Merge branch 'master' into staging-next-2022-04-23

23 files changed, 265 insertions, 138 deletions

diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index e3241aacab698..a02e34df631d4 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -1,27 +1,68 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, stdenv }:
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.8.4";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TP366SozSNfxUGYXIOObfIul0BhQtIGQYZLwH/TPFs0=";
+    sha256 = "sha256-frVQ2nqOflY26ZZWVYJGMNMOdbLuIojQDu/79kLilBk=";
   };
-
   vendorSha256 = "sha256-1c+YtfRy1ey0z117YHHkrCnpb7g+DmM+LR1rjn1YwMQ=";
 
-  subPackages = [
-    "cmd/stripe"
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/stripe/stripe-cli/pkg/version.Version=${version}"
   ];
 
+  preCheck = ''
+    # the tests expect the Version ldflag not to be set
+    unset ldflags
+  '' + lib.optionalString (
+      # delete plugin tests on all platforms but exact matches
+      # https://github.com/stripe/stripe-cli/issues/850
+      ! lib.lists.any
+        (platform: lib.meta.platformMatch stdenv.hostPlatform platform)
+        [ "x86_64-linux" "x86_64-darwin" ]
+  ) ''
+    rm pkg/plugins/plugin_test.go
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd stripe \
+      --bash <($out/bin/stripe completion --write-to-stdout --shell bash) \
+      --zsh <($out/bin/stripe completion --write-to-stdout --shell zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/stripe --help
+    $out/bin/stripe --version | grep "${version}"
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
     homepage = "https://stripe.com/docs/stripe-cli";
+    changelog = "https://github.com/stripe/stripe-cli/releases/tag/v${version}";
     description = "A command-line tool for Stripe";
+    longDescription = ''
+      The Stripe CLI helps you build, test, and manage your Stripe integration
+      right from the terminal.
+
+      With the CLI, you can:
+      Securely test webhooks without relying on 3rd party software
+      Trigger webhook events or resend events for easy testing
+      Tail your API request logs in real-time
+      Create, retrieve, update, or delete API objects.
+    '';
     license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ RaghavSood ];
+    maintainers = with maintainers; [ RaghavSood jk ];
     mainProgram = "stripe";
   };
 }
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
new file mode 100644
index 0000000000000..5c0bc74245f62
--- /dev/null
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, rustPlatform, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "httm";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "kimono-koans";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-uqzwS7+OQsPdMv3+fWdn3yVFJwtFZNd8kVWw//mQZj8=";
+  };
+
+  cargoSha256 = "sha256-EC3E5NawsDe+CU5WEu0G3FWVLuqW5nXOoUURN0iDPK0=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage httm.1
+
+    installShellCompletion --cmd httm \
+      --zsh scripts/httm-key-bindings.zsh
+  '';
+
+  meta = with lib; {
+    description = "Interactive, file-level ZFS Time Machine-like tool";
+    homepage = "https://github.com/kimono-koans/httm";
+    license = licenses.mpl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ wyndon ];
+  };
+}
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index d815b6ac83e2c..2bc40f1cc7889 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -36,7 +36,7 @@ mkDerivation rec {
     libGLU libGL freeglut
   ]) ++ lib.optional enableUnfree (opencv2.override { enableUnfree = true; });
 
-  patches = [ ./threads.patch ./pfstools.patch ./pfsalign.patch ];
+  patches = [ ./glut.patch ./threads.patch ./pfstools.patch ./pfsalign.patch ];
 
   meta = with lib; {
     homepage = "http://pfstools.sourceforge.net/";
diff --git a/pkgs/tools/graphics/pfstools/glut.patch b/pkgs/tools/graphics/pfstools/glut.patch
new file mode 100644
index 0000000000000..b540b5ebc6a6e
--- /dev/null
+++ b/pkgs/tools/graphics/pfstools/glut.patch
@@ -0,0 +1,12 @@
+--- a/src/pfsglview/CMakeLists.txt	2022-04-04 23:21:11.164016369 +0300
++++ b/src/pfsglview/CMakeLists.txt	2022-04-04 23:21:32.757878750 +0300
+@@ -11,8 +11,7 @@
+ 

+ add_executable(pfsglview pfsglview.cpp picture_io.cpp module.cpp m_histogram.cpp m_status.cpp m_on_screen_display.cpp)

+ 

+-# TODO: Use ${GLUT_LIBRARY} instead.

