Merge pull request #195862 from NixOS/staging-next

65 files changed, 266 insertions, 103 deletions

diff --git a/pkgs/tools/X11/find-cursor/default.nix b/pkgs/tools/X11/find-cursor/default.nix
index c99c86a714e25..44a7c7662152c 100644
--- a/pkgs/tools/X11/find-cursor/default.nix
+++ b/pkgs/tools/X11/find-cursor/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ installShellFiles git ];
   buildInputs = [ libX11 libXdamage libXrender libXcomposite libXext ];
   preInstall = "mkdir -p $out/share/man/man1";
-  installFlags = "PREFIX=${placeholder "out"}";
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Simple XLib program to highlight the cursor position";
diff --git a/pkgs/tools/X11/xmousepasteblock/default.nix b/pkgs/tools/X11/xmousepasteblock/default.nix
index 35db8a133a23c..984f6ac70a6b7 100644
--- a/pkgs/tools/X11/xmousepasteblock/default.nix
+++ b/pkgs/tools/X11/xmousepasteblock/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0vidckfp277cg2gsww8a8q5b18m10iy4ppyp2qipr89771nrcmns";
     rev = version;
   };
-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
   buildInputs = with xorg; [ libX11 libXext libXi libev ];
   nativeBuildInputs = [ pkg-config ];
   meta = with lib; {
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index afb8489e1f429..d5a2863d968d8 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -7,6 +7,7 @@
 , openssl
 , pkg-config
 , slang
+, libxcrypt
 , autoreconfHook
 }:
 stdenv.mkDerivation rec {
@@ -23,7 +24,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-ssl-headers=${openssl.dev}/include/openssl" ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ bzip2 zlib newt newt openssl slang ];
+  buildInputs = [ bzip2 zlib newt newt openssl slang libxcrypt ];
 
   patches = [
     ./gentoos-zlib.patch
diff --git a/pkgs/tools/cd-dvd/dvdisaster/default.nix b/pkgs/tools/cd-dvd/dvdisaster/default.nix
index 72f8cc0be2e98..55e0e51e5f448 100644
--- a/pkgs/tools/cd-dvd/dvdisaster/default.nix
+++ b/pkgs/tools/cd-dvd/dvdisaster/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gettext pkg-config which ];
   buildInputs = [ glib gtk2 ];
 
-  patches = lib.optional enableSoftening [
+  patches = lib.optionals enableSoftening [
     ./encryption.patch
     ./dvdrom.patch
   ];
diff --git a/pkgs/tools/compression/bsdiff/default.nix b/pkgs/tools/compression/bsdiff/default.nix
index b8a86eae89bde..6db5d99246771 100644
--- a/pkgs/tools/compression/bsdiff/default.nix
+++ b/pkgs/tools/compression/bsdiff/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     })
     ./CVE-2020-14315.patch
     ./include-systypes.patch
-  ] ++ lib.optional stdenv.hostPlatform.isLinux [
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     (fetchpatch {
       url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/30-bug-632585-mmap-src-file-instead-of-malloc-read-it.patch";
       sha256 = "sha256-esbhz2/efUiuQDuF7LGfSeEn3/f1WbqCxQpTs2A0ulI=";
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 86df04c266919..1f898dbdef4bc 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.2.6";
+  version = "5.2.7";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "E+NALjAbYBj2px7w5Jf3FMbRHiFK6C2rFWuBwqZKyyU=";
+    sha256 = "tl8dDCcI5XcW9N0iFpiac4R6xv20Fo/86xVXZ+Irg0s=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 7202f9f8b5628..9639a7881f0f4 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -108,7 +108,7 @@ in stdenv.mkDerivation rec {
       libdbus = dbus.lib;
       inherit hwdata libX11;
     })
-  ] ++ lib.optional (stdenv.hostPlatform.system == "x86_64-linux") [
+  ] ++ lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [
     # Support 32bit OpenGL applications by appending the mangohud32
     # lib path to LD_LIBRARY_PATH.
     #
diff --git a/pkgs/tools/misc/conserver/default.nix b/pkgs/tools/misc/conserver/default.nix
index d8bb437404d41..30ac050ee0d33 100644
--- a/pkgs/tools/misc/conserver/default.nix
+++ b/pkgs/tools/misc/conserver/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , autoreconfHook
+, libxcrypt
 , gssapiSupport ? false
 , libkrb5
 , freeipmiSupport ? false
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  buildInputs = [ ]
+  buildInputs = [ libxcrypt ]
     ++ lib.optionals freeipmiSupport [ freeipmi ]
     ++ lib.optionals gssapiSupport [ libkrb5 ]
     ++ lib.optionals opensslSupport [ openssl ];
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index d2c0dfe371666..5ebbbe1e118b4 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "5.19";
+  version = "6.0";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-O3UqMymCeQesOBLygx3+z1HIxBxV0tac+5xTygZEn8Y=";
+    sha256 = "sha256-1URsk95XDOaPOx6mnb+hL8/Wf8GYl/ZV0/GCMeK4GNY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/gigalixir/default.nix b/pkgs/tools/misc/gigalixir/default.nix
new file mode 100644
index 0000000000000..c3710ca944871
--- /dev/null
+++ b/pkgs/tools/misc/gigalixir/default.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, lib
+, python3
+, git
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gigalixir";
+  version = "1.3.0";
+  format = "setuptools";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    hash = "sha256-kNtybgv8j7t1tl6R5ZuC4vj5fnEcEenuNt0twA1kAh0=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "'pytest-runner'," "" \
+      --replace "cryptography==" "cryptography>="
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    click
+    pygments
+    pyopenssl
+    qrcode
+    requests
+    rollbar
+    stripe
+  ];
+
+  checkInputs = [
+    git
+  ] ++ (with python3.pkgs; [
+    httpretty
+    pytestCheckHook
+    sure
+  ]);
+
+  disabledTests = [
+    # Test requires network access
+    "test_rollback_without_version"
+  ];
+
+  pythonImportsCheck = [
+    "gigalixir"
+  ];
+
+  meta = with lib; {
+    broken = stdenv.isDarwin;
+    description = "Gigalixir Command-Line Interface";
+    homepage = "https://github.com/gigalixir/gigalixir-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/tools/misc/hiksink/default.nix b/pkgs/tools/misc/hiksink/default.nix
index 9cc91035afe05..05d7e1c9f44ea 100644
--- a/pkgs/tools/misc/hiksink/default.nix
+++ b/pkgs/tools/misc/hiksink/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/tools/misc/jsonwatch/default.nix b/pkgs/tools/misc/jsonwatch/default.nix
index 3fe4f5008fd69..6f11e7d97e5da 100644
--- a/pkgs/tools/misc/jsonwatch/default.nix
+++ b/pkgs/tools/misc/jsonwatch/default.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-Gjb7v3kz11iOml3Ykxhy43KNxzaprgMbb5DpPNChLTc=";
 
