summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/X11/opentabletdriver/default.nix152
-rw-r--r--pkgs/tools/X11/opentabletdriver/deps.nix462
-rw-r--r--pkgs/tools/X11/opentabletdriver/shell.nix12
-rwxr-xr-xpkgs/tools/X11/opentabletdriver/update.sh64
-rw-r--r--pkgs/tools/X11/xkb-switch-i3/default.nix34
-rw-r--r--pkgs/tools/X11/xwallpaper/default.nix3
-rw-r--r--pkgs/tools/admin/awscli/default.nix4
-rw-r--r--pkgs/tools/admin/azure-cli/default.nix5
-rw-r--r--pkgs/tools/admin/azure-cli/python-packages.nix20
-rw-r--r--pkgs/tools/admin/chamber/default.nix14
-rw-r--r--pkgs/tools/admin/clair/default.nix7
-rw-r--r--pkgs/tools/admin/credhub-cli/default.nix44
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix8
-rw-r--r--pkgs/tools/audio/aucdtect/default.nix33
-rw-r--r--pkgs/tools/audio/volctl/default.nix46
-rw-r--r--pkgs/tools/backup/borg/default.nix4
-rw-r--r--pkgs/tools/backup/duplicacy/default.nix4
-rw-r--r--pkgs/tools/backup/duplicacy/deps.nix188
-rw-r--r--pkgs/tools/backup/duplicity/default.nix4
-rw-r--r--pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch18
-rw-r--r--pkgs/tools/filesystems/android-file-transfer/default.nix6
-rw-r--r--pkgs/tools/graphics/directx-shader-compiler/default.nix4
-rw-r--r--pkgs/tools/graphics/jhead/default.nix5
-rw-r--r--pkgs/tools/misc/agedu/default.nix10
-rw-r--r--pkgs/tools/misc/barman/default.nix4
-rw-r--r--pkgs/tools/misc/broot/default.nix6
-rw-r--r--pkgs/tools/misc/calamares/default.nix17
-rw-r--r--pkgs/tools/misc/clac/default.nix15
-rw-r--r--pkgs/tools/misc/code-minimap/default.nix25
-rw-r--r--pkgs/tools/misc/fbcat/default.nix33
-rw-r--r--pkgs/tools/misc/hdf4/default.nix3
-rw-r--r--pkgs/tools/misc/html-proofer/Gemfile.lock4
-rw-r--r--pkgs/tools/misc/html-proofer/gemset.nix8
-rw-r--r--pkgs/tools/misc/kcollectd/default.nix56
-rw-r--r--pkgs/tools/misc/kermit/default.nix5
-rw-r--r--pkgs/tools/misc/nix-direnv/default.nix4
-rw-r--r--pkgs/tools/misc/picocom/default.nix48
-rw-r--r--pkgs/tools/misc/snapper/default.nix9
-rw-r--r--pkgs/tools/misc/toybox/default.nix2
-rw-r--r--pkgs/tools/misc/woof/default.nix25
-rw-r--r--pkgs/tools/misc/you-get/default.nix4
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/misc/z-lua/default.nix4
-rw-r--r--pkgs/tools/misc/zalgo/default.nix25
-rw-r--r--pkgs/tools/networking/cjdns/default.nix6
-rw-r--r--pkgs/tools/networking/fdm/default.nix20
-rw-r--r--pkgs/tools/networking/httpstat/default.nix4
-rw-r--r--pkgs/tools/networking/kapp/default.nix23
-rw-r--r--pkgs/tools/networking/libreswan/default.nix6
-rw-r--r--pkgs/tools/networking/openssh/default.nix3
-rw-r--r--pkgs/tools/networking/proxify/default.nix31
-rw-r--r--pkgs/tools/networking/qrcp/default.nix4
-rw-r--r--pkgs/tools/package-management/librepo/default.nix9
-rw-r--r--pkgs/tools/package-management/nix-update/default.nix4
-rw-r--r--pkgs/tools/package-management/protontricks/default.nix52
-rw-r--r--pkgs/tools/package-management/protontricks/steam-run.patch254
-rw-r--r--pkgs/tools/package-management/rpm/default.nix26
-rw-r--r--pkgs/tools/security/dnsx/default.nix31
-rw-r--r--pkgs/tools/security/enpass/data.json10
-rw-r--r--pkgs/tools/security/enpass/default.nix11
-rw-r--r--pkgs/tools/security/ffuf/default.nix34
-rw-r--r--pkgs/tools/security/gau/default.nix29
-rw-r--r--pkgs/tools/security/ghidra/default.nix28
-rw-r--r--pkgs/tools/security/gospider/default.nix33
-rw-r--r--pkgs/tools/security/httpx/default.nix30
-rw-r--r--pkgs/tools/security/naabu/default.nix38
-rw-r--r--pkgs/tools/security/nuclei/default.nix36
-rw-r--r--pkgs/tools/security/onlykey-cli/default.nix24
-rw-r--r--pkgs/tools/security/step-ca/default.nix30
-rw-r--r--pkgs/tools/security/step-ca/deps.nix291
-rw-r--r--pkgs/tools/security/step-cli/default.nix23
-rw-r--r--pkgs/tools/security/step-cli/deps.nix453
-rw-r--r--pkgs/tools/security/teler/default.nix33
-rw-r--r--pkgs/tools/security/wad/default.nix43
-rw-r--r--pkgs/tools/typesetting/bibclean/default.nix1
-rw-r--r--pkgs/tools/typesetting/lowdown/default.nix4
-rw-r--r--pkgs/tools/typesetting/tectonic/default.nix6
-rw-r--r--pkgs/tools/typesetting/tex/texlive/combine.nix4
-rw-r--r--pkgs/tools/virtualization/amazon-ecs-cli/default.nix6
79 files changed, 2010 insertions, 1082 deletions
diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
new file mode 100644
index 00000000000..6f8f9e44cc4
--- /dev/null
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -0,0 +1,152 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchurl
+, makeWrapper
+, linkFarmFromDrvs
+, dotnet-netcore
+, dotnet-sdk
+, dotnetPackages
+, dpkg
+, gtk3
+, libX11
+, libXrandr
+, libappindicator
+, libevdev
+, libnotify
+, udev
+, makeDesktopItem
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "OpenTabletDriver";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "InfinityGhost";
+    repo = "OpenTabletDriver";
+    rev = "v${version}";
+    sha256 = "048y7gjlk2yw4vh62px1d9w0va6ap1a0cndcpbirlyj9q6b8jxax";
+  };
+
+  debPkg = fetchurl {
+    url = "https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${version}/OpenTabletDriver.deb";
+    sha256 = "13gg0dhvjy88h9lhcrp30fjiwgb9dzjsgk1k760pi1ki71a5vz2r";
+  };
+
+  nativeBuildInputs = [
+    dotnet-sdk
+    dotnetPackages.Nuget
+    dpkg
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  nugetDeps = linkFarmFromDrvs "${pname}-nuget-deps" (import ./deps.nix {
+    fetchNuGet = { name, version, sha256 }: fetchurl {
+      name = "nuget-${name}-${version}.nupkg";
+      url = "https://www.nuget.org/api/v2/package/${name}/${version}";
+      inherit sha256;
+    };
+  });
+
+  runtimeDeps = [
+    gtk3
+    libX11
+    libXrandr
+    libappindicator
+    libevdev
+    libnotify
+    udev
+  ];
+
+  configurePhase = ''
+    export HOME=$(mktemp -d)
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+
+    nuget sources Add -Name nixos -Source "$PWD/nixos"
+    nuget init "$nugetDeps" "$PWD/nixos"
+
+    # FIXME: https://github.com/NuGet/Home/issues/4413
+    mkdir -p $HOME/.nuget/NuGet
+    cp $HOME/.config/NuGet/NuGet.Config $HOME/.nuget/NuGet
+
+    for project in OpenTabletDriver.{Console,Daemon,UX.Gtk}; do
+        dotnet restore --source "$PWD/nixos" $project
+    done
+  '';
+
+  buildPhase = ''
+    for project in OpenTabletDriver.{Console,Daemon,UX.Gtk}; do
+        dotnet build $project \
+            --no-restore \
+            --configuration Release \
+            --framework net5
+    done
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib/OpenTabletDriver/
+    cp -r ./OpenTabletDriver/Configurations/ $out/lib/OpenTabletDriver/
+
+    for project in OpenTabletDriver.{Console,Daemon,UX.Gtk}; do
+      dotnet publish $project \
+          --no-build \
+          --no-self-contained \
+          --configuration Release \
+          --framework net5 \
+          --output $out/lib
+    done
+
+    # Give a more "*nix" name to the binaries
+    makeWrapper $out/lib/OpenTabletDriver.Console $out/bin/otd \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
+
+    makeWrapper $out/lib/OpenTabletDriver.Daemon $out/bin/otd-daemon \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
+
+    makeWrapper $out/lib/OpenTabletDriver.UX.Gtk $out/bin/otd-gui \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+        --set DOTNET_ROOT "${dotnet-netcore}" \
+        --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}"
+
+    mkdir -p $out/share/{applications,pixmaps}
+
+    cp -r $src/OpenTabletDriver.UX/Assets/* $out/share/pixmaps
+
+    cp -r ${makeDesktopItem {
+      desktopName = "OpenTabletDriver";
+      name = "OpenTabletDriver";
+      exec = "otd-gui";
+      icon = "otd";
+      comment = meta.description;
+      type = "Application";
+      categories = "Utility;";
+    }}/share/applications/* $out/share/applications
+
+    # TODO: Ideally this should be build from OpenTabletDriver/OpenTabletDriver-udev instead
+    dpkg-deb --fsys-tarfile ${debPkg} | tar xf - ./usr/lib/udev/rules.d/30-opentabletdriver.rules
+    mkdir -p $out/lib/udev/rules.d
+    cp ./usr/lib/udev/rules.d/* $out/lib/udev/rules.d
+  '';
+
+  dontWrapGApps = true;
+  dontStrip = true;
+
+  meta = with lib; {
+    description = "Open source, cross-platform, user-mode tablet driver";
+    homepage = "https://github.com/InfinityGhost/OpenTabletDriver";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/X11/opentabletdriver/deps.nix b/pkgs/tools/X11/opentabletdriver/deps.nix
new file mode 100644
index 00000000000..34d2981cff5
--- /dev/null
+++ b/pkgs/tools/X11/opentabletdriver/deps.nix
@@ -0,0 +1,462 @@
+{ fetchNuGet }: [
+  (fetchNuGet {
+    name = "AtkSharp";
+    version = "3.22.25.74";
+    sha256 = "04zjpjrddw5clac0mjpk0q00rbmv45bh1bsqa4s3pc5pb7fm9cd9";
+  })
+  (fetchNuGet {
+    name = "CairoSharp";
+    version = "3.22.25.74";
+    sha256 = "0sx7vmwcrfbkg3g887v051iklcdmdhh43ndp96nk4bccjimmmwl6";
+  })
+  (fetchNuGet {
+    name = "Eto.Forms";
+    version = "2.5.6";
+    sha256 = "035ny8jlanchwq16gcq0xb6ywabjl71c7qbpv26sjwg96na8vz51";
+  })
+  (fetchNuGet {
+    name = "Eto.Platform.Gtk";
+    version = "2.5.6";
+    sha256 = "1ijkjd3lc7x59yk369kxipzgk1zhyr9g6k319wc0n033vij26mwl";
+  })
+  (fetchNuGet {
+    name = "GdkSharp";
+    version = "3.22.25.74";
+    sha256 = "07sdfvqk2jmyjj7fyd0mikhnzsk52zd3g2dhip8kz3006cczqm81";
+  })
+  (fetchNuGet {
+    name = "GioSharp";
+    version = "3.22.25.74";
+    sha256 = "01l4216bm5jxbxypkkq4d2527c6zd68kbywr3h1lr1darc9nf1d1";
+  })
+  (fetchNuGet {
+    name = "GLibSharp";
+    version = "3.22.25.74";
+    sha256 = "0k2p79z4wcswi528v0ykc37rsqfqi6xd6pl0j4csdj9zf19svgx2";
+  })
+  (fetchNuGet {
+    name = "GtkSharp";
+    version = "3.22.25.74";
+    sha256 = "0vazfvkjyzppcynqa1h70s1jmp4vq2j30v5x2scg8n2c5dxaj0k3";
+  })
+  (fetchNuGet {
+    name = "HidSharpCore";
+    version = "1.1.0";
+    sha256 = "122s5j3wrv8hcgnbxrnjqydvcfz7gdm8xq0wlwzrgwdjk44lr45a";
+  })
+  (fetchNuGet {
+    name = "MessagePack.Annotations";
+    version = "2.1.194";
+    sha256 = "1jkhq3hiy4brvzsywl4p4jb9jrnzs3vmgr3s8fxpb1dzafadw8b0";
+  })
+  (fetchNuGet {
+    name = "MessagePack";
+    version = "2.1.194";
+    sha256 = "1v2gyd9sd6hppfhlzngmzzhnpr39b95rwrqq0r9zzp480b6vzaj0";
+  })
+  (fetchNuGet {
+    name = "Microsoft.Bcl.AsyncInterfaces";
+    version = "1.1.1";
+    sha256 = "0a1ahssqds2ympr7s4xcxv5y8jgxs7ahd6ah6fbgglj4rki1f1vw";
+  })
+  (fetchNuGet {
+    name = "Microsoft.CSharp";
+    version = "4.4.1";
+    sha256 = "0z6d1i6xcf0c00z6rs75rgw4ncs9q2m8amasf6mmbf40fm02ry7g";
+  })
+  (fetchNuGet {
+    name = "Microsoft.NETCore.Platforms";
+    version = "1.1.0";
+    sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm";
+  })
+  (fetchNuGet {
+    name = "Microsoft.NETCore.Platforms";
+    version = "1.1.1";
+    sha256 = "164wycgng4mi9zqi2pnsf1pq6gccbqvw6ib916mqizgjmd8f44pj";
+  })
+  (fetchNuGet {
+    name = "Microsoft.NETCore.Platforms";
+    version = "3.0.0";
+    sha256 = "1bk8r4r3ihmi6322jmcag14jmw11mjqys202azqjzglcx59pxh51";
+  })
+  (fetchNuGet {
+    name = "Microsoft.NETCore.Targets";
+    version = "1.1.0";
+    sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh";
+  })
+  (fetchNuGet {
+    name = "Microsoft.VisualStudio.Threading.Analyzers";
+    version = "16.7.56";
+    sha256 = "04v9df0k7bsc0rzgkw4mnvi43pdrh42vk6xdcwn9m6im33m0nnz2";
+  })
+  (fetchNuGet {
+    name = "Microsoft.VisualStudio.Threading";
+    version = "16.7.56";
+    sha256 = "13x0xrsjxd86clf9cjjwmpzlyp8pkrf13riya7igs8zy93zw2qap";
+  })
+  (fetchNuGet {
+    name = "Microsoft.VisualStudio.Validation";
+    version = "15.5.31";
+    sha256 = "1ah99rn922qa0sd2k3h64m324f2r32pw8cn4cfihgvwx4qdrpmgw";
+  })
+  (fetchNuGet {
+    name = "Microsoft.Win32.Primitives";
+    version = "4.3.0";
+    sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq";
+  })
+  (fetchNuGet {
+    name = "Microsoft.Win32.Registry";
+    version = "4.6.0";
+    sha256 = "0i4y782yrqqyx85pg597m20gm0v126w0j9ddk5z7xb3crx4z9f2s";
+  })
+  (fetchNuGet {
+    name = "Nerdbank.Streams";
+    version = "2.6.77";
+    sha256 = "13dnfwxa8syx7vfjmd5pcrqz31k0q8y3mmh6yz6bmljhjri65q5c";
+  })
+  (fetchNuGet {
+    name = "Newtonsoft.Json";
+    version = "12.0.2";
+    sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5";
+  })
+  (fetchNuGet {
+    name = "Newtonsoft.Json";
+    version = "12.0.3";
+    sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x";
+  })
+  (fetchNuGet {
+    name = "PangoSharp";
+    version = "3.22.25.74";
+    sha256 = "172i1hjpz4rgqlilir8a57kgmciw9x0shz4zwbhhlr59mndvqbih";
+  })
+  (fetchNuGet {
+    name = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "0rwpqngkqiapqc5c2cpkj7idhngrgss5qpnqg0yh40mbyflcxf8i";
+  })
+  (fetchNuGet {
+    name = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "1n06gxwlinhs0w7s8a94r1q3lwqzvynxwd3mp10ws9bg6gck8n4r";
+  })
+  (fetchNuGet {
+    name = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "0404wqrc7f2yc0wxv71y3nnybvqx8v4j9d47hlscxy759a525mc3";
+  })
+  (fetchNuGet {
+    name = "runtime.native.System.Net.Http";
+    version = "4.3.0";
+    sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk";
+  })
+  (fetchNuGet {
+    name = "runtime.native.System.Security.Cryptography.Apple";
+    version = "4.3.0";
+    sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q";
+  })
+  (fetchNuGet {
+    name = "runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "0zy5r25jppz48i2bkg8b9lfig24xixg6nm3xyr1379zdnqnpm8f6";
+  })
+  (fetchNuGet {
+    name = "runtime.native.System";
+    version = "4.3.0";
+    sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4";
+  })
+  (fetchNuGet {
+    name = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "096ch4n4s8k82xga80lfmpimpzahd2ip1mgwdqgar0ywbbl6x438";
+  })
+  (fetchNuGet {
+    name = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "1dm8fifl7rf1gy7lnwln78ch4rw54g0pl5g1c189vawavll7p6rj";
+  })
+  (fetchNuGet {
+    name = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple";
+    version = "4.3.0";
+    sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi";
+  })
+  (fetchNuGet {
+    name = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "1m9z1k9kzva9n9kwinqxl97x2vgl79qhqjlv17k9s2ymcyv2bwr6";
+  })
+  (fetchNuGet {
+    name = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "1cpx56mcfxz7cpn57wvj18sjisvzq8b5vd9rw16ihd2i6mcp3wa1";
+  })
+  (fetchNuGet {
+    name = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "15gsm1a8jdmgmf8j5v1slfz8ks124nfdhk2vxs2rw3asrxalg8hi";
+  })
+  (fetchNuGet {
+    name = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "0q0n5q1r1wnqmr5i5idsrd9ywl33k0js4pngkwq9p368mbxp8x1w";
+  })
+  (fetchNuGet {
+    name = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl";
+    version = "4.3.2";
+    sha256 = "1x0g58pbpjrmj2x2qw17rdwwnrcl0wvim2hdwz48lixvwvp22n9c";
+  })
+  (fetchNuGet {
+    name = "StreamJsonRpc";
+    version = "2.6.121";
+    sha256 = "0xzvpk17w2skndzdg47j7gkrrvw6521db4mv8lc3v8hm97vs9m76";
+  })
+  (fetchNuGet {
+    name = "System.Collections.Concurrent";
+    version = "4.3.0";
+    sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8";
+  })
+  (fetchNuGet {
+    name = "System.Collections.Immutable";
+    version = "1.7.1";
+    sha256 = "1nh4nlxfc7lbnbl86wwk1a3jwl6myz5j6hvgh5sp4krim9901hsq";
+  })
+  (fetchNuGet {
+    name = "System.Collections";
+    version = "4.3.0";
+    sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9";
+  })
+  (fetchNuGet {
+    name = "System.CommandLine";
+    version = "2.0.0-beta1.20253.1";
+    sha256 = "16saf1fm9q80bb624fkqz0ksrwpnbw9617d7xg3jib7a2wgagm2r";
+  })
+  (fetchNuGet {
+    name = "System.CommandLine";
+    version = "2.0.0-beta1.20303.1";
+    sha256 = "0isnz8ipqlqim06hf56zlaq2vnsy5facvf5nvq6kzm5h1dm3l2vn";
+  })
+  (fetchNuGet {
+    name = "System.ComponentModel.Annotations";
+    version = "4.7.0";
+    sha256 = "06x1m46ddxj0ng28d7gry9gjkqdg2kp89jyf480g5gznyybbs49z";
+  })
+  (fetchNuGet {
+    name = "System.Diagnostics.Debug";
+    version = "4.3.0";
+    sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y";
+  })
+  (fetchNuGet {
+    name = "System.Diagnostics.DiagnosticSource";
+    version = "4.3.0";
+    sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq";
+  })
+  (fetchNuGet {
+    name = "System.Diagnostics.Tracing";
+    version = "4.3.0";
+    sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4";
+  })
+  (fetchNuGet {
+    name = "System.Globalization.Calendars";
+    version = "4.3.0";
+    sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq";
+  })
+  (fetchNuGet {
+    name = "System.Globalization.Extensions";
+    version = "4.3.0";
+    sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls";
+  })
+  (fetchNuGet {
+    name = "System.Globalization";
+    version = "4.3.0";
+    sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki";
+  })
+  (fetchNuGet {
+    name = "System.IO.FileSystem.Primitives";
+    version = "4.3.0";
+    sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c";
+  })
+  (fetchNuGet {
+    name = "System.IO.FileSystem";
+    version = "4.3.0";
+    sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw";
+  })
+  (fetchNuGet {
+    name = "System.IO.Pipelines";
+    version = "4.7.2";
+    sha256 = "16v4qaypm72cfsfqr8z3k6yrpzn0m3apgkh6aljfwpycdk150sf9";
+  })
+  (fetchNuGet {
+    name = "System.IO";
+    version = "4.3.0";
+    sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f";
+  })
+  (fetchNuGet {
+    name = "System.Linq";
+    version = "4.3.0";
+    sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7";
+  })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.3";
+    sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a";
+  })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.4";
+    sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y";
+  })
+  (fetchNuGet {
+    name = "System.Net.Http";
+    version = "4.3.4";
+    sha256 = "0kdp31b8819v88l719j6my0yas6myv9d1viql3qz5577mv819jhl";
+  })
+  (fetchNuGet {
+    name = "System.Net.Primitives";
+    version = "4.3.0";
+    sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii";
+  })
+  (fetchNuGet {
+    name = "System.Net.WebSockets";
+    version = "4.3.0";
+    sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p";
+  })
+  (fetchNuGet {
+    name = "System.Numerics.Vectors";
+    version = "4.5.0";
+    sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59";
+  })
+  (fetchNuGet {
+    name = "System.Reflection.Emit.Lightweight";
+    version = "4.6.0";
+    sha256 = "0hry2k6b7kicg4zxnq0hhn0ys52711pxy7l9v5sp7gvp9cicwpgp";
+  })
+  (fetchNuGet {
+    name = "System.Reflection.Emit";
+    version = "4.7.0";
+    sha256 = "121l1z2ypwg02yz84dy6gr82phpys0njk7yask3sihgy214w43qp";
+  })
+  (fetchNuGet {
+    name = "System.Reflection.Primitives";
+    version = "4.3.0";
+    sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276";
+  })
+  (fetchNuGet {
+    name = "System.Reflection";
+    version = "4.3.0";
+    sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m";
+  })
+  (fetchNuGet {
+    name = "System.Resources.ResourceManager";
+    version = "4.3.0";
+    sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.CompilerServices.Unsafe";
+    version = "4.5.2";
+    sha256 = "1vz4275fjij8inf31np78hw50al8nqkngk04p3xv5n4fcmf1grgi";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.CompilerServices.Unsafe";
+    version = "4.7.1";
+    sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.Extensions";
+    version = "4.3.0";
+    sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.Handles";
+    version = "4.3.0";
+    sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.InteropServices";
+    version = "4.3.0";
+    sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j";
+  })
+  (fetchNuGet {
+    name = "System.Runtime.Numerics";
+    version = "4.3.0";
+    sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z";
+  })
+  (fetchNuGet {
+    name = "System.Runtime";
+    version = "4.3.0";
+    sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7";
+  })
+  (fetchNuGet {
+    name = "System.Security.AccessControl";
+    version = "4.6.0";
+    sha256 = "1wl1dyghi0qhpap1vgfhg2ybdyyhy9vc2a7dpm1xb30vfgmlkjmf";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Algorithms";
+    version = "4.3.0";
+    sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Cng";
+    version = "4.3.0";
+    sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Csp";
+    version = "4.3.0";
+    sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Encoding";
+    version = "4.3.0";
+    sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.OpenSsl";
+    version = "4.3.0";
+    sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Primitives";
+    version = "4.3.0";
+    sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby";
+  })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.X509Certificates";
+    version = "4.3.0";
+    sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h";
+  })
+  (fetchNuGet {
+    name = "System.Security.Principal.Windows";
+    version = "4.6.0";
+    sha256 = "1jmfzfz1n8hp63s5lja5xxpzkinbp6g59l3km9h8avjiisdrg5wm";
+  })
+  (fetchNuGet {
+    name = "System.Text.Encoding";
+    version = "4.3.0";
+    sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr";
+  })
+  (fetchNuGet {
+    name = "System.Threading.Tasks.Dataflow";
+    version = "4.11.1";
+    sha256 = "09fbfsiay1xcbpvnq2j38b6mb2scvf0s8mpn78bcqsldidg7k2vw";
+  })
+  (fetchNuGet {
+    name = "System.Threading.Tasks.Extensions";
+    version = "4.5.4";
+    sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153";
+  })
+  (fetchNuGet {
+    name = "System.Threading.Tasks";
+    version = "4.3.0";
+    sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7";
+  })
+  (fetchNuGet {
+    name = "System.Threading";
+    version = "4.3.0";
+    sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34";
+  })
+  (fetchNuGet {
+    name = "WaylandNET";
+    version = "0.2.0";
+    sha256 = "1qjpvra08vdqdw4j1gamz6451x5sd5r1j86lsvrl8akq4nymfr8k";
+  })
+]
diff --git a/pkgs/tools/X11/opentabletdriver/shell.nix b/pkgs/tools/X11/opentabletdriver/shell.nix
new file mode 100644
index 00000000000..526fa4a4432
--- /dev/null
+++ b/pkgs/tools/X11/opentabletdriver/shell.nix
@@ -0,0 +1,12 @@
+{ pkgs ? import ../../../../. {} }:
+
+with pkgs;
+
+mkShell {
+  buildInputs = [
+    common-updater-scripts
+    curl
+    dotnetCorePackages.sdk_5_0
+    jq
+  ];
+}
diff --git a/pkgs/tools/X11/opentabletdriver/update.sh b/pkgs/tools/X11/opentabletdriver/update.sh
new file mode 100755
index 00000000000..04fae30c05a
--- /dev/null
+++ b/pkgs/tools/X11/opentabletdriver/update.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env nix-shell
+#!nix-shell shell.nix -i bash
+
+set -eo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+deps_file="$(realpath "./deps.nix")"
+
+new_version="$(curl -s "https://api.github.com/repos/InfinityGhost/OpenTabletDriver/releases" | jq -r '.[0].tag_name' | sed 's|[^0-9.]||g')"
+old_version="$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)"
+if [[ "$new_version" == "$old_version" ]]; then
+  echo "Up to date"
+  [[ "${1}" != "--force" ]] && exit 0
+fi
+
+cd ../../../..
+update-source-version opentabletdriver "$new_version"
+store_src="$(nix-build . -A opentabletdriver.src --no-out-link)"
+src="$(mktemp -d /tmp/opentabletdriver-src.XXX)"
+echo "Temp src dir: $src"
+cp -rT "$store_src" "$src"
+chmod -R +w "$src"
+
+pushd "$src"
+
+# Setup empty nuget package folder to force reinstall.
+mkdir ./nuget_tmp.packages
+cat >./nuget_tmp.config <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <config>
+    <add key="globalPackagesFolder" value="$(realpath ./nuget_tmp.packages)" />
+  </config>
+</configuration>
+EOF
+
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+
+for project in OpenTabletDriver.{Console,Daemon,UX.Gtk}; do
+    dotnet restore $project --configfile ./nuget_tmp.config
+done
+
+echo "{ fetchNuGet }: [" >"$deps_file"
+while read pkg_spec; do
+  { read pkg_name; read pkg_version; } < <(
+    # Build version part should be ignored: `3.0.0-beta2.20059.3+77df2220` -> `3.0.0-beta2.20059.3`
+    sed -nE 's/.*<id>([^<]*).*/\1/p; s/.*<version>([^<+]*).*/\1/p' "$pkg_spec")
+  pkg_sha256="$(nix-hash --type sha256 --flat --base32 "$(dirname "$pkg_spec")"/*.nupkg)"
+  cat >>"$deps_file" <<EOF
+  (fetchNuGet {
+    name = "$pkg_name";
+    version = "$pkg_version";
+    sha256 = "$pkg_sha256";
+  })
+EOF
+done < <(find ./nuget_tmp.packages -name '*.nuspec' | sort)
+echo "]" >>"$deps_file"
+
+popd
+rm -r "$src"
diff --git a/pkgs/tools/X11/xkb-switch-i3/default.nix b/pkgs/tools/X11/xkb-switch-i3/default.nix
new file mode 100644
index 00000000000..9485cb62b2b
--- /dev/null
+++ b/pkgs/tools/X11/xkb-switch-i3/default.nix
@@ -0,0 +1,34 @@
+{ stdenv
+, cmake
+, fetchFromGitHub
+, i3
+, jsoncpp
+, libsigcxx
+, libX11
+, libxkbfile
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "xkb-switch-i3";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "Zebradil";
+    repo = "xkb-switch-i3";
+    rev = version;
+    sha256 = "15c19hp0n1k3w15qn97j6wp5b8hbk0mq6x3xjfn6dkkjfz1fl6cn";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ i3 jsoncpp libsigcxx libX11 libxkbfile ];
+
+  meta = with stdenv.lib; {
+    description = "Switch your X keyboard layouts from the command line(i3 edition)";
+    homepage = "https://github.com/Zebradil/xkb-switch-i3";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ewok ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/X11/xwallpaper/default.nix b/pkgs/tools/X11/xwallpaper/default.nix
index 759613553fe..aab4d1180e0 100644
--- a/pkgs/tools/X11/xwallpaper/default.nix
+++ b/pkgs/tools/X11/xwallpaper/default.nix
@@ -5,6 +5,7 @@
 , pixman
 , xcbutil
 , xcbutilimage
+, libseccomp
 , libjpeg
 , libpng
 , libXpm
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
   preConfigure = "./autogen.sh";
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ pixman xcbutilimage xcbutil libjpeg libpng libXpm ];
+  buildInputs = [ pixman xcbutilimage xcbutil libseccomp libjpeg libpng libXpm ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/stoeckmann/xwallpaper";
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 3dd63148e84..2d995e6c181 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.18.202"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.206"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nlgqIzFELlg8Ck3HCXBx/LDzlM9p2CGKOgA2vS+r2y0=";
+    sha256 = "sha256-+BEiIuhZ0L8WXNN0hkOMVH2eTojyAiuj3zahuiGkx7I=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 59b22f48f99..4026effd6f6 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -1,12 +1,12 @@
 { stdenv, lib, python3, fetchFromGitHub, installShellFiles }:
 
