Merge staging-next into staging

20 files changed, 236 insertions, 811 deletions

diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index dc78728d66360..de3c7d693d47b 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -126,6 +126,13 @@ let
     </IfModule>
   '';
 
+  luaSetPaths = ''
+    <IfModule mod_lua.c>
+      LuaPackageCPath ${cfg.package.lua5}/lib/lua/${cfg.package.lua5.lua.luaversion}/?.so
+      LuaPackagePath  ${cfg.package.lua5}/share/lua/${cfg.package.lua5.lua.luaversion}/?.lua
+    </IfModule>
+  '';
+
   mkVHostConf = hostOpts:
     let
       adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;
@@ -326,6 +333,8 @@ let
 
     ${sslConf}
 
+    ${if cfg.package.luaSupport then luaSetPaths else ""}
+
     # Fascist default - deny access to everything.
     <Directory />
         Options FollowSymLinks
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 629f11865bbc7..c35579def7e9a 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -223,7 +223,7 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  name = "k3s";
+  pname = "k3s";
   version = k3sVersion;
 
   # Important utilities used by  the kubelet, see
diff --git a/pkgs/applications/printing/pappl/default.nix b/pkgs/applications/printing/pappl/default.nix
new file mode 100644
index 0000000000000..5cad364d240b3
--- /dev/null
+++ b/pkgs/applications/printing/pappl/default.nix
@@ -0,0 +1,62 @@
+{ lib, stdenv, fetchFromGitHub
+, avahi
+, cups
+, gnutls
+, libjpeg
+, libpng
+, libusb1
+, pkg-config
+, withPAMSupport ? true, pam
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pappl";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "michaelrsweet";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1cg06v8hxska0hnybnmfda1v4h3ifjir24nx2iqx80kb6jq0hayb";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    cups
+    libjpeg
+    libpng
+    libusb1
+    zlib
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    # upstream mentions these are not needed for Mac
+    # see: https://github.com/michaelrsweet/pappl#requirements
+    avahi
+    gnutls
+  ] ++ lib.optionals withPAMSupport [
+    pam
+  ];
+
+  # testing requires some networking
+  # doCheck = true;
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/pappl-makeresheader --help
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "C-based framework/library for developing CUPS Printer Applications";
+    homepage = "https://github.com/michaelrsweet/pappl";
+    license = licenses.asl20;
+    platforms = platforms.linux; # should also work for darwin, but requires additional work
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/libraries/boost/1.75.nix b/pkgs/development/libraries/boost/1.75.nix
new file mode 100644
index 0000000000000..9912032c77743
--- /dev/null
+++ b/pkgs/development/libraries/boost/1.75.nix
@@ -0,0 +1,15 @@
+{ stdenv, callPackage, fetchurl, fetchpatch, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "1.75.0";
+
+  src = fetchurl {
+    urls = [
+      "mirror://sourceforge/boost/boost_1_75_0.tar.bz2"
+      "https://dl.bintray.com/boostorg/release/1.75.0/source/boost_1_75_0.tar.bz2"
+    ];
+    # SHA256 from http://www.boost.org/users/history/version_1_75_0.html
+    sha256 = "953db31e016db7bb207f11432bef7df100516eeb746843fa0486a222e3fd49cb";
+  };
+})
+
diff --git a/pkgs/development/libraries/umockdev/default.nix b/pkgs/development/libraries/umockdev/default.nix
index 9911c3e68cd41..cd8c90f319d79 100644
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@@ -1,53 +1,69 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig
-, gobject-introspection, glib, systemd, libgudev, vala
-, usbutils, which, python3 }:
+{ stdenv
+, docbook_xsl
+, fetchurl
+, glib
+, gobject-introspection
+, gtk-doc
+, libgudev
+, meson
+, ninja
+, pkg-config
+, python3
+, systemd
+, usbutils
+, vala
+, which
+}:
 
 stdenv.mkDerivation rec {
   pname = "umockdev";
-  version = "0.13.1";
+  version = "0.15.2";
 
   outputs = [ "bin" "out" "dev" "doc" ];
 
   src = fetchurl {
     url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "197a169imiirgm73d9fn9234cx56agyw9d2f47h7f1d8s2d51lla";
+    sha256 = "19f21qb9ckwvlm7yzpnc0vcp092qbkms2yrafc26b9a63v4imj52";
   };
 
