summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/hsetroot/default.nix2
-rw-r--r--pkgs/tools/X11/setroot/default.nix4
-rw-r--r--pkgs/tools/X11/srandrd/default.nix2
-rw-r--r--pkgs/tools/X11/xbrightness/default.nix2
-rw-r--r--pkgs/tools/X11/xcwd/default.nix2
-rw-r--r--pkgs/tools/X11/xdotool/default.nix2
-rw-r--r--pkgs/tools/X11/xnee/default.nix2
-rw-r--r--pkgs/tools/X11/xpointerbarrier/default.nix2
-rw-r--r--pkgs/tools/X11/xpra/default.nix4
-rw-r--r--pkgs/tools/X11/xzoom/default.nix2
-rw-r--r--pkgs/tools/admin/aws_shell/default.nix5
-rw-r--r--pkgs/tools/admin/awscli/default.nix22
-rw-r--r--pkgs/tools/admin/azure-cli/default.nix4
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix31
-rw-r--r--pkgs/tools/admin/berglas/default.nix8
-rw-r--r--pkgs/tools/admin/bubblewrap/default.nix4
-rw-r--r--pkgs/tools/admin/certbot/0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch18
-rw-r--r--pkgs/tools/admin/certbot/0001-pebble_artifacts-hardcode-pebble-location.patch24
-rw-r--r--pkgs/tools/admin/certbot/default.nix22
-rw-r--r--pkgs/tools/admin/fastlane/default.nix14
-rw-r--r--pkgs/tools/admin/salt/default.nix2
-rw-r--r--pkgs/tools/admin/simp_le/default.nix4
-rw-r--r--pkgs/tools/archivers/afio/default.nix2
-rw-r--r--pkgs/tools/archivers/undmg/default.nix2
-rw-r--r--pkgs/tools/archivers/unzip/default.nix14
-rw-r--r--pkgs/tools/archivers/zip/default.nix7
-rw-r--r--pkgs/tools/audio/gvolicon/default.nix2
-rw-r--r--pkgs/tools/audio/trx/default.nix15
-rw-r--r--pkgs/tools/backup/lvmsync/default.nix25
-rw-r--r--pkgs/tools/cd-dvd/cdrdao/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/cdrkit/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/isomd5sum/default.nix2
-rw-r--r--pkgs/tools/cd-dvd/vobcopy/default.nix2
-rw-r--r--pkgs/tools/compression/pbzip2/default.nix2
-rw-r--r--pkgs/tools/compression/zstd/default.nix51
-rw-r--r--pkgs/tools/filesystems/bees/default.nix4
-rw-r--r--pkgs/tools/filesystems/blobfuse/default.nix2
-rw-r--r--pkgs/tools/filesystems/ciopfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/fatresize/default.nix4
-rw-r--r--pkgs/tools/filesystems/glusterfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/irods/default.nix7
-rw-r--r--pkgs/tools/filesystems/moosefs/default.nix4
-rw-r--r--pkgs/tools/filesystems/mtdutils/default.nix9
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix2
-rw-r--r--pkgs/tools/filesystems/sasquatch/default.nix2
-rw-r--r--pkgs/tools/filesystems/squashfs/default.nix2
-rw-r--r--pkgs/tools/filesystems/sshfs-fuse/default.nix14
-rw-r--r--pkgs/tools/graphics/appleseed/default.nix3
-rw-r--r--pkgs/tools/graphics/argyllcms/default.nix6
-rw-r--r--pkgs/tools/graphics/asymptote/default.nix2
-rw-r--r--pkgs/tools/graphics/dpic/default.nix2
-rw-r--r--pkgs/tools/graphics/fim/default.nix2
-rw-r--r--pkgs/tools/graphics/gifsicle/default.nix7
-rw-r--r--pkgs/tools/graphics/gnuplot/default.nix7
-rw-r--r--pkgs/tools/graphics/graphviz/base.nix2
-rw-r--r--pkgs/tools/graphics/kst/default.nix2
-rw-r--r--pkgs/tools/graphics/nifskope/default.nix2
-rw-r--r--pkgs/tools/graphics/nifskope/no-sse-on-arm.patch19
-rw-r--r--pkgs/tools/graphics/pfstools/default.nix4
-rw-r--r--pkgs/tools/graphics/pngcheck/default.nix2
-rw-r--r--pkgs/tools/graphics/quirc/default.nix2
-rw-r--r--pkgs/tools/graphics/zbar/default.nix2
-rw-r--r--pkgs/tools/inputmethods/fcitx/unwrapped.nix28
-rw-r--r--pkgs/tools/misc/automirror/default.nix2
-rw-r--r--pkgs/tools/misc/bash_unit/default.nix27
-rw-r--r--pkgs/tools/misc/bibtool/default.nix2
-rw-r--r--pkgs/tools/misc/bonfire/default.nix7
-rw-r--r--pkgs/tools/misc/chezmoi/default.nix4
-rw-r--r--pkgs/tools/misc/ckb-next/default.nix7
-rw-r--r--pkgs/tools/misc/ckb-next/install-dirs.patch37
-rw-r--r--pkgs/tools/misc/ckb-next/modprobe.patch36
-rw-r--r--pkgs/tools/misc/ckb-next/systemd-service.patch45
-rw-r--r--pkgs/tools/misc/cpulimit/default.nix7
-rw-r--r--pkgs/tools/misc/dylibbundler/default.nix2
-rw-r--r--pkgs/tools/misc/ent/default.nix2
-rw-r--r--pkgs/tools/misc/entr/default.nix4
-rw-r--r--pkgs/tools/misc/fdupes/default.nix2
-rw-r--r--pkgs/tools/misc/ffsend/default.nix6
-rw-r--r--pkgs/tools/misc/file/default.nix17
-rw-r--r--pkgs/tools/misc/fondu/default.nix2
-rw-r--r--pkgs/tools/misc/fontforge/default.nix2
-rw-r--r--pkgs/tools/misc/fselect/default.nix8
-rw-r--r--pkgs/tools/misc/fzf/default.nix6
-rw-r--r--pkgs/tools/misc/fzy/default.nix2
-rw-r--r--pkgs/tools/misc/heimdall/default.nix3
-rw-r--r--pkgs/tools/misc/ldmtool/default.nix52
-rw-r--r--pkgs/tools/misc/lf/default.nix4
-rw-r--r--pkgs/tools/misc/man-db/default.nix4
-rw-r--r--pkgs/tools/misc/memtest86+/default.nix2
-rw-r--r--pkgs/tools/misc/mktorrent/default.nix10
-rw-r--r--pkgs/tools/misc/moreutils/default.nix4
-rw-r--r--pkgs/tools/misc/multitail/default.nix2
-rw-r--r--pkgs/tools/misc/neo-cowsay/default.nix24
-rw-r--r--pkgs/tools/misc/onefetch/default.nix14
-rw-r--r--pkgs/tools/misc/osm2pgsql/default.nix2
-rw-r--r--pkgs/tools/misc/pal/default.nix2
-rw-r--r--pkgs/tools/misc/parcellite/default.nix2
-rw-r--r--pkgs/tools/misc/pws/default.nix18
-rw-r--r--pkgs/tools/misc/qjoypad/default.nix2
-rw-r--r--pkgs/tools/misc/reredirect/default.nix29
-rw-r--r--pkgs/tools/misc/snapper/default.nix4
-rw-r--r--pkgs/tools/misc/starship/default.nix6
-rw-r--r--pkgs/tools/misc/svtplay-dl/default.nix2
-rw-r--r--pkgs/tools/misc/teleconsole/default.nix2
-rw-r--r--pkgs/tools/misc/timidity/default.nix2
-rw-r--r--pkgs/tools/misc/tmpwatch/default.nix2
-rw-r--r--pkgs/tools/misc/tmux-xpanes/default.nix33
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/toybox/default.nix2
-rw-r--r--pkgs/tools/misc/tty-clock/default.nix2
-rw-r--r--pkgs/tools/misc/txr/default.nix9
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix8
-rw-r--r--pkgs/tools/misc/vmtouch/default.nix2
-rw-r--r--pkgs/tools/misc/wob/default.nix6
-rw-r--r--pkgs/tools/misc/wyrd/default.nix2
-rw-r--r--pkgs/tools/misc/xdo/default.nix2
-rw-r--r--pkgs/tools/misc/xsel/default.nix6
-rw-r--r--pkgs/tools/networking/altermime/default.nix3
-rw-r--r--pkgs/tools/networking/atinout/default.nix2
-rw-r--r--pkgs/tools/networking/bandwhich/default.nix32
-rw-r--r--pkgs/tools/networking/bwm-ng/default.nix4
-rw-r--r--pkgs/tools/networking/chrony/default.nix2
-rw-r--r--pkgs/tools/networking/cjdns/default.nix2
-rw-r--r--pkgs/tools/networking/clash/default.nix29
-rw-r--r--pkgs/tools/networking/corerad/default.nix24
-rw-r--r--pkgs/tools/networking/dhcp/default.nix8
-rw-r--r--pkgs/tools/networking/dhcpcd/default.nix10
-rw-r--r--pkgs/tools/networking/eternal-terminal/default.nix4
-rw-r--r--pkgs/tools/networking/findomain/default.nix37
-rw-r--r--pkgs/tools/networking/frp/default.nix4
-rw-r--r--pkgs/tools/networking/iodine/default.nix2
-rw-r--r--pkgs/tools/networking/ipv6calc/default.nix10
-rw-r--r--pkgs/tools/networking/libreswan/default.nix3
-rw-r--r--pkgs/tools/networking/maphosts/default.nix6
-rw-r--r--pkgs/tools/networking/mcrcon/default.nix4
-rw-r--r--pkgs/tools/networking/miniupnpc/default.nix5
-rw-r--r--pkgs/tools/networking/network-manager/iodine/default.nix2
-rw-r--r--pkgs/tools/networking/network-manager/strongswan.nix2
-rw-r--r--pkgs/tools/networking/nfstrace/default.nix9
-rw-r--r--pkgs/tools/networking/ngrok-2/default.nix2
-rw-r--r--pkgs/tools/networking/ntopng/default.nix4
-rw-r--r--pkgs/tools/networking/openresolv/default.nix2
-rw-r--r--pkgs/tools/networking/openssh/default.nix12
-rw-r--r--pkgs/tools/networking/packetdrill/default.nix6
-rw-r--r--pkgs/tools/networking/ratools/default.nix2
-rw-r--r--pkgs/tools/networking/shadowfox/default.nix2
-rw-r--r--pkgs/tools/networking/shorewall/default.nix130
-rw-r--r--pkgs/tools/networking/snabb/default.nix2
-rw-r--r--pkgs/tools/networking/ssmtp/default.nix4
-rw-r--r--pkgs/tools/networking/tracebox/default.nix2
-rw-r--r--pkgs/tools/networking/traceroute/default.nix2
-rw-r--r--pkgs/tools/networking/uwimap/default.nix8
-rw-r--r--pkgs/tools/networking/v2ray/default.nix12
-rw-r--r--pkgs/tools/networking/vde2/default.nix2
-rw-r--r--pkgs/tools/networking/wireguard-go/0001-Fix-darwin-build.patch26
-rw-r--r--pkgs/tools/networking/wireguard-go/default.nix6
-rw-r--r--pkgs/tools/networking/wireguard-go/deps.nix12
-rw-r--r--pkgs/tools/networking/wireguard-tools/default.nix12
-rw-r--r--pkgs/tools/networking/wrk/default.nix6
-rw-r--r--pkgs/tools/networking/zerotierone/default.nix15
-rw-r--r--pkgs/tools/package-management/cargo-release/default.nix11
-rw-r--r--pkgs/tools/package-management/clib/default.nix2
-rw-r--r--pkgs/tools/package-management/home-manager/default.nix6
-rw-r--r--pkgs/tools/package-management/librepo/default.nix2
-rw-r--r--pkgs/tools/package-management/nix/default.nix10
-rw-r--r--pkgs/tools/package-management/opkg/default.nix4
-rw-r--r--pkgs/tools/package-management/reuse/default.nix4
-rw-r--r--pkgs/tools/package-management/xbps/default.nix2
-rw-r--r--pkgs/tools/security/afl/README.md4
-rw-r--r--pkgs/tools/security/afl/default.nix12
-rw-r--r--pkgs/tools/security/afl/libdislocator.nix2
-rw-r--r--pkgs/tools/security/afl/qemu-patches/qemu-2.10.0-glibc-2.27.patch28
-rw-r--r--pkgs/tools/security/afl/qemu.nix18
-rw-r--r--pkgs/tools/security/aws-okta/default.nix6
-rw-r--r--pkgs/tools/security/bitwarden-cli/default.nix18
-rwxr-xr-xpkgs/tools/security/bitwarden-cli/generate.sh8
-rw-r--r--pkgs/tools/security/bitwarden-cli/node-packages-generated.nix1407
-rw-r--r--pkgs/tools/security/bitwarden-cli/node-packages.json3
-rw-r--r--pkgs/tools/security/bitwarden-cli/node-packages.nix17
-rw-r--r--pkgs/tools/security/crunch/default.nix2
-rw-r--r--pkgs/tools/security/fail2ban/default.nix27
-rw-r--r--pkgs/tools/security/fwknop/default.nix4
-rw-r--r--pkgs/tools/security/gpgstats/default.nix4
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix4
-rw-r--r--pkgs/tools/security/meo/default.nix2
-rw-r--r--pkgs/tools/security/monkeysphere/default.nix8
-rw-r--r--pkgs/tools/security/nitrokey-app/default.nix2
-rw-r--r--pkgs/tools/security/opensc/default.nix22
-rw-r--r--pkgs/tools/security/pass/extensions/genphrase.nix2
-rw-r--r--pkgs/tools/security/pbis/default.nix2
-rw-r--r--pkgs/tools/security/phrasendrescher/default.nix2
-rw-r--r--pkgs/tools/security/proxmark3/default.nix78
-rw-r--r--pkgs/tools/security/rarcrack/default.nix4
-rw-r--r--pkgs/tools/security/rhash/default.nix7
-rw-r--r--pkgs/tools/security/spectre-meltdown-checker/default.nix4
-rw-r--r--pkgs/tools/security/step-ca/default.nix25
-rw-r--r--pkgs/tools/security/step-ca/deps.nix291
-rw-r--r--pkgs/tools/security/sudo/default.nix10
-rw-r--r--pkgs/tools/security/super/default.nix2
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/system/clinfo/default.nix2
-rw-r--r--pkgs/tools/system/ctop/default.nix12
-rw-r--r--pkgs/tools/system/ctop/go-1.13-deps.patch90
-rw-r--r--pkgs/tools/system/daemon/default.nix2
-rw-r--r--pkgs/tools/system/di/default.nix4
-rw-r--r--pkgs/tools/system/efivar/default.nix10
-rw-r--r--pkgs/tools/system/facter/default.nix4
-rw-r--r--pkgs/tools/system/fcron/default.nix2
-rw-r--r--pkgs/tools/system/gdmap/default.nix4
-rw-r--r--pkgs/tools/system/ioping/default.nix2
-rw-r--r--pkgs/tools/system/ipmitool/default.nix2
-rw-r--r--pkgs/tools/system/lr/default.nix6
-rw-r--r--pkgs/tools/system/netdata/default.nix14
-rw-r--r--pkgs/tools/system/netdata/no-files-in-etc-and-var.patch98
-rw-r--r--pkgs/tools/system/nq/default.nix2
-rw-r--r--pkgs/tools/system/opencl-info/default.nix2
-rw-r--r--pkgs/tools/system/pciutils/default.nix2
-rw-r--r--pkgs/tools/system/rowhammer-test/default.nix2
-rw-r--r--pkgs/tools/system/rsyslog/default.nix4
-rw-r--r--pkgs/tools/system/setserial/default.nix2
-rw-r--r--pkgs/tools/system/stress-ng/default.nix2
-rw-r--r--pkgs/tools/system/testdisk/default.nix2
-rw-r--r--pkgs/tools/system/uefitool/common.nix39
-rw-r--r--pkgs/tools/system/uefitool/variants.nix15
-rw-r--r--pkgs/tools/system/vboot_reference/default.nix3
-rw-r--r--pkgs/tools/system/xe/default.nix2
-rw-r--r--pkgs/tools/text/ansifilter/default.nix2
-rw-r--r--pkgs/tools/text/gawk/default.nix4
-rw-r--r--pkgs/tools/text/mdcat/default.nix2
-rw-r--r--pkgs/tools/text/multitran/libmtquery/default.nix4
-rw-r--r--pkgs/tools/text/reckon/default.nix14
-rw-r--r--pkgs/tools/text/replace/default.nix2
-rw-r--r--pkgs/tools/text/sgml/jade/default.nix2
-rw-r--r--pkgs/tools/text/smu/default.nix4
-rw-r--r--pkgs/tools/text/untex/default.nix4
-rw-r--r--pkgs/tools/text/zimreader/default.nix2
-rw-r--r--pkgs/tools/typesetting/asciidoc/default.nix2
-rw-r--r--pkgs/tools/typesetting/hevea/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/combine.nix7
-rw-r--r--pkgs/tools/video/bento4/default.nix4
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix2
-rw-r--r--pkgs/tools/video/rav1e/default.nix17
-rw-r--r--pkgs/tools/video/vncrec/default.nix2
-rw-r--r--pkgs/tools/video/yamdi/default.nix2
244 files changed, 1580 insertions, 2323 deletions
diff --git a/pkgs/tools/X11/hsetroot/default.nix b/pkgs/tools/X11/hsetroot/default.nix
index 239dfa0963b..6bae355812c 100644
--- a/pkgs/tools/X11/hsetroot/default.nix
+++ b/pkgs/tools/X11/hsetroot/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   patches = [ underlinkingPatch ];
 
-  patchFlags = "-p0";
+  patchFlags = [ "-p0" ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/X11/setroot/default.nix b/pkgs/tools/X11/setroot/default.nix
index bb113c90849..a9b5f17af83 100644
--- a/pkgs/tools/X11/setroot/default.nix
+++ b/pkgs/tools/X11/setroot/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 imlib2 ]
     ++ stdenv.lib.optional enableXinerama libXinerama;
 
-  buildFlags = "CC=cc " + (if enableXinerama then "xinerama=1" else "xinerama=0");
+  buildFlags = [ "CC=cc" (if enableXinerama then "xinerama=1" else "xinerama=0") ] ;
 
-  installFlags = "DESTDIR=$(out) PREFIX=";
+  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
   meta = with stdenv.lib; {
     description = "Simple X background setter inspired by imlibsetroot and feh";
diff --git a/pkgs/tools/X11/srandrd/default.nix b/pkgs/tools/X11/srandrd/default.nix
index af9394a84fa..6d5fa0f3d98 100644
--- a/pkgs/tools/X11/srandrd/default.nix
+++ b/pkgs/tools/X11/srandrd/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libX11 libXrandr libXinerama ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/jceb/srandrd";
diff --git a/pkgs/tools/X11/xbrightness/default.nix b/pkgs/tools/X11/xbrightness/default.nix
index 2857ea6c7be..e196411ce41 100644
--- a/pkgs/tools/X11/xbrightness/default.nix
+++ b/pkgs/tools/X11/xbrightness/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   buildInputs = [ libX11 libXaw libXext libXmu libXpm libXxf86vm ];
 
   makeFlags = [ "BINDIR=$(out)/bin" "MANPATH=$(out)/share/man" ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     description = "X11 brigthness and gamma software control";
diff --git a/pkgs/tools/X11/xcwd/default.nix b/pkgs/tools/X11/xcwd/default.nix
index 48cab6529cc..d50a7c006c8 100644
--- a/pkgs/tools/X11/xcwd/default.nix
+++ b/pkgs/tools/X11/xcwd/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libX11 ];
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   installPhase = ''
     install -D xcwd "$out/bin/xcwd"
diff --git a/pkgs/tools/X11/xdotool/default.nix b/pkgs/tools/X11/xdotool/default.nix
index d20714befba..6fa185dfeab 100644
--- a/pkgs/tools/X11/xdotool/default.nix
+++ b/pkgs/tools/X11/xdotool/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
   '';
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     homepage = https://www.semicomplete.com/projects/xdotool/;
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index b5350ebecf7..f8f48ea4cdb 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   # `cnee' is linked without `-lXi' and as a consequence has a RUNPATH that
   # lacks libXi.
-  makeFlags = "LDFLAGS=-lXi";
+  makeFlags = [ "LDFLAGS=-lXi" ];
 
   # XXX: Actually tests require an X server.
   doCheck = true;
diff --git a/pkgs/tools/X11/xpointerbarrier/default.nix b/pkgs/tools/X11/xpointerbarrier/default.nix
index dfac2cf88a5..4dbe31df03c 100644
--- a/pkgs/tools/X11/xpointerbarrier/default.nix
+++ b/pkgs/tools/X11/xpointerbarrier/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ xorg.libX11 xorg.libXfixes xorg.libXrandr ];
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = {
     homepage = https://uninformativ.de/git/xpointerbarrier;
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index ffede7d58b2..da7bfb445a9 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -60,10 +60,8 @@ in buildPythonApplication rec {
     ipaddress idna
   ];
 
-  NIX_CFLAGS_COMPILE = [
     # error: 'import_cairo' defined but not used
-    "-Wno-error=unused-function"
-  ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
   setupPyBuildFlags = [
     "--with-Xdummy"
diff --git a/pkgs/tools/X11/xzoom/default.nix b/pkgs/tools/X11/xzoom/default.nix
index 31f2c014557..ed7828f37e2 100644
--- a/pkgs/tools/X11/xzoom/default.nix
+++ b/pkgs/tools/X11/xzoom/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "BINDIR=$(out)/bin"
     "MANPATH=$(out)/share/man"
   ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     inherit version;
diff --git a/pkgs/tools/admin/aws_shell/default.nix b/pkgs/tools/admin/aws_shell/default.nix
index 95f1df39576..b9169691808 100644
--- a/pkgs/tools/admin/aws_shell/default.nix
+++ b/pkgs/tools/admin/aws_shell/default.nix
@@ -23,6 +23,11 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+     --replace "prompt-toolkit>=1.0.0,<1.1.0" "prompt-toolkit"
+  '';
+
   #Checks are failing due to missing TTY, which won't exist.
   doCheck = false;
   preCheck = ''
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index b3af7f9bd6e..f38d4cd1a1d 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -7,20 +7,30 @@
 let
   py = python3.override {
     packageOverrides = self: super: {
-      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.1";
+      rsa = super.rsa.overridePythonAttrs (oldAttrs: rec {
+        version = "3.4.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "05eed71e2e327246ad6b38c540c4a3117230b19679b875190486ddd2d721422d";
+          sha256 = "25df4e10c263fb88b5ace923dd84bf9aa7f5019687b5e55382ffcdb8bede9db5";
         };
       });
-      rsa = super.rsa.overridePythonAttrs (oldAttrs: rec {
-        version = "3.4.2";
+
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "5.1.2";
         src = oldAttrs.src.override {
           inherit version;
-          sha256 = "25df4e10c263fb88b5ace923dd84bf9aa7f5019687b5e55382ffcdb8bede9db5";
+          sha256 = "1r5faspz73477hlbjgilw05xsms0glmsa371yqdd26znqsvg1b81";
         };
       });
+
+      colorama = super.colorama.overridePythonAttrs (oldAttrs: rec {
+        version = "0.4.1";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "0ba247bx5pc60hcpbf3rjsqk0whilg241i9qdfnlcwij5qgdgvh5";
+        };
+      });
+
     };
   };
 
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index b28ef88ad99..69eae818c3b 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, python, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.0.77";
+  version = "2.0.78";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "1qd6di8cqwhpcsqcx6g3scmwj90m15r695y5977q6a3qy13knisv";
+    sha256 = "095dk5jbri3ydizs0fhfw1lhamvvxwx5smw8mj1bj78b2qsl5xh3";
   };
 
   # put packages that needs to be overriden in the py package scope
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index 529bc4d50d3..01355d48d5c 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -114,8 +114,8 @@ let
       azure-mgmt-recoveryservicesbackup = overrideAzureMgmtPackage super.azure-mgmt-recoveryservicesbackup "0.4.0" "zip"
         "0zssvzdip23yzaxlac9rlzg9mlyjl97fwr0gj8y27z8j58pwj72i";
 
-      azure-mgmt-resource = overrideAzureMgmtPackage super.azure-mgmt-resource "4.0.0" "zip"
-        "0gy89bi89ikg5hps8rvnq28r33lixci3sk2m86jvziv9fh9rz41b";
+      azure-mgmt-resource = overrideAzureMgmtPackage super.azure-mgmt-resource "6.0.0" "zip"
+        "08n6r6ja7p20qlhb9pp51nwwxz2mal19an98zry276i8z5x8ckp0";
 
       azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "10.0.0" "zip"
         "1s3bx6knxw5dxycp43yimvgrh0i19drzd09asglcwz2x5mr3bpyg";
@@ -150,12 +150,18 @@ let
       azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "7.0.0" "zip"
         "0ss5yc9k3dh78lb88nfh3z98yz1pcd8d7d7cfjlxmv4n3dlr1kij";
 
+      azure-mgmt-media = overrideAzureMgmtPackage super.azure-mgmt-media "1.1.1" "zip"
+        "16wk0ksycrscsn3n14qk4vvf7i567vq6f96lwf5dwbc81wx6n32x";
+
       azure-mgmt-msi = overrideAzureMgmtPackage super.azure-mgmt-msi "0.2.0" "zip"
         "0rvik03njz940x2hvqg6iiq8k0d88gyygsr86w8s0sa12sdbq8l6";
 
       azure-mgmt-web = overrideAzureMgmtPackage super.azure-mgmt-web "0.42.0" "zip"
         "0vp40i9aaw5ycz7s7qqir6jq7327f7zg9j9i8g31qkfl1h1c7pdn";
 
+      azure-mgmt-redis = overrideAzureMgmtPackage super.azure-mgmt-redis "7.0.0rc1" "zip"
+        "086wk31wsl8dx14qpd0g1bly8i9a8fix007djlj9cybva2f2bk6k";
+
       azure-mgmt-reservations = overrideAzureMgmtPackage super.azure-mgmt-reservations "0.6.0" "zip"
         "16ycni3cjl9c0mv419gy5rgbrlg8zp0vnr6aj8z8p2ypdw6sgac3";
 
@@ -177,6 +183,9 @@ let
       azure-mgmt-keyvault = overrideAzureMgmtPackage super.azure-mgmt-keyvault "1.1.0" "zip"
         "16a0d3j5dilbp7pd7gbwf8jr46vzbjim1p9alcmisi12m4km7885";
 
+      azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "3.1.0" "zip"
+        "1qvnksmvsg8cw1ac6vbdxjdqsm7s1sak27k8xy24hm7c9a8y1nqc";
+
       azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc7" "zip"
         "1bzfpbz186dhnxn0blgr20xxnk67gkr8ysn2b3f1r41bq9hz97xp";
 
@@ -230,6 +239,24 @@ let
         };
       });
 
+      azure-keyvault = super.azure-keyvault.overrideAttrs(oldAttrs: rec {
+        version = "1.1.0";
+        src = super.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          extension = "zip";
+          sha256 = "0jfxm8lx8dzs3v2b04ljizk8gfckbm5l2v86rm7k0npbfvryba1p";
+        };
+
+        propagatedBuildInputs = with self; [
+          azure-common azure-nspkg msrest msrestazure cryptography
+        ];
+        postInstall = ''
+          rm -f $out/${self.python.sitePackages}/azure/__init__.py
+        '';
+        pythonImportsCheck = [ ];
+      });
+
       # part of azure.mgmt.datalake namespace
       azure-mgmt-datalake-analytics = super.azure-mgmt-datalake-analytics.overrideAttrs(oldAttrs: rec {
         version = "0.2.1";
diff --git a/pkgs/tools/admin/berglas/default.nix b/pkgs/tools/admin/berglas/default.nix
index d75c317187b..aaca67baa16 100644
--- a/pkgs/tools/admin/berglas/default.nix
+++ b/pkgs/tools/admin/berglas/default.nix
@@ -3,16 +3,16 @@
 buildGoModule rec {
 
   name = "berglas-${version}";
-  version = "0.2.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "berglas";
-    rev = "v0.2.1";
-    sha256 = "1m34rxiynmgsris1avjn7am50b8sds77515zlnna9qvsrywbzljc";
+    rev = "v0.5.0";
+    sha256 = "1y5w2czipwj069w4zxnyb9xqv5mx0yjjramykf3vm3q478bk3rm7";
   };
 
-  modSha256 = "0lfcrsb4r5hxxd652cxff23fnbrphp3lgwp5anpaddzcjcd2qyj8";
+  modSha256 = "0y4ajii3pv25s4gjazf6fl0b9wax17cmwhbmiybqhp61annca7kr";
 
   meta = with stdenv.lib; {
     description = "A tool for managing secrets on Google Cloud";
diff --git a/pkgs/tools/admin/bubblewrap/default.nix b/pkgs/tools/admin/bubblewrap/default.nix
index e4b27d98dff..8e2ef7c87e1 100644
--- a/pkgs/tools/admin/bubblewrap/default.nix
+++ b/pkgs/tools/admin/bubblewrap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bubblewrap";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchurl {
     url = "https://github.com/projectatomic/bubblewrap/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "1zsd6rxryg97dkkhibr0fvq16x3s75qj84rvhdv8p42ag58mz966";
+    sha256 = "08r0f4c3fjkb4zjrb4kkax1zfcgcgic702vb62sjjw5xfhppvzp5";
   };
 
   nativeBuildInputs = [ libcap libxslt docbook_xsl ];
diff --git a/pkgs/tools/admin/certbot/0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch b/pkgs/tools/admin/certbot/0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch
index 81c1dd0e6a3..62351a70160 100644
--- a/pkgs/tools/admin/certbot/0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch
+++ b/pkgs/tools/admin/certbot/0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch
@@ -1,6 +1,6 @@
-From 411b8a413baf39e9b967949b17a992e81a11abfe Mon Sep 17 00:00:00 2001
+From 0de195de31dc311976af52a7c2b547bc23af2691 Mon Sep 17 00:00:00 2001
 From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Tue, 29 Oct 2019 14:08:07 +0100
+Date: Sat, 14 Dec 2019 19:27:14 +0100
 Subject: [PATCH] Don't use distutils.StrictVersion that cannot handle certain
  versions
 