+-target_link_libraries(pfsglview ${OPENGL_LIBRARIES} ${GLUT_glut_LIBRARY} pfs)

++target_link_libraries(pfsglview ${OPENGL_LIBRARIES} ${GLUT_LIBRARIES} pfs)

+ 

+ install (TARGETS pfsglview DESTINATION bin)

+ install (FILES pfsglview.1 DESTINATION ${MAN_DIR})

diff --git a/pkgs/tools/graphics/pixel2svg/default.nix b/pkgs/tools/graphics/pixel2svg/default.nix
new file mode 100644
index 0000000000000..630e896ee75bb
--- /dev/null
+++ b/pkgs/tools/graphics/pixel2svg/default.nix
@@ -0,0 +1,20 @@
+{ lib, buildPythonPackage, fetchurl, python310Packages }:
+
+python310Packages.buildPythonPackage rec {
+  pname = "pixel2svg";
+  version = "0.3.0";
+
+  src = fetchurl {
+    url = "https://static.florian-berger.de/pixel2svg-${version}.zip";
+    sha256 = "sha256-aqcTTmZKcdRdVd8GGz5cuaQ4gjPapVJNtiiZu22TZgQ=";
+  };
+
+  propagatedBuildInputs = with python310Packages; [ pillow svgwrite ];
+
+  meta = with lib; {
+    homepage = "https://florian-berger.de/en/software/pixel2svg/";
+    description = "Converts pixel art to SVG - pixel by pixel";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ papojari ];
+  };
+}
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index df41ecd485db6..ea1acfb4edfce 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.2.198.0";
+  version = "1.3.211.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-ExtensionLayer";
       rev = "sdk-${version}";
-      sha256 = "sha256-g674rw8lXyP1WUoJmbRRL7s+1Yxs00sR04+hTQ3l3dE=";
+      sha256 = "sha256-ixCfHnp6YAOuR4NMTGjhhqkfm0H7ZcO/8xKFJqw16YE=";
     });
 
   nativeBuildInputs = [ cmake jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index ae9e0e86b2521..7bdfafad13f88 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -23,14 +23,14 @@
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
   # The version must match that in vulkan-headers
-  version = "1.2.189.1";
+  version = "1.3.211.0";
 
   src = (assert version == vulkan-headers.version;
     fetchFromGitHub {
       owner = "LunarG";
       repo = "VulkanTools";
       rev = "sdk-${version}";
-      sha256 = "0431dgplv5wiz8bj0ja91mbpc2qhjgdhqhrgaqarvyvjr1f7jw52";
+      sha256 = "sha256-Pkz2FV0AnTKm/4jVmkQNkYzpxpKJaSoy2fRAhVh5OKU=";
       fetchSubmodules = true;
     });
 
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 987511b1cc967..77d23df4923f5 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -1,9 +1,24 @@
-{ stdenv, lib, fetchFromGitHub, cmake, glslang, libX11, libxcb
-, libXrandr, vulkan-headers, vulkan-loader, wayland }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkgconfig
+, glslang
+, libffi
+, libX11
+, libXau
+, libxcb
+, libXdmcp
+, libXrandr
+, vulkan-headers
+, vulkan-loader
+, wayland
+, wayland-protocols
+}:
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.2.198.0";
+  version = "1.3.211.0";
 