-  buildInputs = lib.optional stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/tools/misc/kermit/default.nix b/pkgs/tools/misc/kermit/default.nix
index 33644e911c635..bccecde01cc75 100644
--- a/pkgs/tools/misc/kermit/default.nix
+++ b/pkgs/tools/misc/kermit/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses, glibc }:
+{ lib, stdenv, fetchurl, ncurses, libxcrypt }:
 
 stdenv.mkDerivation {
   pname = "kermit";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0487mh6s99ijqf1pfmbm302pa5i4pzmm8s439hdl1ffs5g8jqpqd";
   };
 
-  buildInputs = [ ncurses glibc ];
+  buildInputs = [ ncurses libxcrypt ];
 
   unpackPhase = ''
     mkdir -p src
diff --git a/pkgs/tools/misc/ldapvi/default.nix b/pkgs/tools/misc/ldapvi/default.nix
index f8862cfa56774..dd0d34f50fe57 100644
--- a/pkgs/tools/misc/ldapvi/default.nix
+++ b/pkgs/tools/misc/ldapvi/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, openldap, openssl, popt, glib, ncurses, readline, pkg-config, cyrus_sasl, autoconf, automake }:
+{ lib, stdenv, fetchgit, openldap, openssl, popt, glib, libxcrypt, ncurses, readline, pkg-config, cyrus_sasl, autoconf, automake }:
 
 stdenv.mkDerivation {
   pname = "ldapvi";
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ pkg-config autoconf automake ];
-  buildInputs = [ openldap openssl popt glib ncurses readline cyrus_sasl ];
+  buildInputs = [ openldap openssl popt glib libxcrypt ncurses readline cyrus_sasl ];
 
   preConfigure = ''
     cd ldapvi
diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index df8d9eef22ac5..a7212ccf7648a 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   configureFlags = [ "--sysconfdir=/etc" ] # Look for ‘sysless’ in /etc.
-    ++ lib.optional lessSecure [ "--with-secure" ];
+    ++ lib.optionals lessSecure [ "--with-secure" ];
 
   buildInputs = [ ncurses ];
 
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 3e34a81cd4f82..4c23143b103ee 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "--with-systemdtmpfilesdir=${placeholder "out"}/lib/tmpfiles.d"
     "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "--with-pager=less"
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin [
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "ac_cv_func__set_invalid_parameter_handler=no"
     "ac_cv_func_posix_fadvise=no"
     "ac_cv_func_mempcpy=no"
diff --git a/pkgs/tools/misc/otfcc/default.nix b/pkgs/tools/misc/otfcc/default.nix
index b233e94f4f60f..b6c971dd3c2ef 100644
--- a/pkgs/tools/misc/otfcc/default.nix
+++ b/pkgs/tools/misc/otfcc/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     ./move-makefiles.patch
   ];
 