@@ -18,13 +18,13 @@ line 137, in parse
 ValueError: invalid version number '41.4.0.post20191022'
 ```
 ---
- setup.py | 15 +--------------
+ certbot/setup.py | 15 +--------------
  1 file changed, 1 insertion(+), 14 deletions(-)
 
-diff --git a/setup.py b/setup.py
-index 1f4838c90..831528d77 100644
---- a/setup.py
-+++ b/setup.py
+diff --git a/certbot/setup.py b/certbot/setup.py
+index c1bf914..7456bf2 100644
+--- a/certbot/setup.py
++++ b/certbot/setup.py
 @@ -3,7 +3,6 @@ import os
  import re
  import sys
@@ -40,7 +40,7 @@ index 1f4838c90..831528d77 100644
 -# However environment markers are supported only with setuptools >= 36.2.
 -# So this dependency is not added for old Linux distributions with old setuptools,
 -# in order to allow these systems to build certbot from sources.
- pywin32_req = 'pywin32>=224'
+ pywin32_req = 'pywin32>=227'  # do not forget to edit pywin32 dependency accordingly in windows-installer/construct.py
 -if StrictVersion(setuptools_version) >= StrictVersion('36.2'):
 -    install_requires.append(pywin32_req + " ; sys_platform == 'win32'")
 -elif 'bdist_wheel' in sys.argv[1:]:
@@ -56,5 +56,5 @@ index 1f4838c90..831528d77 100644
  dev_extras = [
      'astroid==1.6.5',
 -- 
-2.23.0
+2.24.1
 
diff --git a/pkgs/tools/admin/certbot/0001-pebble_artifacts-hardcode-pebble-location.patch b/pkgs/tools/admin/certbot/0001-pebble_artifacts-hardcode-pebble-location.patch
deleted file mode 100644
index 33f0cd216c1..00000000000
--- a/pkgs/tools/admin/certbot/0001-pebble_artifacts-hardcode-pebble-location.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 8ddf2697508eca514a0dde4646ad14ac3ba34b2a Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Fri, 18 Oct 2019 16:06:50 +0200
-Subject: [PATCH] pebble_artifacts: hardcode pebble location
-
----
- certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py b/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py
-index 2b1557928..d2603c51a 100644
---- a/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py
-+++ b/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py
-@@ -22,6 +22,7 @@ def fetch(workspace):
- 
- 
- def _fetch_asset(asset, suffix):
-+    return "@pebble@"
-     asset_path = os.path.join(ASSETS_PATH, '{0}_{1}_{2}'.format(asset, PEBBLE_VERSION, suffix))
-     if not os.path.exists(asset_path):
-         asset_url = ('https://github.com/letsencrypt/pebble/releases/download/{0}/{1}_{2}'
--- 
-2.23.0
-
diff --git a/pkgs/tools/admin/certbot/default.nix b/pkgs/tools/admin/certbot/default.nix
index 7d3d019e81f..8fdbfd12778 100644
--- a/pkgs/tools/admin/certbot/default.nix
+++ b/pkgs/tools/admin/certbot/default.nix
@@ -1,19 +1,18 @@
-{ stdenv, python37Packages, fetchFromGitHub, fetchurl, dialog, autoPatchelfHook, nginx, pebble }:
+{ stdenv, python37Packages, fetchFromGitHub, fetchurl, dialog, autoPatchelfHook }:
 
 
 python37Packages.buildPythonApplication rec {
   pname = "certbot";
-  version = "0.39.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1s32xg2ljz7ci78wc8rqkjvgrz7vprb7fkznrlf9a4blm55pp54c";
+    sha256 = "180x7gcpfbrzw8k654s7b5nxdy2yg61lq513dykyn3wz4gssw465";
   };
 
   patches = [
-    ./0001-pebble_artifacts-hardcode-pebble-location.patch
     ./0001-Don-t-use-distutils.StrictVersion-that-cannot-handle.patch
   ];
 
@@ -43,9 +42,8 @@ python37Packages.buildPythonApplication rec {
   ];
 
   postPatch = ''
-    substituteInPlace certbot/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/bin/sendmail"
-    substituteInPlace certbot/util.py --replace "sw_vers" "/usr/bin/sw_vers"
-    substituteInPlace certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py --replace "@pebble@" "${pebble}/bin/pebble"
+    cd certbot
+    substituteInPlace certbot/_internal/notify.py --replace "/usr/sbin/sendmail" "/run/wrappers/bin/sendmail"
   '';
 
   postInstall = ''
@@ -55,15 +53,7 @@ python37Packages.buildPythonApplication rec {
     done
   '';
 
-  # tests currently time out, because they're trying to do network access
-  # Upstream issue: https://github.com/certbot/certbot/issues/7450
-  doCheck = false;
-
-  checkPhase = ''
-    PATH="$out/bin:${nginx}/bin:$PATH" pytest certbot-ci/certbot_integration_tests
-  '';
-
-  dontUseSetuptoolsCheck = true;
+  doCheck = true;
 
   meta = with stdenv.lib; {
     homepage = src.meta.homepage;
diff --git a/pkgs/tools/admin/fastlane/default.nix b/pkgs/tools/admin/fastlane/default.nix
index afb044ad583..1cdc969ea2e 100644
--- a/pkgs/tools/admin/fastlane/default.nix
+++ b/pkgs/tools/admin/fastlane/default.nix
@@ -6,15 +6,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-    inherit pname ruby;
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+      inherit pname ruby;
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/fastlane $out/bin/fastlane \
      --set FASTLANE_SKIP_UPDATE_CHECK 1
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 13bba0860c4..c94686c93c1 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
     pyzmq
     requests
     tornado_4
-  ] ++ stdenv.lib.optional (!pythonPackages.isPy3k) [
+  ] ++ stdenv.lib.optionals (!pythonPackages.isPy3k) [
     futures
   ] ++ extraInputs;
 
diff --git a/pkgs/tools/admin/simp_le/default.nix b/pkgs/tools/admin/simp_le/default.nix
index 37f627a18f5..eaefba36545 100644
--- a/pkgs/tools/admin/simp_le/default.nix
+++ b/pkgs/tools/admin/simp_le/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "simp_le-client";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "17azqlb1xsnh9p0m75apb19j7pramgj00cf5k6fwzz2zqz0x0hpp";
+    sha256 = "0m1jynar4calaffp2zdxr5yy9vnhw2qf2hsfxwzfwf8fqb5h7bjb";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/archivers/afio/default.nix b/pkgs/tools/archivers/afio/default.nix
index 13da95a28b5..8d1e28fed29 100644
--- a/pkgs/tools/archivers/afio/default.nix
+++ b/pkgs/tools/archivers/afio/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    */
   patches = [ ./0001-makefile-fix-installation.patch ];
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = {
     homepage = http://members.chello.nl/~k.holtman/afio.html;
diff --git a/pkgs/tools/archivers/undmg/default.nix b/pkgs/tools/archivers/undmg/default.nix
index 9d072c9bb19..72be49d9792 100644
--- a/pkgs/tools/archivers/undmg/default.nix
+++ b/pkgs/tools/archivers/undmg/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/matthewbauer/undmg;
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index 7bbcc906292..b8f649fbdcb 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  patchFlags = "-p1 -F3";
+  patchFlags = [ "-p1" "-F3" ];
 
   patches = [
     ./CVE-2014-8139.diff
@@ -53,15 +53,21 @@ stdenv.mkDerivation {
 
   makefile = "unix/Makefile";
 
-  NIX_LDFLAGS = [ "-lbz2" ] ++ stdenv.lib.optional enableNLS "-lnatspec";
+  NIX_LDFLAGS = "-lbz2" + stdenv.lib.optionalString enableNLS " -lnatspec";
 
-  buildFlags = "generic D_USE_BZ2=-DUSE_BZIP2 L_BZ2=-lbz2";
+  buildFlags = [
+    "generic"
+    "D_USE_BZ2=-DUSE_BZIP2"
+    "L_BZ2=-lbz2"
+  ];
 
   preConfigure = ''
     sed -i -e 's@CF="-O3 -Wall -I. -DASM_CRC $(LOC)"@CF="-O3 -Wall -I. -DASM_CRC -DLARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 $(LOC)"@' unix/Makefile
   '';
 
-  installFlags = "prefix=$(out)";
+  installFlags = [
+    "prefix=${placeholder ''out''}"
+  ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/archivers/zip/default.nix b/pkgs/tools/archivers/zip/default.nix
index 20d85405bba..09ba6510707 100644
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@@ -19,8 +19,11 @@ stdenv.mkDerivation {
   hardeningDisable = [ "format" ];
 
   makefile = "unix/Makefile";
-  buildFlags = if stdenv.isCygwin then "cygwin" else "generic";
-  installFlags = "prefix=$(out) INSTALL=cp";
+  buildFlags = if stdenv.isCygwin then [ "cygwin" ] else [ "generic" ];
+  installFlags = [
+    "prefix=${placeholder ''out''}"
+    "INSTALL=cp"
+  ];
 
   patches = if (enableNLS && !stdenv.isCygwin) then [ ./natspec-gentoo.patch.bz2 ] else [];
 
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index c66c6bc1f7e..9029eb38b06 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  NIX_CFLAGS_COMPILE = [ "-D_POSIX_C_SOURCE" ];
+  NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE";
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/audio/trx/default.nix b/pkgs/tools/audio/trx/default.nix
index 5d31193ee8d..1d052adbba9 100644
--- a/pkgs/tools/audio/trx/default.nix
+++ b/pkgs/tools/audio/trx/default.nix
@@ -1,13 +1,12 @@
-{ stdenv, fetchgit, alsaLib, libopus, ortp, bctoolbox }:
+{ stdenv, fetchurl, alsaLib, libopus, ortp, bctoolbox }:
 
-stdenv.mkDerivation {
-  pname = "trx-unstable";
-  version = "2018-01-23";
+stdenv.mkDerivation rec {
+  pname = "trx";
+  version = "0.4";
 
-  src = fetchgit {
-    url = "http://www.pogo.org.uk/~mark/trx.git";
-    rev = "66b4707a24172751a131e24d2a800496c699137f";
-    sha256 = "0w0960p25944b30lkc8n4lj14xgsf0fjpmxqwlz2r8wl642bqnfm";
+  src = fetchurl {
+    url = "https://www.pogo.org.uk/~mark/trx/releases/${pname}-${version}.tar.gz";
+    sha256 = "1wsrkbqc090px8i9p8awz38znxjcqjb1dzjjdd8xkjmiprayjhkl";
   };
 
   buildInputs = [ alsaLib libopus ortp bctoolbox ];
diff --git a/pkgs/tools/backup/lvmsync/default.nix b/pkgs/tools/backup/lvmsync/default.nix
index 8c23d804d0b..a52c6bf1ba7 100644
--- a/pkgs/tools/backup/lvmsync/default.nix
+++ b/pkgs/tools/backup/lvmsync/default.nix
@@ -1,27 +1,22 @@
 { stdenv, bundlerEnv, ruby, bundlerUpdateScript, makeWrapper }:
 
-let
-
+stdenv.mkDerivation rec {
   pname = "lvmsync";
   version = (import ./gemset.nix).${pname}.version;
 
-in stdenv.mkDerivation rec {
-
-  name = "${pname}-${version}";
-
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-    ruby = ruby;
-    gemfile  = ./Gemfile;
-    lockfile = ./Gemfile.lock;
-    gemset   = ./gemset.nix;
-  };
-
   buildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+      ruby = ruby;
+      gemfile  = ./Gemfile;
+      lockfile = ./Gemfile.lock;
+      gemset   = ./gemset.nix;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/lvmsync $out/bin/lvmsync
   '';
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index a17b0302503..908808b79f3 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "0pmpgx91j984snrsxbq1dgf3ximks2dfh1sqqmic72lrls7wp4w1";
   };
 
-  makeFlags = "RM=rm LN=ln MV=mv";
+  makeFlags = [ "RM=rm" "LN=ln" "MV=mv" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libvorbis libmad libao ];
diff --git a/pkgs/tools/cd-dvd/cdrkit/default.nix b/pkgs/tools/cd-dvd/cdrkit/default.nix
index 81bd4f60f43..7de086dba60 100644
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ln -s $out/bin/wodim $out/bin/cdrecord
   '';
 
-  makeFlags = "PREFIX=\$(out)";
+  makeFlags = [ "PREFIX=\$(out)" ];
 
   meta = {
     description = "Portable command-line CD/DVD recorder software, mostly compatible with cdrtools";
diff --git a/pkgs/tools/cd-dvd/isomd5sum/default.nix b/pkgs/tools/cd-dvd/isomd5sum/default.nix
index 90315540aba..3bc1f886ccd 100644
--- a/pkgs/tools/cd-dvd/isomd5sum/default.nix
+++ b/pkgs/tools/cd-dvd/isomd5sum/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   # we don't install python stuff as it borks up directories
-  installTargets = "install-bin install-devel";
+  installTargets = [ "install-bin" "install-devel" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/rhinstaller/isomd5sum;
diff --git a/pkgs/tools/cd-dvd/vobcopy/default.nix b/pkgs/tools/cd-dvd/vobcopy/default.nix
index f181ab71edf..48a58c0c7d1 100644
--- a/pkgs/tools/cd-dvd/vobcopy/default.nix
+++ b/pkgs/tools/cd-dvd/vobcopy/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [libdvdread libdvdcss];
-  makeFlags   = "DESTDIR=$(out) PREFIX=/";
+  makeFlags   = [ "DESTDIR=$(out)" "PREFIX=/" ];
 
   meta = {
     description = "Copies DVD .vob files to harddisk, decrypting them on the way";
diff --git a/pkgs/tools/compression/pbzip2/default.nix b/pkgs/tools/compression/pbzip2/default.nix
index 94ca5eb58b1..3314544084f 100644
--- a/pkgs/tools/compression/pbzip2/default.nix
+++ b/pkgs/tools/compression/pbzip2/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   preBuild = "substituteInPlace Makefile --replace g++ c++";
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
 
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index a3aecf88c90..82a6a3a8a53 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, fetchFromGitHub, fetchpatch, gnugrep
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, gnugrep
 , fixDarwinDylibNames
 , file
-, legacySupport ? false }:
+, legacySupport ? false
+, enableShared ? true }:
 
 stdenv.mkDerivation rec {
   pname = "zstd";
@@ -14,56 +15,46 @@ stdenv.mkDerivation rec {
     owner = "facebook";
   };
 
+  nativeBuildInputs = [ cmake ]
+   ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
   patches = [
-    # All 3 from https://github.com/facebook/zstd/pull/1883
+    # From https://github.com/facebook/zstd/pull/1883
     (fetchpatch {
       url = "https://github.com/facebook/zstd/commit/106278e7e5fafaea3b7deb4147bdc8071562d2f0.diff";
       sha256 = "13z7id1qbc05cv1rmak7c8xrchp7jh1i623bq5pwcihg57wzcyr8";
     })
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/commit/0ede342acc2c26f87ae962fa88e158904d4198c4.diff";
-      sha256 = "12l5xbvnzkvr76mvl1ls767paqfwbd9q1pzq44ckacfpz4f6iaap";
-      excludes = [
-        # I think line endings are causing problems, or something like that
-        "programs/windres/generate_res.bat"
-      ];
-    })
-    (fetchpatch {
-      url = "https://github.com/facebook/zstd/commit/10552eaffef84c011f67af0e04f0780b50a5ab26.diff";
-      sha256 = "1s27ravar3rn7q8abybp9733jhpsfcaci51k04da94ahahvxwiqw";
-    })
   ] # This I didn't upstream because if you use posix threads with MinGW it will
     # work find, and I'm not sure how to write the condition.
     ++ stdenv.lib.optional stdenv.hostPlatform.isWindows ./mcfgthreads-no-pthread.patch;
 
-  nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
-
-  makeFlags = [
-    "ZSTD_LEGACY_SUPPORT=${if legacySupport then "1" else "0"}"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isWindows "OS=Windows";
+  cmakeFlags = [
+    "-DZSTD_BUILD_SHARED:BOOL=${if enableShared then "ON" else "OFF"}"
+    "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
+    "-DZSTD_BUILD_TESTS:BOOL=ON"
+  ];
+  cmakeDir = "../build/cmake";
+  dontUseCmakeBuildDir = true;
+  preConfigure = ''
+    mkdir -p build_ && cd $_
+  '';
 
   checkInputs = [ file ];
   doCheck = true;
   preCheck = ''
-    substituteInPlace tests/playTests.sh \
+    substituteInPlace ../tests/playTests.sh \
       --replace 'MD5SUM="md5 -r"' 'MD5SUM="md5sum"'
   '';
 
-  installFlags = [
-    "PREFIX=$(out)"
-  ];
-
-  preInstall = ''
-    substituteInPlace programs/zstdgrep \
+  preInstall = stdenv.lib.optionalString enableShared ''
+    substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
       --replace ":-zstdcat" ":-$out/bin/zstdcat"
 
-    substituteInPlace programs/zstdless \
+    substituteInPlace ../programs/zstdless \
       --replace "zstdcat" "$out/bin/zstdcat"
   '';
 
-  enableParallelBuilding = true;
-
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
index 94573bcd201..c6bb07e7b87 100644
--- a/pkgs/tools/filesystems/bees/default.nix
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -2,8 +2,8 @@
 
 let
 
-  version = "0.6.1";
-  sha256 = "0h7idclmhyp14mq6786x7f2237vqpn70gyi88ik4g70xl84yfgyh";
+  version = "0.6.2";
+  sha256 = "05niv9rivd3j3cwcx3n3vjr85wr0l5i76giq9n54d2vdwmn8qjib";
 
   bees = stdenv.mkDerivation {
     pname = "bees";
diff --git a/pkgs/tools/filesystems/blobfuse/default.nix b/pkgs/tools/filesystems/blobfuse/default.nix
index 6fc0e3a7f21..3c6f6228329 100644
--- a/pkgs/tools/filesystems/blobfuse/default.nix
+++ b/pkgs/tools/filesystems/blobfuse/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=catch-value" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
   buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/tools/filesystems/ciopfs/default.nix b/pkgs/tools/filesystems/ciopfs/default.nix
index 4a8c767e44a..533bb2322e7 100644
--- a/pkgs/tools/filesystems/ciopfs/default.nix
+++ b/pkgs/tools/filesystems/ciopfs/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ fuse glib attr ];
 
-  makeFlags = "DESTDIR=$(out) PREFIX=";
+  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
 
   meta = {
     homepage = http://www.brain-dump.org/projects/ciopfs/;
diff --git a/pkgs/tools/filesystems/fatresize/default.nix b/pkgs/tools/filesystems/fatresize/default.nix
index a00104510bf..5a60f8c055e 100644
--- a/pkgs/tools/filesystems/fatresize/default.nix
+++ b/pkgs/tools/filesystems/fatresize/default.nix
@@ -25,9 +25,7 @@ stdenv.mkDerivation rec {
 
   # Filesystem resize functions were reintroduced in parted 3.1 due to no other available free alternatives
   # but in a sepparate library -> libparted-fs-resize --- that's why the added LDFLAG
-  makeFlags = ''
-    LDFLAGS=-lparted-fs-resize
-  '';
+  makeFlags = [ "LDFLAGS=-lparted-fs-resize" ];
 
   propagatedBuildInputs = [ parted utillinux ];
 
diff --git a/pkgs/tools/filesystems/glusterfs/default.nix b/pkgs/tools/filesystems/glusterfs/default.nix
index f9960722e82..b5fc12024b1 100644
--- a/pkgs/tools/filesystems/glusterfs/default.nix
+++ b/pkgs/tools/filesystems/glusterfs/default.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation
     ''--localstatedir=/var''
     ];
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/filesystems/irods/default.nix b/pkgs/tools/filesystems/irods/default.nix
index 56fc2e40ba2..b6099c099f3 100644
--- a/pkgs/tools/filesystems/irods/default.nix
+++ b/pkgs/tools/filesystems/irods/default.nix
@@ -30,11 +30,8 @@ in rec {
     #                         but we don't use /usr with nix, so remove only 2 items.
     patches = [ ./irods_root_path.patch ];
 
-    NIX_CFLAGS_COMPILE = [
-      # fix build with recent llvm versions
-      "-Wno-deprecated-register"
-      "-Wno-deprecated-declarations"
-    ];
+    # fix build with recent llvm versions
+    NIX_CFLAGS_COMPILE = "-Wno-deprecated-register -Wno-deprecated-declarations";
 
     preConfigure = common.preConfigure + ''
       patchShebangs ./test
diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index e9dc2c1f37c..5d3c2d15fb2 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "moosefs";
-  version = "3.0.107";
+  version = "3.0.109";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "18mw7a1by8l09fb2pan6zak29bcrgbf5zgfzrlw3c203yawqbx3k";
+    sha256 = "1pwackc511fzx28w3an5qk738ykhpspvc1063w2hv901f213xjzw";
   };
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
diff --git a/pkgs/tools/filesystems/mtdutils/default.nix b/pkgs/tools/filesystems/mtdutils/default.nix
index 0461c732e1a..3b355c92226 100644
--- a/pkgs/tools/filesystems/mtdutils/default.nix
+++ b/pkgs/tools/filesystems/mtdutils/default.nix
@@ -9,13 +9,16 @@ stdenv.mkDerivation rec {
     sha256 = "1lijl89l7hljx8xx70vrz9srd3h41v5gh4b0lvqnlv831yvyh5cd";
   };
 
-  nativeBuildInputs = [ autoreconfHook cmocka pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ] ++ stdenv.lib.optional doCheck cmocka;
   buildInputs = [ acl libuuid lzo zlib zstd ];
 
-  configureFlags = [ "--enable-unit-tests" "--enable-tests" ];
+  configureFlags = [
+    (stdenv.lib.enableFeature doCheck "unit-tests")
+    (stdenv.lib.enableFeature doCheck "tests")
+  ];
   enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
   meta = {
     description = "Tools for MTD filesystems";
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 7c92dc95268..804b052b61a 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
   #patches = [ ./purity.patch ];
 
   # To prevent make install from failing.
-  preInstall = "installFlags=\"OWNER= GROUP= confdir=$out/etc\"";
+  installFlags = [ "OWNER=" "GROUP=" "confdir=${placeholder "out"}/etc" ];
 
   # Install systemd stuff.
   #installTargets = "install install_systemd_generators install_systemd_units install_tmpfiles_configuration";
diff --git a/pkgs/tools/filesystems/sasquatch/default.nix b/pkgs/tools/filesystems/sasquatch/default.nix
index c393c65a720..36ac3630e54 100644
--- a/pkgs/tools/filesystems/sasquatch/default.nix
+++ b/pkgs/tools/filesystems/sasquatch/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     cd squashfs-tools
   '';
 
-  installFlags = "INSTALL_DIR=\${out}/bin";
+  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
 
   makeFlags = [ "XZ_SUPPORT=1" ]
     ++ stdenv.lib.optional lz4Support "LZ4_SUPPORT=1";
diff --git a/pkgs/tools/filesystems/squashfs/default.nix b/pkgs/tools/filesystems/squashfs/default.nix
index 15a535eed3b..f02a913bc25 100644
--- a/pkgs/tools/filesystems/squashfs/default.nix
+++ b/pkgs/tools/filesystems/squashfs/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   preBuild = "cd squashfs-tools";
 
-  installFlags = "INSTALL_DIR=\${out}/bin";
+  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
 
   makeFlags = [ "XZ_SUPPORT=1" "ZSTD_SUPPORT=1" ]
     ++ stdenv.lib.optional lz4Support "LZ4_SUPPORT=1";
diff --git a/pkgs/tools/filesystems/sshfs-fuse/default.nix b/pkgs/tools/filesystems/sshfs-fuse/default.nix
index 33fc5ce2ab6..018dfe7858e 100644
--- a/pkgs/tools/filesystems/sshfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/sshfs-fuse/default.nix
@@ -1,30 +1,26 @@
-{ stdenv, fetchFromGitHub, fetchpatch, meson, pkgconfig, ninja, docutils, makeWrapper
+{ stdenv, fetchFromGitHub
+, meson, pkgconfig, ninja, docutils, makeWrapper
 , fuse3, glib
 , which, python3Packages
 , openssh
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.6.0";
+  version = "3.7.0";
   pname = "sshfs-fuse";
 
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "sshfs";
     rev = "sshfs-${version}";
-    sha256 = "0l4a6azsp920fhl4safxjam6821b77zxhw8mjgm33f60pksslww0";
+    sha256 = "119qvjaai3nqs2psqk2kv4gxjchrnrcfnmlwk7yxnj3v59pgyxhv";
   };
 
-  patches = [ (fetchpatch {
-    url = "https://github.com/libfuse/sshfs/commit/a548abd1f33a8423bec72724a5f48eb96fa55dd2.patch";
-    sha256 = "19p94aw7nvydd7p2bd1f5cqhlhhamjhda31k22sg06xaqyl893jm";
-  }) ];
-
   nativeBuildInputs = [ meson pkgconfig ninja docutils makeWrapper ];
   buildInputs = [ fuse3 glib ];
   checkInputs = [ which python3Packages.pytest ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString
     (stdenv.hostPlatform.system == "i686-linux")
     "-D_FILE_OFFSET_BITS=64";
 
diff --git a/pkgs/tools/graphics/appleseed/default.nix b/pkgs/tools/graphics/appleseed/default.nix
index d7603c42fca..cafe0bb7b11 100644
--- a/pkgs/tools/graphics/appleseed/default.nix
+++ b/pkgs/tools/graphics/appleseed/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
     osl seexpr makeWrapper
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = toString [
     "-I${openexr.dev}/include/OpenEXR"
     "-I${ilmbase.dev}/include/OpenEXR"
     "-I${openimageio.dev}/include/OpenImageIO"
@@ -33,6 +33,7 @@ in stdenv.mkDerivation rec {
     "-Wno-error=class-memaccess"
     "-Wno-error=maybe-uninitialized"
     "-Wno-error=catch-value"
+    "-Wno-error=stringop-truncation"
   ];
 
   cmakeFlags = [
diff --git a/pkgs/tools/graphics/argyllcms/default.nix b/pkgs/tools/graphics/argyllcms/default.nix
index 160b77229b3..1326d045459 100644
--- a/pkgs/tools/graphics/argyllcms/default.nix
+++ b/pkgs/tools/graphics/argyllcms/default.nix
@@ -94,9 +94,11 @@ stdenv.mkDerivation rec {
     libXrender libXScrnSaver libXdmcp libXau openssl
   ];
 
-  buildFlags = "PREFIX=$(out) all";
+  buildFlags = [ "all" ];
 
-  installFlags = "PREFIX=$(out)";
+  makeFlags = [
+    "PREFIX=${placeholder ''out''}"
+  ];
 
   # Install udev rules, but remove lines that set up the udev-acl
   # stuff, since that is handled by udev's own rules (70-udev-acl.rules)
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 14b15686d72..31bdba26783 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     "--with-context=$out/share/texmf/tex/context/third"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${boehmgc.dev}/include/gc" ];
+  NIX_CFLAGS_COMPILE = "-I${boehmgc.dev}/include/gc";
 
   postInstall = ''
     mv $out/share/info/asymptote/*.info $out/share/info/
diff --git a/pkgs/tools/graphics/dpic/default.nix b/pkgs/tools/graphics/dpic/default.nix
index d28f73dd91c..62fa83800cb 100644
--- a/pkgs/tools/graphics/dpic/default.nix
+++ b/pkgs/tools/graphics/dpic/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
 
-  makeFlags = "CC=${stdenv.cc.outPath}/bin/cc";
+  makeFlags = [ "CC=${stdenv.cc.outPath}/bin/cc" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 296ba43a5ed..3fc82a9c72a 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ optional jpegSupport libjpeg
     ++ optional pngSupport libpng;
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString x11Support "-lSDL";
 
   meta = with stdenv.lib; {
     description = "A lightweight, highly customizable and scriptable image viewer";
diff --git a/pkgs/tools/graphics/gifsicle/default.nix b/pkgs/tools/graphics/gifsicle/default.nix
index 79b2708cb2b..9b3836b9dec 100644
--- a/pkgs/tools/graphics/gifsicle/default.nix
+++ b/pkgs/tools/graphics/gifsicle/default.nix
@@ -11,12 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0rffpzxcak19k6cngpxn73khvm3z1gswrqs90ycdzzb53p05ddas";
   };
 
-  buildInputs = optional gifview [ xorgproto libXt libX11 ];
+  buildInputs = optionals gifview [ xorgproto libXt libX11 ];
 
-  configureFlags = []
-    ++ optional (!gifview) [ "--disable-gifview" ];
+  configureFlags = optional (!gifview) "--disable-gifview";
 
-  LDFLAGS = optional static "-static";
+  LDFLAGS = optionalString static "-static";
 
   doCheck = true;
   checkPhase = ''
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 9f6393b6372..0ac1c1a2155 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -19,11 +19,12 @@ let
   withX = libX11 != null && !aquaterm && !stdenv.isDarwin;
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
-  name = "gnuplot-5.2.7";
+  pname = "gnuplot";
+  version = "5.2.8";
 
   src = fetchurl {
-    url = "mirror://sourceforge/gnuplot/${name}.tar.gz";
-    sha256 = "1vglp4la40f5dpj0zdj63zprrkyjgzy068p35bz5dqxjyczm1zlp";
+    url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
+    sha256 = "0dxc52d17mpyb2xm24da1nvhlacryv0irwa0q5l1cjj0rx67d9k0";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig texinfo ] ++ lib.optional withQt qttools;
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index 700bed237bd..3b9d8a4cca5 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   configureFlags = [
     "--with-ltdl-lib=${libtool.lib}/lib"
     "--with-ltdl-include=${libtool}/include"
-  ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ];
+  ] ++ stdenv.lib.optional (xorg == null) "--without-x";
 
   inherit patches;
 
diff --git a/pkgs/tools/graphics/kst/default.nix b/pkgs/tools/graphics/kst/default.nix
index 24d678e1142..480ae328cd3 100644
--- a/pkgs/tools/graphics/kst/default.nix
+++ b/pkgs/tools/graphics/kst/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ qtbase gsl getdata netcdf muparser matio ];
 
-  cmakeFlags = "-Dkst_qt5=1 -Dkst_release=1";
+  cmakeFlags = [ "-Dkst_qt5=1" "-Dkst_release=1" ];
 
   postInstall = ''
     mkdir -p $out
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index 90716d04a75..65ccfecedd6 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
       url = "https://github.com/niftools/nifskope/commit/30954e7f01f3d779a2a1fd37d363e8a6ad560bd3.patch";
       sha256 = "0d6xjj2mjjhdd7w1aig5f75jksjni16jyj0lxsz51pys6xqb6fpj";
     })
-  ];
+  ] ++ (stdenv.lib.optional stdenv.isAarch64 ./no-sse-on-arm.patch);
 
   buildInputs = [ qtbase qttools libGLU.dev ];
   nativeBuildInputs = [ qmake wrapQtAppsHook ];
diff --git a/pkgs/tools/graphics/nifskope/no-sse-on-arm.patch b/pkgs/tools/graphics/nifskope/no-sse-on-arm.patch
new file mode 100644
index 00000000000..452fb1a76d5
--- /dev/null
+++ b/pkgs/tools/graphics/nifskope/no-sse-on-arm.patch
@@ -0,0 +1,19 @@
+diff --git a/NifSkope.pro b/NifSkope.pro
+index cc29fc5..b17bb6e 100644
+--- a/NifSkope.pro
++++ b/NifSkope.pro
+@@ -428,13 +428,10 @@ win32 {
+ 	#  Optimization flags
+ 	QMAKE_CXXFLAGS_DEBUG -= -O0 -g
+ 	QMAKE_CXXFLAGS_DEBUG *= -Og -g3
+-	QMAKE_CXXFLAGS_RELEASE *= -O3 -mfpmath=sse
++	QMAKE_CXXFLAGS_RELEASE *= -O3
+ 
+ 	# C++11 Support
+ 	QMAKE_CXXFLAGS_RELEASE *= -std=c++14
+-
+-	#  Extension flags
+-	QMAKE_CXXFLAGS_RELEASE *= -msse2 -msse
+ }
+ 
+ win32 {
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 6dafbfe2f9f..6a0385614e8 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -14,9 +14,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man"];
 
-  cmakeFlags = ''
-    -DWITH_MATLAB=false 
-  '';
+  cmakeFlags = [ "-DWITH_MATLAB=false" ];
 
   preConfigure = ''
     rm cmake/FindNETPBM.cmake
diff --git a/pkgs/tools/graphics/pngcheck/default.nix b/pkgs/tools/graphics/pngcheck/default.nix
index 6814a06e3b9..f7bd8d520c8 100644
--- a/pkgs/tools/graphics/pngcheck/default.nix
+++ b/pkgs/tools/graphics/pngcheck/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   makefile = "Makefile.unx";
-  makeFlags = "ZPATH=${zlib.static}/lib";
+  makeFlags = [ "ZPATH=${zlib.static}/lib" ];
 
   buildInputs = [ zlib ];
 
diff --git a/pkgs/tools/graphics/quirc/default.nix b/pkgs/tools/graphics/quirc/default.nix
index 9891ea5e52b..4b610ebbfef 100644
--- a/pkgs/tools/graphics/quirc/default.nix
+++ b/pkgs/tools/graphics/quirc/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     mkdir -p "$out"/{bin,lib,include}
     find . -maxdepth 1 -type f -perm -0100 -exec cp '{}' "$out"/bin ';'
   '';
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   meta = {
     inherit (s) version;
     description = ''A small QR code decoding library'';
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 9a071e6150f..7610b4e56fb 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Disable assertions which include -dev QtBase file paths.
-  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];
+  NIX_CFLAGS_COMPILE = "-DQT_NO_DEBUG";
 
   configureFlags = [
     "--without-python"
diff --git a/pkgs/tools/inputmethods/fcitx/unwrapped.nix b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
index 636cb518fd2..60de9e6910e 100644
--- a/pkgs/tools/inputmethods/fcitx/unwrapped.nix
+++ b/pkgs/tools/inputmethods/fcitx/unwrapped.nix
@@ -75,20 +75,20 @@ stdenv.mkDerivation rec {
     libxkbcommon libxml2 dbus cairo gtk2 gtk3 pango qt4 libuuid
   ];
 
-  cmakeFlags = ''
-    -DENABLE_QT_IM_MODULE=ON
-    -DENABLE_GTK2_IM_MODULE=ON
-    -DENABLE_GTK3_IM_MODULE=ON
-    -DENABLE_GIR=OFF
-    -DENABLE_OPENCC=OFF
-    -DENABLE_PRESAGE=OFF
-    -DENABLE_XDGAUTOSTART=OFF
-    -DENABLE_PINYIN=${if withPinyin then "ON" else "OFF"}
-    -DENABLE_TABLE=ON
-    -DENABLE_SPELL=ON
-    -DENABLE_QT_GUI=ON
-    -DXKB_RULES_XML_FILE='${xkeyboard_config}/share/X11/xkb/rules/evdev.xml'
-    '';
+  cmakeFlags = [
+    "-DENABLE_QT_IM_MODULE=ON"
+    "-DENABLE_GTK2_IM_MODULE=ON"
+    "-DENABLE_GTK3_IM_MODULE=ON"
+    "-DENABLE_GIR=OFF"
+    "-DENABLE_OPENCC=OFF"
+    "-DENABLE_PRESAGE=OFF"
+    "-DENABLE_XDGAUTOSTART=OFF"
+    "-DENABLE_PINYIN=${if withPinyin then "ON" else "OFF"}"
+    "-DENABLE_TABLE=ON"
+    "-DENABLE_SPELL=ON"
+    "-DENABLE_QT_GUI=ON"
+    "-DXKB_RULES_XML_FILE='${xkeyboard_config}/share/X11/xkb/rules/evdev.xml'"
+  ];
 
   meta = with stdenv.lib; {
     homepage    = https://github.com/fcitx/fcitx;
diff --git a/pkgs/tools/misc/automirror/default.nix b/pkgs/tools/misc/automirror/default.nix
index 3bfb2d656d9..84778fb1c2d 100644
--- a/pkgs/tools/misc/automirror/default.nix
+++ b/pkgs/tools/misc/automirror/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ git ronn ];
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/schlomo/automirror;
diff --git a/pkgs/tools/misc/bash_unit/default.nix b/pkgs/tools/misc/bash_unit/default.nix
new file mode 100644
index 00000000000..f23ab45cfab
