NixOS · Mar 17, 2020 · Mar 25, 2020 · Mar 27, 2020 · Mar 27, 2020 · Mar 27, 2020
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -108,6 +108,23 @@
       <link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The initrd SSH support now uses OpenSSH rather than Dropbear to
+     allow the use of Ed25519 keys and other OpenSSH-specific
+     functionality. Host keys must now be in the OpenSSH format, and at
+     least one pre-generated key must be specified.
+    </para>
+    <para>
+     If you used the <option>boot.initrd.network.ssh.host*Key</option>
+     options, you'll get an error explaining how to convert your host
+     keys and migrate to the new
+     <option>boot.initrd.network.ssh.hostKeys</option> option.
+     Otherwise, if you don't have any host keys set, you'll need to
+     generate some; see the <option>hostKeys</option> option
+     documentation for instructions.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -690,6 +690,7 @@
   ./services/networking/prosody.nix
   ./services/networking/quagga.nix
   ./services/networking/quassel.nix
+  ./services/networking/quorum.nix
   ./services/networking/quicktun.nix
   ./services/networking/racoon.nix
   ./services/networking/radicale.nix

diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -155,7 +155,7 @@ in {
 
       systemd.services.alertmanager = {
         wantedBy = [ "multi-user.target" ];
-        after    = [ "network.target" ];
+        after    = [ "network-online.target" ];
         preStart = ''
            ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
                                                     -i "${alertmanagerYml}"

diff --git a/nixos/modules/services/networking/quorum.nix b/nixos/modules/services/networking/quorum.nix
@@ -0,0 +1,229 @@
+{ config, pkgs, lib, ... }:
+let
+
+  inherit (lib) mkEnableOption mkIf mkOption literalExample types optionalString;
+
+  cfg = config.services.quorum;
+  dataDir = "/var/lib/quorum";
+  genesisFile = pkgs.writeText "genesis.json" (builtins.toJSON cfg.genesis);
+  staticNodesFile = pkgs.writeText "static-nodes.json" (builtins.toJSON cfg.staticNodes);
+
+in {
+  options = {
+
+    services.quorum = {
+      enable = mkEnableOption "Quorum blockchain daemon";
+
+      user = mkOption {
+        type = types.str;
+        default = "quorum";
+        description = "The user as which to run quorum.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = cfg.user;
+        description = "The group as which to run quorum.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 21000;
+        description = "Override the default port on which to listen for connections.";
+      };
+
+      nodekeyFile = mkOption {
+        type = types.path;
+        default = "${dataDir}/nodekey";
+        description = "Path to the nodekey.";
+      };
+
+      staticNodes = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0" ];
+        description = "List of validator nodes.";
+      };
+
+      privateconfig = mkOption {
+        type = types.str;
+        default = "ignore";
+        description = "Configuration of privacy transaction manager.";
+      };
+
+      syncmode = mkOption {
+        type = types.enum [ "fast" "full" "light" ];
+        default = "full";
+        description = "Blockchain sync mode.";
+      };
+
+      blockperiod = mkOption {
+        type = types.int;
+        default = 5;
+        description = "Default minimum difference between two consecutive block's timestamps in seconds.";
+      };
+
+      permissioned = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Allow only a defined list of nodes to connect.";
+      };
+
+      rpc = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable RPC interface.";
+        };
+
+        address = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "Listening address for RPC connections.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 22004;
+          description = "Override the default port on which to listen for RPC connections.";
+        };
+
+        api = mkOption {
+          type = types.str;
+          default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
+          description = "API's offered over the HTTP-RPC interface.";
+        };
+      };
+
+     ws = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable WS-RPC interface.";
+        };
+
+        address = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "Listening address for WS-RPC connections.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8546;
+          description = "Override the default port on which to listen for WS-RPC connections.";
+        };
+
+        api = mkOption {
+          type = types.str;
+          default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
+          description = "API's offered over the WS-RPC interface.";
+        };
+
+       origins = mkOption {
+          type = types.str;
+          default = "*";
+          description = "Origins from which to accept websockets requests";
+       };
+     };
+
+      genesis = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        example = literalExample '' {
+          alloc = {
+            a47385db68718bdcbddc2d2bb7c54018066ec111 = {
+              balance = "1000000000000000000000000000";
+            };
+          };
+          coinbase = "0x0000000000000000000000000000000000000000";
+          config = {
+            byzantiumBlock = 4;
+            chainId = 494702925;
+            eip150Block = 2;
+            eip155Block = 3;
+            eip158Block = 3;
+            homesteadBlock = 1;
+            isQuorum = true;
+            istanbul = {
+              epoch = 30000;
+              policy = 0;
+            };
+          };
+          difficulty = "0x1";
+          extraData = "0x0000000000000000000000000000000000000000000000000000000000000000f85ad59438f0508111273d8e482f49410ca4078afc86a961b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
+          gasLimit = "0x2FEFD800";
+          mixHash = "0x63746963616c2062797a616e74696e65201111756c7420746f6c6572616e6365";
+          nonce = "0x0";
+          parentHash = "0x0000000000000000000000000000000000000000000000000000000000000000";
+          timestamp = "0x00";
+          }'';
+        description = "Blockchain genesis settings.";
+      };
+     };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.quorum ];
+    systemd.tmpfiles.rules = [
+      "d '${dataDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    ];
+    systemd.services.quorum = {
+      description = "Quorum daemon";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        PRIVATE_CONFIG = "${cfg.privateconfig}";
+      };
+      preStart = ''
+        if [ ! -d ${dataDir}/geth ]; then
+          if [ ! -d ${dataDir}/keystore ]; then
+            echo ERROR: You need to create a wallet before initializing your genesis file, run:
+            echo   # su -s /bin/sh - quorum
+            echo   $ geth --datadir ${dataDir} account new
+            echo and configure your genesis file accordingly.
+            exit 1;
+          fi
+          ln -s ${staticNodesFile} ${dataDir}/static-nodes.json
+          ${pkgs.quorum}/bin/geth --datadir ${dataDir} init ${genesisFile}
+        fi
+      '';
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = ''${pkgs.quorum}/bin/geth \
+            --nodiscover \
+            --verbosity 5 \
+            --nodekey ${cfg.nodekeyFile} \
+            --istanbul.blockperiod ${toString cfg.blockperiod} \
+            --syncmode ${cfg.syncmode} \
+            ${optionalString (cfg.permissioned)
+            "--permissioned"} \
+            --mine --minerthreads 1 \
+            ${optionalString (cfg.rpc.enable)
+            "--rpc --rpcaddr ${cfg.rpc.address} --rpcport ${toString cfg.rpc.port} --rpcapi ${cfg.rpc.api}"} \
+            ${optionalString (cfg.ws.enable)
+            "--ws --wsaddr ${cfg.ws.address} --wsport ${toString cfg.ws.port} --wsapi ${cfg.ws.api} --wsorigins ${cfg.ws.origins}"} \
+            --emitcheckpoints \
+            --datadir ${dataDir} \
+            --port ${toString cfg.port}'';
+        Restart = "on-failure";
+
+        # Hardening measures
+        PrivateTmp = "true";
+        ProtectSystem = "full";
+        NoNewPrivileges = "true";
+        PrivateDevices = "true";
+        MemoryDenyWriteExecute = "true";
+      };
+    };
+    users.users.${cfg.user} = {
+      name = cfg.user;
+      group = cfg.group;
+      description = "Quorum daemon user";
+      home = dataDir;
+      isSystemUser = true;
+    };
+    users.groups.${cfg.group} = {};
+  };
+}
diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix
@@ -10,123 +10,193 @@ in
 
 {
 
-  options = {
-
-    boot.initrd.network.ssh.enable = mkOption {
+  options.boot.initrd.network.ssh = {
+    enable = mkOption {
       type = types.bool;
       default = false;
       description = ''
         Start SSH service during initrd boot. It can be used to debug failing
         boot on a remote server, enter pasphrase for an encrypted partition etc.
         Service is killed when stage-1 boot is finished.
+
+        The sshd configuration is largely inherited from
+        <option>services.openssh</option>.
       '';
     };
 
-    boot.initrd.network.ssh.port = mkOption {
+    port = mkOption {
       type = types.int;
       default = 22;
       description = ''
         Port on which SSH initrd service should listen.
       '';
     };
 
-    boot.initrd.network.ssh.shell = mkOption {
+    shell = mkOption {
       type = types.str;
       default = "/bin/ash";
       description = ''
         Login shell of the remote user. Can be used to limit actions user can do.
       '';
     };
 
-    boot.initrd.network.ssh.hostRSAKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        RSA SSH private key file in the Dropbear format.
-
-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
-      '';
-    };
-
-    boot.initrd.network.ssh.hostDSSKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
+    hostKeys = mkOption {
+      type = types.listOf (types.either types.str types.path);
+      default = [];
+      example = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
       description = ''
-        DSS SSH private key file in the Dropbear format.
-
-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
+        Specify SSH host keys to import into the initrd.
+
+        To generate keys, use
+        <citerefentry><refentrytitle>ssh-keygen</refentrytitle><manvolnum>1</manvolnum></citerefentry>:
+
+        <screen>
+        <prompt># </prompt>ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key
+        <prompt># </prompt>ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed_25519_key
+        </screen>
+
+        <warning>
+          <para>
+            Unless your bootloader supports initrd secrets, these keys
+            are stored insecurely in the global Nix store. Do NOT use
+            your regular SSH host private keys for this purpose or
+            you'll expose them to regular users!
+          </para>
+          <para>
+            Additionally, even if your initrd supports secrets, if
+            you're using initrd SSH to unlock an encrypted disk then
+            using your regular host keys exposes the private keys on
+            your unencrypted boot partition.
+          </para>
+        </warning>
       '';
     };
 
-    boot.initrd.network.ssh.hostECDSAKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        ECDSA SSH private key file in the Dropbear format.
-
-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
-      '';
-    };
-
-    boot.initrd.network.ssh.authorizedKeys = mkOption {
+    authorizedKeys = mkOption {
       type = types.listOf types.str;
       default = config.users.users.root.openssh.authorizedKeys.keys;
+      defaultText = "config.users.users.root.openssh.authorizedKeys.keys";
       description = ''
         Authorized keys for the root user on initrd.
-        Note that Dropbear doesn't support OpenSSH's Ed25519 key type.
       '';
     };
-
   };
 