-  buildFlags = lib.optional stdenv.isAarch64 [ "config=release_arm" ];
+  buildFlags = lib.optionals stdenv.isAarch64 [ "config=release_arm" ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/pre-commit/default.nix b/pkgs/tools/misc/pre-commit/default.nix
index 7fef96dae312e..2e11679f45182 100644
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@@ -37,9 +37,9 @@ buildPythonPackage rec {
     pyyaml
     toml
     virtualenv
-  ] ++ lib.optional (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
-  ] ++ lib.optional (pythonOlder "3.7") [
+  ] ++ lib.optionals (pythonOlder "3.7") [
     importlib-resources
   ];
 
diff --git a/pkgs/tools/misc/rust-motd/default.nix b/pkgs/tools/misc/rust-motd/default.nix
index a2c7710984ea9..b881d94438cd7 100644
--- a/pkgs/tools/misc/rust-motd/default.nix
+++ b/pkgs/tools/misc/rust-motd/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index b5b3f2b189b69..f9d546a30fe35 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, ncurses, utmp, pam ? null }:
+{ lib, stdenv, fetchurl, autoreconfHook, ncurses, libxcrypt, utmp, pam ? null }:
 
 stdenv.mkDerivation rec {
   pname = "screen";
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     ncurses
+    libxcrypt
   ] ++ lib.optional stdenv.isLinux pam
     ++ lib.optional stdenv.isDarwin utmp;
 
diff --git a/pkgs/tools/misc/sheldon/default.nix b/pkgs/tools/misc/sheldon/default.nix
index db6aa9d8f1708..8f2c458fe1d6f 100644
--- a/pkgs/tools/misc/sheldon/default.nix
+++ b/pkgs/tools/misc/sheldon/default.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-uRcaHuDLQm6OYqt01kLbW/mfZnL4HaDabaweaw1EOfs=";
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin [ Security curl ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security curl ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
   # Needs network connection
diff --git a/pkgs/tools/misc/toybox/default.nix b/pkgs/tools/misc/toybox/default.nix
index fc9465f35cdc1..c94537c0bfd24 100644
--- a/pkgs/tools/misc/toybox/default.nix
+++ b/pkgs/tools/misc/toybox/default.nix
@@ -1,6 +1,6 @@
 {
   stdenv, lib, fetchFromGitHub, which,
-  buildPackages,
+  buildPackages, libxcrypt,
   enableStatic ? stdenv.hostPlatform.isStatic,
   enableMinimal ? false,
   extraConfig ? ""
@@ -18,8 +18,12 @@ stdenv.mkDerivation rec {
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # needed for cross
-  buildInputs = lib.optionals (enableStatic && stdenv.cc.libc ? static)
-    [ stdenv.cc.libc stdenv.cc.libc.static ];
+  buildInputs = [
+    libxcrypt
+  ] ++lib.optionals (enableStatic && stdenv.cc.libc ? static) [
+    stdenv.cc.libc
+    stdenv.cc.libc.static
+  ];
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index ecfc40bdf6f34..273d34ffdb8e4 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake perl pkg-config ];
   buildInputs = [ openssl curl libusb1 protobufc ];
 
-  cmakeFlags = lib.optional enableUnsafe [ "-Dunsafe=on" ];
+  cmakeFlags = lib.optionals enableUnsafe [ "-Dunsafe=on" ];
 
   preFixup = ''
     chmod +x $out/bin/ttbin2mysports
diff --git a/pkgs/tools/networking/bore-cli/default.nix b/pkgs/tools/networking/bore-cli/default.nix
index 5ca16499fe823..ae39bfb6204fd 100644
--- a/pkgs/tools/networking/bore-cli/default.nix
+++ b/pkgs/tools/networking/bore-cli/default.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-ZnEVTFiPo3AFyo1BoV88X2nCqYzRK6PkcbawiR+QnV0=";
 
-  buildInputs = lib.optional stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/tools/networking/bore/default.nix b/pkgs/tools/networking/bore/default.nix
index 66334e0621034..e7934428a958d 100644
--- a/pkgs/tools/networking/bore/default.nix
+++ b/pkgs/tools/networking/bore/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   cargoSha256 = "1xlbfzmy0wjyz3jpr17r4ma4i79d9b32yqwwi10vrcjzr7vsyhmx";
-  cargoBuildFlags = "-p ${pname}";
+  cargoBuildFlags = [ "-p" pname ];
 
   # FIXME can’t test --all-targets and --doc in a single invocation
   cargoTestFlags = [ "--all-targets" "--workspace" ];
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 07b9e58589a01..32d2fbb62de01 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, perl, nixosTests
 , brotliSupport ? false, brotli
-, c-aresSupport ? false, c-ares
+, c-aresSupport ? false, c-aresMinimal
 , gnutlsSupport ? false, gnutls
 , gsaslSupport ? false, gsasl
 , gssSupport ? with stdenv.hostPlatform; (
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   # applications that use Curl.
   propagatedBuildInputs = with lib;
     optional brotliSupport brotli ++
-    optional c-aresSupport c-ares ++
+    optional c-aresSupport c-aresMinimal ++
     optional gnutlsSupport gnutls ++
     optional gsaslSupport gsasl ++
     optional gssSupport libkrb5 ++
diff --git a/pkgs/tools/networking/dcap/default.nix b/pkgs/tools/networking/dcap/default.nix
index f606c3f6cd6a8..3ee1a389ef946 100644
--- a/pkgs/tools/networking/dcap/default.nix
+++ b/pkgs/tools/networking/dcap/default.nix
@@ -6,6 +6,7 @@
 , libtool
 , zlib
 , cunit
+, libxcrypt
 }:
 stdenv.mkDerivation rec {
   pname = "dcap";
@@ -19,7 +20,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoconf automake libtool ];
-  buildInputs = [ zlib ];
+  buildInputs = [ zlib libxcrypt ];
 