-  patches = [
-    ./fix-test-paths.patch
-    # https://github.com/NixOS/nixpkgs/commit/9960a2be9b32a6d868046c5bfa188b9a0dd66682#commitcomment-34734461
-    ./disable-failed-test.patch
-    # https://github.com/martinpitt/umockdev/pull/93
-    (fetchpatch {
-      url = "https://github.com/abbradar/umockdev/commit/ce22f893bf50de0b32760238a3e2cfb194db89e9.patch";
-      sha256 = "01q3qhs30x8hl23iigimsa2ikbiw8y8y0bpmh02mh1my87shpwnx";
-    })
+  mesonFlags = [
+    "-Dgtk_doc=true"
   ];
 
-  # autoreconfHook complains if we try to build the documentation
-  postPatch = ''
-    echo 'EXTRA_DIST =' > docs/gtk-doc.make
-  '';
-
   preCheck = ''
     patchShebangs tests/test-static-code
   '';
 
   buildInputs = [ glib systemd libgudev ];
 
-  nativeBuildInputs = [ pkgconfig vala gobject-introspection ];
+  nativeBuildInputs = [
+    docbook_xsl
+    gobject-introspection
+    gtk-doc
+    meson
+    ninja
+    pkg-config
+    vala
+  ];
 
   checkInputs = [ python3 which usbutils ];
 
   enableParallelBuilding = true;
 
   # Test fail with libusb 1.0.24
+  # https://github.com/NixOS/nixpkgs/issues/107420
+  # https://github.com/martinpitt/umockdev/issues/115
   doCheck = false;
 
+  postInstall = ''
+    mkdir -p $doc/share/doc/umockdev/
+    mv docs/reference $doc/share/doc/umockdev/
+  '';
+
   meta = with stdenv.lib; {
     description = "Mock hardware devices for creating unit tests";
     license = licenses.lgpl2;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ flokli ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/development/tools/database/litecli/default.nix b/pkgs/development/tools/database/litecli/default.nix
index 163926f0e5858..ee18a72216dc6 100644
--- a/pkgs/development/tools/database/litecli/default.nix
+++ b/pkgs/development/tools/database/litecli/default.nix
@@ -1,8 +1,8 @@
-{ lib, python3Packages, fetchpatch }:
+{ lib, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
   pname = "litecli";
-  version = "1.4.1";
+  version = "1.5.0";
 
   # Python 2 won't have prompt_toolkit 2.x.x
   # See: https://github.com/NixOS/nixpkgs/blob/f49e2ad3657dede09dc998a4a98fd5033fb52243/pkgs/top-level/python-packages.nix#L3408
@@ -10,17 +10,9 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "FARWjtbS5zi/XQDyAVImUmArLj8xATz1jZ4jnXFdq1w=";
+    sha256 = "b09f0804d26b018360b240778612390810e8e00ea0f79d5412fd0d4775c0e3cd";
   };
 
-  patches = [
-    # Fix compatibility with sqlparse >= 0.4.0. Remove with the next release
-    (fetchpatch {
-      url = "https://github.com/dbcli/litecli/commit/37957e401d22f88800bbdec2c690e731f2cc13bd.patch";
-      sha256 = "1x82s2h1rzflyiahyd8pfya30rzs6yx6ij4a4s16f8iix5x35zv9";
-    })
-  ];
-
   propagatedBuildInputs = with python3Packages; [
     cli-helpers
     click
@@ -31,23 +23,17 @@ python3Packages.buildPythonApplication rec {
   ];
 
   checkInputs = with python3Packages; [
-    pytest
+    pytestCheckHook
     mock
   ];
 
-  preCheck = ''
-    export XDG_CONFIG_HOME=$TMP
-    # add missing file
-    mkdir -p tests/data
-    echo -e "t1,11\nt2,22\n" > tests/data/import_data.csv
-  '';
-
   meta = with lib; {
     description = "Command-line interface for SQLite";
     longDescription = ''
       A command-line client for SQLite databases that has auto-completion and syntax highlighting.
     '';
     homepage = "https://litecli.com";
+    changelog = "https://github.com/dbcli/litecli/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ Scriptkiddi ];
   };
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 4b63b589ea952..71f8c8054c714 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    inherit apr aprutil sslSupport proxySupport ldapSupport;
+    inherit apr aprutil sslSupport proxySupport ldapSupport luaSupport lua5;
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index adbcbb63759b8..7ec56b023e591 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "1w48rqrbqah0hnirvjdz8lyr9ah8b73j3cgsppb04gnrmpssgmb6";
+    sha256 = "1qi617ppjjl38mqpbxiqhpxanq9qgqshb87cajs30rqkv9nj811k";
   };
 
   patches = [ ./sysstatedir.patch ];
diff --git a/pkgs/servers/nfs-ganesha/sysstatedir.patch b/pkgs/servers/nfs-ganesha/sysstatedir.patch
index 534f71743e717..fff3d58973533 100644
--- a/pkgs/servers/nfs-ganesha/sysstatedir.patch
+++ b/pkgs/servers/nfs-ganesha/sysstatedir.patch
@@ -1,15 +1,22 @@
 diff --git a/src/include/config-h.in.cmake b/src/include/config-h.in.cmake
-index 51697310b..2b5f91075 100644
+index 2a5795e9f..7314e0594 100644
 --- a/src/include/config-h.in.cmake
 +++ b/src/include/config-h.in.cmake
-@@ -72,8 +72,8 @@
+@@ -71,13 +71,13 @@
+ #cmakedefine HAVE_URCU_REF_GET_UNLESS_ZERO 1
  #define NFS_GANESHA 1
  