   # It's not strictly necessary to have matching versions here, however
   # since we're using the SDK version we may as well be consistent with
@@ -13,11 +28,27 @@ stdenv.mkDerivation rec {
       owner = "KhronosGroup";
       repo = "Vulkan-Tools";
       rev = "sdk-${version}";
-      sha256 = "sha256-oNJm9Gi41aA5krkpkQI0EYdIlMcQpdodv9yqXhnNURA=";
+      sha256 = "sha256-iXsWTKNllPZy1Kpo3JHzEEus3Hu9LofvMB3c4Gn6/DM=";
     });
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ glslang libX11 libxcb libXrandr vulkan-headers vulkan-loader wayland ];
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+  ];
+
+  buildInputs = [
+    glslang
+    libffi
+    libX11
+    libXau
+    libxcb
+    libXdmcp
+    libXrandr
+    vulkan-headers
+    vulkan-loader
+    wayland
+    wayland-protocols
+  ];
 
   libraryPath = lib.strings.makeLibraryPath [ vulkan-loader ];
 
@@ -28,6 +59,7 @@ stdenv.mkDerivation rec {
     "-DBUILD_ICD=OFF"
     # vulkaninfo loads libvulkan using dlopen, so we have to add it manually to RPATH
     "-DCMAKE_INSTALL_RPATH=${libraryPath}"
+    "-DPKG_CONFIG_EXECUTABLE=${pkgconfig}/bin/pkg-config"
     # Hide dev warnings that are useless for packaging
     "-Wno-dev"
   ];
diff --git a/pkgs/tools/misc/bcunit/default.nix b/pkgs/tools/misc/bcunit/default.nix
index 61fc84fef7e76..b9e7c9712daab 100644
--- a/pkgs/tools/misc/bcunit/default.nix
+++ b/pkgs/tools/misc/bcunit/default.nix
@@ -5,9 +5,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bcunit";
-  # Latest release 3.0.2 is missing some functions needed by bctoolbox. See:
-  # https://gitlab.linphone.org/BC/public/bcunit/issues/1
-  version = "unstable-2019-11-19";
+  version = "linphone-4.4.1";
 
   nativeBuildInputs = [ cmake ];
   src = fetchFromGitLab {
@@ -15,12 +13,12 @@ stdenv.mkDerivation rec {
     owner = "public";
     group = "BC";
     repo = pname;
-    rev = "3c720fbf67dd3c02b0c7011ed4036982b2c93532";
-    sha256 = "1237hpmkls2igp60gdfkbknxpgwvxn1vmv2m41vyl25xw1d3g35w";
+    rev = "c5eebcc7f794e9567d3c72d15d3f28bffe6bfd0f";
+    sha256 = "sha256-8DSfqHerx/V00SJjTSQaG9Rjqx330iG6sGivBDUvQfA=";
   };
 
   meta = with lib; {
-    description = "A fork of CUnit test framework";
+    description = "Belledonne Communications' fork of CUnit test framework. Part of the Linphone project.";
     homepage = "https://gitlab.linphone.org/BC/public/bcunit";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ raskin jluttine ];
diff --git a/pkgs/tools/misc/dsq/default.nix b/pkgs/tools/misc/dsq/default.nix
index 9aae206bcdd01..2fef722173b15 100644
--- a/pkgs/tools/misc/dsq/default.nix
+++ b/pkgs/tools/misc/dsq/default.nix
@@ -4,8 +4,12 @@
 , buildGoModule
 , runCommand
 , nix-update-script
-, dsq
+, fetchurl
 , testers
+, python3
+, curl
+, jq
+, dsq
 }:
 
 buildGoModule rec {
@@ -23,31 +27,34 @@ buildGoModule rec {
 
   ldflags = [ "-X" "main.Version=${version}" ];
 