   preConfigure = ''
     patchShebangs bootstrap.sh
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index ba17f10e96c78..1eb8b85166fe5 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -2,6 +2,7 @@
 , libidn, libnetfilter_conntrack, buildPackages
 , dbusSupport ? stdenv.isLinux
 , dbus
+, nixosTests
 }:
 
 with lib;
@@ -17,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.86";
+  version = "2.87";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    sha256 = "sha256-KNUs/J4gBKxPhSdPUrMuFke028l2G4Ln3h5BxJkH6wg=";
+    sha256 = "sha256-AijANkp/I1b9fn8VSZN8vzCZp407LrG6W7DDHiuJ3no=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -77,6 +78,15 @@ stdenv.mkDerivation rec {
     ++ optionals dbusSupport [ dbus ]
     ++ optionals stdenv.isLinux [ libnetfilter_conntrack ];
 
+  passthru.tests = {
+    prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;
+
+    # these tests use dnsmasq incidentally
+    inherit (nixosTests) dnscrypt-proxy2;
+    kubernetes-dns-single = nixosTests.kubernetes.dns-single-node;
+    kubernetes-dns-multi = nixosTests.kubernetes.dns-multi-node;
+  };
+
   meta = {
     description = "An integrated DNS, DHCP and TFTP server for small networks";
     homepage = "https://www.thekelleys.org.uk/dnsmasq/doc.html";
diff --git a/pkgs/tools/networking/dropbear/default.nix b/pkgs/tools/networking/dropbear/default.nix
index 30efbcc508d0b..e15b0072be769 100644
--- a/pkgs/tools/networking/dropbear/default.nix
+++ b/pkgs/tools/networking/dropbear/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, glibc, zlib
+{ lib, stdenv, fetchurl, glibc, zlib, libxcrypt
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableSCP ? false
 , sftpPath ? "/run/current-system/sw/libexec/sftp-server"
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     ./pass-path.patch
   ];
 
-  buildInputs = [ zlib ] ++ lib.optionals enableStatic [ glibc.static zlib.static ];
+  buildInputs = [ zlib libxcrypt ] ++ lib.optionals enableStatic [ glibc.static zlib.static ];
 
   meta = with lib; {
     homepage = "https://matt.ucc.asn.au/dropbear/dropbear.html";
diff --git a/pkgs/tools/networking/eternal-terminal/default.nix b/pkgs/tools/networking/eternal-terminal/default.nix
index 05e3152bec192..96315e305ad56 100644
--- a/pkgs/tools/networking/eternal-terminal/default.nix
+++ b/pkgs/tools/networking/eternal-terminal/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     "-DDISABLE_CRASH_LOG=TRUE"
   ];
 
-  CXXFLAGS = lib.optional stdenv.cc.isClang [
+  CXXFLAGS = lib.optionals stdenv.cc.isClang [
     "-std=c++17"
   ];
 
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index e43c58d78d489..7928905762e55 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -2,7 +2,7 @@
 , usePcre ? true
 , withPrometheusExporter ? true
 , stdenv, lib, fetchurl, nixosTests
-, openssl, zlib
+, openssl, zlib, libxcrypt
 , lua5_3 ? null, pcre ? null, systemd ? null
 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0MgMkMBK55WYtYuXSdU3h/APe1FRdefYID8nluamWU0=";
   };
 
-  buildInputs = [ openssl zlib ]
+  buildInputs = [ openssl zlib libxcrypt ]
     ++ lib.optional useLua lua5_3
     ++ lib.optional usePcre pcre
     ++ lib.optional stdenv.isLinux systemd;
diff --git a/pkgs/tools/networking/ipv6calc/default.nix b/pkgs/tools/networking/ipv6calc/default.nix
index 6df96e268effa..8489ffd6f7074 100644
--- a/pkgs/tools/networking/ipv6calc/default.nix
+++ b/pkgs/tools/networking/ipv6calc/default.nix
@@ -43,11 +43,11 @@ stdenv.mkDerivation rec {
     "--disable-bundled-md5"
     "--disable-dynamic-load"
     "--enable-shared"
-  ] ++ lib.optional (libmaxminddb != null) [
+  ] ++ lib.optionals (libmaxminddb != null) [
     "--enable-mmdb"
-  ] ++ lib.optional (geolite-legacy != null) [
+  ] ++ lib.optionals (geolite-legacy != null) [
     "--with-geoip-db=${geolite-legacy}/share/GeoIP"
-  ] ++ lib.optional (ip2location-c != null) [
+  ] ++ lib.optionals (ip2location-c != null) [
     "--enable-ip2location"
   ];
 