 let
-  version = "2.16.0";
+  version = "2.17.0";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    sha256 = "wuHPNpt5pizgAwxRxJpRBiX6keJpKRpHu6M5BpFUyeY=";
+    sha256 = "2QLPtZYZZ+W5xZH2hxFnjox31v3My3zocouqLWGWSYI=";
   };
 
   # put packages that needs to be overriden in the py package scope
@@ -67,6 +67,7 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
     azure-mgmt-containerregistry
     azure-mgmt-containerservice
     azure-mgmt-cosmosdb
+    azure-mgmt-databoxedge
     azure-mgmt-datalake-analytics
     azure-mgmt-datalake-store
     azure-mgmt-datamigration
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index f5f661c8e9b..ab417af8d44 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -125,8 +125,8 @@ let
         '';
       };
 
-      azure-batch = overrideAzureMgmtPackage super.azure-batch "9.0.0" "zip"
-        "112d73gxjqng348mcvi36ska6pxyg8qc3qswvhf5x4a0lr86zjj7";
+      azure-batch = overrideAzureMgmtPackage super.azure-batch "10.0.0" "zip"
+        "83d7a2b0be42ca456ac2b56fa3dc6ce704c130e888d37d924072c1d3718f32d0";
 
       azure-mgmt-apimanagement = overrideAzureMgmtPackage super.azure-mgmt-apimanagement "0.2.0" "zip"
         "0whx3s8ri9939r3pdvjf8iqcslas1xy6cnccidmp10r5ng0023vr";
@@ -158,8 +158,8 @@ let
       azure-mgmt-cognitiveservices = overrideAzureMgmtPackage super.azure-mgmt-cognitiveservices "6.3.0" "zip"
         "059lhbxqx1r1717s8xz5ahpxwphq5fgy0h7k6b63cahm818rs0hx";
 
-      azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "14.0.0" "zip"
-        "0bvqv56plcgmnfyj0apphlbsn2vfm1a22idvy8y5npbfjz4zwja9";
+      azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "18.0.0" "zip"
+        "34815c91193640ad8ff0c4dad7f2d997548c853d2e8b10250329ed516e55879e";
 
       azure-mgmt-consumption = overrideAzureMgmtPackage super.azure-mgmt-consumption "2.0.0" "zip"
         "12ai4qps73ivawh0yzvgb148ksx02r30pqlvfihx497j62gsi1cs";
@@ -206,8 +206,8 @@ let
       azure-mgmt-loganalytics = overrideAzureMgmtPackage super.azure-mgmt-loganalytics "0.7.0" "zip"
         "18n2lqvrhq40gdqhlzzg8mc03571i02c7qq7jv771lc58rqpzysh";
 
-      azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "13.0.0" "zip"
-        "02ac54fs4wqdwy986j9qyx6fbl5zmpkh1sykr9r6mqk1xx9l4jq8";
+      azure-mgmt-network = overrideAzureMgmtPackage super.azure-mgmt-network "17.0.0" "zip"
+        "3694f2675e152afccb1588a6cc7bb4b4795d442a4e5d7082cdf1f4e32a779199";
 
       azure-mgmt-media = overrideAzureMgmtPackage super.azure-mgmt-media "2.1.0" "zip"
         "1py0hch0wghzfxazdrrs7p0kln2zn9jh3fmkzwd2z8qggj38q6gm";
@@ -230,8 +230,8 @@ let
       azure-mgmt-search = overrideAzureMgmtPackage super.azure-mgmt-search "2.0.0" "zip"
         "14v8ja8har2xrb00v98610pqvakcdvnzw8hkd6wbr1np3f3dxi8f";
 
-      azure-mgmt-security = overrideAzureMgmtPackage super.azure-mgmt-security "0.4.1" "zip"
-        "08gf401d40bd1kn9wmpxcjxqdh84cd9hxm8rdjd0918483sqs71r";
+      azure-mgmt-security = overrideAzureMgmtPackage super.azure-mgmt-security "0.6.0" "zip"
+        "9f37d0151d730801222af111f0830905634795dbfd59ad1b89c35197421e74d3";
 
       azure-mgmt-signalr = overrideAzureMgmtPackage super.azure-mgmt-signalr "0.4.0" "zip"
         "09n12ligh301z4xwixl50n8f1rgd2k6lpsxqzr6n6jvgkpdds0v5";
@@ -260,8 +260,8 @@ let
       azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "5.2.0" "zip"
         "10b8y1b5qlyr666x7yimnwis9386ciphrxdnmmyzk90qg6h0niry";
 
-      azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc15" "zip"
-        "1fnmdl3m7kdn6c2ws5vrm7nwadcbq9mgc6g5bg4s1a4xjb23q6vb";
+      azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "3.0.0rc16" "zip"
+        "eT5gH0K4q2Qr1lEpuqjxQhOUrA6bEsAktj+PKsfMXTo=";
 
       azure-mgmt-monitor = overrideAzureMgmtPackage super.azure-mgmt-monitor "0.11.0" "zip"
         "05jhn66d4sl1qi6w34rqd8wl500jndismiwhdmzzmprdvn1zxqf6";
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 7a80ed37188..c2126181f36 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -1,15 +1,23 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{ buildGoModule, lib, fetchFromGitHub, fetchpatch }:
+
 buildGoModule rec {
   pname = "chamber";
-  version = "2.8.2";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7L9RaE4LvHRR6MUimze5QpbnfasWJdY4arfS/Usy2q0=";
+    sha256 = "eOMY9P/fCYvnl6KGNb6wohykLA0Sj9Ti0L18gx5dqUk=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/segmentio/chamber/commit/3aeb416cdf4c232552b653262e37047fc13b1f02.patch";
+      sha256 = "cyxNF9ZP4oG+1sfX9yWZCyntpAvwYUh5BzTirZQGejc=";
+    })
+  ];
+
   vendorSha256 = null;
 