+  checkInputs = [ python3 curl jq ];
+
+  preCheck =
+    let
+      taxiCsv = fetchurl {
+        url = "https://s3.amazonaws.com/nyc-tlc/trip+data/yellow_tripdata_2021-04.csv";
+        hash = "sha256-CXJPraOYAy5tViDcBi9gxI/rJ3ZXqOa/nJ/d+aREV+M=";
+      };
+    in
+    ''
+      substituteInPlace scripts/test.py \
+        --replace '${taxiCsv.url}' file://${taxiCsv} \
+        --replace 'dsq latest' 'dsq ${version}'
+    '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    cp "$GOPATH/bin/dsq" .
+    python3 scripts/test.py
+
+    runHook postCheck
+  '';
+
   passthru = {
     updateScript = nix-update-script { attrPath = pname; };
 
-    tests = {
-      version = testers.testVersion { package = dsq; };
-
-      pretty-csv = runCommand "${pname}-test" { } ''
-        mkdir "$out"
-        cat <<EOF > "$out/input.csv"
-        first,second
-        1,a
-        2,b
-        EOF
-        cat <<EOF > "$out/expected.txt"
-        +-------+--------+
-        | first | second |
-        +-------+--------+
-        |     1 | a      |
-        |     2 | b      |
-        +-------+--------+
-        EOF
-        ${dsq}/bin/dsq --pretty "$out/input.csv" 'select first, second from {}' > "$out/actual.txt"
-        diff "$out/expected.txt" "$out/actual.txt"
-      '';
-    };
+    tests.version = testers.testVersion { package = dsq; };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/ntfy-sh/default.nix b/pkgs/tools/misc/ntfy-sh/default.nix
index f7c55dfa91a19..17e26fc33d19c 100644
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ntfy-sh";
-  version = "1.20.0";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "binwiederhier";
     repo = "ntfy";
     rev = "v${version}";
-    sha256 = "sha256-JwRI58FadN7DH4MOO033EYmcbqCIuPxw5wWeafoInSg=";
+    sha256 = "sha256-bMVClVt+D+LSvlD0m82MHJc+dcUuqGKo6gxtSqFwkHM=";
   };
 
-  vendorSha256 = "sha256-nzcCLDN/vJ6DS6isCSLL9ycxFkIyUwy4Um6M7NWAPTk=";
+  vendorSha256 = "sha256-Sx6l5GJ72A0SHEHyVtlte8Ed9fuJzZAkJzC0zpCbvK8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/s6-portable-utils/default.nix b/pkgs/tools/misc/s6-portable-utils/default.nix
index 84877508607e2..fe6fbf8717c71 100644
--- a/pkgs/tools/misc/s6-portable-utils/default.nix
+++ b/pkgs/tools/misc/s6-portable-utils/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6-portable-utils";
-  version = "2.2.3.4";
-  sha256 = "04n9i9ydaa3cb3pip9d02dm24k26v3djvwrafjzq5qx94zvrifip";
+  version = "2.2.4.0";
+  sha256 = "sha256-yx7qifAxEAbwEyqkUyT/lvp3VtEaX0Nmxo0ISDnlpW8=";
 
   description = "A set of tiny general Unix utilities optimized for simplicity and small size";
 
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index dfa9b18afd22b..78e2dc219b730 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -1,19 +1,26 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, Foundation, installShellFiles }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, rustPlatform
+, Cocoa
+, Foundation
+, installShellFiles
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "8.3.0";
+  version = "8.3.1";
 
   src = fetchFromGitHub {
     owner = "r-darwish";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iFS8Bf2IF0GoW168DwfBbkiPd7IGJhGShofFnBESpUc=";
+    sha256 = "sha256-EsC17VUQDgrhCU26fsqf2zXOTKa/WeKHiWG0Zn1Qao4=";
   };
 
-  cargoSha256 = "sha256-8Ag4rDXnDZgxdwFpiWnYNjDeau9vr9EIfbJzeQlqSDM=";
+  cargoSha256 = "sha256-e5QJw5yY+ZkijqoqRauA5ncvLWiRlalYZCwSG5U7uDk=";
 