diff --git a/pkgs/tools/networking/libreswan/default.nix b/pkgs/tools/networking/libreswan/default.nix
index b12fdbdbad770..ab3249e57a873 100644
--- a/pkgs/tools/networking/libreswan/default.nix
+++ b/pkgs/tools/networking/libreswan/default.nix
@@ -11,6 +11,7 @@
 , pam
 , libevent
 , libcap_ng
+, libxcrypt
 , curl
 , nspr
 , bash
@@ -66,7 +67,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     systemd coreutils
     gnused gawk gmp unbound pam libevent
-    libcap_ng curl nspr nss ldns
+    libcap_ng libxcrypt curl nspr nss ldns
     # needed to patch shebangs
     python3 bash
   ] ++ lib.optional stdenv.isLinux libselinux;
diff --git a/pkgs/tools/networking/lsh/default.nix b/pkgs/tools/networking/lsh/default.nix
index 07f0524d5f4fa..7c5e09b950ae1 100644
--- a/pkgs/tools/networking/lsh/default.nix
+++ b/pkgs/tools/networking/lsh/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, gperf, guile, gmp, zlib, liboop, readline, gnum4, pam
-, nettools, lsof, procps }:
+, nettools, lsof, procps, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "lsh";
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   # Should be present in upcoming 2.1 release.
   NIX_CFLAGS_COMPILE = "-std=gnu90 -fcommon";
 
-  buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam ];
+  buildInputs = [ gperf guile gmp zlib liboop readline gnum4 pam libxcrypt ];
 
   meta = {
     description = "GPL'd implementation of the SSH protocol";
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index faccef57697a0..225b208822a3a 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -22,6 +22,7 @@
 , python3
 , sasl
 , system-sendmail
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     python3
     readline
     sasl
+    libxcrypt
   ] ++ lib.optionals stdenv.isLinux [ nettools ];
 
   patches = [
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index 4561661df5a09..89ec8508bbfc3 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -1,31 +1,17 @@
 { lib, stdenv, fetchurl
-, fetchpatch
 , glib, udev, libgudev, polkit, ppp, gettext, pkg-config, python3
 , libmbim, libqmi, systemd, vala, gobject-introspection, dbus
 }:
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.18.10";
+  version = "1.18.12";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/ModemManager/ModemManager-${version}.tar.xz";
-    sha256 = "sha256-FiVfginu6y3+y43RNwNg1G8QFeyF5vulwcvZ9DcdZes=";
+    sha256 = "sha256-tGTkkl2VWmyobdCGFudjsmrkbX/Tfb4oFnjjQGWx5DA=";
   };
 
-  patches = [
-    # Fix tests with GLib 2.73.2
-    # https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/601
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/79a5a4eed2189ea87d25cbe00bc824a2572cad66.patch";
-      sha256 = "egGXkCzAMyqPjeO6ro23sdTddTDEGJUkV7rH8sSlSGE=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/commit/51a333cd9a6707de7c623fd4c94cb6032477572f.patch";
-      sha256 = "1XyJ0GBmpBRwnsKPI4i/EBrF7W08HelL/PMDwmlQWcw=";
-    })
-  ];
-
   nativeBuildInputs = [ vala gobject-introspection gettext pkg-config ];
 
   buildInputs = [ glib udev libgudev polkit ppp libmbim libqmi systemd ];
diff --git a/pkgs/tools/networking/ocserv/default.nix b/pkgs/tools/networking/ocserv/default.nix
index 067c614f58509..29801eebbd78d 100644
--- a/pkgs/tools/networking/ocserv/default.nix
+++ b/pkgs/tools/networking/ocserv/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitLab, autoreconfHook, pkg-config, nettle, gnutls
 , libev, protobufc, guile, geoip, libseccomp, gperf, readline
-, lz4, libgssglue, ronn, pam
+, lz4, libgssglue, ronn, pam, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook gperf pkg-config ronn ];
-  buildInputs = [ nettle gnutls libev protobufc guile geoip libseccomp readline lz4 libgssglue pam ];
+  buildInputs = [ nettle gnutls libev protobufc guile geoip libseccomp readline lz4 libgssglue pam libxcrypt ];
 
   meta = with lib; {
     homepage = "https://gitlab.com/openconnect/ocserv";
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 55aec86bee57e..7a2be129b8ddd 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -6,11 +6,11 @@ in
 
   openssh = common rec {
     pname = "openssh";
-    version = "9.0p1";
+    version = "9.1p1";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      sha256 = "12m2f9czvgmi7akp7xah6y7mrrpi280a3ksk47iwr7hy2q1475q3";
+      hash = "sha256-GfhQCcfj4jeH8CNvuxV4OSq01L+fjsX+a8HNfov90og=";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
diff --git a/pkgs/tools/networking/ppp/default.nix b/pkgs/tools/networking/ppp/default.nix
index d39607338e74f..be50397bf1d0a 100644
--- a/pkgs/tools/networking/ppp/default.nix
+++ b/pkgs/tools/networking/ppp/default.nix
@@ -3,8 +3,10 @@
 , fetchFromGitHub
 , substituteAll
 , libpcap
+, libxcrypt
 , openssl
 , bash
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -31,6 +33,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libpcap
+    libxcrypt
     openssl
     bash
   ];
@@ -48,6 +51,8 @@ stdenv.mkDerivation rec {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
+  NIX_LDFLAGS = "-lcrypt";
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
@@ -60,6 +65,10 @@ stdenv.mkDerivation rec {
     substituteInPlace "$out/bin/pon" --replace "/usr/sbin" "$out/bin"
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) pppd;
+  };
+
   meta = with lib; {
     homepage = "https://ppp.samba.org";
     description = "Point-to-point implementation to provide Internet connections over serial lines";
diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
index ceaf89ef92e96..cb392114e0627 100644
--- a/pkgs/tools/networking/rathole/default.nix
+++ b/pkgs/tools/networking/rathole/default.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin [ CoreServices ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/tools/networking/srelay/default.nix b/pkgs/tools/networking/srelay/default.nix
index da09395fc7a8a..709e4f9594a48 100644
--- a/pkgs/tools/networking/srelay/default.nix
+++ b/pkgs/tools/networking/srelay/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "srelay";
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./arm.patch ];
 