- #define GANESHA_CONFIG_PATH "@SYSCONFDIR@/ganesha/ganesha.conf"
+-#define GANESHA_CONFIG_PATH "@SYSCONFDIR@/ganesha/ganesha.conf"
 -#define GANESHA_PIDFILE_PATH "@SYSSTATEDIR@/run/ganesha.pid"
 -#define NFS_V4_RECOV_ROOT "@SYSSTATEDIR@/lib/nfs/ganesha"
++#define GANESHA_CONFIG_PATH "/etc/ganesha/ganesha.conf"
 +#define GANESHA_PIDFILE_PATH "/run/ganesha.pid"
 +#define NFS_V4_RECOV_ROOT "/var/lib/nfs/ganesha"
  /**
   * @brief Default value for krb5_param.ccache_dir
   */
+-#define DEFAULT_NFS_CCACHE_DIR "@SYSSTATEDIR@/run/ganesha"
++#define DEFAULT_NFS_CCACHE_DIR "/run/ganesha"
+ 
+ /* We're LGPL'd */
+ #define _LGPL_SOURCE 1
diff --git a/pkgs/servers/xandikos/default.nix b/pkgs/servers/xandikos/default.nix
index 6bd3ebc4232c2..515282c1dbcf3 100644
--- a/pkgs/servers/xandikos/default.nix
+++ b/pkgs/servers/xandikos/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , fetchFromGitHub
 , python3Packages
+, installShellFiles
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -24,10 +25,17 @@ python3Packages.buildPythonApplication rec {
     prometheus_client
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage xandikos.1
+  '';
+
   meta = with stdenv.lib; {
     description = "Lightweight CalDAV/CardDAV server";
     homepage = "https://github.com/jelmer/xandikos";
     license = licenses.gpl3Plus;
+    changelog = "https://github.com/jelmer/xandikos/blob/v${version}/NEWS";
     maintainers = with maintainers; [ _0x4A6F ];
   };
 }
diff --git a/pkgs/tools/backup/borg/default.nix b/pkgs/tools/backup/borg/default.nix
index 7bfb9e5739223..f7d9896431cae 100644
--- a/pkgs/tools/backup/borg/default.nix
+++ b/pkgs/tools/backup/borg/default.nix
@@ -2,11 +2,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.1.14";
+  version = "1.1.15";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "1fpdj73cgp96xwasdcifxl7q2pr1my2f4vfdjpv771llri3hgfvx";
+    sha256 = "1g62sdzcw3zx4ccky125ciwnzx6z9kwyvskvp7ijmqxqk3nrxjs9";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/graphics/jhead/default.nix b/pkgs/tools/graphics/jhead/default.nix
index 19a0e26d9ccfc..1d3696a8cd249 100644
--- a/pkgs/tools/graphics/jhead/default.nix
+++ b/pkgs/tools/graphics/jhead/default.nix
@@ -43,5 +43,10 @@ stdenv.mkDerivation rec {
     license = licenses.publicDomain;
     maintainers = with maintainers; [ rycee ];
     platforms = platforms.all;
+    # https://github.com/NixOS/nixpkgs/issues/90828
+    knownVulnerabilities = [
+      "CVE-2020-6624"
+      "CVE-2020-6625"
+    ];
   };
 }
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index c9e75f39e9b85..ef98f48214050 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, pkgs
 , fetchurl
 , fetchpatch
 , zlib
@@ -68,7 +69,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ]
     ++ optional (hpnSupport || withGssapiPatches) autoreconfHook
-    ++ optional withKerberos kerberos.dev;
+    ++ optional withKerberos pkgs.kerberos.dev;
   buildInputs = [ zlib openssl libedit pam ]
     ++ optional withFIDO libfido2
     ++ optional withKerberos kerberos;
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index e5574be8ab941..f3c9990a3c742 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -1,19 +1,35 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, buildGoModule
+, pcsclite
+, PCSC
+, pkg-config
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "step-ca";
-  version = "0.13.3";
-
-  goPackagePath = "github.com/smallstep/certificates";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "v${version}";
-    sha256 = "1i42j7v5a5qqqb9ng8irblfyzykhyws0394q3zac290ymjijxbnq";
+    sha256 = "0n26692ph4q4cmrqammfazmx1k9p2bydwqc57q4hz5ni6jd31zbz";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "0w0phyqymcg2h2jjasxmkf4ryn4y1bqahcy94rs738cqr5ifyfbg";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    lib.optional stdenv.isLinux (lib.getDev pcsclite)
+    ++ lib.optional stdenv.isDarwin PCSC;
+
+  # Tests fail on darwin with
+  # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted [recovered]
+  # probably some sandboxing issue
+  doCheck = stdenv.isLinux;
 
