summary refs log tree commit diff
path: root/pkgs/tools/security
diff options
context:
space:
mode:
authorBen Siraphob <bensiraphob@gmail.com>2021-01-15 16:19:50 +0700
committerBen Siraphob <bensiraphob@gmail.com>2021-01-15 17:12:36 +0700
commit8c5d37129fc5097d9fb52e95fb07de75392d1c3c (patch)
tree40cfd341b87811008151e9ecf053cf7449574b98 /pkgs/tools/security
parent94f36839357387fd711d17d762d88c69767f265b (diff)
pkgs/tools: stdenv.lib -> lib
Diffstat (limited to 'pkgs/tools/security')
-rw-r--r--pkgs/tools/security/1password-gui/default.nix2
-rw-r--r--pkgs/tools/security/acsccid/default.nix2
-rw-r--r--pkgs/tools/security/aespipe/default.nix2
-rw-r--r--pkgs/tools/security/afl/default.nix6
-rw-r--r--pkgs/tools/security/afl/libdislocator.nix4
-rw-r--r--pkgs/tools/security/afl/qemu.nix2
-rw-r--r--pkgs/tools/security/aflplusplus/default.nix10
-rw-r--r--pkgs/tools/security/aflplusplus/libdislocator.nix4
-rw-r--r--pkgs/tools/security/aflplusplus/libtokencap.nix4
-rw-r--r--pkgs/tools/security/aflplusplus/qemu.nix2
-rw-r--r--pkgs/tools/security/apg/default.nix12
-rw-r--r--pkgs/tools/security/asc-key-to-qr-code-gif/default.nix4
-rw-r--r--pkgs/tools/security/b2sum/default.nix4
-rw-r--r--pkgs/tools/security/bash-supergenpass/default.nix2
-rw-r--r--pkgs/tools/security/bettercap/default.nix2
-rw-r--r--pkgs/tools/security/bitwarden/default.nix2
-rw-r--r--pkgs/tools/security/bitwarden_rs/default.nix2
-rw-r--r--pkgs/tools/security/brutespray/default.nix2
-rw-r--r--pkgs/tools/security/ccrypt/default.nix8
-rw-r--r--pkgs/tools/security/chntpw/default.nix6
-rw-r--r--pkgs/tools/security/clamav/default.nix6
-rw-r--r--pkgs/tools/security/cowpatty/default.nix4
-rw-r--r--pkgs/tools/security/crlfuzz/default.nix4
-rw-r--r--pkgs/tools/security/dirmngr/default.nix6
-rw-r--r--pkgs/tools/security/duo-unix/default.nix8
-rw-r--r--pkgs/tools/security/ecryptfs/default.nix6
-rw-r--r--pkgs/tools/security/enchive/default.nix8
-rw-r--r--pkgs/tools/security/encryptr/default.nix2
-rw-r--r--pkgs/tools/security/enum4linux/default.nix2
-rw-r--r--pkgs/tools/security/fail2ban/default.nix2
-rw-r--r--pkgs/tools/security/fpm2/default.nix4
-rw-r--r--pkgs/tools/security/fprintd/default.nix2
-rw-r--r--pkgs/tools/security/fwknop/default.nix12
-rw-r--r--pkgs/tools/security/gen-oath-safe/default.nix2
-rw-r--r--pkgs/tools/security/genpass/default.nix2
-rw-r--r--pkgs/tools/security/gnu-pw-mgr/default.nix2
-rw-r--r--pkgs/tools/security/gnupg/22.nix6
-rw-r--r--pkgs/tools/security/gopass/default.nix6
-rw-r--r--pkgs/tools/security/gorilla-bin/default.nix8
-rw-r--r--pkgs/tools/security/gpgstats/default.nix2
-rw-r--r--pkgs/tools/security/haka/default.nix6
-rw-r--r--pkgs/tools/security/hash-slinger/default.nix6
-rw-r--r--pkgs/tools/security/hashdeep/default.nix2
-rw-r--r--pkgs/tools/security/haveged/default.nix8
-rw-r--r--pkgs/tools/security/honggfuzz/default.nix6
-rw-r--r--pkgs/tools/security/ipscan/default.nix2
-rw-r--r--pkgs/tools/security/john/default.nix4
-rw-r--r--pkgs/tools/security/jwt-cli/default.nix2
-rw-r--r--pkgs/tools/security/kbs2/default.nix8
-rw-r--r--pkgs/tools/security/keybase/default.nix2
-rw-r--r--pkgs/tools/security/kpcli/default.nix4
-rw-r--r--pkgs/tools/security/lynis/default.nix2
-rw-r--r--pkgs/tools/security/mbox/default.nix6
-rw-r--r--pkgs/tools/security/meo/default.nix10
-rw-r--r--pkgs/tools/security/mkrand/default.nix6
-rw-r--r--pkgs/tools/security/modsecurity/default.nix4
-rw-r--r--pkgs/tools/security/monkeysphere/default.nix10
-rw-r--r--pkgs/tools/security/monsoon/default.nix4
-rw-r--r--pkgs/tools/security/nitrokey-app/udev-rules.nix4
-rw-r--r--pkgs/tools/security/nmap/default.nix4
-rw-r--r--pkgs/tools/security/open-ecard/default.nix2
-rw-r--r--pkgs/tools/security/opensc/default.nix8
-rw-r--r--pkgs/tools/security/ossec/default.nix6
-rw-r--r--pkgs/tools/security/p0f/default.nix8
-rw-r--r--pkgs/tools/security/pass/default.nix12
-rw-r--r--pkgs/tools/security/pass/rofi-pass.nix8
-rw-r--r--pkgs/tools/security/pbis/default.nix2
-rw-r--r--pkgs/tools/security/pcsc-scm-scl011/default.nix2
-rw-r--r--pkgs/tools/security/pcsclite/default.nix8
-rw-r--r--pkgs/tools/security/pgpdump/default.nix2
-rw-r--r--pkgs/tools/security/pinentry/default.nix2
-rw-r--r--pkgs/tools/security/pinentry/mac.nix6
-rw-r--r--pkgs/tools/security/pius/default.nix8
-rw-r--r--pkgs/tools/security/polkit-gnome/default.nix8
-rw-r--r--pkgs/tools/security/pwgen/default.nix4
-rw-r--r--pkgs/tools/security/radamsa/default.nix8
-rw-r--r--pkgs/tools/security/rage/default.nix2
-rw-r--r--pkgs/tools/security/rarcrack/default.nix2
-rw-r--r--pkgs/tools/security/ripasso/cursive.nix2
-rw-r--r--pkgs/tools/security/rng-tools/default.nix4
-rw-r--r--pkgs/tools/security/rustscan/default.nix2
-rw-r--r--pkgs/tools/security/saml2aws/default.nix4
-rw-r--r--pkgs/tools/security/scallion/default.nix2
-rw-r--r--pkgs/tools/security/seccure/default.nix10
-rw-r--r--pkgs/tools/security/secp256k1/default.nix2
-rw-r--r--pkgs/tools/security/shc/default.nix2
-rw-r--r--pkgs/tools/security/signing-party/default.nix28
-rw-r--r--pkgs/tools/security/softhsm/default.nix2
-rw-r--r--pkgs/tools/security/spectre-meltdown-checker/default.nix2
-rw-r--r--pkgs/tools/security/ssdeep/default.nix8
-rw-r--r--pkgs/tools/security/sshuttle/default.nix4
-rw-r--r--pkgs/tools/security/ssss/default.nix6
-rw-r--r--pkgs/tools/security/stoken/default.nix2
-rw-r--r--pkgs/tools/security/stricat/default.nix8
-rw-r--r--pkgs/tools/security/sudo/default.nix10
-rw-r--r--pkgs/tools/security/sudolikeaboss/default.nix2
-rw-r--r--pkgs/tools/security/super/default.nix4
-rw-r--r--pkgs/tools/security/tcpcrypt/default.nix4
-rw-r--r--pkgs/tools/security/tor/default.nix8
-rw-r--r--pkgs/tools/security/tor/tor-arm.nix8
-rw-r--r--pkgs/tools/security/tor/torsocks.nix12
-rw-r--r--pkgs/tools/security/tpm-quote-tools/default.nix8
-rw-r--r--pkgs/tools/security/volatility/default.nix2
-rw-r--r--pkgs/tools/security/yara/default.nix12
104 files changed, 266 insertions, 266 deletions
diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index d9f7a7c7d3315..cb4ba1a2c0e4a 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     # Wrap the application with Electron.
     makeWrapper "${electron_11}/bin/electron" "$out/bin/${pname}" \
       --add-flags "$out/share/${pname}/resources/app.asar" \
-      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath runtimeLibs}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
   '';
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/tools/security/acsccid/default.nix b/pkgs/tools/security/acsccid/default.nix
index df30d18edfc65..eb31bf0cdebee 100644
--- a/pkgs/tools/security/acsccid/default.nix
+++ b/pkgs/tools/security/acsccid/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     pcsclite
     libusb1
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     libiconv
   ];
 
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index f0a1dbbf7aca5..f2244f98d54bd 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     cp bz2aespipe $out/bin
     wrapProgram $out/bin/bz2aespipe \
-     --prefix PATH : $out/bin:${stdenv.lib.makeBinPath [ sharutils ]}
+     --prefix PATH : $out/bin:${lib.makeBinPath [ sharutils ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index 091b52bfcf04a..056aa3b07fdec 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, callPackage, makeWrapper
+{ lib, stdenv, fetchFromGitHub, callPackage, makeWrapper
 , clang, llvm, which, libcgroup
 }:
 