+  buildInputs = [ libxcrypt ];
+
   installPhase = "install -D srelay $out/bin/srelay";
 
   meta = {
diff --git a/pkgs/tools/networking/termscp/default.nix b/pkgs/tools/networking/termscp/default.nix
index 7fbf30614e7ac..70e1643199400 100644
--- a/pkgs/tools/networking/termscp/default.nix
+++ b/pkgs/tools/networking/termscp/default.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
     dbus
     libssh
     openssl
-  ] ++ lib.optional stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [
     AppKit
     Cocoa
     Foundation
diff --git a/pkgs/tools/networking/toxvpn/default.nix b/pkgs/tools/networking/toxvpn/default.nix
index 57a5510bd4306..633ecf654924e 100644
--- a/pkgs/tools/networking/toxvpn/default.nix
+++ b/pkgs/tools/networking/toxvpn/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = lib.optional stdenv.isLinux [ "-DSYSTEMD=1" ];
+  cmakeFlags = lib.optionals stdenv.isLinux [ "-DSYSTEMD=1" ];
 
   postInstall = "$out/bin/toxvpn -h";
 
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 25fcc1bcc397e..3e42eaaaaf94a 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.16.3";
+  version = "1.17.0";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-6gxmZeLDMlt2nqwd/M1g/hgo1fz2YmUAOezLP2ftso4=";
+    hash = "sha256-3LyV14kdn5EMZuTtyfHy/eTeou7Bjjr591rtRKAvE0E=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     "--with-rootkey-file=${dns-root-data}/root.key"
     "--enable-pie"
     "--enable-relro-now"
-  ] ++ lib.optional stdenv.hostPlatform.isStatic [
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     "--disable-flto"
   ] ++ lib.optionals withSystemd [
     "--enable-systemd"
diff --git a/pkgs/tools/networking/vde2/default.nix b/pkgs/tools/networking/vde2/default.nix
index c14aa8bb3c13b..83cee2e466af5 100644
--- a/pkgs/tools/networking/vde2/default.nix
+++ b/pkgs/tools/networking/vde2/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Yf6QB7j5lYld2XtqhYspK4037lTtimoFc7nCavCP+mU=";
   };
 
-  patches = lib.optional stdenv.hostPlatform.isMusl [
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
       url = "https://git.alpinelinux.org/aports/plain/main/vde2/musl-build-fix.patch?id=ddee2f86a48e087867d4a2c12849b2e3baccc238";
       sha256 = "0b5382v541bkxhqylilcy34bh83ag96g71f39m070jzvi84kx8af";
diff --git a/pkgs/tools/networking/wg-netmanager/default.nix b/pkgs/tools/networking/wg-netmanager/default.nix
index 0c74fe4ad04c9..15dc7b163b573 100644
--- a/pkgs/tools/networking/wg-netmanager/default.nix
+++ b/pkgs/tools/networking/wg-netmanager/default.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   # Test 01 tries to create a wireguard interface, which requires sudo.
   doCheck = true;
-  checkFlags = "--skip device";
+  checkFlags = [ "--skip" "device" ];
 
   meta = with lib; {
     description = "Wireguard network manager";
diff --git a/pkgs/tools/networking/xrootd/default.nix b/pkgs/tools/networking/xrootd/default.nix
index 24354f3ec7c1c..454ee09446209 100644
--- a/pkgs/tools/networking/xrootd/default.nix
+++ b/pkgs/tools/networking/xrootd/default.nix
@@ -9,6 +9,7 @@
 , fuse
 , libkrb5
 , libuuid
+, libxcrypt
 , libxml2
 , openssl
 , readline
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
     curl
     libkrb5
     libuuid
+    libxcrypt
     libxml2
     openssl
     readline
diff --git a/pkgs/tools/package-management/cde/default.nix b/pkgs/tools/package-management/cde/default.nix
index 5e86e2affb32f..43a32eccda16d 100644
--- a/pkgs/tools/package-management/cde/default.nix
+++ b/pkgs/tools/package-management/cde/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "cde";
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   # useful.
   preferLocalBuild = true;
 