-  config = mkIf (config.boot.initrd.network.enable && cfg.enable) {
+  imports =
+    map (opt: mkRemovedOptionModule ([ "boot" "initrd" "network" "ssh" ] ++ [ opt ]) ''
+      The initrd SSH functionality now uses OpenSSH rather than Dropbear.
+
+      If you want to keep your existing initrd SSH host keys, convert them with
+        $ dropbearconvert dropbear openssh dropbear_host_$type_key ssh_host_$type_key
+      and then set options.boot.initrd.network.ssh.hostKeys.
+    '') [ "hostRSAKey" "hostDSSKey" "hostECDSAKey" ];
+
+  config = let
+    # Nix complains if you include a store hash in initrd path names, so
+    # as an awful hack we drop the first character of the hash.
+    initrdKeyPath = path: if isString path
+      then path
+      else let name = builtins.baseNameOf path; in
+        builtins.unsafeDiscardStringContext ("/etc/ssh/" +
+          substring 1 (stringLength name) name);
+
+    sshdCfg = config.services.openssh;
+
+    sshdConfig = ''
+      Port ${toString cfg.port}
+
+      PasswordAuthentication no
+      ChallengeResponseAuthentication no
+
+      ${flip concatMapStrings cfg.hostKeys (path: ''
+        HostKey ${initrdKeyPath path}
+      '')}
+
+      KexAlgorithms ${concatStringsSep "," sshdCfg.kexAlgorithms}
+      Ciphers ${concatStringsSep "," sshdCfg.ciphers}
+      MACs ${concatStringsSep "," sshdCfg.macs}
+
+      LogLevel ${sshdCfg.logLevel}
+
+      ${if sshdCfg.useDns then ''
+        UseDNS yes
+      '' else ''
+        UseDNS no
+      ''}
+    '';
+  in mkIf (config.boot.initrd.network.enable && cfg.enable) {
     assertions = [
-      { assertion = cfg.authorizedKeys != [];
+      {
+        assertion = cfg.authorizedKeys != [];
         message = "You should specify at least one authorized key for initrd SSH";
       }
+
+      {
+        assertion = cfg.hostKeys != [];
+        message = ''
+          You must now pre-generate the host keys for initrd SSH.
+          See the boot.inird.network.ssh.hostKeys documentation
+          for instructions.
+        '';
+      }
     ];
 
     boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.dropbear}/bin/dropbear
+      copy_bin_and_libs ${pkgs.openssh}/bin/sshd
       cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib
     '';
 
     boot.initrd.extraUtilsCommandsTest = ''
-      $out/bin/dropbear -V
+      # sshd requires a host key to check config, so we pass in the test's
+      echo -n ${escapeShellArg sshdConfig} |
+        $out/bin/sshd -t -f /dev/stdin \
+        -h ${../../../tests/initrd-network-ssh/ssh_host_ed25519_key}
     '';
 
     boot.initrd.network.postCommands = ''
       echo '${cfg.shell}' > /etc/shells
       echo 'root:x:0:0:root:/root:${cfg.shell}' > /etc/passwd
+      echo 'sshd:x:1:1:sshd:/var/empty:/bin/nologin' >> /etc/passwd
       echo 'passwd: files' > /etc/nsswitch.conf
 
-      mkdir -p /var/log
+      mkdir -p /var/log /var/empty
       touch /var/log/lastlog
 
-      mkdir -p /etc/dropbear
+      mkdir -p /etc/ssh
+      echo -n ${escapeShellArg sshdConfig} > /etc/ssh/sshd_config
+
+      echo "export PATH=$PATH" >> /etc/profile
+      echo "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH" >> /etc/profile
 
       mkdir -p /root/.ssh
       ${concatStrings (map (key: ''
         echo ${escapeShellArg key} >> /root/.ssh/authorized_keys
       '') cfg.authorizedKeys)}
 
-      dropbear -s -j -k -E -p ${toString cfg.port} ${optionalString (cfg.hostRSAKey == null && cfg.hostDSSKey == null && cfg.hostECDSAKey == null) "-R"}
+      ${flip concatMapStrings cfg.hostKeys (path: ''
+        # keys from Nix store are world-readable, which sshd doesn't like
+        chmod 0600 "${initrdKeyPath path}"
+      '')}
+
+      /bin/sshd -e
     '';
 
-    boot.initrd.secrets =
-     (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //
-     (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //
-     (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });
+    boot.initrd.postMountCommands = ''
+      # Stop sshd cleanly before stage 2.
+      #
+      # If you want to keep it around to debug post-mount SSH issues,
+      # run `touch /.keep_sshd` (either from an SSH session or in
+      # another initrd hook like preDeviceCommands).
+      if ! [ -e /.keep_sshd ]; then
+        pkill -x sshd
+      fi
+    '';
 
+    boot.initrd.secrets = listToAttrs
+      (map (path: nameValuePair (initrdKeyPath path) path) cfg.hostKeys);
   };
 
 }
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
@@ -142,7 +142,10 @@ let
              let source' = if source == null then dest else source; in
                ''
                   mkdir -p $(dirname "$out/secrets/${dest}")
-                  cp -a ${source'} "$out/secrets/${dest}"
+                  # Some programs (e.g. ssh) doesn't like secrets to be
+                  # symlinks, so we use `cp -L` here to match the
+                  # behaviour when secrets are natively supported.
+                  cp -Lr ${source'} "$out/secrets/${dest}"
                 ''
           ) config.boot.initrd.secrets))
        }

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
@@ -252,6 +252,7 @@ in
   prosodyMysql = handleTest ./xmpp/prosody-mysql.nix {};
   proxy = handleTest ./proxy.nix {};
   quagga = handleTest ./quagga.nix {};
+  quorum = handleTest ./quorum.nix {};
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
   radicale = handleTest ./radicale.nix {};

diff --git a/nixos/tests/initrd-network-ssh/default.nix b/nixos/tests/initrd-network-ssh/default.nix
@@ -3,7 +3,7 @@ import ../make-test-python.nix ({ lib, ... }:
 {
   name = "initrd-network-ssh";
   meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
+    maintainers = [ willibutz emily ];
   };
 
   nodes = with lib; {
@@ -17,9 +17,9 @@ import ../make-test-python.nix ({ lib, ... }:
           enable = true;
           ssh = {
             enable = true;
-            authorizedKeys = [ "${readFile ./openssh.pub}" ];
+            authorizedKeys = [ (readFile ./id_ed25519.pub) ];
             port = 22;
-            hostRSAKey = ./dropbear.priv;
+            hostKeys = [ ./ssh_host_ed25519_key ];
           };
         };
         boot.initrd.preLVMCommands = ''
@@ -42,11 +42,11 @@ import ../make-test-python.nix ({ lib, ... }:
               "${toString (head (splitString " " (
                 toString (elemAt (splitString "\n" config.networking.extraHosts) 2)
               )))} "
-              "${readFile ./dropbear.pub}"
+              "${readFile ./ssh_host_ed25519_key.pub}"
             ];
           };
           sshKey = {
-            source = ./openssh.priv; # dont use this anywhere else
+            source = ./id_ed25519;
             mode = "0600";
           };
         };
@@ -56,7 +56,17 @@ import ../make-test-python.nix ({ lib, ... }:
   testScript = ''
     start_all()
     client.wait_for_unit("network.target")
-    client.wait_until_succeeds("ping -c 1 server")
+
+
+    def ssh_is_up(_) -> bool:
+        status, _ = client.execute("nc -z server 22")
+        return status == 0
+
+
+    with client.nested("waiting for SSH server to come up"):
+        retry(ssh_is_up)
+
+
     client.succeed(
         "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'touch /fnord'"
     )

diff --git a/nixos/tests/initrd-network-ssh/dropbear.priv b/nixos/tests/initrd-network-ssh/dropbear.priv
diff --git a/nixos/tests/initrd-network-ssh/dropbear.pub b/nixos/tests/initrd-network-ssh/dropbear.pub
diff --git a/nixos/tests/initrd-network-ssh/generate-keys.nix b/nixos/tests/initrd-network-ssh/generate-keys.nix
@@ -1,12 +1,10 @@
 with import ../../.. {};
 
 runCommand "gen-keys" {
-    buildInputs = [ dropbear openssh ];
+    buildInputs = [ openssh ];
   }
   ''
     mkdir $out
-    dropbearkey -t rsa -f $out/dropbear.priv -s 4096 | sed -n 2p > $out/dropbear.pub
-    ssh-keygen -q -t rsa -b 4096 -N "" -f client
-    mv client $out/openssh.priv
-    mv client.pub $out/openssh.pub
+    ssh-keygen -q -t ed25519 -N "" -f $out/ssh_host_ed25519_key
+    ssh-keygen -q -t ed25519 -N "" -f $out/id_ed25519
   ''
diff --git a/nixos/tests/initrd-network-ssh/id_ed25519 b/nixos/tests/initrd-network-ssh/id_ed25519
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfwAAAJi/AJZMvwCW
+TAAAAAtzc2gtZWQyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfw
+AAAEAPLjQusjrB90Lk3996G3AbtTeK+XweNgxaegYnml/A/RVxf7fZiqKDblHFEDxt6X9/
+rTjBXSn/re6b46S7/e9/AAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/nixos/tests/initrd-network-ssh/id_ed25519.pub b/nixos/tests/initrd-network-ssh/id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/ nixbld@localhost
diff --git a/nixos/tests/initrd-network-ssh/openssh.priv b/nixos/tests/initrd-network-ssh/openssh.priv
diff --git a/nixos/tests/initrd-network-ssh/openssh.pub b/nixos/tests/initrd-network-ssh/openssh.pub
diff --git a/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key b/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIAAAAJg0WGFGNFhh
+RgAAAAtzc2gtZWQyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIA
+AAAEA0Hjs7LfFPdTf3ThGx6GNKvX0ItgzgXs91Z3oGIaF6S8/0zPqqXF1CoDiiauBs6VWz
+FIY40Imy2Nb3Oqq5qOUgAAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub b/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost
diff --git a/nixos/tests/quorum.nix b/nixos/tests/quorum.nix
@@ -0,0 +1,79 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "quorum";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.quorum = {
+        enable = true;
+        permissioned = false;
+        staticNodes = [ "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0" ];
+        genesis = {
+          alloc = {
+            "189d23d201b03ae1cf9113672df29a5d672aefa3" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "44b07d2c28b8ed8f02b45bd84ac7d9051b3349e6" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "4c1ccd426833b9782729a212c857f2f03b7b4c0d" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "7ae555d0f6faad7930434abdaac2274fd86ab516" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            c1056df7c02b6f1a353052eaf0533cc7cb743b52 = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+          };
+          coinbase = "0x0000000000000000000000000000000000000000";
+          config = {
+            byzantiumBlock = 1;
+            chainId = 10;
+            eip150Block = 1;
+            eip150Hash =
+              "0x0000000000000000000000000000000000000000000000000000000000000000";
+            eip155Block = 1;
+            eip158Block = 1;
+            isQuorum = true;
+            istanbul = {
+              epoch = 30000;
+              policy = 0;
+            };
+          };
+        difficulty = "0x1";
+        extraData =
+          "0x0000000000000000000000000000000000000000000000000000000000000000f8aff869944c1ccd426833b9782729a212c857f2f03b7b4c0d94189d23d201b03ae1cf9113672df29a5d672aefa39444b07d2c28b8ed8f02b45bd84ac7d9051b3349e694c1056df7c02b6f1a353052eaf0533cc7cb743b52947ae555d0f6faad7930434abdaac2274fd86ab516b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
+        gasLimit = "0xe0000000";
+        gasUsed = "0x0";
+        mixHash =
+          "0x63746963616c2062797a616e74696e65206661756c7420746f6c6572616e6365";
+        nonce = "0x0";
+        number = "0x0";
+        parentHash =
+          "0x0000000000000000000000000000000000000000000000000000000000000000";
+        timestamp = "0x5cffc201";
+		  };
+     };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("mkdir -p /var/lib/quorum/keystore")
+    machine.wait_until_succeeds(
+        'echo \{\\"address\\":\\"9377bc3936de934c497e22917b81aa8774ac3bb0\\",\\"crypto\\":\{\\"cipher\\":\\"aes-128-ctr\\",\\"ciphertext\\":\\"ad8341d8ef225650403fd366c955f41095e438dd966a3c84b3d406818c1e366c\\",\\"cipherparams\\":\{\\"iv\\":\\"2a09f7a72fd6dff7c43150ff437e6ac2\\"\},\\"kdf\\":\\"scrypt\\",\\"kdfparams\\":\{\\"dklen\\":32,\\"n\\":262144,\\"p\\":1,\\"r\\":8,\\"salt\\":\\"d1a153845bb80cd6274c87c5bac8ac09fdfac5ff131a6f41b5ed319667f12027\\"\},\\"mac\\":\\"a9621ad88fa1d042acca6fc2fcd711f7e05bfbadea3f30f379235570c8e270d3\\"\},\\"id\\":\\"89e847a3-1527-42f6-a321-77de0a14ce02\\",\\"version\\":3\}\\" > /var/lib/quorum/keystore/UTC--2020-03-23T11-08-34.144812212Z--9377bc3936de934c497e22917b81aa8774ac3bb0'
+    )
+    machine.wait_until_succeeds(
+        "echo fe2725c4e8f7617764b845e8d939a65c664e7956eb47ed7d934573f16488efc1 > /var/lib/quorum/nodekey"
+    )
+    machine.wait_until_succeeds("systemctl restart quorum")
+    machine.wait_for_unit("quorum.service")
+    machine.sleep(15)
+    machine.wait_until_succeeds(
+        'geth attach /var/lib/quorum/geth.ipc --exec "eth.accounts" | grep 0x9377bc3936de934c497e22917b81aa8774ac3bb0'
+    )
+  '';
+})
diff --git a/pkgs/applications/blockchains/go-ethereum.nix b/pkgs/applications/blockchains/go-ethereum.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit, CoreServices }:
+{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit }:
 