   meta = with lib; {
     description = "A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH";
diff --git a/pkgs/tools/security/step-ca/deps.nix b/pkgs/tools/security/step-ca/deps.nix
deleted file mode 100644
index 07607b6f65d27..0000000000000
--- a/pkgs/tools/security/step-ca/deps.nix
+++ /dev/null
@@ -1,291 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/AndreasBriese/bbloom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/AndreasBriese/bbloom";
-      rev =  "e2d15f34fcf99d5dbb871c820ec73f710fca9815";
-      sha256 = "05kkrsmpragy69bj6s80pxlm3pbwxrkkx7wgk0xigs6y2n6ylpds";
-    };
-  }
-  {
-    goPackagePath  = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev =  "2972be24d48e78746da79ba8e24e8b488c9880de";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgraph-io/badger";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgraph-io/badger";
-      rev =  "391b6d3b93e6014fe8c2971fcc0c1266e47dbbd9";
-      sha256 = "13zyd6irxagwfv4azgmpk2qg8f80plhxrcjl8x89jzsjkl0a0pkx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgryski/go-farm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-farm";
-      rev =  "6a90982ecee230ff6cba02d5bd386acc030be9d3";
-      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-chi/chi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-chi/chi";
-      rev =  "0ebf7795c516423a110473652e9ba3a59a504863";
-      sha256 = "18hwj6vni19ykp3bsmg9ggnl6y2hawym0vbsigdgx8craqbp7jb1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
-      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "aa810b61a9c79d51363740d207bb46cf8e620ed5";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
-    };
-  }
-  {
-    goPackagePath  = "github.com/juju/ansiterm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/ansiterm";
-      rev =  "720a0952cc2ac777afc295d9861263e2a4cf96a1";
-      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev =  "5c8c8bd35d3832f5d134ae1e1e375b69a4d25242";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lunixbochs/vtclean";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lunixbochs/vtclean";
-      rev =  "2d01aacdc34a083dca635ba869909f5fc0cd4f41";
-      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/manifoldco/promptui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/manifoldco/promptui";
-      rev =  "157c96fb638a14d268b305cf2012582431fcc410";
-      sha256 = "0zha48i5f529q4j1qycybdzza4l9706hijiqws36ikd5jzg8i7wz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "6ca4dbf54d38eea1a992b3c722a76a5d1c4cb25c";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mmcloughlin/avo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mmcloughlin/avo";
-      rev =  "2e7d06bc7ada2979f17ccf8ebf486dba23b84fc7";
-      sha256 = "0fna1hhg193zy428lkj24a8853g3qviqs2c9xi96mji6ldprna5d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/newrelic/go-agent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/newrelic/go-agent";
-      rev =  "f5bce3387232559bcbe6a5f8227c4bf508dac1ba";
-      sha256 = "1zbp1cqhxp0sz3faymam6h1f91r1gl8dnnjx7qg8r06bd5fbzllb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/rs/xid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rs/xid";
-      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
-      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/samfoo/ansi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/samfoo/ansi";
-      rev =  "b6bd2ded7189ce35bc02233b554eb56a5146af73";
-      sha256 = "0sw2d7c6l2ry34x0n4j37ydr8s7hxnax76yh6n35gb2g6f1h46sz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev =  "86672fcb3f950f35f2e675df2240550f2a50762f";
-      sha256 = "142m507s9971cl8qdmbcw7sqxnkgi3xqd8wzvfq15p0w7w8i4a3h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev =  "ad15b42461921f1fb3529b058c6786c6a45d5162";
-      sha256 = "02xdfcp4f6dqvpavwf1vvr794qgz2fx8929paam7wnvcxy7ib606";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/assert";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/assert";
-      rev =  "de77670473b5492f5d0bce155b5c01534c2d13f7";
-      sha256 = "15z2b4qyylnwgq2pzlaxsdabqxh8dbna4ddprk9rzmsvnfkpds16";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/cli";
-      rev =  "eeecaac062cb548ee2ab7c7563bc3c2f2160f019";
-      sha256 = "1khhd1vgwqb08vki1nh0k4i2yk6jjdqmnq4f8anqn125zsj7hvdk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/nosql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/nosql";
-      rev =  "f80b3f432de0662f07ebd58fe52b0a119fe5dcd9";
-      sha256 = "155blxdgaprl1py5g8p52gipp0ckz3k6v41hgsp83nay01yynafb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev =  "b67dcf995b6a7b7f14fad5fcb7cc5441b05e814b";
-      sha256 = "0n5vq4nydlhb7w12jiwphvxqdy4jwpxc3zwlxyhf05lq1nxfb56h";
-    };
-  }
-  {
-    goPackagePath  = "go.etcd.io/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/etcd-io/bbolt";
-      rev =  "63597a96ec0ad9e6d43c3fc81e809909e0237461";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06";
-      sha256 = "0sbsgjm6wqa162ssrf1gnpv62ak5wjn1bn8v7sxwwfg8a93z1028";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "c44066c5c816ec500d459a2a324a753f78531ae0";
-      sha256 = "0mgww74bl15d0jvsh4f3qr1ckjzb8icb8hn0mgs5ppa0b2fgpc4f";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
-      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "54a98f90d1c46b7731eb8fb305d2a321c30ef610";
-      sha256 = "0l7mkdnwhidv8m686x432vmx8z5nqcrr9f46ddgvrxbh4wvyfcll";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/square/go-jose";
-      rev =  "730df5f748271903322feb182be83b43ebbbe27d";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-]
\ No newline at end of file
diff --git a/pkgs/tools/security/step-cli/default.nix b/pkgs/tools/security/step-cli/default.nix
index d696b560f6dc3..2b6ec57bbf2ba 100644
--- a/pkgs/tools/security/step-cli/default.nix
+++ b/pkgs/tools/security/step-cli/default.nix
@@ -1,19 +1,26 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+}:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "step-cli";
-  version = "0.13.3";
-
-  goPackagePath = "github.com/smallstep/cli";
+  version = "0.15.3-22-g3ddc5aa";
 