-  buildInputs = lib.optional stdenv.isDarwin Foundation;
+  buildInputs = lib.optionals stdenv.isDarwin [ Cocoa Foundation ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -25,6 +32,7 @@ rustPlatform.buildRustPackage rec {
     description = "Upgrade all the things";
     homepage = "https://github.com/r-darwish/topgrade";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ Br1ght0ne hugoreeves SuperSandro2000 ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index efabd8bc453b9..1a87a31e3385b 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -10,6 +10,7 @@
 , pycryptodomex
 , websockets
 , mutagen
+, atomicparsleySupport ? true
 , ffmpegSupport ? true
 , rtmpSupport ? true
 , phantomjsSupport ? false
@@ -37,11 +38,12 @@ buildPythonPackage rec {
   # - atomicparsley: embedding thumbnails
   makeWrapperArgs =
     let
-      packagesToBinPath = [ atomicparsley ]
+      packagesToBinPath = []
+        ++ lib.optional atomicparsleySupport atomicparsley
         ++ lib.optional ffmpegSupport ffmpeg
         ++ lib.optional rtmpSupport rtmpdump
         ++ lib.optional phantomjsSupport phantomjs2;
-    in
+    in lib.optionalString (packagesToBinPath != [])
     [ ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ];
 
   setupPyBuildFlags = [
diff --git a/pkgs/tools/networking/philter/default.nix b/pkgs/tools/networking/philter/default.nix
deleted file mode 100644
index dc447f3a86b90..0000000000000
--- a/pkgs/tools/networking/philter/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ lib, stdenv, fetchurl, python2 }:
-
-stdenv.mkDerivation rec {
-  pname = "philter";
-  version = "1.1";
-  src = fetchurl {
-    url = "mirror://sourceforge/philter/${pname}-${version}.tar.gz";
-    sha256 = "177pqfflhdn2mw9lc1wv9ik32ji69rjqr6dw83hfndwlsva5151l";
-  };
-
-  installPhase = ''
-    mkdir -p "$out"/{bin,share/philter}
-    cp .philterrc "$out"/share/philter/philterrc
-    sed -i 's@/usr/local/bin@${python2}/bin@' src/philter.py
-    cp src/philter.py "$out"/bin/philter
-    chmod +x "$out"/bin/philter
-  '';
-
-  meta = with lib; {
-    description = "Mail sorter for Maildirs";
-    homepage = "http://philter.sourceforge.net";
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.all;
-    license = licenses.gpl2;
-  };
-
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://philter.sourceforge.net/";
-    };
-  };
-}
diff --git a/pkgs/tools/networking/termscp/default.nix b/pkgs/tools/networking/termscp/default.nix
index 5542adca77af9..4a497a767f4c8 100644
--- a/pkgs/tools/networking/termscp/default.nix
+++ b/pkgs/tools/networking/termscp/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "termscp";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "veeso";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WqOkud8gOa81P6FT44y5RZX4CWjmou9HufZ3QPoYuAk=";
+    sha256 = "sha256-7T3VmcI9CWrKROQ0U2du2d8e0A6XnOxpd8Zl0T4w+KQ=";
   };
 
-  cargoSha256 = "sha256-jckJiFhiUvbn0fkgKzqDorWQvuLenx/S8+RyPoqaWUg=";
+  cargoSha256 = "sha256-WuoN7b9Fw2Op8tck4ek8gyufInlbPkDHHtLAsbG1NLE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/package-management/packagekit/default.nix b/pkgs/tools/package-management/packagekit/default.nix
index 15f94aceaa4e7..66064139f3800 100644
--- a/pkgs/tools/package-management/packagekit/default.nix
+++ b/pkgs/tools/package-management/packagekit/default.nix
@@ -11,7 +11,6 @@
 , vala
 , gtk-doc
 , nix
-, nlohmann_json ? null
 , boost
 , meson
 , ninja
@@ -27,12 +26,6 @@
 , enableSystemd ? stdenv.isLinux
 , systemd
 }:
-let
-  nix_version = lib.removeSuffix nix.VERSION_SUFFIX nix.version;
-  useNlohmann = lib.versionAtLeast "2.7" nix_version;
-in
-
-assert useNlohmann -> nlohmann_json != null;
 