 buildGoModule rec {
   pname = "go-ethereum";
@@ -30,8 +30,6 @@ buildGoModule rec {
     "cmd/wnode"
   ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
-
   # Fix for usb-related segmentation faults on darwin
   propagatedBuildInputs =
     stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];

diff --git a/pkgs/applications/blockchains/lnd.nix b/pkgs/applications/blockchains/lnd.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "lnd";
@@ -13,12 +13,10 @@ buildGoModule rec {
 
   modSha256 = "1pvcvpiz6ck8xkgpypchrq9kgkik0jxd7f3jhihbgldsh4zaqiaq";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Lightning Network Daemon";
     homepage = "https://github.com/lightningnetwork/lnd";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     maintainers = with maintainers; [ cypherpunk2140 ];
   };
 }
diff --git a/pkgs/applications/editors/glow/default.nix b/pkgs/applications/editors/glow/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "glow";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "0r0yq7kgz7i1wf4gxxihdrn1c8mi4wcyhadncxbln24s9c5apxsf";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = [ "-ldflags=" "-X=main.Version=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Render markdown on the CLI";
     homepage = "https://github.com/charmbracelet/glow";
     license = licenses.mit;

diff --git a/pkgs/applications/misc/archiver/default.nix b/pkgs/applications/misc/archiver/default.nix
@@ -1,7 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
-, Security
+, lib
 }:
 
 buildGoModule rec {
@@ -17,9 +16,7 @@ buildGoModule rec {
 
   modSha256 = "1mrfqhd0zb78rlqlj2ncb0srwjfl7rzhy2p9mwa82pgysvlp08gv";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Easily create & extract archives, and compress & decompress files of various formats";
     homepage = "https://github.com/mholt/archiver";
     license = licenses.mit;

diff --git a/pkgs/applications/misc/exercism/default.nix b/pkgs/applications/misc/exercism/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "exercism";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0pg0hxrr6jjd03wbjn5y65x02md3h352mnm1gr6vyiv7hn4ws14m";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "./exercism" ];
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/misc/geoipupdate/default.nix b/pkgs/applications/misc/geoipupdate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "geoipupdate";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "1bypanvrkcqp8rk84cv2569671irgaf3cy27lcrknyina4pdvir5";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Automatic GeoIP database updater";
     homepage = "https://github.com/maxmind/geoipupdate";

diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
@@ -1,9 +1,11 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "hugo";
   version = "0.68.3";
 
+  goPackagePath = "github.com/gohugoio/hugo";
+
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
@@ -13,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "04vzm65kbj9905z4cf5yh6yc6g3b0pd5vc00lrxw84pwgqgc0ykb";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlags = [ "-tags" "extended" ];
 
   subPackages = [ "." ];

diff --git a/pkgs/applications/misc/todoist/default.nix b/pkgs/applications/misc/todoist/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "todoist";
@@ -13,12 +13,10 @@ buildGoModule rec {
 
   modSha256 = "1nnp5ijz4n34gc97rar4wlvlbx21ndpjyb2mc6gxdk1wzx3mgswp";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = {
     homepage = https://github.com/sachaos/todoist;
     description = "Todoist CLI Client";
-    license = licenses.mit;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/wtf/default.nix b/pkgs/applications/misc/wtf/default.nix
@@ -1,9 +1,8 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib
 , makeWrapper
 , ncurses
-, Security
 }:
 
 buildGoModule rec {
@@ -25,14 +24,12 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   postInstall = ''
     mv "$out/bin/wtf" "$out/bin/wtfutil"
     wrapProgram "$out/bin/wtfutil" --prefix PATH : "${ncurses.dev}/bin"
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The personal information dashboard for your terminal";
     homepage = "https://wtfutil.com/";
     license = licenses.mpl20;

diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, buildGoPackage, fetchFromGitHub, Security }:
+{ lib, buildGoModule, buildGoPackage, fetchFromGitHub }:
 
 let
   # Argo can package a static server in the CLI using the `staticfiles` go module.
@@ -32,16 +32,14 @@ buildGoModule rec {
 
   subPackages = [ "cmd/argo" ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   preBuild = ''
     mkdir -p ui/dist/app
     echo "Built without static files" > ui/dist/app/index.html
 
     ${staticfiles}/bin/staticfiles -o server/static/files.go ui/dist/app
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Container native workflow engine for Kubernetes";
     homepage = https://github.com/argoproj/argo;
     license = licenses.asl20;

diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, packr, Security }:
+{ lib, buildGoModule, fetchFromGitHub, packr }:
 
 buildGoModule rec {
   pname = "argocd";
@@ -16,8 +16,6 @@ buildGoModule rec {
 
   nativeBuildInputs = [ packr ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   patches = [ ./use-go-module.patch ];
 
   buildFlagsArray = ''
@@ -33,7 +31,7 @@ buildGoModule rec {
     packr
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes";
     homepage = "https://github.com/argoproj/argo";
     license = licenses.asl20;

diff --git a/pkgs/applications/networking/cluster/atlantis/default.nix b/pkgs/applications/networking/cluster/atlantis/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "atlantis";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     homepage = "https://github.com/runatlantis/atlantis";
     description = "Terraform Pull Request Automation";

diff --git a/pkgs/applications/networking/cluster/fluxctl/default.nix b/pkgs/applications/networking/cluster/fluxctl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "fluxctl";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0ij5q31a0818nmqsdql1ii6rhq6nb0liplnw509qih8py7dk5xkg";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cmd/fluxctl" ];
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "helm";
@@ -16,9 +16,6 @@ buildGoModule rec {
   buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.version=v${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
-
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   postInstall = ''
     $out/bin/helm completion bash > helm.bash
     $out/bin/helm completion zsh > helm.zsh

diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -1,8 +1,10 @@
-{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, Security }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, kubernetes-helm, ... }:
 
-buildGoModule rec {
+let version = "0.102.0"; in
+
+buildGoModule {
   pname = "helmfile";
-  version = "0.102.0";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "roboll";
@@ -11,27 +13,27 @@ buildGoModule rec {
     sha256 = "0v7mhsnhswiqd62wrmkcpzsg9nfi6wvkh9danngs5rqjiz1zffhy";
   };
 
+  goPackagePath = "github.com/roboll/helmfile";
+
   modSha256 = "0s7j7jbgr8gdc0s9dnl6zjwkpywqj05xyb7mkcank54kgrz0g5vq";
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = ''
     -ldflags=
     -X main.Version=${version}
   '';
 
   postInstall = ''
     wrapProgram $out/bin/helmfile \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ kubernetes-helm ]}
+      --prefix PATH : ${lib.makeBinPath [ kubernetes-helm ]}
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "Deploy Kubernetes Helm charts";
     homepage = "https://github.com/roboll/helmfile";
-    license = licenses.mit;
-    maintainers = with maintainers; [ pneumaticat yurrriq ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pneumaticat yurrriq ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/hetzner-kube/default.nix b/pkgs/applications/networking/cluster/hetzner-kube/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "hetzner-kube";
@@ -13,18 +13,16 @@ buildGoModule rec {
 
   modSha256 = "0jjrk93wdi13wrb5gchhqk7rgwm74kcizrbqsibgkgs2dszwfazh";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = ''
     -ldflags=
     -X github.com/xetys/hetzner-kube/cmd.version=${version}
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "A CLI tool for provisioning Kubernetes clusters on Hetzner Cloud";
     homepage = "https://github.com/xetys/hetzner-kube";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ eliasp ];
-    platforms = platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ eliasp ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/cluster/jx/default.nix b/pkgs/applications/networking/cluster/jx/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   name = "jx";
@@ -16,8 +16,6 @@ buildGoModule rec {
     ./3321-fix-location-of-thrift.patch
   ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   modSha256 = "0ljf0c0c3pc12nmhdbrwflcaj6hs8igzjw5hi6fyhi6n9cy87vac";
 
   subPackages = [ "cmd/jx" ];
@@ -28,7 +26,7 @@ buildGoModule rec {
     -X github.com/jenkins-x/jx/pkg/version.Revision=${version}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "JX is a command line tool for installing and using Jenkins X.";
     homepage = https://jenkins-x.io;
     longDescription = ''

diff --git a/pkgs/applications/networking/cluster/k9s/default.nix b/pkgs/applications/networking/cluster/k9s/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "k9s";
@@ -22,8 +22,6 @@ buildGoModule rec {
 
   modSha256 = "06m4xgl29zx6zpqx630m9cm52wmljms9cvly5f4pqdb4zicq7n86";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Kubernetes CLI To Manage Your Clusters In Style.";
     homepage = "https://github.com/derailed/k9s";

diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "kubeseal";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cmd/kubeseal" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A Kubernetes controller and tool for one-way encrypted Secrets";
     homepage = "https://github.com/bitnami-labs/sealed-secrets";
     license = licenses.asl20;

diff --git a/pkgs/applications/networking/cluster/kubeval/default.nix b/pkgs/applications/networking/cluster/kubeval/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, lib, fetchFromGitHub, buildGoModule, makeWrapper }:
 
 buildGoModule rec {
   pname = "kubeval";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "0y9x44y3bchi8xg0a6jmp2rmi8dybkl6qlywb6nj1viab1s8dd4y";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Validate your Kubernetes configuration files";
     homepage = https://github.com/instrumenta/kubeval;
     license = licenses.asl20;

diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 
 buildGoModule {
   pname = "linkerd-unstablle";
@@ -13,8 +13,6 @@ buildGoModule {
 
   modSha256 = "0gahhywpcj16ww4l8s3wjwvavq24fpy258snhyf94ipy6lb797sl";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cli/cmd" ];
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -6,10 +6,6 @@
 , go-bindata
 , libvirt
 , vmnet
-, xpc
-, libobjc
-, Foundation
-, IOKit
 }:
 
 buildGoModule rec {
@@ -31,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ libvirt ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ vmnet xpc libobjc IOKit Foundation ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ vmnet ];
 
   preBuild = ''
     go-bindata -nomemcopy -o pkg/minikube/assets/assets.go -pkg assets deploy/addons/...

