Merge remote-tracking branch 'upstream/master' into hardened-stdenv

pkgs/tools/security/keybase/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "keybase-${version}";
+  version = "1.0.16";
+  rev = "v${version}";
+
+  goPackagePath = "github.com/keybase/client";
+  subPackages = [ "go/keybase" ];
+
+  dontRenameImports = true;
+
+  src = fetchFromGitHub {
+    owner = "keybase";
+    repo = "client";
+    inherit rev;
+    sha256 = "0p62cqpfgx9b5kfnviqpig27i20yv9bg5mq61am5xrmkp68jk35b";
+  };
+
+  buildFlags = [ "-tags production" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://www.keybase.io/;
+    description = "The Keybase official command-line utility and service.";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ carlsverre ];
+  };
+}

pkgs/tools/security/minisign/default.nix

@@ -1,12 +1,14 @@
-{ stdenv, fetchurl, cmake, libsodium }:
+{ stdenv, fetchFromGitHub, cmake, libsodium }:
 
 stdenv.mkDerivation rec {
   name = "minisign-${version}";
   version = "0.6";
 
-  src = fetchurl {
-    url = "https://github.com/jedisct1/minisign/archive/${version}.tar.gz";
-    sha256 = "029g8ian72fy07k73nf451dw1yggav6crjjc2x6kv4nfpq3pl9pj";
+  src = fetchFromGitHub {
+    repo = "minisign";
+    owner = "jedisct1";
+    rev = version;
+    sha256 = "1m71ngxaij3q1dw602kjgj22y5xfjlxrrkjdmx1v4p36y0n6wl92";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -22,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = https://jedisct1.github.io/minisign/;
     license = licenses.isc;
     maintainers = with maintainers; [ joachifm ];
+    platforms = platforms.unix;
   };
 }

pkgs/tools/security/nasty/default.nix

@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1dznlxr728k1pgy1kwmlm7ivyl3j3rlvkmq34qpwbwbj8rnja1vn";
   };
 
+  # does not apply cleanly with patchPhase/fetchpatch
+  # https://sources.debian.net/src/nasty/0.6-3/debian/patches/02_add_largefile_support.patch
+  CFLAGS = "-D_FILE_OFFSET_BITS=64";
+
   buildInputs = [ gpgme ];
 
   installPhase = ''

pkgs/tools/security/sslscan/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "sslscan-${version}";
-  version = "1.11.5";
+  version = "1.11.7";
 
   src = fetchurl {
     url = "https://github.com/rbsec/sslscan/archive/${version}-rbsec.tar.gz";
-    sha256 = "0mcg8hyx1r9sq716bw1r554fcsf512khgcms2ixxb1c31ng6lhq6";
+    sha256 = "0wygz2gm9asvhpfy44333y4pkdja1sbr41hc6mhkxg7a4ys8f9qs";
   };
 
   buildInputs = [ openssl ];

pkgs/tools/security/sudo/default.nix

@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.16";
+  name = "sudo-1.8.17p1";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "0k86sm9ilhxhvnfwq3092zhfxazj3kddn0y2mirz0nqjqmpq50rd";
+    sha256 = "c690d707fb561b3ecdf6a6de5563bc0b769388eff201c851edbace408bb155cc";
   };
 
   configureFlags = [