--- /dev/null
+++ b/pkgs/tools/misc/bash_unit/default.nix
@@ -0,0 +1,27 @@
+{ fetchFromGitHub
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bash_unit";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "pgrange";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0jcjpcyf569b12vm4jrd53iqrrsjvr8sp9y29w2ls38fm8a16vr6";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp bash_unit $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Bash unit testing enterprise edition framework for professionals";
+    maintainers = with maintainers; [ pamplemousse ];
+    platforms = platforms.linux;
+    license = licenses.gpl3Plus;
+  };
+}
diff --git a/pkgs/tools/misc/bibtool/default.nix b/pkgs/tools/misc/bibtool/default.nix
index 7664b96563b..df7564a4b84 100644
--- a/pkgs/tools/misc/bibtool/default.nix
+++ b/pkgs/tools/misc/bibtool/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # Perl for running test suite.
   buildInputs = [ perl ];
 
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/misc/bonfire/default.nix b/pkgs/tools/misc/bonfire/default.nix
index a5e4a42ef3c..12b0ad2abf1 100644
--- a/pkgs/tools/misc/bonfire/default.nix
+++ b/pkgs/tools/misc/bonfire/default.nix
@@ -3,9 +3,8 @@
 with python3Packages;
 
 buildPythonApplication rec {
-  version = "2017-01-19";
   pname = "bonfire";
-  name = "${pname}-unstable-${version}";
+  version = "unstable-2017-01-19";
 
   # use latest git version with --endpoint flag
   # https://github.com/blue-yonder/bonfire/pull/18
@@ -25,7 +24,7 @@ buildPythonApplication rec {
     # pip fails when encountering the git hash for the package version
     substituteInPlace setup.py \
       --replace "version=version," "version='${version}',"
-    # remove extraneous files  
+    # remove extraneous files
     substituteInPlace setup.cfg \
       --replace "data_files = *.rst, *.txt" ""
   '';
@@ -45,6 +44,6 @@ buildPythonApplication rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.womfoo ];
     platforms = platforms.linux;
+    broken = true; # no longer compatible with new arrow package
   };
-
 }
diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix
index 3eb3851457a..637f7a17695 100644
--- a/pkgs/tools/misc/chezmoi/default.nix
+++ b/pkgs/tools/misc/chezmoi/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "1.7.9";
+  version = "1.7.10";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "1qvrzksqr06lslryh7qzs56bs11xfyah5153x3aab2f5kgk1i8md";
+    sha256 = "1miki6p611s0m3s0q5qsc9cks0akm59ks3x1gzi9wvhzf6k9h0dn";
   };
 
   modSha256 = "0rzwslpikadhqw8rcbg4hbasfcgjcc850ccfnprdxva4g1bb5rqc";
diff --git a/pkgs/tools/misc/ckb-next/default.nix b/pkgs/tools/misc/ckb-next/default.nix
index 575cb686f9d..738430f561b 100644
--- a/pkgs/tools/misc/ckb-next/default.nix
+++ b/pkgs/tools/misc/ckb-next/default.nix
@@ -2,14 +2,14 @@
 , pkgconfig, qtbase, cmake, zlib, kmod }:
 
 mkDerivation rec {
-  version = "0.3.2";
+  version = "0.4.2";
   pname = "ckb-next";
 
   src = fetchFromGitHub {
     owner = "ckb-next";
     repo = "ckb-next";
     rev = "v${version}";
-    sha256 = "0ri5n7r1vhsgk6s64abvqcdrs5fmlwprw0rxiwfy0j8a9qcic1dr";
+    sha256 = "1mkx1psw5xnpscdfik1kpzsnfhhkn3571i7acr9gxyjr27sckplc";
   };
 
   buildInputs = [
@@ -25,11 +25,12 @@ mkDerivation rec {
 
   cmakeFlags = [
     "-DINSTALL_DIR_ANIMATIONS=libexec"
+    "-DUDEV_RULE_DIRECTORY=lib/udev/rules.d"
+    "-DFORCE_INIT_SYSTEM=systemd"
   ];
 
   patches = [
     ./install-dirs.patch
-    ./systemd-service.patch
     (substituteAll {
       name = "ckb-next-modprobe.patch";
       src = ./modprobe.patch;
diff --git a/pkgs/tools/misc/ckb-next/install-dirs.patch b/pkgs/tools/misc/ckb-next/install-dirs.patch
index 5545292a65e..0f113d71aa3 100644
--- a/pkgs/tools/misc/ckb-next/install-dirs.patch
+++ b/pkgs/tools/misc/ckb-next/install-dirs.patch
@@ -1,32 +1,13 @@
 diff --git a/src/daemon/CMakeLists.txt b/src/daemon/CMakeLists.txt
-index 09056a7..1bb4595 100644
+index 2fc10a8..22dbd14 100644
 --- a/src/daemon/CMakeLists.txt
 +++ b/src/daemon/CMakeLists.txt
-@@ -456,7 +456,7 @@ endif ()
- if (LINUX)
-   install(
-     FILES "${CMAKE_SOURCE_DIR}/linux/udev/99-ckb-daemon.rules"
--    DESTINATION "/etc/udev/rules.d"
-+    DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/udev/rules.d"
-     PERMISSIONS
-     OWNER_READ OWNER_WRITE
-     GROUP_READ
-diff --git a/src/libs/ckb-next/CMakeLists.txt b/src/libs/ckb-next/CMakeLists.txt
-index ecc591c..35de563 100644
---- a/src/libs/ckb-next/CMakeLists.txt
-+++ b/src/libs/ckb-next/CMakeLists.txt
-@@ -75,12 +75,12 @@ if(NOT MACOS)
-         NAMESPACE
-           ${CMAKE_PROJECT_NAME}::
-         DESTINATION
--          "/usr/lib/cmake/${CMAKE_PROJECT_NAME}/${PROJECT_NAME}")
-+          "${CMAKE_INSTALL_PREFIX}/lib/cmake/${CMAKE_PROJECT_NAME}/${PROJECT_NAME}")
- 
+@@ -421,7 +421,7 @@ if ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "launchd")
+ elseif ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "systemd")
      install(
-         FILES
-           "cmake/${PROJECT_NAME}Config.cmake"
-           "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}/${PROJECT_NAME}ConfigVersion.cmake"
-         DESTINATION
--          "/usr/lib/cmake/${CMAKE_PROJECT_NAME}/${PROJECT_NAME}")
-+          "${CMAKE_INSTALL_PREFIX}/lib/cmake/${CMAKE_PROJECT_NAME}/${PROJECT_NAME}")
- endif()
+         FILES "${CMAKE_CURRENT_BINARY_DIR}/service/ckb-next-daemon.service"
+-        DESTINATION "/usr/lib/systemd/system"
++        DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/systemd/system"
+         PERMISSIONS
+         OWNER_READ OWNER_WRITE
+         GROUP_READ
diff --git a/pkgs/tools/misc/ckb-next/modprobe.patch b/pkgs/tools/misc/ckb-next/modprobe.patch
index f2156fc3b23..a2cbe262e89 100644
--- a/pkgs/tools/misc/ckb-next/modprobe.patch
+++ b/pkgs/tools/misc/ckb-next/modprobe.patch
@@ -1,26 +1,26 @@
 diff --git a/src/daemon/input_linux.c b/src/daemon/input_linux.c
-index 1cedb07..8e0b24b 100644
+index 8489f5b..b851419 100644
 --- a/src/daemon/input_linux.c
 +++ b/src/daemon/input_linux.c
-@@ -58,7 +58,7 @@ int os_inputopen(usbdevice* kb){
-     /// First check whether the uinput module is loaded by the kernel.
-     ///
-     // Load the uinput module (if it's not loaded already)
--    if(system("modprobe uinput") != 0) {
-+    if(system("@kmod@/bin/modprobe uinput") != 0) {
-         ckb_fatal("Failed to load uinput module\n");
-         return 1;
-     }
+@@ -63,7 +63,7 @@ int os_inputopen(usbdevice* kb){
+ 
+     // If not available, load the module
+     if(fd < 0){
+-        if(system("modprobe uinput") != 0) {
++        if(system("@kmod@/bin/modprobe uinput") != 0) {
+             ckb_fatal("Failed to load uinput module\n");
+             return 1;
+         }
 diff --git a/src/gui/mainwindow.cpp b/src/gui/mainwindow.cpp
-index 3601146..3f2f78f 100644
+index 1eb95bd..f7d38ba 100644
 --- a/src/gui/mainwindow.cpp
 +++ b/src/gui/mainwindow.cpp
-@@ -251,7 +251,7 @@ void MainWindow::updateVersion(){
-             daemonWarning.append(tr("<br /><b>Warning:</b> System Extension by \"Fumihiko Takayama\" is not allowed in Security & Privacy. Please allow it and then unplug and replug your devices."));
+@@ -284,7 +284,7 @@ void MainWindow::updateVersion(){
  #elif defined(Q_OS_LINUX)
-             QProcess modprobe;
--            modprobe.start("modprobe", QStringList("uinput"));
-+            modprobe.start("@kmod@/bin/modprobe", QStringList("uinput"));
+             if(!(QFileInfo("/dev/uinput").exists() || QFileInfo("/dev/input/uinput").exists())){
+                 QProcess modprobe;
+-                modprobe.start("modprobe", QStringList("uinput"));
++                modprobe.start("@kmod@/bin/modprobe", QStringList("uinput"));
  
-             if(!modprobe.waitForFinished())
-                 qDebug() << "Modprobe error";
+                 if(!modprobe.waitForFinished())
+                     qDebug() << "Modprobe error";
diff --git a/pkgs/tools/misc/ckb-next/systemd-service.patch b/pkgs/tools/misc/ckb-next/systemd-service.patch
deleted file mode 100644
index 917bc09627f..00000000000
--- a/pkgs/tools/misc/ckb-next/systemd-service.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-diff --git a/src/daemon/CMakeLists.txt b/src/daemon/CMakeLists.txt
-index 09056a7..72a7249 100644
---- a/src/daemon/CMakeLists.txt
-+++ b/src/daemon/CMakeLists.txt
-@@ -249,12 +249,7 @@ elseif (LINUX)
-     # but it is not enabled by default and systemd is used instead. (Ubuntu 15.04+)
- 
-     # A way to check for upstart
--    execute_process(
--        COMMAND initctl --version
--        OUTPUT_VARIABLE initctl_output
--        OUTPUT_STRIP_TRAILING_WHITESPACE)
--
--    if ("${initctl_output}" MATCHES "upstart")
-+    if (FALSE)
-         message(STATUS "upstart detected")
-         set(CKB_NEXT_INIT_SYSTEM "upstart" CACHE INTERNAL "")
-         set(DISALLOW_SYSVINIT TRUE)
-@@ -292,7 +287,7 @@ elseif (LINUX)
-     endif ()
- 
-     # A way to check for systemd
--    if (EXISTS "/run/systemd/system")
-+    if (TRUE)
-         message(STATUS "systemd detected")
-         set(CKB_NEXT_INIT_SYSTEM "systemd" CACHE INTERNAL "")
-         set(DISALLOW_SYSVINIT TRUE)
-@@ -328,7 +323,7 @@ elseif (LINUX)
-     endif ()
- 
-     # A way to check for OpenRC
--    if (EXISTS "/run/openrc/softlevel")
-+    if (FALSE)
-         message(STATUS "OpenRC detected")
-         set(CKB_NEXT_INIT_SYSTEM "OpenRC" CACHE INTERNAL "")
-         set(DISALLOW_SYSVINIT TRUE)
-@@ -419,7 +414,7 @@ if ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "launchd")
- elseif ("${CKB_NEXT_INIT_SYSTEM}" STREQUAL "systemd")
-     install(
-         FILES "${CMAKE_CURRENT_BINARY_DIR}/service/ckb-next-daemon.service"
--        DESTINATION "/usr/lib/systemd/system"
-+        DESTINATION "${CMAKE_INSTALL_PREFIX}/lib/systemd/system"
-         PERMISSIONS
-         OWNER_READ OWNER_WRITE
-         GROUP_READ
diff --git a/pkgs/tools/misc/cpulimit/default.nix b/pkgs/tools/misc/cpulimit/default.nix
index 547e2a1f059..1978476a12d 100644
--- a/pkgs/tools/misc/cpulimit/default.nix
+++ b/pkgs/tools/misc/cpulimit/default.nix
@@ -9,12 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "0xf0r6zxaqan1drz61nqf95p2pkiiihpvrjhrr9dx9j3vswyx31g";
   };
 
-  buildFlags = with stdenv;
+  buildFlags = with stdenv; [ (
     if isDarwin then "osx"
     else if isFreeBSD then "freebsd"
-    else "cpulimit";
+    else "cpulimit"
+  ) ];
 
-  installFlags = "PREFIX=$(out)";
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = http://limitcpu.sourceforge.net/;
diff --git a/pkgs/tools/misc/dylibbundler/default.nix b/pkgs/tools/misc/dylibbundler/default.nix
index 6bb9924ddd0..c4209442de8 100644
--- a/pkgs/tools/misc/dylibbundler/default.nix
+++ b/pkgs/tools/misc/dylibbundler/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1mpd43hvpfp7pskfrjnd6vcmfii9v3p97q0ws50krkdvshp0bv2h";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Small command-line program that aims to make bundling .dylibs as easy as possible";
diff --git a/pkgs/tools/misc/ent/default.nix b/pkgs/tools/misc/ent/default.nix
index 1c0401e2ead..7e8d04b4209 100644
--- a/pkgs/tools/misc/ent/default.nix
+++ b/pkgs/tools/misc/ent/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ unzip ];
 
-  buildFlags = if stdenv.cc.isClang then [ "CC=clang" ] else null;
+  buildFlags = stdenv.lib.optional stdenv.cc.isClang "CC=clang";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index 735580eee5d..247572a379f 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "entr";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "http://entrproject.org/code/${pname}-${version}.tar.gz";
-    sha256 = "0ni34sfrssa6njiqm22q2kxv437r6vbs0a6mys8kwwn7vbdw30dh";
+    sha256 = "1x2hyc8vc5dz6k7b3291vxz36wllhinvqrb0d8zx9bv0ydj6qmjl";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fdupes/default.nix b/pkgs/tools/misc/fdupes/default.nix
index 8c303dd1e0c..af9a7c9a133 100644
--- a/pkgs/tools/misc/fdupes/default.nix
+++ b/pkgs/tools/misc/fdupes/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "19b6vqblddaw8ccw4sn0qsqzbswlhrz8ia6n4m3hymvcxn8skpz9";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Identifies duplicate files residing within specified directories";
diff --git a/pkgs/tools/misc/ffsend/default.nix b/pkgs/tools/misc/ffsend/default.nix
index d0c389f31f9..bb10bfe2ec7 100644
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@@ -16,16 +16,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   pname = "ffsend";
-  version = "0.2.57";
+  version = "0.2.58";
 
   src = fetchFromGitLab {
     owner = "timvisee";
     repo = "ffsend";
     rev = "v${version}";
-    sha256 = "04y3mnh77g8mvcikp3m0a20vz180fzv847z8xjnz97ynhrbp3q94";
+    sha256 = "0yqigqh5vldzmp7wc1mxi5a4bxzm81xycx5h0ghak74vbjibps49";
   };
 
-  cargoSha256 = "19w1lwvp54fjl1ll5pay5grfgj4zs2idqiqppxhksf61az6knql9";
+  cargoSha256 = "1wwdnm6a5g4gpd1f89qii8v4f6mcfc1bif1v6mdlcbrpwax5skh4";
 
   nativeBuildInputs = [ cmake pkgconfig installShellFiles ];
   buildInputs = [ openssl ]
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index a06b38c0ec7..24a7143d8e1 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -1,33 +1,24 @@
-{ stdenv, fetchurl, fetchpatch, file, zlib, libgnurx }:
+{ stdenv, fetchurl, file, zlib, libgnurx }:
 
 stdenv.mkDerivation rec {
   pname = "file";
-  version = "5.37";
+  version = "5.38";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.astron.com/pub/file/${pname}-${version}.tar.gz"
       "https://distfiles.macports.org/file/${pname}-${version}.tar.gz"
     ];
-    sha256 = "0zz0p9bqnswfx0c16j8k62ivjq1m16x10xqv4hy9lcyxyxkkkhg9";
+    sha256 = "0d7s376b4xqymnrsjxi3nsv3f5v89pzfspzml2pcajdk5by2yg2r";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2019-18218.patch";
-      url = "https://sources.debian.org/data/main/f/file/1:5.37-6/debian/patches/cherry-pick.FILE5_37-67-g46a8443f.limit-the-number-of-elements-in-a-vector-found-by-oss-fuzz.patch";
-      sha256 = "1i22y91yndc3n2p2ngczp1lwil8l05sp8ciicil74xrc5f91y6mj";
-    })
-  ];
-
   nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ]
               ++ stdenv.lib.optional stdenv.hostPlatform.isWindows libgnurx;
 
   doCheck = true;
 
-  makeFlags = if stdenv.hostPlatform.isWindows then "FILE_COMPILE=file"
-              else null;
+  makeFlags = stdenv.lib.optional stdenv.hostPlatform.isWindows "FILE_COMPILE=file";
 
   meta = with stdenv.lib; {
     homepage = https://darwinsys.com/file;
diff --git a/pkgs/tools/misc/fondu/default.nix b/pkgs/tools/misc/fondu/default.nix
index 33efd2bd614..772ae236764 100644
--- a/pkgs/tools/misc/fondu/default.nix
+++ b/pkgs/tools/misc/fondu/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "152prqad9jszjmm4wwqrq83zk13ypsz09n02nrk1gg0fcxfm7fr2";
   };
 
-  makeFlags = "DESTDIR=$(out)";
+  makeFlags = [ "DESTDIR=$(out)" ];
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index e012d40271b..6239e839598 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isi686 "-msse2 -mfpmath=sse";
 
   nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
   buildInputs = [
diff --git a/pkgs/tools/misc/fselect/default.nix b/pkgs/tools/misc/fselect/default.nix
index b86e5ad997a..0685ecf2440 100644
--- a/pkgs/tools/misc/fselect/default.nix
+++ b/pkgs/tools/misc/fselect/default.nix
@@ -2,22 +2,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.6.7";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "0pg3ahx8rmzr585qa4vphd1vxcm1r3sx5iyi8ghg5nn6sibqy0z4";
+    sha256 = "1zccl60l557lhaaqb33myys4vp3jsnjqh3dxb22i46bff28s1w6c";
   };
 
-  cargoSha256 = "0yf3xkxxlb9252r869wbiv3b3kpz4p5gp556sic63bp0acig6a76";
+  cargoSha256 = "1496zjrkwj5bv08k575m064x0hfk0gpci0dmxvvspj6jf8f8bfm6";
 
   meta = with stdenv.lib; {
     description = "Find files with SQL-like queries";
     homepage = "https://github.com/jhspetersson/fselect";
     license = with licenses; [ asl20 mit ];
-    maintainers = [ maintainers.filalex77 ];
+    maintainers = with maintainers; [ filalex77 ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 9de5ca0df78..960373e7e5f 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -36,15 +36,13 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    name="${pname}-${version}"
-
     cp $src/bin/fzf-tmux $out/bin
 
     mkdir -p $man/share/man
     cp -r $src/man/man1 $man/share/man
 
-    mkdir -p $out/share/vim-plugins/$name
-    cp -r $src/plugin $out/share/vim-plugins/$name
+    mkdir -p $out/share/vim-plugins/${pname}
+    cp -r $src/plugin $out/share/vim-plugins/${pname}
 
     cp -R $src/shell $out/share/fzf
     cat <<SCRIPT > $out/bin/fzf-share
diff --git a/pkgs/tools/misc/fzy/default.nix b/pkgs/tools/misc/fzy/default.nix
index 5b05ce534d7..24daa7fc81f 100644
--- a/pkgs/tools/misc/fzy/default.nix
+++ b/pkgs/tools/misc/fzy/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1gkzdvj73f71388jvym47075l9zw61v6l8wdv2lnc0mns6dxig0k";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A better fuzzy finder";
diff --git a/pkgs/tools/misc/heimdall/default.nix b/pkgs/tools/misc/heimdall/default.nix
index a8100e455f0..26396fee507 100644
--- a/pkgs/tools/misc/heimdall/default.nix
+++ b/pkgs/tools/misc/heimdall/default.nix
@@ -21,11 +21,14 @@ mkDerivation {
 
   cmakeFlags = [
     "-DDISABLE_FRONTEND=${if enableGUI then "OFF" else "ON"}"
+    "-DLIBUSB_LIBRARY=${libusb1}"
   ];
 
   preConfigure = ''
     # Give ownership of the Galaxy S USB device to the logged in user.
     substituteInPlace heimdall/60-heimdall.rules --replace 'MODE="0666"' 'TAG+="uaccess"'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace libpit/CMakeLists.txt --replace "-std=gnu++11" ""
   '';
 
   installPhase = ''
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index d1d3996bd62..2ec68348495 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -3,15 +3,15 @@
 , fetchpatch }:
 
 stdenv.mkDerivation rec {
-   pname = "ldmtool";
-   version = "0.2.4";
+  pname = "ldmtool";
+  version = "0.2.4";
 
-   src = fetchFromGitHub {
-     owner = "mdbooth";
-     repo = "libldm";
-     rev = "libldm-${version}";
-     sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
-   };
+  src = fetchFromGitHub {
+    owner = "mdbooth";
+    repo = "libldm";
+    rev = "libldm-${version}";
+    sha256 = "1fy5wbmk8kwl86lzswq0d1z2j5y023qzfm2ppm8knzv9c47kniqk";
+  };
 
   patches = [
     # Remove useage of deprecrated G_PARAM_PRIVATE
@@ -21,26 +21,26 @@ stdenv.mkDerivation rec {
     })
   ];
 
-   preConfigure = ''
-     sed -i docs/reference/ldmtool/Makefile.am \
-       -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
-   '';
+  preConfigure = ''
+    sed -i docs/reference/ldmtool/Makefile.am \
+      -e 's|-nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl|--nonet ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl|g'
+  '';
 
-   # glib-2.62 deprecations
-   NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  # glib-2.62 deprecations
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
-   configureScript = "sh autogen.sh";
+  configureScript = "sh autogen.sh";
 
-   nativeBuildInputs = [ pkgconfig ];
-   buildInputs = [ autoconf automake gtk-doc lvm2 libxslt.bin
-     libtool readline gobject-introspection json-glib libuuid
-   ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ autoconf automake gtk-doc lvm2 libxslt.bin
+    libtool readline gobject-introspection json-glib libuuid
+  ];
 
-   meta = with stdenv.lib; {
-     description = "Tool and library for managing Microsoft Windows Dynamic Disks";
-     homepage = https://github.com/mdbooth/libldm;
-     maintainers = with maintainers; [ jensbin ];
-     license = licenses.gpl3;
-     platforms = platforms.linux;
-   };
+  meta = with stdenv.lib; {
+    description = "Tool and library for managing Microsoft Windows Dynamic Disks";
+    homepage = https://github.com/mdbooth/libldm;
+    maintainers = with maintainers; [ jensbin ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
 }
diff --git a/pkgs/tools/misc/lf/default.nix b/pkgs/tools/misc/lf/default.nix
index 61e115e71eb..c2f281ecb17 100644
--- a/pkgs/tools/misc/lf/default.nix
+++ b/pkgs/tools/misc/lf/default.nix
@@ -15,8 +15,8 @@ buildGoModule rec {
 
   # TODO: Setting buildFlags probably isn't working properly. I've tried a few
   # variants, e.g.:
-  # - buildFlags = "-ldflags \"-s -w -X 'main.gVersion=${version}'\"";
-  # - buildFlags = "-ldflags \\\"-X ${goPackagePath}/main.gVersion=${version}\\\"";
+  # - buildFlags = [ "-ldflags" "\"-s" "-w"" ""-X 'main.gVersion=${version}'\"" ];
+  # - buildFlags = [ "-ldflags" "\\\"-X" "${goPackagePath}/main.gVersion=${version}\\\"" ];
   # Override the build phase (to set buildFlags):
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 49e4ab44836..918e8372dcb 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpipeline, db, groff, libiconv, makeWrapper, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "man-db-2.8.7";
+  name = "man-db-2.9.0";
 
   src = fetchurl {
     url = "mirror://savannah/man-db/${name}.tar.xz";
-    sha256 = "09mkpvwirv9kh2pqhfq90zl7pjdl63f4w4g1x6zhhp9hjswmpkdr";
+    sha256 = "0qg2sdn8mayya0ril484iz1r7hi46l68d2d80cr6lvc7x3csqjjx";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/tools/misc/memtest86+/default.nix b/pkgs/tools/misc/memtest86+/default.nix
index 48f048b3abf..57cf5bb97e2 100644
--- a/pkgs/tools/misc/memtest86+/default.nix
+++ b/pkgs/tools/misc/memtest86+/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "all" ];
 
-  buildFlags = "memtest.bin";
+  buildFlags = [ "memtest.bin" ];
 
   doCheck = false; # fails
 
diff --git a/pkgs/tools/misc/mktorrent/default.nix b/pkgs/tools/misc/mktorrent/default.nix
index b2f7fdf2a90..c88f12c74d1 100644
--- a/pkgs/tools/misc/mktorrent/default.nix
+++ b/pkgs/tools/misc/mktorrent/default.nix
@@ -11,13 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "17pdc5mandl739f8q26n5is8ga56s83aqcrwhlnnplbxwx2inidr";
   };
 
-  makeFlags = "USE_PTHREADS=1 USE_OPENSSL=1 USE_LONG_OPTIONS=1"
-    + stdenv.lib.optionalString stdenv.isi686 " USE_LARGE_FILES=1"
-    + stdenv.lib.optionalString stdenv.isLinux "CFLAGS=-lgcc_s";
+  makeFlags = [ "USE_PTHREADS=1" "USE_OPENSSL=1" "USE_LONG_OPTIONS=1" ]
+    ++ stdenv.lib.optional stdenv.isi686 "USE_LARGE_FILES=1"
+    ++ stdenv.lib.optional stdenv.isLinux "CFLAGS=-lgcc_s";
 
-  preInstall = ''
-    installFlags=PREFIX=$out
-  '';
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 336d673f7ec..44f791e5b8a 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
-  buildFlags = "CC=cc";
-  installFlags = "PREFIX=$(out)";
+  buildFlags = [ "CC=cc" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   postInstall = ''
     wrapProgram $out/bin/chronic --prefix PERL5LIB : $PERL5LIB
diff --git a/pkgs/tools/misc/multitail/default.nix b/pkgs/tools/misc/multitail/default.nix
index 92945004cb0..6ca0c6e8e08 100644
--- a/pkgs/tools/misc/multitail/default.nix
+++ b/pkgs/tools/misc/multitail/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  makeFlags = stdenv.lib.optionalString stdenv.isDarwin "-f makefile.macosx";
+  makeFlags = stdenv.lib.optionals stdenv.isDarwin [ "-f" "makefile.macosx" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/neo-cowsay/default.nix b/pkgs/tools/misc/neo-cowsay/default.nix
new file mode 100644
index 00000000000..128d582e32e
--- /dev/null
+++ b/pkgs/tools/misc/neo-cowsay/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "neo-cowsay";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Code-Hex";
+    repo = "Neo-cowsay";
+    rev = "v${version}";
+    sha256 = "1in6kadczv05v62qhskqbdx7wppch0gwl0bshr5ihmi39k8l7v3z";
+  };
+
+  modSha256 = "063ds35dzv8m4bjk7v1q3f6jwyp7j5jrkrhrl41z1c1mbzzkagkq";
+
+  subPackages = [ "cmd/cowsay" "cmd/cowthink" ];
+
+  meta = with lib; {
+    description = "Cowsay reborn, written in Go";
+    homepage = "https://github.com/Code-Hex/Neo-cowsay";
+    license = with licenses; [artistic1 /* or */ gpl3];
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}
diff --git a/pkgs/tools/misc/onefetch/default.nix b/pkgs/tools/misc/onefetch/default.nix
index be8c4fb9c06..e51a00dc7bd 100644
--- a/pkgs/tools/misc/onefetch/default.nix
+++ b/pkgs/tools/misc/onefetch/default.nix
@@ -1,15 +1,15 @@
-{ fetchFromGitHub, rustPlatform, stdenv
+{ fetchFromGitHub, rustPlatform, stdenv, fetchpatch
 , CoreFoundation, libiconv, libresolv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "onefetch";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "o2sh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "02mdzpzfcxp9na86b4jcqqjd3id5jslgmnq1jc0vykg58xha51jg";
+    sha256 = "1sgpai3gx3w7w3ilmbnmzgdxdim6klkfiqaqxmffpyap6qgksfqs";
   };
 
   cargoSha256 = "1phv06zf47bv5cmhypivljfiynrblha0kj13c5al9l0hd1xx749h";
@@ -17,6 +17,14 @@ rustPlatform.buildRustPackage rec {
   buildInputs = with stdenv;
     lib.optionals isDarwin [ CoreFoundation libiconv libresolv Security ];
 
+  cargoPatches = [
+    # fix wrong version in Cargo.lock
+    (fetchpatch {
+      url = "https://github.com/o2sh/onefetch/commit/b69fe660d72b65d7efac99ac5db3b03a82d8667f.patch";
+      sha256 = "14przkdyd4yd11xpdgyscs70w9gpnh02j3xdzxf6h895w3mn84lx";
+    })
+  ];
+
   meta = with stdenv.lib; {
     description = "Git repository summary on your terminal";
     homepage = "https://github.com/o2sh/onefetch";
diff --git a/pkgs/tools/misc/osm2pgsql/default.nix b/pkgs/tools/misc/osm2pgsql/default.nix
index 007ae348bc2..54da1a16401 100644
--- a/pkgs/tools/misc/osm2pgsql/default.nix
+++ b/pkgs/tools/misc/osm2pgsql/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat proj bzip2 zlib boost postgresql lua ];
 
-  NIX_CFLAGS_COMPILE = [ "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H" ];
+  NIX_CFLAGS_COMPILE = "-DACCEPT_USE_OF_DEPRECATED_PROJ_API_H";
 
   meta = with stdenv.lib; {
     description = "OpenStreetMap data to PostgreSQL converter";
diff --git a/pkgs/tools/misc/pal/default.nix b/pkgs/tools/misc/pal/default.nix
index be96dd9d3d3..85bad70edc9 100644
--- a/pkgs/tools/misc/pal/default.nix
+++ b/pkgs/tools/misc/pal/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's,/etc/pal\.conf,'$out/etc/pal.conf, src/input.c
   '';
 
-  makeFlags = "prefix=$(out)";
+  makeFlags = [ "prefix=$(out)" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib gettext readline ];
diff --git a/pkgs/tools/misc/parcellite/default.nix b/pkgs/tools/misc/parcellite/default.nix
index 8dcaed706c1..46606e3b43b 100644
--- a/pkgs/tools/misc/parcellite/default.nix
+++ b/pkgs/tools/misc/parcellite/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook intltool pkgconfig wrapGAppsHook ];
   buildInputs = [ gtk2 hicolor-icon-theme ];
-  NIX_LDFLAGS = [ "-lgio-2.0" ];
+  NIX_LDFLAGS = "-lgio-2.0";
 
   preFixup = ''
     # Need which and xdotool on path to fix auto-pasting.
diff --git a/pkgs/tools/misc/pws/default.nix b/pkgs/tools/misc/pws/default.nix
index d5f2fd4afd4..50952435dd7 100644
--- a/pkgs/tools/misc/pws/default.nix
+++ b/pkgs/tools/misc/pws/default.nix
@@ -3,19 +3,19 @@
 stdenv.mkDerivation rec {
   name = "pws-${(import ./gemset.nix).pws.version}";
 
-  env = bundlerEnv {
-    name = "${name}-gems";
-
-    inherit ruby;
-
-    gemdir = ./.;
-  };
-
   buildInputs = [ makeWrapper ];
 
   phases = ["installPhase"];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${name}-gems";
+
+      inherit ruby;
+
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/pws $out/bin/pws \
       --set PATH '"${xsel}/bin/:$PATH"'
diff --git a/pkgs/tools/misc/qjoypad/default.nix b/pkgs/tools/misc/qjoypad/default.nix
index 4428bf1e625..3e7e3870959 100644
--- a/pkgs/tools/misc/qjoypad/default.nix
+++ b/pkgs/tools/misc/qjoypad/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libX11 libXtst qt4 ];
-  NIX_LDFLAGS = [ "-lX11" ];
+  NIX_LDFLAGS = "-lX11";
   patchPhase = ''
     cd src
     substituteInPlace config --replace /bin/bash ${stdenv.shell}
diff --git a/pkgs/tools/misc/reredirect/default.nix b/pkgs/tools/misc/reredirect/default.nix
new file mode 100644
index 00000000000..15045d4bd8a
--- /dev/null
+++ b/pkgs/tools/misc/reredirect/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "reredirect";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "jerome-pouiller";
+    repo = "reredirect";
+    rev = "v${version}";
+    sha256 = "0aqzs940kwvw80lhkszx8spcdh9ilsx5ncl9vnp611hwlryfw7kk";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postFixup = ''
+    substituteInPlace ${placeholder "out"}/bin/relink \
+      --replace "reredirect" "${placeholder "out"}/bin/reredirect"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tool to dynamicly redirect outputs of a running process";
+    homepage = "https://github.com/jerome-pouiller/reredirect";
+    license = licenses.mit;
+    maintainers = [ maintainers.tobim ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
+
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index ee47c17065f..466a5f3faf1 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -49,9 +49,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-  ];
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   postInstall = ''
     rm -r $out/etc/cron.*
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 4683f10092f..fa59935f561 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "starship";
-  version = "0.32.2";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "starship";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1yn2xr7142xnrsglrabxzgv16hp16i5d2dybazpzxflfnn52c0am";
+    sha256 = "1wqxcfd7ams3k0swps9037dzc1qzxhpbqaz4qjw9jabgcl6jkb6v";
   };
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
       --replace "/bin/echo" "echo"
   '';
 
-  cargoSha256 = "0i3jrk7qyyzhk4855z0vsdf64n14xqqg9by0dr62jz83hdx89x1w";
+  cargoSha256 = "0gcca3vlwrfhw9k4r9zc1raflr1m4xws9dpdxjh1kz34f9g88ijg";
   checkPhase = "cargo test -- --skip directory::home_directory --skip directory::directory_in_root";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index b530193258c..66ed0a11fd9 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
       --replace 'PYTHONPATH=lib' 'PYTHONPATH=lib:$PYTHONPATH'
   '';
 
-  makeFlags = "PREFIX=$(out) SYSCONFDIR=$(out)/etc PYTHON=${python.interpreter}";
+  makeFlags = [ "PREFIX=$(out)" "SYSCONFDIR=$(out)/etc" "PYTHON=${python.interpreter}" ];
 
   postInstall = ''
     wrapProgram "$out/bin/svtplay-dl" \
diff --git a/pkgs/tools/misc/teleconsole/default.nix b/pkgs/tools/misc/teleconsole/default.nix
index 4cac9befe16..b8e984e90c4 100644
--- a/pkgs/tools/misc/teleconsole/default.nix
+++ b/pkgs/tools/misc/teleconsole/default.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   CGO_ENABLED = 1;
-  buildFlags = "-ldflags";
+  buildFlags = [ "-ldflags" ];
 
   meta = with stdenv.lib; {
     homepage = "https://www.teleconsole.com/";
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index 318ad6e3a9d..c307c96199f 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   configureFlags = [ "--enable-audio=oss,alsa,jack" "--enable-alsaseq" "--with-default-output=alsa" "--enable-ncurses" ];
 
-  NIX_LDFLAGS = ["-ljack -L${libjack2}/lib"];
+  NIX_LDFLAGS = "-ljack -L${libjack2}/lib";
 
   instruments = fetchurl {
     url = http://www.csee.umbc.edu/pub/midia/instruments.tar.gz;
diff --git a/pkgs/tools/misc/tmpwatch/default.nix b/pkgs/tools/misc/tmpwatch/default.nix
index 59aa3861510..006cef6f102 100644
--- a/pkgs/tools/misc/tmpwatch/default.nix
+++ b/pkgs/tools/misc/tmpwatch/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1m5859ngwx61l1i4s6fja2avf1hyv6w170by273w8nsin89825lk";
   };
 
-  configureFlags="--with-fuser=${psmisc}/bin/fuser";
+  configureFlags = [ "--with-fuser=${psmisc}/bin/fuser" ];
 
   meta = with stdenv.lib; {
     homepage = https://fedorahosted.org/tmpwatch/;
diff --git a/pkgs/tools/misc/tmux-xpanes/default.nix b/pkgs/tools/misc/tmux-xpanes/default.nix
new file mode 100644