 stdenv.mkDerivation rec {
   pname = "packagekit";
@@ -43,8 +36,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "PackageKit";
     repo = "PackageKit";
-    rev = "33b847c49b4a42499e3c0f10fef62830c874e086";
-    sha256 = "UDpMswf0EBwcoHTqoWiztXnIAwM69nM+S9MPsR24amw=";
+    rev = "30bb82da8d4161330a6d7a20c9989149303421a1";
+    sha256 = "k2osc2v0OuGrNjwxdqn785RsbHEJP3p79PG9YqnVE3U=";
   };
 
   buildInputs = [
@@ -59,7 +52,6 @@ stdenv.mkDerivation rec {
     nix
     boost
   ] ++ lib.optional enableSystemd systemd
-  ++ lib.optional useNlohmann nlohmann_json
   ++ lib.optional enableBashCompletion bash-completion;
   nativeBuildInputs = [
     vala
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 2d24c8292b68a..b4d33a1729160 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Jxtu4f3JeQ1LH2IjSc5hRKDrWXllczQWWHBa4eTzOIY=";
+    sha256 = "sha256-9zA50tnUWR8dglPvMagiGcJDkPHs7yXuqYV2jnRdWqA=";
   };
 
   buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorSha256 = "sha256-fBmSuxjguNc1LOoXqOue0/Ki3979NpqJTzuuqqsjooM=";
+  vendorSha256 = "sha256-buOdutDZUFu+GbjyF0Ql8QAXpNEv2ej0mwjSZMHDmdA=";
 
   subPackages = [
     "cmd/cosign"
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 4098a1015180b..86ba5a9b3bf45 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,47 +2,50 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jcmjfNGruDhQPhVn5R2hdUr+d42qQnIVj8+CCX5HMMM=";
+    sha256 = "sha256-WxSN1pZ8E5vKMoqR5EkGgKnLuHYb5Wl2vzqPcPEkXWE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
       git rev-parse HEAD > $out/COMMIT
-      # '0000-00-00T00:00:00Z'
-      date -u -d "@$(git log -1 --pretty=%ct)" "+'%Y-%m-%dT%H:%M:%SZ'" > $out/SOURCE_DATE_EPOCH
+      # 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-WQ0MuNEJWCxKTjkyqA66bGPoMrS/7W/YTiGU3yd+Ge8=";
+  vendorSha256 = "sha256-v3H+uUERDHZB2ArruCOClCQFEEW8ANeReObww+1VKOI=";
 
-  # install completions post-install
   nativeBuildInputs = [ installShellFiles ];
 
-  excludedPackages = [ "federation" "test/prometheus" ];
+  subPackages = [ "." ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/sigstore/fulcio/cmd/app.gitVersion=v${version}"
-    "-X github.com/sigstore/fulcio/cmd/app.gitTreeState=clean"
+    "-X github.com/sigstore/fulcio/pkg/api.gitVersion=v${version}"
+    "-X github.com/sigstore/fulcio/pkg/api.gitTreeState=clean"
   ];
 
   # ldflags based on metadata from git and source
   preBuild = ''
-    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.gitCommit=$(cat COMMIT)"
-    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.buildDate=$(cat SOURCE_DATE_EPOCH)"
+    ldflags+=" -X github.com/sigstore/fulcio/pkg/api.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X github.com/sigstore/fulcio/pkg/api.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
   preCheck = ''
-    # remove test that requires networking
-    rm pkg/config/config_test.go
+    # test all paths
+    unset subPackages
+
+    # skip test that requires networking
+    substituteInPlace pkg/config/config_test.go \
+      --replace "TestLoad" "SkipLoad"
   '';
 
   postInstall = ''
@@ -55,10 +58,8 @@ buildGoModule rec {
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
-
     $out/bin/fulcio --help
     $out/bin/fulcio version | grep "v${version}"
-
     runHook postInstallCheck
   '';
 