@@ -74,9 +74,9 @@ let
         testing regimes down the road.
       '';
       homepage    = "https://lcamtuf.coredump.cx/afl/";
-      license     = stdenv.lib.licenses.asl20;
+      license     = lib.licenses.asl20;
       platforms   = ["x86_64-linux" "i686-linux"];
-      maintainers = with stdenv.lib.maintainers; [ thoughtpolice ris ];
+      maintainers = with lib.maintainers; [ thoughtpolice ris ];
     };
   };
 in afl
diff --git a/pkgs/tools/security/afl/libdislocator.nix b/pkgs/tools/security/afl/libdislocator.nix
index 1c22c7d1d244d..400464c005673 100644
--- a/pkgs/tools/security/afl/libdislocator.nix
+++ b/pkgs/tools/security/afl/libdislocator.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, afl}:
 
 stdenv.mkDerivation {
-  version = stdenv.lib.getVersion afl;
+  version = lib.getVersion afl;
   pname = "libdislocator";
 
   src = afl.src;
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
       the odds of bumping into heap-related security bugs in
       several ways.
     '';
-    license = stdenv.lib.licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = with maintainers; [ ris ];
   };
 }
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index 31aac2430b8bb..b2c1618ed7932 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -2,7 +2,7 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with stdenv.lib;
+with lib;
 
 let
   qemuName = "qemu-2.10.0";
diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix
index 8e5db3cd22c9a..79a0779e60a1d 100644
--- a/pkgs/tools/security/aflplusplus/default.nix
+++ b/pkgs/tools/security/aflplusplus/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper
+{ lib, stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper
 , clang, llvm, gcc, which, libcgroup, python, perl, gmp
 , file, wine ? null, fetchpatch
 }:
@@ -31,7 +31,7 @@ let
     # script.
     nativeBuildInputs = [ makeWrapper which clang gcc ];
     buildInputs = [ llvm python gmp ]
-      ++ stdenv.lib.optional (wine != null) python.pkgs.wrapPython;
+      ++ lib.optional (wine != null) python.pkgs.wrapPython;
 
 
     postPatch = ''
@@ -91,7 +91,7 @@ let
 
       patchShebangs $out/bin
 
-    '' + stdenv.lib.optionalString (wine != null) ''
+    '' + lib.optionalString (wine != null) ''
       substitute afl-wine-trace $out/bin/afl-wine-trace \
         --replace "qemu_mode/unsigaction" "$out/lib/afl"
       chmod +x $out/bin/afl-wine-trace
@@ -128,9 +128,9 @@ let
         and improvements from the community
       '';
       homepage    = "https://aflplus.plus";
-      license     = stdenv.lib.licenses.asl20;
+      license     = lib.licenses.asl20;
       platforms   = ["x86_64-linux" "i686-linux"];
-      maintainers = with stdenv.lib.maintainers; [ ris mindavi ];
+      maintainers = with lib.maintainers; [ ris mindavi ];
     };
   };
 in aflplusplus
diff --git a/pkgs/tools/security/aflplusplus/libdislocator.nix b/pkgs/tools/security/aflplusplus/libdislocator.nix
index 99f9d51ea7e64..ed695a7a70275 100644
--- a/pkgs/tools/security/aflplusplus/libdislocator.nix
+++ b/pkgs/tools/security/aflplusplus/libdislocator.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, aflplusplus}:
 
 stdenv.mkDerivation {
-  version = stdenv.lib.getVersion aflplusplus;
+  version = lib.getVersion aflplusplus;
   pname = "libdislocator";
 
   src = aflplusplus.src;
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
       the odds of bumping into heap-related security bugs in
       several ways.
     '';
-    license = stdenv.lib.licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = with maintainers; [ ris ];
   };
 }
diff --git a/pkgs/tools/security/aflplusplus/libtokencap.nix b/pkgs/tools/security/aflplusplus/libtokencap.nix
index 87e06ed9aeb94..f3ea5d4ec6b7f 100644
--- a/pkgs/tools/security/aflplusplus/libtokencap.nix
+++ b/pkgs/tools/security/aflplusplus/libtokencap.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, aflplusplus}:
 
 stdenv.mkDerivation {
-  version = stdenv.lib.getVersion aflplusplus;
+  version = lib.getVersion aflplusplus;
   pname = "libtokencap";
 
   src = aflplusplus.src;
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://github.com/vanhauser-thc/AFLplusplus";
     description = "strcmp & memcmp token capture library";
-    license = stdenv.lib.licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = with maintainers; [ ris ];
   };
 }
diff --git a/pkgs/tools/security/aflplusplus/qemu.nix b/pkgs/tools/security/aflplusplus/qemu.nix
index cc6bf3a83efad..74e081b95a3ab 100644
--- a/pkgs/tools/security/aflplusplus/qemu.nix
+++ b/pkgs/tools/security/aflplusplus/qemu.nix
@@ -2,7 +2,7 @@
 , texinfo, libuuid, flex, bison, pixman, autoconf
 }:
 
-with stdenv.lib;
+with lib;
 
 let
   qemuName = "qemu-3.1.0";
diff --git a/pkgs/tools/security/apg/default.nix b/pkgs/tools/security/apg/default.nix
index 1dcdeae832d5b..579026f07ca9c 100644
--- a/pkgs/tools/security/apg/default.nix
+++ b/pkgs/tools/security/apg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl }:
+{ lib, stdenv, fetchurl, openssl }:
 stdenv.mkDerivation rec {
   name = "apg-2.3.0b";
   src = fetchurl {
@@ -8,14 +8,14 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     substituteInPlace Makefile --replace /usr/local "$out"
   '';
-  makeFlags = stdenv.lib.optionals stdenv.isDarwin ["CC=cc"];
+  makeFlags = lib.optionals stdenv.isDarwin ["CC=cc"];
 
   patches = [
     ./apg.patch
     ./phony-install-target.patch
   ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = lib.optionalString stdenv.isDarwin ''
     sed -i -e 's|APG_CLIBS += -lcrypt|APG_CLIBS += -L${openssl.out}/lib -lcrypto|' Makefile
   '';
 
@@ -65,8 +65,8 @@ stdenv.mkDerivation rec {
          password generation
     '';
     homepage = "http://www.adel.nursat.kz/apg/";
-    license = stdenv.lib.licenses.bsd3;
-    maintainers = with stdenv.lib.maintainers; [ astsmtl ];
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ astsmtl ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
index b0e3a6449596f..3256b5431a75e 100644
--- a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
+++ b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
@@ -23,12 +23,12 @@ stdenv.mkDerivation {
     substitutions = [
       ''--replace "convert" "${imagemagick}/bin/convert"''
       ''--replace "qrencode" "${qrencode.bin}/bin/qrencode"''
-    ] ++ stdenv.lib.optional testQR [
+    ] ++ lib.optional testQR [
       ''--replace "hash zbarimg" "true"'' # hash does not work on NixOS
       ''--replace "$(zbarimg --raw" "$(${zbar.out}/bin/zbarimg --raw"''
     ];
   in ''
-    substituteInPlace asc-to-gif.sh ${stdenv.lib.concatStringsSep " " substitutions}
+    substituteInPlace asc-to-gif.sh ${lib.concatStringsSep " " substitutions}
   '';
 
   installPhase = ''
diff --git a/pkgs/tools/security/b2sum/default.nix b/pkgs/tools/security/b2sum/default.nix
index fdd4f2c73fd40..393043df67588 100644
--- a/pkgs/tools/security/b2sum/default.nix
+++ b/pkgs/tools/security/b2sum/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchzip, openmp ? null }:
+{ lib, stdenv, fetchzip, openmp ? null }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation {
   pname = "b2sum";
diff --git a/pkgs/tools/security/bash-supergenpass/default.nix b/pkgs/tools/security/bash-supergenpass/default.nix
index cbacf8b33a471..9276c9b116773 100644
--- a/pkgs/tools/security/bash-supergenpass/default.nix
+++ b/pkgs/tools/security/bash-supergenpass/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   installPhase = ''
     install -m755 -D supergenpass.sh "$out/bin/supergenpass"
-    wrapProgram "$out/bin/supergenpass" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnugrep ]}"
+    wrapProgram "$out/bin/supergenpass" --prefix PATH : "${lib.makeBinPath [ openssl coreutils gnugrep ]}"
   '';
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/tools/security/bettercap/default.nix b/pkgs/tools/security/bettercap/default.nix
index 3b0a6ca626407..0037b8cdff747 100644
--- a/pkgs/tools/security/bettercap/default.nix
+++ b/pkgs/tools/security/bettercap/default.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libpcap libusb1 ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ libnfnetlink libnetfilter_queue ];
+    ++ lib.optionals stdenv.isLinux [ libnfnetlink libnetfilter_queue ];
 
   meta = with lib; {
     description = "A man in the middle tool";
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index 9bbcdab6bf7d8..9d700686b1c9f 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -78,7 +78,7 @@ let
 
     postFixup = ''
       makeWrapper $out/opt/Bitwarden/bitwarden $out/bin/bitwarden \
-        --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ libsecret stdenv.cc.cc ] }" \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libsecret stdenv.cc.cc ] }" \
         "''${gappsWrapperArgs[@]}"
     '';
   };
diff --git a/pkgs/tools/security/bitwarden_rs/default.nix b/pkgs/tools/security/bitwarden_rs/default.nix
index 482ba400e637d..d2321523b32d8 100644
--- a/pkgs/tools/security/bitwarden_rs/default.nix
+++ b/pkgs/tools/security/bitwarden_rs/default.nix
@@ -18,7 +18,7 @@ in rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = with stdenv.lib; [ openssl ]
+  buildInputs = with lib; [ openssl ]
     ++ optionals stdenv.isDarwin [ Security CoreServices ]
     ++ optional (dbBackend == "mysql") libmysqlclient
     ++ optional (dbBackend == "postgresql") postgresql;
diff --git a/pkgs/tools/security/brutespray/default.nix b/pkgs/tools/security/brutespray/default.nix
index 69d8dbc96235e..25b9aecb8e0ec 100644
--- a/pkgs/tools/security/brutespray/default.nix
+++ b/pkgs/tools/security/brutespray/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     patchShebangs $out/bin
     patchPythonScript $out/bin/brutespray
     wrapProgram $out/bin/brutespray \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ medusa ]}
+      --prefix PATH : ${lib.makeBinPath [ medusa ]}
 
     mkdir -p $out/share/brutespray
     cp -r wordlist/ $out/share/brutespray/wordlist
diff --git a/pkgs/tools/security/ccrypt/default.nix b/pkgs/tools/security/ccrypt/default.nix
index a3210b2a59874..bf5f26f7044f0 100644
--- a/pkgs/tools/security/ccrypt/default.nix
+++ b/pkgs/tools/security/ccrypt/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, perl}:
+{lib, stdenv, fetchurl, perl}:
 
 stdenv.mkDerivation {
   name = "ccrypt-1.11";
@@ -15,8 +15,8 @@ stdenv.mkDerivation {
   meta = {
     homepage = "http://ccrypt.sourceforge.net/";
     description = "Utility for encrypting and decrypting files and streams with AES-256";
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; all; 
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [viric];
+    platforms = with lib.platforms; all;
   };
 }
diff --git a/pkgs/tools/security/chntpw/default.nix b/pkgs/tools/security/chntpw/default.nix
index d0b75bdd42b28..ef462f5bf2dc2 100644
--- a/pkgs/tools/security/chntpw/default.nix
+++ b/pkgs/tools/security/chntpw/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ unzip ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
+    ++ lib.optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
 