index 00000000000..3ea5f758050
--- /dev/null
+++ b/pkgs/tools/misc/tmux-xpanes/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, openssl, perl }:
+
+stdenv.mkDerivation rec {
+  pname = "tmux-xpanes";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "greymd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "11yz6rh2ckd1z8q80n8giv2gcz2i22fgf3pnfxq96qrzflb0d96a";
+  };
+
+  buildInputs = [ openssl perl ];
+
+  installPhase = ''
+    # Create directories.
+    install -m 755 -d $out/bin/
+    install -m 755 -d $out/share/man/man1/
+
+    # Perform installation.
+    install -m 755 bin/* $out/bin/
+    install -m 644 man/*.1 $out/share/man/man1/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "tmux-based terminal divider";
+    homepage = "https://github.com/greymd/tmux-xpanes";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ monsieurp ];
+  };
+}
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index 3adf37c2218..db25ec9d366 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15w1qi38dsx573nadqpvarxx63xla53w775fwkdds2iyspaljsg6";
+    sha256 = "1pr8bwwxp8zvn89ldsb0qy5asx59kpd7dsp7sjmgnbj2ddizl05n";
   };
 
-  cargoSha256 = "0xhrgs2rpkgjzgsipq5rb3fmqwvxrl2wi0fly1xaa6p304k1710m";
+  cargoSha256 = "1f5s8nxl450vpfhvshiwvm49q6ph79vb40qqiz0a2i6jdrzhphq3";
 
   meta = with stdenv.lib; {
     description = "Upgrade all the things";
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index ccf8113e1a5..b863786145c 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)/bin" ] ++ lib.optional enableStatic "LDFLAGS=--static";
 
-  installTargets = "install_flat";
+  installTargets = [ "install_flat" ];
 
   # tests currently (as of 0.8.0) get stuck in an infinite loop...
   # ...this is fixed in latest git, so doCheck can likely be enabled for next release
diff --git a/pkgs/tools/misc/tty-clock/default.nix b/pkgs/tools/misc/tty-clock/default.nix
index edaa9b662e7..b261f0ef841 100644
--- a/pkgs/tools/misc/tty-clock/default.nix
+++ b/pkgs/tools/misc/tty-clock/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ncurses ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/xorg62/tty-clock;
diff --git a/pkgs/tools/misc/txr/default.nix b/pkgs/tools/misc/txr/default.nix
index c47fe77fb76..0f68ca82ece 100644
--- a/pkgs/tools/misc/txr/default.nix
+++ b/pkgs/tools/misc/txr/default.nix
@@ -2,16 +2,21 @@
 
 stdenv.mkDerivation rec {
   pname = "txr";
-  version = "225";
+  version = "230";
 
   src = fetchurl {
     url = "http://www.kylheku.com/cgit/txr/snapshot/${pname}-${version}.tar.bz2";
-    sha256 = "07vh0rmvjr2sir15l3ppp2pnp2d849dg17rzykkzqyk3d5rwfxyj";
+    sha256 = "03ab9drdqvkfq240pkrx6197jjvvjizjwfx9psjmm6lixksw0kjx";
   };
 
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ libffi ];
 
+  # fix usage of off_t without include
+  postPatch = ''
+    sed -i '1i#include <sys/types.h>' sysif.h
+  '';
+
   enableParallelBuilding = true;
 
   doCheck = true;
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 9d928a3701e..5aa9f8c34a4 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, rustPlatform, cargo, cmake, sphinx, lib, prefix ? "uutils-" }:
+{ stdenv, fetchFromGitHub, rustPlatform, cargo, cmake, sphinx, lib, prefix ? "uutils-"
+, Security
+}:
 
 rustPlatform.buildRustPackage {
   name = "uutils-coreutils-2019-05-03";
@@ -19,13 +21,13 @@ rustPlatform.buildRustPackage {
     ++ lib.optional (prefix != null) [ "PROG_PREFIX=${prefix}" ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ cargo sphinx ];
+  buildInputs = [ cargo sphinx ] ++ lib.optional stdenv.isDarwin Security;
 
   # empty {build,install}Phase to use defaults of `stdenv.mkDerivation` rather than rust defaults
   buildPhase = "";
   installPhase = "";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Cross-platform Rust rewrite of the GNU coreutils";
     longDescription = ''
       uutils is an attempt at writing universal (as in cross-platform)
diff --git a/pkgs/tools/misc/vmtouch/default.nix b/pkgs/tools/misc/vmtouch/default.nix
index e5bb23016ae..fda442a6729 100644
--- a/pkgs/tools/misc/vmtouch/default.nix
+++ b/pkgs/tools/misc/vmtouch/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [perl];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
     description = "Portable file system cache diagnostics and control";
diff --git a/pkgs/tools/misc/wob/default.nix b/pkgs/tools/misc/wob/default.nix
index ac00fd007e3..c3b3cd11239 100644
--- a/pkgs/tools/misc/wob/default.nix
+++ b/pkgs/tools/misc/wob/default.nix
@@ -5,17 +5,15 @@
 
 stdenv.mkDerivation rec {
   pname = "wob";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "francma";
     repo = pname;
     rev = version;
-    sha256 = "1z8q5p5q8f0dfjzr96jldz97ycir9ip4p2cwj26nywmb8r0hznjr";
+    sha256 = "0cfglwh1inv6ng55vgznhll51m9g1lxfh37k4ridyxl64rc9jfq8";
   };
 
-  postPatch = "sed -Ei 's/Version\ 0\.[0-9]/Version ${version}/' wob.1.scd";
-
   nativeBuildInputs = [ meson ninja pkg-config scdoc wayland ];
   buildInputs = [ wayland-protocols ];
 
diff --git a/pkgs/tools/misc/wyrd/default.nix b/pkgs/tools/misc/wyrd/default.nix
index ec516555273..6a5ec867222 100644
--- a/pkgs/tools/misc/wyrd/default.nix
+++ b/pkgs/tools/misc/wyrd/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0zlrg602q781q8dij62lwdprpfliyy9j1rqfqcz8p2wgndpivddj";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-DNCURSES_INTERNALS=1" ];
+  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
 
   preConfigure = ''
     substituteInPlace curses/curses.ml --replace 'pp gcc' "pp $CC"
diff --git a/pkgs/tools/misc/xdo/default.nix b/pkgs/tools/misc/xdo/default.nix
index f042b9e209f..77a2ef763a9 100644
--- a/pkgs/tools/misc/xdo/default.nix
+++ b/pkgs/tools/misc/xdo/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
      sha256 = "1h3jrygcjjbavdbkpx2hscsf0yf97gk487lzjdlvymd7dxdv9hy9";
    };
 
-   makeFlags = "PREFIX=$(out)";
+   makeFlags = [ "PREFIX=$(out)" ];
 
    buildInputs = [ libxcb xcbutilwm xcbutil ];
 
diff --git a/pkgs/tools/misc/xsel/default.nix b/pkgs/tools/misc/xsel/default.nix
index 3d2fb50371e..4c39babc317 100644
--- a/pkgs/tools/misc/xsel/default.nix
+++ b/pkgs/tools/misc/xsel/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation {
   pname = "xsel-unstable";
 
-  version = "2018-01-10";
+  version = "2019-08-21";
 
   src = fetchFromGitHub {
     owner = "kfish";
     repo = "xsel";
-    rev = "9bfc13d64b5acb92c6648c696a9d9260fcbecc65";
-    sha256 = "05ms34by5hxznnpvmvhgp6llvlkz0zw4sq6c4bgwr82lj140lscm";
+    rev = "ef01f3c72a195dbce682184c842b81b17d7d7ad1";
+    sha256 = "191qa6022b7nww3bicfxpgp4d9x6c8s3sgixi780383ghkxds08c";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index e9091086ed9..b1481b2208c 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format"
+  NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=format"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
     "-Wno-error=memset-elt-size"
diff --git a/pkgs/tools/networking/atinout/default.nix b/pkgs/tools/networking/atinout/default.nix
index 175ba3960ee..16b3ee668da 100644
--- a/pkgs/tools/networking/atinout/default.nix
+++ b/pkgs/tools/networking/atinout/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "atinout-${version}";
   version = "0.9.2-alpha";
 
-  NIX_CFLAGS_COMPILE = [ "-Werror=implicit-fallthrough=0" ];
+  NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";
   LANG = "C.UTF-8";
   nativeBuildInputs = [ ronn mount ];
 
diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix
new file mode 100644
index 00000000000..f1b9a87dd5a
--- /dev/null
+++ b/pkgs/tools/networking/bandwhich/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, rustPlatform, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bandwhich";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "imsnif";
+    repo = pname;
+    rev = version;
+    sha256 = "1qrxxy6vhac1g6jzg30lqwcpjffyk2297jkd9j4rmwwf5cgip58a";
+  };
+
+  cargoSha256 = "1rixpljqddwhryddzni5l6m4sjyn1krrj0ig0rzc701am7srhg3a";
+
+  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+
+  meta = with stdenv.lib; {
+    description = "A CLI utility for displaying current network utilization";
+    longDescription = ''
+      bandwhich sniffs a given network interface and records IP packet size, cross
+      referencing it with the /proc filesystem on linux or lsof on MacOS. It is
+      responsive to the terminal window size, displaying less info if there is
+      no room for it. It will also attempt to resolve ips to their host name in
+      the background using reverse DNS on a best effort basis.
+    '';
+    homepage = "https://github.com/imsnif/bandwhich";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 4637a39e6e9..8e766cdeeb5 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
      void sigint(int sig) FUNCATTR_NORETURN;
     -inline void init(void);
     +static inline void init(void);
-     
+
      /* clear stuff and exit */
     --- a/src/options.c
     +++ b/src/options.c
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
 
   # This code uses inline in the gnu89 sense: see http://clang.llvm.org/compatibility.html#inline
-  NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-std=gnu89" else null;
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-std=gnu89";
 
   meta = with stdenv.lib; {
     description = "A small and simple console-based live network and disk io bandwidth monitor";
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index c0c3281431f..2ec16aa430a 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   hardeningEnable = [ "pie" ];
 
   configureFlags = [ "--chronyvardir=$(out)/var/lib/chrony" ]
-    ++ stdenv.lib.optional stdenv.isLinux [ "--enable-scfilter" ];
+    ++ stdenv.lib.optional stdenv.isLinux "--enable-scfilter";
 
   meta = with stdenv.lib; {
     description = "Sets your computer's clock from time servers on the Net";
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index f9dc3de7735..df94de882be 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     # for flock
     stdenv.lib.optional stdenv.isLinux utillinux;
 
-  CFLAGS = "-O2";
+  CFLAGS = "-O2 -Wno-error=stringop-truncation";
   buildPhase =
     stdenv.lib.optionalString stdenv.isAarch32 "Seccomp_NO=1 "
     + "bash do";
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
new file mode 100644
index 00000000000..f3d0a584593
--- /dev/null
+++ b/pkgs/tools/networking/clash/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "clash";
+  version = "0.17.1";
+
+  src = fetchFromGitHub {
+    owner = "Dreamacro";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0zhbaw9jzl9wqc7yx8yxqlb6fwkss4pqkv26069qg6nsk584ndnf";
+  };
+
+  goPackagePath = "github.com/Dreamacro/clash";
+  modSha256 = "0vyd61bin7hmpdqrmrikc776mgif9v25627n8hzi65kiycv40kgx";
+
+  buildFlagsArray = [
+    "-ldflags="
+    "-X ${goPackagePath}/constant.Version=${version}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A rule-based tunnel in Go";
+    homepage = "https://github.com/Dreamacro/clash";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ contrun filalex77 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/corerad/default.nix b/pkgs/tools/networking/corerad/default.nix
new file mode 100644
index 00000000000..6f9ea09eea1
--- /dev/null
+++ b/pkgs/tools/networking/corerad/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "corerad";
+  version = "0.1.4";
+
+  goPackagePath = "github.com/mdlayher/corerad";
+
+  src = fetchFromGitHub {
+    owner = "mdlayher";
+    repo = "corerad";
+    rev = "v${version}";
+    sha256 = "0qlmmgdz69gqqn6h5kb3gsjyj7lm6pcfcx9xlmrxhisj914ij76r";
+  };
+
+  modSha256 = "0vim91yvw0cf9bd10hfanz8azq7q19lp2x61rs44ycx9zm3qdhcw";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/mdlayher/corerad";
+    description = "CoreRAD extensible and observable IPv6 NDP RA daemon";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mdlayher ];
+  };
+}
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index bcf0743b7b9..c5d650f52bb 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -36,12 +36,14 @@ stdenv.mkDerivation rec {
     "--enable-early-chroot"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    (lib.optional stdenv.isLinux "--with-randomdev=/dev/random")
-  ] ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
+  ] ++ lib.optional stdenv.isLinux "--with-randomdev=/dev/random"
+    ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
 
-  NIX_CFLAGS_COMPILE = [
+  NIX_CFLAGS_COMPILE = builtins.toString [
     "-Wno-error=pointer-compare"
     "-Wno-error=format-truncation"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=format-overflow"
   ];
 
   installFlags = [ "DESTDIR=\${out}" ];
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 20b017ee67c..c45d017e3f5 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, pkgconfig, udev, runtimeShellPackage, runtimeShell }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, udev, runtimeShellPackage,
+runtimeShell }:
 
 stdenv.mkDerivation rec {
   # when updating this to >=7, check, see previous reverts:
@@ -21,6 +22,13 @@ stdenv.mkDerivation rec {
     substituteInPlace hooks/dhcpcd-run-hooks.in --replace /bin/sh ${runtimeShell}
   '';
 
+  patches = [
+    (fetchpatch {
+      url = "https://roy.marples.name/cgit/dhcpcd.git/patch/?id=114870290a8d3d696bc4049c32eef3eed03d6070";
+      sha256 = "0kzpwjh2gzvl5lvlnw6lis610p67nassk3apns68ga2pyxlky8qb";
+    })
+  ];
+
   preConfigure = "patchShebangs ./configure";
 
   configureFlags = [
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
index 3382616bfb6..8dd18df28c7 100644
--- a/pkgs/tools/networking/eternal-terminal/default.nix
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eternal-terminal";
-  version = "6.0.4";
+  version = "6.0.5";
 
   src = fetchFromGitHub {
     owner = "MisterTea";
     repo = "EternalTerminal";
     rev = "et-v${version}";
-    sha256 = "05hbcbbxpvwm17ascnrwrz413kp3i94kp4px3vqx0f635rm41dqc";
+    sha256 = "04jn0189vq5lc795izkxq1zdv9fnpxz2xchg2mm37armpz7n06id";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/findomain/default.nix b/pkgs/tools/networking/findomain/default.nix
new file mode 100644
index 00000000000..abc34abd77f
--- /dev/null
+++ b/pkgs/tools/networking/findomain/default.nix
@@ -0,0 +1,37 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, rustPlatform
+, installShellFiles
+, perl
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "findomain";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "Edu4rdSHL";
+    repo = pname;
+    rev = version;
+    sha256 = "1p7bj8q3zwn92nn6d71bk7cczclcsjvan6m8znlzr4lrwircp1y1";
+  };
+
+  cargoSha256 = "1grb0frc1kp3z6vs2906h9v1yx9qxn6x0gf9jy1msqgnqjw0bgn9";
+
+  nativeBuildInputs = [ installShellFiles perl ];
+  buildInputs = lib.optional stdenv.isDarwin Security;
+
+  postInstall = ''
+    installManPage ${pname}.1
+  '';
+
+  meta = with lib; {
+    description = "The fastest and cross-platform subdomain enumerator";
+    homepage = "https://github.com/Edu4rdSHL/findomain";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 87932cd02bd..46ccfc0d24c 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.30.0";
+  version = "0.31.1";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15q2lfwqyicgllhh5fn3a8g3iw9m42cd0izb99a24hn57pd9cr0n";
+    sha256 = "1cf2f0nbcg76i4mv8l3d38c13lw0mma6d2xzwkb9iqn7jflj1j9y";
   };
 
   modSha256 = "1zbl0gfc99pbzdacxhfa1k3y6i7v13sb441wpbp9aygxhvwqrms9";
diff --git a/pkgs/tools/networking/iodine/default.nix b/pkgs/tools/networking/iodine/default.nix
index 5aa0c01e848..44bf52c9933 100644
--- a/pkgs/tools/networking/iodine/default.nix
+++ b/pkgs/tools/networking/iodine/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-DIFCONFIGPATH=\"${nettools}/bin/\"";
 
-  installFlags = "prefix=\${out}";
+  installFlags = [ "prefix=\${out}" ];
 
   meta = {
     homepage = http://code.kryo.se/iodine/;
diff --git a/pkgs/tools/networking/ipv6calc/default.nix b/pkgs/tools/networking/ipv6calc/default.nix
index 5de4b8cecb7..35aeb23a9a8 100644
--- a/pkgs/tools/networking/ipv6calc/default.nix
+++ b/pkgs/tools/networking/ipv6calc/default.nix
@@ -30,13 +30,9 @@ stdenv.mkDerivation rec {
     "--disable-bundled-md5"
     "--disable-dynamic-load"
     "--enable-shared"
-  ] ++ stdenv.lib.optional (libmaxminddb != null ) [
-    "--enable-mmdb"
-  ] ++ stdenv.lib.optional (geolite-legacy != null) [
-    "--with-geoip-db=${geolite-legacy}/share/GeoIP"
-  ] ++ stdenv.lib.optional (ip2location-c != null ) [
-    "--enable-ip2location"
-  ];
+  ] ++ stdenv.lib.optional (libmaxminddb != null) "--enable-mmdb"
+    ++ stdenv.lib.optional (geolite-legacy != null) "--with-geoip-db=${geolite-legacy}/share/GeoIP"
+    ++ stdenv.lib.optional (ip2location-c != null) "--enable-ip2location";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 0f043c58a18..4c8b926b582 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -26,11 +26,12 @@ stdenv.mkDerivation {
   };
 
   # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
+  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
     # these flags were added to build with gcc7
     "-Wno-error=implicit-fallthrough"
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
+    "-Wno-error=stringop-truncation"
   ];
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
diff --git a/pkgs/tools/networking/maphosts/default.nix b/pkgs/tools/networking/maphosts/default.nix
index e54a2b21d9f..dd9886a65ee 100644
--- a/pkgs/tools/networking/maphosts/default.nix
+++ b/pkgs/tools/networking/maphosts/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, bundlerEnv, ruby, bundlerUpdateScript }:
 
-stdenv.mkDerivation rec {
-  name = "maphosts-${env.gems.maphosts.version}";
-
+let
   env = bundlerEnv {
     name = "maphosts-gems";
     inherit ruby;
     gemdir = ./.;
   };
+in stdenv.mkDerivation {
+  name = "maphosts-${env.gems.maphosts.version}";
 
   phases = ["installPhase"];
 
diff --git a/pkgs/tools/networking/mcrcon/default.nix b/pkgs/tools/networking/mcrcon/default.nix
index e902f24ca0e..469dd4cceb7 100644
--- a/pkgs/tools/networking/mcrcon/default.nix
+++ b/pkgs/tools/networking/mcrcon/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mcrcon";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "Tiiffi";
     repo = "mcrcon";
     rev = "v${version}";
-    sha256 = "0as60cgl8sflykmwihc6axy1hzx6gjgjav6c7mvlbsc43dv8fs51";
+    sha256 = "004h1glagyw1mic1k461bky0w2fxdfhrhcqjzr9wp6gvyy9s8bix";
   };
 
   buildPhase = ''
diff --git a/pkgs/tools/networking/miniupnpc/default.nix b/pkgs/tools/networking/miniupnpc/default.nix
index dc0a4457dde..ebe6a60291a 100644
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@@ -11,14 +11,13 @@ let
         inherit sha256;
       };
 
-      nativeBuildInputs = [] ++
-        stdenv.lib.optionals stdenv.isDarwin [ which cctools ];
+      nativeBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ which cctools ];
 
       patches = stdenv.lib.optional stdenv.isFreeBSD ./freebsd.patch;
 
       doCheck = !stdenv.isFreeBSD;
 
-      makeFlags = "PREFIX=$(out) INSTALLPREFIX=$(out)";
+      makeFlags = [ "PREFIX=$(out)" "INSTALLPREFIX=$(out)" ];
 
       meta = with stdenv.lib; {
         homepage = http://miniupnp.free.fr/;
diff --git a/pkgs/tools/networking/network-manager/iodine/default.nix b/pkgs/tools/networking/network-manager/iodine/default.nix
index 1b41a176723..29c0d550fe2 100644
--- a/pkgs/tools/networking/network-manager/iodine/default.nix
+++ b/pkgs/tools/networking/network-manager/iodine/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/network-manager/strongswan.nix b/pkgs/tools/networking/network-manager/strongswan.nix
index 8d16f71c4af..843985bfa3e 100644
--- a/pkgs/tools/networking/network-manager/strongswan.nix
+++ b/pkgs/tools/networking/network-manager/strongswan.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ intltool pkgconfig ];
 
   # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = [ "-DGLIB_DISABLE_DEPRECATION_WARNINGS" ];
+  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
 
   configureFlags = [
     "--without-libnm-glib"
diff --git a/pkgs/tools/networking/nfstrace/default.nix b/pkgs/tools/networking/nfstrace/default.nix
index 50654da54e4..88510b9b887 100644
--- a/pkgs/tools/networking/nfstrace/default.nix
+++ b/pkgs/tools/networking/nfstrace/default.nix
@@ -18,13 +18,18 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "-Wno-braced-scalar-init" ""
+  '';
+
   buildInputs = [ json_c libpcap ncurses ];
   nativeBuildInputs = [ cmake ];
 
   # To build with GCC 8+ it needs:
-  CXXFLAGS = [ "-Wno-class-memaccess" "-Wno-ignored-qualifiers" ];
+  CXXFLAGS = "-Wno-class-memaccess -Wno-ignored-qualifiers";
   # CMake can't find json_c without:
-  NIX_CFLAGS_COMPILE = [ "-I${json_c.dev}/include/json-c" ];
+  NIX_CFLAGS_COMPILE = [ "-I${json_c.dev}/include/json-c" "-Wno-error=address-of-packed-member" ];
 
   doCheck = false; # requires network access
 
diff --git a/pkgs/tools/networking/ngrok-2/default.nix b/pkgs/tools/networking/ngrok-2/default.nix
index cc5620a1f4d..a0d6171efe2 100644
--- a/pkgs/tools/networking/ngrok-2/default.nix
+++ b/pkgs/tools/networking/ngrok-2/default.nix
@@ -5,8 +5,8 @@ with stdenv.lib;
 let versions = builtins.fromJSON (builtins.readFile ./versions.json);
     arch = if stdenv.isi686 then "386"
            else if stdenv.isx86_64 then "amd64"
+           else if stdenv.isAarch32 then "arm"
            else if stdenv.isAarch64 then "arm64"
-           else if stdenv.isArm then "arm"
            else throw "Unsupported architecture";
     os = if stdenv.isLinux then "linux"
          else if stdenv.isDarwin then "darwin"
diff --git a/pkgs/tools/networking/ntopng/default.nix b/pkgs/tools/networking/ntopng/default.nix
index 0c693ac6288..68f80106031 100644
--- a/pkgs/tools/networking/ntopng/default.nix
+++ b/pkgs/tools/networking/ntopng/default.nix
@@ -54,8 +54,8 @@ stdenv.mkDerivation rec {
     sed 's|LIBS += -lstdc++.6||' -i Makefile
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-fpermissive" ]
-    ++ stdenv.lib.optional stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
+  NIX_CFLAGS_COMPILE = "-fpermissive"
+    + stdenv.lib.optionalString stdenv.cc.isClang " -Wno-error=reserved-user-defined-literal";
 
   meta = with stdenv.lib; {
     description = "High-speed web-based traffic analysis and flow collection tool";
diff --git a/pkgs/tools/networking/openresolv/default.nix b/pkgs/tools/networking/openresolv/default.nix
index 190c903d9c1..423282aa8c1 100644
--- a/pkgs/tools/networking/openresolv/default.nix
+++ b/pkgs/tools/networking/openresolv/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       EOF
     '';
 
-  installFlags = "SYSCONFDIR=$(out)/etc";
+  installFlags = [ "SYSCONFDIR=$(out)/etc" ];
 
   postInstall = ''
     wrapProgram "$out/sbin/resolvconf" --set PATH "${coreutils}/bin"
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 2a1122029c1..90ecba0891d 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -12,10 +12,8 @@ let
   # **please** update this patch when you update to a new openssh release.
   gssapiPatch = fetchpatch {
     name = "openssh-gssapi.patch";
-    url = "https://salsa.debian.org/ssh-team/openssh/raw/"
-      + "e50a98bda787a3b9f53ed67bdccbbac0bde1f9ae"
-      + "/debian/patches/gssapi.patch";
-    sha256 = "14j9cabb3gkhkjc641zbiv29mbvsmgsvis3fbj8ywsd21zc7m2hv";
+    url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%258.1p1-2/debian/patches/gssapi.patch";
+    sha256 = "0zfxx46a5lpjp317z354yyswa2wvmb1pp5p0nxsbhsrzw94jvxsj";
   };
 
 in
@@ -61,11 +59,9 @@ stdenv.mkDerivation rec {
       substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
     '';
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ] ++ optional (hpnSupport || withGssapiPatches) autoreconfHook;
   buildInputs = [ zlib openssl libedit pam ]
-    ++ optional withKerberos kerberos
-    ++ optional hpnSupport autoreconfHook
-    ;
+    ++ optional withKerberos kerberos;
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 2041d935c94..623645efc0c 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -11,7 +11,11 @@ stdenv.mkDerivation {
   setSourceRoot = ''
     export sourceRoot=$(realpath */gtests/net/packetdrill)
   '';
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error=unused-result"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=address-of-packed-member"
+  ];
   nativeBuildInputs = [ bison flex ];
   patches = [ ./nix.patch ];
   enableParallelBuilding = true;
diff --git a/pkgs/tools/networking/ratools/default.nix b/pkgs/tools/networking/ratools/default.nix
index cf8c370c522..f5353db6803 100644
--- a/pkgs/tools/networking/ratools/default.nix
+++ b/pkgs/tools/networking/ratools/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "07m45bn9lzgbfihmxic23wqp73nxg5ihrvkigr450jq6gzvgwawq";
   };
 
-  makeFlags = "-C src";
+  makeFlags = [ "-C" "src" ];
 
   installPhase = ''
     install -vD bin/* -t $out/bin
diff --git a/pkgs/tools/networking/shadowfox/default.nix b/pkgs/tools/networking/shadowfox/default.nix
index 8a2dee19b95..f2ae143e1b9 100644
--- a/pkgs/tools/networking/shadowfox/default.nix
+++ b/pkgs/tools/networking/shadowfox/default.nix
@@ -15,7 +15,7 @@ buildGoModule rec {
 
   modSha256 = "0hcc87mzacqwbw10l49kx0sxl4mivdr88c40wh6hdfvrbam2w86r";
 
-  buildFlags = "--tags release";
+  buildFlags = [ "--tags" "release" ];
 
   meta = with stdenv.lib; {
     description = ''
diff --git a/pkgs/tools/networking/shorewall/default.nix b/pkgs/tools/networking/shorewall/default.nix
new file mode 100644
index 00000000000..8e62aa735a4
--- /dev/null
+++ b/pkgs/tools/networking/shorewall/default.nix
@@ -0,0 +1,130 @@
+{ coreutils
+, ebtables
+, fetchurl
+, gnugrep
+, gnused
+, iproute
+, ipset
+, iptables
+, perl
+, perlPackages
+, stdenv
+, tree
+, utillinux
+}:
+let
+  PATH = stdenv.lib.concatStringsSep ":"
+           [ "${coreutils}/bin"
+             "${iproute}/bin"
+             "${iptables}/bin"
+             "${ipset}/bin"
+             "${ebtables}/bin"
+             "${utillinux}/bin"
+             "${gnugrep}/bin"
+             "${gnused}/bin"
+           ];
+in
+stdenv.mkDerivation rec {
+  pname = "shorewall";
+  version = "5.2.3.3";
+
+  srcs = [
+    (fetchurl {
+      url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.3/shorewall-core-${version}.tar.bz2";
+      sha256 = "1gg2yfxzm3y9qqjrrg5nq2ggi1c6yfxx0s7fvwjw70b185mwa5p5";
+    })
+    (fetchurl {
+      url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.3/shorewall-${version}.tar.bz2";
+      sha256 = "1ka70pa3s0cnvc83rlm57r05cdv9idnxnq0vmxi6nr7razak5f3b";
+    })
+    (fetchurl {
+      url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.3/shorewall6-${version}.tar.bz2";
+      sha256 = "0mhs4m6agwk082h1n69gnyfsjpycdd8215r4r9rzb3czs5xi087n";
+    })
+  ];
+  sourceRoot = ".";
+
+  buildInputs = [
+    coreutils
+    iproute
+    ipset
+    iptables
+    ebtables
+    utillinux
+    gnugrep
+    gnused
+    perl
+  ] ++ (with perlPackages; [
+    DigestSHA1
+  ]);
+  prePatch = ''
+    # Patch configure and install.sh files
+    patchShebangs .
+
+    # Remove hardcoded PATH
+    sed -i shorewall-core-${version}/lib.cli \
+        -e '/^ *PATH=.*/d'
+  '';
+  configurePhase = ''
+    shorewall-core-${version}/configure \
+      HOST=linux \
+      PREFIX=$out \
+      CONFDIR=\$PREFIX/etc-example \
+      SBINDIR=\$PREFIX/sbin \
+      SYSCONFDIR= \
+      SHAREDIR=\$PREFIX/share \
+      LIBEXECDIR=\$SHAREDIR \
+      PERLLIBDIR=\$SHAREDIR/shorewall \
+      MANDIR=$out/man \
+      VARLIB=/var/lib \
+      INITSOURCE= \
+      INITDIR= \
+      INITFILE= \
+      DEFAULT_PAGER=
+  '';
+  installPhase = ''
+    export DESTDIR=/
+    shorewall-core-${version}/install.sh
+
+    ln -s ../shorewall-core-${version}/shorewallrc shorewall-${version}/
+    shorewall-${version}/install.sh
+
+    ln -s ../shorewall-core-${version}/shorewallrc shorewall6-${version}/
+    shorewall6-${version}/install.sh
+
+    # Patch the example shorewall{,6}.conf in case it is included
+    # in services.shorewall{,6}.configs
+    sed -i $out/etc-example/shorewall/shorewall.conf \
+           $out/etc-example/shorewall6/shorewall6.conf \
+        -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall.log|' \
+        -e 's|^PATH=.*|PATH=${PATH}|' \
+        -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \
+        -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|'
+    sed -i $out/etc-example/shorewall6/shorewall6.conf \
+        -e 's|^CONFIG_PATH=.*|CONFIG_PATH=:''${CONFDIR}/shorewall6:''${SHAREDIR}/shorewall6:''${SHAREDIR}/shorewall|'
+    # FIXME: the default GEOIPDIR=/usr/share/xt_geoip/LE may require attention.
+
+    # Redirect CONFDIR to /etc where services.shorewall{,6}.configs
+    # will generate the config files.
+    sed -i $out/share/shorewall/shorewallrc \
+        -e 's~^CONFDIR=.*~CONFDIR=/etc~'
+  '';
+
+  meta = {
+    homepage = http://www.shorewall.net/;
+    description = "An IP gateway/firewall configuration tool for GNU/Linux";
+    longDescription = ''
+      Shorewall is a high-level tool for configuring Netfilter. You describe your
+      firewall/gateway requirements using entries in a set of configuration
+      files. Shorewall reads those configuration files and with the help of the
+      iptables, iptables-restore, ip and tc utilities, Shorewall configures
+      Netfilter and the Linux networking subsystem to match your requirements.
+      Shorewall can be used on a dedicated firewall system, a multi-function
+      gateway/router/server or on a standalone GNU/Linux system. Shorewall does
+      not use Netfilter's ipchains compatibility mode and can thus take
+      advantage of Netfilter's connection state tracking capabilities.
+    '';
+    license = stdenv.lib.licenses.gpl2Plus;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index ba05ee8e8b5..9471efa92d7 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ makeWrapper ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   patchPhase = ''
     patchShebangs .
 
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index ebe31dc8b5a..81da427a52c 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -30,13 +30,13 @@ stdenv.mkDerivation {
         --replace '$(INSTALL) -s' '$(INSTALL) -s --strip-program $(STRIP)'
     '';
 
-  installFlags = "etcdir=$(out)/etc";
+  installFlags = [ "etcdir=$(out)/etc" ];
 
   installTargets = [ "install" "install-sendmail" ];
 
   buildInputs = stdenv.lib.optional tlsSupport openssl;
 
-  NIX_LDFLAGS = stdenv.lib.optional tlsSupport [ "-lcrypto" ];
+  NIX_LDFLAGS = stdenv.lib.optionalString tlsSupport "-lcrypto";
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/tracebox/default.nix b/pkgs/tools/networking/tracebox/default.nix
index 4062fc0fd58..1d3c4190e38 100644
--- a/pkgs/tools/networking/tracebox/default.nix
+++ b/pkgs/tools/networking/tracebox/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-lua=yes" ];
 
-  NIX_LDFLAGS = [ "${libpcap}/lib/libpcap.so" "${libcrafter}/lib/libcrafter.so" ];
+  NIX_LDFLAGS = "${libpcap}/lib/libpcap.so ${libcrafter}/lib/libcrafter.so";
 
   preAutoreconf = ''
     substituteInPlace Makefile.am --replace "noinst" ""
diff --git a/pkgs/tools/networking/traceroute/default.nix b/pkgs/tools/networking/traceroute/default.nix
index af8f5cafb89..8591db4e016 100644
--- a/pkgs/tools/networking/traceroute/default.nix
+++ b/pkgs/tools/networking/traceroute/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "3669d22a34d3f38ed50caba18cd525ba55c5c00d5465f2d20d7472e5d81603b6";
   };
 
-  makeFlags = "prefix=$(out) LDFLAGS=-lm";
+  makeFlags = [ "prefix=$(out)" "LDFLAGS=-lm" ];
 
   preConfigure = ''
     sed -i 's@LIBS := \(.*\) -lm \(.*\)@LIBS := \1 \2@' Make.rules
diff --git a/pkgs/tools/networking/uwimap/default.nix b/pkgs/tools/networking/uwimap/default.nix
