9 files changed, 24 insertions, 13 deletions
diff --git a/pkgs/tools/cd-dvd/cdrtools/default.nix b/pkgs/tools/cd-dvd/cdrtools/default.nix
index fa90ceb6161..68358a0c333 100644
--- a/pkgs/tools/cd-dvd/cdrtools/default.nix
+++ b/pkgs/tools/cd-dvd/cdrtools/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = false; # parallel building fails on some linux machines
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   meta = with lib; {
     homepage = "https://cdrtools.sourceforge.net/private/cdrecord.html";
     description = "Highly portable CD/DVD/BluRay command line recording software";
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 24f81d99da3..b48e2696f09 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gzip";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zl4D5Rn2N+H4FAEazjXE+HszwLur7sNbr1+9NHnpGVY=";
+    hash = "sha256-dFTraTXbF8ZlVXbC4bD6vv04tNCTbg+H9IzQYs6RoFc=";
   };
 
   outputs = [ "out" "man" "info" ];
diff --git a/pkgs/tools/graphics/blockhash/default.nix b/pkgs/tools/graphics/blockhash/default.nix
index 9d7b613bbe0..4f63cf90a3a 100644
--- a/pkgs/tools/graphics/blockhash/default.nix
+++ b/pkgs/tools/graphics/blockhash/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3, pkg-config, imagemagick, waf }:
+{ lib, stdenv, fetchFromGitHub, python3, pkg-config, imagemagick, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "blockhash";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x3lvhnkb4c3pyq6p81qnnqimz35wpippiac506dgjx3b1848v35";
   };
 
-  nativeBuildInputs = [ python3 pkg-config waf.hook ];
+  nativeBuildInputs = [ python3 pkg-config wafHook ];
   buildInputs = [ imagemagick ];
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/aardvark-dns/default.nix b/pkgs/tools/networking/aardvark-dns/default.nix
index 57888630cd0..59eb35cfe83 100644
--- a/pkgs/tools/networking/aardvark-dns/default.nix
+++ b/pkgs/tools/networking/aardvark-dns/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , nixosTests
 }:
 
@@ -17,9 +18,11 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-rrn+ZTAsFs7UTP4xQL3Cy8G6RG7vwT0wMKnXHHIkB90=";
 
-  checkFlags = [
-    # https://github.com/containers/aardvark-dns/issues/379
-    "--skip=test::test::tests::test_backend_network_scoped_custom_dns_server"
+  patches = [
+    (fetchpatch { # https://github.com/containers/aardvark-dns/issues/379
+      url = "https://github.com/containers/aardvark-dns/commit/b13f0434f410934b515f086334414c6f5f55096e.diff";
+      hash = "sha256-6XReIShEe8+WKc5jK5NzCNMEd4INdOn9Sf8UrQLbj+s=";
+    })
   ];
 
   passthru.tests = { inherit (nixosTests) podman; };
diff --git a/pkgs/tools/networking/ndn-tools/default.nix b/pkgs/tools/networking/ndn-tools/default.nix
index 01c05a5d1ac..1cbc6d403a9 100644
--- a/pkgs/tools/networking/ndn-tools/default.nix
+++ b/pkgs/tools/networking/ndn-tools/default.nix
@@ -7,7 +7,7 @@
 , openssl
 , pkg-config
 , sphinx
-, waf
+, wafHook
 }:
 
 stdenv.mkDerivation rec {
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
-  nativeBuildInputs = [ pkg-config sphinx waf.hook ];
+  nativeBuildInputs = [ pkg-config sphinx wafHook ];
   buildInputs = [ libpcap ndn-cxx openssl ];
 
   wafConfigureFlags = [
diff --git a/pkgs/tools/networking/saldl/default.nix b/pkgs/tools/networking/saldl/default.nix
index 7f37e61f511..d02acb3100a 100644
--- a/pkgs/tools/networking/saldl/default.nix
+++ b/pkgs/tools/networking/saldl/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchFromGitHub
 , pkg-config
-, waf
+, wafHook
 , python3
 , asciidoc
 , docbook_xml_dtd_45
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkg-config
-    waf.hook
+    wafHook
     python3
     asciidoc
     docbook_xml_dtd_45
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index b6ce17a80cc..1f135aecd85 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-7kCFzszhJYTmAPPYFKKPqCLfqs7B+UyEv9Z/ilVxpfQ=";
+    hash = "sha256-PalUkKhc/2Qg8m+uC4Skn1ES3xvxt/w0+HJPAggstxI=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -152,6 +152,7 @@ stdenv.mkDerivation rec {
   passthru.tests = {
     inherit gnutls;
     nixos-test = nixosTests.unbound;
+    nixos-test-exporter = nixosTests.prometheus-exporters.unbound;
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 9259c7e21f1..798c7cc918d 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -82,6 +82,8 @@ self = stdenv.mkDerivation {
 
   hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
 
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+
   nativeBuildInputs = [
     pkg-config
   ] ++ lib.optionals atLeast24 [
diff --git a/pkgs/tools/security/ncrack/default.nix b/pkgs/tools/security/ncrack/default.nix
index 9e9aeaa409d..4b0feccb412 100644
--- a/pkgs/tools/security/ncrack/default.nix
+++ b/pkgs/tools/security/ncrack/default.nix
@@ -21,6 +21,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Our version is good; the check is bad.
+  configureFlags = [ "--without-zlib-version-check" ];
+
   buildInputs = [ openssl zlib ];
 
   meta = with lib; {