+  # 0.15.3 isn't enough, because we need https://github.com/smallstep/cli/pull/394
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "cli";
-    rev = "v${version}";
-    sha256 = "0b5hk9a8yq1nyh8m1gmf28yiha95xwsc4dk321g84hvai7g47pbr";
+    rev = "3ddc5aaafccb23ba9a20abfa70109a2923f298e3";
+    sha256 = "1kd04hi764xa3f9p6aw6k9f6wa4y6xsmzby5jxvvkhim4w78brw0";
   };
 
-  goDeps = ./deps.nix;
+  preCheck = ''
+    # Tries to connect to smallstep.com
+    rm command/certificate/remote_test.go
+  '';
+  vendorSha256 = "04hckq78g1p04b2q0rq4xw6d880hqhkabbx1pc3pf8r1m6jxwz10";
 
   meta = with lib; {
     description = "A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
diff --git a/pkgs/tools/security/step-cli/deps.nix b/pkgs/tools/security/step-cli/deps.nix
deleted file mode 100644
index bae1ba070a691..0000000000000
--- a/pkgs/tools/security/step-cli/deps.nix
+++ /dev/null
@@ -1,453 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/AndreasBriese/bbloom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/AndreasBriese/bbloom";
-      rev =  "e2d15f34fcf99d5dbb871c820ec73f710fca9815";
-      sha256 = "05kkrsmpragy69bj6s80pxlm3pbwxrkkx7wgk0xigs6y2n6ylpds";
-    };
-  }
-  {
-    goPackagePath  = "github.com/ThomasRooney/gexpect";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ThomasRooney/gexpect";
-      rev =  "5482f03509440585d13d8f648989e05903001842";
-      sha256 = "04zan78ndabxlwsw2hdcqbz32435pw2s04ljza07jlxnxzjp4kws";
-    };
-  }
-  {
-    goPackagePath  = "github.com/asaskevich/govalidator";
-    fetch = {
-      type = "git";
-      url = "https://github.com/asaskevich/govalidator";
-      rev =  "ccb8e960c48f04d6935e72476ae4a51028f9e22f";
-      sha256 = "1sih4yb6fqmdp5g6594yyida0qm7dvvqcfvf8pgikydkxyqb8g0k";
-    };
-  }
-  {
-    goPackagePath  = "github.com/boombuler/barcode";
-    fetch = {
-      type = "git";
-      url = "https://github.com/boombuler/barcode";
-      rev =  "3cfea5ab600ae37946be2b763b8ec2c1cf2d272d";
-      sha256 = "1fzb8wz1ny2sc78g9rm0bcm80pgwvkm2k6lmim2sb4jgm1j3sajd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/chzyer/readline";
-    fetch = {
-      type = "git";
-      url = "https://github.com/chzyer/readline";
-      rev =  "2972be24d48e78746da79ba8e24e8b488c9880de";
-      sha256 = "104q8dazj8yf6b089jjr82fy9h1g80zyyzvp3g8b44a7d8ngjj6r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/corpix/uarand";
-    fetch = {
-      type = "git";
-      url = "https://github.com/corpix/uarand";
-      rev =  "2b8494104d86337cdd41d0a49cbed8e4583c0ab4";
-      sha256 = "06ml5m8l9wbr96gvyg6z1syawn797f8kmq74nhgry3vqpngyb6yn";
-    };
-  }
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "8991bc29aa16c548c550c7ff78260e27b9ab7c73";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgraph-io/badger";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgraph-io/badger";
-      rev =  "391b6d3b93e6014fe8c2971fcc0c1266e47dbbd9";
-      sha256 = "13zyd6irxagwfv4azgmpk2qg8f80plhxrcjl8x89jzsjkl0a0pkx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgryski/go-farm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgryski/go-farm";
-      rev =  "6a90982ecee230ff6cba02d5bd386acc030be9d3";
-      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-chi/chi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-chi/chi";
-      rev =  "0ebf7795c516423a110473652e9ba3a59a504863";
-      sha256 = "18hwj6vni19ykp3bsmg9ggnl6y2hawym0vbsigdgx8craqbp7jb1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
-      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "b5d812f8a3706043e23a9cd5babf2e5423744d30";
-      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/google/certificate-transparency-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/certificate-transparency-go";
-      rev =  "3629d6846518309d22c16fee15d1007262a459d2";
-      sha256 = "16vsq7dd2kbbk3vwlrhm3jrlg5kq16wf4iz6d1gnyc32s5fcy9d7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/icrowley/fake";
-    fetch = {
-      type = "git";
-      url = "https://github.com/icrowley/fake";