   patches = [
     ./00-chntpw-build-arch-autodetect.patch
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://pogostick.net/~pnh/ntpasswd/";
     description = "An utility to reset the password of any user that has a valid local account on a Windows system";
-    maintainers = with stdenv.lib.maintainers; [ deepfire ];
+    maintainers = with lib.maintainers; [ deepfire ];
     license = licenses.gpl2;
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with lib.platforms; linux;
   };
 }
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 4b3048223f7a4..eb9fc8e7b9570 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -21,8 +21,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter pcre2 libmspack json_c check
-  ] ++ stdenv.lib.optional stdenv.isLinux systemd
-    ++ stdenv.lib.optional stdenv.isDarwin Foundation;
+  ] ++ lib.optional stdenv.isLinux systemd
+    ++ lib.optional stdenv.isDarwin Foundation;
 
   configureFlags = [
     "--libdir=$(out)/lib"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     "--enable-milter"
     "--disable-unrar" # disable unrar because it's non-free and requires some extra patching to work properly
     "--enable-check"
-  ] ++ stdenv.lib.optional stdenv.isLinux
+  ] ++ lib.optional stdenv.isLinux
     "--with-systemdsystemunitdir=$(out)/lib/systemd";
 
   postInstall = ''
diff --git a/pkgs/tools/security/cowpatty/default.nix b/pkgs/tools/security/cowpatty/default.nix
index 7d58de8553b37..4cd420650f3bb 100644
--- a/pkgs/tools/security/cowpatty/default.nix
+++ b/pkgs/tools/security/cowpatty/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchurl, openssl, libpcap
+{ lib, stdenv, fetchurl, openssl, libpcap
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "cowpatty";
diff --git a/pkgs/tools/security/crlfuzz/default.nix b/pkgs/tools/security/crlfuzz/default.nix
index 2e4b17170c659..feddd893cece6 100644
--- a/pkgs/tools/security/crlfuzz/default.nix
+++ b/pkgs/tools/security/crlfuzz/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -18,7 +18,7 @@ buildGoModule rec {
 
   doCheck = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Tool to scan for CRLF vulnerability";
     homepage = "https://github.com/dwisiswant0/crlfuzz";
     license = with licenses; [ mit ];
diff --git a/pkgs/tools/security/dirmngr/default.nix b/pkgs/tools/security/dirmngr/default.nix
index ee97bda190644..cab059ca33eaa 100644
--- a/pkgs/tools/security/dirmngr/default.nix
+++ b/pkgs/tools/security/dirmngr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libgpgerror, libgcrypt, libassuan, libksba, pth, openldap
+{ lib, stdenv, fetchurl, libgpgerror, libgcrypt, libassuan, libksba, pth, openldap
 , libiconv}:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
                   pth openldap libiconv ];
 
   meta = {
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/tools/security/duo-unix/default.nix b/pkgs/tools/security/duo-unix/default.nix
index 2c3a7a441afde..40645ce089d8a 100644
--- a/pkgs/tools/security/duo-unix/default.nix
+++ b/pkgs/tools/security/duo-unix/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pam, openssl, zlib }:
+{ lib, stdenv, fetchurl, pam, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "duo-unix";
@@ -21,8 +21,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Duo Security Unix login integration";
     homepage    = "https://duosecurity.com";
-    license     = stdenv.lib.licenses.gpl2;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.gpl2;
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index dbec36cb12b05..a49c6713e095e 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -33,14 +33,14 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  configureFlags = stdenv.lib.optionals (!enablePython) [ "--disable-pywrap" ];
+  configureFlags = lib.optionals (!enablePython) [ "--disable-pywrap" ];
 
   nativeBuildInputs = [ pkgconfig ]
   # if python2 support is requested, it is needed at builtime as well as runtime.
-  ++ stdenv.lib.optionals (enablePython) [ python2 ]
+  ++ lib.optionals (enablePython) [ python2 ]
   ;
   buildInputs = [ perl nss nspr pam intltool makeWrapper ]
-  ++ stdenv.lib.optionals (enablePython) [ python2 ]
+  ++ lib.optionals (enablePython) [ python2 ]
   ;
   propagatedBuildInputs = [ coreutils gettext cryptsetup lvm2 rsync keyutils which ];
 
diff --git a/pkgs/tools/security/enchive/default.nix b/pkgs/tools/security/enchive/default.nix
index 3c7d3144d3b24..960ef251b1cdf 100644
--- a/pkgs/tools/security/enchive/default.nix
+++ b/pkgs/tools/security/enchive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "enchive";
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Encrypted personal archives";
     homepage = "https://github.com/skeeto/enchive";
-    license = stdenv.lib.licenses.unlicense;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.nico202 ];
+    license = lib.licenses.unlicense;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.nico202 ];
   };
 }
diff --git a/pkgs/tools/security/encryptr/default.nix b/pkgs/tools/security/encryptr/default.nix
index 0cbfd79296dc0..e1a5de7754e7f 100644
--- a/pkgs/tools/security/encryptr/default.nix
+++ b/pkgs/tools/security/encryptr/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation rec {
 
   dontBuild = true;
 
-  rpath = stdenv.lib.makeLibraryPath [
+  rpath = lib.makeLibraryPath [
     glib nss nspr gconf fontconfig freetype pango cairo libX11 libXi
     libXcursor libXext libXfixes libXrender libXcomposite alsaLib
     libXdamage libXtst libXrandr expat libcap dbus gtk2 gdk-pixbuf
diff --git a/pkgs/tools/security/enum4linux/default.nix b/pkgs/tools/security/enum4linux/default.nix
index 4fe567d1ed0f5..9a9f2039ac20e 100644
--- a/pkgs/tools/security/enum4linux/default.nix
+++ b/pkgs/tools/security/enum4linux/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     cp enum4linux.pl $out/bin/enum4linux
 
     wrapProgram $out/bin/enum4linux \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ samba openldap ]}
+      --prefix PATH : ${lib.makeBinPath [ samba openldap ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 45bea0ae99f1b..922fb412cad76 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication {
   };
 
   pythonPath = with python3.pkgs;
-    stdenv.lib.optionals stdenv.isLinux [
+    lib.optionals stdenv.isLinux [
       systemd
     ];
 
diff --git a/pkgs/tools/security/fpm2/default.nix b/pkgs/tools/security/fpm2/default.nix
index 2f297ffd6b79c..1837fc6d85019 100644
--- a/pkgs/tools/security/fpm2/default.nix
+++ b/pkgs/tools/security/fpm2/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, gnupg, gtk2
+{ lib, stdenv, fetchurl, pkgconfig, gnupg, gtk2
 , libxml2, intltool
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "fpm2";
diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 368f49d944d2f..14a9427b0f121 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_DBUS_1_DATADIR = "${placeholder "out"}/share";
 
   # FIXME: Ugly hack for tests to find libpam_wrapper.so
-  LIBRARY_PATH = stdenv.lib.makeLibraryPath [ python3.pkgs.pypamtest ];
+  LIBRARY_PATH = lib.makeLibraryPath [ python3.pkgs.pypamtest ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index d3787f834d03f..b56ba93dc7bca 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -19,17 +19,17 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ libpcap texinfo ]
-    ++ stdenv.lib.optionals gnupgSupport [ gnupg gpgme.dev ]
-    ++ stdenv.lib.optionals wgetSupport [ wget ];
+    ++ lib.optionals gnupgSupport [ gnupg gpgme.dev ]
+    ++ lib.optionals wgetSupport [ wget ];
 
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/run"
     "--with-iptables=${iptables}/sbin/iptables"
-    (stdenv.lib.enableFeature buildServer "server")
-    (stdenv.lib.enableFeature buildClient "client")
-    (stdenv.lib.withFeatureAs wgetSupport "wget" "${wget}/bin/wget")
-  ] ++ stdenv.lib.optionalString gnupgSupport [
+    (lib.enableFeature buildServer "server")
+    (lib.enableFeature buildClient "client")
+    (lib.withFeatureAs wgetSupport "wget" "${wget}/bin/wget")
+  ] ++ lib.optionalString gnupgSupport [
     "--with-gpgme"
     "--with-gpgme-prefix=${gpgme.dev}"
     "--with-gpg=${gnupg}"
diff --git a/pkgs/tools/security/gen-oath-safe/default.nix b/pkgs/tools/security/gen-oath-safe/default.nix
index 670b9631f219a..51ff5b0e81e9f 100644
--- a/pkgs/tools/security/gen-oath-safe/default.nix
+++ b/pkgs/tools/security/gen-oath-safe/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   installPhase =
     let
-      path = stdenv.lib.makeBinPath [
+      path = lib.makeBinPath [
         coreutils
         file
         libcaca.bin
diff --git a/pkgs/tools/security/genpass/default.nix b/pkgs/tools/security/genpass/default.nix
index 88d6604be8378..29703ee1fc873 100644
--- a/pkgs/tools/security/genpass/default.nix
+++ b/pkgs/tools/security/genpass/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1cwxpc3xkw673wiamr4v7clrzwxl8ma1vdr6bw0hixm37gxdxz7x";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation libiconv Security ];
 
   meta = with lib; {
     description = "A simple yet robust commandline random password generator";
diff --git a/pkgs/tools/security/gnu-pw-mgr/default.nix b/pkgs/tools/security/gnu-pw-mgr/default.nix
index af6893b26e865..8478c37483662 100644
--- a/pkgs/tools/security/gnu-pw-mgr/default.nix
+++ b/pkgs/tools/security/gnu-pw-mgr/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gnu.org/software/gnu-pw-mgr/";
     description = "A password manager designed to make it easy to reconstruct difficult passwords";
     license = with licenses; [ gpl3Plus lgpl3Plus ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = lib.platforms.linux;
     maintainers = with maintainers; [ qoelet ];
   };
 }
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index a6b0d43aae210..8dd0c779c3bfd 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -9,7 +9,7 @@
 null
 }:
 
-with stdenv.lib;
+with lib;
 
 assert guiSupport -> pinentry != null && enableMinimal == false;
 