+  buildInputs = [ libxcrypt ];
+
   patchBuild = ''
     sed -i -e '/install/d' $src/Makefile
   '';
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index f69ee083af1f5..95fbd0782b798 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -113,7 +113,7 @@ self = stdenv.mkDerivation {
 
   propagatedBuildInputs = [
     boehmgc
-  ] ++ lib.optional (atLeast27) [
+  ] ++ lib.optionals (atLeast27) [
     nlohmann_json
   ];
 
diff --git a/pkgs/tools/package-management/poetry2conda/default.nix b/pkgs/tools/package-management/poetry2conda/default.nix
new file mode 100644
index 0000000000000..1e570156f8c96
--- /dev/null
+++ b/pkgs/tools/package-management/poetry2conda/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+with python3.pkgs; buildPythonApplication rec {
+  pname = "poetry2conda";
+  version = "0.3.0";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "dojeda";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-UqNoEGgStvqtxhYwExk7wO4SvATaM2kGaFbB5ViJa7U=";
+  };
+
+  nativeBuildInputs = [ poetry ];
+
+  propagatedBuildInputs = [
+    poetry-semver
+    toml
+  ];
+
+  checkInputs = [
+    pytest-mock
+    pytestCheckHook
+    pyyaml
+  ];
+
+  meta = with lib; {
+    description = "A script to convert a Python project declared on a pyproject.toml to a conda environment";
+    homepage = "https://github.com/dojeda/poetry2conda";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
index 13327a84fff00..28913c685778b 100644
--- a/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
+++ b/pkgs/tools/security/asc-key-to-qr-code-gif/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     substitutions = [
       ''--replace "convert" "${imagemagick}/bin/convert"''
       ''--replace "qrencode" "${qrencode.bin}/bin/qrencode"''
-    ] ++ lib.optional testQR [
+    ] ++ lib.optionals testQR [
       ''--replace "hash zbarimg" "true"'' # hash does not work on NixOS
       ''--replace "$(zbarimg --raw" "$(${zbar.out}/bin/zbarimg --raw"''
     ];
diff --git a/pkgs/tools/security/chipsec/default.nix b/pkgs/tools/security/chipsec/default.nix
index 5b4957139d753..64a4946136f09 100644
--- a/pkgs/tools/security/chipsec/default.nix
+++ b/pkgs/tools/security/chipsec/default.nix
@@ -48,7 +48,7 @@ python3.pkgs.buildPythonApplication rec {
 
   setupPyBuildFlags = [
     "--build-lib=$CHIPSEC_BUILD_LIB"
-  ] ++ lib.optional (!withDriver) [
+  ] ++ lib.optionals (!withDriver) [
     "--skip-driver"
   ];
 
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index c5b738678aa2c..012d492aacad6 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -1,23 +1,14 @@
-{ stdenv, fetchurl, fetchpatch, lib, openssl }:
+{ stdenv, fetchurl, lib, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
-  version = "1661";
+  version = "1682";
 
   src = fetchurl {
     url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
-    sha256 = "sha256-VRRZKK0rJPNL5qDqz5+0kuEODqkZuEKMch+pcOhdYUc=";
+    hash = "sha256-PLZC+HGheyPVCwRuX5X0ScIodBX8HnrrS9u4kg28s48=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/kgoldman/ibmswtpm2/commit/e6684009aff9c1bad38875e3319c2e02ef791424.patch";
-      sha256 = "1flzlri807c88agmpb0w8xvh5f16mmqv86xw4ic4z272iynzd40j";
-    })
-  ];
-
-  patchFlags = [ "-p2" ];
-
   buildInputs = [ openssl ];
 
   sourceRoot = "src";
diff --git a/pkgs/tools/security/mokutil/default.nix b/pkgs/tools/security/mokutil/default.nix
index b408e4d2c80eb..5a597b73a7cec 100644
--- a/pkgs/tools/security/mokutil/default.nix
+++ b/pkgs/tools/security/mokutil/default.nix
@@ -6,6 +6,7 @@
 , openssl
 , efivar
 , keyutils
+, libxcrypt
 }:
 
 stdenv.mkDerivation rec {
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
     openssl
     efivar
     keyutils
+    libxcrypt
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index e071f460b1aa9..b539772213bb6 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   installTargets = [
     "install"
     "install-lib-headers"
-  ] ++ lib.optional (!enableStatic) [
+  ] ++ lib.optionals (!enableStatic) [
     "install-lib-so-link"
   ];
 
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 429027df872df..d667734ef9916 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -35,10 +35,10 @@ stdenv.mkDerivation rec {
     "--with-iologdir=/var/log/sudo-io"
     "--with-sendmail=${sendmailPath}"
     "--enable-tmpfiles.d=no"
-  ] ++ lib.optional withInsults [
+  ] ++ lib.optionals withInsults [
     "--with-insults"
     "--with-all-insults"
-  ] ++ lib.optional withSssd [
+  ] ++ lib.optionals withSssd [
     "--with-sssd"
     "--with-sssd-lib=${sssd}/lib"
   ];
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index eba7def957ce3..1c2e9cbd4ab4e 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchurl, fetchpatch, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "super";
@@ -37,6 +37,8 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
+  buildInputs = [ libxcrypt ];
+
   installFlags = [ "sysconfdir=$(out)/etc" "localstatedir=$(TMPDIR)" ];
 