diff --git a/pkgs/applications/networking/cluster/prow/default.nix b/pkgs/applications/networking/cluster/prow/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "prow-unstable";
@@ -20,8 +20,6 @@ buildGoModule rec {
 
   modSha256 = "06q1zvhm78k64aj475k1xl38h7nk83mysd0bja0wknja048ymgsq";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [
     "./prow/cmd/admission"
     "./prow/cmd/artifact-uploader"
@@ -56,7 +54,7 @@ buildGoModule rec {
     "./prow/cmd/tot"
   ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Prow is a Kubernetes based CI/CD system";
     longDescription = ''
       Prow is a Kubernetes based CI/CD system. Jobs can be triggered by various

diff --git a/pkgs/applications/networking/cluster/qbec/default.nix b/pkgs/applications/networking/cluster/qbec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "qbec";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "165zqmannlylkzaz9gkmcrlyx8rfhz70ahzhiks4ycgq1qxr0av9";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Configure kubernetes objects on multiple clusters using jsonnet https://qbec.io";
     homepage = "https://github.com/splunk/qbec";
     license = licenses.asl20;

diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -2,7 +2,6 @@
 , buildGoPackage
 , fetchFromGitHub
 , callPackage
-, Security
 }:
 let
   list = import ./data.nix;
@@ -24,9 +23,7 @@ let
     };
 in
   {
-    elasticsearch = callPackage ./elasticsearch {
-     inherit Security;
-    };
+    elasticsearch = callPackage ./elasticsearch {};
     gandi = callPackage ./gandi {};
     ibm = callPackage ./ibm {};
     libvirt = callPackage ./libvirt {};

diff --git a/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix b/pkgs/applications/networking/cluster/terraform-providers/elasticsearch/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 buildGoModule rec {
   pname = "terraform-provider-elasticsearch";
   version = "0.7.0";
@@ -12,8 +12,6 @@ buildGoModule rec {
 
   modSha256 = "1xk21xswqwpv34j4ba4fj8lcbvfdd12x7rq1hrdyd21mdhmrhw0p";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
   # Terraform allow checking the provider versions, but this breaks

diff --git a/pkgs/applications/networking/hydroxide/default.nix b/pkgs/applications/networking/hydroxide/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, fetchpatch, Security }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
 buildGoModule rec {
   pname = "hydroxide";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0b19rcif8yiyvhrsjd3q5nsvr580lklamlphx4dk47n456ckcqfp";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   # FIXME: remove with next release
   patches = [
     (fetchpatch {
@@ -25,7 +23,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/hydroxide" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A third-party, open-source ProtonMail bridge";
     homepage = "https://github.com/emersion/hydroxide";
     license = licenses.mit;

diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -1,47 +1,120 @@
-{ stdenv, fetchurl, rpmextract, patchelf, libnotify, libcap, cairo, pango, fontconfig, udev, dbus
-, gtk2, atk, expat, gdk-pixbuf, freetype, nspr, glib, nss, gconf, libX11, libXrender, libXtst, libXdamage
-, libXi, libXext, libXfixes, libXcomposite, alsaLib, bash
+{ stdenv
+, fetchurl
+, rpmextract
+, patchelf
+, patchelfUnstable
+, libnotify
+, libuuid
+, cairo
+, cups
+, pango
+, fontconfig
+, udev
+, dbus
+, gtk3
+, atk
+, at-spi2-atk
+, expat
+, gdk-pixbuf
+, freetype
+, nspr
+, glib
+, nss
+, libX11
+, libXrandr
+, libXrender
+, libXtst
+, libXdamage
+, libxcb
+, libXcursor
+, libXi
+, libXext
+, libXfixes
+, libXft
+, libXcomposite
+, libXScrnSaver
+, alsaLib
+, pulseaudio
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "1.36.9";
+  version = "2.1.0";
 
-  src =
-    fetchurl {
-      url = "https://swdl.bluejeans.com/desktop/linux/1.36/${version}/bluejeans-${version}.x86_64.rpm";
-      sha256 = "0sbv742pzqd2cxn3kq10lfi16jah486i9kyrmi8l1rpb9fhyw2m1";
-    };
+  src = fetchurl {
+    url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
+    sha256 = "1zhh0pla5gk75p8x84va9flvnk456pbcm1n6x8l82c9682fwr7dd";
+  };
 
-  nativeBuildInputs = [ patchelf rpmextract ];
+  nativeBuildInputs = [ rpmextract makeWrapper ];
 
   libPath =
     stdenv.lib.makeLibraryPath
-       [ libnotify libcap cairo pango fontconfig gtk2 atk expat gdk-pixbuf dbus udev.lib
-         freetype nspr glib stdenv.cc stdenv.cc.cc.lib nss gconf libX11 libXrender libXtst libXdamage
-         libXi libXext libXfixes libXcomposite alsaLib
-       ];
+      [
+        libnotify
+        libuuid
+        cairo
+        cups
+        pango
+        fontconfig
+        gtk3
+        atk
+        at-spi2-atk
+        expat
+        gdk-pixbuf
+        dbus
+        udev.lib
+        freetype
+        nspr
+        glib
+        stdenv.cc.cc.lib
+        nss
+        libX11
+        libXrandr
+        libXrender
+        libXtst
+        libXdamage
+        libxcb
+        libXcursor
+        libXi
+        libXext
+        libXfixes
+        libXft
+        libXcomposite
+        libXScrnSaver
+        alsaLib
+        pulseaudio
+      ];
+
+  localtime64_stub = ./localtime64_stub.c;
 
   buildCommand = ''
     mkdir -p $out/bin/
     cd $out
     rpmextract $src
-    patchelf \
+    mv usr/share share
+    rmdir usr
+
+    ${patchelf}/bin/patchelf \
       --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      opt/bluejeans/bluejeans-bin
-    patchelf \
-      --set-rpath ${libPath} \
-      opt/bluejeans/bluejeans-bin
-    patchelf \
       --replace-needed libudev.so.0 libudev.so.1 \
-      opt/bluejeans/bluejeans-bin
-    ln -s $out/opt/bluejeans/bluejeans $out/bin/bluejeans
-    chmod +x $out/bin/bluejeans
-    patchShebangs $out
+      opt/BlueJeans/bluejeans-v2
+    ${patchelfUnstable}/bin/patchelf \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      opt/BlueJeans/resources/BluejeansHelper
+
+    cc $localtime64_stub -shared -o "$out"/opt/BlueJeans/liblocaltime64_stub.so
+
+    makeWrapper $out/opt/BlueJeans/bluejeans-v2 $out/bin/bluejeans \
+      --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
+      --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so
+
+    patchShebangs "$out"
   '';
 
   meta = with stdenv.lib; {
-    description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day.";
+    description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day";
     homepage = "https://www.bluejeans.com";
     license = licenses.unfree;
     maintainers = with maintainers; [ veprbl ];

diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c b/pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c
@@ -0,0 +1,12 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+void *localtime64() {
+  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
+  abort();
+}
+
+void *localtime64_r() {
+  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
+  abort();
+}
diff --git a/pkgs/applications/networking/instant-messengers/gomuks/default.nix b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "gomuks";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "03vbrh50pvx71rp6c23qc2sh0ir4jm1wl0gvi3z1c14ndzhsqky4";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     homepage = "https://maunium.net/go/gomuks/";
     description = "A terminal based Matrix client written in Go";

diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub, fetchgx, gx-go }:
 
 buildGoModule rec {
   pname = "ipfs-cluster";
@@ -14,8 +14,6 @@ buildGoModule rec {
     sha256 = "1jh6ynj50jd4w79widaqrgm3h3yz5h03vq0lbsx717a8d9073blh";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Allocate, replicate, and track Pins across a cluster of IPFS daemons";
     homepage = https://cluster.ipfs.io/;
@@ -24,3 +22,4 @@ buildGoModule rec {
     maintainers = with maintainers; [ jglukasik ];
   };
 }
+
diff --git a/pkgs/applications/networking/ipfs/default.nix b/pkgs/applications/networking/ipfs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "ipfs";
@@ -18,8 +18,6 @@ buildGoModule rec {
 
   modSha256 = "12m4ind1s8zaa6kssblc28z2cafy20w2jp80kzif39hg5ar9bijm";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "A global, versioned, peer-to-peer filesystem";
     homepage = https://ipfs.io/;

diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildGoModule, fetchurl
 , go, ncurses, notmuch, scdoc
-, python3, perl, w3m, dante, Security
+, python3, perl, w3m, dante
 }:
 
 let
@@ -29,8 +29,7 @@ in buildGoModule rec {
     python3.pkgs.colorama
   ];
 
-  buildInputs = [ python3 notmuch ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [ python3 notmuch ];
 
   GOFLAGS="-tags=notmuch";
 

diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, stdenv, lib, procps, fetchFromGitHub, libobjc, CoreServices, Foundation }:
+{ buildGoModule, stdenv, lib, procps, fetchFromGitHub }:
 
 let
   common = { stname, target, postInstall ? "" }:
@@ -15,8 +15,6 @@ let
 
       modSha256 = "1qq0979cm42wd3scy3blyi0hg67mkghis9r5rn2x1lqi2b982wfh";
 
-      buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc CoreServices Foundation ];
-
       patches = [
         ./add-stcli-target.patch
       ];

diff --git a/pkgs/applications/networking/websocketd/default.nix b/pkgs/applications/networking/websocketd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "websocketd";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "18hamj557ln8k3vmvcrpvnydjr1dy7zi9490iacwdldw5vp870xs";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Turn any program that uses STDIN/STDOUT into a WebSocket server";
     homepage = "http://websocketd.com/";
     maintainers = [ maintainers.bjornfor ];

diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -34,9 +34,7 @@ let
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  ghq = callPackage ./ghq {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  ghq = callPackage ./ghq { };
 
   git = appendToName "minimal" gitBase;
 
@@ -67,9 +65,7 @@ let
 
   git-appraise = callPackage ./git-appraise {};
 
-  git-bug = callPackage ./git-bug {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  git-bug = callPackage ./git-bug { };
 
   # support for bugzilla
   git-bz = callPackage ./git-bz { };
@@ -140,9 +136,7 @@ let
 
   git-subrepo = callPackage ./git-subrepo { };
 
-  git-subtrac = callPackage ./git-subtrac {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  git-subtrac = callPackage ./git-subtrac { };
 
   git-sync = callPackage ./git-sync { };
 
@@ -183,13 +177,9 @@ let
     inherit (darwin) Security;
   };
 
-  lab = callPackage ./lab {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  lab = callPackage ./lab { };
 
-  lefthook = callPackage ./lefthook {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  lefthook = callPackage ./lefthook { };
 
   pass-git-helper = python3Packages.callPackage ./pass-git-helper { };
 

diff --git a/pkgs/applications/version-management/git-and-tools/ghq/default.nix b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "ghq";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0hlbhky3c6zva9khn73n6xgq57k5p8anskxy3g2m0wzhr72cyc41";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = ''
     -ldflags=
       -X=main.Version=${version}

diff --git a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "git-bug";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "1cfn49cijiarzzczrpd28x1k7ib98xyzlvn3zghwk2ngfgiah3ld";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = ''
     -ldflags= 
       -X ${goPackagePath}/commands.GitCommit=${rev}

diff --git a/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix b/pkgs/applications/version-management/git-and-tools/git-subtrac/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "git-subtrac";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "147vzllp1gydk2156hif313vwykagrj35vaiqy1swqczxs7p9hhs";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Keep the content for your git submodules all in one place: the parent repo";
     homepage = "https://github.com/apenwarr/git-subtrac";
     license = licenses.asl20;

diff --git a/pkgs/applications/version-management/git-and-tools/lab/default.nix b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "lab";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "03fqa7s6729g0a6ffiyc61dkldpi7vg8pvvpqak4c0mqi1dycivd";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
   postInstall = ''

diff --git a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "lefthook";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0ih11gw2y9dhv3zw1fzjmdfjln5h6zg1bj7sl68cglf6743siqnq";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Fast and powerful Git hooks manager for any type of projects";
     homepage = "https://github.com/Arkweid/lefthook";

diff --git a/pkgs/development/compilers/go/1.12.nix b/pkgs/development/compilers/go/1.12.nix
@@ -43,8 +43,7 @@ stdenv.mkDerivation rec {
     ++ optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-
-  propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
 

diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
@@ -43,8 +43,7 @@ stdenv.mkDerivation rec {
     ++ optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-
-  propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
 

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
@@ -43,8 +43,7 @@ stdenv.mkDerivation rec {
     ++ optionals stdenv.isLinux [ stdenv.cc.libc.out ]
     ++ optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
 