   # set the version. see: chamber's Makefile
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 565196280ce..cbe6e3eed1f 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "2.1.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1bvwh3ghxb3ynq8a07ka9i0rzaqg1aikxvqxmpjkwjvhwk63lwqd";
+    sha256 = "10kgg2i5yzdfhylrdkmh8rsc4cgdnhcgfa8fa4dm8m3licjciwam";
   };
 
-  vendorSha256 = "0x31n50vd8660z816as6kms5dkv87b0mhblccpkvd9cbvcv2n37a";
+  vendorSha256 = "1l3b86f5xmyc6lskvb4ab30adcgzb69ayccc0wcz2f28sda3i80r";
 
   doCheck = false;
 
@@ -25,6 +25,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Vulnerability Static Analysis for Containers";
     homepage = "https://github.com/quay/clair";
+    changelog = "https://github.com/quay/clair/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ marsam ];
   };
diff --git a/pkgs/tools/admin/credhub-cli/default.nix b/pkgs/tools/admin/credhub-cli/default.nix
new file mode 100644
index 00000000000..f3cc5141618
--- /dev/null
+++ b/pkgs/tools/admin/credhub-cli/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "credhub-cli";
+  version = "2.9.0";
+
+  src = fetchFromGitHub {
+    owner = "cloudfoundry-incubator";
+    repo = "credhub-cli";
+    rev = version;
+    sha256 = "1j0i0b79ph2i52cj0qln8wvp6gwhl73akkn026h27vvmlw9sndc2";
+  };
+
+  # these tests require network access that we're not going to give them
+  postPatch = ''
+    rm commands/api_test.go
+    rm commands/socks5_test.go
+  '';
+  __darwinAllowLocalNetworking = true;
+
+  vendorSha256 = null;
+
+  buildFlagsArray = [
+    "-ldflags="
+    "-s"
+    "-w"
+    "-X code.cloudfoundry.org/credhub-cli/version.Version=${version}"
+  ];
+
+  postInstall = ''
+    ln -s $out/bin/credhub-cli $out/bin/credhub
+  '';
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Provides a command line interface to interact with CredHub servers";
+    homepage = "https://github.com/cloudfoundry-incubator/credhub-cli";
+    maintainers = with maintainers; [ ris ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 29592451734..b2148fafe28 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -21,18 +21,18 @@ let
   sources = name: system: {
     x86_64-darwin = {
       url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
-      sha256 = "0kldvy63gba5k6ymybnggw3q3rlav1gcbpxiwnv6670lk5qzqdsw";
+      sha256 = "1miqvh2b3mxrrr63q8f5i944mp3rz6685ckmnk5fml2wyc273jiv";
     };
 
     x86_64-linux = {
       url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
-      sha256 = "1ifl4skwqhkapfwhymyz7v4jpwpd01n4x3956w5ci8c3zvw8l118";
+      sha256 = "15kfsxn6j37rsw97ixj7ixkzcby0pkgc5xj7cpqdq975ym58sgv7";
     };
   }.${system};
 
 in stdenv.mkDerivation rec {
   pname = "google-cloud-sdk";
-  version = "319.0.0";
+  version = "321.0.0";
 
   src = fetchurl (sources "${pname}-${version}" stdenv.hostPlatform.system);
 
@@ -99,7 +99,7 @@ in stdenv.mkDerivation rec {
     # This package contains vendored dependencies. All have free licenses.
     license = licenses.free;
     homepage = "https://cloud.google.com/sdk/";
-    maintainers = with maintainers; [ pradyuman stephenmw zimbatm ];
+    maintainers = with maintainers; [ iammrinal0 pradyuman stephenmw zimbatm ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/tools/audio/aucdtect/default.nix b/pkgs/tools/audio/aucdtect/default.nix
deleted file mode 100644
index ad9d5fb8690..00000000000
--- a/pkgs/tools/audio/aucdtect/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ stdenv, fetchurl, lib, rpmextract }:
-
-with lib;
-
-stdenv.mkDerivation rec {
-  pname = "aucdtect";
-  version = "0.8-2";
-
-  src = fetchurl {
-    url = "http://www.true-audio.com/ftp/${pname}-${version}.i586.rpm";
-    sha256 = "1lp5f0rq5b5n5il0c64m00gcfskarvgqslpryms9443d200y6mmd";
-  };
-
-  unpackCmd = "${rpmextract}/bin/rpmextract $src";
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 local/bin/auCDtect $out/bin/aucdtect
-
-    runHook postInstall
-  '';
-
-  dontStrip = true;
-
-  meta = with stdenv.lib; {
-    description = "Verify authenticity of lossless audio files";
-    homepage = "http://tausoft.org";
-    license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/tools/audio/volctl/default.nix b/pkgs/tools/audio/volctl/default.nix
index 2a55015be10..1965fb08316 100644
--- a/pkgs/tools/audio/volctl/default.nix
+++ b/pkgs/tools/audio/volctl/default.nix
@@ -1,43 +1,49 @@
-{ stdenv, fetchFromGitHub, python3, libpulseaudio, glib, gtk3, gobject-introspection, wrapGAppsHook }:
+{ stdenv, python3Packages, fetchFromGitHub, wrapGAppsHook, gobject-introspection, libpulseaudio, glib, gtk3, pango, xorg }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "volctl";
-  version = "0.6.3";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "buzz";
     repo = pname;
-    rev = version;
-    sha256 = "0rppqc5wiqxd83z2mgvhi6gdx7yhy9wnav1dbbi1wvm7lzw6fnil";
+    rev = "v${version}";
+    sha256 = "02scfscf4mdrphzrd7cbwbhpig9bhvaws8qk4zc81z8vvf3mcfv2";
   };
 
+  postPatch = ''
+    substituteInPlace volctl/lib/xwrappers.py \
+      --replace 'libXfixes.so' "${xorg.libXfixes}/lib/libXfixes.so" \
+      --replace 'libXfixes.so.3' "${xorg.libXfixes}/lib/libXfixes.so.3"
+  '';
+
+  preBuild = ''
+    export LD_LIBRARY_PATH=${libpulseaudio}/lib
+  '';
+
   nativeBuildInputs = [
     gobject-introspection
     wrapGAppsHook
   ];
 
-  buildInputs = [
-    glib
-    gtk3
-    libpulseaudio
-  ];
-
-  pythonPath = with python3.pkgs; [
+  propagatedBuildInputs = [ pango gtk3 ] ++ (with python3Packages; [
+    click
+    pycairo
     pygobject3
-  ];
+    pyyaml
+  ]);
 
+  # with strictDeps importing "gi.repository.Gtk" fails with "gi.RepositoryError: Typelib file for namespace 'Pango', version '1.0' not found"
   strictDeps = false;
 
-  preBuild = ''
-    export LD_LIBRARY_PATH=${libpulseaudio}/lib
-  '';
+  # no tests included
+  doCheck = false;
+
+  pythonImportsCheck = [ "volctl" ];
 
   preFixup = ''
     glib-compile-schemas ${glib.makeSchemaPath "$out" "${pname}-${version}"}
-
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "${libpulseaudio}/lib"
-    )
+    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${libpulseaudio}/lib")
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 7bfb9e57392..f7d9896431c 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,11 +2,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.1.14";
+  version = "1.1.15";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1fpdj73cgp96xwasdcifxl7q2pr1my2f4vfdjpv771llri3hgfvx";
+    sha256 = "1g62sdzcw3zx4ccky125ciwnzx6z9kwyvskvp7ijmqxqk3nrxjs9";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/backup/duplicacy/default.nix b/pkgs/tools/backup/duplicacy/default.nix
index b261289f0bf..9fecfb70f39 100644
--- a/pkgs/tools/backup/duplicacy/default.nix
+++ b/pkgs/tools/backup/duplicacy/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "duplicacy";
-  version = "2.3.0";
+  version = "2.7.2";
 
   goPackagePath = "github.com/gilbertchen/duplicacy";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "gilbertchen";
     repo = "duplicacy";
     rev = "v${version}";
-    sha256 = "12swp3kbwkmwn3g2mp964m60kabmz0ip7kkhvhiqq7k74nxzj312";
+    sha256 = "0j37sqicj7rl982czqsl3ipxw7k8k4smcr63s0yklxwz7ch3353c";
   };
   goDeps = ./deps.nix;
   buildPhase = ''
diff --git a/pkgs/tools/backup/duplicacy/deps.nix b/pkgs/tools/backup/duplicacy/deps.nix
index 12d30b53b6c..e7bf7e91f89 100644
--- a/pkgs/tools/backup/duplicacy/deps.nix
+++ b/pkgs/tools/backup/duplicacy/deps.nix
@@ -4,27 +4,18 @@
     goPackagePath  = "cloud.google.com/go";
     fetch = {
       type = "git";
-      url = "https://code.googlesource.com/gocloud";
+      url = "https://github.com/googleapis/google-cloud-go";
       rev =  "2d3a6656c17a60b0815b7e06ab0be04eacb6e613";
       sha256 = "0fi3qj9fvc4bxbrwa1m5sxsb8yhvawiwigaddvmmizjykxbq5csq";
     };
   }
   {
-    goPackagePath  = "github.com/Azure/azure-sdk-for-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-sdk-for-go";
-      rev =  "b7fadebe0e7f5c5720986080a01495bd8d27be37";
-      sha256 = "11zcmd17206byxhgz2a75qascilydlzjbz73l2mrqng3yyr20yk1";
-    };
-  }
-  {
     goPackagePath  = "github.com/Azure/go-autorest";
     fetch = {
       type = "git";
       url = "https://github.com/Azure/go-autorest";
-      rev =  "0ae36a9e544696de46fdadb7b0d5fb38af48c063";
-      sha256 = "0f2qcv24l9bx3jys2m9ycyy77vqlx7dbfa3frxlk19wnrwiv3p6g";
+      rev =  "9bc4033dd347c7f416fca46b2f42a043dc1fbdf6";
+      sha256 = "158xbd8wn1bna1k1ichlirz6a1zvlh3rg7klr9cnp72l2q8jwvcl";
     };
   }
   {
@@ -41,8 +32,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/aws/aws-sdk-go";
-      rev =  "a32b1dcd091264b5dee7b386149b6cc3823395c9";
-      sha256 = "1yicb7l6m4hs3mi724hz74wn8305qvx6g73mjqafaaqvh6dyn86m";
+      rev =  "851d5ffb66720c2540cc68020d4d8708950686c8";
+      sha256 = "16qp8ywcf04d2y1ibf3mpglcrxk07x8gak46a2l53lchps2mgcrp";
     };
   }
   {
@@ -59,8 +50,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/dgrijalva/jwt-go";
-      rev =  "dbeaa9332f19a944acb5736b4456cfcc02140e29";
-      sha256 = "0zk6l6kzsjdijfn7c4h0aywdjx5j2hjwi67vy1k6wr46hc8ks2hs";
+      rev =  "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e";
+      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
     };
   }
   {
@@ -68,8 +59,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/gilbertchen/azure-sdk-for-go";
-      rev =  "bbf89bd4d716c184f158d1e1428c2dbef4a18307";
-      sha256 = "14563izc2y05k8s20fmhanvjydbcq8k5adp4cgw91d9bs52qivx7";
+      rev =  "8fd4663cab7c7c1c46d00449291c92ad23b0d0d9";
+      sha256 = "123fj5jni1pjj8i9adzd4r07n9hnlmfprlcjf5hqb1zjb72xi1p7";
     };
   }
   {
@@ -86,8 +77,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/gilbertchen/go-dropbox";
-      rev =  "90711b603312b1f973f3a5da3793ac4f1e5c2f2a";
-      sha256 = "0y2ydl3mjbkfbqyygrwq7vqig9hjh7cxvzsn2gxc1851haqp4h19";
+      rev =  "2233fa1dd846b3a3e8060b6c1ea12883deb9d288";
+      sha256 = "01fqxad5mm7rs0mp1ipp9aw80ski6sqyqljpf9dgify8dbiffl97";
     };
   }
   {
@@ -145,12 +136,12 @@
     };
   }
   {
-    goPackagePath  = "github.com/go-ini/ini";
+    goPackagePath  = "github.com/golang/groupcache";
     fetch = {
       type = "git";
-      url = "https://github.com/go-ini/ini";
-      rev =  "32e4c1e6bc4e7d0d8451aa6b75200d19e37a536a";
-      sha256 = "0mhgxw5q6b0pryhikx3k4wby7g32rwjjljzihi47lwn34kw5y1qn";
+      url = "https://github.com/golang/groupcache";
+      rev =  "8c9f03a8e57eb486e42badaed3fb287da51807ba";
+      sha256 = "0vjjr79r32icjzlb05wn02k59av7jx0rn1jijml8r4whlg7dnkfh";
     };
   }
   {
@@ -158,8 +149,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/protobuf";
-      rev =  "1e59b77b52bf8e4b449a57e6f79f21226d571845";
-      sha256 = "19bkh81wnp6njg3931wky6hsnnl2d1ig20vfjxpv450sd3k6yys8";
+      rev =  "84668698ea25b64748563aa20726db66a6b8d299";
+      sha256 = "1gkd1942vk9n8kfzdwy1iil6wgvlwjq7a3y5jc49ck4lz9rhmgkq";
     };
   }
   {
@@ -167,8 +158,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/googleapis/gax-go";
-      rev =  "317e0006254c44a0ac427cc52a0e083ff0b9622f";
-      sha256 = "0h92x579vbrv2fka8q2ddy1kq6a63qbqa8zc09ygl6skzn9gw1dh";
+      rev =  "c8a15bac9b9fe955bd9f900272f9a306465d28cf";
+      sha256 = "13x3x7agq0b46wpchbd2sqli5l33z6hvfn1qjbiqvsgpbv7wd140";
     };
   }
   {
@@ -176,8 +167,26 @@
     fetch = {
       type = "git";
       url = "https://github.com/jmespath/go-jmespath";
-      rev =  "0b12d6b5";
-      sha256 = "1vv6hph8j6xgv7gwl9vvhlsaaqsm22sxxqmgmldi4v11783pc1ld";
+      rev =  "c2b33e84";
+      sha256 = "1r6w7ydx8ydryxk3sfhzsk8m6f1nsik9jg3i1zhi69v4kfl4d5cz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/klauspost/cpuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/cpuid";
+      rev =  "750c0591dbbd50ef88371c665ad49e426a4b830b";
+      sha256 = "1yiby4xa12j3kcw5q7dfsbcybhaxjkppvgz6ac2p2lcwha303b1g";
+    };
+  }
+  {
+    goPackagePath  = "github.com/klauspost/reedsolomon";
+    fetch = {
+      type = "git";
+      url = "https://github.com/klauspost/reedsolomon";
+      rev =  "7daa20bf74337a939c54f892a2eca9d9b578eb7f";
+      sha256 = "1xk4wqgrl63l95lqnszzbpa06apzxfmpwfnkrn1n8jb0ws7mi01m";
     };
   }
   {
@@ -185,8 +194,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/kr/fs";
-      rev =  "2788f0dbd16903de03cb8186e5c7d97b69ad387b";
-      sha256 = "1c0fipl4rsh0v5liq1ska1dl83v3llab4k6lm8mvrx9c4dyp71ly";
+      rev =  "1455def202f6e05b95cc7bfc7e8ae67ae5141eba";
+      sha256 = "11zg176x9hr9q7fsk95r6q0wf214gg4czy02slax4x56n79g6a7q";
     };
   }
   {
@@ -208,12 +217,30 @@
     };
   }
   {
+    goPackagePath  = "github.com/minio/highwayhash";
+    fetch = {
+      type = "git";
+      url = "https://github.com/minio/highwayhash";
+      rev =  "86a2a969d04373bf05ca722517d30fb1c9a3e4f9";
+      sha256 = "0kj2hs82sphag0h25xvprvf2fz3zlinmlif89sk9jp8h518aiahf";
+    };
+  }
+  {
+    goPackagePath  = "github.com/mmcloughlin/avo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mmcloughlin/avo";
+      rev =  "443f81d771042b019379ae4bfcd0a591cb47c88a";
+      sha256 = "1zc95crbyi7ylqq3jwv4ya55lyzn9x730szdm307vdss4gqlx8yn";
+    };
+  }
+  {
     goPackagePath  = "github.com/ncw/swift";
     fetch = {
       type = "git";
       url = "https://github.com/ncw/swift";
-      rev =  "ae9f0ea1605b9aa6434ed5c731ca35d83ba67c55";
-      sha256 = "0a0iwynhgxsl3czabl7ajnxpyw6x0dzbiqz6il8aw7kn10ld1rvl";
+      rev =  "3e1a09f21340e4828e7265aa89f4dc1495fa7ccc";
+      sha256 = "19gb8xh400hzlbdp3nx1f85jxzs36zk0py39vmjcg3fnvdjzblm2";
     };
   }
   {
@@ -221,8 +248,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/pkg/errors";
-      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+      rev =  "614d223910a179a466c1767a985424175c39b465";
+      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
     };
   }
   {
@@ -230,8 +257,17 @@
     fetch = {
       type = "git";
       url = "https://github.com/pkg/sftp";
-      rev =  "3edd153f213d8d4191a0ee4577c61cca19436632";
-      sha256 = "0iw6lijdljwh5xw5hsy0b578cr52h6vvm7hbnzlrvciwhh4sfhhp";
+      rev =  "5616182052227b951e76d9c9b79a616c608bd91b";
+      sha256 = "1rjlhlkr505a0wvync1ycfn9njfc6bib6bw44qnnm50hlfs59hz2";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pkg/xattr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/xattr";
+      rev =  "dd870b5cfebab49617ea0c1da6176474e8a52bf4";
+      sha256 = "11ynkc61qrmf853g04sav8vawz8i6a8b73w71f3cq4djb4cnsw0d";
     };
   }
   {
@@ -253,12 +289,30 @@
     };
   }
   {
+    goPackagePath  = "go.opencensus.io";
+    fetch = {
+      type = "git";
+      url = "https://github.com/census-instrumentation/opencensus-go";
+      rev =  "d835ff86be02193d324330acdb7d65546b05f814";
+      sha256 = "0xj16iq5jp26hi2py7lsd8cvqh651fgn39y05gzvjdi88d9xd3nw";
+    };
+  }
+  {
     goPackagePath  = "golang.org/x/crypto";
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev =  "9f005a07e0d31d45e6656d241bb5c0f2efd4bc94";
-      sha256 = "1mhmr6ljzl3iafsz4qy8vval7rmr828wh59dlqqqjqx6sqmcs1dv";
+      rev =  "056763e48d71961566155f089ac0f02f1dda9b5a";
+      sha256 = "0dcmns62hwid7hk4bmpl22z6ygjh168p23x3arzy320sd1lvap92";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/mod";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/mod";
+      rev =  "859b3ef565e237f9f1a0fb6b55385c497545680d";
+      sha256 = "0ldgbx2zpprbsfn6p8pfgs4nn87gwbfcv2z0fa7n8alwsq2yw78q";
     };
   }
   {
@@ -266,8 +320,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev =  "9dfe39835686865bff950a07b394c12a98ddc811";
-      sha256 = "0z8mnl4mi88syafrgqys2ak2gg3yrbna25hpz88y3anl8x4jhg1a";
+      rev =  "d3edc9973b7eb1fb302b0ff2c62357091cea9a30";
+      sha256 = "12zbjwcsh9b0lwycqlkrnbyg5a6a9dzgj8hhgq399bdda5bd97y7";
     };
   }
   {
@@ -275,8 +329,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/oauth2";
-      rev =  "f95fa95eaa936d9d87489b15d1d18b97c1ba9c28";
-      sha256 = "0p9kis69wvhv8a2qbcjxvn9ggpdh81cbfjpq5pjga7n8k6d065fh";
+      rev =  "bf48bf16ab8d622ce64ec6ce98d2c98f916b6303";
+      sha256 = "1sirdib60zwmh93kf9qrx51r8544k1p9rs5mk0797wibz3m4mrdg";
     };
   }
   {
@@ -284,8 +338,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev =  "82aafbf43bf885069dc71b7e7c2f9d7a614d47da";
-      sha256 = "1jvngpvy0q40f7krkgmwf5bbjzhv449297awcr0y78kzn0cyawi2";
+      rev =  "59c9f1ba88faf592b225274f69c5ef1e4ebacf82";
+      sha256 = "014iiqjh9sikbcvacqiwhg6mvrsrr1va91wmc9yrnsm11c63yxfa";
     };
   }
   {
@@ -293,17 +347,35 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/text";
-      rev =  "88f656faf3f37f690df1a32515b479415e1a6769";
-      sha256 = "0zakmgg6dlwnkhignwjajn0dckzqq18zxvnmmg0fq6455x7fs673";
+      rev =  "342b2e1fbaa52c93f31447ad2c6abc048c63e475";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev =  "5d1fdd8fa3469142b9369713b23d8413d6d83189";
+      sha256 = "0xp5ggnjnl1gqwi2ks042zimgkfv2qda9a57ar198xpyzdn1bv5s";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev =  "5ec99f83aff198f5fbd629d6c8d8eb38a04218ca";
+      sha256 = "1dbzc3gmf2haazpv7cgmv97rq40g2xzwbglc17vas8dwhgwgwrzb";
     };
   }
   {
     goPackagePath  = "google.golang.org/api";
     fetch = {
       type = "git";
-      url = "https://code.googlesource.com/google-api-go-client";
-      rev =  "17b5f22a248d6d3913171c1a557552ace0d9c806";
-      sha256 = "0gs78qsxfg89kpiiray1x9jiv6bh328jmjkwd3ghnygf3l98kc8c";
+      url = "https://github.com/googleapis/google-api-go-client";
+      rev =  "52f0532eadbcc6f6b82d6f5edf66e610d10bfde6";
+      sha256 = "0l7q0mmq0v51wc72bk50nwaz9frl1pqp7gn5jhy1vzxdry930gkc";
     };
   }
   {
@@ -311,17 +383,17 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/appengine";
-      rev =  "150dc57a1b433e64154302bdc40b6bb8aefa313a";
-      sha256 = "0w3knznv39k8bm85ri62f83czcrxknql7dv6p9hk1a5jx3xljgxq";
+      rev =  "971852bfffca25b069c31162ae8f247a3dba083b";
+      sha256 = "05hbq4cs7bqw0zl17bx8rzdkszid3nyl92100scg3jjrg70dhm7w";
     };
   }
   {
     goPackagePath  = "google.golang.org/genproto";
     fetch = {
       type = "git";
-      url = "https://github.com/google/go-genproto";
-      rev =  "891aceb7c239e72692819142dfca057bdcbfcb96";
-      sha256 = "1axim84fqzsp6iialk6zl4fsbfpx658vssc6ccakn4yy1xc9h854";
+      url = "https://github.com/googleapis/go-genproto";
+      rev =  "baae70f3302d3efdff74db41e48a5d476d036906";
+      sha256 = "1xacik4i5w2bpkrxzrfm00ggy5vygbzh8jmm2yq4mxiv0lnsh9nk";
     };
   }
   {
@@ -329,8 +401,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/grpc/grpc-go";
-      rev =  "5a9f7b402fe85096d2e1d0383435ee1876e863d0";
-      sha256 = "1hlirgvmzb929jpb1dvh930646ih5ffg3b6pmlilqr7ffdkl5z3j";
+      rev =  "ac54eec90516cee50fc6b9b113b34628a85f976f";
+      sha256 = "17zfx4xgqjamk7rc1sivm5gppkh3j4qp3i294w9rqbv0rqi0c9pq";
     };
   }
 ]
\ No newline at end of file
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 1f62834e4d1..c29af7b2fd4 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -19,11 +19,11 @@ let
 in
 pythonPackages.buildPythonApplication rec {
   pname = "duplicity";
-  version = "0.8.13";
+  version = "0.8.15";
 