@@ -42,8 +42,8 @@ stdenv.mkDerivation rec {
     # Fix broken SOURCE_DATE_EPOCH usage - remove on the next upstream update
     sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.am
     sed -i 's/$SOURCE_DATE_EPOCH/''${SOURCE_DATE_EPOCH}/' doc/Makefile.in
-  '' + stdenv.lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
-    sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
+  '' + lib.optionalString ( stdenv.isLinux && pcsclite != null) ''
+    sed -i 's,"libpcsclite\.so[^"]*","${lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   ''; #" fix Emacs syntax highlighting :-(
 
   pinentryBinaryPath = pinentry.binaryPath or "bin/pinentry";
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 34abfe2175734..d85c6ca286935 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -29,12 +29,12 @@ buildGoModule rec {
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version} -X main.commit=${src.rev}" ];
 
-  wrapperPath = stdenv.lib.makeBinPath (
+  wrapperPath = lib.makeBinPath (
     [
       git
       gnupg
       xclip
-    ] ++ stdenv.lib.optional stdenv.isLinux wl-clipboard
+    ] ++ lib.optional stdenv.isLinux wl-clipboard
   );
 
   postInstall = ''
@@ -42,7 +42,7 @@ buildGoModule rec {
       $out/bin/gopass completion $shell > gopass.$shell
       installShellCompletion gopass.$shell
     done
-  '' + stdenv.lib.optionalString passAlias ''
+  '' + lib.optionalString passAlias ''
     ln -s $out/bin/gopass $out/bin/pass
   '';
 
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index 975976c6a3c1a..68aa7c4881984 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, makeWrapper, patchelf, stdenv, libXft, libX11, freetype, fontconfig, libXrender, libXScrnSaver, libXext }:
+{ fetchurl, makeWrapper, patchelf, lib, stdenv, libXft, libX11, freetype, fontconfig, libXrender, libXScrnSaver, libXext }:
 
 stdenv.mkDerivation rec {
   pname = "gorilla-bin";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   installPhase = let
     interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
-    libPath = stdenv.lib.makeLibraryPath [ libXft libX11 freetype fontconfig libXrender libXScrnSaver libXext ];
+    libPath = lib.makeLibraryPath [ libXft libX11 freetype fontconfig libXrender libXScrnSaver libXext ];
   in ''
     mkdir -p $out/opt/password-gorilla
     mkdir -p $out/bin
@@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Password Gorilla is a Tk based password manager";
     homepage = "https://github.com/zdia/gorilla/wiki";
-    maintainers = [ stdenv.lib.maintainers.namore ];
+    maintainers = [ lib.maintainers.namore ];
     platforms = [ "x86_64-linux" ];
-    license = stdenv.lib.licenses.gpl2;
+    license = lib.licenses.gpl2;
   };
 }
diff --git a/pkgs/tools/security/gpgstats/default.nix b/pkgs/tools/security/gpgstats/default.nix
index c9a178cff42d4..f6f6d36781096 100644
--- a/pkgs/tools/security/gpgstats/default.nix
+++ b/pkgs/tools/security/gpgstats/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp gpgstats $out/bin
   '';
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.is64bit)
+  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.is64bit)
     "-D_FILE_OFFSET_BITS=64 -DLARGEFILE_SOURCE=1";
 
   meta = with lib; {
diff --git a/pkgs/tools/security/haka/default.nix b/pkgs/tools/security/haka/default.nix
index bc57849dcd5e6..809902e889766 100644
--- a/pkgs/tools/security/haka/default.nix
+++ b/pkgs/tools/security/haka/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, swig, wireshark, check, rsync, libpcap, gawk, libedit, pcre }:
+{ lib, stdenv, fetchurl, cmake, swig, wireshark, check, rsync, libpcap, gawk, libedit, pcre }:
 
 let version = "0.3.0"; in
 
@@ -27,8 +27,8 @@ stdenv.mkDerivation {
   meta = {
     description = "A collection of tools that allows capturing TCP/IP packets and filtering them based on Lua policy files";
     homepage = "http://www.haka-security.org/";
-    license = stdenv.lib.licenses.mpl20;
-    maintainers = [ stdenv.lib.maintainers.tvestelind ];
+    license = lib.licenses.mpl20;
+    maintainers = [ lib.maintainers.tvestelind ];
     platforms = [ "x86_64-linux" "i686-linux" ]; # fails on aarch64
   };
 }
diff --git a/pkgs/tools/security/hash-slinger/default.nix b/pkgs/tools/security/hash-slinger/default.nix
index 4fa0499f1dded..b8759d3571b5e 100644
--- a/pkgs/tools/security/hash-slinger/default.nix
+++ b/pkgs/tools/security/hash-slinger/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages, unbound, libreswan }:
+{ lib, stdenv, fetchFromGitHub, pythonPackages, unbound, libreswan }:
 
 let
   inherit (pythonPackages) python;
@@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
    meta = {
     description = "Various tools to generate special DNS records";
     homepage    = "https://github.com/letoams/hash-slinger";
-    license     = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.leenaars ];
+    license     = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.leenaars ];
   };
 }
diff --git a/pkgs/tools/security/hashdeep/default.nix b/pkgs/tools/security/hashdeep/default.nix
index 2f0a40dfc5e25..4841dc5e07fa9 100644
--- a/pkgs/tools/security/hashdeep/default.nix
+++ b/pkgs/tools/security/hashdeep/default.nix
@@ -18,6 +18,6 @@ in stdenv.mkDerivation {
     homepage = "https://github.com/jessek/hashdeep";
     license = licenses.gpl2;
     platforms = with platforms; linux ++ freebsd ++ openbsd;
-    maintainers = [ stdenv.lib.maintainers.karantan ];
+    maintainers = [ lib.maintainers.karantan ];
   };
 }
diff --git a/pkgs/tools/security/haveged/default.nix b/pkgs/tools/security/haveged/default.nix
index c676a173092da..b088f07c6e3dc 100644
--- a/pkgs/tools/security/haveged/default.nix
+++ b/pkgs/tools/security/haveged/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "haveged";
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
       the barriers to using haveged for other tasks.
     '';
     homepage = "http://www.issihosts.com/haveged/";
-    license = stdenv.lib.licenses.gpl3;
-    maintainers = [ stdenv.lib.maintainers.domenkozar ];
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.domenkozar ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/honggfuzz/default.nix b/pkgs/tools/security/honggfuzz/default.nix
index a46acef81d75d..081e26e34abb9 100644
--- a/pkgs/tools/security/honggfuzz/default.nix
+++ b/pkgs/tools/security/honggfuzz/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, callPackage, makeWrapper
+{ lib, stdenv, fetchFromGitHub, callPackage, makeWrapper
 , clang, llvm, libbfd, libopcodes, libunwind, libblocksruntime
 }:
 
@@ -43,9 +43,9 @@ let
         feedback-based coverage metrics.
       '';
       homepage    = "https://honggfuzz.dev/";
-      license     = stdenv.lib.licenses.asl20;
+      license     = lib.licenses.asl20;
       platforms   = ["x86_64-linux"];
-      maintainers = with stdenv.lib.maintainers; [ cpu ];
+      maintainers = with lib.maintainers; [ cpu ];
     };
   };
 in honggfuzz
diff --git a/pkgs/tools/security/ipscan/default.nix b/pkgs/tools/security/ipscan/default.nix
index 8440b0b6ec989..a5b0fe8d92899 100644
--- a/pkgs/tools/security/ipscan/default.nix
+++ b/pkgs/tools/security/ipscan/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     cp usr/lib/ipscan/ipscan-any-${version}.jar $out/share/${pname}-${version}.jar
 
     makeWrapper ${jre}/bin/java $out/bin/ipscan \
-      --prefix LD_LIBRARY_PATH : "$out/lib/:${stdenv.lib.makeLibraryPath [ swt xorg.libXtst ]}" \
+      --prefix LD_LIBRARY_PATH : "$out/lib/:${lib.makeLibraryPath [ swt xorg.libXtst ]}" \
       --add-flags "-Xmx256m -cp $out/share/${pname}-${version}.jar:${swt}/jars/swt.jar net.azib.ipscan.Main"
 
     mkdir -p $out/share/applications
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index 2fedec48c700d..b243e10d3531e 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, openssl, nss, nspr, kerberos, gmp, zlib, libpcap, re2
+{ lib, stdenv, fetchurl, openssl, nss, nspr, kerberos, gmp, zlib, libpcap, re2
 , gcc, python3Packages, perl, perlPackages, makeWrapper
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "john";
diff --git a/pkgs/tools/security/jwt-cli/default.nix b/pkgs/tools/security/jwt-cli/default.nix
index b607cabf916ee..6b4639a530798 100644
--- a/pkgs/tools/security/jwt-cli/default.nix
+++ b/pkgs/tools/security/jwt-cli/default.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1k13pw202fr5mvd0ys39n3dxwcl3sd01j6izfb28k06b6pav3wc8";
 
-  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+  buildInputs = lib.optional stdenv.isDarwin Security;
 
   doInstallCheck = true;
   installCheckPhase = "$out/bin/jwt --version";
diff --git a/pkgs/tools/security/kbs2/default.nix b/pkgs/tools/security/kbs2/default.nix
index e7b1c95126a66..80e6e25518e68 100644
--- a/pkgs/tools/security/kbs2/default.nix
+++ b/pkgs/tools/security/kbs2/default.nix
@@ -14,18 +14,18 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "1gvvmfavaq29p40p5mq1phpp2a1nw04dz4975pzm1b6z89p0jlzl";
 
   nativeBuildInputs = [ installShellFiles ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
+    ++ lib.optionals stdenv.isLinux [ python3 ];
 
   buildInputs = [ ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ libxcb ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit ];
+    ++ lib.optionals stdenv.isLinux [ libxcb ]
+    ++ lib.optionals stdenv.isDarwin [ AppKit ];
 
   preCheck = ''
     export HOME=$TMPDIR
   '';
 
   checkFlags = [ "--skip=kbs2::config::tests::test_find_config_dir" ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ "--skip=test_ragelib_rewrap_keyfile" ];
+    ++ lib.optionals stdenv.isDarwin [ "--skip=test_ragelib_rewrap_keyfile" ];
 
   postInstall = ''
     mkdir -p $out/share/kbs2
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index ba9649f36ab9c..50724d1199ae0 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -28,7 +28,7 @@ buildGoPackage rec {
     })
   ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox ];
+  buildInputs = lib.optionals stdenv.isDarwin [ AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox ];
   buildFlags = [ "-tags production" ];
 