-      rev =  "4178557ae428460c3780a381c824a1f3aceb6325";
-      sha256 = "1mv4bxfphaqbvacy49v4lf4gf2nmadzpmjq0jbdx93wi5bnkc977";
-    };
-  }
-  {
-    goPackagePath  = "github.com/juju/ansiterm";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/ansiterm";
-      rev =  "720a0952cc2ac777afc295d9861263e2a4cf96a1";
-      sha256 = "0n6j0y7xhashp8gdkdl0r7vlbkdrkymrzxn9hxrx522k2isggs7h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kballard/go-shellquote";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kballard/go-shellquote";
-      rev =  "95032a82bc518f77982ea72343cc1ade730072f0";
-      sha256 = "1rspvmnsikdq95jmx3dykxd4k1rmgl98ryjrysvl0cf18hl1vq80";
-    };
-  }
-  {
-    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev =  "5c8c8bd35d3832f5d134ae1e1e375b69a4d25242";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev =  "db8e3cd836b82e82e0a9c8edc6896967dd31374f";
-      sha256 = "0knzlvndfgjm2k23vhp2xj1cv3fm31vbg5b20gdl1vnxk7rh549h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lunixbochs/vtclean";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lunixbochs/vtclean";
-      rev =  "2d01aacdc34a083dca635ba869909f5fc0cd4f41";
-      sha256 = "1ss88dyx5hr4imvpg5lixvp0cf7c2qm4x9m8mdgshjpm92g5rqmf";
-    };
-  }
-  {
-    goPackagePath  = "github.com/manifoldco/promptui";
-    fetch = {
-      type = "git";
-      url = "https://github.com/manifoldco/promptui";
-      rev =  "157c96fb638a14d268b305cf2012582431fcc410";
-      sha256 = "0zha48i5f529q4j1qycybdzza4l9706hijiqws36ikd5jzg8i7wz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "6ca4dbf54d38eea1a992b3c722a76a5d1c4cb25c";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mmcloughlin/avo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mmcloughlin/avo";
-      rev =  "2e7d06bc7ada2979f17ccf8ebf486dba23b84fc7";
-      sha256 = "0fna1hhg193zy428lkj24a8853g3qviqs2c9xi96mji6ldprna5d";
-    };
-  }
-  {
-    goPackagePath  = "github.com/newrelic/go-agent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/newrelic/go-agent";
-      rev =  "f5bce3387232559bcbe6a5f8227c4bf508dac1ba";
-      sha256 = "1zbp1cqhxp0sz3faymam6h1f91r1gl8dnnjx7qg8r06bd5fbzllb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pquerna/otp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pquerna/otp";
-      rev =  "b7b89250c468c06871d3837bee02e2d5c155ae19";
-      sha256 = "0gsl9rh8awira21z6cj26c6swasskx03z66q72yjc1mpbvyg6han";
-    };
-  }
-  {
-    goPackagePath  = "github.com/rs/xid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rs/xid";
-      rev =  "15d26544def341f036c5f8dca987a4cbe575032c";
-      sha256 = "1vgw1dikqw273awcci6pzifs7shkl5ah4l88j1zjbnpgbiwzlx9j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/samfoo/ansi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/samfoo/ansi";
-      rev =  "b6bd2ded7189ce35bc02233b554eb56a5146af73";
-      sha256 = "0sw2d7c6l2ry34x0n4j37ydr8s7hxnax76yh6n35gb2g6f1h46sz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev =  "86672fcb3f950f35f2e675df2240550f2a50762f";
-      sha256 = "142m507s9971cl8qdmbcw7sqxnkgi3xqd8wzvfq15p0w7w8i4a3h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev =  "ad15b42461921f1fb3529b058c6786c6a45d5162";
-      sha256 = "02xdfcp4f6dqvpavwf1vvr794qgz2fx8929paam7wnvcxy7ib606";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/assert";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/assert";
-      rev =  "de77670473b5492f5d0bce155b5c01534c2d13f7";
-      sha256 = "15z2b4qyylnwgq2pzlaxsdabqxh8dbna4ddprk9rzmsvnfkpds16";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/certificates";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/certificates";
-      rev =  "effb490d276f33b8cdab661df8b57a8ded67e082";
-      sha256 = "1i76bbm4rbpv4cw2ln36v0x74jjkss6j8pdh49hfvb75j2n32790";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/certinfo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/certinfo";
-      rev =  "78e21b44234ef6ddeb58f5e8aad2ed09975b694a";
-      sha256 = "0zrxql9173vzn7zirv4299j0vw2mzwknivrg8rzhdbkhvbfiql9q";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/nosql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/nosql";