   src = fetchurl {
     url = "https://code.launchpad.net/duplicity/${majorMinor version}-series/${majorMinorPatch version}/+download/duplicity-${version}.tar.gz";
-    sha256 = "0lflg1ay4q4w9qzpmh6y2hza4fc3ig12q44qkd80ks17hj21bxa6";
+    sha256 = "1kg467mxg5a97v1rlv4shk32krgv8ys4nczq4b11av4bp1lgysdc";
   };
 
   patches = [
diff --git a/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch b/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
index a3ba1422915..c02527cf394 100644
--- a/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
+++ b/pkgs/tools/backup/duplicity/use-installed-scripts-in-test.patch
@@ -38,12 +38,12 @@
          # """ERROR 2
 --- a/testing/functional/test_rdiffdir.py
 +++ b/testing/functional/test_rdiffdir.py
-@@ -38,7 +38,7 @@ class RdiffdirTest(FunctionalTestCase):
- 
-     def run_rdiffdir(self, argstring):
-         u"""Run rdiffdir with given arguments"""
--        self.run_cmd(u"../bin/rdiffdir " + argstring)
-+        self.run_cmd(u"rdiffdir " + argstring)
- 
-     def run_cycle(self, dirname_list):
-         u"""Run diff/patch cycle on directories in dirname_list"""
+@@ -42,7 +42,7 @@ class RdiffdirTest(FunctionalTestCase):
+         basepython = os.environ.get(u'TOXPYTHON', None)
+         if basepython is not None:
+             cmd_list.extend([basepython])
+-        cmd_list.extend([u"../bin/rdiffdir"])
++        cmd_list.extend([u"rdiffdir"])
+         cmd_list.extend(argstring.split())
+         cmdline = u" ".join([u'"%s"' % x for x in cmd_list])
+         self.run_cmd(cmdline)
diff --git a/pkgs/tools/filesystems/android-file-transfer/default.nix b/pkgs/tools/filesystems/android-file-transfer/default.nix
index d9ae2cb7461..b52099bdeab 100644
--- a/pkgs/tools/filesystems/android-file-transfer/default.nix
+++ b/pkgs/tools/filesystems/android-file-transfer/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "android-file-transfer";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "whoozle";
     repo = "android-file-transfer-linux";
     rev = "v${version}";
-    sha256 = "0xmnwxr649wdzsa1vf3spl387hxs4pq0rldyrsr9hz43da4v081k";
+    sha256 = "125rq8ji83nw6chfw43i0h9c38hjqh1qjibb0gnf9wrigar9zc8b";
   };
 
   nativeBuildInputs = [ cmake readline pkgconfig ];
@@ -17,7 +17,7 @@ mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Reliable MTP client with minimalistic UI";
     homepage = "https://whoozle.github.io/android-file-transfer-linux/";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Plus;
     maintainers = [ maintainers.xaverdh ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/graphics/directx-shader-compiler/default.nix b/pkgs/tools/graphics/directx-shader-compiler/default.nix
index 13665b77646..4e74d2c443f 100644
--- a/pkgs/tools/graphics/directx-shader-compiler/default.nix
+++ b/pkgs/tools/graphics/directx-shader-compiler/default.nix
@@ -36,14 +36,14 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin $out/lib $dev/include
     mv bin/dxc* $out/bin/
-    mv lib/libdxcompiler.so* $out/lib/
+    mv lib/libdxcompiler.so* lib/libdxcompiler.*dylib $out/lib/
     cp -r $src/include/dxc $dev/include/
   '';
 
   meta = with stdenv.lib; {
     description = "A compiler to compile HLSL programs into DXIL and SPIR-V";
     homepage = "https://github.com/microsoft/DirectXShaderCompiler";
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
     license = licenses.ncsa;
     maintainers = with maintainers; [ expipiplus1 ];
   };
diff --git a/pkgs/tools/graphics/jhead/default.nix b/pkgs/tools/graphics/jhead/default.nix
index 19a0e26d9cc..1d3696a8cd2 100644
--- a/pkgs/tools/graphics/jhead/default.nix
+++ b/pkgs/tools/graphics/jhead/default.nix
@@ -43,5 +43,10 @@ stdenv.mkDerivation rec {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ rycee ];
     platforms = platforms.all;
+    # https://github.com/NixOS/nixpkgs/issues/90828
+    knownVulnerabilities = [
+      "CVE-2020-6624"
+      "CVE-2020-6625"
+    ];
   };
 }
diff --git a/pkgs/tools/misc/agedu/default.nix b/pkgs/tools/misc/agedu/default.nix
index c9bad789ad2..3cdfa36337f 100644
--- a/pkgs/tools/misc/agedu/default.nix
+++ b/pkgs/tools/misc/agedu/default.nix
@@ -1,15 +1,17 @@
 {stdenv, fetchgit, autoreconfHook, halibut}:
 let
-  date = "20200206";
-  rev = "963bc9d";
+  date = "20200705";
+  rev = "2a7d4a2";
 in
 stdenv.mkDerivation {
-  name = "agedu-${date}.${rev}";
+  pname = "agedu";
+  version = "${date}.${rev}";
+
   # upstream provides tarballs but it seems they disappear after the next version is released
   src = fetchgit {
     url = "https://git.tartarus.org/simon/agedu.git";
     inherit rev;
-    sha256 = "1jmvgg2v6aqgbgpxbndrdhgfhlglrq4yv4sdbjaj6bsz9fb8lqhc";
+    sha256 = "gRNscl/vhBoZaHFCs9JjDBHDRoEpILJLtiI4YV+K/b4=";
   };
 
   nativeBuildInputs = [autoreconfHook halibut];
diff --git a/pkgs/tools/misc/barman/default.nix b/pkgs/tools/misc/barman/default.nix
index 2105ad0ae01..da79110f9a8 100644
--- a/pkgs/tools/misc/barman/default.nix
+++ b/pkgs/tools/misc/barman/default.nix
@@ -4,12 +4,12 @@
 
 buildPythonApplication rec {
   pname = "barman";
-  version = "2.11";
+  version = "2.12";
 
   outputs = [ "out" "man" ];
   src = fetchurl {
     url = "mirror://sourceforge/pgbarman/${version}/barman-${version}.tar.gz";
-    sha256 = "0w5lh4aavab9ynfy2mq09ga6j4vss4k0vlc3g6f5a9i4175g9pmr";
+    sha256 = "Ts8I6tlP2GRp90OIIKXy+cRWWvUO3Sm86zq2dtVP5YE=";
   };
 
   propagatedBuildInputs = [ dateutil argh psycopg2 boto3 argcomplete ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index fb8e2508294..e4561c38228 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.0.8";
+  version = "1.1.10";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "06881c8qnh917y2mn5q5qlf86idz17xi2dapsad3m1zbdr53c25j";
+    sha256 = "04nidx43w4nnccgbrw30wg9ai8p7hbklxpn1gc6gr2325yhqvwhl";
   };
 
-  cargoSha256 = "1k5qm4h028172r7i2pz5l8886qviy7ni83qxn10a8d5hsgalarvx";
+  cargoHash = "sha256-4F9HIQ1BQx4EikyH0DwlDAkYIeUJJbMsj7ZX23QD+K8=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index 815129f7f0f..a671090460e 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -6,16 +6,17 @@
 
 mkDerivation rec {
   pname = "calamares";
-  version = "3.2.17.1";
+  version = "3.2.35.1";
 
   # release including submodule
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "156zpjyw8w4y23aa60mvg3d3mr0kzfq5jkl7ixgahq33zpc17ms8";
+    sha256 = "s2wnwcdrcJLG5NhugSkntBCYfPuv3T/9+PclbmK0BJ4=";
   };
 
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [
-    boost cmake extra-cmake-modules kparts.dev kpmcore.out kservice.dev
+    boost kparts.dev kpmcore.out kservice.dev
     libatasmart libxcb libyamlcpp parted polkit-qt python qtbase
     qtquickcontrols qtsvg qttools qtwebengine.dev util-linux
   ];
@@ -32,18 +33,14 @@ mkDerivation rec {
 
   POLKITQT-1_POLICY_FILES_INSTALL_DIR = "$(out)/share/polkit-1/actions";
 
-  patchPhase = ''
+  postPatch = ''
     sed -e "s,/usr/bin/calamares,$out/bin/calamares," \
         -i calamares.desktop \
         -i com.github.calamares.calamares.policy
 
     sed -e 's,/usr/share/zoneinfo,${tzdata}/share/zoneinfo,' \
-        -i src/modules/locale/timezonewidget/localeconst.h \
         -i src/modules/locale/SetTimezoneJob.cpp
 
-    sed -e 's,/usr/share/i18n/locales,${glibc.out}/share/i18n/locales,' \
-        -i src/modules/locale/timezonewidget/localeconst.h
-
     sed -e 's,/usr/share/X11/xkb/rules/base.lst,${xkeyboard_config}/share/X11/xkb/rules/base.lst,' \
         -i src/modules/keyboard/keyboardwidget/keyboardglobal.h
 
@@ -56,8 +53,8 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "Distribution-independent installer framework";
-    license = licenses.gpl3;
-    maintainers = with lib.maintainers; [ manveru ];
+    license = with licenses; [ gpl3Plus bsd2 ];
+    maintainers = with maintainers; [ manveru ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/clac/default.nix b/pkgs/tools/misc/clac/default.nix
index 8aea37ebddf..8d6e464e9bb 100644
--- a/pkgs/tools/misc/clac/default.nix
+++ b/pkgs/tools/misc/clac/default.nix
@@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub }:
+
 stdenv.mkDerivation rec {
   pname = "clac";
-  version = "0.0.0.20170503";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "soveran";
     repo = "clac";
-    rev = "e92bd5cbab0d694cef945e3478820c9505e06f04";
-    sha256 = "0j8p1npgq32s377c9lw959h5i2csq4yb27cvg7av17bji46816bv";
+    rev = version;
+    sha256 = "rsag8MWl/udwXC0Gj864fAuQ6ts1gzrN2N/zelazqjE=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
@@ -17,12 +18,12 @@ stdenv.mkDerivation rec {
     cp README* LICENSE "$out/share/doc/${pname}"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     inherit version;
     description = "Interactive stack-based calculator";
-    license = stdenv.lib.licenses.bsd2;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.unix;
     homepage = "https://github.com/soveran/clac";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/code-minimap/default.nix b/pkgs/tools/misc/code-minimap/default.nix
new file mode 100644
index 00000000000..8c43e2b903c
--- /dev/null
+++ b/pkgs/tools/misc/code-minimap/default.nix
@@ -0,0 +1,25 @@
+{ stdenv
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "code-minimap";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "wfxr";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "03azqy4i15kfpd0gzjaw2di9xva4xdf95yb65b93z3y9y5wy4krc";
+  };
+
+  cargoSha256 = "1rxrdavj07i7qa5rf1i3aj7zdcp7c6lrg8yiy75r6lm4g98izzww";
+
+  meta = with stdenv.lib; {
+    description = "A high performance code minimap render";
+    homepage = "https://github.com/wfxr/code-minimap";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ bsima ];
+  };
+}
diff --git a/pkgs/tools/misc/fbcat/default.nix b/pkgs/tools/misc/fbcat/default.nix
new file mode 100644
index 00000000000..4f640f13a27
--- /dev/null
+++ b/pkgs/tools/misc/fbcat/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub } :
+
+stdenv.mkDerivation rec {
+  pname = "fbcat";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "jwilk";
+    repo = pname;
+    rev = version;
+    sha256 = "08y79br4a4cgkjnslw0hw57441ybsapaw7wjdbak19mv9lnl5ll9";
+  };
+
+  # hardcoded because makefile target "install" depends on libxslt dependencies from network
+  # that are just too hard to monkeypatch here
+  # so this is the simple fix.
+  installPhase = ''
+    mkdir -p $out
+    install -d $out/bin
+    install -m755 fbcat $out/bin/
+    install -m755 fbgrab $out/bin/
+    install -d $out/share/man/man1
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://jwilk.net/software/fbcat";
+    description = "Framebuffer screenshot tool";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.matthiasbeyer ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/tools/misc/hdf4/default.nix b/pkgs/tools/misc/hdf4/default.nix
index 5e5154111dc..b15eba8b7bc 100644
--- a/pkgs/tools/misc/hdf4/default.nix
+++ b/pkgs/tools/misc/hdf4/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , fetchpatch
 , fetchurl
+, fixDarwinDylibNames
 , cmake
 , libjpeg
 , zlib
@@ -17,6 +18,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
   ];
 