@@ -66,8 +67,17 @@ buildGoModule rec {
     homepage = "https://github.com/sigstore/fulcio";
     changelog = "https://github.com/sigstore/fulcio/releases/tag/v${version}";
     description = "A Root-CA for code signing certs - issuing certificates based on an OIDC email address";
+    longDescription = ''
+      Fulcio is a free code signing Certificate Authority, built to make
+      short-lived certificates available to anyone. Based on an Open ID Connect
+      email address, Fulcio signs x509 certificates valid for under 20 minutes.
+
+      Fulcio was designed to run as a centralized, public-good instance backed
+      up by other transparency logs. Development is now underway to support
+      different delegation models, and to deploy and run Fulcio as a
+      disconnected instance.
+    '';
     license = licenses.asl20;
     maintainers = with maintainers; [ lesuisse jk ];
-    mainProgram = "fulcio-server";
   };
 }
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index a298f10d2d50f..d03a0ce1cac84 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.8.2";
+  version = "8.8.4";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WEVlddqG7t01yl05EujxH/XXBYZxePSKY6IQwkKUkws=";
+    sha256 = "sha256-EW5skmSnnQiMCMqyh51t1q4F5JVYWLSuj1qTqfWp/ok=";
   };
 
   vendorSha256 = "sha256-X8z9iKRR3PptNHwy1clZG8QsClsjbW45nZb2fHGfSYk=";
diff --git a/pkgs/tools/system/envconsul/default.nix b/pkgs/tools/system/envconsul/default.nix
index 9e8180b318a66..71ff489b566f3 100644
--- a/pkgs/tools/system/envconsul/default.nix
+++ b/pkgs/tools/system/envconsul/default.nix
@@ -1,19 +1,24 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "envconsul";
-  version = "0.7.3";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/hashicorp/envconsul";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "hashicorp";
     repo = "envconsul";
-    sha256 = "03cgxkyyynr067dg5b0lhvaxn60318fj9fh55p1n43vj5nrzgnbc";
+    rev = "v${version}";
+    sha256 = "sha256-oV+dGenyNYdVLFn43p+J9TgIbliYOppAKr1ePlMF0d4=";
   };
 
+  vendorSha256 = "sha256-kal1HR9zRVhQKR/ql63hju7XIHU1KRNDTAlOEqzYR4o=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/hashicorp/envconsul/version.Name=envconsul"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/hashicorp/envconsul/";
     description = "Read and set environmental variables for processes from Consul";
diff --git a/pkgs/tools/system/s6-rc/default.nix b/pkgs/tools/system/s6-rc/default.nix
index 0144a605e4087..5a1a4b0929cd4 100644
--- a/pkgs/tools/system/s6-rc/default.nix
+++ b/pkgs/tools/system/s6-rc/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6-rc";
-  version = "0.5.3.0";
-  sha256 = "09rznjlz988fk9pff6mxc3dknwh2mibbawr9g62gcscmscmiv8wk";
+  version = "0.5.3.1";
+  sha256 = "sha256-BYxu25KLvihOyUtc1xObrPNEcszF/5YDo65qGNU7PBI=";
 
   description = "A service manager for s6-based systems";
   platforms = lib.platforms.unix;
diff --git a/pkgs/tools/system/s6/default.nix b/pkgs/tools/system/s6/default.nix
index f1215f9934d7f..eb04e10a31a4d 100644
--- a/pkgs/tools/system/s6/default.nix
+++ b/pkgs/tools/system/s6/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6";
-  version = "2.11.0.1";
-  sha256 = "02pr4q4cr9wc8i8ad8s6184a6fyndpmpnylgxwhfnkk3hx2j0zxd";
+  version = "2.11.1.0";
+  sha256 = "sha256-rmTcK6II/4DkrEeSzpDdUmtCvxnJZtx9jrmmhw5Lwjo=";
 
   description = "skarnet.org's small & secure supervision software suite";