-      rev =  "a0934e12468769d8cbede3ed316c47a4b88de4ca";
-      sha256 = "08bg0sgrhkzflyl0ybi8v2vmk8bfk5pmcyfrizpxssyql7k27fam";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/truststore";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/truststore";
-      rev =  "e16045d94a61ca04b60d5d246da3117e7eeb1ecf";
-      sha256 = "15cv3dkn2npf6rwhkb575sdq089rf70rha8wrym4ygc8rjbgwbab";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/zcrypto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/zcrypto";
-      rev =  "6bab21fcaafc3d150cf793b6d5f25fe32f49c80e";
-      sha256 = "129az7k556lmnhh14ayrwzrp1y205zdgwk3rj1xcmgisx5irliqp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/smallstep/zlint";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smallstep/zlint";
-      rev =  "d84eaafe274f9dc1f811ebfbb073e18c466e2a44";
-      sha256 = "1xm7b1wvbify20vk9f3kmgmi5mnj5x2z3czc0r4zylcqcwwjkfd6";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "f35b8ab0b5a2cef36673838d662e249dd9c94686";
-      sha256 = "0dlszlshlxbmmfxj5hlwgv3r22x0y1af45gn1vd198nvvs3pnvfs";
-    };
-  }
-  {
-    goPackagePath  = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev =  "b67dcf995b6a7b7f14fad5fcb7cc5441b05e814b";
-      sha256 = "0n5vq4nydlhb7w12jiwphvxqdy4jwpxc3zwlxyhf05lq1nxfb56h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/weppos/publicsuffix-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/weppos/publicsuffix-go";
-      rev =  "386050f8211b04c965721c3591e7d96650a1ea86";
-      sha256 = "17nvc0m0azm418w4mcyk7r1qcik0099vjpn455ia0lxhbqbl701b";
-    };
-  }
-  {
-    goPackagePath  = "go.etcd.io/bbolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/etcd-io/bbolt";
-      rev =  "63597a96ec0ad9e6d43c3fc81e809909e0237461";
-      sha256 = "13d5l6p6c5wvkr6vn9hkhz9c593qifn7fgx0hg4d6jcvg1y0bnm2";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "4d3f4d9ffa16a13f451c3b2999e9c49e9750bf06";
-      sha256 = "0sbsgjm6wqa162ssrf1gnpv62ak5wjn1bn8v7sxwwfg8a93z1028";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "c44066c5c816ec500d459a2a324a753f78531ae0";
-      sha256 = "0mgww74bl15d0jvsh4f3qr1ckjzb8icb8hn0mgs5ppa0b2fgpc4f";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9b800f95dbbc54abff0acf7ee32d88ba4e328c89";
-      sha256 = "07v3l7q7y59cwvw0mc85i39v7qjcc1jh4svwi789rmrqqm5nq7q6";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "f21a4dfb5e38f5895301dc265a8def02365cc3d0";
-      sha256 = "0r6x6zjzhr8ksqlpiwm5gdd7s209kwk5p4lw54xjvz10cs3qlq19";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "3a10b9bf0a52df7e992a8c3eb712a86d3c896c75";
-      sha256 = "19f3dijcc54jnd7458jab2dgpd0gzccmv2qympd9wi8cc8jpnhws";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "54a98f90d1c46b7731eb8fb305d2a321c30ef610";
-      sha256 = "0l7mkdnwhidv8m686x432vmx8z5nqcrr9f46ddgvrxbh4wvyfcll";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/square/go-jose";
-      rev =  "730df5f748271903322feb182be83b43ebbbe27d";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-  {
-    goPackagePath  = "howett.net/plist";
-    fetch = {
-      type = "git";
-      url = "https://gitlab.howett.net/go/plist.git";
-      rev =  "591f970eefbbeb04d7b37f334a0c4c3256e32876";
-      sha256 = "1gr74rf6m8bgayf6mxcfaxb3cc49ldlhydzqfafx7di5nds5hxk9";
-    };
-  }
-]
diff --git a/pkgs/tools/typesetting/bibclean/default.nix b/pkgs/tools/typesetting/bibclean/default.nix
index d0e2c79c0bcef..c95c6921a4e0d 100644
--- a/pkgs/tools/typesetting/bibclean/default.nix
+++ b/pkgs/tools/typesetting/bibclean/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     description = "Prettyprint and syntax check BibTeX and Scribe bibliography data base files";
     homepage = "http://ftp.math.utah.edu/pub/bibclean";
     license = licenses.gpl2;
+    platforms = platforms.all;
     maintainers = with maintainers; [ dtzWill ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f03c9ab845cb3..9f087dd677745 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2617,7 +2617,9 @@ in
 