   buildInputs = [
diff --git a/pkgs/tools/misc/html-proofer/Gemfile.lock b/pkgs/tools/misc/html-proofer/Gemfile.lock
index 13c630718b1..ce75c4e7fd8 100644
--- a/pkgs/tools/misc/html-proofer/Gemfile.lock
+++ b/pkgs/tools/misc/html-proofer/Gemfile.lock
@@ -5,8 +5,8 @@ GEM
       public_suffix (>= 2.0.2, < 5.0)
     ethon (0.12.0)
       ffi (>= 1.3.0)
-    ffi (1.13.1)
-    html-proofer (3.18.2)
+    ffi (1.14.2)
+    html-proofer (3.18.3)
       addressable (~> 2.3)
       mercenary (~> 0.3)
       nokogumbo (~> 2.0)
diff --git a/pkgs/tools/misc/html-proofer/gemset.nix b/pkgs/tools/misc/html-proofer/gemset.nix
index 49f7726fc8b..da26cc347fe 100644
--- a/pkgs/tools/misc/html-proofer/gemset.nix
+++ b/pkgs/tools/misc/html-proofer/gemset.nix
@@ -26,10 +26,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
+      sha256 = "15hgiy09i8ywjihyzyvjvk42ivi3kmy6dm21s5sgg9j7y3h3zkkx";
       type = "gem";
     };
-    version = "1.13.1";
+    version = "1.14.2";
   };
   html-proofer = {
     dependencies = ["addressable" "mercenary" "nokogumbo" "parallel" "rainbow" "typhoeus" "yell"];
@@ -37,10 +37,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06vbbm8qdmw4955522zh9wqn2214ajsf70y0vymxgl7dlwjd2pz0";
+      sha256 = "0l0nkk0px6bc4g3xwc1c5fyi0c3n8sgl1zy94vqdzllfmkjvfggc";
       type = "gem";
     };
-    version = "3.18.2";
+    version = "3.18.3";
   };
   mercenary = {
     groups = ["default"];
diff --git a/pkgs/tools/misc/kcollectd/default.nix b/pkgs/tools/misc/kcollectd/default.nix
new file mode 100644
index 00000000000..ffc64b1455a
--- /dev/null
+++ b/pkgs/tools/misc/kcollectd/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, fetchFromGitLab
+, mkDerivation
+, qtbase
+, cmake
+, kconfig
+, kio
+, kiconthemes
+, kxmlgui
+, ki18n
+, kguiaddons
+, extra-cmake-modules
+, boost
+, shared-mime-info
+, rrdtool
+, breeze-icons
+}:
+
+mkDerivation rec {
+  pname = "kcollectd";
+  version = "0.11.99.0";
+  src = fetchFromGitLab {
+    owner = "aerusso";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0h4ymvzihzbmyv3z0bp28g94wxc6c7lgi3my0xbka3advxr811gn";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    shared-mime-info
+  ];
+
+  buildInputs = [
+    qtbase
+    kconfig
+    kio
+    kxmlgui
+    kiconthemes
+    ki18n
+    kguiaddons
+    boost
+    rrdtool
+    # otherwise some buttons are blank
+    breeze-icons
+  ];
+
+  meta = with lib; {
+    description = "A graphical frontend to collectd";
+    homepage = "https://www.antonioerusso.com/projects/kcollectd/";
+    maintainers = [ maintainers.symphorien ];
+    license = [ lib.licenses.gpl3Plus ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/kermit/default.nix b/pkgs/tools/misc/kermit/default.nix
index f81d9b7266b..2155b8676be 100644
--- a/pkgs/tools/misc/kermit/default.nix
+++ b/pkgs/tools/misc/kermit/default.nix
@@ -16,12 +16,12 @@ stdenv.mkDerivation {
     tar xvzf $src
   '';
 
-  patchPhase = ''
+  postPatch = ''
     sed -i -e 's@-I/usr/include/ncurses@@' \
       -e 's@/usr/local@'"$out"@ makefile
   '';
 
-  buildPhase = "make -f makefile linux LNKFLAGS='-lcrypt -lresolv'";
+  buildPhase = "make -f makefile linux KFLAGS='-D_IO_file_flags' LNKFLAGS='-lcrypt -lresolv'";
 
   installPhase = ''
     mkdir -p $out/bin
@@ -35,6 +35,5 @@ stdenv.mkDerivation {
     license = licenses.bsd3;
     maintainers = with maintainers; [ pSub ];
     platforms = with platforms; linux;
-    broken = true;
   };
 }
diff --git a/pkgs/tools/misc/nix-direnv/default.nix b/pkgs/tools/misc/nix-direnv/default.nix
index 11cb0dcf554..392de7d1bd9 100644
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-direnv";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = version;
-    sha256 = "sha256-xMz6e0OLeB3eltGrLV3Hew0lMjH5LSgqJ1l7JT2Ho/M=";
+    sha256 = "sha256-/mlM1EeUlr1nTUJ5rB41idzk3Mfy/htjjPUARYDFpb0=";
   };
 
   # Substitute instead of wrapping because the resulting file is
diff --git a/pkgs/tools/misc/picocom/default.nix b/pkgs/tools/misc/picocom/default.nix
index 5dd83c4887b..1db8d00a902 100644
--- a/pkgs/tools/misc/picocom/default.nix
+++ b/pkgs/tools/misc/picocom/default.nix
@@ -1,36 +1,48 @@
-{ stdenv, fetchFromGitHub, makeWrapper, lrzsz, IOKit }:
-
-assert stdenv.isDarwin -> IOKit != null;
-
-with stdenv.lib;
+{ stdenv
+, fetchFromGitHub
+, installShellFiles
+, lrzsz
+, IOKit
+}:
 
 stdenv.mkDerivation rec {
   pname = "picocom";
-  version = "3.1";
+  # last tagged release is 3.1 but 3.2 is still considered a release
+  version = "3.2a";
 
+  # upstream is quiet as the original author is no longer active since March 2018
   src = fetchFromGitHub {
     owner = "npat-efault";
     repo = "picocom";
-    rev = version;
-    sha256 = "1vvjydqf0ax47nvdyyl67jafw5b3sfsav00xid6qpgia1gs2r72n";
+    rev = "1acf1ddabaf3576b4023c4f6f09c5a3e4b086fb8";
+    sha256 = "sha256-cs2bxqZfTbnY5d+VJ257C5hssaFvYup3tBKz68ROnAo=";
   };
 
-  buildInputs = [ makeWrapper ]
-    ++ optionals stdenv.isDarwin [ IOKit ];
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace '.picocom_history' '.cache/picocom_history'
 
-  installPhase = ''
-    mkdir -p $out/bin $out/share/man/man1
-    cp picocom $out/bin
-    cp picocom.1 $out/share/man/man1
+    substituteInPlace picocom.c \
+      --replace '"rz -vv"' '"${lrzsz}/bin/rz -vv"' \
+      --replace '"sz -vv"' '"${lrzsz}/bin/sz -vv"'
+  '';
 
-    wrapProgram $out/bin/picocom \
-      --prefix PATH ":" "${lrzsz}/bin"
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = stdenv.lib.optional stdenv.isDarwin IOKit;
+
+  installPhase = ''
+    install -Dm555 -t $out/bin picocom
+    installManPage picocom.1
+    installShellCompletion --bash bash_completion/picocom
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Minimal dumb-terminal emulation program";
     homepage = "https://github.com/npat-efault/picocom/";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/snapper/default.nix b/pkgs/tools/misc/snapper/default.nix
index 177580c099b..3843f16f6a8 100644
--- a/pkgs/tools/misc/snapper/default.nix
+++ b/pkgs/tools/misc/snapper/default.nix
@@ -1,17 +1,18 @@
 { stdenv, fetchFromGitHub
 , autoreconfHook, pkgconfig, docbook_xsl, libxslt, docbook_xml_dtd_45
 , acl, attr, boost, btrfs-progs, dbus, diffutils, e2fsprogs, libxml2
-, lvm2, pam, python, util-linux, fetchpatch, json_c, nixosTests }:
+, lvm2, pam, python, util-linux, fetchpatch, json_c, nixosTests
+, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "snapper";
-  version = "0.8.14";
+  version = "0.8.15";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "snapper";
     rev = "v${version}";
-    sha256 = "1q687bjwy668klxnhsrc2rlhisa59j8bhmh1jw220rq7z0hm2khr";
+    sha256 = "1rqv1qfxr02qbkix1mpx91s4827irxryxkhby3ii0fdkm3ympsas";
   };
 
   nativeBuildInputs = [
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     acl attr boost btrfs-progs dbus diffutils e2fsprogs libxml2
-    lvm2 pam python util-linux json_c
+    lvm2 pam python util-linux json_c ncurses
   ];
 
   passthru.tests.snapper = nixosTests.snapper;
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index 9b38db5a727..e7a08877e90 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -1,5 +1,6 @@
 {
   stdenv, lib, fetchFromGitHub, which,
+  buildPackages,
   enableStatic ? false,
   enableMinimal ? false,
   extraConfig ? ""
@@ -16,6 +17,7 @@ stdenv.mkDerivation rec {
     sha256 = "0cgbmv6qk1haj709hjx5q4sl7wgh91i459gzs1203adwc7rvk6jv";
   };
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # needed for cross
   buildInputs = lib.optionals enableStatic [ stdenv.cc.libc stdenv.cc.libc.static ];
 
   postPatch = "patchShebangs .";
diff --git a/pkgs/tools/misc/woof/default.nix b/pkgs/tools/misc/woof/default.nix
index e89ef8dab0e..158a83a99ca 100644
--- a/pkgs/tools/misc/woof/default.nix
+++ b/pkgs/tools/misc/woof/default.nix
@@ -1,24 +1,25 @@
-{ stdenv, fetchurl, python }:
+{ stdenv, fetchFromGitHub, python3 }:
 
 stdenv.mkDerivation rec {
-  version = "2012-05-31";
+  version = "2020-12-17";
   pname = "woof";
 
-  src = fetchurl {
-    url = "http://www.home.unix-ag.org/simon/woof-${version}.py";
-    sha256 = "d84353d07f768321a1921a67193510bf292cf0213295e8c7689176f32e945572";
+  src = fetchFromGitHub {
+    owner = "simon-budig";
+    repo = "woof";
+    rev = "4aab9bca5b80379522ab0bdc5a07e4d652c375c5";
+    sha256 = "0ypd2fs8isv6bqmlrdl2djgs5lnk91y1c3rn4ar6sfkpsqp9krjn";
   };
 
-  buildInputs = [ python ];
+  propagatedBuildInputs = [ python3 ];
 
   dontUnpack = true;
 
-  installPhase =
-    ''
-      mkdir -p $out/bin
-      cp $src $out/bin/woof
-      chmod +x $out/bin/woof
-    '';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/woof $out/bin/woof
+    chmod +x $out/bin/woof
+  '';
 
   meta = with stdenv.lib; {
     homepage = "http://www.home.unix-ag.org/simon/woof.html";
diff --git a/pkgs/tools/misc/you-get/default.nix b/pkgs/tools/misc/you-get/default.nix
index 053d2ae59d2..6a13c455fe0 100644
--- a/pkgs/tools/misc/you-get/default.nix
+++ b/pkgs/tools/misc/you-get/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "you-get";
-  version = "0.4.1488";
+  version = "0.4.1500";
 
   # Tests aren't packaged, but they all hit the real network so
   # probably aren't suitable for a build environment anyway.
@@ -10,7 +10,7 @@ buildPythonApplication rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "28aec2f15e86ea1cbf9900827ade41388aa3f1ac43b4ab49999bce48f37cf9c3";
+    sha256 = "5a6cc0d661fe0cd4210bf467d6c89afd8611609e402690254722c1415736da92";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 9950a46be1b..c407637599d 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -18,11 +18,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2020.12.22";
+  version = "2020.12.31";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0v7pyrdii8yqcx9pjl6r46qj7ljjmwmwkrd5sghf1vmgfwacx5fc";
+    sha256 = "0ncqkzzaasda2hd89psgc0j34r2jinn1dcsfcapzrsd902qghkh9";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
diff --git a/pkgs/tools/misc/z-lua/default.nix b/pkgs/tools/misc/z-lua/default.nix
index dc689236867..2b5a4643549 100644
--- a/pkgs/tools/misc/z-lua/default.nix
+++ b/pkgs/tools/misc/z-lua/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "z-lua";
-  version = "1.8.7";
+  version = "1.8.10";
 
   src = fetchFromGitHub {
     owner = "skywind3000";
     repo = "z.lua";
     rev = version;
-    sha256 = "14n1abv7gh4zajq471bgzpcv8l1159g00h9x83h719i9kxxsa2ba";
+    sha256 = "0q0qs07kmkpjv68j2bjgsrv6shl76mssnchfv82vjf8abkf8343b";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/misc/zalgo/default.nix b/pkgs/tools/misc/zalgo/default.nix
new file mode 100644
index 00000000000..d9538141af0
--- /dev/null
+++ b/pkgs/tools/misc/zalgo/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "zalgo";
+  version = "unstable-2020-08-26";
+
+  src = fetchFromGitHub {
+    owner = "lunasorcery";
+    repo = "zalgo";
+    rev = "6aa1f66cfe183f8164a666730dfeaf39133cf01a";
+    sha256 = "00q56yvfcj2f89wllrckvizihivqmd6l77nihb52ffqd99rdd24w";
+  };
+
+  installPhase = ''
+    install -Dm755 zalgo -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Read stdin and corrupt it with combining diacritics";
+    homepage = "https://github.com/lunasorcery/zalgo";
+    license = licenses.unfree;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ djanatyn ];
+  };
+}
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 28a418c27f2..8cc891cce19 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cjdns";
-  version = "21";
+  version = "21.1";
 
   src = fetchFromGitHub {
     owner = "cjdelisle";
     repo = "cjdns";
     rev = "cjdns-v${version}";
-    sha256 = "1s9d8yrdrj2gviig05jhr0fnzazb88lih0amxfk0av786rvh7ymj";
+    sha256 = "NOmk+vMZ8i0E2MjrUzksk+tkJ9XVVNEXlE5OOTNa+Y0=";
   };
 
   buildInputs = [ which python27 nodejs ] ++
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Encrypted networking for regular people";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ehmry ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/networking/fdm/default.nix b/pkgs/tools/networking/fdm/default.nix
index fb125b486d7..cb5a781f5ef 100644
--- a/pkgs/tools/networking/fdm/default.nix
+++ b/pkgs/tools/networking/fdm/default.nix
@@ -1,20 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook, openssl, tdb, zlib, flex, bison }:
 
-let
-
-  baseName = "fdm";
-  version = "1.9.0.20170124";
-
-in
-
-stdenv.mkDerivation {
-  name = "${baseName}-${version}";
+stdenv.mkDerivation rec {
+  pname = "fdm";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "nicm";
-    repo = baseName;
-    rev = "cae4ea37b6b296d1b2e48f62934ea3a7f6085e33";
-    sha256 = "048191wdv1yprwinipmx2152gvd2iq1ssv7xfb1bzh6zirh1ya3n";
+    repo = pname;
+    rev = version;
+    sha256 = "0j2n271ni5wslgjq1f4zgz1nsvqjf895dxy3ij5c904bbp8ckcwq";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -23,7 +17,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Mail fetching and delivery tool - should do the job of getmail and procmail";
-    maintainers = with maintainers; [ raskin ];
+    maintainers = with maintainers; [ ninjin raskin ];
     platforms = with platforms; linux;
     homepage = "https://github.com/nicm/fdm";
     downloadPage = "https://github.com/nicm/fdm/releases";
diff --git a/pkgs/tools/networking/httpstat/default.nix b/pkgs/tools/networking/httpstat/default.nix
index e9987a51eae..f404090e5e3 100644
--- a/pkgs/tools/networking/httpstat/default.nix
+++ b/pkgs/tools/networking/httpstat/default.nix
@@ -2,12 +2,12 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "httpstat";
-  version = "1.3.0";
+  version = "1.3.1";
   src = fetchFromGitHub {
     owner = "reorx";
     repo = pname;
     rev = version;
-    sha256 = "18k2glnyzxlmry19ijmndim2vqqn3c86smd7xc3haw6k7qafifx1";
+    sha256 = "sha256-zUdis41sQpJ1E3LdNwaCVj6gexi/Rk21IBUgoFISiDM=";
   };
   doCheck = false; # No tests
   buildInputs = [ glibcLocales ];
diff --git a/pkgs/tools/networking/kapp/default.nix b/pkgs/tools/networking/kapp/default.nix
new file mode 100644
index 00000000000..13076338529
--- /dev/null
+++ b/pkgs/tools/networking/kapp/default.nix
@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+buildGoModule rec {
+  pname = "kapp";
+  version = "0.35.0";
+
+  src = fetchFromGitHub {
+    owner = "vmware-tanzu";
+    repo = "carvel-kapp";
+    rev = "v${version}";
+    sha256 = "1i4hpqpbwqb0yg3rx4z733zfslq3svmahfr39ss1ydylsipl02mg";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/kapp" ];
+
+  meta = with lib; {
+    description = "CLI tool that encourages Kubernetes users to manage bulk resources with an application abstraction for grouping";
+    homepage = "https://get-kapp.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ brodes ];
+  };
+}
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index 3e7719c40d4..7e6f2c475ca 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
     "-Wno-error=format-truncation"
     "-Wno-error=pointer-compare"
     "-Wno-error=stringop-truncation"
+    # The following flag allows libreswan v3.32 to work with NSS 3.22, see
+    # https://github.com/libreswan/libreswan/issues/334.
+    # This flag should not be needed for libreswan v3.33 (which is not yet released).
+    "-DNSS_PKCS11_2_0_COMPAT=1"
   ];
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
@@ -82,7 +86,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://libreswan.org";
     description = "A free software implementation of the VPN protocol based on IPSec and the Internet Key Exchange";
-    platforms = platforms.linux ++ platforms.darwin ++ platforms.freebsd;
+    platforms = platforms.linux ++ platforms.freebsd;
     license = licenses.gpl2;
     maintainers = [ maintainers.afranchuk ];
   };
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index c9e75f39e9b..ef98f482140 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, pkgs
 , fetchurl
 , fetchpatch
 , zlib
@@ -68,7 +69,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ]
     ++ optional (hpnSupport || withGssapiPatches) autoreconfHook
-    ++ optional withKerberos kerberos.dev;
+    ++ optional withKerberos pkgs.kerberos.dev;
   buildInputs = [ zlib openssl libedit pam ]
     ++ optional withFIDO libfido2
     ++ optional withKerberos kerberos;
diff --git a/pkgs/tools/networking/proxify/default.nix b/pkgs/tools/networking/proxify/default.nix
new file mode 100644
index 00000000000..4a75b3ca2f1
--- /dev/null
+++ b/pkgs/tools/networking/proxify/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "proxify";
+  version = "0.0.3";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "proxify";
+    rev = "v${version}";
+    sha256 = "15j2q9zrs8bdf72jgldkai3xbi4irk69wyjzv48r74rdgf2k49gn";
+  };
+
+  vendorSha256 = "1x78n88ri8kph827k03x1q06zpbbbp7793xsvc376ljda5n6bqig";
+
+  meta = with stdenv.lib; {
+    description = "Proxy tool for HTTP/HTTPS traffic capture";
+    longDescription = ''
+      This tool supports multiple operations such as request/response dump, filtering
+      and manipulation via DSL language, upstream HTTP/Socks5 proxy. Additionally a
+      replay utility allows to import the dumped traffic (request/responses with correct
+      domain name) into other tools by simply setting the upstream proxy to proxify.
+    '';
+    homepage = "https://github.com/projectdiscovery/proxify";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/networking/qrcp/default.nix b/pkgs/tools/networking/qrcp/default.nix
index 0cfc78d69df..bf3b3936edd 100644
--- a/pkgs/tools/networking/qrcp/default.nix
+++ b/pkgs/tools/networking/qrcp/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "qrcp";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "claudiodangelis";
     repo = "qrcp";
     rev = version;
-    sha256 = "08fjy9mskf6n1zldc63fjm5x617qqx987a58cjav03apzfwzvvhg";
+    sha256 = "0rx0pzy7p3dklayr2lkmyfdc00x9v4pd5xnzydbjx12hncnkpw4l";
   };
 
   vendorSha256 = "0iffy43x3njcahrxl99a71v8p7im102nzv8iqbvd5c6m14rsckqa";
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index f636560844b..203d5e20f88 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -38,9 +38,8 @@ stdenv.mkDerivation rec {
     curl
     check
     gpgme
-  ]
-  # zchunk currently has issues compiling in darwin, fine in linux
-  ++ stdenv.lib.optional stdenv.isLinux zchunk;
+    zchunk
+  ];
 