index bc500a01c11..b687f1db017 100644
--- a/pkgs/tools/networking/uwimap/default.nix
+++ b/pkgs/tools/networking/uwimap/default.nix
@@ -8,12 +8,12 @@ stdenv.mkDerivation ({
     sha256 = "0a2a00hbakh0640r2wdpnwr8789z59wnk7rfsihh3j0vbhmmmqak";
   };
 
-  makeFlags = if stdenv.isDarwin
+  makeFlags = [ (if stdenv.isDarwin
     then "osx"
-    else "lnp" # Linux with PAM modules;
+    else "lnp") ]  # Linux with PAM modules;
     # -fPIC is required to compile php with imap on x86_64 systems
-    + stdenv.lib.optionalString stdenv.isx86_64 " EXTRACFLAGS=-fPIC"
-    + stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) " CC=${stdenv.hostPlatform.config}-gcc RANLIB=${stdenv.hostPlatform.config}-ranlib";
+    ++ stdenv.lib.optional stdenv.isx86_64 "EXTRACFLAGS=-fPIC"
+    ++ stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ "CC=${stdenv.hostPlatform.config}-gcc" "RANLIB=${stdenv.hostPlatform.config}-ranlib" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 78f17934a78..ee3ca416aa4 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -3,20 +3,20 @@
 , ... } @ args:
 
 callPackage ./generic.nix (rec {
-  version = "4.21.3";
+  version = "4.22.0";
 
   src = fetchFromGitHub {
     owner = "v2ray";
     repo = "v2ray-core";
     rev = "v${version}";
-    sha256 = "0z45nrjnalrvpprq7g4zrjbrdkc3d3lhs4ci8hb8m69f92asiwbs";
+    sha256 = "1gr4s96ii4dx5bcwpb82rn250pcnncxwzx147p9dbwbyiy0i9nz7";
   };
 
   assets = {
     # MIT licensed
     "geoip.dat" = let
-      geoipRev = "20190516.1";
-      geoipSha256 = "14h4rq7rlcl1397pwpylfgwpk3fiscpzqb04c4wd5lxkfvk5f02r";
+      geoipRev = "202001010102";
+      geoipSha256 = "16i73c3852f7zmya0q3856cc4gvhqhpln9s98qvr2dr1mpp72c1w";
     in fetchurl {
       url = "https://github.com/v2ray/geoip/releases/download/${geoipRev}/geoip.dat";
       sha256 = geoipSha256;
@@ -24,8 +24,8 @@ callPackage ./generic.nix (rec {
 
     # MIT licensed
     "geosite.dat" = let
-      geositeRev = "20191121.1";
-      geositeSha256 = "0ijmvy43pvm69w38djf114j8swni7wfq5ry9wdpv9dj0rzb59m74";
+      geositeRev = "20191226.1";
+      geositeSha256 = "0b4ji5kj5jpkwri3libxm9yl49dcy91vkl7h1rkhrrhbl17s3qiy";
     in fetchurl {
       url = "https://github.com/v2ray/domain-list-community/releases/download/${geositeRev}/dlc.dat";
       sha256 = geositeSha256;
diff --git a/pkgs/tools/networking/vde2/default.nix b/pkgs/tools/networking/vde2/default.nix
index 4ea09cd7f00..e43c174ab3f 100644
--- a/pkgs/tools/networking/vde2/default.nix
+++ b/pkgs/tools/networking/vde2/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     }
   );
 
-  configureFlags = stdenv.lib.optional (!withPython) [ "--disable-python" ];
+  configureFlags = stdenv.lib.optional (!withPython) "--disable-python";
 
   buildInputs = [ openssl libpcap ]
     ++ stdenv.lib.optional withPython python2;
diff --git a/pkgs/tools/networking/wireguard-go/0001-Fix-darwin-build.patch b/pkgs/tools/networking/wireguard-go/0001-Fix-darwin-build.patch
new file mode 100644
index 00000000000..d79d9e3531f
--- /dev/null
+++ b/pkgs/tools/networking/wireguard-go/0001-Fix-darwin-build.patch
@@ -0,0 +1,26 @@
+From 63360467da4ae6d7fc8c0e05619bdf8813c7e417 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sun, 5 Jan 2020 15:35:15 +0100
+Subject: [PATCH] Fix darwin build
+
+---
+ rwcancel/select_default.go | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/rwcancel/select_default.go b/rwcancel/select_default.go
+index dd23cda..03f3452 100644
+--- a/rwcancel/select_default.go
++++ b/rwcancel/select_default.go
+@@ -9,6 +9,7 @@ package rwcancel
+ 
+ import "golang.org/x/sys/unix"
+ 
+-func unixSelect(nfd int, r *unix.FdSet, w *unix.FdSet, e *unix.FdSet, timeout *unix.Timeval) error {
+-	return unix.Select(nfd, r, w, e, timeout)
++func unixSelect(nfd int, r *unix.FdSet, w *unix.FdSet, e *unix.FdSet, timeout *unix.Timeval) (err error) {
++	_, err = unix.Select(nfd, r, w, e, timeout)
++	return
+ }
+-- 
+2.23.1
+
diff --git a/pkgs/tools/networking/wireguard-go/default.nix b/pkgs/tools/networking/wireguard-go/default.nix
index 025573d7dd1..8832560b3b1 100644
--- a/pkgs/tools/networking/wireguard-go/default.nix
+++ b/pkgs/tools/networking/wireguard-go/default.nix
@@ -2,15 +2,17 @@
 
 buildGoPackage rec {
   pname = "wireguard-go";
-  version = "0.0.20190908";
+  version = "0.0.20191012";
 
   goPackagePath = "golang.zx2c4.com/wireguard";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-go/snapshot/wireguard-go-${version}.tar.xz";
-    sha256 = "1jsch0157nk86krdknij7dsvg6i7ar0ydhy07r40drhxqyp3q0hx";
+    sha256 = "0s3hvqpz13n630yvi0476hfzrp3xcj8x61zc2hl5z70f8kvbay4i";
   };
 
+  patches = [ ./0001-Fix-darwin-build.patch ];
+
   goDeps = ./deps.nix;
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/tools/networking/wireguard-go/deps.nix b/pkgs/tools/networking/wireguard-go/deps.nix
index 5501ebdc6c2..b1a92582b7c 100644
--- a/pkgs/tools/networking/wireguard-go/deps.nix
+++ b/pkgs/tools/networking/wireguard-go/deps.nix
@@ -5,8 +5,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "9756ffdc2472";
-      sha256 = "0q7hxaaq6lp0v8qqzifvysl47z5rfdlrxkh3d29vsl3wyby3dxl8";
+      rev = "34f69633bfdc";
+      sha256 = "0169vcn9s4c851y9vm7xqnar3vdfjrp7qsvcxadpfhsmwlfhxzgg";
     };
   }
   {
@@ -14,8 +14,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev = "ba9fcec4b297";
-      sha256 = "1hbqvy6r0s5h0dpdqw8fynl3cq0acin3iyqki9xvl5r8h33yb9bx";
+      rev = "d98b1b443823";
+      sha256 = "1vzwpy56g056dsq304xga3d55jg2cxx89bijpfwjlhwyqyskybsz";
     };
   }
   {
@@ -23,8 +23,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev = "19e00faab6ad";
-      sha256 = "0znjx9xbyjdvk8cafdc1jl22gg29asxl5yl7mi3yz6zx3h39rm8y";
+      rev = "c178f38b412c";
+      sha256 = "1r6v8xnvb4z5vdckbj6vd08kn6h4ivr9hvdpgq4drj6l1mp79rf7";
     };
   }
   {
diff --git a/pkgs/tools/networking/wireguard-tools/default.nix b/pkgs/tools/networking/wireguard-tools/default.nix
index 8133e2a5a54..a01b0ab2061 100644
--- a/pkgs/tools/networking/wireguard-tools/default.nix
+++ b/pkgs/tools/networking/wireguard-tools/default.nix
@@ -14,14 +14,14 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "wireguard-tools";
-  version = "0.0.20191219";
+  version = "1.0.20200102";
 
   src = fetchzip {
-    url = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "1qxpjvj3927xdly022rp2sndbifmr0c2y6ik77v43k95ch94716d";
+    url = "https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${version}.tar.xz";
+    sha256 = "0ry3vbckcbkx43bz0bqinrd1hkll67jbwb72ak0b41wkxjsc8fmv";
   };
 
-  sourceRoot = "source/src/tools";
+  sourceRoot = "source/src";
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = optional stdenv.isLinux libmnl;
@@ -51,10 +51,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Tools for the WireGuard secure network tunnel";
-    downloadPage = "https://git.zx2c4.com/WireGuard/refs/";
+    downloadPage = "https://git.zx2c4.com/wireguard-tools/refs/";
     homepage = "https://www.wireguard.com/";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ elseym ericsagnes mic92 zx2c4 globin ma27 ];
+    maintainers = with maintainers; [ elseym ericsagnes mic92 zx2c4 globin ma27 xwvvvvwx ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/wrk/default.nix b/pkgs/tools/networking/wrk/default.nix
index 9c8f46bef07..98705430c2f 100644
--- a/pkgs/tools/networking/wrk/default.nix
+++ b/pkgs/tools/networking/wrk/default.nix
@@ -22,13 +22,13 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-DluaL_reg=luaL_Reg" ]; # needed since luajit-2.1.0-beta3
-  
+  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg"; # needed since luajit-2.1.0-beta3
+
   installPhase = ''
     mkdir -p $out/bin
     cp wrk $out/bin
   '';
-  
+
   meta = with stdenv.lib; {
     description = "HTTP benchmarking tool";
     homepage = https://github.com/wg/wrk;
diff --git a/pkgs/tools/networking/zerotierone/default.nix b/pkgs/tools/networking/zerotierone/default.nix
index 58f2e816008..da5b8837523 100644
--- a/pkgs/tools/networking/zerotierone/default.nix
+++ b/pkgs/tools/networking/zerotierone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, lzo, zlib, iproute, which, ronn }:
+{ stdenv, buildPackages, fetchFromGitHub, openssl, lzo, zlib, iproute, ronn }:
 
 stdenv.mkDerivation rec {
   pname = "zerotierone";
@@ -20,11 +20,14 @@ stdenv.mkDerivation rec {
 
       patchShebangs ./doc/build.sh
       substituteInPlace ./doc/build.sh \
-        --replace '/usr/bin/ronn' '${ronn}/bin/ronn' \
-        --replace 'ronn -r' '${ronn}/bin/ronn -r'
+        --replace '/usr/bin/ronn' '${buildPackages.ronn}/bin/ronn' \
   '';
 
-  buildInputs = [ openssl lzo zlib iproute which ronn ];
+
+  nativeBuildInputs = [ ronn ];
+  buildInputs = [ openssl lzo zlib iproute ];
+
+  enableParallelBuilding = true;
 
   installPhase = ''
     install -Dt "$out/bin/" zerotier-one
@@ -43,7 +46,7 @@ stdenv.mkDerivation rec {
     description = "Create flat virtual Ethernet networks of almost unlimited size";
     homepage = https://www.zerotier.com;
     license = licenses.bsl11;
-    maintainers = with maintainers; [ sjmackenzie zimbatm ehmry obadz ];
-    platforms = platforms.x86_64 ++ platforms.aarch64;
+    maintainers = with maintainers; [ sjmackenzie zimbatm ehmry obadz danielfullmer ];
+    platforms = with platforms; x86_64 ++ aarch64 ++ arm;
   };
 }
diff --git a/pkgs/tools/package-management/cargo-release/default.nix b/pkgs/tools/package-management/cargo-release/default.nix
index eb3977e84e6..3e3ba47be05 100644
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
@@ -1,19 +1,20 @@
-{ stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ stdenv, rustPlatform, fetchFromGitHub, Security, openssl, pkg-config }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-release";
-  version = "0.12.4";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "sunng87";
     repo = "cargo-release";
     rev = "v${version}";
-    sha256 = "02rx25dd3klprwr1qmn5vn4vz4244amk2ky4nqfmi4vq3ygrhd1c";
+    sha256 = "1w9w43i5br94vg5m4idabh67p4ffsx2lmc2g0ak2k961vl46wr0q";
   };
 
-  cargoSha256 = "18nbmq8j58jlka1lsrx2y0bhb9l5f3wyvcr1zmmda3hvc3vm7kla";
+  cargoSha256 = "075fvvd4c8f3kz6i6ny835h6jpa3c1v3miwfwwrdyy49a85lzjyj";
 
-  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
   meta = with stdenv.lib; {
     description = ''Cargo subcommand "release": everything about releasing a rust crate'';
diff --git a/pkgs/tools/package-management/clib/default.nix b/pkgs/tools/package-management/clib/default.nix
index eb8f5ef186f..75c47dda0c4 100644
--- a/pkgs/tools/package-management/clib/default.nix
+++ b/pkgs/tools/package-management/clib/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "fortify" ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   buildInputs = [ curl ];
 
diff --git a/pkgs/tools/package-management/home-manager/default.nix b/pkgs/tools/package-management/home-manager/default.nix
index f093f442e52..21b2fad1caa 100644
--- a/pkgs/tools/package-management/home-manager/default.nix
+++ b/pkgs/tools/package-management/home-manager/default.nix
@@ -6,13 +6,13 @@
 stdenv.mkDerivation rec {
 
   pname = "home-manager";
-  version = "2019-11-17";
+  version = "2020-01-04";
 
   src = fetchFromGitHub {
     owner = "rycee";
     repo = "home-manager";
-    rev = "286dd9b3088298e5a4625b517f8e72b1c62e4f74";
-    sha256 = "0p3ba287h9a7mpj8chdgvz5qryc15qxdis3fdmv9jvl0hwsr738d";
+    rev = "1b7b1bc294e99ab1795fe7dad183c1d2ae58a099";
+    sha256 = "02kwym8n41d5ba9lccnl5q3y10sw35p1da5b66mxldfr6d930pbj";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index 0c53c1bbbc9..61435cee284 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  cmakeFlags="-DPYTHON_DESIRED=${stdenv.lib.substring 0 1 python.pythonVersion}";
+  cmakeFlags = ["-DPYTHON_DESIRED=${stdenv.lib.substring 0 1 python.pythonVersion}" ];
 
   buildInputs = [ python libxml2 glib openssl curl check gpgme ];
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 5c55ac31588..28413971c00 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -57,7 +57,7 @@ common =
       propagatedBuildInputs = [ boehmgc ];
 
       # Seems to be required when using std::atomic with 64-bit types
-      NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
+      NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
 
       preConfigure =
         # Copy libboost_context so we don't get all of Boost in our closure.
@@ -94,9 +94,9 @@ common =
            # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
         ++ lib.optional (!withLibseccomp) "--disable-seccomp-sandboxing";
 
-      makeFlags = "profiledir=$(out)/etc/profile.d";
+      makeFlags = [ "profiledir=$(out)/etc/profile.d" ];
 
-      installFlags = "sysconfdir=$(out)/etc";
+      installFlags = [ "sysconfdir=$(out)/etc" ];
 
       doInstallCheck = true; # not cross
 
@@ -174,10 +174,10 @@ in rec {
   };
 
   nixStable = callPackage common (rec {
-    name = "nix-2.3.1";
+    name = "nix-2.3.2";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "bb6578e9f20eebab6d78469ecc59c450ac54f276e5a86a882015d98fecb1bc7b";
+      sha256 = "9fea4b52db0b296dcf05d36f7ecad9f48396af3a682bb21e31f8d04c469beef8";
     };
 
     inherit storeDir stateDir confDir boehmgc;
diff --git a/pkgs/tools/package-management/opkg/default.nix b/pkgs/tools/package-management/opkg/default.nix
index 05f43cf29b1..1aae0290d5a 100644
--- a/pkgs/tools/package-management/opkg/default.nix
+++ b/pkgs/tools/package-management/opkg/default.nix
@@ -2,11 +2,11 @@
 , autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.1";
+  version = "0.4.2";
   pname = "opkg";
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/opkg/opkg-${version}.tar.gz";
-    sha256 = "0hqa4lqxs3w9fmn9idzfscjkm23jw5asby43v0szcxrqgl1ixb25";
+    sha256 = "01p1a7hw9q9ixfk01djyy9axs71z1x9dkdnqz7zysmrlqi97i246";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/tools/package-management/reuse/default.nix b/pkgs/tools/package-management/reuse/default.nix
index 4aadc4b7af0..13a3a85f082 100644
--- a/pkgs/tools/package-management/reuse/default.nix
+++ b/pkgs/tools/package-management/reuse/default.nix
@@ -4,13 +4,13 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "reuse";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "fsfe";
     repo = "reuse-tool";
     rev = "v${version}";
-    sha256 = "17bslyvjndhqryrisba9y7y0ijyzi3gmyl9rddkcvdqi3lg9668y";
+    sha256 = "04i8zd66cs152h28k9085nqg937wp31pz2yqywaldx1gywijyd8h";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
index 2be1db764e1..7ff079c0116 100644
--- a/pkgs/tools/package-management/xbps/default.nix
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./cert-paths.patch ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" ];
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)
diff --git a/pkgs/tools/security/afl/README.md b/pkgs/tools/security/afl/README.md
index 0b0d4e80fbc..180cad6bc4c 100644
--- a/pkgs/tools/security/afl/README.md
+++ b/pkgs/tools/security/afl/README.md
@@ -4,12 +4,12 @@ Updating the QEMU patches
 When updating to the latest American Fuzzy Lop, make sure to check for
 any new patches to qemu for binary fuzzing support:
 
-https://github.com/mirrorer/afl/tree/master/qemu_mode
+https://github.com/google/AFL/tree/master/qemu_mode
 
 Be sure to check the build script and make sure it's also using the
 right QEMU version and options in `qemu.nix`:
 
-https://github.com/mirrorer/afl/blob/master/qemu_mode/build_qemu_support.sh
+https://github.com/google/AFL/blob/master/qemu_mode/build_qemu_support.sh
 
 `afl-config.h`, `afl-types.h`, and `afl-qemu-cpu-inl.h` are part of
 the afl source code, and copied from `config.h`, `types.h` and
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index 05866792af6..df5e3728943 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, callPackage, makeWrapper
+{ stdenv, fetchFromGitHub, callPackage, makeWrapper
 , clang, llvm, which, libcgroup
 }:
 
@@ -9,11 +9,13 @@ let
     else throw "afl: no support for ${stdenv.hostPlatform.system}!";
   afl = stdenv.mkDerivation rec {
     pname = "afl";
-    version = "2.52b";
+    version = "2.56b";
 
-    src = fetchurl {
-      url    = "http://lcamtuf.coredump.cx/afl/releases/${pname}-${version}.tgz";
-      sha256 = "0ig0ij4n1pwry5dw1hk4q88801jzzy2cric6y2gd6560j55lnqa3";
+    src = fetchFromGitHub {
+      owner = "google";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "1q1g59gkm48aa4cg9h70jx4i2gapmypgp5rzs156b2avd95vwkn1";
     };
     enableParallelBuilding = true;
 
diff --git a/pkgs/tools/security/afl/libdislocator.nix b/pkgs/tools/security/afl/libdislocator.nix
index 415fa82f2ec..953c59e435c 100644
--- a/pkgs/tools/security/afl/libdislocator.nix
+++ b/pkgs/tools/security/afl/libdislocator.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   pname = "libdislocator";
 
   src = afl.src;
-  sourceRoot = "${afl.name}/libdislocator";
+  sourceRoot = "${afl.src.name}/libdislocator";
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/security/afl/qemu-patches/qemu-2.10.0-glibc-2.27.patch b/pkgs/tools/security/afl/qemu-patches/qemu-2.10.0-glibc-2.27.patch
deleted file mode 100644
index 6cc663dc1fb..00000000000
--- a/pkgs/tools/security/afl/qemu-patches/qemu-2.10.0-glibc-2.27.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-A modified version of qemu commit 75e5b70e6b5dcc4f2219992d7cffa462aa406af0
-diff --git a/configure b/configure
-index 9c8aa5a..99ccc17 100755
---- a/configure
-+++ b/configure
-@@ -3855,7 +3855,7 @@ fi
- # check if memfd is supported
- memfd=no
- cat > $TMPC << EOF
--#include <sys/memfd.h>
-+#include <sys/mman.h>
- 
- int main(void)
- {
-diff --git a/util/memfd.c b/util/memfd.c
-index 4571d1a..412e94a 100644
---- a/util/memfd.c
-+++ b/util/memfd.c
-@@ -31,9 +31,7 @@
- 
- #include "qemu/memfd.h"
- 
--#ifdef CONFIG_MEMFD
--#include <sys/memfd.h>
--#elif defined CONFIG_LINUX
-+#if defined CONFIG_LINUX && !defined CONFIG_MEMFD
- #include <sys/syscall.h>
- #include <asm/unistd.h>
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index d80d301351f..479de4b4185 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -6,7 +6,6 @@ with stdenv.lib;
 
 let
   qemuName = "qemu-2.10.0";
-  aflName = afl.name;
   cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
     else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
     else throw "afl: no support for ${stdenv.hostPlatform.system}!";
@@ -25,12 +24,12 @@ stdenv.mkDerivation {
   sourceRoot = qemuName;
 
   postUnpack = ''
-    cp ${aflName}/types.h $sourceRoot/afl-types.h
-    substitute ${aflName}/config.h $sourceRoot/afl-config.h \
+    cp ${afl.src.name}/types.h $sourceRoot/afl-types.h
+    substitute ${afl.src.name}/config.h $sourceRoot/afl-config.h \
       --replace "types.h" "afl-types.h"
-    substitute ${aflName}/qemu_mode/patches/afl-qemu-cpu-inl.h $sourceRoot/afl-qemu-cpu-inl.h \
+    substitute ${afl.src.name}/qemu_mode/patches/afl-qemu-cpu-inl.h $sourceRoot/afl-qemu-cpu-inl.h \
       --replace "../../config.h" "afl-config.h"
-    substituteInPlace ${aflName}/qemu_mode/patches/cpu-exec.diff \
+    substituteInPlace ${afl.src.name}/qemu_mode/patches/cpu-exec.diff \
       --replace "../patches/afl-qemu-cpu-inl.h" "afl-qemu-cpu-inl.h"
   '';
 
@@ -46,12 +45,13 @@ stdenv.mkDerivation {
 
   patches = [
     # patches extracted from afl source
-    "../${aflName}/qemu_mode/patches/cpu-exec.diff"
-    "../${aflName}/qemu_mode/patches/elfload.diff"
-    "../${aflName}/qemu_mode/patches/syscall.diff"
+    "../${afl.src.name}/qemu_mode/patches/cpu-exec.diff"
+    "../${afl.src.name}/qemu_mode/patches/elfload.diff"
+    "../${afl.src.name}/qemu_mode/patches/syscall.diff"
+    "../${afl.src.name}/qemu_mode/patches/configure.diff"
+    "../${afl.src.name}/qemu_mode/patches/memfd.diff"
     # nix-specific patches to make installation more well-behaved
     ./qemu-patches/no-etc-install.patch
-    ./qemu-patches/qemu-2.10.0-glibc-2.27.patch
   ];
 
   configureFlags =
diff --git a/pkgs/tools/security/aws-okta/default.nix b/pkgs/tools/security/aws-okta/default.nix
index f960245e2b3..71732f26934 100644
--- a/pkgs/tools/security/aws-okta/default.nix
+++ b/pkgs/tools/security/aws-okta/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "aws-okta";
-  version = "0.20.1";
+  version = "0.26.3";
 
   goPackagePath = "github.com/segmentio/aws-okta";
 
@@ -10,12 +10,12 @@ buildGoPackage rec {
     owner = "segmentio";
     repo = "aws-okta";
     rev = "v${version}";
-    sha256 = "084lb9rp04vbpzmvsb2l92a4gp7c8g28x4xsagzwkqqpwi3fd15d";
+    sha256 = "0n6xm3yv0lxfapchzfrqi05hk918n4lh1hcp7gq7hybam93rld96";
   };
 
   goDeps = ./deps.nix;
 
-  buildFlags = "--tags release";
+  buildFlags = [ "--tags" "release" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libusb1  libiconv ];
diff --git a/pkgs/tools/security/bitwarden-cli/default.nix b/pkgs/tools/security/bitwarden-cli/default.nix
deleted file mode 100644
index 5c60eb9f4e2..00000000000
--- a/pkgs/tools/security/bitwarden-cli/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, pkgs }:
-
-let
-  # node-packages*.nix generated via:
-  #
-  # % node2nix --input node-packages.json \
-  #            --output node-packages-generated.nix \
-  #            --composition node-packages.nix \
-  #            --node-env ./../../../development/node-packages/node-env.nix
-  #
-  nodePackages = import ./node-packages.nix {
-    inherit pkgs;
-    inherit (stdenv.hostPlatform) system;
-  };
-in pkgs.lib.overrideDerivation nodePackages."@bitwarden/cli" (drv: {
-  # This defaults to "node-_at_bitwarden_slash_cli-1.7.0"
-  name = "bitwarden-cli-${drv.version}";
-})
diff --git a/pkgs/tools/security/bitwarden-cli/generate.sh b/pkgs/tools/security/bitwarden-cli/generate.sh
deleted file mode 100755
index 5bcee4c0513..00000000000
--- a/pkgs/tools/security/bitwarden-cli/generate.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nodePackages.node2nix
-
-exec node2nix -8 \
-    --input node-packages.json \
-    --output node-packages-generated.nix \
-    --composition node-packages.nix \
-    --node-env ./../../../development/node-packages/node-env.nix
diff --git a/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix b/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
deleted file mode 100644
index 2afff040354..00000000000
--- a/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
+++ /dev/null
@@ -1,1407 +0,0 @@
-# This file has been generated by node2nix 1.7.0. Do not edit!
-
-{nodeEnv, fetchurl, fetchgit, globalBuildInputs ? []}:
-
-let
-  sources = {
-    "abab-2.0.0" = {
-      name = "abab";
-      packageName = "abab";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/abab/-/abab-2.0.0.tgz";
-        sha512 = "sY5AXXVZv4Y1VACTtR11UJCPHHudgY5i26Qj5TypE6DKlIApbwb5uqhXcJ5UUGbvZNRh7EeIoW+LrJumBsKp7w==";
-      };
-    };
-    "acorn-6.2.1" = {
-      name = "acorn";
-      packageName = "acorn";
-      version = "6.2.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn/-/acorn-6.2.1.tgz";
-        sha512 = "JD0xT5FCRDNyjDda3Lrg/IxFscp9q4tiYtxE1/nOzlKCk7hIRuYjhq1kCNkbPjMRMZuFq20HNQn1I9k8Oj0E+Q==";
-      };
-    };
-    "acorn-globals-4.3.2" = {
-      name = "acorn-globals";
-      packageName = "acorn-globals";
-      version = "4.3.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn-globals/-/acorn-globals-4.3.2.tgz";
-        sha512 = "BbzvZhVtZP+Bs1J1HcwrQe8ycfO0wStkSGxuul3He3GkHOIZ6eTqOkPuw9IP1X3+IkOo4wiJmwkobzXYz4wewQ==";
-      };
-    };
-    "acorn-walk-6.2.0" = {
-      name = "acorn-walk";
-      packageName = "acorn-walk";
-      version = "6.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn-walk/-/acorn-walk-6.2.0.tgz";
-        sha512 = "7evsyfH1cLOCdAzZAd43Cic04yKydNx0cF+7tiA19p1XnLLPU4dpCQOqpjqwokFe//vS0QqfqqjCS2JkiIs0cA==";
-      };
-    };
-    "ajv-6.10.2" = {
-      name = "ajv";
-      packageName = "ajv";
-      version = "6.10.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ajv/-/ajv-6.10.2.tgz";
-        sha512 = "TXtUUEYHuaTEbLZWIKUr5pmBuhDLy+8KYtPYdcV8qC+pOZL+NKqYwvWSRrVXHn+ZmRRAu8vJTAznH7Oag6RVRw==";
-      };
-    };
-    "ansi-escapes-3.2.0" = {
-      name = "ansi-escapes";
-      packageName = "ansi-escapes";
-      version = "3.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-3.2.0.tgz";
-        sha512 = "cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==";
-      };
-    };
-    "ansi-regex-3.0.0" = {
-      name = "ansi-regex";
-      packageName = "ansi-regex";
-      version = "3.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz";
-        sha1 = "ed0317c322064f79466c02966bddb605ab37d998";
-      };
-    };
-    "ansi-styles-3.2.1" = {
-      name = "ansi-styles";
-      packageName = "ansi-styles";
-      version = "3.2.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz";
-        sha512 = "VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==";
-      };
-    };
-    "array-equal-1.0.0" = {
-      name = "array-equal";
-      packageName = "array-equal";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/array-equal/-/array-equal-1.0.0.tgz";
-        sha1 = "8c2a5ef2472fd9ea742b04c77a75093ba2757c93";
-      };
-    };
-    "asn1-0.2.4" = {
-      name = "asn1";
-      packageName = "asn1";
-      version = "0.2.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/asn1/-/asn1-0.2.4.tgz";
-        sha512 = "jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==";
-      };
-    };
-    "assert-plus-1.0.0" = {
-      name = "assert-plus";
-      packageName = "assert-plus";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz";
-        sha1 = "f12e0f3c5d77b0b1cdd9146942e4e96c1e4dd525";
-      };
-    };
-    "async-limiter-1.0.0" = {
-      name = "async-limiter";
-      packageName = "async-limiter";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/async-limiter/-/async-limiter-1.0.0.tgz";
-        sha512 = "jp/uFnooOiO+L211eZOoSyzpOITMXx1rBITauYykG3BRYPu8h0UcxsPNB04RR5vo4Tyz3+ay17tR6JVf9qzYWg==";
-      };
-    };
-    "asynckit-0.4.0" = {
-      name = "asynckit";
-      packageName = "asynckit";
-      version = "0.4.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz";
-        sha1 = "c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79";
-      };
-    };
-    "aws-sign2-0.7.0" = {
-      name = "aws-sign2";
-      packageName = "aws-sign2";
-      version = "0.7.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sign2/-/aws-sign2-0.7.0.tgz";
-        sha1 = "b46e890934a9591f2d2f6f86d7e6a9f1b3fe76a8";
-      };
-    };
-    "aws4-1.8.0" = {
-      name = "aws4";
-      packageName = "aws4";
-      version = "1.8.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/aws4/-/aws4-1.8.0.tgz";
-        sha512 = "ReZxvNHIOv88FlT7rxcXIIC0fPt4KZqZbOlivyWtXLt8ESx84zd3kMC6iK5jVeS2qt+g7ftS7ye4fi06X5rtRQ==";
-      };
-    };
-    "bcrypt-pbkdf-1.0.2" = {
-      name = "bcrypt-pbkdf";
-      packageName = "bcrypt-pbkdf";
-      version = "1.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz";
-        sha1 = "a4301d389b6a43f9b67ff3ca11a3f6637e360e9e";
-      };
-    };
-    "big-integer-1.6.36" = {
-      name = "big-integer";
-      packageName = "big-integer";
-      version = "1.6.36";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/big-integer/-/big-integer-1.6.36.tgz";
-        sha512 = "t70bfa7HYEA1D9idDbmuv7YbsbVkQ+Hp+8KFSul4aE5e/i1bjCNIRYJZlA8Q8p0r9T8cF/RVvwUgRA//FydEyg==";
-      };
-    };
-    "browser-process-hrtime-0.1.3" = {
-      name = "browser-process-hrtime";
-      packageName = "browser-process-hrtime";
-      version = "0.1.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-0.1.3.tgz";
-        sha512 = "bRFnI4NnjO6cnyLmOV/7PVoDEMJChlcfN0z4s1YMBY989/SvlfMI1lgCnkFUs53e9gQF+w7qu7XdllSTiSl8Aw==";
-      };
-    };
-    "caseless-0.12.0" = {
-      name = "caseless";
-      packageName = "caseless";
-      version = "0.12.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz";
-        sha1 = "1b681c21ff84033c826543090689420d187151dc";
-      };
-    };
-    "chalk-2.4.1" = {
-      name = "chalk";
-      packageName = "chalk";
-      version = "2.4.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/chalk/-/chalk-2.4.1.tgz";
-        sha512 = "ObN6h1v2fTJSmUXoS3nMQ92LbDK9be4TV+6G+omQlGJFdcUX5heKi1LZ1YnRMIgwTLEj3E24bT6tYni50rlCfQ==";
-      };
-    };
-    "chardet-0.7.0" = {
-      name = "chardet";
-      packageName = "chardet";
-      version = "0.7.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/chardet/-/chardet-0.7.0.tgz";
-        sha512 = "mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==";
-      };
-    };
-    "cli-cursor-2.1.0" = {
-      name = "cli-cursor";
-      packageName = "cli-cursor";
-      version = "2.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cli-cursor/-/cli-cursor-2.1.0.tgz";
-        sha1 = "b35dac376479facc3e94747d41d0d0f5238ffcb5";
-      };
-    };
-    "cli-width-2.2.0" = {
-      name = "cli-width";
-      packageName = "cli-width";
-      version = "2.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cli-width/-/cli-width-2.2.0.tgz";
-        sha1 = "ff19ede8a9a5e579324147b0c11f0fbcbabed639";
-      };
-    };
-    "color-convert-1.9.3" = {
-      name = "color-convert";
-      packageName = "color-convert";
-      version = "1.9.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz";
-        sha512 = "QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==";
-      };
-    };
-    "color-name-1.1.3" = {
-      name = "color-name";
-      packageName = "color-name";
-      version = "1.1.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz";
-        sha1 = "a7d0558bd89c42f795dd42328f740831ca53bc25";
-      };
-    };
-    "combined-stream-1.0.6" = {
-      name = "combined-stream";
-      packageName = "combined-stream";
-      version = "1.0.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.6.tgz";
-        sha1 = "723e7df6e801ac5613113a7e445a9b69cb632818";
-      };
-    };
-    "commander-2.18.0" = {
-      name = "commander";
-      packageName = "commander";
-      version = "2.18.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/commander/-/commander-2.18.0.tgz";
-        sha512 = "6CYPa+JP2ftfRU2qkDK+UTVeQYosOg/2GbcjIcKPHfinyOLPVGXu/ovN86RP49Re5ndJK1N0kuiidFFuepc4ZQ==";
-      };
-    };
-    "core-util-is-1.0.2" = {
-      name = "core-util-is";
-      packageName = "core-util-is";
-      version = "1.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz";
-        sha1 = "b5fd54220aa2bc5ab57aab7140c940754503c1a7";
-      };
-    };
-    "cssom-0.3.8" = {
-      name = "cssom";
-      packageName = "cssom";
-      version = "0.3.8";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz";
-        sha512 = "b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==";
-      };
-    };
-    "cssstyle-1.4.0" = {
-      name = "cssstyle";
-      packageName = "cssstyle";
-      version = "1.4.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/cssstyle/-/cssstyle-1.4.0.tgz";
-        sha512 = "GBrLZYZ4X4x6/QEoBnIrqb8B/f5l4+8me2dkom/j1Gtbxy0kBv6OGzKuAsGM75bkGwGAFkt56Iwg28S3XTZgSA==";
-      };
-    };
-    "dashdash-1.14.1" = {
-      name = "dashdash";
-      packageName = "dashdash";
-      version = "1.14.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz";
-        sha1 = "853cfa0f7cbe2fed5de20326b8dd581035f6e2f0";
-      };
-    };
-    "data-urls-1.1.0" = {
-      name = "data-urls";
-      packageName = "data-urls";
-      version = "1.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/data-urls/-/data-urls-1.1.0.tgz";
-        sha512 = "YTWYI9se1P55u58gL5GkQHW4P6VJBJ5iBT+B5a7i2Tjadhv52paJG0qHX4A0OR6/t52odI64KP2YvFpkDOi3eQ==";
-      };
-    };
-    "deep-is-0.1.3" = {
-      name = "deep-is";
-      packageName = "deep-is";
-      version = "0.1.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/deep-is/-/deep-is-0.1.3.tgz";
-        sha1 = "b369d6fb5dbc13eecf524f91b070feedc357cf34";