   meta = with lib; {
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index a0dd8c7fc8b6f..d0e260bb6775d 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -21,14 +21,14 @@ stdenv.mkDerivation rec {
     makeWrapper $out/share/kpcli.pl $out/bin/kpcli --set PERL5LIB \
       "${with perlPackages; makePerlPath ([
          CaptureTiny Clipboard Clone CryptRijndael SortNaturally TermReadKey TermShellUI FileKeePass TermReadLineGnu XMLParser
-      ] ++ stdenv.lib.optional stdenv.isDarwin MacPasteboard)}"
+      ] ++ lib.optional stdenv.isDarwin MacPasteboard)}"
   '';
 
 
   meta = with lib; {
     description = "KeePass Command Line Interface";
     longDescription = ''
-      KeePass Command Line Interface (CLI) / interactive shell. 
+      KeePass Command Line Interface (CLI) / interactive shell.
       Use this program to access and manage your KeePass 1.x or 2.x databases from a Unix-like command line.
     '';
     license = licenses.artistic1;
diff --git a/pkgs/tools/security/lynis/default.nix b/pkgs/tools/security/lynis/default.nix
index 6533c9e96fdfe..42a6bfd341468 100644
--- a/pkgs/tools/security/lynis/default.nix
+++ b/pkgs/tools/security/lynis/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     install -d $out/bin $out/share/lynis/plugins
     cp -r include db default.prf $out/share/lynis/
     cp -a lynis $out/bin
-    wrapProgram "$out/bin/lynis" --prefix PATH : ${stdenv.lib.makeBinPath [ gawk ]}
+    wrapProgram "$out/bin/lynis" --prefix PATH : ${lib.makeBinPath [ gawk ]}
 
     installManPage lynis.8
     installShellCompletion --bash --name lynis.bash \
diff --git a/pkgs/tools/security/mbox/default.nix b/pkgs/tools/security/mbox/default.nix
index 7292ac6785f66..dd73e1624c7de 100644
--- a/pkgs/tools/security/mbox/default.nix
+++ b/pkgs/tools/security/mbox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, which }:
+{ lib, stdenv, fetchFromGitHub, openssl, which }:
 
 stdenv.mkDerivation {
   name = "mbox-20140526";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     cd src
     cp {.,}configsbox.h
   '';
-  
+
   doCheck = true;
   checkPhase = ''
     rm tests/test-*vim.sh tests/test-pip.sh
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     ./testall.sh
   '';
 
-  meta = with stdenv.lib;
+  meta = with lib;
     { description = "Lightweight sandboxing mechanism that any user can use without special privileges";
       homepage = "http://pdos.csail.mit.edu/mbox/";
       maintainers = with maintainers; [ ehmry ];
diff --git a/pkgs/tools/security/meo/default.nix b/pkgs/tools/security/meo/default.nix
index 54b96917623a0..05aa8323cc91d 100644
--- a/pkgs/tools/security/meo/default.nix
+++ b/pkgs/tools/security/meo/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchhg, openssl, pcre-cpp, qt4, boost, pkcs11helper }:
+{ lib, stdenv, fetchhg, openssl, pcre-cpp, qt4, boost, pkcs11helper }:
 
 stdenv.mkDerivation {
   name = "meo-20121113";
-  
+
   src = fetchhg {
     url = "http://oss.stamfest.net/hg/meo";
     rev = "b48e5f16cff8";
@@ -27,9 +27,9 @@ stdenv.mkDerivation {
   meta = {
     homepage = "http://oss.stamfest.net/wordpress/meo-multiple-eyepairs-only";
     description = "Tools to use cryptography for things like four-eyes principles";
-    license = stdenv.lib.licenses.agpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [viric];
+    platforms = with lib.platforms; linux;
     broken = true;
   };
 }
diff --git a/pkgs/tools/security/mkrand/default.nix b/pkgs/tools/security/mkrand/default.nix
index 54934b7111a94..59b48f1881d2d 100644
--- a/pkgs/tools/security/mkrand/default.nix
+++ b/pkgs/tools/security/mkrand/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation {
   name = "mkrand-0.1.0";
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     description = "A Digital Random Bit Generator";
     longDescription = "MKRAND is a utility for generating random information.";
     homepage = "https://github.com/mknight-tag/MKRAND/";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
   };
   }
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index b9b696c17be62..63813619abc27 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -6,7 +6,7 @@
 with lib;
 
 let luaValue = if luaSupport then lua5 else "no";
-    optional = stdenv.lib.optional;
+    optional = lib.optional;
 in
 
 stdenv.mkDerivation rec {
@@ -49,6 +49,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     homepage = "https://www.modsecurity.org/";
     maintainers = with maintainers; [offline];
-    platforms   = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    platforms   = lib.platforms.linux ++ stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index e5dca7721ac75..bc267a9a7703d 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ perl libassuan libgcrypt ]
-    ++ stdenv.lib.optional doCheck
+    ++ lib.optional doCheck
       ([ gnupg opensshUnsafe which socat cpio hexdump procps lockfileProgs ] ++
       (with perlPackages; [ CryptOpenSSLRSA CryptOpenSSLBignum ]));
 
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   # but they aren't enabled by default because they "drain" entropy (GnuPG
   # still uses /dev/random).
   doCheck = false;
-  preCheck = stdenv.lib.optionalString doCheck ''
+  preCheck = lib.optionalString doCheck ''
     patchShebangs tests/
     patchShebangs src/
     sed -i \
@@ -64,12 +64,12 @@ in stdenv.mkDerivation rec {
               CryptOpenSSLRSA
               CryptOpenSSLBignum
             ])
-          + stdenv.lib.optionalString
+          + lib.optionalString
               (builtins.length runtimeDeps > 0)
-              " --prefix PATH : ${stdenv.lib.makeBinPath runtimeDeps}";
+              " --prefix PATH : ${lib.makeBinPath runtimeDeps}";
         wrapMonkeysphere = runtimeDeps: program:
           "wrapProgram $out/bin/${program} ${wrapperArgs runtimeDeps}\n";
-        wrapPrograms = runtimeDeps: programs: stdenv.lib.concatMapStrings
+        wrapPrograms = runtimeDeps: programs: lib.concatMapStrings
           (wrapMonkeysphere runtimeDeps)
           programs;
     in wrapPrograms [ gnupg ] [ "monkeysphere-authentication" "monkeysphere-host" ]
diff --git a/pkgs/tools/security/monsoon/default.nix b/pkgs/tools/security/monsoon/default.nix
index c2a5aa1debf9a..3f414081500f2 100644
--- a/pkgs/tools/security/monsoon/default.nix
+++ b/pkgs/tools/security/monsoon/default.nix
@@ -1,6 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
+, lib, stdenv
 }:
 
 buildGoModule rec {
@@ -19,7 +19,7 @@ buildGoModule rec {
   # tests fails on darwin
   doCheck = !stdenv.isDarwin;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Fast HTTP enumerator";
     longDescription = ''
       A fast HTTP enumerator that allows you to execute a large number of HTTP
diff --git a/pkgs/tools/security/nitrokey-app/udev-rules.nix b/pkgs/tools/security/nitrokey-app/udev-rules.nix
index a89fa7238269f..a8143ae6925ca 100644
--- a/pkgs/tools/security/nitrokey-app/udev-rules.nix
+++ b/pkgs/tools/security/nitrokey-app/udev-rules.nix
@@ -1,9 +1,9 @@
-{ stdenv, nitrokey-app
+{ lib, stdenv, nitrokey-app
 , group ? "nitrokey"
 }:
 
 stdenv.mkDerivation {
-  name = "nitrokey-udev-rules-${stdenv.lib.getVersion nitrokey-app}";
+  name = "nitrokey-udev-rules-${lib.getVersion nitrokey-app}";
 
   inherit (nitrokey-app) src;
 
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index bd543154494cf..e0a4f8a08fc9b 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, libpcap, pkgconfig, openssl, lua5_3
+{ lib, stdenv, fetchurl, fetchpatch, libpcap, pkgconfig, openssl, lua5_3
 , pcre, liblinear, libssh2
 , graphicalSupport ? false
 , libX11 ? null
@@ -8,7 +8,7 @@
 , withLua ? true
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index 0dfdba804c09f..c46d5b65cd8ef 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     makeWrapper ${jre}/bin/java $out/bin/${appName} \
       --add-flags "-cp $out/share/java/cifs-${version}.jar" \
       --add-flags "-jar $out/share/java/richclient-${version}.jar" \
-      --suffix LD_LIBRARY_PATH ':' ${stdenv.lib.getLib pcsclite}/lib
+      --suffix LD_LIBRARY_PATH ':' ${lib.getLib pcsclite}/lib
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/opensc/default.nix b/pkgs/tools/security/opensc/default.nix
index f623e3a2f6ffb..8201b809d156d 100644
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     zlib readline openssl libassuan
     libXt libxslt libiconv docbook_xml_dtd_412
   ]
-  ++ stdenv.lib.optional stdenv.isDarwin Carbon
+  ++ lib.optional stdenv.isDarwin Carbon
   ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
@@ -41,13 +41,13 @@ stdenv.mkDerivation rec {
       if withApplePCSC then
         "${PCSC}/Library/Frameworks/PCSC.framework/PCSC"
       else
-        "${stdenv.lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
+        "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
       }"
-    (stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform)
+    (lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform)
       "XSLTPROC=${buildPackages.libxslt}/bin/xsltproc")
   ];
 