   meta = {
diff --git a/pkgs/tools/system/chase/default.nix b/pkgs/tools/system/chase/default.nix
index ff4885b088d5f..d20d33235cf87 100644
--- a/pkgs/tools/system/chase/default.nix
+++ b/pkgs/tools/system/chase/default.nix
@@ -12,8 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   doCheck = true;
-  makeFlags = [ "-e" ];
-  makeFlagsArray="LIBS=-lgc";
+  makeFlags = [ "-e" "LIBS=-lgc" ];
 
   meta = with lib ; {
     description = "Follow a symlink and print out its target file";
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 0fc90be2dcbf1..c2c46e9a5d14e 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   pythonPath = [ python3.pkgs.six ];
 
-  makeWrapperArgs = lib.optional withGnuplot [
+  makeWrapperArgs = lib.optionals withGnuplot [
     "--prefix PATH : ${lib.makeBinPath [ gnuplot ]}"
   ];
 
diff --git a/pkgs/tools/system/gptfdisk/default.nix b/pkgs/tools/system/gptfdisk/default.nix
index 871d309d53040..436aec4c552f7 100644
--- a/pkgs/tools/system/gptfdisk/default.nix
+++ b/pkgs/tools/system/gptfdisk/default.nix
@@ -12,6 +12,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # issues with popt 1.19 (from upstream but not yet released):
+    # https://sourceforge.net/p/gptfdisk/code/ci/5d5e76d369a412bfb3d2cebb5fc0a7509cef878d/
+    # https://github.com/rpm-software-management/popt/issues/80
+    ./popt-1-19.patch
+
     # fix UUID generation (from upstream but not yet released):
     # https://sourceforge.net/p/gptfdisk/code/ci/6a8416cbd12d55f882bb751993b94f72d338d96f/
     # https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1853985.html
diff --git a/pkgs/tools/system/gptfdisk/popt-1-19.patch b/pkgs/tools/system/gptfdisk/popt-1-19.patch
new file mode 100644
index 0000000000000..ae971362cdd5d
--- /dev/null
+++ b/pkgs/tools/system/gptfdisk/popt-1-19.patch
@@ -0,0 +1,13 @@
+diff --git a/gptcl.cc b/gptcl.cc
+index 34c9421..0d578eb 100644
+--- a/gptcl.cc
++++ b/gptcl.cc
+@@ -155,7 +155,7 @@ int GPTDataCL::DoOptions(int argc, char* argv[]) {
+    } // while
+ 
+    // Assume first non-option argument is the device filename....
+-   device = (char*) poptGetArg(poptCon);
++   device = strdup((char*) poptGetArg(poptCon));
+    poptResetContext(poptCon);
+ 
+    if (device != NULL) {
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index b338f6a80d6af..07b0163b5ac99 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -4,6 +4,7 @@
 , bison
 , flex
 , zlib
+, libxcrypt
 , usePAM ? stdenv.hostPlatform.isLinux
 , pam
 , useSSL ? true
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ bison flex ];
-  buildInputs = [ zlib.dev ] ++
+  buildInputs = [ zlib.dev libxcrypt ] ++
     lib.optionals useSSL [ openssl ] ++
     lib.optionals usePAM [ pam ];
 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 96ca146358d26..d27ebc4e2a64a 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -99,9 +99,9 @@ in stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--disable-ebpf"
     "--with-jemalloc=${jemalloc}"
-  ] ++ optional (!withDBengine) [
+  ] ++ optionals (!withDBengine) [
     "--disable-dbengine"
-  ] ++ optional (!withCloud) [
+  ] ++ optionals (!withCloud) [
     "--disable-cloud"
   ];
 
diff --git a/pkgs/tools/system/tre-command/default.nix b/pkgs/tools/system/tre-command/default.nix
index f79c1625fbf25..971aa29b9644a 100644
--- a/pkgs/tools/system/tre-command/default.nix
+++ b/pkgs/tools/system/tre-command/default.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   # this test requires package to be in a git repo to succeed
-  checkFlags = "--skip respect_git_ignore";
+  checkFlags = [ "--skip" "respect_git_ignore" ];
 
   meta = with lib; {
     description = "Tree command, improved";
diff --git a/pkgs/tools/typesetting/rfc-bibtex/default.nix b/pkgs/tools/typesetting/rfc-bibtex/default.nix
new file mode 100644
index 0000000000000..de38b4cd29c26
--- /dev/null
+++ b/pkgs/tools/typesetting/rfc-bibtex/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+with python3.pkgs; buildPythonApplication rec {
+  pname = "rfc-bibtex";
+  version = "0.3.2";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "iluxonchik";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-bPCNQqiG50vWVFA6J2kyxftwsXunHTNBdSkoIRYkb0s=";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+    vcrpy
+  ];
+
+  pythonImportsCheck = [
+    "rfc_bibtex"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/iluxonchik/rfc-bibtex/";
+    description = "Generate Bibtex entries for IETF RFCs and Internet-Drafts";
+    license = licenses.mit;
+    maintainers = with maintainers; [ teto ];
+  };
+}