-
-  propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
+  depsTargetTargetPropagated = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
 

diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pcre ];
-  propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
+  depsTargetTargetPropagated = lib.optional stdenv.isDarwin Security;
 
   hardeningDisable = [ "all" ];
 

diff --git a/pkgs/development/interpreters/joker/default.nix b/pkgs/development/interpreters/joker/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "joker";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "0i16vf7n1xfz5kp9w3fvyc9y9wgz4h396glgpdaznpxjr12rb43j";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   preBuild = ''
     go generate ./...
   '';

diff --git a/pkgs/development/libraries/loadcaffe/default.nix b/pkgs/development/libraries/loadcaffe/default.nix
diff --git a/pkgs/development/libraries/packr/default.nix b/pkgs/development/libraries/packr/default.nix
@@ -1,7 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
-, Security
+, lib
 }:
 
 buildGoModule rec {
@@ -17,11 +16,9 @@ buildGoModule rec {
 
   subPackages = [ "packr" "v2/packr2" ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   modSha256 = "0afhkvivma16bi8rz3kwcsz9mhmcn4zm6rrymxkvazx6b844hcdv";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The simple and easy way to embed static files into Go binaries";
     homepage = "https://github.com/gobuffalo/packr";
     license = licenses.mit;

diff --git a/pkgs/development/libraries/torch-hdf5/default.nix b/pkgs/development/libraries/torch-hdf5/default.nix
diff --git a/pkgs/development/libraries/torch/default.nix b/pkgs/development/libraries/torch/default.nix
diff --git a/pkgs/development/node-packages/generate.sh b/pkgs/development/node-packages/generate.sh
@@ -1,11 +1,11 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -p nodePackages.node2nix -i bash
+#!/usr/bin/env bash
 set -eu -o pipefail
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+node2nix=$(nix-build ../../.. --no-out-link -A nodePackages.node2nix)
 
 cd ${DIR}
 rm -f ./node-env.nix
 for version in 10 12 13; do
-  node2nix --nodejs-$version -i node-packages-v$version.json -o node-packages-v$version.nix -c composition-v$version.nix
+  "${node2nix}/bin/node2nix" --nodejs-$version -i node-packages-v$version.json -o node-packages-v$version.nix -c composition-v$version.nix
 done
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -134,37 +134,36 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
+    substituteInPlace setup.py \
+      --replace "flask>=1.1.0, <2.0" "flask" \
+      --replace "jinja2>=2.10.1, <2.11.0" "jinja2" \
+      --replace "pandas>=0.17.1, <1.0.0" "pandas" \
+      --replace "flask-caching>=1.3.3, <1.4.0" "flask-caching" \
+      --replace "flask-appbuilder>=1.12.5, <2.0.0" "flask-appbuilder" \
+      --replace "pendulum==1.4.4" "pendulum" \
+      --replace "cached_property~=1.5" "cached_property" \
+      --replace "dill>=0.2.2, <0.3" "dill" \
+      --replace "configparser>=3.5.0, <3.6.0" "configparser" \
+      --replace "jinja2>=2.7.3, <=2.10.0" "jinja2" \
+      --replace "funcsigs==1.0.0" "funcsigs" \
+      --replace "flask-swagger==0.2.13" "flask-swagger" \
+      --replace "python-daemon>=2.1.1, <2.2" "python-daemon" \
+      --replace "alembic>=0.9, <1.0" "alembic" \
+      --replace "markdown>=2.5.2, <3.0" "markdown" \
+      --replace "future>=0.16.0, <0.17" "future" \
+      --replace "tenacity==4.12.0" "tenacity" \
+      --replace "text-unidecode==1.2" "text-unidecode" \
+      --replace "tzlocal>=1.4,<2.0.0" "tzlocal" \
+      --replace "sqlalchemy~=1.3" "sqlalchemy" \
+      --replace "gunicorn>=19.5.0, <20.0" "gunicorn" \
+      --replace "werkzeug>=0.14.1, <0.15.0" "werkzeug"
 
-   substituteInPlace setup.py \
-     --replace "flask>=1.1.0, <2.0" "flask" \
-     --replace "jinja2>=2.10.1, <2.11.0" "jinja2" \
-     --replace "pandas>=0.17.1, <1.0.0" "pandas" \
-     --replace "flask-caching>=1.3.3, <1.4.0" "flask-caching" \
-     --replace "flask-appbuilder>=1.12.5, <2.0.0" "flask-appbuilder" \
-     --replace "pendulum==1.4.4" "pendulum" \
-     --replace "cached_property~=1.5" "cached_property" \
-     --replace "dill>=0.2.2, <0.3" "dill" \
-     --replace "configparser>=3.5.0, <3.6.0" "configparser" \
-     --replace "jinja2>=2.7.3, <=2.10.0" "jinja2" \
-     --replace "funcsigs==1.0.0" "funcsigs" \
-     --replace "flask-swagger==0.2.13" "flask-swagger" \
-     --replace "python-daemon>=2.1.1, <2.2" "python-daemon" \
-     --replace "alembic>=0.9, <1.0" "alembic" \
-     --replace "markdown>=2.5.2, <3.0" "markdown" \
-     --replace "future>=0.16.0, <0.17" "future" \
-     --replace "tenacity==4.12.0" "tenacity" \
-     --replace "text-unidecode==1.2" "text-unidecode" \
-     --replace "tzlocal>=1.4,<2.0.0" "tzlocal" \
-     --replace "sqlalchemy~=1.3" "sqlalchemy" \
-     --replace "gunicorn>=19.5.0, <20.0" "gunicorn" \
-     --replace "werkzeug>=0.14.1, <0.15.0" "werkzeug"
+    # dumb-init is only needed for CI and Docker, not relevant for NixOS.
+    substituteInPlace setup.py \
+      --replace "'dumb-init>=1.2.2'," ""
 
-  # dumb-init is only needed for CI and Docker, not relevant for NixOS.
-  substituteInPlace setup.py \
-     --replace "'dumb-init>=1.2.2'," ""
-
-   substituteInPlace tests/core.py \
-     --replace "/bin/bash" "${stdenv.shell}"
+    substituteInPlace tests/core.py \
+      --replace "/bin/bash" "${stdenv.shell}"
   '';
 
   checkPhase = ''
@@ -184,8 +183,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Programmatically author, schedule and monitor data pipelines";
-    homepage = http://airflow.apache.org/;
+    homepage = "http://airflow.apache.org/";
     license = licenses.asl20;
-    maintainers = [ maintainers.costrouc maintainers.ingenieroariel ];
+    maintainers = with maintainers; [ costrouc ingenieroariel ];
   };
 }
diff --git a/pkgs/development/python-modules/ciso8601/default.nix b/pkgs/development/python-modules/ciso8601/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytz
+, unittest2
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "ciso8601";
+  version = "2.1.3";
+
+  src = fetchFromGitHub {
+    owner = "closeio";
+    repo = "ciso8601";
+    rev = "v${version}";
+    sha256 = "0g1aiyc1ayh0rnibyy416m5mmck38ksgdm3jsy0z3rxgmgb24951";
+  };
+
+  checkInputs = [
+    pytz
+  ] ++ lib.optional (isPy27) unittest2;
+
+  meta = with lib; {
+    description = "Fast ISO8601 date time parser for Python written in C";
+    homepage = "https://github.com/closeio/ciso8601";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}
diff --git a/pkgs/development/python-modules/effect/default.nix b/pkgs/development/python-modules/effect/default.nix
@@ -1,33 +1,40 @@
 { buildPythonPackage
 , fetchPypi
 , lib
+, isPy3k
 , six
 , attrs
 , pytest
 , testtools
 }:
+
 buildPythonPackage rec {
   version = "1.1.0";
   pname = "effect";
+  disabled = (!isPy3k);
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "7affb603707c648b07b11781ebb793a4b9aee8acf1ac5764c3ed2112adf0c9ea";
   };
+
   checkInputs = [
     pytest
     testtools
   ];
+
   propagatedBuildInputs = [
     six
     attrs
   ];
+
   checkPhase = ''
     pytest
   '';
+
   meta = with lib; {
     description = "Pure effects for Python";
-    homepage = https://github.com/python-effect/effect;
+    homepage = "https://github.com/python-effect/effect";
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -1,14 +1,16 @@
-{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch, acme, aiohttp, snitun, attrs, pytest-aiohttp, warrant, pytest }:
+{ lib, buildPythonPackage, fetchFromGitHub, fetchpatch
+, acme, aiohttp, snitun, attrs, pycognito, warrant
+, pytest-aiohttp, asynctest, pytest  }:
 
 buildPythonPackage rec {
   pname = "hass-nabucasa";
-  version = "0.31";
+  version = "0.32.2";
 
   src = fetchFromGitHub {
     owner = "nabucasa";
     repo = pname;
     rev = version;
-    sha256 = "0hxdvdj41gq5ryafjhrcgf6y8l33lyf45a1vgwwbk0q29sir9bnr";
+    sha256 = "1hfi5q222kgbgrj5yvr4lbhca49hcs6sc2yhxc4pjxqsc12bv1f1";
   };
 
   # upstreamed in https://github.com/NabuCasa/hass-nabucasa/pull/119
@@ -17,13 +19,13 @@ buildPythonPackage rec {
     cat setup.py
   '';
 
-  propagatedBuildInputs = [ acme aiohttp snitun attrs warrant ];
+  propagatedBuildInputs = [ acme aiohttp snitun attrs warrant pycognito ];
 
-  checkInputs = [ pytest pytest-aiohttp ];
+  checkInputs = [ pytest pytest-aiohttp asynctest ];
 
   checkPhase = ''
     pytest tests/
-    '';
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/NabuCasa/hass-nabucasa";

diff --git a/pkgs/development/python-modules/prompt_toolkit/default.nix b/pkgs/development/python-modules/prompt_toolkit/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "prompt_toolkit";
-  version = "2.0.10";
+  version = "3.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1nr990i4b04rnlw1ghd0xmgvvvhih698mb6lb6jylr76cs7zcnpi";
+    sha256 = "10wpsbl1mmnvm8q63zs40633kbq93bidx4vz1p2q92w8ijqb3rpb";
   };
   checkPhase = ''
     py.test -k 'not test_pathcompleter_can_expanduser'

diff --git a/pkgs/development/python-modules/ptpython/default.nix b/pkgs/development/python-modules/ptpython/default.nix
@@ -1,16 +1,17 @@
-{ stdenv, buildPythonPackage, fetchPypi, prompt_toolkit, docopt , jedi, pygments, isPy3k }:
+{ stdenv, buildPythonPackage, fetchPypi, prompt_toolkit, appdirs, docopt, jedi
+, pygments, isPy3k }:
 
 buildPythonPackage rec {
   pname = "ptpython";
-  version = "2.0.6";
+  version = "3.0.1";
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "90e24040e82de4abae0bbe6e352d59ae6657e14e1154e742c0038679361b052f";
+    sha256 = "a69cce0aa04f0075e2e65287a0ee2f3a928c0591b301ce22aa2e498af1ebcb4b";
   };
 
-  propagatedBuildInputs = [ prompt_toolkit docopt jedi pygments ];
+  propagatedBuildInputs = [ appdirs prompt_toolkit docopt jedi pygments ];
 