-  PCSC_CFLAGS = stdenv.lib.optionalString withApplePCSC
+  PCSC_CFLAGS = lib.optionalString withApplePCSC
     "-I${PCSC}/Library/Frameworks/PCSC.framework/Headers";
 
   installFlags = [
diff --git a/pkgs/tools/security/ossec/default.nix b/pkgs/tools/security/ossec/default.nix
index 285e275a81f76..22374e1d302b2 100644
--- a/pkgs/tools/security/ossec/default.nix
+++ b/pkgs/tools/security/ossec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, which }:
+{ lib, stdenv, fetchurl, which }:
 
 stdenv.mkDerivation {
   name = "ossec-client-2.6";
@@ -33,8 +33,8 @@ yes
   meta = {
     description = "Open source host-based instrusion detection system";
     homepage = "https://www.ossec.net";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
   };
 }
 
diff --git a/pkgs/tools/security/p0f/default.nix b/pkgs/tools/security/p0f/default.nix
index 02d888b725ff5..84221fbd566ca 100644
--- a/pkgs/tools/security/p0f/default.nix
+++ b/pkgs/tools/security/p0f/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libpcap, bash }:
+{ lib, stdenv, fetchurl, libpcap, bash }:
 
 stdenv.mkDerivation rec {
   pname = "p0f";
@@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Passive network reconnaissance and fingerprinting tool";
     homepage    = "https://lcamtuf.coredump.cx/p0f3/";
-    license     = stdenv.lib.licenses.lgpl21;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.lgpl21;
+    platforms   = lib.platforms.linux;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/pass/default.nix b/pkgs/tools/security/pass/default.nix
index e2b163445ce25..a7872c50fb3b7 100644
--- a/pkgs/tools/security/pass/default.nix
+++ b/pkgs/tools/security/pass/default.nix
@@ -26,7 +26,7 @@ let
   env = extensions:
     let
       selected = [ pass ] ++ extensions passExtensions
-        ++ stdenv.lib.optional tombPluginSupport passExtensions.tomb;
+        ++ lib.optional tombPluginSupport passExtensions.tomb;
     in buildEnv {
       name = "pass-extensions-env";
       paths = selected;
@@ -63,10 +63,10 @@ stdenv.mkDerivation rec {
   patches = [
     ./set-correct-program-name-for-sleep.patch
     ./extension-dir.patch
-  ] ++ stdenv.lib.optional stdenv.isDarwin ./no-darwin-getopt.patch
+  ] ++ lib.optional stdenv.isDarwin ./no-darwin-getopt.patch
     # TODO (@Ma27) this patch adds support for wl-clipboard and can be removed during the next
     # version bump.
-    ++ stdenv.lib.optional waylandSupport ./clip-wayland-support.patch;
+    ++ lib.optional waylandSupport ./clip-wayland-support.patch;
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     cp "contrib/dmenu/passmenu" "$out/bin/"
   '';
 
-  wrapperPath = with stdenv.lib; makeBinPath ([
+  wrapperPath = with lib; makeBinPath ([
     coreutils
     findutils
     getopt
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     # Ensure all dependencies are in PATH
     wrapProgram $out/bin/pass \
       --prefix PATH : "${wrapperPath}"
-  '' + stdenv.lib.optionalString dmenuSupport ''
+  '' + lib.optionalString dmenuSupport ''
     # We just wrap passmenu with the same PATH as pass. It doesn't
     # need all the tools in there but it doesn't hurt either.
     wrapProgram $out/bin/passmenu \
@@ -127,7 +127,7 @@ stdenv.mkDerivation rec {
            -e 's@^GPGS=.*''$@GPG=${gnupg}/bin/gpg2@' \
            -e '/which gpg/ d' \
       tests/setup.sh
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+  '' + lib.optionalString stdenv.isDarwin ''
     # 'pass edit' uses hdid, which is not available from the sandbox.
     rm -f tests/t0200-edit-tests.sh
     rm -f tests/t0010-generate-tests.sh
diff --git a/pkgs/tools/security/pass/rofi-pass.nix b/pkgs/tools/security/pass/rofi-pass.nix
index d46aac93e86b3..b6547deb560ab 100644
--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pass, rofi, coreutils, util-linux, xdotool, gnugrep
+{ lib, stdenv, fetchFromGitHub, pass, rofi, coreutils, util-linux, xdotool, gnugrep
 , libnotify, pwgen, findutils, gawk, gnused, xclip, makeWrapper
 }:
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     cp -a config.example $out/share/doc/rofi-pass/config.example
   '';
 
-  wrapperPath = with stdenv.lib; makeBinPath [
+  wrapperPath = with lib; makeBinPath [
     coreutils
     findutils
     gawk
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A script to make rofi work with password-store";
     homepage = "https://github.com/carnager/rofi-pass";
-    license = stdenv.lib.licenses.gpl3;
-    platforms = with stdenv.lib.platforms; linux;
+    license = lib.licenses.gpl3;
+    platforms = with lib.platforms; linux;
   };
 }
diff --git a/pkgs/tools/security/pbis/default.nix b/pkgs/tools/security/pbis/default.nix
index 25e945a082d2e..a2533c1c6a0f1 100644
--- a/pkgs/tools/security/pbis/default.nix
+++ b/pkgs/tools/security/pbis/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     if [ $CC = gcc ]; then
             NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error=format-overflow -Wno-error=address-of-packed-member"
     fi
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${stdenv.lib.getDev libxml2}/include/libxml2 -Wno-error=array-bounds -Wno-error=pointer-sign -Wno-error=deprecated-declarations -Wno-error=unused-variable"
+    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libxml2}/include/libxml2 -Wno-error=array-bounds -Wno-error=pointer-sign -Wno-error=deprecated-declarations -Wno-error=unused-variable"
   '';
   configureScript = ''../configure'';
   configureFlags = [
diff --git a/pkgs/tools/security/pcsc-scm-scl011/default.nix b/pkgs/tools/security/pcsc-scm-scl011/default.nix
index a9697718e3cfc..b7c4319fa0584 100644
--- a/pkgs/tools/security/pcsc-scm-scl011/default.nix
+++ b/pkgs/tools/security/pcsc-scm-scl011/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     cp -r proprietary/*.bundle $out/pcsc/drivers
   '';
 
-  libPath = stdenv.lib.makeLibraryPath [ libusb-compat-0_1 ];
+  libPath = lib.makeLibraryPath [ libusb-compat-0_1 ];
 
   fixupPhase = ''
     patchelf --set-rpath $libPath \
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 8a4ae08944035..da8fa96d10d95 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
     # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
     "--enable-confdir=/etc"
-  ] ++ stdenv.lib.optional stdenv.isLinux
+  ] ++ lib.optional stdenv.isLinux
          "--with-systemdsystemunitdir=\${out}/etc/systemd/system"
-    ++ stdenv.lib.optional (!stdenv.isLinux)
+    ++ lib.optional (!stdenv.isLinux)
          "--disable-libsystemd";
 
   postConfigure = ''
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkgconfig perl ];
-  buildInputs = [ python3 ] ++ stdenv.lib.optionals stdenv.isLinux [ udev dbus ]
-             ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
+  buildInputs = [ python3 ] ++ lib.optionals stdenv.isLinux [ udev dbus ]
+             ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
diff --git a/pkgs/tools/security/pgpdump/default.nix b/pkgs/tools/security/pgpdump/default.nix
index 89ee6a9eab2df..c0f496438a4ea 100644
--- a/pkgs/tools/security/pgpdump/default.nix
+++ b/pkgs/tools/security/pgpdump/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pi9qdbmcmi58gmljin51ylbi3zkknl8fm26jm67cpl55hvfsn23";
   };
 
-  buildInputs = stdenv.lib.optionals supportCompressedPackets [ zlib bzip2 ];
+  buildInputs = lib.optionals supportCompressedPackets [ zlib bzip2 ];
 
   meta = with lib; {
     description = "A PGP packet visualizer";
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index cac245bb256ee..444dd3679f36b 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -5,7 +5,7 @@
 , enabledFlavors ? [ "curses" "tty" "gtk2" "qt" "emacs" ] ++ lib.optionals stdenv.isLinux [ "gnome3" ]
 }:
 
-with stdenv.lib;
+with lib;
 
 assert isList enabledFlavors && enabledFlavors != [];
 
diff --git a/pkgs/tools/security/pinentry/mac.nix b/pkgs/tools/security/pinentry/mac.nix
index 1c3b87cd9f02e..f208576561e4c 100644
--- a/pkgs/tools/security/pinentry/mac.nix
+++ b/pkgs/tools/security/pinentry/mac.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, xcbuildHook, libiconv, ncurses, Cocoa }:
+{ lib, stdenv, fetchFromGitHub, xcbuildHook, libiconv, ncurses, Cocoa }:
 
 stdenv.mkDerivation {
   name = "pinentry-mac-0.9.4";
@@ -24,8 +24,8 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Pinentry for GPG on Mac";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     homepage = "https://github.com/GPGTools/pinentry-mac";
-    platforms = stdenv.lib.platforms.darwin;
+    platforms = lib.platforms.darwin;
   };
 }
diff --git a/pkgs/tools/security/pius/default.nix b/pkgs/tools/security/pius/default.nix
index f1b4d80a35544..4c92d2e3e1897 100644
--- a/pkgs/tools/security/pius/default.nix
+++ b/pkgs/tools/security/pius/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, stdenv, python3Packages, gnupg, perl }:
+{ fetchFromGitHub, lib, stdenv, python3Packages, gnupg, perl }:
 
 let version = "3.0.0"; in
 python3Packages.buildPythonApplication {
@@ -33,9 +33,9 @@ python3Packages.buildPythonApplication {
          to the process.
       '';
 
-    license = stdenv.lib.licenses.gpl2;
+    license = lib.licenses.gpl2;
 
-    platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ kierdavis ];
+    platforms = lib.platforms.gnu ++ stdenv.lib.platforms.linux;
+    maintainers = with lib.maintainers; [ kierdavis ];
   };
 }
diff --git a/pkgs/tools/security/polkit-gnome/default.nix b/pkgs/tools/security/polkit-gnome/default.nix
index 559911699680b..bd8be01c697b9 100644
--- a/pkgs/tools/security/polkit-gnome/default.nix
+++ b/pkgs/tools/security/polkit-gnome/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, polkit, gtk3, pkgconfig, intltool }:
+{ lib, stdenv, fetchurl, polkit, gtk3, pkgconfig, intltool }:
 stdenv.mkDerivation rec {
   pname = "polkit-gnome";
   version = "0.105";
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://gitlab.gnome.org/Archive/policykit-gnome";
     description = "A dbus session bus service that is used to bring up authentication dialogs";
-    license = stdenv.lib.licenses.lgpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [ phreedom ];
-    platforms = stdenv.lib.platforms.linux;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ phreedom ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/pwgen/default.nix b/pkgs/tools/security/pwgen/default.nix
index a63e40b744e87..c84b9472e96f0 100644
--- a/pkgs/tools/security/pwgen/default.nix
+++ b/pkgs/tools/security/pwgen/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, autoreconfHook}:
+{lib, stdenv, fetchurl, autoreconfHook}:
 stdenv.mkDerivation {
   name = "pwgen-2.08";
 