   statserial = callPackage ../tools/misc/statserial { };
 
-  step-ca = callPackage ../tools/security/step-ca { };
+  step-ca = callPackage ../tools/security/step-ca {
+    inherit (darwin.apple_sdk.frameworks) PCSC;
+  };
 
   step-cli = callPackage ../tools/security/step-cli { };
 
@@ -6457,6 +6459,8 @@ in
 
   papertrail = callPackage ../tools/text/papertrail { };
 
+  pappl = callPackage ../applications/printing/pappl { };
+
   par2cmdline = callPackage ../tools/networking/par2cmdline { };
 
   parallel = callPackage ../tools/misc/parallel { };
@@ -12550,7 +12554,8 @@ in
   boost172 = callPackage ../development/libraries/boost/1.72.nix { };
   boost173 = callPackage ../development/libraries/boost/1.73.nix { };
   boost174 = callPackage ../development/libraries/boost/1.74.nix { };
-  boost17x = boost174;
+  boost175 = callPackage ../development/libraries/boost/1.75.nix { };
+  boost17x = boost175;
   boost = boost16x;
 
   boost_process = callPackage ../development/libraries/boost-process { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 39e203aa170a4..330abc91db240 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13499,6 +13499,22 @@ let
     };
   };
 
+  MojoSAML = buildPerlModule {
+    pname = "Mojo-SAML";
+    version = "0.07";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-SAML-0.07.tar.gz";
+      sha256 = "03biykpz281z9nmd846jlxwzbaqlqwvh987aw9spl7bgvfn4rhkj";
+    };
+    buildInputs = [ ModuleBuildTiny ];
+    propagatedBuildInputs = [ CryptOpenSSLRSA CryptOpenSSLX509 DataGUID Mojolicious XMLCanonicalizeXML ];
+    meta = {
+      description = "A SAML2 toolkit using the Mojo toolkit";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   MojoSQLite = buildPerlModule {
     pname = "Mojo-SQLite";
     version = "3.004";
@@ -22888,6 +22904,21 @@ let
     };
   };
 
+  XMLCanonicalizeXML = buildPerlPackage {
+    pname = "XML-CanonicalizeXML";
+    version = "0.10";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/S/SJ/SJZASADA/XML-CanonicalizeXML-0.10.tar.gz";
+      sha256 = "1vl6wbqmq91mc0hkgfwlndbxcv2jm01hj7kpzprw3d6bh144ca77";
+    };
+    buildInputs = [ pkgs.libxml2 ];
+    meta = {
+      description = "Perl extension for inclusive (1.0 and 1.1) and exclusive canonicalization of XML using libxml2";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   XMLDescent = buildPerlModule {
     pname = "XML-Descent";
     version = "1.04";