   # no tests to run
   doCheck = false;

diff --git a/pkgs/development/python-modules/pycognito/default.nix b/pkgs/development/python-modules/pycognito/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, cryptography
+, boto3
+, envs
+, python-jose
+, requests
+, mock
+, isPy27
+}:
+
+buildPythonPackage rec {
+  pname = "pycognito";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "pvizeli";
+    repo = "pycognito";
+    rev = version;
+    sha256 = "01zns522awm5yp5cbk1y7k7px534i5akiivip709i1naph3hvnfk";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'python-jose[cryptography]' 'python-jose'
+  '';
+
+  propagatedBuildInputs = [
+    boto3
+    envs
+    python-jose
+    requests
+  ];
+
+  disabled = isPy27;
+
+  checkInputs = [ mock ];
+
+  meta = with lib; {
+    description = "Python class to integrate Boto3's Cognito client so it is easy to login users. With SRP support";
+    homepage = "https://GitHub.com/pvizeli/pycognito";
+    license = licenses.asl20;
+    maintainers = [ maintainers.mic92 ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyicloud/default.nix b/pkgs/development/python-modules/pyicloud/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "pyicloud";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0r171wnq2g5bw7gd59vh6flm0104ix1a6s2vhdrf8s74hipw57si";
+    sha256 = "1c8sdlqcmpajcpf6jfpi6amncibm9c3zrl1860r0vfimps50m34h";
   };
 
   propagatedBuildInputs = [

diff --git a/pkgs/development/python-modules/python-jose/default.nix b/pkgs/development/python-modules/python-jose/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "python-jose";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "mpdavis";
     repo = "python-jose";
     rev = version;
-    sha256 = "1ahq4m86z504bnlk9z473r7r3dprg5m39900rld797hbczdhqa4f";
+    sha256 = "1gnn0zy03pywj65ammy3sd07knzhjv8n5jhx1ir9bikgra9v0iqh";
   };
 
   checkInputs = [

diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.24.4";
+  version = "0.24.5";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f66d38f16026097572939ab78b1f46a97f556bca415491eb0fd094d0b5827dfe";
+    sha256 = "0jpgd0rk91si93857mjrizan5gc42kj1q4fi4160qgk68la88fl9";
   };
 
   propagatedBuildInputs = [ ifaddr ]

diff --git a/pkgs/development/python-modules/zetup/default.nix b/pkgs/development/python-modules/zetup/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi
+{ lib, buildPythonPackage, fetchPypi
 , setuptools_scm, pathpy, nbconvert
 , pytest }:
 
@@ -11,11 +11,10 @@ buildPythonPackage rec {
     sha256 = "b8a9bdcfa4b705d72b55b218658bc9403c157db7b57a14158253c98d03ab713d";
   };
 
-  # Python 3.7 compatibility
-  # See https://github.com/zimmermanncode/zetup/pull/1
+  # Python 3.8 compatibility
   postPatch = ''
     substituteInPlace zetup/zetup_config.py \
-      --replace "'3.6']" "'3.6', '3.7']"
+      --replace "'3.7']" "'3.7', '3.8']"
   '';
 
   checkPhase = ''
@@ -25,11 +24,9 @@ buildPythonPackage rec {
   checkInputs = [ pytest pathpy nbconvert ];
   propagatedBuildInputs = [ setuptools_scm ];
 
-  meta = with stdenv.lib; {
-    description = ''
-      Zimmermann's Extensible Tools for Unified Project setups
-    '';
-    homepage = https://github.com/zimmermanncode/zetup;
+  meta = with lib; {
+    description = "Zimmermann's Extensible Tools for Unified Project setups";
+    homepage = "https://github.com/zimmermanncode/zetup";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
   };

diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "tflint";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "14vgy5lavyp4w16g7wpi9xbni3js541rc3w9qn5ab3khqw5rdhgn";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Terraform linter focused on possible errors, best practices, and so on";
     homepage = "https://github.com/terraform-linters/tflint";
     changelog = "https://github.com/terraform-linters/tflint/releases/tag/v${version}";

diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
@@ -11,8 +11,6 @@ buildGoModule rec {
     sha256 = "16pdvcgy1d5dfqk3as23j45rkwfrv232n384cj5wfz9qwijkcy5g";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
   modSha256 = "07cy2zi7m2pkbfdcy659x4k5j2w60cmjy8kxv1dcii3dc6ls4bvb";

diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "bazelisk";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "1w8k659ifapcxbbim0nf7wd7w10bhlagc33q08izh84gcgsh0yyz";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "A user-friendly launcher for Bazel";
     longDescription = ''

diff --git a/pkgs/development/tools/conftest/default.nix b/pkgs/development/tools/conftest/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "conftest";
@@ -13,14 +13,12 @@ buildGoModule rec {
 
   modSha256 = "0gm08lrlaxc7504mapjdm3c4mwlzybnqxfwkkh6fawzvmd9sqddr";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = ''
     -ldflags=
         -X main.version=${version}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Write tests against structured configuration data";
     homepage = "https://github.com/instrumenta/conftest";
     license = licenses.asl20;

diff --git a/pkgs/development/tools/continuous-integration/drone-cli/default.nix b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
@@ -1,8 +1,11 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 
-buildGoModule rec {
+let version = "1.2.1";
+in buildGoModule rec {
+  inherit version;
   pname = "drone-cli";
-  version = "1.2.1";
+  revision = "v${version}";
+  goPackagePath = "github.com/drone/drone-cli";
 
   modSha256 = "0g0vq4vm2hy00r2gjsrhg57xv9sldlqix3wzimiqdli085bcz46b";
 
@@ -13,12 +16,10 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "drone";
     repo = "drone-cli";
-    rev = "v${version}";
+    rev = revision;
     sha256 = "19icihi5nxcafxlh4w61nl4cd0dhvik9zl8g4gqmazikjqsjms2j";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ bricewge ];
     license = licenses.asl20;

diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
   name = "drone.io-${version}";
@@ -14,8 +14,6 @@ buildGoModule rec {
     sha256 = "05cgd72qyss836fby0adhrm5p8g7639psk2yslhg6pmz0cqfbq9m";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ elohmeier vdemeester ];
     license = licenses.asl20;

diff --git a/pkgs/development/tools/continuous-integration/fly/default.nix b/pkgs/development/tools/continuous-integration/fly/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, writeText, Security }:
+{ buildGoModule, fetchFromGitHub, lib, writeText }:
 
 buildGoModule rec {
   pname = "fly";
@@ -20,8 +20,6 @@ buildGoModule rec {
       -X github.com/concourse/concourse.Version=${version}
   '';
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   # The fly.bash file included with this derivation can be replaced by a
   # call to `fly completion bash` once the `completion` subcommand has
   # made it into a release. Similarly, `fly completion zsh` will provide
@@ -30,7 +28,7 @@ buildGoModule rec {
     install -D -m 444 ${./fly.bash} $out/share/bash-completion/completions/fly
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A command line interface to Concourse CI";
     homepage = "https://concourse-ci.org";
     license = licenses.asl20;

diff --git a/pkgs/development/tools/cue/default.nix b/pkgs/development/tools/cue/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchgit, stdenv, Security }:
+{ buildGoModule, fetchgit, stdenv }:
 
 buildGoModule rec {
   pname = "cue";
@@ -12,8 +12,6 @@ buildGoModule rec {
 
   modSha256 = "04dapx75zwi8cv1pj3c6266znrhwihv3df4izm3gjk34r2i07q6s";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cmd/cue" ];
 
   buildFlagsArray = [

diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "dbmate";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "12x3m5bjyx3blh5i51pd99phv73m96pmm6i3ir4vf2kms3viif9i";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Database migration tool";
     homepage = https://github.com/amacneil/dbmate;

diff --git a/pkgs/development/tools/database/dbmate/deps.nix b/pkgs/development/tools/database/dbmate/deps.nix
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, pkg-config, btrfs-progs, gpgme, lvm2, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub, pkg-config, btrfs-progs, gpgme, lvm2 }:
 
 buildGoModule rec {
   pname = "dive";
@@ -15,8 +15,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = stdenv.lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 

diff --git a/pkgs/development/tools/go-tools/default.nix b/pkgs/development/tools/go-tools/default.nix
@@ -1,7 +1,6 @@
 { buildGoModule
-, stdenv
+, lib
 , fetchFromGitHub
-, Security
 }:
 
 buildGoModule rec {
@@ -17,11 +16,9 @@ buildGoModule rec {
     sha256 = "0pvi1mzhy6zgx4zfgdypbl4zhvgg11hl5qv7blf2qs0a96j2djhf";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   modSha256 = "03560xjr2531xj87paskfx2zs364fz6y4kpsid8x08s1syq9nq7p";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A collection of tools and libraries for working with Go code, including linters and static analysis";
     homepage = https://staticcheck.io;
     license = licenses.mit;

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "golangci-lint";
@@ -14,9 +14,7 @@ buildGoModule rec {
   modSha256 = "0ab1s8pqkpss15rd9brin39lzx2fqkvq2v3nhk8kfrgpari2addk";
   subPackages = [ "cmd/golangci-lint" ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Linters Runner for Go. 5x faster than gometalinter. Nice colored output.";
     homepage = "https://golangci.com/";
     license = licenses.agpl3;

diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "hcloud";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "1zy41hi2qzrdmih3pkpng8im576lhkr64zm66w73p7jyvy0kf9sx";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = [ "-ldflags=" "-w -X github.com/hetznercloud/cli/cli.Version=${version}" ];
 
   postInstall = ''

diff --git a/pkgs/development/tools/kcli/default.nix b/pkgs/development/tools/kcli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "kcli";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "1wcqh3306q9wxb6pnl8cpk73vmy36bjv2gil03j7j4pajs1f2lwn";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
   meta = with stdenv.lib; {

diff --git a/pkgs/development/tools/kubeprompt/default.nix b/pkgs/development/tools/kubeprompt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "kubeprompt";
@@ -21,8 +21,6 @@ buildGoModule rec {
   goPackagePath = "github.com/jlesquembre/kubeprompt";
   modSha256 = "0rbpdk2dixywn3wcdgz48f3xw3b7fk8xh7mrlx27wz7fq5wj9v8f";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     description = "Kubernetes prompt";
     homepage = "https://github.com/jlesquembre/kubeprompt";

diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub, tree }:
 
 buildGoModule rec {
   pname = "kustomize";
@@ -25,9 +25,7 @@ buildGoModule rec {
 
   modSha256 = "1bas6al14ck0d2ccb4235426a5hldqsm0nf8vi76chz4nahzb71g";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Customization of kubernetes YAML configurations";
     longDescription = ''
       kustomize lets you customize raw, template-free YAML files for

diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ lib, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
   pname = "act";
@@ -11,13 +11,11 @@ buildGoModule rec {
     sha256 = "0l7id483006mnii4rlcff4p0ricd8a2n24sf74a9b387x0akpbsn";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   modSha256 = "04s4p9j6j7gw1s4v271zwzvdny7dvjaazd2pihmyjfik95xmwx9r";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Run your GitHub Actions locally";
     homepage = "https://github.com/nektos/act";
     license = licenses.mit;

diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ stdenv, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
   pname = "circleci-cli";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   modSha256 = "199ai38knp50mjjhddjd70qfwx63c69rf7ddw4hpzgx5cm5a04q2";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/CircleCI-Public/circleci-cli/version.Version=${version}" ];
 
   preBuild = ''

diff --git a/pkgs/development/tools/misc/editorconfig-checker/default.nix b/pkgs/development/tools/misc/editorconfig-checker/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "editorconfig-checker";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "1iiv12ginb3ky739z7v8wf4z5lv24gmghbybs3lzay0kqn449n4x";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A tool to verify that your files are in harmony with your .editorconfig";
     homepage = "https://editorconfig-checker.github.io/";
     license = licenses.mit;

diff --git a/pkgs/development/tools/misc/go-license-detector/default.nix b/pkgs/development/tools/misc/go-license-detector/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "go-license-detector";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "163f1kiy7kqrnaazb8ydaaiz57lv30jyjkvv6i7pczvcg9yfhmdb";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Reliable project licenses detector";
     homepage = "https://github.com/src-d/go-license-detector";
     license = licenses.asl20;