@@ -11,6 +11,6 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Password generator which creates passwords which can be easily memorized by a human";
-    platforms = stdenv.lib.platforms.all;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/security/radamsa/default.nix b/pkgs/tools/security/radamsa/default.nix
index b1d6400f2d0d6..2ddbc4034926c 100644
--- a/pkgs/tools/security/radamsa/default.nix
+++ b/pkgs/tools/security/radamsa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitLab, bash }:
+{ lib, stdenv, fetchurl, fetchFromGitLab, bash }:
 
 let
   # Fetch explicitly, otherwise build will try to do so
@@ -32,12 +32,12 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ bash ];
   doCheck = true;
-  
+
   meta = {
     description = "A general purpose fuzzer";
     longDescription = "Radamsa is a general purpose data fuzzer. It reads data from given sample files, or standard input if none are given, and outputs modified data. It is usually used to generate malformed data for testing programs.";
     homepage =  "https://gitlab.com/akihe/radamsa";
-    maintainers = [ stdenv.lib.maintainers.markWot ];
-    platforms = stdenv.lib.platforms.all;
+    maintainers = [ lib.maintainers.markWot ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/security/rage/default.nix b/pkgs/tools/security/rage/default.nix
index 5cf38cb756d95..d70e58d729390 100644
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Foundation
     Security
   ];
diff --git a/pkgs/tools/security/rarcrack/default.nix b/pkgs/tools/security/rarcrack/default.nix
index e5bbb7e8421db..94800ca8c04f2 100644
--- a/pkgs/tools/security/rarcrack/default.nix
+++ b/pkgs/tools/security/rarcrack/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ libxml2 file p7zip unrar unzip ];
-  buildFlags = stdenv.lib.optional stdenv.cc.isClang "CC=clang";
+  buildFlags = lib.optional stdenv.cc.isClang "CC=clang";
   installFlags = [ "PREFIX=\${out}" ];
 
   patchPhase = ''
diff --git a/pkgs/tools/security/ripasso/cursive.nix b/pkgs/tools/security/ripasso/cursive.nix
index 24e1146346450..268641cb3cbc6 100644
--- a/pkgs/tools/security/ripasso/cursive.nix
+++ b/pkgs/tools/security/ripasso/cursive.nix
@@ -21,7 +21,7 @@ buildRustPackage rec {
   nativeBuildInputs = [ pkgconfig gpgme python3 ];
   buildInputs = [
     ncurses openssl libgpgerror gpgme xorg.libxcb
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit Security ];
+  ] ++ lib.optionals stdenv.isDarwin [ AppKit Security ];
 
   preFixup = ''
     mkdir -p "$out/man/man1"
diff --git a/pkgs/tools/security/rng-tools/default.nix b/pkgs/tools/security/rng-tools/default.nix
index 16952e6dabb46..2b35ec94e6e74 100644
--- a/pkgs/tools/security/rng-tools/default.nix
+++ b/pkgs/tools/security/rng-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libtool, autoreconfHook, pkgconfig
+{ lib, stdenv, fetchFromGitHub, libtool, autoreconfHook, pkgconfig
 , sysfsutils
 , argp-standalone
   # WARNING: DO NOT USE BEACON GENERATED VALUES AS SECRET CRYPTOGRAPHIC KEYS
@@ -10,7 +10,7 @@
 , libp11 ? null, opensc ? null, withPkcs11 ? true
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "rng-tools";
diff --git a/pkgs/tools/security/rustscan/default.nix b/pkgs/tools/security/rustscan/default.nix
index 3d84900f18e64..80cc8c8cc1fb9 100644
--- a/pkgs/tools/security/rustscan/default.nix
+++ b/pkgs/tools/security/rustscan/default.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
       --replace 'Command::new("nmap")' 'Command::new("${nmap}/bin/nmap")'
   '';
 
-  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
+  buildInputs = lib.optional stdenv.isDarwin Security;
 
   checkFlags = [
     "--skip=infer_ulimit_lowering_no_panic"
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 2e617a8de8a50..ade299ec5893f 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
     description = "CLI tool which enables you to login and retrieve AWS temporary credentials using a SAML IDP";
     homepage    = "https://github.com/Versent/saml2aws";
     license     = licenses.mit;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.pmyjavec ];
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.pmyjavec ];
   };
 }
diff --git a/pkgs/tools/security/scallion/default.nix b/pkgs/tools/security/scallion/default.nix
index 91b92071fe796..6f0dcd1bb013f 100644
--- a/pkgs/tools/security/scallion/default.nix
+++ b/pkgs/tools/security/scallion/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp scallion/bin/Debug/* $out/share/
     makeWrapper ${mono}/bin/mono $out/bin/scallion \
-      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ openssl_1_0_2 ocl-icd ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl_1_0_2 ocl-icd ]} \
       --add-flags $out/share/scallion.exe
   '';
 
diff --git a/pkgs/tools/security/seccure/default.nix b/pkgs/tools/security/seccure/default.nix
index e0f01f4f2c417..07c8d0382ca5b 100644
--- a/pkgs/tools/security/seccure/default.nix
+++ b/pkgs/tools/security/seccure/default.nix
@@ -1,16 +1,16 @@
-{ stdenv, fetchurl, libgcrypt }:
+{ lib, stdenv, fetchurl, libgcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "seccure";
   version = "0.5";
-  
+
   src = fetchurl {
     url = "http://point-at-infinity.org/seccure/${pname}-${version}.tar.gz";
     sha256 = "0nwnk3hfhgvf5xr0xipbh6smfnya22wphc5rj0vgi5d0zr5cwrk5";
   };
 
   buildInputs = [ libgcrypt ];
-  
+
   preConfigure = ''
     sed -e s@/usr/@$out/@g -i Makefile
     sed -e 's@ln -f@ln -sf@g' -i Makefile
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://point-at-infinity.org/seccure/";
     description = "Zero-configuration elliptic curve cryptography utility";
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.lgpl3;
+    platforms = lib.platforms.unix;
+    license = lib.licenses.lgpl3;
   };
 }
diff --git a/pkgs/tools/security/secp256k1/default.nix b/pkgs/tools/security/secp256k1/default.nix
index 55b02d7a8c30d..a8acf3586c9e2 100644
--- a/pkgs/tools/security/secp256k1/default.nix
+++ b/pkgs/tools/security/secp256k1/default.nix
@@ -13,7 +13,7 @@
 
 }:
 
-let inherit (stdenv.lib) optionals; in
+let inherit (lib) optionals; in
 
 stdenv.mkDerivation {
   pname = "secp256k1";
diff --git a/pkgs/tools/security/shc/default.nix b/pkgs/tools/security/shc/default.nix
index f9bdf66ed860a..4cbedb232187f 100644
--- a/pkgs/tools/security/shc/default.nix
+++ b/pkgs/tools/security/shc/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://neurobin.org/projects/softwares/unix/shc/";
     description = "Shell Script Compiler";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = lib.platforms.linux;
     license = licenses.gpl3;
   };
 }
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index c2a51f3bdf5de..ee099b704aaae 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -127,62 +127,62 @@ in stdenv.mkDerivation rec {
         TextTemplate MIMETools MailTools TimeDate NetIDNEncode ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ nettools gnupg ]}"
+      "${lib.makeBinPath [ nettools gnupg ]}"
 
     wrapProgram $out/bin/gpg-key2latex --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg libpaper ]}"
+      "${lib.makeBinPath [ gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-key2ps --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ which gnupg libpaper ]}"
+      "${lib.makeBinPath [ which gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-mailkeys --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg qprint ]}"
+      "${lib.makeBinPath [ gnupg qprint ]}"
 
     wrapProgram $out/bin/gpgdir --set PERL5LIB \
       ${with perlPackages; makePerlPath ([
         TermReadKey ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpglist --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgparticipants --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ getopt gnupg ]}"
+      "${lib.makeBinPath [ getopt gnupg ]}"
 
 #    wrapProgram $out/bin/gpgparticipants-prefill
 
     wrapProgram $out/bin/gpgparticipants-filter --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgsigs --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgwrap --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/keyanalyze --set PERL5LIB \
 
     wrapProgram $out/bin/keyart --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/keylookup --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-clean --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-fixkey --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg ]}"
+      "${lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/pgpring
 
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 5ba0bd11f827b..873cfdbbb0568 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     ];
 
   propagatedBuildInputs =
-    stdenv.lib.optionals stdenv.isDarwin [ libobjc Security ];
+    lib.optionals stdenv.isDarwin [ libobjc Security ];
 
   buildInputs = [ botan2 ];
 
diff --git a/pkgs/tools/security/spectre-meltdown-checker/default.nix b/pkgs/tools/security/spectre-meltdown-checker/default.nix
index 53797ef98514c..49aa4a2a4ca5f 100644
--- a/pkgs/tools/security/spectre-meltdown-checker/default.nix
+++ b/pkgs/tools/security/spectre-meltdown-checker/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  installPhase = with stdenv.lib; ''
+  installPhase = with lib; ''
     runHook preInstall
 
     install -Dm755 spectre-meltdown-checker.sh $out/bin/spectre-meltdown-checker
diff --git a/pkgs/tools/security/ssdeep/default.nix b/pkgs/tools/security/ssdeep/default.nix
index 33ab4c373bcac..acc617103d719 100644
--- a/pkgs/tools/security/ssdeep/default.nix
+++ b/pkgs/tools/security/ssdeep/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "ssdeep";
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A program for calculating fuzzy hashes";
     homepage    = "http://www.ssdeep.sf.net";
-    license     = stdenv.lib.licenses.gpl2;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.gpl2;
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/sshuttle/default.nix b/pkgs/tools/security/sshuttle/default.nix
index 4a24e4596972f..dbdd94a3d5c97 100644
--- a/pkgs/tools/security/sshuttle/default.nix
+++ b/pkgs/tools/security/sshuttle/default.nix
@@ -23,11 +23,11 @@ python3Packages.buildPythonApplication rec {
 
   checkInputs = with python3Packages; [ mock pytest pytestcov pytestrunner flake8 ];
 