   # librepo/fastestmirror.h includes curl/curl.h, and pkg-config specfile refers to others in here
   propagatedBuildInputs = [
@@ -49,9 +48,7 @@ stdenv.mkDerivation rec {
     libxml2
   ];
 
-  cmakeFlags = [
-    "-DPYTHON_DESIRED=${stdenv.lib.substring 0 1 python.pythonVersion}"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "-DWITH_ZCHUNK=OFF";
+  cmakeFlags = [ "-DPYTHON_DESIRED=${stdenv.lib.substring 0 1 python.pythonVersion}" ];
 
   postFixup = ''
     moveToOutput "lib/${python.libPrefix}" "$py"
diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index 54492d173e8..34f63593612 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    sha256 = "12fsxy2rv2dgk8l10ymp10j01jkcbn9w0fv5iyb5db85q4xsrsm5";
+    sha256 = "sha256-cMllWFPK6pwqrocjkZKjnELIdtW4tj5Yu6AMw7Zd2JU=";
   };
 
   makeWrapperArgs = [
diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/tools/package-management/protontricks/default.nix
index 02bc599f47d..e4e60442c8f 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/tools/package-management/protontricks/default.nix
@@ -1,31 +1,29 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonApplication
 , fetchFromGitHub
 , setuptools_scm
 , vdf
-, wine
+, steam-run
 , winetricks
 , zenity
-, pytest
+, pytestCheckHook
 }:
 
 buildPythonApplication rec {
   pname = "protontricks";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "Matoking";
     repo = pname;
     rev = version;
-    sha256 = "0ri4phi1rna9snrxa6gl23walyack09mgax7zpjqfpxivwls3ach";
+    sha256 = "0a5727igwafwvj8rr5lv0lx8rlfji3qkzmrbp0d15w5dc4fhknp0";
   };
 
-  # Fix interpreter in mock run.sh for tests
-  postPatch = ''
-    substituteInPlace tests/conftest.py \
-      --replace '#!/bin/bash' '#!${stdenv.shell}' \
-  '';
+  patches = [
+    # Use steam-run to run Proton binaries
+    ./steam-run.patch
+  ];
 
   preBuild = ''
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
@@ -34,22 +32,30 @@ buildPythonApplication rec {
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ vdf ];
 
-  # The wine install shipped with Proton must run under steam's
-  # chrootenv, but winetricks and zenity break when running under
-  # it. See https://github.com/NixOS/nix/issues/902.
-  #
-  # The current workaround is to use wine from nixpkgs
   makeWrapperArgs = [
-    "--set STEAM_RUNTIME 0"
-    "--set-default WINE ${wine}/bin/wine"
-    "--set-default WINESERVER ${wine}/bin/wineserver"
-    "--prefix PATH : ${lib.makeBinPath [ winetricks zenity ]}"
+    "--prefix PATH : ${lib.makeBinPath [
+      steam-run
+      (winetricks.override {
+        # Remove default build of wine to reduce closure size.
+        # Falls back to wine in PATH when --no-runtime is passed.
+        wine = null;
+      })
+      zenity
+    ]}"
   ];
 
-  checkInputs = [ pytest ];
-  checkPhase = "pytest";
+  checkInputs = [ pytestCheckHook ];
+  disabledTests = [
+    # Steam runtime is hard-coded with steam-run.patch and can't be configured
+    "test_run_steam_runtime_not_found"
+    "test_unknown_steam_runtime_detected"
+
+    # Steam runtime 2 currently isn't supported
+    # See https://github.com/NixOS/nixpkgs/issues/100655
+    "test_run_winetricks_steam_runtime_v2"
+  ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A simple wrapper for running Winetricks commands for Proton-enabled games";
     homepage = "https://github.com/Matoking/protontricks";
     license = licenses.gpl3;
diff --git a/pkgs/tools/package-management/protontricks/steam-run.patch b/pkgs/tools/package-management/protontricks/steam-run.patch
new file mode 100644
index 00000000000..536072cafc4
--- /dev/null
+++ b/pkgs/tools/package-management/protontricks/steam-run.patch
@@ -0,0 +1,254 @@
+diff --git a/src/protontricks/cli.py b/src/protontricks/cli.py
+index 6506dae..2f762c9 100755
+--- a/src/protontricks/cli.py
++++ b/src/protontricks/cli.py
+@@ -14,7 +14,7 @@ import os
+ import logging
+ 
+ from . import __version__
+-from .steam import (find_proton_app, find_steam_path, find_steam_runtime_path,
++from .steam import (find_proton_app, find_steam_path,
+                     get_steam_apps, get_steam_lib_paths)
+ from .winetricks import get_winetricks_path
+ from .gui import select_steam_app_with_gui
+@@ -75,8 +75,7 @@ def main(args=None):
+             "WINE: path to a custom 'wine' executable\n"
+             "WINESERVER: path to a custom 'wineserver' executable\n"
+             "STEAM_RUNTIME: 1 = enable Steam Runtime, 0 = disable Steam "
+-            "Runtime, valid path = custom Steam Runtime path, "
+-            "empty = enable automatically (default)"
++            "Runtime, empty = enable automatically (default)"
+         ),
+         formatter_class=argparse.RawTextHelpFormatter
+     )
+@@ -133,14 +132,10 @@ def main(args=None):
+         sys.exit(-1)
+ 
+     # 2. Find Steam Runtime if enabled
+-    steam_runtime_path = None
++    steam_runtime = False
+ 
+     if os.environ.get("STEAM_RUNTIME", "") != "0" and not args.no_runtime:
+-        steam_runtime_path = find_steam_runtime_path(steam_root=steam_root)
+-
+-        if not steam_runtime_path:
+-            print("Steam Runtime was enabled but couldn't be found!")
+-            sys.exit(-1)
++        steam_runtime = True
+     else:
+         logger.info("Steam Runtime disabled.")
+ 
+@@ -194,7 +189,7 @@ def main(args=None):
+             winetricks_path=winetricks_path,
+             proton_app=proton_app,
+             steam_app=steam_app,
+-            steam_runtime_path=steam_runtime_path,
++            steam_runtime=steam_runtime,
+             command=[winetricks_path, "--gui"]
+         )
+         return
+@@ -261,7 +256,7 @@ def main(args=None):
+             winetricks_path=winetricks_path,
+             proton_app=proton_app,
+             steam_app=steam_app,
+-            steam_runtime_path=steam_runtime_path,
++            steam_runtime=steam_runtime,
+             command=[winetricks_path] + args.winetricks_command)
+     elif args.command:
+         run_command(
+@@ -269,7 +264,7 @@ def main(args=None):
+             proton_app=proton_app,
+             steam_app=steam_app,
+             command=args.command,
+-            steam_runtime_path=steam_runtime_path,
++            steam_runtime=steam_runtime,
+             # Pass the command directly into the shell *without*
+             # escaping it
+             cwd=steam_app.install_path,
+diff --git a/src/protontricks/steam.py b/src/protontricks/steam.py
+index 215b31d..aa545b8 100644
+--- a/src/protontricks/steam.py
++++ b/src/protontricks/steam.py
+@@ -11,7 +11,7 @@ from .util import lower_dict
+ 
+ __all__ = (
+     "COMMON_STEAM_DIRS", "SteamApp", "find_steam_path",
+-    "find_steam_proton_app", "find_proton_app", "find_steam_runtime_path",
++    "find_steam_proton_app", "find_proton_app",
+     "find_appid_proton_prefix", "get_steam_lib_paths", "get_steam_apps",
+     "get_custom_proton_installations"
+ )
+@@ -245,37 +245,6 @@ def find_steam_path():
+     return None, None
+ 
+ 
+-def find_steam_runtime_path(steam_root):
+-    """
+-    Find the Steam Runtime either using the STEAM_RUNTIME env or
+-    steam_root
+-    """
+-    env_steam_runtime = os.environ.get("STEAM_RUNTIME", "")
+-
+-    if env_steam_runtime == "0":
+-        # User has disabled Steam Runtime
+-        logger.info("STEAM_RUNTIME is 0. Disabling Steam Runtime.")
+-        return None
+-    elif env_steam_runtime and Path(env_steam_runtime).is_dir():
+-        # User has a custom Steam Runtime
+-        logger.info(
+-            "Using custom Steam Runtime at %s", env_steam_runtime)
+-        return Path(env_steam_runtime)
+-    elif env_steam_runtime in ["1", ""]:
+-        # User has enabled Steam Runtime or doesn't have STEAM_RUNTIME set;
+-        # default to enabled Steam Runtime in either case
+-        steam_runtime_path = steam_root / "ubuntu12_32" / "steam-runtime"
+-
+-        logger.info(
+-            "Using default Steam Runtime at %s", str(steam_runtime_path))
+-        return steam_runtime_path
+-
+-    logger.error(
+-        "Path in STEAM_RUNTIME doesn't point to a valid Steam Runtime!")
+-
+-    return None
+-
+-
+ APPINFO_STRUCT_HEADER = "<4sL"
+ APPINFO_STRUCT_SECTION = "<LLLLQ20sL"
+ 
+diff --git a/src/protontricks/util.py b/src/protontricks/util.py
+index a850427..390fc01 100644
+--- a/src/protontricks/util.py
++++ b/src/protontricks/util.py
+@@ -6,7 +6,7 @@ import stat
+ from pathlib import Path
+ from subprocess import check_output, run, PIPE
+ 
+-__all__ = ("get_runtime_library_paths", "create_wine_bin_dir", "run_command")
++__all__ = ("create_wine_bin_dir", "run_command")
+ 
+ logger = logging.getLogger("protontricks")
+ 
+@@ -25,70 +25,10 @@ def lower_dict(d):
+     return {k.lower(): v for k, v in d.items()}
+ 
+ 
+-def get_host_library_paths():
+-    """
+-    Get host library paths to use when creating the LD_LIBRARY_PATH environment
+-    variable for use with newer Steam Runtime installations
+-    """
+-    # The traditional Steam Runtime does the following when running the
+-    # `run.sh --print-steam-runtime-library-paths` command.
+-    # Since that command is unavailable with newer Steam Runtime releases,
+-    # do it ourselves here.
+-    result = run(
+-        ["/sbin/ldconfig", "-XNv"],
+-        check=True, stdout=PIPE, stderr=PIPE
+-    )
+-    lines = result.stdout.decode("utf-8").split("\n")
+-    paths = [
+-        line.split(":")[0] for line in lines
+-        if line.startswith("/") and ":" in line
+-    ]
+-
+-    return ":".join(paths)
+-
+-
+-def get_runtime_library_paths(steam_runtime_path, proton_app):
+-    """
+-    Get LD_LIBRARY_PATH value to run a command using Steam Runtime
+-    """
+-    if proton_app.required_tool_app:
+-        # bwrap based Steam Runtime is used for Proton installations that
+-        # use separate Steam runtimes
+-        # TODO: Try to run the Wine binaries inside an user namespace somehow.
+-        # Newer Steam Runtime environments may rely on a newer glibc than what
+-        # is available on the host system, which may cause potential problems
+-        # otherwise.
+-        runtime_root = next(
+-            proton_app.required_tool_app.install_path.glob("*/files/")
+-        )
+-        return "".join([
+-            str(proton_app.install_path / "dist" / "lib"), os.pathsep,
+-            str(proton_app.install_path / "dist" / "lib64"), os.pathsep,
+-            get_host_library_paths(), os.pathsep,
+-            str(runtime_root / "i686-pc-linux-gnu" / "lib"), os.pathsep,
+-            str(runtime_root / "x86_64-pc-linux-gnu" / "lib")
+-        ])
+-
+-    # Traditional LD_LIBRARY_PATH based Steam Runtime is used otherwise
+-    steam_runtime_paths = check_output([
+-        str(steam_runtime_path / "run.sh"),
+-        "--print-steam-runtime-library-paths"
+-    ])
+-    steam_runtime_paths = str(steam_runtime_paths, "utf-8")
+-    # Add Proton installation directory first into LD_LIBRARY_PATH
+-    # so that libwine.so.1 is picked up correctly (see issue #3)
+-    return "".join([
+-        str(proton_app.install_path / "dist" / "lib"), os.pathsep,
+-        str(proton_app.install_path / "dist" / "lib64"), os.pathsep,
+-        steam_runtime_paths
+-    ])
+-
+-
+ WINE_SCRIPT_TEMPLATE = (
+-    "#!/bin/bash\n"
++    "#!/bin/sh\n"
+     "# Helper script created by Protontricks to run Wine binaries using Steam Runtime\n"
+-    "export LD_LIBRARY_PATH=\"$PROTON_LD_LIBRARY_PATH\"\n"
+-    "exec \"$PROTON_PATH\"/dist/bin/{name} \"$@\""
++    "exec steam-run \"$PROTON_PATH\"/dist/bin/{name} \"$@\""
+ )
+ 
+ 
+@@ -149,7 +89,7 @@ def create_wine_bin_dir(proton_app):
+ 
+ def run_command(
+         winetricks_path, proton_app, steam_app, command,
+-        steam_runtime_path=None,
++        steam_runtime=False,
+         **kwargs):
+     """Run an arbitrary command with the correct environment variables
+     for the given Proton app
+@@ -157,7 +97,7 @@ def run_command(
+     The environment variables are set for the duration of the call
+     and restored afterwards
+ 
+-    If 'steam_runtime_path' is provided, run the command using Steam Runtime
++    If 'steam_runtime' is provided, run the command using Steam Runtime
+     """
+     # Make a copy of the environment variables to restore later
+     environ_copy = os.environ.copy()
+@@ -200,7 +140,7 @@ def run_command(
+     os.environ.pop("WINEARCH", "")
+ 
+     wine_bin_dir = None
+-    if steam_runtime_path:
++    if steam_runtime:
+         if proton_app.required_tool_app:
+             runtime_name = proton_app.required_tool_app.name
+             logger.info(
+@@ -217,8 +157,6 @@ def run_command(
+         # that load the underlying Proton Wine executables with Steam Runtime
+         # and Proton libraries instead of system libraries
+         wine_bin_dir = create_wine_bin_dir(proton_app=proton_app)
+-        os.environ["PROTON_LD_LIBRARY_PATH"] = \
+-            get_runtime_library_paths(steam_runtime_path, proton_app)
+         os.environ["PATH"] = "".join([
+             str(wine_bin_dir), os.pathsep, os.environ["PATH"]
+         ])
+diff --git a/tests/test_cli.py b/tests/test_cli.py
+index 19e1137..2ef56d6 100644
+--- a/tests/test_cli.py
++++ b/tests/test_cli.py
+@@ -114,9 +114,6 @@ class TestCLIRun:
+         assert str(command.args[0]).endswith(".local/bin/winetricks")
+         assert command.args[1] == "winecfg"
+         assert command.env["PATH"].startswith(str(wine_bin_dir))
+-        assert (
+-            "fake_steam_runtime/lib64" in command.env["PROTON_LD_LIBRARY_PATH"]
+-        )
+         assert command.env["WINE"] == str(wine_bin_dir / "wine")
+         assert command.env["WINELOADER"] == str(wine_bin_dir / "wine")
+         assert command.env["WINESERVER"] == str(wine_bin_dir / "wineserver")
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 8acf57570d7..ac470d3e26a 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -1,21 +1,22 @@
-{ stdenv, lib
+{ stdenv, lib, fetchpatch
 , pkgconfig, autoreconfHook
-, fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libarchive, nspr, nss, popt, db, xz, python, lua, llvmPackages
+, fetchurl, cpio, zlib, bzip2, file, elfutils, libbfd, libgcrypt, libarchive, nspr, nss, popt, db, xz, python, lua, llvmPackages
+, sqlite
 }:
 
 stdenv.mkDerivation rec {
   pname = "rpm";
-  version = "4.15.1";
+  version = "4.16.1.2";
 
   src = fetchurl {
     url = "http://ftp.rpm.org/releases/rpm-${lib.versions.majorMinor version}.x/rpm-${version}.tar.bz2";
-    sha256 = "0c6jwail90fhha3bpx70w4a2i8ycxwvnx6zwxm121l8wc3wlbvyx";
+    sha256 = "1k6ank2aad7r503w12m6m494mxr6iccj52wqhwbc94pwxsf34mw3";
   };
 