-      };
-    };
-    "delayed-stream-1.0.0" = {
-      name = "delayed-stream";
-      packageName = "delayed-stream";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz";
-        sha1 = "df3ae199acadfb7d440aaae0b29e2272b24ec619";
-      };
-    };
-    "domexception-1.0.1" = {
-      name = "domexception";
-      packageName = "domexception";
-      version = "1.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/domexception/-/domexception-1.0.1.tgz";
-        sha512 = "raigMkn7CJNNo6Ihro1fzG7wr3fHuYVytzquZKX5n0yizGsTcYgzdIUwj1X9pK0VvjeihV+XiclP+DjwbsSKug==";
-      };
-    };
-    "ecc-jsbn-0.1.2" = {
-      name = "ecc-jsbn";
-      packageName = "ecc-jsbn";
-      version = "0.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz";
-        sha1 = "3a83a904e54353287874c564b7549386849a98c9";
-      };
-    };
-    "escape-string-regexp-1.0.5" = {
-      name = "escape-string-regexp";
-      packageName = "escape-string-regexp";
-      version = "1.0.5";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz";
-        sha1 = "1b61c0562190a8dff6ae3bb2cf0200ca130b86d4";
-      };
-    };
-    "escodegen-1.11.1" = {
-      name = "escodegen";
-      packageName = "escodegen";
-      version = "1.11.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/escodegen/-/escodegen-1.11.1.tgz";
-        sha512 = "JwiqFD9KdGVVpeuRa68yU3zZnBEOcPs0nKW7wZzXky8Z7tffdYUHbe11bPCV5jYlK6DVdKLWLm0f5I/QlL0Kmw==";
-      };
-    };
-    "esprima-3.1.3" = {
-      name = "esprima";
-      packageName = "esprima";
-      version = "3.1.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/esprima/-/esprima-3.1.3.tgz";
-        sha1 = "fdca51cee6133895e3c88d535ce49dbff62a4633";
-      };
-    };
-    "estraverse-4.2.0" = {
-      name = "estraverse";
-      packageName = "estraverse";
-      version = "4.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/estraverse/-/estraverse-4.2.0.tgz";
-        sha1 = "0dee3fed31fcd469618ce7342099fc1afa0bdb13";
-      };
-    };
-    "esutils-2.0.3" = {
-      name = "esutils";
-      packageName = "esutils";
-      version = "2.0.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz";
-        sha512 = "kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==";
-      };
-    };
-    "extend-3.0.2" = {
-      name = "extend";
-      packageName = "extend";
-      version = "3.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz";
-        sha512 = "fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==";
-      };
-    };
-    "external-editor-3.1.0" = {
-      name = "external-editor";
-      packageName = "external-editor";
-      version = "3.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/external-editor/-/external-editor-3.1.0.tgz";
-        sha512 = "hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==";
-      };
-    };
-    "extsprintf-1.3.0" = {
-      name = "extsprintf";
-      packageName = "extsprintf";
-      version = "1.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/extsprintf/-/extsprintf-1.3.0.tgz";
-        sha1 = "96918440e3041a7a414f8c52e3c574eb3c3e1e05";
-      };
-    };
-    "fast-deep-equal-2.0.1" = {
-      name = "fast-deep-equal";
-      packageName = "fast-deep-equal";
-      version = "2.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-2.0.1.tgz";
-        sha1 = "7b05218ddf9667bf7f370bf7fdb2cb15fdd0aa49";
-      };
-    };
-    "fast-json-stable-stringify-2.0.0" = {
-      name = "fast-json-stable-stringify";
-      packageName = "fast-json-stable-stringify";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.0.0.tgz";
-        sha1 = "d5142c0caee6b1189f87d3a76111064f86c8bbf2";
-      };
-    };
-    "fast-levenshtein-2.0.6" = {
-      name = "fast-levenshtein";
-      packageName = "fast-levenshtein";
-      version = "2.0.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz";
-        sha1 = "3d8a5c66883a16a30ca8643e851f19baa7797917";
-      };
-    };
-    "figures-2.0.0" = {
-      name = "figures";
-      packageName = "figures";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz";
-        sha1 = "3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962";
-      };
-    };
-    "forever-agent-0.6.1" = {
-      name = "forever-agent";
-      packageName = "forever-agent";
-      version = "0.6.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/forever-agent/-/forever-agent-0.6.1.tgz";
-        sha1 = "fbc71f0c41adeb37f96c577ad1ed42d8fdacca91";
-      };
-    };
-    "form-data-2.3.2" = {
-      name = "form-data";
-      packageName = "form-data";
-      version = "2.3.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/form-data/-/form-data-2.3.2.tgz";
-        sha1 = "4970498be604c20c005d4f5c23aecd21d6b49099";
-      };
-    };
-    "getpass-0.1.7" = {
-      name = "getpass";
-      packageName = "getpass";
-      version = "0.1.7";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/getpass/-/getpass-0.1.7.tgz";
-        sha1 = "5eff8e3e684d569ae4cb2b1282604e8ba62149fa";
-      };
-    };
-    "graceful-fs-4.2.0" = {
-      name = "graceful-fs";
-      packageName = "graceful-fs";
-      version = "4.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.0.tgz";
-        sha512 = "jpSvDPV4Cq/bgtpndIWbI5hmYxhQGHPC4d4cqBPb4DLniCfhJokdXhwhaDuLBGLQdvvRum/UiX6ECVIPvDXqdg==";
-      };
-    };
-    "har-schema-2.0.0" = {
-      name = "har-schema";
-      packageName = "har-schema";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz";
-        sha1 = "a94c2224ebcac04782a0d9035521f24735b7ec92";
-      };
-    };
-    "har-validator-5.1.3" = {
-      name = "har-validator";
-      packageName = "har-validator";
-      version = "5.1.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/har-validator/-/har-validator-5.1.3.tgz";
-        sha512 = "sNvOCzEQNr/qrvJgc3UG/kD4QtlHycrzwS+6mfTrrSq97BvaYcPZZI1ZSqGSPR73Cxn4LKTD4PttRwfU7jWq5g==";
-      };
-    };
-    "has-flag-3.0.0" = {
-      name = "has-flag";
-      packageName = "has-flag";
-      version = "3.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz";
-        sha1 = "b5d454dc2199ae225699f3467e5a07f3b955bafd";
-      };
-    };
-    "html-encoding-sniffer-1.0.2" = {
-      name = "html-encoding-sniffer";
-      packageName = "html-encoding-sniffer";
-      version = "1.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-1.0.2.tgz";
-        sha512 = "71lZziiDnsuabfdYiUeWdCVyKuqwWi23L8YeIgV9jSSZHCtb6wB1BKWooH7L3tn4/FuZJMVWyNaIDr4RGmaSYw==";
-      };
-    };
-    "http-signature-1.2.0" = {
-      name = "http-signature";
-      packageName = "http-signature";
-      version = "1.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/http-signature/-/http-signature-1.2.0.tgz";
-        sha1 = "9aecd925114772f3d95b65a60abb8f7c18fbace1";
-      };
-    };
-    "iconv-lite-0.4.24" = {
-      name = "iconv-lite";
-      packageName = "iconv-lite";
-      version = "0.4.24";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz";
-        sha512 = "v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==";
-      };
-    };
-    "inquirer-6.2.0" = {
-      name = "inquirer";
-      packageName = "inquirer";
-      version = "6.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/inquirer/-/inquirer-6.2.0.tgz";
-        sha512 = "QIEQG4YyQ2UYZGDC4srMZ7BjHOmNk1lR2JQj5UknBapklm6WHA+VVH7N+sUdX3A7NeCfGF8o4X1S3Ao7nAcIeg==";
-      };
-    };
-    "is-fullwidth-code-point-2.0.0" = {
-      name = "is-fullwidth-code-point";
-      packageName = "is-fullwidth-code-point";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz";
-        sha1 = "a3b30a5c4f199183167aaab93beefae3ddfb654f";
-      };
-    };
-    "is-promise-2.1.0" = {
-      name = "is-promise";
-      packageName = "is-promise";
-      version = "2.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-promise/-/is-promise-2.1.0.tgz";
-        sha1 = "79a2a9ece7f096e80f36d2b2f3bc16c1ff4bf3fa";
-      };
-    };
-    "is-typedarray-1.0.0" = {
-      name = "is-typedarray";
-      packageName = "is-typedarray";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz";
-        sha1 = "e479c80858df0c1b11ddda6940f96011fcda4a9a";
-      };
-    };
-    "isstream-0.1.2" = {
-      name = "isstream";
-      packageName = "isstream";
-      version = "0.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/isstream/-/isstream-0.1.2.tgz";
-        sha1 = "47e63f7af55afa6f92e1500e690eb8b8529c099a";
-      };
-    };
-    "jsbn-0.1.1" = {
-      name = "jsbn";
-      packageName = "jsbn";
-      version = "0.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz";
-        sha1 = "a5e654c2e5a2deb5f201d96cefbca80c0ef2f513";
-      };
-    };
-    "jsdom-13.2.0" = {
-      name = "jsdom";
-      packageName = "jsdom";
-      version = "13.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/jsdom/-/jsdom-13.2.0.tgz";
-        sha512 = "cG1NtMWO9hWpqRNRR3dSvEQa8bFI6iLlqU2x4kwX51FQjp0qus8T9aBaAO6iGp3DeBrhdwuKxckknohkmfvsFw==";
-      };
-    };
-    "json-schema-0.2.3" = {
-      name = "json-schema";
-      packageName = "json-schema";
-      version = "0.2.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz";
-        sha1 = "b480c892e59a2f05954ce727bd3f2a4e882f9e13";
-      };
-    };
-    "json-schema-traverse-0.4.1" = {
-      name = "json-schema-traverse";
-      packageName = "json-schema-traverse";
-      version = "0.4.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz";
-        sha512 = "xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==";
-      };
-    };
-    "json-stringify-safe-5.0.1" = {
-      name = "json-stringify-safe";
-      packageName = "json-stringify-safe";
-      version = "5.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz";
-        sha1 = "1296a2d58fd45f19a0f6ce01d65701e2c735b6eb";
-      };
-    };
-    "jsprim-1.4.1" = {
-      name = "jsprim";
-      packageName = "jsprim";
-      version = "1.4.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/jsprim/-/jsprim-1.4.1.tgz";
-        sha1 = "313e66bc1e5cc06e438bc1b7499c2e5c56acb6a2";
-      };
-    };
-    "levn-0.3.0" = {
-      name = "levn";
-      packageName = "levn";
-      version = "0.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz";
-        sha1 = "3b09924edf9f083c0490fdd4c0bc4421e04764ee";
-      };
-    };
-    "lodash-4.17.15" = {
-      name = "lodash";
-      packageName = "lodash";
-      version = "4.17.15";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz";
-        sha512 = "8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==";
-      };
-    };
-    "lodash.sortby-4.7.0" = {
-      name = "lodash.sortby";
-      packageName = "lodash.sortby";
-      version = "4.7.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/lodash.sortby/-/lodash.sortby-4.7.0.tgz";
-        sha1 = "edd14c824e2cc9c1e0b0a1b42bb5210516a42438";
-      };
-    };
-    "lowdb-1.0.0" = {
-      name = "lowdb";
-      packageName = "lowdb";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/lowdb/-/lowdb-1.0.0.tgz";
-        sha512 = "2+x8esE/Wb9SQ1F9IHaYWfsC9FIecLOPrK4g17FGEayjUWH172H6nwicRovGvSE2CPZouc2MCIqCI7h9d+GftQ==";
-      };
-    };
-    "lunr-2.3.3" = {
-      name = "lunr";
-      packageName = "lunr";
-      version = "2.3.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/lunr/-/lunr-2.3.3.tgz";
-        sha512 = "rlAEsgU9Bnavca2w1WJ6+6cdeHMXNyadcersyk3ZpuhgWb5HBNj8l4WwJz9PjksAhYDlpQffCVXPctOn+wCIVA==";
-      };
-    };
-    "mime-db-1.40.0" = {
-      name = "mime-db";
-      packageName = "mime-db";
-      version = "1.40.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.40.0.tgz";
-        sha512 = "jYdeOMPy9vnxEqFRRo6ZvTZ8d9oPb+k18PKoYNYUe2stVEBPPwsln/qWzdbmaIvnhZ9v2P+CuecK+fpUfsV2mA==";
-      };
-    };
-    "mime-types-2.1.24" = {
-      name = "mime-types";
-      packageName = "mime-types";
-      version = "2.1.24";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.24.tgz";
-        sha512 = "WaFHS3MCl5fapm3oLxU4eYDw77IQM2ACcxQ9RIxfaC3ooc6PFuBMGZZsYpvoXS5D5QTWPieo1jjLdAm3TBP3cQ==";
-      };
-    };
-    "mimic-fn-1.2.0" = {
-      name = "mimic-fn";
-      packageName = "mimic-fn";
-      version = "1.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/mimic-fn/-/mimic-fn-1.2.0.tgz";
-        sha512 = "jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==";
-      };
-    };
-    "mute-stream-0.0.7" = {
-      name = "mute-stream";
-      packageName = "mute-stream";
-      version = "0.0.7";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.7.tgz";
-        sha1 = "3075ce93bc21b8fab43e1bc4da7e8115ed1e7bab";
-      };
-    };
-    "node-fetch-2.2.0" = {
-      name = "node-fetch";
-      packageName = "node-fetch";
-      version = "2.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/node-fetch/-/node-fetch-2.2.0.tgz";
-        sha512 = "OayFWziIxiHY8bCUyLX6sTpDH8Jsbp4FfYd1j1f7vZyfgkcOnAyM4oQR16f8a0s7Gl/viMGRey8eScYk4V4EZA==";
-      };
-    };
-    "node-forge-0.7.6" = {
-      name = "node-forge";
-      packageName = "node-forge";
-      version = "0.7.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/node-forge/-/node-forge-0.7.6.tgz";
-        sha512 = "sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==";
-      };
-    };
-    "nwsapi-2.1.4" = {
-      name = "nwsapi";
-      packageName = "nwsapi";
-      version = "2.1.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/nwsapi/-/nwsapi-2.1.4.tgz";
-        sha512 = "iGfd9Y6SFdTNldEy2L0GUhcarIutFmk+MPWIn9dmj8NMIup03G08uUF2KGbbmv/Ux4RT0VZJoP/sVbWA6d/VIw==";
-      };
-    };
-    "oauth-sign-0.9.0" = {
-      name = "oauth-sign";
-      packageName = "oauth-sign";
-      version = "0.9.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/oauth-sign/-/oauth-sign-0.9.0.tgz";
-        sha512 = "fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==";
-      };
-    };
-    "onetime-2.0.1" = {
-      name = "onetime";
-      packageName = "onetime";
-      version = "2.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/onetime/-/onetime-2.0.1.tgz";
-        sha1 = "067428230fd67443b2794b22bba528b6867962d4";
-      };
-    };
-    "optionator-0.8.2" = {
-      name = "optionator";
-      packageName = "optionator";
-      version = "0.8.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/optionator/-/optionator-0.8.2.tgz";
-        sha1 = "364c5e409d3f4d6301d6c0b4c05bba50180aeb64";
-      };
-    };
-    "os-tmpdir-1.0.2" = {
-      name = "os-tmpdir";
-      packageName = "os-tmpdir";
-      version = "1.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz";
-        sha1 = "bbe67406c79aa85c5cfec766fe5734555dfa1274";
-      };
-    };
-    "papaparse-4.6.0" = {
-      name = "papaparse";
-      packageName = "papaparse";
-      version = "4.6.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/papaparse/-/papaparse-4.6.0.tgz";
-        sha512 = "ylm8pmgyz9rkS3Ng/ru5tHUF3JxWwKYP0aZZWZ8eCGdSxoqgYiDUXLNQei73mUJOjHw8QNu5ZNCsLoDpkMA6sg==";
-      };
-    };
-    "parse5-5.1.0" = {
-      name = "parse5";
-      packageName = "parse5";
-      version = "5.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/parse5/-/parse5-5.1.0.tgz";
-        sha512 = "fxNG2sQjHvlVAYmzBZS9YlDp6PTSSDwa98vkD4QgVDDCAo84z5X1t5XyJQ62ImdLXx5NdIIfihey6xpum9/gRQ==";
-      };
-    };
-    "performance-now-2.1.0" = {
-      name = "performance-now";
-      packageName = "performance-now";
-      version = "2.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz";
-        sha1 = "6309f4e0e5fa913ec1c69307ae364b4b377c9e7b";
-      };
-    };
-    "pify-3.0.0" = {
-      name = "pify";
-      packageName = "pify";
-      version = "3.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz";
-        sha1 = "e5a4acd2c101fdf3d9a4d07f0dbc4db49dd28176";
-      };
-    };
-    "pn-1.1.0" = {
-      name = "pn";
-      packageName = "pn";
-      version = "1.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/pn/-/pn-1.1.0.tgz";
-        sha512 = "2qHaIQr2VLRFoxe2nASzsV6ef4yOOH+Fi9FBOVH6cqeSgUnoyySPZkxzLuzd+RYOQTRpROA0ztTMqxROKSb/nA==";
-      };
-    };
-    "prelude-ls-1.1.2" = {
-      name = "prelude-ls";
-      packageName = "prelude-ls";
-      version = "1.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz";
-        sha1 = "21932a549f5e52ffd9a827f570e04be62a97da54";
-      };
-    };
-    "psl-1.3.0" = {
-      name = "psl";
-      packageName = "psl";
-      version = "1.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/psl/-/psl-1.3.0.tgz";
-        sha512 = "avHdspHO+9rQTLbv1RO+MPYeP/SzsCoxofjVnHanETfQhTJrmB0HlDoW+EiN/R+C0BZ+gERab9NY0lPN2TxNag==";
-      };
-    };
-    "punycode-1.4.1" = {
-      name = "punycode";
-      packageName = "punycode";
-      version = "1.4.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz";
-        sha1 = "c0d5a63b2718800ad8e1eb0fa5269c84dd41845e";
-      };
-    };
-    "punycode-2.1.1" = {
-      name = "punycode";
-      packageName = "punycode";
-      version = "2.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz";
-        sha512 = "XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==";
-      };
-    };
-    "qs-6.5.2" = {
-      name = "qs";
-      packageName = "qs";
-      version = "6.5.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz";
-        sha512 = "N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==";
-      };
-    };
-    "request-2.88.0" = {
-      name = "request";
-      packageName = "request";
-      version = "2.88.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/request/-/request-2.88.0.tgz";
-        sha512 = "NAqBSrijGLZdM0WZNsInLJpkJokL72XYjUpnB0iwsRgxh7dB6COrHnTBNwN0E+lHDAJzu7kLAkDeY08z2/A0hg==";
-      };
-    };
-    "request-promise-core-1.1.2" = {
-      name = "request-promise-core";
-      packageName = "request-promise-core";
-      version = "1.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/request-promise-core/-/request-promise-core-1.1.2.tgz";
-        sha512 = "UHYyq1MO8GsefGEt7EprS8UrXsm1TxEvFUX1IMTuSLU2Rh7fTIdFtl8xD7JiEYiWU2dl+NYAjCTksTehQUxPag==";
-      };
-    };
-    "request-promise-native-1.0.7" = {
-      name = "request-promise-native";
-      packageName = "request-promise-native";
-      version = "1.0.7";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/request-promise-native/-/request-promise-native-1.0.7.tgz";
-        sha512 = "rIMnbBdgNViL37nZ1b3L/VfPOpSi0TqVDQPAvO6U14lMzOLrt5nilxCQqtDKhZeDiW0/hkCXGoQjhgJd/tCh6w==";
-      };
-    };
-    "restore-cursor-2.0.0" = {
-      name = "restore-cursor";
-      packageName = "restore-cursor";
-      version = "2.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/restore-cursor/-/restore-cursor-2.0.0.tgz";
-        sha1 = "9f7ee287f82fd326d4fd162923d62129eee0dfaf";
-      };
-    };
-    "run-async-2.3.0" = {
-      name = "run-async";
-      packageName = "run-async";
-      version = "2.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/run-async/-/run-async-2.3.0.tgz";
-        sha1 = "0371ab4ae0bdd720d4166d7dfda64ff7a445a6c0";
-      };
-    };
-    "rxjs-6.5.2" = {
-      name = "rxjs";
-      packageName = "rxjs";
-      version = "6.5.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/rxjs/-/rxjs-6.5.2.tgz";
-        sha512 = "HUb7j3kvb7p7eCUHE3FqjoDsC1xfZQ4AHFWfTKSpZ+sAhhz5X1WX0ZuUqWbzB2QhSLp3DoLUG+hMdEDKqWo2Zg==";
-      };
-    };
-    "safe-buffer-5.2.0" = {
-      name = "safe-buffer";
-      packageName = "safe-buffer";
-      version = "5.2.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz";
-        sha512 = "fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==";
-      };
-    };
-    "safer-buffer-2.1.2" = {
-      name = "safer-buffer";
-      packageName = "safer-buffer";
-      version = "2.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz";
-        sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
-      };
-    };
-    "saxes-3.1.11" = {
-      name = "saxes";
-      packageName = "saxes";
-      version = "3.1.11";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/saxes/-/saxes-3.1.11.tgz";
-        sha512 = "Ydydq3zC+WYDJK1+gRxRapLIED9PWeSuuS41wqyoRmzvhhh9nc+QQrVMKJYzJFULazeGhzSV0QleN2wD3boh2g==";
-      };
-    };
-    "signal-exit-3.0.2" = {
-      name = "signal-exit";
-      packageName = "signal-exit";
-      version = "3.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.2.tgz";
-        sha1 = "b5fdc08f1287ea1178628e415e25132b73646c6d";
-      };
-    };
-    "source-map-0.6.1" = {
-      name = "source-map";
-      packageName = "source-map";
-      version = "0.6.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz";
-        sha512 = "UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==";
-      };
-    };
-    "sshpk-1.16.1" = {
-      name = "sshpk";
-      packageName = "sshpk";
-      version = "1.16.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/sshpk/-/sshpk-1.16.1.tgz";
-        sha512 = "HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==";
-      };
-    };
-    "stealthy-require-1.1.1" = {
-      name = "stealthy-require";
-      packageName = "stealthy-require";
-      version = "1.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/stealthy-require/-/stealthy-require-1.1.1.tgz";
-        sha1 = "35b09875b4ff49f26a777e509b3090a3226bf24b";
-      };
-    };
-    "steno-0.4.4" = {
-      name = "steno";
-      packageName = "steno";
-      version = "0.4.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/steno/-/steno-0.4.4.tgz";
-        sha1 = "071105bdfc286e6615c0403c27e9d7b5dcb855cb";
-      };
-    };
-    "string-width-2.1.1" = {
-      name = "string-width";
-      packageName = "string-width";
-      version = "2.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/string-width/-/string-width-2.1.1.tgz";
-        sha512 = "nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==";
-      };
-    };
-    "strip-ansi-4.0.0" = {
-      name = "strip-ansi";
-      packageName = "strip-ansi";
-      version = "4.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/strip-ansi/-/strip-ansi-4.0.0.tgz";
-        sha1 = "a8479022eb1ac368a871389b635262c505ee368f";
-      };
-    };
-    "supports-color-5.5.0" = {
-      name = "supports-color";
-      packageName = "supports-color";
-      version = "5.5.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz";
-        sha512 = "QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==";
-      };
-    };
-    "symbol-tree-3.2.4" = {
-      name = "symbol-tree";
-      packageName = "symbol-tree";
-      version = "3.2.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz";
-        sha512 = "9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==";
-      };
-    };
-    "through-2.3.8" = {
-      name = "through";
-      packageName = "through";
-      version = "2.3.8";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/through/-/through-2.3.8.tgz";
-        sha1 = "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5";
-      };
-    };
-    "tldjs-2.3.1" = {
-      name = "tldjs";
-      packageName = "tldjs";
-      version = "2.3.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tldjs/-/tldjs-2.3.1.tgz";
-        sha512 = "W/YVH/QczLUxVjnQhFC61Iq232NWu3TqDdO0S/MtXVz4xybejBov4ud+CIwN9aYqjOecEqIy0PscGkwpG9ZyTw==";
-      };
-    };
-    "tmp-0.0.33" = {
-      name = "tmp";
-      packageName = "tmp";
-      version = "0.0.33";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz";
-        sha512 = "jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==";
-      };
-    };
-    "tough-cookie-2.4.3" = {
-      name = "tough-cookie";
-      packageName = "tough-cookie";
-      version = "2.4.3";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.4.3.tgz";
-        sha512 = "Q5srk/4vDM54WJsJio3XNn6K2sCG+CQ8G5Wz6bZhRZoAe/+TxjWB/GlFAnYEbkYVlON9FMk/fE3h2RLpPXo4lQ==";
-      };
-    };
-    "tough-cookie-2.5.0" = {
-      name = "tough-cookie";
-      packageName = "tough-cookie";
-      version = "2.5.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz";
-        sha512 = "nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==";
-      };
-    };
-    "tr46-1.0.1" = {
-      name = "tr46";
-      packageName = "tr46";
-      version = "1.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tr46/-/tr46-1.0.1.tgz";
-        sha1 = "a8b13fd6bfd2489519674ccde55ba3693b706d09";
-      };
-    };
-    "tslib-1.10.0" = {
-      name = "tslib";
-      packageName = "tslib";
-      version = "1.10.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tslib/-/tslib-1.10.0.tgz";
-        sha512 = "qOebF53frne81cf0S9B41ByenJ3/IuH8yJKngAX35CmiZySA0khhkovshKK+jGCaMnVomla7gVlIcc3EvKPbTQ==";
-      };
-    };
-    "tunnel-agent-0.6.0" = {
-      name = "tunnel-agent";
-      packageName = "tunnel-agent";
-      version = "0.6.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz";
-        sha1 = "27a5dea06b36b04a0a9966774b290868f0fc40fd";
-      };
-    };
-    "tweetnacl-0.14.5" = {
-      name = "tweetnacl";
-      packageName = "tweetnacl";
-      version = "0.14.5";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz";
-        sha1 = "5ae68177f192d4456269d108afa93ff8743f4f64";
-      };
-    };
-    "type-check-0.3.2" = {
-      name = "type-check";
-      packageName = "type-check";
-      version = "0.3.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz";
-        sha1 = "5884cab512cf1d355e3fb784f30804b2b520db72";
-      };
-    };
-    "uri-js-4.2.2" = {
-      name = "uri-js";
-      packageName = "uri-js";
-      version = "4.2.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/uri-js/-/uri-js-4.2.2.tgz";
-        sha512 = "KY9Frmirql91X2Qgjry0Wd4Y+YTdrdZheS8TFwvkbLWf/G5KNJDCh6pKL5OZctEW4+0Baa5idK2ZQuELRwPznQ==";
-      };
-    };
-    "uuid-3.3.2" = {
-      name = "uuid";
-      packageName = "uuid";
-      version = "3.3.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz";
-        sha512 = "yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA==";
-      };
-    };
-    "verror-1.10.0" = {
-      name = "verror";
-      packageName = "verror";
-      version = "1.10.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz";
-        sha1 = "3a105ca17053af55d6e270c1f8288682e18da400";
-      };
-    };
-    "w3c-hr-time-1.0.1" = {
-      name = "w3c-hr-time";
-      packageName = "w3c-hr-time";
-      version = "1.0.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.1.tgz";
-        sha1 = "82ac2bff63d950ea9e3189a58a65625fedf19045";
-      };
-    };
-    "w3c-xmlserializer-1.1.2" = {
-      name = "w3c-xmlserializer";
-      packageName = "w3c-xmlserializer";
-      version = "1.1.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-1.1.2.tgz";
-        sha512 = "p10l/ayESzrBMYWRID6xbuCKh2Fp77+sA0doRuGn4tTIMrrZVeqfpKjXHY+oDh3K4nLdPgNwMTVP6Vp4pvqbNg==";
-      };
-    };
-    "webidl-conversions-4.0.2" = {
-      name = "webidl-conversions";
-      packageName = "webidl-conversions";
-      version = "4.0.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-4.0.2.tgz";
-        sha512 = "YQ+BmxuTgd6UXZW3+ICGfyqRyHXVlD5GtQr5+qjiNW7bF0cqrzX500HVXPBOvgXb5YnzDd+h0zqyv61KUD7+Sg==";
-      };
-    };
-    "whatwg-encoding-1.0.5" = {
-      name = "whatwg-encoding";
-      packageName = "whatwg-encoding";
-      version = "1.0.5";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz";
-        sha512 = "b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==";
-      };
-    };
-    "whatwg-mimetype-2.3.0" = {
-      name = "whatwg-mimetype";
-      packageName = "whatwg-mimetype";
-      version = "2.3.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz";
-        sha512 = "M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==";
-      };
-    };
-    "whatwg-url-7.0.0" = {
-      name = "whatwg-url";
-      packageName = "whatwg-url";
-      version = "7.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/whatwg-url/-/whatwg-url-7.0.0.tgz";
-        sha512 = "37GeVSIJ3kn1JgKyjiYNmSLP1yzbpb29jdmwBSgkD9h40/hyrR/OifpVUndji3tmwGgD8qpw7iQu3RSbCrBpsQ==";
-      };
-    };
-    "wordwrap-1.0.0" = {
-      name = "wordwrap";
-      packageName = "wordwrap";
-      version = "1.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz";
-        sha1 = "27584810891456a4171c8d0226441ade90cbcaeb";
-      };
-    };
-    "ws-6.2.1" = {
-      name = "ws";
-      packageName = "ws";
-      version = "6.2.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/ws/-/ws-6.2.1.tgz";
-        sha512 = "GIyAXC2cB7LjvpgMt9EKS2ldqr0MTrORaleiOno6TweZ6r3TKtoFQWay/2PceJ3RuBasOHzXNn5Lrw1X0bEjqA==";
-      };
-    };
-    "xml-name-validator-3.0.0" = {
-      name = "xml-name-validator";
-      packageName = "xml-name-validator";
-      version = "3.0.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz";
-        sha512 = "A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==";
-      };
-    };
-    "xmlchars-2.1.1" = {
-      name = "xmlchars";
-      packageName = "xmlchars";
-      version = "2.1.1";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/xmlchars/-/xmlchars-2.1.1.tgz";
-        sha512 = "7hew1RPJ1iIuje/Y01bGD/mXokXxegAgVS+e+E0wSi2ILHQkYAH1+JXARwTjZSM4Z4Z+c73aKspEcqj+zPPL/w==";
-      };
-    };
-    "zxcvbn-4.4.2" = {
-      name = "zxcvbn";
-      packageName = "zxcvbn";
-      version = "4.4.2";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/zxcvbn/-/zxcvbn-4.4.2.tgz";
-        sha1 = "28ec17cf09743edcab056ddd8b1b06262cc73c30";
-      };
-    };
-  };
-in
-{
-  "@bitwarden/cli" = nodeEnv.buildNodePackage {
-    name = "_at_bitwarden_slash_cli";
-    packageName = "@bitwarden/cli";
-    version = "1.7.4";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/@bitwarden/cli/-/cli-1.7.4.tgz";
-      sha512 = "WCYARJaSpcItFvxPFdRXTO9s26HbYFazL3wSlZ7HuL4tiML/7AfPD4wO3J7fgBn1ghU5NGJ7YZIL+oPmiuw6+Q==";
-    };
-    dependencies = [
-      sources."abab-2.0.0"
-      sources."acorn-6.2.1"
-      sources."acorn-globals-4.3.2"
-      sources."acorn-walk-6.2.0"
-      sources."ajv-6.10.2"
-      sources."ansi-escapes-3.2.0"
-      sources."ansi-regex-3.0.0"
-      sources."ansi-styles-3.2.1"
-      sources."array-equal-1.0.0"
-      sources."asn1-0.2.4"
-      sources."assert-plus-1.0.0"
-      sources."async-limiter-1.0.0"
-      sources."asynckit-0.4.0"
-      sources."aws-sign2-0.7.0"
-      sources."aws4-1.8.0"
-      sources."bcrypt-pbkdf-1.0.2"
-      sources."big-integer-1.6.36"
-      sources."browser-process-hrtime-0.1.3"
-      sources."caseless-0.12.0"
-      sources."chalk-2.4.1"
-      sources."chardet-0.7.0"
-      sources."cli-cursor-2.1.0"
-      sources."cli-width-2.2.0"
-      sources."color-convert-1.9.3"
-      sources."color-name-1.1.3"
-      sources."combined-stream-1.0.6"
-      sources."commander-2.18.0"
-      sources."core-util-is-1.0.2"
-      sources."cssom-0.3.8"
-      sources."cssstyle-1.4.0"
-      sources."dashdash-1.14.1"
-      sources."data-urls-1.1.0"
-      sources."deep-is-0.1.3"
-      sources."delayed-stream-1.0.0"
-      sources."domexception-1.0.1"
-      sources."ecc-jsbn-0.1.2"
-      sources."escape-string-regexp-1.0.5"
-      sources."escodegen-1.11.1"
-      sources."esprima-3.1.3"
-      sources."estraverse-4.2.0"
-      sources."esutils-2.0.3"
-      sources."extend-3.0.2"
-      sources."external-editor-3.1.0"
-      sources."extsprintf-1.3.0"
-      sources."fast-deep-equal-2.0.1"
-      sources."fast-json-stable-stringify-2.0.0"
-      sources."fast-levenshtein-2.0.6"
-      sources."figures-2.0.0"
-      sources."forever-agent-0.6.1"
-      sources."form-data-2.3.2"
-      sources."getpass-0.1.7"
-      sources."graceful-fs-4.2.0"
-      sources."har-schema-2.0.0"
-      sources."har-validator-5.1.3"
-      sources."has-flag-3.0.0"
-      sources."html-encoding-sniffer-1.0.2"
-      sources."http-signature-1.2.0"
-      sources."iconv-lite-0.4.24"
-      sources."inquirer-6.2.0"
-      sources."is-fullwidth-code-point-2.0.0"
-      sources."is-promise-2.1.0"