-  runtimeDeps = [ coreutils openssh procps ] ++ stdenv.lib.optionals stdenv.isLinux [ iptables nettools ];
+  runtimeDeps = [ coreutils openssh procps ] ++ lib.optionals stdenv.isLinux [ iptables nettools ];
 
   postInstall = ''
     wrapProgram $out/bin/sshuttle \
-      --prefix PATH : "${stdenv.lib.makeBinPath runtimeDeps}" \
+      --prefix PATH : "${lib.makeBinPath runtimeDeps}" \
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/ssss/default.nix b/pkgs/tools/security/ssss/default.nix
index bd7de72e6beca..34407f5f5ad9e 100644
--- a/pkgs/tools/security/ssss/default.nix
+++ b/pkgs/tools/security/ssss/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gmp }:
+{ lib, stdenv, fetchurl, gmp }:
 
 stdenv.mkDerivation {
   name = "ssss-0.5";
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Shamir Secret Sharing Scheme";
     homepage = "http://point-at-infinity.org/ssss/";
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.gpl2;
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2;
   };
 }
diff --git a/pkgs/tools/security/stoken/default.nix b/pkgs/tools/security/stoken/default.nix
index 497d3816a767c..0c6699b439c34 100644
--- a/pkgs/tools/security/stoken/default.nix
+++ b/pkgs/tools/security/stoken/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     autoconf automake libtool
     libxml2 nettle
-  ] ++ stdenv.lib.optional withGTK3 gtk3;
+  ] ++ lib.optional withGTK3 gtk3;
 
   meta = with lib; {
     description = "Software Token for Linux/UNIX";
diff --git a/pkgs/tools/security/stricat/default.nix b/pkgs/tools/security/stricat/default.nix
index 28c462cbb0a24..460838965a02a 100644
--- a/pkgs/tools/security/stricat/default.nix
+++ b/pkgs/tools/security/stricat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "stricat";
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Multi-use cryptographic tool based on the STRIBOB algorithm";
     homepage    = "https://www.stribob.com/stricat/";
-    license     = stdenv.lib.licenses.bsd3;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.bsd3;
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 3271af4a4b548..1e6af55baab24 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, coreutils, pam, groff, sssd, nixosTests
+{ lib, stdenv, fetchurl, coreutils, pam, groff, sssd, nixosTests
 , sendmailPath ? "/run/wrappers/bin/sendmail"
 , withInsults ? false
 , withSssd ? false
@@ -27,10 +27,10 @@ stdenv.mkDerivation rec {
     "--with-iologdir=/var/log/sudo-io"
     "--with-sendmail=${sendmailPath}"
     "--enable-tmpfiles.d=no"
-  ] ++ stdenv.lib.optional withInsults [
+  ] ++ lib.optional withInsults [
     "--with-insults"
     "--with-all-insults"
-  ] ++ stdenv.lib.optional withSssd [
+  ] ++ lib.optional withSssd [
     "--with-sssd"
     "--with-sssd-lib=${sssd}/lib"
   ];
@@ -78,8 +78,8 @@ stdenv.mkDerivation rec {
 
     license = "https://www.sudo.ws/sudo/license.html";
 
-    maintainers = with stdenv.lib.maintainers; [ eelco delroth ];
+    maintainers = with lib.maintainers; [ eelco delroth ];
 
-    platforms = stdenv.lib.platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/sudolikeaboss/default.nix b/pkgs/tools/security/sudolikeaboss/default.nix
index a137646382379..bdaf8f129d02a 100644
--- a/pkgs/tools/security/sudolikeaboss/default.nix
+++ b/pkgs/tools/security/sudolikeaboss/default.nix
@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   pname = "sudolikeaboss-unstable";
-  version = "20161127-${stdenv.lib.strings.substring 0 7 rev}";
+  version = "20161127-${lib.strings.substring 0 7 rev}";
   rev = "2d9afe19f872c9f433d476e57ee86169781b164c";
 
   goPackagePath = "github.com/ravenac95/sudolikeaboss";
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 79a7cd839e5b4..f8e78c66979fd 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "super-3.30.0";
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
         in /etc/super.tab); and 2) “setuid”, which allows root to
         execute a command under a different uid.
       '';
-    platforms = stdenv.lib.platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/security/tcpcrypt/default.nix b/pkgs/tools/security/tcpcrypt/default.nix
index a6eb09fd2c5f6..23b79af73cd0a 100644
--- a/pkgs/tools/security/tcpcrypt/default.nix
+++ b/pkgs/tools/security/tcpcrypt/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchFromGitHub, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, autoreconfHook
 , openssl
 , libcap, libpcap, libnfnetlink, libnetfilter_conntrack, libnetfilter_queue
 }:
 
-with stdenv.lib;
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "tcpcrypt";
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 038f4040d31af..a96dae5f5efd5 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -15,7 +15,7 @@
 }:
 let
   tor-client-auth-gen = writeShellScript "tor-client-auth-gen" ''
-    PATH="${stdenv.lib.makeBinPath [coreutils gnugrep openssl]}"
+    PATH="${lib.makeBinPath [coreutils gnugrep openssl]}"
     pem="$(openssl genpkey -algorithm x25519)"
 
     printf private_key=descriptor:x25519:
@@ -41,15 +41,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libevent openssl zlib lzma zstd scrypt ] ++
-    stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
+    lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
 
   patches = [ ./disable-monotonic-timer-tests.patch ];
 
   # cross compiles correctly but needs the following
-  configureFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+  configureFlags = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     "--disable-tool-name-check";
 
-  NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
+  NIX_CFLAGS_LINK = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
   postPatch = ''
     substituteInPlace contrib/client-tools/torify \
diff --git a/pkgs/tools/security/tor/tor-arm.nix b/pkgs/tools/security/tor/tor-arm.nix
index 896ab50562d8a..fcdb628e0f4aa 100644
--- a/pkgs/tools/security/tor/tor-arm.nix
+++ b/pkgs/tools/security/tor/tor-arm.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper
+{ lib, stdenv, fetchurl, makeWrapper
 , python2Packages, ncurses, lsof, nettools
 }:
 
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A terminal status monitor for Tor relays";
     homepage    = "https://www.atagar.com/arm/";
-    license     = stdenv.lib.licenses.gpl3;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.gpl3;
+    platforms   = lib.platforms.unix;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/tools/security/tor/torsocks.nix
index 381377032d6e0..22cfa51d4e52a 100644
--- a/pkgs/tools/security/tor/torsocks.nix
+++ b/pkgs/tools/security/tor/torsocks.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, fetchurl, autoreconfHook, libcap }:
+{ lib, stdenv, fetchgit, fetchurl, autoreconfHook, libcap }:
 
 stdenv.mkDerivation rec {
   pname = "torsocks";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  patches = stdenv.lib.optional stdenv.isDarwin
+  patches = lib.optional stdenv.isDarwin
     (fetchurl {
        url = "https://trac.torproject.org/projects/tor/raw-attachment/ticket/28538/0001-Fix-macros-for-accept4-2.patch";
        sha256 = "97881f0b59b3512acc4acb58a0d6dfc840d7633ead2f400fad70dda9b2ba30b0";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     sed -i \
       -e 's,\(local app_path\)=`which $1`,\1=`type -P $1`,' \
       src/bin/torsocks.in
-  '' + stdenv.lib.optionalString stdenv.isLinux ''
+  '' + lib.optionalString stdenv.isLinux ''
     sed -i \
       -e 's,\(local getcap\)=.*,\1=${libcap}/bin/getcap,' \
       src/bin/torsocks.in
@@ -36,8 +36,8 @@ stdenv.mkDerivation rec {
     description      = "Wrapper to safely torify applications";
     homepage         = "https://github.com/dgoulet/torsocks";
     repositories.git = "https://git.torproject.org/torsocks.git";
-    license          = stdenv.lib.licenses.gpl2;
-    platforms        = stdenv.lib.platforms.unix;
-    maintainers      = with stdenv.lib.maintainers; [ phreedom thoughtpolice ];
+    license          = lib.licenses.gpl2;
+    platforms        = lib.platforms.unix;
+    maintainers      = with lib.maintainers; [ phreedom thoughtpolice ];
   };
 }
diff --git a/pkgs/tools/security/tpm-quote-tools/default.nix b/pkgs/tools/security/tpm-quote-tools/default.nix
index 94da17fabeca6..938d0a6f29467 100644
--- a/pkgs/tools/security/tpm-quote-tools/default.nix
+++ b/pkgs/tools/security/tpm-quote-tools/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, trousers, openssl }:
 
-stdenv.mkDerivation rec { 
+stdenv.mkDerivation rec {
   pname = "tpm-quote-tools";
   version = "1.0.4";
 
-  src = fetchurl { 
+  src = fetchurl {
     url = "mirror://sourceforge/project/tpmquotetools/${version}/${pname}-${version}.tar.gz";
     sha256 = "1qjs83xb4np4yn1bhbjfhvkiika410v8icwnjix5ad96w2nlxp0h";
   };
@@ -13,11 +13,11 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     patchelf \
-      --set-rpath "${stdenv.lib.makeLibraryPath [ openssl ]}:$(patchelf --print-rpath $out/bin/tpm_mkaik)" \
+      --set-rpath "${lib.makeLibraryPath [ openssl ]}:$(patchelf --print-rpath $out/bin/tpm_mkaik)" \
       $out/bin/tpm_mkaik
   '';
 
-  meta = with lib; { 
+  meta = with lib; {
     description = "A collection of programs that provide support for TPM based attestation using the TPM quote mechanism";
     longDescription = ''
       The TPM Quote Tools is a collection of programs that provide support
diff --git a/pkgs/tools/security/volatility/default.nix b/pkgs/tools/security/volatility/default.nix
index 8ffdfc4e2b097..80cd0d971a3f4 100644
--- a/pkgs/tools/security/volatility/default.nix
+++ b/pkgs/tools/security/volatility/default.nix
@@ -19,6 +19,6 @@ pythonPackages.buildPythonApplication rec {
     homepage = "https://www.volatilityfoundation.org/";
     description = "Advanced memory forensics framework";
     maintainers = with maintainers; [ bosu ];
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 19d409e03eea0..f11e772390d97 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -23,17 +23,17 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ pcre protobufc ]
-    ++ stdenv.lib.optionals withCrypto [ openssl ]
-    ++ stdenv.lib.optionals enableMagic [ file ]
-    ++ stdenv.lib.optionals enableCuckoo [ jansson ]
+    ++ lib.optionals withCrypto [ openssl ]
+    ++ lib.optionals enableMagic [ file ]
+    ++ lib.optionals enableCuckoo [ jansson ]
   ;
 
   preConfigure = "./bootstrap.sh";
 
   configureFlags = [
-    (stdenv.lib.withFeature withCrypto "crypto")
-    (stdenv.lib.enableFeature enableMagic "magic")
-    (stdenv.lib.enableFeature enableCuckoo "cuckoo")
+    (lib.withFeature withCrypto "crypto")
+    (lib.enableFeature enableMagic "magic")
+    (lib.enableFeature enableCuckoo "cuckoo")
   ];
 
   meta = with lib; {