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua ]
+  buildInputs = [ cpio zlib bzip2 file libarchive libgcrypt nspr nss db xz python lua sqlite ]
                 ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];
 
   # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
@@ -28,14 +29,23 @@ stdenv.mkDerivation rec {
     "--with-external-db"
     "--with-lua"
     "--enable-python"
+    "--enable-ndb"
+    "--enable-sqlite"
     "--localstatedir=/var"
     "--sharedstatedir=/com"
   ];
 
-  postPatch = ''
-    # For Python3, the original expression evaluates as 'python3.4' but we want 'python3.4m' here
-    substituteInPlace configure.ac --replace 'python''${PYTHON_VERSION}' ${python.executable}
+  # Small fixes for ndb on darwin
+  # https://github.com/rpm-software-management/rpm/pull/1465
+  patches = [
+    (fetchpatch {
+      name = "darwin-support.patch";
+      url = "https://github.com/rpm-software-management/rpm/commit/2d20e371d5e38f4171235e5c64068cad30bda557.patch";
+      sha256 = "0p3j5q5a4hl357maf7018k3826jhcpqg6wfrnccrkv30g0ayk171";
+    })
+  ];
 
+  postPatch = ''
     substituteInPlace Makefile.am --replace '@$(MKDIR_P) $(DESTDIR)$(localstatedir)/tmp' ""
   '';
 
diff --git a/pkgs/tools/security/dnsx/default.nix b/pkgs/tools/security/dnsx/default.nix
new file mode 100644
index 00000000000..21bf7d4664c
--- /dev/null
+++ b/pkgs/tools/security/dnsx/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "dnsx";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "dnsx";
+    rev = "v${version}";
+    sha256 = "1pgq21pbnz2dm272zrhd455njj5vg4kywpd230acj675nlgir6y1";
+  };
+
+  vendorSha256 = "0j2cqvskzxbyfrvsv4gm4qwfjm0digizcg157z5iignnknddajax";
+
+  meta = with stdenv.lib; {
+    description = "Fast and multi-purpose DNS toolkit";
+    longDescription = ''
+      dnsx is a fast and multi-purpose DNS toolkit allow to run multiple
+      probers using retryabledns library, that allows you to perform
+      multiple DNS queries of your choice with a list of user supplied
+      resolvers.
+    '';
+    homepage = "https://github.com/projectdiscovery/dnsx";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/enpass/data.json b/pkgs/tools/security/enpass/data.json
index a4a3b919e64..7a52e260eb9 100644
--- a/pkgs/tools/security/enpass/data.json
+++ b/pkgs/tools/security/enpass/data.json
@@ -1,12 +1,12 @@
 {
   "amd64": {
-    "path": "pool/main/e/enpass/enpass_6.0.1.239_amd64.deb", 
-    "sha256": "408a2bb318564307607f13b52fec7667f425c01ac40cbe345ebfa191ab1479ba", 
-    "version": "6.0.1.239"
-  }, 
+    "path": "pool/main/e/enpass/enpass_6.5.1.723_amd64.deb",
+    "sha256": "d9bb408fa2253ce44ab5396898f7db13291ce23ae58964f4a27ade38bd5067bf",
+    "version": "6.5.1.723"
+  },
   "i386": {
     "path": "pool/main/e/enpass/enpass_5.6.9_i386.deb", 
     "sha256": "3f699ac3e2ecfd4afee1505d8d364d4f6b6b94c55ba989d0a80bd678ff66cb2c", 
     "version": "5.6.9"
   }
-}
\ No newline at end of file
+}
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 370282d02d0..be2e5b06246 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -2,7 +2,7 @@
 , glib, libGLU, libGL, libpulseaudio, zlib, dbus, fontconfig, freetype
 , gtk3, pango
 , makeWrapper , python2Packages, lib
-, lsof, curl, libuuid, cups, mesa
+, lsof, curl, libuuid, cups, mesa, lzma, libxkbcommon
 }:
 
 let
@@ -38,6 +38,8 @@ let
     curl
     libuuid
     cups
+    lzma
+    libxkbcommon
   ]);
   package = stdenv.mkDerivation {
 
@@ -49,11 +51,12 @@ let
       url = "${baseUrl}/${data.path}";
     };
 
-    meta = {
-      description = "a well known password manager";
+    meta = with stdenv.lib; {
+      description = "A well known password manager";
       homepage = "https://www.enpass.io/";
-      license = lib.licenses.unfree;
+      license = licenses.unfree;
       platforms = [ "x86_64-linux" "i686-linux"];
+      maintainers = with maintainers; [ ewok ];
     };
 
     buildInputs = [makeWrapper dpkg];
diff --git a/pkgs/tools/security/ffuf/default.nix b/pkgs/tools/security/ffuf/default.nix
new file mode 100644
index 00000000000..77a286df4c6
--- /dev/null
+++ b/pkgs/tools/security/ffuf/default.nix
@@ -0,0 +1,34 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "ffuf";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1jb2x0ybcb9zkqm7flpmr0hd3171xvnn6kxmfcgds4x8l9fbmxnr";
+  };
+
+  vendorSha256 = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+
+  # tests don't pass due to an issue with the memory addresses
+  # https://github.com/ffuf/ffuf/issues/367
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Fast web fuzzer written in Go";
+    longDescription = ''
+      FFUF, or “Fuzz Faster you Fool” is an open source web fuzzing tool,
+      intended for discovering elements and content within web applications
+      or web servers.
+    '';
+    homepage = "https://github.com/ffuf/ffuf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/gau/default.nix b/pkgs/tools/security/gau/default.nix
new file mode 100644
index 00000000000..cfbae951526
--- /dev/null
+++ b/pkgs/tools/security/gau/default.nix
@@ -0,0 +1,29 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "gau";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "lc";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1srbql603vvlxc6p1ibw0982icdq9kcr1iamxlr8bmgldbm8215w";
+  };
+
+  vendorSha256 = "17ag2wvaxv2dyx3yx3fvlf36ww4a44660pn4gvpbrwacsan9as5s";
+
+  meta = with stdenv.lib; {
+    description = "Tool to fetch known URLs";
+    longDescription = ''
+      getallurls (gau) fetches known URLs from various sources for any
+      given domain.
+    '';
+    homepage = "https://github.com/lc/gau";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/ghidra/default.nix b/pkgs/tools/security/ghidra/default.nix
index e11d028f1f8..2e55b24f723 100644
--- a/pkgs/tools/security/ghidra/default.nix
+++ b/pkgs/tools/security/ghidra/default.nix
@@ -1,6 +1,15 @@
-{ stdenv, fetchzip, lib, makeWrapper, autoPatchelfHook
-, openjdk11, pam, makeDesktopItem, icoutils
-}: let
+{ stdenv
+, fetchzip
+, lib
+, makeWrapper
+, autoPatchelfHook
+, openjdk11
+, pam
+, makeDesktopItem
+, icoutils
+}:
+
+let
 
   pkg_path = "$out/lib/ghidra";
 
@@ -13,23 +22,22 @@
     categories = "Development;";
   };
 
-
 in stdenv.mkDerivation rec {
 
   pname = "ghidra";
-  version = "9.2";
-  versiondate = "20201113";
+  version = "9.2.1";
+  versiondate = "20201215";
 
   src = fetchzip {
     url = "https://www.ghidra-sre.org/ghidra_${version}_PUBLIC_${versiondate}.zip";
-    sha256 = "0lcvmbq04qkdsf0bz509frgw79bhyxyixkqg1k712p3576ng3nby";
+    sha256 = "0rjzmx0nbv9flb666mk3w2dqliyfzjyc4ldjfmb5d29wpgnf9bnz";
   };
 
   nativeBuildInputs = [
     makeWrapper
-    autoPatchelfHook
     icoutils
-  ];
+  ]
+  ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
 
   buildInputs = [
     stdenv.cc.cc.lib
@@ -62,7 +70,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission";
     homepage = "https://ghidra-sre.org/";
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
     license = licenses.asl20;
     maintainers = with maintainers; [ ck3d govanify ];
   };
diff --git a/pkgs/tools/security/gospider/default.nix b/pkgs/tools/security/gospider/default.nix
new file mode 100644
index 00000000000..b7c94c94023
--- /dev/null
+++ b/pkgs/tools/security/gospider/default.nix
@@ -0,0 +1,33 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "gospider";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "jaeles-project";
+    repo = pname;
+    rev = version;
+    sha256 = "03gl8y2047iwa6bhmayyds3li21wy3sw1x4hpp9zgqgi95039q86";
+  };
+
+  vendorSha256 = "0dc4ddi26i38c5rvy9zbal27a7qvn17h64w1yhbig4iyb79b18ym";
+
+  # tests require internet access and API keys
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Fast web spider written in Go";
+    longDescription = ''
+      GoSpider is a fast web crawler that parses sitemap.xml and robots.txt file.
+      It can generate and verify link from JavaScript files, extract URLs from
+      various sources and can detect subdomains from the response source.
+    '';
+    homepage = "https://github.com/jaeles-project/gospider";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/httpx/default.nix b/pkgs/tools/security/httpx/default.nix
new file mode 100644
index 00000000000..c7d83075e9d
--- /dev/null
+++ b/pkgs/tools/security/httpx/default.nix
@@ -0,0 +1,30 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "httpx";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "httpx";
+    rev = "v${version}";
+    sha256 = "15ihc5926kbai16i59c7bmvgd162qq9dpd52g4vrp7dq4jrz155m";
+  };
+
+  vendorSha256 = "0fg93vhwpx113fpw8qg4ram4bdh6a8x3a36pr1c962s4vhrabwy2";
+
+  meta = with stdenv.lib; {
+    description = "Fast and multi-purpose HTTP toolkit";
+    longDescription = ''
+      httpx is a fast and multi-purpose HTTP toolkit allow to run multiple
+      probers using retryablehttp library, it is designed to maintain the
+      result reliability with increased threads.
+    '';
+    homepage = "https://github.com/projectdiscovery/httpx";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/naabu/default.nix b/pkgs/tools/security/naabu/default.nix
new file mode 100644
index 00000000000..a2295d87fec
--- /dev/null
+++ b/pkgs/tools/security/naabu/default.nix
@@ -0,0 +1,38 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, libpcap
+}:
+
+buildGoModule rec {
+  pname = "naabu";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "naabu";
+    rev = "v${version}";
+    sha256 = "05iybf7q3y0piyw202yzld89fiz2dv2pmnpm1pd905phk5a23n1x";
+  };
+
+  vendorSha256 = "111qvkqdcdgir3dz267xckzlnfx72flnyi7ki7fa6ml7mkfyf70y";
+
+  buildInputs = [ libpcap ];
+
+  preBuild = ''
+    mv v2/* .
+  '';
+
+  meta = with lib; {
+    description = "Fast SYN/CONNECT port scanner";
+    longDescription = ''
+      Naabu is a port scanning tool written in Go that allows you to enumerate
+      valid ports for hosts in a fast and reliable manner. It is a really simple
+      tool that does fast SYN/CONNECT scans on the host/list of hosts and lists
+      all ports that return a reply.
+    '';
+    homepage = "https://github.com/projectdiscovery/naabu";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
new file mode 100644
index 00000000000..22013352a38
--- /dev/null
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -0,0 +1,36 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "nuclei";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "nuclei";
+    rev = "v${version}";
+    sha256 = "0xrvza86aczlnb11x58fiqch5g0q6gvpxwsi5dq3akfi95gk3a3x";
+  };
+
+  vendorSha256 = "1v3ax8l1lgp2vs50gsa2fhdd6bvyfdlkd118akrqmwxahyyyqycv";
+
+  preBuild = ''
+    mv v2/* .
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tool for configurable targeted scanning";
+    longDescription = ''
+      Nuclei is used to send requests across targets based on a template
+      leading to zero false positives and providing effective scanning
+      for known paths. Main use cases for nuclei are during initial
+      reconnaissance phase to quickly check for low hanging fruits or
+      CVEs across targets that are known and easily detectable.
+    '';
+    homepage = "https://github.com/projectdiscovery/nuclei";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/onlykey-cli/default.nix b/pkgs/tools/security/onlykey-cli/default.nix
new file mode 100644
index 00000000000..b342f203b44
--- /dev/null
+++ b/pkgs/tools/security/onlykey-cli/default.nix
@@ -0,0 +1,24 @@
+{ lib, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "onlykey-cli";
+  version = "1.2.2";
+
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "onlykey";
+    sha256 = "1qkbgab5xlg7bd0jfzf8k5ppb1zhib76r050fiaqi5wibrqrfwdi";
+  };
+
+  # Requires having the physical onlykey (a usb security key)
+  doCheck = false;
+  propagatedBuildInputs =
+    with python3Packages; [ hidapi aenum six prompt_toolkit pynacl ecdsa cython ];
+
+  meta = with lib; {
+    description = "OnlyKey client and command-line tool";
+    homepage = "https://github.com/trustcrypto/python-onlykey";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ranfdev ];
+  };
+}
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index e5574be8ab9..f3c9990a3c7 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -1,19 +1,35 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, buildGoModule
+, pcsclite
+, PCSC
+, pkg-config
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "step-ca";
-  version = "0.13.3";
-
-  goPackagePath = "github.com/smallstep/certificates";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "v${version}";
-    sha256 = "1i42j7v5a5qqqb9ng8irblfyzykhyws0394q3zac290ymjijxbnq";
+    sha256 = "0n26692ph4q4cmrqammfazmx1k9p2bydwqc57q4hz5ni6jd31zbz";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "0w0phyqymcg2h2jjasxmkf4ryn4y1bqahcy94rs738cqr5ifyfbg";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    lib.optional stdenv.isLinux (lib.getDev pcsclite)
+    ++ lib.optional stdenv.isDarwin PCSC;
+
+  # Tests fail on darwin with
+  # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted [recovered]
+  # probably some sandboxing issue
+  doCheck = stdenv.isLinux;
 
   meta = with lib; {
     description = "A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH";
diff --git a/pkgs/tools/security/step-ca/deps.nix b/pkgs/tools/security/step-ca/deps.nix
deleted file mode 100644
index 07607b6f65d..00000000000
--- a/pkgs/tools/security/step-ca/deps.nix
+++ /dev/null
@@ -1,291 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/AndreasBriese/bbloom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/AndreasBriese/bbloom";
-      rev =  "e2d15f34fcf99d5dbb871c820ec73f710fca9815";
-      sha256 = "05kkrsmpragy69bj6s80pxlm3pbwxrkkx7wgk0xigs6y2n6ylpds";
-    };
-  }
-  {
-    goPackagePath  = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev =  "2972be24d48e78746da79ba8e24e8b488c9880de";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgraph-io/badger";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgraph-io/badger";
-      rev =  "391b6d3b93e6014fe8c2971fcc0c1266e47dbbd9";
-      sha256 = "13zyd6irxagwfv4azgmpk2qg8f80plhxrcjl8x89jzsjkl0a0pkx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgryski/go-farm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-farm";
-      rev =  "6a90982ecee230ff6cba02d5bd386acc030be9d3";
-      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-chi/chi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-chi/chi";
-      rev =  "0ebf7795c516423a110473652e9ba3a59a504863";
-      sha256 = "18hwj6vni19ykp3bsmg9ggnl6y2hawym0vbsigdgx8craqbp7jb1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
-      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "aa810b61a9c79d51363740d207bb46cf8e620ed5";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
-    };
-  }
-  {
-    goPackagePath  = "github.com/juju/ansiterm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/ansiterm";
-      rev =  "720a0952cc2ac777afc295d9861263e2a4cf96a1";
-      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev =  "5c8c8bd35d3832f5d134ae1e1e375b69a4d25242";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lunixbochs/vtclean";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lunixbochs/vtclean";
-      rev =  "2d01aacdc34a083dca635ba869909f5fc0cd4f41";
-      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/manifoldco/promptui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/manifoldco/promptui";
-      rev =  "157c96fb638a14d268b305cf2012582431fcc410";
-      sha256 = "0zha48i5f529q4j1qycybdzza4l9706hijiqws36ikd5jzg8i7wz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "6ca4dbf54d38eea1a992b3c722a76a5d1c4cb25c";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mmcloughlin/avo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mmcloughlin/avo";
-      rev =  "2e7d06bc7ada2979f17ccf8ebf486dba23b84fc7";
-      sha256 = "0fna1hhg193zy428lkj24a8853g3qviqs2c9xi96mji6ldprna5d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/newrelic/go-agent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/newrelic/go-agent";
-      rev =  "f5bce3387232559bcbe6a5f8227c4bf508dac1ba";
-      sha256 = "1zbp1cqhxp0sz3faymam6h1f91r1gl8dnnjx7qg8r06bd5fbzllb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/rs/xid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rs/xid";
-      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
-      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/samfoo/ansi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/samfoo/ansi";
-      rev =  "b6bd2ded7189ce35bc02233b554eb56a5146af73";
-      sha256 = "0sw2d7c6l2ry34x0n4j37ydr8s7hxnax76yh6n35gb2g6f1h46sz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev =  "86672fcb3f950f35f2e675df2240550f2a50762f";
-      sha256 = "142m507s9971cl8qdmbcw7sqxnkgi3xqd8wzvfq15p0w7w8i4a3h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev =  "ad15b42461921f1fb3529b058c6786c6a45d5162";
-      sha256 = "02xdfcp4f6dqvpavwf1vvr794qgz2fx8929paam7wnvcxy7ib606";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/assert";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/assert";
-      rev =  "de77670473b5492f5d0bce155b5c01534c2d13f7";
-      sha256 = "15z2b4qyylnwgq2pzlaxsdabqxh8dbna4ddprk9rzmsvnfkpds16";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/cli";
-      rev =  "eeecaac062cb548ee2ab7c7563bc3c2f2160f019";
-      sha256 = "1khhd1vgwqb08vki1nh0k4i2yk6jjdqmnq4f8anqn125zsj7hvdk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/nosql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/nosql";
-      rev =  "f80b3f432de0662f07ebd58fe52b0a119fe5dcd9";
-      sha256 = "155blxdgaprl1py5g8p52gipp0ckz3k6v41hgsp83nay01yynafb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev =  "b67dcf995b6a7b7f14fad5fcb7cc5441b05e814b";
-      sha256 = "0n5vq4nydlhb7w12jiwphvxqdy4jwpxc3zwlxyhf05lq1nxfb56h";
-    };
-  }
-  {
-    goPackagePath  = "go.etcd.io/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/etcd-io/bbolt";
-      rev =  "63597a96ec0ad9e6d43c3fc81e809909e0237461";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06";
-      sha256 = "0sbsgjm6wqa162ssrf1gnpv62ak5wjn1bn8v7sxwwfg8a93z1028";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "c44066c5c816ec500d459a2a324a753f78531ae0";
-      sha256 = "0mgww74bl15d0jvsh4f3qr1ckjzb8icb8hn0mgs5ppa0b2fgpc4f";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
-      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "54a98f90d1c46b7731eb8fb305d2a321c30ef610";
-      sha256 = "0l7mkdnwhidv8m686x432vmx8z5nqcrr9f46ddgvrxbh4wvyfcll";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/square/go-jose";
-      rev =  "730df5f748271903322feb182be83b43ebbbe27d";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-]
\ No newline at end of file
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index d696b560f6d..2b6ec57bbf2 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -1,19 +1,26 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "step-cli";
-  version = "0.13.3";
-
-  goPackagePath = "github.com/smallstep/cli";
+  version = "0.15.3-22-g3ddc5aa";
 