-      sources."is-typedarray-1.0.0"
-      sources."isstream-0.1.2"
-      sources."jsbn-0.1.1"
-      sources."jsdom-13.2.0"
-      sources."json-schema-0.2.3"
-      sources."json-schema-traverse-0.4.1"
-      sources."json-stringify-safe-5.0.1"
-      sources."jsprim-1.4.1"
-      sources."levn-0.3.0"
-      sources."lodash-4.17.15"
-      sources."lodash.sortby-4.7.0"
-      sources."lowdb-1.0.0"
-      sources."lunr-2.3.3"
-      sources."mime-db-1.40.0"
-      sources."mime-types-2.1.24"
-      sources."mimic-fn-1.2.0"
-      sources."mute-stream-0.0.7"
-      sources."node-fetch-2.2.0"
-      sources."node-forge-0.7.6"
-      sources."nwsapi-2.1.4"
-      sources."oauth-sign-0.9.0"
-      sources."onetime-2.0.1"
-      sources."optionator-0.8.2"
-      sources."os-tmpdir-1.0.2"
-      sources."papaparse-4.6.0"
-      sources."parse5-5.1.0"
-      sources."performance-now-2.1.0"
-      sources."pify-3.0.0"
-      sources."pn-1.1.0"
-      sources."prelude-ls-1.1.2"
-      sources."psl-1.3.0"
-      sources."punycode-2.1.1"
-      sources."qs-6.5.2"
-      (sources."request-2.88.0" // {
-        dependencies = [
-          sources."punycode-1.4.1"
-          sources."tough-cookie-2.4.3"
-        ];
-      })
-      sources."request-promise-core-1.1.2"
-      sources."request-promise-native-1.0.7"
-      sources."restore-cursor-2.0.0"
-      sources."run-async-2.3.0"
-      sources."rxjs-6.5.2"
-      sources."safe-buffer-5.2.0"
-      sources."safer-buffer-2.1.2"
-      sources."saxes-3.1.11"
-      sources."signal-exit-3.0.2"
-      sources."source-map-0.6.1"
-      sources."sshpk-1.16.1"
-      sources."stealthy-require-1.1.1"
-      sources."steno-0.4.4"
-      sources."string-width-2.1.1"
-      sources."strip-ansi-4.0.0"
-      sources."supports-color-5.5.0"
-      sources."symbol-tree-3.2.4"
-      sources."through-2.3.8"
-      (sources."tldjs-2.3.1" // {
-        dependencies = [
-          sources."punycode-1.4.1"
-        ];
-      })
-      sources."tmp-0.0.33"
-      sources."tough-cookie-2.5.0"
-      sources."tr46-1.0.1"
-      sources."tslib-1.10.0"
-      sources."tunnel-agent-0.6.0"
-      sources."tweetnacl-0.14.5"
-      sources."type-check-0.3.2"
-      sources."uri-js-4.2.2"
-      sources."uuid-3.3.2"
-      sources."verror-1.10.0"
-      sources."w3c-hr-time-1.0.1"
-      sources."w3c-xmlserializer-1.1.2"
-      sources."webidl-conversions-4.0.2"
-      sources."whatwg-encoding-1.0.5"
-      sources."whatwg-mimetype-2.3.0"
-      sources."whatwg-url-7.0.0"
-      sources."wordwrap-1.0.0"
-      sources."ws-6.2.1"
-      sources."xml-name-validator-3.0.0"
-      sources."xmlchars-2.1.1"
-      sources."zxcvbn-4.4.2"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "A secure and free password manager for all of your devices.";
-      homepage = https://bitwarden.com/;
-      license = "GPL-3.0";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
-}
\ No newline at end of file
diff --git a/pkgs/tools/security/bitwarden-cli/node-packages.json b/pkgs/tools/security/bitwarden-cli/node-packages.json
deleted file mode 100644
index 624aa87bcbe..00000000000
--- a/pkgs/tools/security/bitwarden-cli/node-packages.json
+++ /dev/null
@@ -1,3 +0,0 @@
-[
-  "@bitwarden/cli"
-]
diff --git a/pkgs/tools/security/bitwarden-cli/node-packages.nix b/pkgs/tools/security/bitwarden-cli/node-packages.nix
deleted file mode 100644
index 66560873b4c..00000000000
--- a/pkgs/tools/security/bitwarden-cli/node-packages.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-# This file has been generated by node2nix 1.7.0. Do not edit!
-
-{pkgs ? import <nixpkgs> {
-    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs.nodejs-10_x}:
-
-let
-  nodeEnv = import ../../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
-    inherit nodejs;
-    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
-  };
-in
-import ./node-packages-generated.nix {
-  inherit (pkgs) fetchurl fetchgit;
-  inherit nodeEnv;
-}
\ No newline at end of file
diff --git a/pkgs/tools/security/crunch/default.nix b/pkgs/tools/security/crunch/default.nix
index 57943a31406..259ee38c68f 100644
--- a/pkgs/tools/security/crunch/default.nix
+++ b/pkgs/tools/security/crunch/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation  rec {
       --replace 'sudo ' ""
   '';
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Wordlist generator";
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 324ac46b084..5ea91854282 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, python, pythonPackages, gamin }:
+{ stdenv, fetchFromGitHub, fetchpatch, python3, gamin }:
 
 let version = "0.10.4"; in
 
-pythonPackages.buildPythonApplication {
+python3.pkgs.buildPythonApplication {
   pname = "fail2ban";
   inherit version;
 
@@ -13,8 +13,19 @@ pythonPackages.buildPythonApplication {
     sha256 = "07ik6rm856q0ic2r7vbg6j3hsdcdgkv44hh5ck0c2y21fqwrck3l";
   };
 
-  propagatedBuildInputs = [ gamin ]
-    ++ (stdenv.lib.optional stdenv.isLinux pythonPackages.systemd);
+  patches = [
+    # 0.10.3 supports Python 3 but somehow this got into the way
+    # https://github.com/fail2ban/fail2ban/issues/2255
+    (fetchpatch {
+      url = "https://github.com/fail2ban/fail2ban/commit/657b147c0d7830f3600f3dc7feaa4815a7e19fde.patch";
+      sha256 = "1hrk2x7ssrfhab1wrjk5xw1sxhiv2735glfcp6qcj8x4dss3q7f7";
+    })
+  ];
+
+  pythonPath = with python3.pkgs;
+    stdenv.lib.optionals stdenv.isLinux [
+      systemd
+    ];
 
   preConfigure = ''
     for i in config/action.d/sendmail*.conf; do
@@ -33,11 +44,15 @@ pythonPackages.buildPythonApplication {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python}/bin/${python.executable} setup.py install_data --install-dir=$out --root=$out
+    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
+  '';
+
+  postPatch = ''
+    ${stdenv.shell} ./fail2ban-2to3
   '';
 
   postInstall = let
-    sitePackages = "$out/lib/${python.libPrefix}/site-packages";
+    sitePackages = "$out/${python3.sitePackages}";
   in ''
     # see https://github.com/NixOS/nixpkgs/issues/4968
     rm -rf ${sitePackages}/etc ${sitePackages}/usr ${sitePackages}/var;
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index 4579136add2..a9f69c8b96e 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libpcap texinfo ]
-    ++ stdenv.lib.optional gnupgSupport [ gnupg gpgme.dev ]
-    ++ stdenv.lib.optional wgetSupport [ wget ];
+    ++ stdenv.lib.optionals gnupgSupport [ gnupg gpgme.dev ]
+    ++ stdenv.lib.optionals wgetSupport [ wget ];
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index 34e8c7bd679..c3a14f62c76 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     cp gpgstats $out/bin
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionals (!stdenv.is64bit)
-    [ "-D_FILE_OFFSET_BITS=64" "-DLARGEFILE_SOURCE=1" ];
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
+    "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
   meta = with stdenv.lib; {
     description = "Calculates statistics on the keys in your gpg key-ring";
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index cec31cec377..e2e01fbb921 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
-  version = "1332";
+  version = "1563";
 
   src = fetchurl {
     url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
-    sha256 = "1zdhi8acd4jfp1v7ibd86hcv0g39yk8qrnhxjmmgzn8i7npr70cf";
+    sha256 = "1sfi7drmbm08rgd2414s3sxd7h5g8d4kiwk40xklf7sw67w1ffpw";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/security/meo/default.nix b/pkgs/tools/security/meo/default.nix
index 19f51775ff2..d10c1659964 100644
--- a/pkgs/tools/security/meo/default.nix
+++ b/pkgs/tools/security/meo/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0ifg7y28s89i9gwda6fyj1jbrykbcvq8bf1m6rxmdcv5afi3arbq";
   };
 
-  buildFlags = "QMAKE=qmake";
+  buildFlags = [ "QMAKE=qmake" ];
 
   buildInputs = [ openssl pcre-cpp qt4 boost pkcs11helper ];
 
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index 97d032045b3..1e585136d88 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -36,10 +36,10 @@ in stdenv.mkDerivation rec {
       ([ gnupg opensshUnsafe which socat cpio hexdump procps lockfileProgs ] ++
       (with perlPackages; [ CryptOpenSSLRSA CryptOpenSSLBignum ]));
 
-  makeFlags = ''
-    PREFIX=/
-    DESTDIR=$(out)
-  '';
+  makeFlags = [
+    "PREFIX=/"
+    "DESTDIR=$(out)"
+  ];
 
   # The tests should be run (and succeed) when making changes to this package
   # but they aren't enabled by default because they "drain" entropy (GnuPG
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index 33a873f73da..48df486ef0a 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     pkgconfig
     wrapQtAppsHook
   ];
-  cmakeFlags = "-DCMAKE_BUILD_TYPE=Release";
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
 
   meta = with stdenv.lib; {
     description      = "Provides extra functionality for the Nitrokey Pro and Storage";
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index 4f220ee7717..315cd1c8c28 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -7,33 +7,15 @@
 
 stdenv.mkDerivation rec {
   pname = "opensc";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "OpenSC";
     rev = version;
-    sha256 = "10575gb9l38cskq7swyjp0907wlziyxg4ppq33ndz319dsx69d87";
+    sha256 = "0mg8qmhww3li1isfgvn5hang1hq58zra057ilvgci88csfziv5lv";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2019-6502.patch";
-      url = "https://github.com/OpenSC/OpenSC/commit/0d7967549751b7032f22b437106b41444aff0ba9.patch";
-      sha256 = "1y42lmz8i9w99hgpakdncnv8f94cqjfabz0v4xg6wfz9akl3ff7d";
-    })
-    (fetchpatch {
-      name = "CVE-2019-15945.patch";
-      url = "https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d5608e68.patch";
-      sha256 = "088i2i1fkvdxnywmb54bn4283vhbxx6i2632b34ss5dh7k080hp7";
-    })
-    (fetchpatch {
-      name = "CVE-2019-15946.patch";
-      url = "https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb42740.patch";
-      sha256 = "1qr9n8cbarrdn4kr5z0ys7flq50hfmcbm8584mhw7r39p08qwmvq";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [
     zlib readline openssl libassuan
diff --git a/pkgs/tools/security/pass/extensions/genphrase.nix b/pkgs/tools/security/pass/extensions/genphrase.nix
index 187852e8b55..208012e2f88 100644
--- a/pkgs/tools/security/pass/extensions/genphrase.nix
+++ b/pkgs/tools/security/pass/extensions/genphrase.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  installTargets = "globalinstall";
+  installTargets = [ "globalinstall" ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/security/pbis/default.nix b/pkgs/tools/security/pbis/default.nix
index ee1282e9a13..176ef7f7616 100644
--- a/pkgs/tools/security/pbis/default.nix
+++ b/pkgs/tools/security/pbis/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     mkdir release
     cd release
     if [ $CC = gcc ]; then
-            NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=format-overflow"
+            NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=format-overflow -Wno-error=address-of-packed-member"
     fi
     NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${stdenv.lib.getDev libxml2}/include/libxml2 -Wno-error=array-bounds -Wno-error=pointer-sign -Wno-error=deprecated-declarations -Wno-error=unused-variable"
   '';
diff --git a/pkgs/tools/security/phrasendrescher/default.nix b/pkgs/tools/security/phrasendrescher/default.nix
index 93dc75c1f32..71a9824bb62 100644
--- a/pkgs/tools/security/phrasendrescher/default.nix
+++ b/pkgs/tools/security/phrasendrescher/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl libssh2 gpgme ];
 
-  configureFlags = "--with-plugins";
+  configureFlags = [ "--with-plugins" ];
 
   meta = with stdenv.lib; {
     description = "A modular and multi processing pass phrase cracking tool";
diff --git a/pkgs/tools/security/proxmark3/default.nix b/pkgs/tools/security/proxmark3/default.nix
index afaed796057..e717558a24d 100644
--- a/pkgs/tools/security/proxmark3/default.nix
+++ b/pkgs/tools/security/proxmark3/default.nix
@@ -1,37 +1,59 @@
-{ stdenv, fetchFromGitHub, pkgconfig, ncurses, readline }:
+{ stdenv, fetchFromGitHub, pkgconfig, ncurses, readline, pcsclite, qt5
+, gcc-arm-embedded }:
 
-stdenv.mkDerivation rec {
-  pname = "proxmark3";
-  version = "3.1.0";
+let
+  generic = { pname, version, rev, sha256 }:
+    stdenv.mkDerivation rec {
+      inherit pname version;
 
-  src = fetchFromGitHub {
-    owner = "Proxmark";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1qw28n1bhhl91ix77lv50qcr919fq3hjc8zhhqphwxal2svgx2jf";
-  };
+      src = fetchFromGitHub {
+        owner = "Proxmark";
+        repo = "proxmark3";
+        inherit rev sha256;
+      };
+
+      nativeBuildInputs = [ pkgconfig gcc-arm-embedded ];
+      buildInputs = [ ncurses readline pcsclite qt5.qtbase ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ncurses readline ];
+      postPatch = ''
+        substituteInPlace client/Makefile --replace '-ltermcap' ' '
+        substituteInPlace liblua/Makefile --replace '-ltermcap' ' '
+        substituteInPlace client/flasher.c \
+          --replace 'armsrc/obj/fullimage.elf' \
+                    '${placeholder "out"}/firmware/fullimage.elf'
+      '';
 
-  postPatch = ''
-    substituteInPlace client/Makefile --replace '-ltermcap' ' '
-    substituteInPlace liblua/Makefile --replace '-ltermcap' ' '
-  '';
+      buildPhase = ''
+        make bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf client
+      '';
 
-  preBuild = ''
-    cd client
-  '';
+      installPhase = ''
+        install -Dt $out/bin client/proxmark3
+        install -T client/flasher $out/bin/proxmark3-flasher
+        install -Dt $out/firmware bootrom/obj/bootrom.elf armsrc/obj/fullimage.elf
+      '';
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp proxmark3 $out/bin
-  '';
+      meta = with stdenv.lib; {
+        description = "Client for proxmark3, powerful general purpose RFID tool";
+        homepage = http://www.proxmark.org;
+        license = licenses.gpl2Plus;
+        maintainers = with maintainers; [ fpletz ];
+      };
+    };
+in
+
+{
+  proxmark3 = generic rec {
+    pname = "proxmark3";
+    version = "3.1.0";
+    rev = "v${version}";
+    sha256 = "1qw28n1bhhl91ix77lv50qcr919fq3hjc8zhhqphwxal2svgx2jf";
+  };
 
-  meta = with stdenv.lib; {
-    description = "Client for proxmark3,  powerful general purpose RFID tool";
-    homepage = http://www.proxmark.org;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ fpletz ];
+  proxmark3-unstable = generic {
+    pname = "proxmark3-unstable";
+    version = "2019-12-28";
+    rev = "a4ff62be63ca2a81071e9aa2b882bd3ff57f13ad";
+    sha256 = "067lp28xqx61n3i2a2fy489r5frwxqrcfj8cpv3xdzi3gb3vk5c3";
   };
 }
diff --git a/pkgs/tools/security/rarcrack/default.nix b/pkgs/tools/security/rarcrack/default.nix
index 65158b3c5fe..68e5df80937 100644
--- a/pkgs/tools/security/rarcrack/default.nix
+++ b/pkgs/tools/security/rarcrack/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ libxml2 file p7zip unrar unzip ];
-  buildFlags = if stdenv.cc.isClang then [ "CC=clang" ] else null;
-  installFlags = "PREFIX=\${out}";
+  buildFlags = stdenv.lib.optional stdenv.cc.isClang "CC=clang";
+  installFlags = [ "PREFIX=\${out}" ];
 
   patchPhase = ''
    substituteInPlace rarcrack.c --replace "file -i" "${file}/bin/file -i"
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index ad606af9562..863b03a117c 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, which }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.8";
+  version = "1.3.9";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "0i00wl63hn80g0s9gdi772gchbghwgkvn4nbb5227y2wwy30yyi2";
+    sha256 = "06i49x1l21h2q7pfnf4crbmjyg8b9ad0qs10ywyyn5sjpi0c21wq";
   };
 
   nativeBuildInputs = [ which ];
@@ -23,8 +23,9 @@ stdenv.mkDerivation rec {
   installTargets = [ "install" "install-lib-shared" "install-lib-so-link" "install-lib-headers" ];
 
   meta = with stdenv.lib; {
-    homepage = http://rhash.anz.ru;
+    homepage = "http://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";
+    license = licenses.bsd0;
     platforms = platforms.all;
     maintainers = [ maintainers.andrewrk ];
   };
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 3ece05926cc..656efbf390c 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spectre-meltdown-checker";
-  version = "0.42";
+  version = "0.43";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "spectre-meltdown-checker";
     rev = "v${version}";
-    sha256 = "0pppf844i7b72hqnmfvq72w5y7b6dxd16y29l6j84maf22zxbjni";
+    sha256 = "1ys5m1yvm26qjlsjpqqd33lwpb880p0ay289hmifxjjawkqddjgg";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
new file mode 100644
index 00000000000..e5574be8ab9
--- /dev/null
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "step-ca";
+  version = "0.13.3";
+
+  goPackagePath = "github.com/smallstep/certificates";
+
+  src = fetchFromGitHub {
+    owner = "smallstep";
+    repo = "certificates";
+    rev = "v${version}";
+    sha256 = "1i42j7v5a5qqqb9ng8irblfyzykhyws0394q3zac290ymjijxbnq";
+  };
+
+  goDeps = ./deps.nix;
+
+  meta = with lib; {
+    description = "A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH";
+    homepage = "https://smallstep.com/certificates/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cmcdragonkai ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/tools/security/step-ca/deps.nix b/pkgs/tools/security/step-ca/deps.nix
new file mode 100644
index 00000000000..07607b6f65d
--- /dev/null
+++ b/pkgs/tools/security/step-ca/deps.nix
@@ -0,0 +1,291 @@
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
+[
+  {
+    goPackagePath  = "github.com/AndreasBriese/bbloom";
+    fetch = {
+      type = "git";
+      url = "https://github.com/AndreasBriese/bbloom";
+      rev =  "e2d15f34fcf99d5dbb871c820ec73f710fca9815";
+      sha256 = "05kkrsmpragy69bj6s80pxlm3pbwxrkkx7wgk0xigs6y2n6ylpds";
+    };
+  }
+  {
+    goPackagePath  = "github.com/chzyer/readline";
+    fetch = {
+      type = "git";
+      url = "https://github.com/chzyer/readline";
+      rev =  "2972be24d48e78746da79ba8e24e8b488c9880de";
+      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
+    };
+  }
+  {
+    goPackagePath  = "github.com/dgraph-io/badger";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgraph-io/badger";
+      rev =  "391b6d3b93e6014fe8c2971fcc0c1266e47dbbd9";
+      sha256 = "13zyd6irxagwfv4azgmpk2qg8f80plhxrcjl8x89jzsjkl0a0pkx";
+    };
+  }
+  {
+    goPackagePath  = "github.com/dgryski/go-farm";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgryski/go-farm";
+      rev =  "6a90982ecee230ff6cba02d5bd386acc030be9d3";
+      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
+    };
+  }
+  {
+    goPackagePath  = "github.com/go-chi/chi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-chi/chi";
+      rev =  "0ebf7795c516423a110473652e9ba3a59a504863";
+      sha256 = "18hwj6vni19ykp3bsmg9ggnl6y2hawym0vbsigdgx8craqbp7jb1";
+    };
+  }
+  {
+    goPackagePath  = "github.com/go-sql-driver/mysql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-sql-driver/mysql";
+      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
+      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
+    };
+  }
+  {
+    goPackagePath  = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev =  "aa810b61a9c79d51363740d207bb46cf8e620ed5";
+      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
+    };
+  }
+  {
+    goPackagePath  = "github.com/juju/ansiterm";
+    fetch = {
+      type = "git";
+      url = "https://github.com/juju/ansiterm";
+      rev =  "720a0952cc2ac777afc295d9861263e2a4cf96a1";
+      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
+    };
+  }
+  {
+    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
+    fetch = {
+      type = "git";
+      url = "https://github.com/konsorten/go-windows-terminal-sequences";
+      rev =  "5c8c8bd35d3832f5d134ae1e1e375b69a4d25242";
+      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
+    };
+  }
+  {
+    goPackagePath  = "github.com/lunixbochs/vtclean";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lunixbochs/vtclean";
+      rev =  "2d01aacdc34a083dca635ba869909f5fc0cd4f41";
+      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
+    };
+  }
+  {
+    goPackagePath  = "github.com/manifoldco/promptui";
+    fetch = {
+      type = "git";
+      url = "https://github.com/manifoldco/promptui";
+      rev =  "157c96fb638a14d268b305cf2012582431fcc410";
+      sha256 = "0zha48i5f529q4j1qycybdzza4l9706hijiqws36ikd5jzg8i7wz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/mattn/go-colorable";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-colorable";
+      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
+      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
+    };
+  }
+  {
+    goPackagePath  = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev =  "6ca4dbf54d38eea1a992b3c722a76a5d1c4cb25c";
+      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
+    };
+  }
+  {
+    goPackagePath  = "github.com/mmcloughlin/avo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mmcloughlin/avo";
+      rev =  "2e7d06bc7ada2979f17ccf8ebf486dba23b84fc7";
+      sha256 = "0fna1hhg193zy428lkj24a8853g3qviqs2c9xi96mji6ldprna5d";
+    };
+  }
+  {
+    goPackagePath  = "github.com/newrelic/go-agent";
+    fetch = {
+      type = "git";
+      url = "https://github.com/newrelic/go-agent";
+      rev =  "f5bce3387232559bcbe6a5f8227c4bf508dac1ba";
+      sha256 = "1zbp1cqhxp0sz3faymam6h1f91r1gl8dnnjx7qg8r06bd5fbzllb";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
+      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
+    };
+  }
+  {
+    goPackagePath  = "github.com/rs/xid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rs/xid";
+      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
+      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
+    };
+  }
+  {
+    goPackagePath  = "github.com/samfoo/ansi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/samfoo/ansi";
+      rev =  "b6bd2ded7189ce35bc02233b554eb56a5146af73";
+      sha256 = "0sw2d7c6l2ry34x0n4j37ydr8s7hxnax76yh6n35gb2g6f1h46sz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
+    fetch = {
+      type = "git";
+      url = "https://github.com/shurcooL/sanitized_anchor_name";
+      rev =  "86672fcb3f950f35f2e675df2240550f2a50762f";
+      sha256 = "142m507s9971cl8qdmbcw7sqxnkgi3xqd8wzvfq15p0w7w8i4a3h";
+    };
+  }
+  {
+    goPackagePath  = "github.com/sirupsen/logrus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sirupsen/logrus";
+      rev =  "ad15b42461921f1fb3529b058c6786c6a45d5162";
+      sha256 = "02xdfcp4f6dqvpavwf1vvr794qgz2fx8929paam7wnvcxy7ib606";
+    };
+  }
+  {
+    goPackagePath  = "github.com/smallstep/assert";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smallstep/assert";
+      rev =  "de77670473b5492f5d0bce155b5c01534c2d13f7";
+      sha256 = "15z2b4qyylnwgq2pzlaxsdabqxh8dbna4ddprk9rzmsvnfkpds16";
+    };
+  }
+  {
+    goPackagePath  = "github.com/smallstep/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smallstep/cli";
+      rev =  "eeecaac062cb548ee2ab7c7563bc3c2f2160f019";
+      sha256 = "1khhd1vgwqb08vki1nh0k4i2yk6jjdqmnq4f8anqn125zsj7hvdk";
+    };
+  }
+  {
+    goPackagePath  = "github.com/smallstep/nosql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smallstep/nosql";
+      rev =  "f80b3f432de0662f07ebd58fe52b0a119fe5dcd9";
+      sha256 = "155blxdgaprl1py5g8p52gipp0ckz3k6v41hgsp83nay01yynafb";
+    };
+  }
+  {
+    goPackagePath  = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev =  "b67dcf995b6a7b7f14fad5fcb7cc5441b05e814b";
+      sha256 = "0n5vq4nydlhb7w12jiwphvxqdy4jwpxc3zwlxyhf05lq1nxfb56h";
+    };
+  }
+  {
+    goPackagePath  = "go.etcd.io/bbolt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/etcd-io/bbolt";
+      rev =  "63597a96ec0ad9e6d43c3fc81e809909e0237461";
+      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev =  "4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06";
+      sha256 = "0sbsgjm6wqa162ssrf1gnpv62ak5wjn1bn8v7sxwwfg8a93z1028";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev =  "c44066c5c816ec500d459a2a324a753f78531ae0";
+      sha256 = "0mgww74bl15d0jvsh4f3qr1ckjzb8icb8hn0mgs5ppa0b2fgpc4f";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev =  "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
+      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
+      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev =  "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
+      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
+    };
+  }
+  {
+    goPackagePath  = "google.golang.org/appengine";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/appengine";
+      rev =  "54a98f90d1c46b7731eb8fb305d2a321c30ef610";
+      sha256 = "0l7mkdnwhidv8m686x432vmx8z5nqcrr9f46ddgvrxbh4wvyfcll";
+    };
+  }
+  {
+    goPackagePath  = "gopkg.in/square/go-jose.v2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/square/go-jose";
+      rev =  "730df5f748271903322feb182be83b43ebbbe27d";
+      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
+    };
+  }
+]
\ No newline at end of file
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index a0922f4df73..71a71be9147 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.29";
+  pname = "sudo";
+  version = "1.8.30";
 
   src = fetchurl {
-    urls =
-      [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
-        "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
-      ];
-    sha256 = "0z4wyadh9cks17gdpfgx4kvbrlnyb6nai2sd6chk7qh4jsngylyf";
+    url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
+    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 1f00d42f277..716973a3e2e 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
-  installFlags = "sysconfdir=$(out)/etc localstatedir=$(TMPDIR)";
+  installFlags = [ "sysconfdir=$(out)/etc" "localstatedir=$(TMPDIR)" ];
 
   meta = {
     homepage = "https://www.ucolick.org/~will/#super";
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index f5184b98562..062bf40b7d6 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "stackprotector" ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+
   configurePhase = ''
     for a in lcptools utils tb_polgen; do
       substituteInPlace $a/Makefile --replace /usr/sbin /sbin
@@ -24,7 +26,7 @@ stdenv.mkDerivation rec {
     substituteInPlace docs/Makefile --replace /usr/share /share
   '';
 
-  installFlags = "DESTDIR=$(out)";
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A pre-kernel/VMM module that uses Intel(R) TXT to perform a measured and verified launch of an OS kernel/VMM";
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index 5653c70d431..dd6e3d4a84b 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocl-icd opencl-headers ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=stringop-truncation" ];
+
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/ctop/default.nix b/pkgs/tools/system/ctop/default.nix
index 8d8b710750c..4f492def162 100644
--- a/pkgs/tools/system/ctop/default.nix
+++ b/pkgs/tools/system/ctop/default.nix
@@ -2,22 +2,18 @@
 
 buildGoModule rec {
   pname = "ctop";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "bcicen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0mm6hl5qklfv0yffj6cgypsgcrk4fq6p60djycfgj20yhz9cmf9x";
+    sha256 = "0y72l65xgfqrgghzbm1zcy776l5m31z0gn6vfr689zyi3k3f4kh8";
   };
 
-  patches = [
-    # Version 0.7.2 does not build with go 1.13.
-    # TODO: Remove once(and if) https://github.com/bcicen/ctop/pull/178 is merged and lands in a release.
-    ./go-1.13-deps.patch
-  ];
+  modSha256 = "0wxv6yzlgki7047qszx9p9xpph95bg097jkgaa0b3wbpx8vg7qml";
 
-  modSha256 = "0ad1gvamckg94r7f68cnjdbq9nyz6c3hh339hy4hghxd3rd1qskn";
+  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.build=v${version}" ];
 
   meta = with lib; {
     description = "Top-like interface for container metrics";
diff --git a/pkgs/tools/system/ctop/go-1.13-deps.patch b/pkgs/tools/system/ctop/go-1.13-deps.patch
deleted file mode 100644
index 153c0f36f81..00000000000
--- a/pkgs/tools/system/ctop/go-1.13-deps.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-diff --git a/go.mod b/go.mod
-index 4921cba..cbb4028 100644
---- a/go.mod
-+++ b/go.mod
-@@ -18,9 +18,6 @@ require (
- 	github.com/golang/protobuf v0.0.0-20170712042213-0a4f71a498b7 // indirect
- 	github.com/hashicorp/go-cleanhttp v0.0.0-20170211013415-3573b8b52aa7 // indirect
- 	github.com/jgautheron/codename-generator v0.0.0-20150829203204-16d037c7cc3c
--	github.com/kr/pretty v0.1.0 // indirect
--	github.com/maruel/panicparse v0.0.0-20170227222818-25bcac0d793c // indirect
--	github.com/maruel/ut v1.0.0 // indirect
- 	github.com/mattn/go-runewidth v0.0.0-20170201023540-14207d285c6c // indirect
- 	github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 // indirect
- 	github.com/nsf/termbox-go v0.0.0-20180303152453-e2050e41c884
-@@ -39,3 +36,5 @@ require (
- )
- 
- replace github.com/gizak/termui => github.com/bcicen/termui v0.0.0-20180326052246-4eb80249d3f5
-+
-+go 1.13
-diff --git a/go.sum b/go.sum
-new file mode 100644
-index 0000000..5ca7d55
---- /dev/null
-+++ b/go.sum
-@@ -0,0 +1,64 @@
-+github.com/Azure/go-ansiterm v0.0.0-20160622173216-fa152c58bc15 h1:VtP6TygBMvrR+SMMPHj3z3jvnj4vcafMRLIw4at7xww=
-+github.com/Azure/go-ansiterm v0.0.0-20160622173216-fa152c58bc15/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-+github.com/BurntSushi/toml v0.3.0 h1:e1/Ivsx3Z0FVTV0NSOv/aVgbUWyQuzj7DDnFblkRvsY=
-+github.com/BurntSushi/toml v0.3.0/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-+github.com/Microsoft/go-winio v0.3.8 h1:dvxbxtpTIjdAbx2OtL26p4eq0iEvys/U5yrsTJb3NZI=
-+github.com/Microsoft/go-winio v0.3.8/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
-+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
-+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
-+github.com/Sirupsen/logrus v0.0.0-20150423025312-26709e271410 h1:RxP6uUzJlS1Qa3+HYls3u+nQMKlnqC3RhL7wWC4Y4+E=
-+github.com/Sirupsen/logrus v0.0.0-20150423025312-26709e271410/go.mod h1:rmk17hk6i8ZSAJkSDa7nOxamrG+SP4P0mm+DAvExv4U=
-+github.com/bcicen/termui v0.0.0-20180326052246-4eb80249d3f5 h1:2pI3ZsoefWIi++8EqmANoC7Px/v2lRwnleVUcCuFgLg=
-+github.com/bcicen/termui v0.0.0-20180326052246-4eb80249d3f5/go.mod h1:yIA9ITWZD1p4/DvCQ44xvhyVb9XEUlVnY1rzGSHwbiM=
-+github.com/c9s/goprocinfo v0.0.0-20170609001544-b34328d6e0cd h1:xqaBnULC8wEnQpRDXAsDgXkU/STqoluz1REOoegSfNU=
-+github.com/c9s/goprocinfo v0.0.0-20170609001544-b34328d6e0cd/go.mod h1:uEyr4WpAH4hio6LFriaPkL938XnrvLpNPmQHBdrmbIE=
-+github.com/coreos/go-systemd v0.0.0-20151104194251-b4a58d95188d h1:MJ4ge3i0lehw+gE3JcGUUp8TmWjsLAlQlhmdASs/9wk=
-+github.com/coreos/go-systemd v0.0.0-20151104194251-b4a58d95188d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-+github.com/docker/docker v0.0.0-20170502054910-90d35abf7b35 h1:ly3dRUfvdP5i/t9iqVHd2VQQIDtO3tpfFWPah7g4CFw=
-+github.com/docker/docker v0.0.0-20170502054910-90d35abf7b35/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-+github.com/docker/go-connections v0.0.0-20170301234100-a2afab980204 h1:JYhQLEn7v7EtrpA9ByRz51gwlk8qt12EGP9XlbX/qw4=
-+github.com/docker/go-connections v0.0.0-20170301234100-a2afab980204/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-+github.com/docker/go-units v0.3.2 h1:Kjm80apys7gTtfVmCvVY8gwu10uofaFSrmAKOVrtueE=
-+github.com/docker/go-units v0.3.2/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-+github.com/fsouza/go-dockerclient v0.0.0-20170307141636-318513eb1ab2 h1:JuVaWSoRMBrstn2l8cxKXjK8l/qurk5qyJ9dq7EIQmU=