diff --git a/pkgs/development/tools/misc/mkcert/default.nix b/pkgs/development/tools/misc/mkcert/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "mkcert";
@@ -19,9 +19,7 @@ buildGoModule rec {
       -X ${goPackagePath}/main.Version=${version}
   '';
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/FiloSottile/mkcert;
     description = "A simple tool for making locally-trusted development certificates";
     license = licenses.bsd3;

diff --git a/pkgs/development/tools/misc/reviewdog/default.nix b/pkgs/development/tools/misc/reviewdog/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "reviewdog";
@@ -13,13 +13,11 @@ buildGoModule rec {
 
   modSha256 = "1jf08g0xr4wknh9x15igq73y02cy2faqjdjs2v842ii4p3n4p9dw";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cmd/reviewdog" ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/reviewdog/reviewdog/commands.Version=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Automated code review tool integrated with any code analysis tools regardless of programming language";
     homepage = "https://github.com/reviewdog/reviewdog";
     changelog = "https://github.com/reviewdog/reviewdog/releases/tag/v${version}";

diff --git a/pkgs/development/tools/misc/terracognita/default.nix b/pkgs/development/tools/misc/terracognita/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "terracognita";
@@ -13,13 +13,11 @@ buildGoModule rec {
 
   modSha256 = "0xlhp8pa5g6an10m56g237pixc4h6ay89hkp1ijdz45iyfn9fk91";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
   buildFlagsArray = [ "-ldflags=-s -w -X github.com/cycloidio/terracognita/cmd.Version=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Reads from existing Cloud Providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration";
     homepage = "https://github.com/cycloidio/terracognita";
     license = licenses.mit;

diff --git a/pkgs/development/tools/mod/default.nix b/pkgs/development/tools/mod/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "mod";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "0x7bdhvam9l23cbdqpna8kwg0v6yhgmw0hlbm48bbhjl27lg7svc";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "cmd/mod" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Automated Semantic Import Versioning Upgrades for Go";
     longDescription = ''
       Command line tool to upgrade/downgrade Semantic Import Versioning in Go

diff --git a/pkgs/development/tools/pet/default.nix b/pkgs/development/tools/pet/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "pet";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "06ham8lsx5c1vk5jkwp1aa9g4q4g7sfq7gxz2gkffa98x2vlawyf";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "." ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Simple command-line snippet manager, written in Go";
     homepage = https://github.com/knqyf263/pet;
     license = licenses.mit;

diff --git a/pkgs/development/tools/proto-contrib/default.nix b/pkgs/development/tools/proto-contrib/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "proto-contrib";
@@ -13,9 +13,7 @@ buildGoModule rec {
 
   modSha256 = "19cqz13jd95d5vibd10420gg69ldgf6afc51mkglhafgmmif56b0";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Contributed tools and other packages on top of the Go proto package";
     homepage = https://github.com/emicklei/proto-contrib;
     license = licenses.mit;

diff --git a/pkgs/development/tools/protoc-gen-doc/default.nix b/pkgs/development/tools/protoc-gen-doc/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule {
   pname = "protoc-gen-doc-unstable";
@@ -13,9 +13,7 @@ buildGoModule {
 
   modSha256 = "1952ycdkgl00q2s3qmhislhhim15nn6nmlkwbfdvrsfzznqj47rd";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Documentation generator plugin for Google Protocol Buffers";
     longDescription = ''
       This is a documentation generator plugin for the Google Protocol Buffers

diff --git a/pkgs/development/tools/prototool/default.nix b/pkgs/development/tools/prototool/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, makeWrapper, protobuf, Security }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, protobuf }:
 
 buildGoModule rec {
   pname = "prototool";
@@ -13,8 +13,6 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   modSha256 = "1gc8kc9mbi3mlh48zx4lcgpsrf8z879f1qj9wfyr66s7wd1ljazg";
 
   postInstall = ''
@@ -25,7 +23,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/prototool" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://github.com/uber/prototool";
     description = "Your Swiss Army Knife for Protocol Buffers";
     maintainers = [ maintainers.marsam ];

diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "flyctl";
@@ -11,8 +11,6 @@ buildGoModule rec {
     sha256 = "181j248i8j9g7kz5krg0bkbxkvmcwpz2vlknii5q3dy7yhgg19h3";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   preBuild = ''
     go generate ./...
   '';
@@ -24,7 +22,7 @@ buildGoModule rec {
 
   modSha256 = "1mqkc7hnavvpbqar9f1d2vnm47p4car9abnk2ikyf27jr5glwmsd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Command line tools for fly.io services";
     homepage = "https://fly.io/";
     license = licenses.asl20;

diff --git a/pkgs/development/web/minify/default.nix b/pkgs/development/web/minify/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "minify";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "09jk3mxf7n9wf1cgyiw9mhsr55fb12k399dmzhnib3vhd9xav15i";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildFlagsArray = [ "-ldflags=-s -w -X main.Version=${version}" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Minifiers for web formats";
     license = licenses.mit;
     homepage = "https://go.tacodewolff.nl/minify";

diff --git a/pkgs/os-specific/darwin/smimesign/default.nix b/pkgs/os-specific/darwin/smimesign/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, libobjc, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:
 
 buildGoModule rec {
   pname = "smimesign";
@@ -13,11 +13,9 @@ buildGoModule rec {
 
   modSha256 = "1k3gnjzblfk14y19zhlvwysx045nbw0xr5nngh7zj1wcqxhhm206";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc Security ];
-
   buildFlagsArray = "-ldflags=-X main.versionString=${version}";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "An S/MIME signing utility for macOS and Windows that is compatible with Git.";
 
     homepage    = https://github.com/github/smimesign;

diff --git a/pkgs/servers/caddy/default.nix b/pkgs/servers/caddy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "caddy";
@@ -16,8 +16,6 @@ buildGoModule rec {
   };
   modSha256 = "1gc0xvsihr4zp7hkrdfrplvzkaphz1y4q53rgwn2jhd8s98l57an";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   preBuild = ''
     cat << EOF > caddy/main.go
     package main

diff --git a/pkgs/servers/caddy/v2.nix b/pkgs/servers/caddy/v2.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, callPackage, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "caddy";
@@ -16,8 +16,6 @@ buildGoModule rec {
   };
   modSha256 = "1sb8w6n84cpya2rjm0zm798kzf5vjpkr5440j1gfnnnr07jl2aqn";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     homepage = "https://caddyserver.com";
     description = "Fast, cross-platform HTTP/2 web server with automatic HTTPS";

diff --git a/pkgs/servers/dns/coredns/default.nix b/pkgs/servers/dns/coredns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "coredns";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   modSha256 = "0wlffk6wkcyn2lphw2vmdsmzag0wxljcxrvm7sv3i124x2x3yvy4";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   meta = with stdenv.lib; {
     homepage = "https://coredns.io";
     description = "A DNS server that runs middleware";

diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, go-bindata, go-bindata-assetfs, Security }:
+{ lib, buildGoModule, fetchFromGitHub, go-bindata, go-bindata-assetfs }:
 
 buildGoModule rec {
   pname = "documize-community";
@@ -15,8 +15,6 @@ buildGoModule rec {
 
   nativeBuildInputs = [ go-bindata go-bindata-assetfs ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   subPackages = [ "edition/community.go" ];
 
   postInstall = ''
@@ -25,7 +23,7 @@ buildGoModule rec {
     mv $out/bin/community $out/bin/documize
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Open source Confluence alternative for internal & external docs built with Golang + EmberJS";
     license = licenses.agpl3;
     maintainers = with maintainers; [ ma27 elseym ];

diff --git a/pkgs/servers/echoip/default.nix b/pkgs/servers/echoip/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule {
   pname = "echoip";
@@ -13,16 +13,14 @@ buildGoModule {
 
   modSha256 = "025p891klwpid5fw4z39fimgfkwgkcwqpn5276hflzdp1hfv35ly";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   outputs = [ "out" "index" ];
 
   postInstall = ''
     mkdir -p $index
     cp $src/index.html $index/index.html
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/mpolden/echoip;
     license = licenses.bsd3;
     maintainers = with maintainers; [ rvolosatovs ];

diff --git a/pkgs/servers/gobetween/default.nix b/pkgs/servers/gobetween/default.nix
@@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security, enableStatic ? false }:
+{ buildGoModule, fetchFromGitHub, lib, enableStatic ? false }:
 
 buildGoModule rec {
   pname = "gobetween";
@@ -14,10 +14,8 @@ buildGoModule rec {
   modSha256 =
     "dd91838d20c99c73447590e43edd13c87755276f17ef3e53f24c5df3d0908f78";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
   buildPhase = ''
-    make build${stdenv.lib.optionalString enableStatic "-static"}
+    make build${lib.optionalString enableStatic "-static"}
   '';
 
   installPhase = ''
@@ -27,7 +25,7 @@ buildGoModule rec {
     cp -r config $out/share
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Modern & minimalistic load balancer for the Сloud era";
     homepage = "http://gobetween.io";
     license = licenses.mit;

diff --git a/pkgs/servers/gortr/default.nix b/pkgs/servers/gortr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, buildGoModule, Security }:
+{ lib, fetchFromGitHub, buildGoModule }:
 
 buildGoModule rec {
   pname = "gortr";
@@ -12,9 +12,7 @@ buildGoModule rec {
   };
   modSha256 = "157dpalfz3z1s3mxq63xy6lrkwzyy9xzmvn7wsxkwznjq4djv1a1";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The RPKI-to-Router server used at Cloudflare";
     homepage = "https://github.com/cloudflare/gortr/";
     license = licenses.gpl3;

diff --git a/pkgs/servers/gotify/default.nix b/pkgs/servers/gotify/default.nix
@@ -1,11 +1,11 @@
 { stdenv
 , buildGoPackage
+, lib
 , fetchFromGitHub
 , buildGoModule
 , packr
 , sqlite
 , callPackage
-, Security
 }:
 
 buildGoModule rec {
@@ -28,8 +28,7 @@ buildGoModule rec {
       --replace 'Version = "unknown"' 'Version = "${version}"'
   '';
 
-  buildInputs = [ sqlite ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [ sqlite ];
 
   nativeBuildInputs = [ packr ];
 