+  # 0.15.3 isn't enough, because we need https://github.com/smallstep/cli/pull/394
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
-    rev = "v${version}";
-    sha256 = "0b5hk9a8yq1nyh8m1gmf28yiha95xwsc4dk321g84hvai7g47pbr";
+    rev = "3ddc5aaafccb23ba9a20abfa70109a2923f298e3";
+    sha256 = "1kd04hi764xa3f9p6aw6k9f6wa4y6xsmzby5jxvvkhim4w78brw0";
   };
 
-  goDeps = ./deps.nix;
+  preCheck = ''
+    # Tries to connect to smallstep.com
+    rm command/certificate/remote_test.go
+  '';
+  vendorSha256 = "04hckq78g1p04b2q0rq4xw6d880hqhkabbx1pc3pf8r1m6jxwz10";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
diff --git a/pkgs/tools/security/step-cli/deps.nix b/pkgs/tools/security/step-cli/deps.nix
deleted file mode 100644
index bae1ba070a6..00000000000
--- a/pkgs/tools/security/step-cli/deps.nix
+++ /dev/null
@@ -1,453 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/AndreasBriese/bbloom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/AndreasBriese/bbloom";
-      rev =  "e2d15f34fcf99d5dbb871c820ec73f710fca9815";
-      sha256 = "05kkrsmpragy69bj6s80pxlm3pbwxrkkx7wgk0xigs6y2n6ylpds";
-    };
-  }
-  {
-    goPackagePath  = "github.com/ThomasRooney/gexpect";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ThomasRooney/gexpect";
-      rev =  "5482f03509440585d13d8f648989e05903001842";
-      sha256 = "04zan78ndabxlwsw2hdcqbz32435pw2s04ljza07jlxnxzjp4kws";
-    };
-  }
-  {
-    goPackagePath  = "github.com/asaskevich/govalidator";
-    fetch = {
-      type = "git";
-      url = "https://github.com/asaskevich/govalidator";
-      rev =  "ccb8e960c48f04d6935e72476ae4a51028f9e22f";
-      sha256 = "1sih4yb6fqmdp5g6594yyida0qm7dvvqcfvf8pgikydkxyqb8g0k";
-    };
-  }
-  {
-    goPackagePath  = "github.com/boombuler/barcode";
-    fetch = {
-      type = "git";
-      url = "https://github.com/boombuler/barcode";
-      rev =  "3cfea5ab600ae37946be2b763b8ec2c1cf2d272d";
-      sha256 = "1fzb8wz1ny2sc78g9rm0bcm80pgwvkm2k6lmim2sb4jgm1j3sajd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev =  "2972be24d48e78746da79ba8e24e8b488c9880de";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/corpix/uarand";
-    fetch = {
-      type = "git";
-      url = "https://github.com/corpix/uarand";
-      rev =  "2b8494104d86337cdd41d0a49cbed8e4583c0ab4";
-      sha256 = "06ml5m8l9wbr96gvyg6z1syawn797f8kmq74nhgry3vqpngyb6yn";
-    };
-  }
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "8991bc29aa16c548c550c7ff78260e27b9ab7c73";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgraph-io/badger";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgraph-io/badger";
-      rev =  "391b6d3b93e6014fe8c2971fcc0c1266e47dbbd9";
-      sha256 = "13zyd6irxagwfv4azgmpk2qg8f80plhxrcjl8x89jzsjkl0a0pkx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgryski/go-farm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-farm";
-      rev =  "6a90982ecee230ff6cba02d5bd386acc030be9d3";
-      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-chi/chi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-chi/chi";
-      rev =  "0ebf7795c516423a110473652e9ba3a59a504863";
-      sha256 = "18hwj6vni19ykp3bsmg9ggnl6y2hawym0vbsigdgx8craqbp7jb1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
-      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "b5d812f8a3706043e23a9cd5babf2e5423744d30";
-      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/google/certificate-transparency-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/certificate-transparency-go";
-      rev =  "3629d6846518309d22c16fee15d1007262a459d2";
-      sha256 = "16vsq7dd2kbbk3vwlrhm3jrlg5kq16wf4iz6d1gnyc32s5fcy9d7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/icrowley/fake";
-    fetch = {
-      type = "git";
-      url = "https://github.com/icrowley/fake";
-      rev =  "4178557ae428460c3780a381c824a1f3aceb6325";
-      sha256 = "1mv4bxfphaqbvacy49v4lf4gf2nmadzpmjq0jbdx93wi5bnkc977";
-    };
-  }
-  {
-    goPackagePath  = "github.com/juju/ansiterm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/ansiterm";
-      rev =  "720a0952cc2ac777afc295d9861263e2a4cf96a1";
-      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kballard/go-shellquote";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kballard/go-shellquote";
-      rev =  "95032a82bc518f77982ea72343cc1ade730072f0";
-      sha256 = "1rspvmnsikdq95jmx3dykxd4k1rmgl98ryjrysvl0cf18hl1vq80";
-    };
-  }
-  {
-    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev =  "5c8c8bd35d3832f5d134ae1e1e375b69a4d25242";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev =  "db8e3cd836b82e82e0a9c8edc6896967dd31374f";
-      sha256 = "0knzlvndfgjm2k23vhp2xj1cv3fm31vbg5b20gdl1vnxk7rh549h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lunixbochs/vtclean";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lunixbochs/vtclean";
-      rev =  "2d01aacdc34a083dca635ba869909f5fc0cd4f41";
-      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/manifoldco/promptui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/manifoldco/promptui";
-      rev =  "157c96fb638a14d268b305cf2012582431fcc410";
-      sha256 = "0zha48i5f529q4j1qycybdzza4l9706hijiqws36ikd5jzg8i7wz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "6ca4dbf54d38eea1a992b3c722a76a5d1c4cb25c";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mmcloughlin/avo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mmcloughlin/avo";
-      rev =  "2e7d06bc7ada2979f17ccf8ebf486dba23b84fc7";
-      sha256 = "0fna1hhg193zy428lkj24a8853g3qviqs2c9xi96mji6ldprna5d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/newrelic/go-agent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/newrelic/go-agent";
-      rev =  "f5bce3387232559bcbe6a5f8227c4bf508dac1ba";
-      sha256 = "1zbp1cqhxp0sz3faymam6h1f91r1gl8dnnjx7qg8r06bd5fbzllb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pquerna/otp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pquerna/otp";
-      rev =  "b7b89250c468c06871d3837bee02e2d5c155ae19";
-      sha256 = "0gsl9rh8awira21z6cj26c6swasskx03z66q72yjc1mpbvyg6han";
-    };
-  }
-  {
-    goPackagePath  = "github.com/rs/xid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rs/xid";
-      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
-      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/samfoo/ansi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/samfoo/ansi";
-      rev =  "b6bd2ded7189ce35bc02233b554eb56a5146af73";
-      sha256 = "0sw2d7c6l2ry34x0n4j37ydr8s7hxnax76yh6n35gb2g6f1h46sz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev =  "86672fcb3f950f35f2e675df2240550f2a50762f";
-      sha256 = "142m507s9971cl8qdmbcw7sqxnkgi3xqd8wzvfq15p0w7w8i4a3h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev =  "ad15b42461921f1fb3529b058c6786c6a45d5162";
-      sha256 = "02xdfcp4f6dqvpavwf1vvr794qgz2fx8929paam7wnvcxy7ib606";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/assert";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/assert";
-      rev =  "de77670473b5492f5d0bce155b5c01534c2d13f7";
-      sha256 = "15z2b4qyylnwgq2pzlaxsdabqxh8dbna4ddprk9rzmsvnfkpds16";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/certificates";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/certificates";
-      rev =  "effb490d276f33b8cdab661df8b57a8ded67e082";
-      sha256 = "1i76bbm4rbpv4cw2ln36v0x74jjkss6j8pdh49hfvb75j2n32790";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/certinfo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/certinfo";
-      rev =  "78e21b44234ef6ddeb58f5e8aad2ed09975b694a";
-      sha256 = "0zrxql9173vzn7zirv4299j0vw2mzwknivrg8rzhdbkhvbfiql9q";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/nosql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/nosql";
-      rev =  "a0934e12468769d8cbede3ed316c47a4b88de4ca";
-      sha256 = "08bg0sgrhkzflyl0ybi8v2vmk8bfk5pmcyfrizpxssyql7k27fam";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/truststore";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/truststore";
-      rev =  "e16045d94a61ca04b60d5d246da3117e7eeb1ecf";
-      sha256 = "15cv3dkn2npf6rwhkb575sdq089rf70rha8wrym4ygc8rjbgwbab";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/zcrypto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/zcrypto";
-      rev =  "6bab21fcaafc3d150cf793b6d5f25fe32f49c80e";
-      sha256 = "129az7k556lmnhh14ayrwzrp1y205zdgwk3rj1xcmgisx5irliqp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/zlint";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/zlint";
-      rev =  "d84eaafe274f9dc1f811ebfbb073e18c466e2a44";
-      sha256 = "1xm7b1wvbify20vk9f3kmgmi5mnj5x2z3czc0r4zylcqcwwjkfd6";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "f35b8ab0b5a2cef36673838d662e249dd9c94686";
-      sha256 = "0dlszlshlxbmmfxj5hlwgv3r22x0y1af45gn1vd198nvvs3pnvfs";
-    };
-  }
-  {
-    goPackagePath  = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev =  "b67dcf995b6a7b7f14fad5fcb7cc5441b05e814b";
-      sha256 = "0n5vq4nydlhb7w12jiwphvxqdy4jwpxc3zwlxyhf05lq1nxfb56h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/weppos/publicsuffix-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/weppos/publicsuffix-go";
-      rev =  "386050f8211b04c965721c3591e7d96650a1ea86";
-      sha256 = "17nvc0m0azm418w4mcyk7r1qcik0099vjpn455ia0lxhbqbl701b";
-    };
-  }
-  {
-    goPackagePath  = "go.etcd.io/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/etcd-io/bbolt";
-      rev =  "63597a96ec0ad9e6d43c3fc81e809909e0237461";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06";
-      sha256 = "0sbsgjm6wqa162ssrf1gnpv62ak5wjn1bn8v7sxwwfg8a93z1028";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "c44066c5c816ec500d459a2a324a753f78531ae0";
-      sha256 = "0mgww74bl15d0jvsh4f3qr1ckjzb8icb8hn0mgs5ppa0b2fgpc4f";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
-      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "54a98f90d1c46b7731eb8fb305d2a321c30ef610";
-      sha256 = "0l7mkdnwhidv8m686x432vmx8z5nqcrr9f46ddgvrxbh4wvyfcll";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/square/go-jose";
-      rev =  "730df5f748271903322feb182be83b43ebbbe27d";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-  {
-    goPackagePath  = "howett.net/plist";
-    fetch = {
-      type = "git";
-      url = "https://gitlab.howett.net/go/plist.git";
-      rev =  "591f970eefbbeb04d7b37f334a0c4c3256e32876";
-      sha256 = "1gr74rf6m8bgayf6mxcfaxb3cc49ldlhydzqfafx7di5nds5hxk9";
-    };
-  }
-]
diff --git a/pkgs/tools/security/teler/default.nix b/pkgs/tools/security/teler/default.nix
new file mode 100644
index 00000000000..37866375859
--- /dev/null
+++ b/pkgs/tools/security/teler/default.nix
@@ -0,0 +1,33 @@
+{ buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "teler";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "kitabisa";
+    repo = "teler";
+    rev = "v${version}";
+    sha256 = "07pfqgms5cj4y6zm984qjmmw1c8j9yjbgrp2spi9vzk96s3k3qn3";
+  };
+
+  vendorSha256 = "06szi2jw3nayd7pljjlww2gsllgnfg8scnjmc6qv5xl6gf797kdz";
+
+  # test require internet access
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Real-time HTTP Intrusion Detection";
+    longDescription = ''
+      teler is an real-time intrusion detection and threat alert
+      based on web log that runs in a terminal with resources that
+      we collect and provide by the community.
+    '';
+    homepage = "https://github.com/kitabisa/teler";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/wad/default.nix b/pkgs/tools/security/wad/default.nix
new file mode 100644
index 00000000000..ee731798097
--- /dev/null
+++ b/pkgs/tools/security/wad/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+, mock
+, pytestCheckHook
+, six
+}:
+
+buildPythonApplication rec {
+  pname = "wad";
+  version = "0.4.6";
+
+  src = fetchPypi {
+    inherit pname;
+    inherit version;
+    sha256 = "02jq77h6g9v7n4qqq7qri6wmhggy257983dwgmpjsf4qsagkgwy8";
+  };
+
+  propagatedBuildInputs = [
+    six
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    mock
+  ];
+
+  pythonImportsCheck = [ "wad" ];
+
+  meta = with lib; {
+    description = "Tool for detecting technologies used by web applications";
+    longDescription = ''
+      WAD lets you analyze given URL(s) and detect technologies used by web
+      application behind that URL, from the OS and web server level, to the
+      programming platform and frameworks, as well as server- and client-side
+      applications, tools and libraries.
+    '';
+    homepage = "https://github.com/CERN-CERT/WAD";
+    # wad is GPLv3+, wappalyzer source is MIT
+    license = with licenses; [ gpl3Plus mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/typesetting/bibclean/default.nix b/pkgs/tools/typesetting/bibclean/default.nix
index d0e2c79c0bc..c95c6921a4e 100644
--- a/pkgs/tools/typesetting/bibclean/default.nix
+++ b/pkgs/tools/typesetting/bibclean/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     description = "Prettyprint and syntax check BibTeX and Scribe bibliography data base files";
     homepage = "http://ftp.math.utah.edu/pub/bibclean";
     license = licenses.gpl2;
+    platforms = platforms.all;
     maintainers = with maintainers; [ dtzWill ];
   };
 }
diff --git a/pkgs/tools/typesetting/lowdown/default.nix b/pkgs/tools/typesetting/lowdown/default.nix
index 017066a2c22..ecd25bf8e83 100644
--- a/pkgs/tools/typesetting/lowdown/default.nix
+++ b/pkgs/tools/typesetting/lowdown/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lowdown";
-  version = "0.7.4";
+  version = "0.7.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-    sha512 = "2iw5x3lf5knnscp0ifgk50yj48p54cbd34h94qrxa9vdybg2nnipklrqmmqblf6l7qph98h7jvlyr99m5qlrki9lvjr1jcgbgp31pn0";
+    sha512 = "1wfbrydbk0f0blhg5my3m5gw8bspwh3rdg4w4mcalnrwpypzd4zrggc4aj3zm72c5jikx6pnjb2k9w1s075k84f6q8p8chlzb3s4qd2";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/tools/typesetting/tectonic/default.nix b/pkgs/tools/typesetting/tectonic/default.nix
index fc4a971f230..d37a4a69570 100644
--- a/pkgs/tools/typesetting/tectonic/default.nix
+++ b/pkgs/tools/typesetting/tectonic/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tectonic";
-  version = "0.3.3";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${version}";
-    sha256 = "1ncczcchyphprkrb8spya400gi212a6akx18fm3j4xdhmg9caj3f";
+    sha256 = "1p93428ln3sfsflc7spjpfcgy81c4z5y0xhwv5mkgzf55g8nrin1";
   };
 
-  cargoSha256 = "11xvq0l9xrppcplkshd5wxv90s97x4iavhzbdk9px992zl0m6ar6";
+  cargoSha256 = "0jzngl1iwrq20cx3l0mwdrrddvyw977rwb75nz1k4hkxjnicc1ga";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 891495c46ca..0625fe16090 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -36,7 +36,7 @@ let
   mkUniqueOutPaths = pkgs: uniqueStrings
     (map (p: p.outPath) (builtins.filter lib.isDerivation pkgs));
 
-in buildEnv {
+in (buildEnv {
   name = "texlive-${extraName}-${bin.texliveYear}";
 
   extraPrefix = "/share/texmf";
@@ -271,6 +271,6 @@ in buildEnv {
   ''
     + bin.cleanBrokenLinks
   ;
-}
+}).overrideAttrs (_: { allowSubstitutes = true; })
 # TODO: make TeX fonts visible by fontconfig: it should be enough to install an appropriate file
 #       similarly, deal with xe(la)tex font visibility?
diff --git a/pkgs/tools/virtualization/amazon-ecs-cli/default.nix b/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
index 4c37054f4a0..bd63481054c 100644
--- a/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
+++ b/pkgs/tools/virtualization/amazon-ecs-cli/default.nix
@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "amazon-ecs-cli";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src =
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-linux-amd64-v${version}";
-        sha256 = "11cw2hk48x66wlsg5bzay95l2pgncwnawzj4xmqmbchhhvphrvxr";
+        sha256 = "sEHwhirU2EYwtBRegiIvN4yr7VKtmy7e6xx5gZOkuY0=";
       }
     else if stdenv.hostPlatform.system == "x86_64-darwin" then
       fetchurl {
         url = "https://s3.amazonaws.com/amazon-ecs-cli/ecs-cli-darwin-amd64-v${version}";
-        sha256 = "1f4yq04sgwkj2p0j598a8vc54dzihmqvg9daa6mxnqj403ln0rg1";
+        sha256 = "1viala49sifpcmgn3jw24h5bkrlm4ffadjiqagbxj3lr0r78i9nm";
       }
     else throw "Architecture not supported";