-+github.com/fsouza/go-dockerclient v0.0.0-20170307141636-318513eb1ab2/go.mod h1:KpcjM623fQYE9MZiTGzKhjfxXAV9wbyX2C1cyRHfhl0=
-+github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55 h1:oIgNYSrSUbNH5DJh6DMhU1PiOKOYIHNxrV3djLsLpEI=
-+github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-+github.com/golang/protobuf v0.0.0-20170712042213-0a4f71a498b7 h1:ulJ2cj/xlDlrwLCvWH4UeV9vJ/jXP6wEGgTSF7EOnmQ=
-+github.com/golang/protobuf v0.0.0-20170712042213-0a4f71a498b7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-+github.com/hashicorp/go-cleanhttp v0.0.0-20170211013415-3573b8b52aa7 h1:67fHcS+inUoiIqWCKIqeDuq2AlPHNHPiTqp97LdQ+bc=
-+github.com/hashicorp/go-cleanhttp v0.0.0-20170211013415-3573b8b52aa7/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-+github.com/jgautheron/codename-generator v0.0.0-20150829203204-16d037c7cc3c h1:/hc+TxW4Q1v6aqNPHE5jiaNF2xEK0CzWTgo25RQhQ+U=
-+github.com/jgautheron/codename-generator v0.0.0-20150829203204-16d037c7cc3c/go.mod h1:FJRkXmPrkHw0WDjB/LXMUhjWJ112Y6JUYnIVBOy8oH8=
-+github.com/mattn/go-runewidth v0.0.0-20170201023540-14207d285c6c h1:eFzthqtg3W6Pihj3DMTXLAF4f+ge5r5Ie5g6HLIZAF0=
-+github.com/mattn/go-runewidth v0.0.0-20170201023540-14207d285c6c/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-+github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7 h1:DpOJ2HYzCv8LZP15IdmG+YdwD2luVPHITV96TkirNBM=
-+github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-+github.com/nsf/termbox-go v0.0.0-20180303152453-e2050e41c884 h1:fcs71SMqqDhUD+PbpIv9xf3EH9F9s6HfiLwr6jKm1VA=
-+github.com/nsf/termbox-go v0.0.0-20180303152453-e2050e41c884/go.mod h1:IuKpRQcYE1Tfu+oAQqaLisqDeXgjyyltCfsaoYN18NQ=
-+github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d h1:VhgPp6v9qf9Agr/56bj7Y/xa04UccTW04VP0Qed4vnQ=
-+github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH2ZwIWBy3CJBeOBEugqcmXREj14T+iG/4k4U=
-+github.com/op/go-logging v0.0.0-20160211212156-b2cb9fa56473 h1:J1QZwDXgZ4dJD2s19iqR9+U00OWM2kDzbf1O/fmvCWg=
-+github.com/op/go-logging v0.0.0-20160211212156-b2cb9fa56473/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-+github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
-+github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-+github.com/seccomp/libseccomp-golang v0.0.0-20150813023252-1b506fc7c24e h1:HJbgNpzYMeTLPpkMwbPNTPlhNd9r4xQtqcZG6qoIGgs=
-+github.com/seccomp/libseccomp-golang v0.0.0-20150813023252-1b506fc7c24e/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
-+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-+github.com/syndtr/gocapability v0.0.0-20150716010906-2c00daeb6c3b h1:UzwAjzrPQVJoxLfb26YI2WRrhD3g09ZHt9vAQckWiPY=
-+github.com/syndtr/gocapability v0.0.0-20150716010906-2c00daeb6c3b/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-+github.com/vishvananda/netlink v0.0.0-20150820014904-1e2e08e8a2dc h1:0HAHLwEY4k1VqaO1SzBi4XxT0KA06Cv+QW2LXknBk9g=
-+github.com/vishvananda/netlink v0.0.0-20150820014904-1e2e08e8a2dc/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
-+github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc h1:R83G5ikgLMxrBvLh22JhdfI8K6YXEPHx5P03Uu3DRs4=
-+github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
-+golang.org/x/net v0.0.0-20170308210134-a6577fac2d73 h1:5kGFsglTK4KqaHYb/WCmYmj+Gm1+dzbilbtzruHj6dw=
-+golang.org/x/net v0.0.0-20170308210134-a6577fac2d73/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
-+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-+golang.org/x/sys v0.0.0-20170308153327-99f16d856c98 h1:U3NsAsR1IG0Aet3Z+IToBDWbPoJ7hjwgDpqqch4APkU=
-+golang.org/x/sys v0.0.0-20170308153327-99f16d856c98/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/pkgs/tools/system/daemon/default.nix b/pkgs/tools/system/daemon/default.nix
index 9bc6ecc6ddf..76f53b55f3d 100644
--- a/pkgs/tools/system/daemon/default.nix
+++ b/pkgs/tools/system/daemon/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
     url = http://libslack.org/daemon/download/daemon-0.6.4.tar.gz;
     sha256 = "18aw0f8k3j30xqwv4z03962kdpqd10nf1w9liihylmadlx5fmff4";
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = [ perl ];
 
   meta = {
diff --git a/pkgs/tools/system/di/default.nix b/pkgs/tools/system/di/default.nix
index 6aaa0eeddfe..3aef366ea06 100644
--- a/pkgs/tools/system/di/default.nix
+++ b/pkgs/tools/system/di/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "di";
-  version = "4.47.2";
+  version = "4.47.3";
 
   src = fetchurl {
     url = "https://gentoo.com/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1g97pp2hznskqlkhl6ppyzgdmv878bcqiwh633kdnm70d1pvh192";
+    sha256 = "0m4npba50sf5s61g5z3xd2r7937zwja941f2h3f081xi24c2hfck";
   };
 
   makeFlags = [ "INSTALL_DIR=$(out)" ];
diff --git a/pkgs/tools/system/efivar/default.nix b/pkgs/tools/system/efivar/default.nix
index 365cfeab058..f02923de349 100644
--- a/pkgs/tools/system/efivar/default.nix
+++ b/pkgs/tools/system/efivar/default.nix
@@ -18,6 +18,16 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/rhboot/efivar/pull/133.patch";
       sha256 = "038cwldb8sqnal5l6mhys92cqv8x7j8rgsl8i4fiv9ih9znw26i6";
     })
+    (fetchurl {
+      name = "fix-misaligned-pointer.patch";
+      url = "https://github.com/rhboot/efivar/commit/b98ba8921010d03f46704a476c69861515deb1ca.patch";
+      sha256 = "0ni9mz7y40a2wf1d1q5n9y5dhcbydxvfdhqic7zsmgnaxs3a0p27";
+    })
+    (fetchurl {
+      name = "fix-gcc9-error.patch";
+      url = "https://github.com/rhboot/efivar/commit/c3c553db85ff10890209d0fe48fb4856ad68e4e0.patch";
+      sha256 = "0lc38npydp069nlcga25wzzm204ww9l6mpjfn6wmhdfhn0pgjwky";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index cc9b95d06c6..86aa5adb6f8 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -14,11 +14,13 @@ stdenv.mkDerivation rec {
   CXXFLAGS = "-fpermissive -Wno-error=catch-value";
   NIX_LDFLAGS = "-lblkid";
 
-  cmakeFlags = [ 
+  cmakeFlags = [
     "-DFACTER_RUBY=${ruby}/lib/libruby.so"
     "-DRUBY_LIB_INSTALL=${placeholder "out"}/lib/ruby"
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-copy";
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ boost cpp-hocon curl leatherman libwhereami libyamlcpp openssl ruby utillinux ];
 
diff --git a/pkgs/tools/system/fcron/default.nix b/pkgs/tools/system/fcron/default.nix
index 6ef39a647f7..3dd84aa8a9c 100644
--- a/pkgs/tools/system/fcron/default.nix
+++ b/pkgs/tools/system/fcron/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       "--disable-checks"
     ];
 
-  installTargets = "install-staged"; # install does also try to change permissions of /etc/* files
+  installTargets = [ "install-staged" ]; # install does also try to change permissions of /etc/* files
 
   # fcron tries to install pid into system directory on install
   installFlags = [
diff --git a/pkgs/tools/system/gdmap/default.nix b/pkgs/tools/system/gdmap/default.nix
index 0c254bb2854..4adc8160829 100644
--- a/pkgs/tools/system/gdmap/default.nix
+++ b/pkgs/tools/system/gdmap/default.nix
@@ -15,9 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  NIX_LDFLAGS = [
-    "-lm"
-  ];
+  NIX_LDFLAGS = "-lm";
 
   meta = with stdenv.lib; {
     homepage = http://gdmap.sourceforge.net;
diff --git a/pkgs/tools/system/ioping/default.nix b/pkgs/tools/system/ioping/default.nix
index b4ab0f04d1c..5cd3a707dde 100644
--- a/pkgs/tools/system/ioping/default.nix
+++ b/pkgs/tools/system/ioping/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cv2496jplka55yqdcf3ln78r8yggy4lgmgf06l6fbljjrdx7pgq";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Disk I/O latency measuring tool";
diff --git a/pkgs/tools/system/ipmitool/default.nix b/pkgs/tools/system/ipmitool/default.nix
index c906ad3c8cf..3105cba5a34 100644
--- a/pkgs/tools/system/ipmitool/default.nix
+++ b/pkgs/tools/system/ipmitool/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
       ${if static then "LDFLAGS=-static --enable-static --disable-shared" else "--enable-shared"}
     )
   '';
-  makeFlags = if static then "AM_LDFLAGS=-all-static" else "";
+  makeFlags = stdenv.lib.optional static "AM_LDFLAGS=-all-static";
   dontDisableStatic = static;
 
   meta = with lib; {
diff --git a/pkgs/tools/system/lr/default.nix b/pkgs/tools/system/lr/default.nix
index 74bc177023f..788319c0c04 100644
--- a/pkgs/tools/system/lr/default.nix
+++ b/pkgs/tools/system/lr/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "lr";
-  version = "1.4.1";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "chneukirchen";
     repo = "lr";
     rev = "v${version}";
-    sha256 = "0mpaqn0zfhxdf9wzs1wgdd29bjcyl3rgfdlqbwhiwcy2h3vy2h8s";
+    sha256 = "1dxla14ldyym01lhmacfwps1vim0fk67c2ik2w08gg534siyj770";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/chneukirchen/lr;
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index ff6a6e03cc8..4f8cfb966e8 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
 , CoreFoundation, IOKit, libossp_uuid
 , curl, libcap,  libuuid, lm_sensors, zlib
 , withCups ? false, cups
@@ -12,12 +12,14 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "1.18.1";
+  version = "1.19.0";
   pname = "netdata";
 
-  src = fetchurl {
-    url = "https://github.com/netdata/netdata/releases/download/v${version}/netdata-v${version}.tar.gz";
-    sha256 = "08g5jp63k8y5gbg8v9hxj75q0533c6cyzpjml9z1g5h2h4zaik1r";
+  src = fetchFromGitHub {
+    owner = "netdata";
+    repo = "netdata";
+    rev = "v${version}";
+    sha256 = "1s6kzx4xh8b6v7ki8h2mfzprj5rxvlgx2md20cr8c0v81qpz3q3q";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
@@ -34,7 +36,7 @@ stdenv.mkDerivation rec {
     ./no-files-in-etc-and-var.patch
   ];
 
-  NIX_CFLAGS_COMPILE = optional withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
+  NIX_CFLAGS_COMPILE = optionalString withDebug "-O1 -ggdb -DNETDATA_INTERNAL_CHECKS=1";
 
   postInstall = optionalString (!stdenv.isDarwin) ''
     # rename this plugin so netdata will look for setuid wrapper
diff --git a/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch b/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
index c3927c29dd2..138787b98f1 100644
--- a/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
+++ b/pkgs/tools/system/netdata/no-files-in-etc-and-var.patch
@@ -1,9 +1,9 @@
 diff --git a/Makefile.am b/Makefile.am
-index f2087bb..7a70cfb 100644
+index 2625dcc..1fdd645 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -116,10 +116,10 @@ AM_CFLAGS = \
- 	$(NULL)
+@@ -113,10 +113,10 @@ AM_CFLAGS = \
+     $(NULL)
  
  sbin_PROGRAMS =
 -dist_cache_DATA = packaging/installer/.keep
@@ -17,70 +17,113 @@ index f2087bb..7a70cfb 100644
  plugins_PROGRAMS =
  
  LIBNETDATA_FILES = \
+diff --git a/collectors/Makefile.am b/collectors/Makefile.am
+index 7431025..f62f8ac 100644
+--- a/collectors/Makefile.am
++++ b/collectors/Makefile.am
+@@ -30,11 +30,6 @@ SUBDIRS = \
+ usercustompluginsconfigdir=$(configdir)/custom-plugins.d
+ usergoconfigdir=$(configdir)/go.d
+ 
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(usercustompluginsconfigdir)
+-	$(INSTALL) -d $(DESTDIR)$(usergoconfigdir)
+-
+ dist_noinst_DATA = \
+     README.md \
+     $(NULL)
 diff --git a/collectors/charts.d.plugin/Makefile.am b/collectors/charts.d.plugin/Makefile.am
-index 2989b4b..64de7d6 100644
+index b3b2fb9..68b768e 100644
 --- a/collectors/charts.d.plugin/Makefile.am
 +++ b/collectors/charts.d.plugin/Makefile.am
-@@ -32,7 +32,6 @@ dist_charts_DATA = \
+@@ -31,13 +31,8 @@ dist_charts_DATA = \
  
  userchartsconfigdir=$(configdir)/charts.d
  dist_userchartsconfig_DATA = \
 -    .keep \
      $(NULL)
  
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(userchartsconfigdir)
+-
  chartsconfigdir=$(libconfigdir)/charts.d
+ dist_chartsconfig_DATA = \
+     $(NULL)
 diff --git a/collectors/node.d.plugin/Makefile.am b/collectors/node.d.plugin/Makefile.am
-index 3b5a0a5..b7abe01 100644
+index 411bce9..ba60276 100644
 --- a/collectors/node.d.plugin/Makefile.am
 +++ b/collectors/node.d.plugin/Makefile.am
-@@ -23,7 +23,6 @@ dist_noinst_DATA = \
+@@ -23,13 +23,8 @@ dist_noinst_DATA = \
  
  usernodeconfigdir=$(configdir)/node.d
  dist_usernodeconfig_DATA = \
 -    .keep \
      $(NULL)
  
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(usernodeconfigdir)
+-
  nodeconfigdir=$(libconfigdir)/node.d
+ dist_nodeconfig_DATA = \
+     $(NULL)
 diff --git a/collectors/python.d.plugin/Makefile.am b/collectors/python.d.plugin/Makefile.am
-index 652a35d..cf4b2cc 100644
+index cb14e35..8a6c5a7 100644
 --- a/collectors/python.d.plugin/Makefile.am
 +++ b/collectors/python.d.plugin/Makefile.am
-@@ -29,7 +29,6 @@ dist_python_DATA = \
+@@ -29,13 +29,8 @@ dist_python_DATA = \
  
  userpythonconfigdir=$(configdir)/python.d
  dist_userpythonconfig_DATA = \
 -    .keep \
      $(NULL)
  
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(userpythonconfigdir)
+-
  pythonconfigdir=$(libconfigdir)/python.d
+ dist_pythonconfig_DATA = \
+     $(NULL)
 diff --git a/collectors/statsd.plugin/Makefile.am b/collectors/statsd.plugin/Makefile.am
-index e63bf98..0f59782 100644
+index 87b6ca7..9d010c7 100644
 --- a/collectors/statsd.plugin/Makefile.am
 +++ b/collectors/statsd.plugin/Makefile.am
-@@ -14,6 +14,5 @@ dist_statsdconfig_DATA = \
+@@ -14,9 +14,4 @@ dist_statsdconfig_DATA = \
  
  userstatsdconfigdir=$(configdir)/statsd.d
  dist_userstatsdconfig_DATA = \
 -    .keep \
      $(NULL)
- 
+-
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(userstatsdconfigdir)
 diff --git a/health/Makefile.am b/health/Makefile.am
-index 62a4c6d..4d651df 100644
+index f63faa8..8912ef2 100644
 --- a/health/Makefile.am
 +++ b/health/Makefile.am
-@@ -16,7 +16,6 @@ dist_noinst_DATA = \
+@@ -16,13 +16,8 @@ dist_noinst_DATA = \
  
  userhealthconfigdir=$(configdir)/health.d
  dist_userhealthconfig_DATA = \
 -    .keep \
      $(NULL)
  
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(userhealthconfigdir)
+-
  healthconfigdir=$(libconfigdir)/health.d
+ dist_healthconfig_DATA = \
+     health.d/adaptec_raid.conf \
 diff --git a/system/Makefile.am b/system/Makefile.am
-index b085dca..ccfa588 100644
+index ad68c65..bf6a840 100644
 --- a/system/Makefile.am
 +++ b/system/Makefile.am
-@@ -17,10 +17,6 @@ CLEANFILES = \
+@@ -16,14 +16,6 @@ CLEANFILES = \
  include $(top_srcdir)/build/subst.inc
  SUFFIXES = .in
  
@@ -88,6 +131,25 @@ index b085dca..ccfa588 100644
 -    edit-config \
 -    $(NULL)
 -
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(configdir)
+-
  nodist_noinst_DATA = \
- 	netdata-openrc \
- 	netdata.logrotate \
+     netdata-openrc \
+     netdata.logrotate \
+diff --git a/web/Makefile.am b/web/Makefile.am
+index ccaccd7..f2fed50 100644
+--- a/web/Makefile.am
++++ b/web/Makefile.am
+@@ -11,10 +11,6 @@ SUBDIRS = \
+ 
+ usersslconfigdir=$(configdir)/ssl
+ 
+-# Explicitly install directories to avoid permission issues due to umask
+-install-exec-local:
+-	$(INSTALL) -d $(DESTDIR)$(usersslconfigdir)
+-
+ dist_noinst_DATA = \
+     README.md \
+     gui/confluence/README.md \
diff --git a/pkgs/tools/system/nq/default.nix b/pkgs/tools/system/nq/default.nix
index 1d8eeff209e..89c84c8c9ca 100644
--- a/pkgs/tools/system/nq/default.nix
+++ b/pkgs/tools/system/nq/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "1db96ykz35r273jyhf7cdknqk4p2jj9l8gbz7pjy1hq4pb6ffk99";
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   postPatch = ''
     sed -i tq \
       -e 's|\bfq\b|'$out'/bin/fq|g' \
diff --git a/pkgs/tools/system/opencl-info/default.nix b/pkgs/tools/system/opencl-info/default.nix
index 60175d27f15..d1c3d0ec6c0 100644
--- a/pkgs/tools/system/opencl-info/default.nix
+++ b/pkgs/tools/system/opencl-info/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ opencl-clhpp ocl-icd ];
 
-  NIX_LDFLAGS = [ "-lOpenCL" ];
+  NIX_LDFLAGS = "-lOpenCL";
 
   installPhase = ''
     install -Dm755 opencl-info $out/bin/opencl-info
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 22154796b31..b773529a0d7 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     "DNS=yes"
   ];
 
-  installTargets = "install install-lib";
+  installTargets = [ "install" "install-lib" ];
 
   # Get rid of update-pciids as it won't work.
   postInstall = "rm $out/sbin/update-pciids $out/man/man8/update-pciids.8";
diff --git a/pkgs/tools/system/rowhammer-test/default.nix b/pkgs/tools/system/rowhammer-test/default.nix
index 5a3ba8b6619..64c184a6122 100644
--- a/pkgs/tools/system/rowhammer-test/default.nix
+++ b/pkgs/tools/system/rowhammer-test/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1fbfcnm5gjish47wdvikcsgzlb5vnlfqlzzm6mwiw2j5qkq0914i";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.isi686 "-Wno-error=format";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-Wno-error=format";
 
   buildPhase = "sh -e make.sh";
 
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index d12411d6145..7c5b9a18966 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -30,8 +30,6 @@ stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional (libmysqlclient != null) libmysqlclient
     ++ stdenv.lib.optional stdenv.isLinux systemd;
 
-  hardeningDisable = [ "format" ];
-
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
@@ -95,9 +93,7 @@ stdenv.mkDerivation rec {
     (mkFlag (hadoop != null)          "omhdfs")
     (mkFlag (rdkafka != null)         "omkafka")
     (mkFlag (libmongo-client != null) "ommongodb")
-    (mkFlag (czmq != null)            "imzmq3")
     (mkFlag (czmq != null)            "imczmq")
-    (mkFlag (czmq != null)            "omzmq3")
     (mkFlag (czmq != null)            "omczmq")
     (mkFlag (rabbitmq-c != null)      "omrabbitmq")
     (mkFlag (hiredis != null)         "omhiredis")
diff --git a/pkgs/tools/system/setserial/default.nix b/pkgs/tools/system/setserial/default.nix
index 036e3a83cf2..68ea32e1e8a 100644
--- a/pkgs/tools/system/setserial/default.nix
+++ b/pkgs/tools/system/setserial/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ groff ];
 
-  installFlags = ''DESTDIR=$(out)'';
+  installFlags = [ "DESTDIR=$(out)" ];
 
   postConfigure = ''
     sed -e s@/usr/man/@/share/man/@ -i Makefile
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index c8748efc302..7d3e62d7beb 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.hostPlatform.isMusl "-D_LINUX_SYSINFO_H=1";
 
   # Won't build on i686 because the binary will be linked again in the
   # install phase without checking the dependencies. This will prevent
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index 9cec99145b9..ad11cd2e3b6 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -37,7 +37,7 @@ assert enableQt -> qwt != null;
   ]
   ++ stdenv.lib.optional enableNtfs ntfs3g
   ++ stdenv.lib.optional enableExtFs e2fsprogs
-  ++ stdenv.lib.optional enableQt [ qtbase qttools qwt ];
+  ++ stdenv.lib.optionals enableQt [ qtbase qttools qwt ];
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/tools/system/uefitool/common.nix b/pkgs/tools/system/uefitool/common.nix
new file mode 100644
index 00000000000..7d5ee82dcf9
--- /dev/null
+++ b/pkgs/tools/system/uefitool/common.nix
@@ -0,0 +1,39 @@
+{ version, sha256, installFiles }:
+{ lib, mkDerivation, fetchFromGitHub, qtbase, qmake, cmake, zip }:
+
+mkDerivation rec {
+  passthru = {
+    inherit version;
+    inherit sha256;
+    inherit installFiles;
+  };
+  pname = "uefitool";
+  inherit version;
+
+  src = fetchFromGitHub {
+    inherit sha256;
+    owner = "LongSoft";
+    repo = pname;
+    rev = version;
+  };
+
+  buildInputs = [ qtbase ];
+  nativeBuildInputs = [ qmake cmake zip ];
+
+  configurePhase = ":";
+  buildPhase = "bash unixbuild.sh";
+
+  installPhase = ''
+    mkdir -p "$out"/bin
+    cp ${lib.concatStringsSep " " installFiles} "$out"/bin
+  '';
+
+  meta = with lib; {
+    description = "UEFI firmware image viewer and editor";
+    homepage = "https://github.com/LongSoft/uefitool";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ajs124 ];
+    # uefitool supposedly works on other platforms, but their build script only works on linux in nixpkgs
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/system/uefitool/variants.nix b/pkgs/tools/system/uefitool/variants.nix
new file mode 100644
index 00000000000..cced17e6ddd
--- /dev/null
+++ b/pkgs/tools/system/uefitool/variants.nix
@@ -0,0 +1,15 @@
+{ libsForQt5 }:
+let
+  common = opts: libsForQt5.callPackage (import ./common.nix opts) {};
+in rec {
+  new-engine = common rec {
+    version = "A56";
+    sha256 = "0sxmjkrwcchxg2qmcjsw2vr42s7cdcg2fxkwb8axq2r2z23465gp";
+    installFiles = [ "UEFITool/UEFITool" "UEFIFind/UEFIFind" "UEFIExtract/UEFIExtract" ];
+  };
+  old-engine = common rec {
+    version = "0.27.0";
+    sha256 = "1i1p823qld927p4f1wcphqcnivb9mq7fi5xmzibxc3g9zzgnyc2h";
+    installFiles = [ "UEFITool" "UEFIReplace/UEFIReplace" "UEFIPatch/UEFIPatch" ];
+  };
+}
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index bce6d0c4185..1391a2a5ed2 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
 
   patches = [ ./dont_static_link.patch ];
 
+  # fix build with gcc9
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+
   postPatch = ''
     substituteInPlace Makefile \
       --replace "ar qc" '${stdenv.cc.bintools.targetPrefix}ar qc'
diff --git a/pkgs/tools/system/xe/default.nix b/pkgs/tools/system/xe/default.nix
index 02e36dbc31c..62423ff594f 100644
--- a/pkgs/tools/system/xe/default.nix
+++ b/pkgs/tools/system/xe/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "04jr8f6jcijr0bsmn8ajm0aj35qh9my3xjsaq64h8lwg5bpyn29x";
   };
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "Simple xargs and apply replacement";
diff --git a/pkgs/tools/text/ansifilter/default.nix b/pkgs/tools/text/ansifilter/default.nix
index 7437d2765a9..bc265c5a5ae 100644
--- a/pkgs/tools/text/ansifilter/default.nix
+++ b/pkgs/tools/text/ansifilter/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Tool to convert ANSI to other formats";
     longDescription = ''
-      Tool to remove ANSI or convert them to another format 
+      Tool to remove ANSI or convert them to another format
       (HTML, TeX, LaTeX, RTF, Pango or BBCode)
     '';
     homepage = "http://www.andre-simon.de/doku/ansifilter/en/ansifilter.php";
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 7a5f6c8dd81..0d5a50570f5 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -41,7 +41,9 @@ stdenv.mkDerivation rec {
     (if interactive then "--with-readline=${readline.dev}" else "--without-readline")
   ];
 
-  makeFlags = "AR=${stdenv.cc.targetPrefix}ar";
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
 
   inherit doCheck;
 
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 4139771b5cb..626963bc601 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ (stdenv.lib.optional stdenv.isDarwin Security) openssl ];
+  buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
 
   cargoSha256 = "1hxsfls6fpllc9yg5ib3qz6pa62j1y1va8a6356j6812csk4ifnn";
 
diff --git a/pkgs/tools/text/multitran/libmtquery/default.nix b/pkgs/tools/text/multitran/libmtquery/default.nix
index 8b2032dcaba..baccdfdedba 100644
--- a/pkgs/tools/text/multitran/libmtquery/default.nix
+++ b/pkgs/tools/text/multitran/libmtquery/default.nix
@@ -9,9 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmtsupport libfacet libbtree multitrandata ];
 
-  NIX_LDFLAGS = [
-    "-lbtree"
-  ];
+  NIX_LDFLAGS = "-lbtree";
 
   patchPhase = ''
     sed -i -e 's@\$(DESTDIR)/usr@'$out'@' \
diff --git a/pkgs/tools/text/reckon/default.nix b/pkgs/tools/text/reckon/default.nix
index 25e9c07f351..261149229b6 100644
--- a/pkgs/tools/text/reckon/default.nix
+++ b/pkgs/tools/text/reckon/default.nix
@@ -4,17 +4,17 @@ stdenv.mkDerivation rec {
   pname = "reckon";
   version = (import ./gemset.nix).reckon.version;
 
-  env = bundlerEnv {
-    name = "${pname}-${version}-gems";
-
-    gemdir = ./.;
-  };
-
   phases = [ "installPhase" ];
 
   buildInputs = [ makeWrapper ];
 
-  installPhase = ''
+  installPhase = let
+    env = bundlerEnv {
+      name = "${pname}-${version}-gems";
+
+      gemdir = ./.;
+    };
+  in ''
     mkdir -p $out/bin
     makeWrapper ${env}/bin/reckon $out/bin/reckon
   '';
diff --git a/pkgs/tools/text/replace/default.nix b/pkgs/tools/text/replace/default.nix
index 9242014cdca..3549e7c1c94 100644
--- a/pkgs/tools/text/replace/default.nix
+++ b/pkgs/tools/text/replace/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "man" ];
 
-  makeFlags = "TREE=\$(out) MANTREE=\$(TREE)/share/man";
+  makeFlags = [ "TREE=\$(out)" "MANTREE=\$(TREE)/share/man" ];
 
   preBuild = ''
     sed -e "s@/bin/mv@$(type -P mv)@" -i replace.h
diff --git a/pkgs/tools/text/sgml/jade/default.nix b/pkgs/tools/text/sgml/jade/default.nix
index b7f8bd6df38..2cc40510121 100644
--- a/pkgs/tools/text/sgml/jade/default.nix
+++ b/pkgs/tools/text/sgml/jade/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gnum4 ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-deprecated" ];
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated";
 
   preInstall = ''
     install -d -m755 "$out"/lib
diff --git a/pkgs/tools/text/smu/default.nix b/pkgs/tools/text/smu/default.nix
index a80a6d3d799..50bceb4fcb3 100644
--- a/pkgs/tools/text/smu/default.nix
+++ b/pkgs/tools/text/smu/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec {
   # _FORTIFY_SOURCE requires compiling with optimization (-O)
   NIX_CFLAGS_COMPILE = "-O";
 
-  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
 
   meta = with lib; {
     description = "simple markup - markdown like syntax";
diff --git a/pkgs/tools/text/untex/default.nix b/pkgs/tools/text/untex/default.nix
index 923adf8571d..f9c7e3cdfc6 100644
--- a/pkgs/tools/text/untex/default.nix
+++ b/pkgs/tools/text/untex/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   unpackPhase = "tar xf $src";
-  installTargets = "install install.man";
-  installFlags = "BINDIR=$(out)/bin MANDIR=$(out)/share/man/man1";
+  installTargets = [ "install" "install.man" ];
+  installFlags = [ "BINDIR=$(out)/bin" "MANDIR=$(out)/share/man/man1" ];
   preBuild = ''
     sed -i '1i#include <stdlib.h>\n#include <string.h>' untex.c
     mkdir -p $out/bin $out/share/man/man1
diff --git a/pkgs/tools/text/zimreader/default.nix b/pkgs/tools/text/zimreader/default.nix
index 15e5ddf2f19..177f9326dd2 100644
--- a/pkgs/tools/text/zimreader/default.nix
+++ b/pkgs/tools/text/zimreader/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "0x529137rxy6ld64xqa6xmn93121ripxvkf3sc7hv3wg6km182sw";
   };
 
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
   patches = [
     (fetchpatch {
       name = "zimreader_tntnet221.patch";
diff --git a/pkgs/tools/typesetting/asciidoc/default.nix b/pkgs/tools/typesetting/asciidoc/default.nix
index 83aa667f58f..44c5f6d1f24 100644
--- a/pkgs/tools/typesetting/asciidoc/default.nix
+++ b/pkgs/tools/typesetting/asciidoc/default.nix
@@ -259,7 +259,7 @@ stdenv.mkDerivation rec {
   '';
 
   preInstall = "mkdir -p $out/etc/vim";
-  makeFlags = if stdenv.isCygwin then "DESTDIR=/." else null;
+  makeFlags = stdenv.lib.optional stdenv.isCygwin "DESTDIR=/.";
 
   meta = with stdenv.lib; {
     description = "Text-based document generation system";
diff --git a/pkgs/tools/typesetting/hevea/default.nix b/pkgs/tools/typesetting/hevea/default.nix
index aa32d52dfc6..2a126ac5c83 100644
--- a/pkgs/tools/typesetting/hevea/default.nix
+++ b/pkgs/tools/typesetting/hevea/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = with ocamlPackages; [ ocaml ocamlbuild ];
 
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A quite complete and fast LATEX to HTML translator";
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 6622a03decc..a4b0fb99f3e 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -128,8 +128,6 @@ in buildEnv {
       mkdir $out/share/texmf-local
     )
   '' +
-    # updmap.cfg seems like not needing changes
-
     # now filter hyphenation patterns, in a hacky way ATM
   (let
     pnames = uniqueStrings (map (p: p.pname) pkgList.splitBin.wrong);
@@ -214,7 +212,12 @@ in buildEnv {
     texlinks.sh "$out/bin" && wrapBin
     (perl `type -P fmtutil.pl` --sys --all || true) | grep '^fmtutil' # too verbose
     #texlinks.sh "$out/bin" && wrapBin # do we need to regenerate format links?
+
+    # Disable unavailable map files
     echo y | perl `type -P updmap.pl` --sys --syncwithtrees --force
+    # Regenerate the map files (this is optional)
+    perl `type -P updmap.pl` --sys --force
+
     perl `type -P mktexlsr.pl` ./share/texmf-* # to make sure
   '' +
     # install (wrappers for) scripts, based on a list from upstream texlive
diff --git a/pkgs/tools/video/bento4/default.nix b/pkgs/tools/video/bento4/default.nix
index 5594143bfbc..4dea8dba6ed 100644
--- a/pkgs/tools/video/bento4/default.nix
+++ b/pkgs/tools/video/bento4/default.nix
@@ -3,13 +3,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "bento4";
-  version = "1.5.1-628";
+  version = "1.5.1-629";
 
   src = fetchFromGitHub {
     owner = "axiomatic-systems";
     repo = "Bento4";
     rev = "v${version}";
-    sha256 = "1fv0k7f3ifwa0c0x22wblm6i8x9zbc13pg047a9i74n456p0mzp3";
+    sha256 = "1614idy0r7qrkiaq4kz3gh1b1bpx592aqvi574kxnjrxc34kpmb3";
   };
 
   patches = [ ./libap4.patch ];
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 31d26a6c72a..3e72d8b8af5 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libdv libjpeg libpng ]
               ++ lib.optionals (!withMinimal) [ gtk2 libX11 SDL SDL_gfx ];
 
-  NIX_CFLAGS_COMPILE = lib.optional (!withMinimal) "-I${SDL.dev}/include/SDL";
+  NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${SDL.dev}/include/SDL";
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 1b0fa9f551b..b57fa540837 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -1,8 +1,8 @@
-{ rustPlatform, fetchFromGitHub, fetchurl, stdenv, lib, unzip, nasm }:
+{ rustPlatform, fetchFromGitHub, fetchurl, stdenv, lib, nasm }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = stdenv.mkDerivation rec {
     name = "${pname}-${version}-source";
@@ -11,24 +11,21 @@ rustPlatform.buildRustPackage rec {
       owner = "xiph";
       repo = "rav1e";
       rev = "v${version}";
-      sha256 = "0sij9hwnar27gcwvfcjbhgyrhw99zjv8gr9s9gshqi766p5dy51a";
+      sha256 = "1lv8g1vw11lanyx6lqr34hb6m4x1fvwb60kgg5nk8s8hgdr18i0y";
     };
     cargoLock = fetchurl {
-      url = "https://github.com/xiph/rav1e/releases/download/v${version}/rav1e-${version}.zip";
-      sha256 = "1i48c7mvc9q20d76p2rpxva551249m3p52q2z1g9sj4xzpyyk41m";
+      url = "https://github.com/xiph/rav1e/releases/download/v${version}/Cargo.lock";
+      sha256 = "1d51wcm537pzfmq48vsv87dwf035yl03qkfc0372gchpv079561w";
     };
 
-    nativeBuildInputs = [ unzip ];
-
     installPhase = ''
       mkdir -p $out
       cp -R ./* $out/
-      unzip ${cargoLock}
-      cp ./Cargo.lock $out/Cargo.lock
+      cp ${cargoLock} $out/Cargo.lock
     '';
   };
 
-  cargoSha256 = "1z0xrcq4mx6gpjyqh1csa424sxmx54z3x7ij3w2063h6s2fv9jy3";
+  cargoSha256 = "0frr4sx05pwvj9gmlvmis6lrnbwk3x579fv3kw38374jy33nrr6z";
 
   nativeBuildInputs = [ nasm ];
 
diff --git a/pkgs/tools/video/vncrec/default.nix b/pkgs/tools/video/vncrec/default.nix
index c09da3dd231..857524661bf 100644
--- a/pkgs/tools/video/vncrec/default.nix
+++ b/pkgs/tools/video/vncrec/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     "BINDIR=${placeholder "out"}/bin"
     "MANDIR=${placeholder "out"}/share/man"
   ];
-  installTargets = "install install.man";
+  installTargets = [ "install" "install.man" ];
 
   meta = {
     description = "VNC recorder";
diff --git a/pkgs/tools/video/yamdi/default.nix b/pkgs/tools/video/yamdi/default.nix
index 8fca318529f..b9b16e4d8ec 100644
--- a/pkgs/tools/video/yamdi/default.nix
+++ b/pkgs/tools/video/yamdi/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "4a6630f27f6c22bcd95982bf3357747d19f40bd98297a569e9c77468b756f715";
   };
 
-  buildFlags = "CC=cc";
+  buildFlags = [ "CC=cc" ];
 
   installPhase = ''
     install -D {,$out/bin/}yamdi