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.106.6";
+  version = "0.107.7";
   components = {
     "abode" = ps: with ps; [ ]; # missing inputs: abodepy
     "acer_projector" = ps: with ps; [ pyserial];
@@ -55,9 +55,10 @@
     "aurora_abb_powerone" = ps: with ps; [ ]; # missing inputs: aurorapy
     "auth" = ps: with ps; [ aiohttp-cors];
     "automatic" = ps: with ps; [ aiohttp-cors]; # missing inputs: aioautomatic
-    "automation" = ps: with ps; [ aiohttp-cors];
+    "automation" = ps: with ps; [ ];
     "avea" = ps: with ps; [ ]; # missing inputs: avea
     "avion" = ps: with ps; [ ]; # missing inputs: avion
+    "avri" = ps: with ps; [ ]; # missing inputs: avri-api
     "awair" = ps: with ps; [ ]; # missing inputs: python_awair
     "aws" = ps: with ps; [ ]; # missing inputs: aiobotocore
     "axis" = ps: with ps; [ ]; # missing inputs: axis
@@ -187,6 +188,7 @@
     "ecovacs" = ps: with ps; [ ]; # missing inputs: sucks
     "eddystone_temperature" = ps: with ps; [ construct]; # missing inputs: beacontools[scan]
     "edimax" = ps: with ps; [ ]; # missing inputs: pyedimax
+    "edl21" = ps: with ps; [ ]; # missing inputs: pysml
     "ee_brightbox" = ps: with ps; [ ]; # missing inputs: eebrightbox
     "efergy" = ps: with ps; [ ];
     "egardia" = ps: with ps; [ ]; # missing inputs: pythonegardia
@@ -217,6 +219,7 @@
     "eufy" = ps: with ps; [ ]; # missing inputs: lakeside
     "everlights" = ps: with ps; [ ]; # missing inputs: pyeverlights
     "evohome" = ps: with ps; [ ]; # missing inputs: evohome-async
+    "ezviz" = ps: with ps; [ ]; # missing inputs: pyezviz
     "facebook" = ps: with ps; [ ];
     "facebox" = ps: with ps; [ ];
     "fail2ban" = ps: with ps; [ ];
@@ -299,6 +302,7 @@
     "graphite" = ps: with ps; [ ];
     "greeneye_monitor" = ps: with ps; [ ]; # missing inputs: greeneye_monitor
     "greenwave" = ps: with ps; [ ]; # missing inputs: greenwavereality
+    "griddy" = ps: with ps; [ ]; # missing inputs: griddypower
     "group" = ps: with ps; [ ];
     "growatt_server" = ps: with ps; [ ]; # missing inputs: growattServer
     "gstreamer" = ps: with ps; [ ]; # missing inputs: gstreamer-player
@@ -307,7 +311,7 @@
     "hangouts" = ps: with ps; [ ]; # missing inputs: hangups
     "harman_kardon_avr" = ps: with ps; [ ]; # missing inputs: hkavr
     "harmony" = ps: with ps; [ ]; # missing inputs: aioharmony
-    "hassio" = ps: with ps; [ aiohttp-cors]; # missing inputs: home-assistant-frontend
+    "hassio" = ps: with ps; [ aiohttp-cors];
     "haveibeenpwned" = ps: with ps; [ ];
     "hddtemp" = ps: with ps; [ ];
     "hdmi_cec" = ps: with ps; [ ]; # missing inputs: pyCEC
@@ -318,14 +322,13 @@
     "hikvisioncam" = ps: with ps; [ ]; # missing inputs: hikvision
     "hisense_aehw4a1" = ps: with ps; [ ]; # missing inputs: pyaehw4a1
     "history" = ps: with ps; [ aiohttp-cors sqlalchemy];
-    "history_graph" = ps: with ps; [ aiohttp-cors sqlalchemy];
     "history_stats" = ps: with ps; [ aiohttp-cors sqlalchemy];
     "hitron_coda" = ps: with ps; [ ];
     "hive" = ps: with ps; [ ]; # missing inputs: pyhiveapi
     "hlk_sw16" = ps: with ps; [ ]; # missing inputs: hlk-sw16
     "homeassistant" = ps: with ps; [ ];
     "homekit" = ps: with ps; [ ]; # missing inputs: HAP-python
-    "homekit_controller" = ps: with ps; [ ]; # missing inputs: homekit[IP]
+    "homekit_controller" = ps: with ps; [ ]; # missing inputs: aiohomekit[IP]
     "homematic" = ps: with ps; [ pyhomematic];
     "homematicip_cloud" = ps: with ps; [ ]; # missing inputs: homematicip
     "homeworks" = ps: with ps; [ ]; # missing inputs: pyhomeworks
@@ -342,6 +345,7 @@
     "hydrawise" = ps: with ps; [ ]; # missing inputs: hydrawiser
     "hyperion" = ps: with ps; [ ];
     "ialarm" = ps: with ps; [ ]; # missing inputs: pyialarm
+    "iammeter" = ps: with ps; [ ]; # missing inputs: iammeter
     "iaqualink" = ps: with ps; [ ]; # missing inputs: iaqualink
     "icloud" = ps: with ps; [ pyicloud];
     "idteck_prox" = ps: with ps; [ ]; # missing inputs: rfk101py
@@ -452,7 +456,7 @@
     "melissa" = ps: with ps; [ ]; # missing inputs: py-melissa-climate
     "meraki" = ps: with ps; [ aiohttp-cors];
     "message_bird" = ps: with ps; [ ]; # missing inputs: messagebird
-    "met" = ps: with ps; [ ]; # missing inputs: pyMetno
+    "met" = ps: with ps; [ pymetno];
     "meteo_france" = ps: with ps; [ ]; # missing inputs: meteofrance vigilancemeteo
     "meteoalarm" = ps: with ps; [ ]; # missing inputs: meteoalertapi
     "metoffice" = ps: with ps; [ ]; # missing inputs: datapoint
@@ -517,7 +521,7 @@
     "nmbs" = ps: with ps; [ ]; # missing inputs: pyrail
     "no_ip" = ps: with ps; [ ];
     "noaa_tides" = ps: with ps; [ ]; # missing inputs: py_noaa
-    "norway_air" = ps: with ps; [ ]; # missing inputs: pyMetno
+    "norway_air" = ps: with ps; [ pymetno];
     "notify" = ps: with ps; [ ];
     "notion" = ps: with ps; [ ]; # missing inputs: aionotion
     "nsw_fuel_station" = ps: with ps; [ ]; # missing inputs: nsw-fuel-api-client
@@ -607,6 +611,7 @@
     "qnap" = ps: with ps; [ ]; # missing inputs: qnapstats
     "qrcode" = ps: with ps; [ pillow]; # missing inputs: pyzbar
     "quantum_gateway" = ps: with ps; [ ]; # missing inputs: quantum-gateway
+    "qvr_pro" = ps: with ps; [ ]; # missing inputs: pyqvrpro
     "qwikswitch" = ps: with ps; [ ]; # missing inputs: pyqwikswitch
     "rachio" = ps: with ps; [ aiohttp-cors]; # missing inputs: rachiopy
     "radarr" = ps: with ps; [ ];
@@ -652,7 +657,7 @@
     "safe_mode" = ps: with ps; [ aiohttp-cors hass-nabucasa]; # missing inputs: home-assistant-frontend
     "saj" = ps: with ps; [ ]; # missing inputs: pysaj
     "salt" = ps: with ps; [ ]; # missing inputs: saltbox
-    "samsungtv" = ps: with ps; [ ]; # missing inputs: samsungctl[websocket]
+    "samsungtv" = ps: with ps; [ ]; # missing inputs: samsungctl[websocket] samsungtvws[websocket]
     "satel_integra" = ps: with ps; [ ]; # missing inputs: satel_integra
     "scene" = ps: with ps; [ ];
     "scrape" = ps: with ps; [ beautifulsoup4];
@@ -677,7 +682,7 @@
     "shopping_list" = ps: with ps; [ aiohttp-cors];
     "sht31" = ps: with ps; [ ]; # missing inputs: Adafruit-GPIO Adafruit-SHT31
     "sigfox" = ps: with ps; [ ];
-    "sighthound" = ps: with ps; [ ]; # missing inputs: simplehound
+    "sighthound" = ps: with ps; [ pillow]; # missing inputs: simplehound
     "signal_messenger" = ps: with ps; [ ]; # missing inputs: pysignalclirestapi
     "simplepush" = ps: with ps; [ ]; # missing inputs: simplepush
     "simplisafe" = ps: with ps; [ ]; # missing inputs: simplisafe-python
@@ -760,6 +765,7 @@
     "tado" = ps: with ps; [ ]; # missing inputs: python-tado
     "tahoma" = ps: with ps; [ ]; # missing inputs: tahoma-api
     "tank_utility" = ps: with ps; [ ]; # missing inputs: tank_utility
+    "tankerkoenig" = ps: with ps; [ ]; # missing inputs: pytankerkoenig
     "tapsaff" = ps: with ps; [ ]; # missing inputs: tapsaff
     "tautulli" = ps: with ps; [ ]; # missing inputs: pytautulli
     "tcp" = ps: with ps; [ ];
@@ -865,7 +871,6 @@
     "waze_travel_time" = ps: with ps; [ WazeRouteCalculator];
     "weather" = ps: with ps; [ ];
     "webhook" = ps: with ps; [ aiohttp-cors];
-    "weblink" = ps: with ps; [ ];
     "webostv" = ps: with ps; [ ]; # missing inputs: aiopylgtv
     "websocket_api" = ps: with ps; [ aiohttp-cors];
     "wemo" = ps: with ps; [ ]; # missing inputs: pywemo

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
@@ -67,15 +67,17 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.106.6";
+  hassVersion = "0.107.7";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
   version = assert (componentPackages.version == hassVersion); hassVersion;
 
   disabled = pythonOlder "3.5";
 
-  patches = [ ./relax-importlib-metadata-pyaml.patch ];
+  patches = [
+    ./relax-deps.patch
+  ];
 
   inherit availableComponents;
 
@@ -84,7 +86,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "11kv5lmm8nxp7yv3w43mzmgzkafddy0z6wl2878p96iyil1w7qhb";
+    sha256 = "1sr7vzsd4hpaix37bb10vbnnqs1v8ll2wb8m713qrvcp3crs6snk";
   };
 
   propagatedBuildInputs = [
@@ -93,12 +95,12 @@ in with py.pkgs; buildPythonApplication rec {
     pyjwt cryptography pip python-slugify pytz pyyaml requests ruamel_yaml
     setuptools voluptuous voluptuous-serialize
     # From http, frontend and recorder components and auth.mfa_modules.totp
-    sqlalchemy aiohttp-cors hass-frontend pyotp pyqrcode
+    sqlalchemy aiohttp-cors hass-frontend pyotp pyqrcode ciso8601
   ] ++ componentBuildInputs ++ extraBuildInputs;
 
   checkInputs = [
     asynctest pytest pytest-aiohttp requests-mock pydispatcher aiohue netdisco
-    hass-nabucasa defusedxml
+    hass-nabucasa defusedxml zeroconf
   ];
 
   postPatch = ''
@@ -112,10 +114,12 @@ in with py.pkgs; buildPythonApplication rec {
     # - components' dependencies are not included, so they cannot be tested
     # - test_merge_id_schema requires pyqwikswitch
     # - unclear why test_merge fails: assert merge_log_err.call_count != 0
-    py.test --ignore tests/components -k "not test_merge_id_schema and not test_merge"
+    # - test_setup_safe_mode_if_no_frontend: requires dependencies for components we have not packaged
+    py.test --ignore tests/components -k "not test_setup_safe_mode_if_no_frontend and not test_merge_id_schema and not test_merge"
+
     # Some basic components should be tested however
     py.test \
-      tests/components/{api,config,configurator,demo,discovery,frontend,group,history,history_graph} \
+      tests/components/{api,config,configurator,demo,discovery,frontend,group,history} \
       tests/components/{homeassistant,http,logger,script,shell_command,system_log,websocket_api}
   '';
 

diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
@@ -4,11 +4,11 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20200220.5";
+  version = "20200318.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0nc44r5ybq0prsz2yid622i0xr7q0qrc4ymbk69bqg6jrmjpbdl1";
+    sha256 = "15by4wd3lpq1pd0hpx04v827i3xywsvxziqb1qrbsraxh1rvsbhz";
   };
 
   # no Python tests implemented

diff --git a/pkgs/servers/home-assistant/relax-deps.patch b/pkgs/servers/home-assistant/relax-deps.patch
@@ -0,0 +1,13 @@
+--- a/setup.py	2020-03-18 15:34:35.474693786 +0000
++++ b/setup.py	2020-03-18 15:49:07.185801916 +0000
+@@ -47,8 +47,8 @@
+     "pip>=8.0.3",
+     "python-slugify==4.0.0",
+     "pytz>=2019.03",
+-    "pyyaml==5.3",
+-    "requests==2.23.0",
++    "pyyaml>=5.2",
++    "requests>=2.22.0",
+     "ruamel.yaml==0.15.100",
+     "voluptuous==0.11.7",
+     "voluptuous-serialize==2.3.0",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/ nixbld@localhost
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost