Merge commit staging+systemd into closure-size

Many non-conflict problems weren't (fully) resolved in this commit yet.

pkgs/tools/security/aespipe/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "aespipe-${version}";
-  version = "2.4c";
+  version = "2.4d";
 
   src = fetchurl {
     url = "mirror://sourceforge/loop-aes/aespipe/aespipe-v${version}.tar.bz2";
-    sha256 = "0pl49jnjczjvfxwm9lw576qsjm1lxh8gc4g776l904cixaz90096";
+    sha256 = "03z5i41xv6p3m79lm04d7msda8878lsppv3324zbjjfy19p6bkn5";
   };
 
   meta = {

pkgs/tools/security/afl/default.nix

@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "afl-${version}";
-  version = "1.67b";
+  version = "1.94b";
 
   src = fetchurl {
     url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
-    sha256 = "11763zgwqg2b5hak006rp0jb3w252js067z9ibgl4nj3br2ncmd2";
+    sha256 = "1c36yz3ajd66m3c5aiai3wf59pzxivn80cvlib3dw45d4zqiymqp";
   };
 
   # Note: libcgroup isn't needed for building, just for the afl-cgroup
@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
 
   buildPhase   = ''
     make PREFIX=$out
-    cd llvm_mode && make && cd ..
+    cd llvm_mode
+    make PREFIX=$out CC=${clang}/bin/clang CXX=${clang}/bin/clang++
+    cd ..
   '';
   installPhase = ''
     # Do the normal installation
@@ -42,13 +44,6 @@ stdenv.mkDerivation rec {
     # Patch shebangs before wrapping
     patchShebangs $out/bin
 
-    # Wrap every program with a custom $AFL_PATH; I believe there is a
-    # bug in afl which causes it to fail to find `afl-qemu-trace`
-    # relative to `afl-fuzz` or `afl-showmap`, so we instead set
-    # $AFL_PATH as a workaround, which allows it to be found.
-    for x in `ls $out/bin/afl-* | grep -v afl-clang-fast`; do
-      wrapProgram $x --prefix AFL_PATH : "$out/bin"
-    done
     # Wrap afl-clang-fast(++) with a *different* AFL_PATH, because it
     # has totally different semantics in that case(?) - and also set a
     # proper AFL_CC and AFL_CXX so we don't pick up the wrong one out

pkgs/tools/security/afl/qemu-patches/afl-config.h

@@ -88,10 +88,10 @@
 /* Maximum stacking for havoc-stage tweaks. The actual value is calculated
    like this: 
 
-   n = random between 0 and HAVOC_STACK_POW2
+   n = random between 1 and HAVOC_STACK_POW2
    stacking = 2^n
 
-   In other words, the default (n = 7) produces 1, 2, 4, 8, 16, 32, 64, or
+   In other words, the default (n = 7) produces 2, 4, 8, 16, 32, 64, or
    128 stacked tweaks: */
 
 #define HAVOC_STACK_POW2    7
@@ -250,9 +250,10 @@
 
 #define RESEED_RNG          10000
 
-/* Maximum line length passed from GCC to 'as': */
+/* Maximum line length passed from GCC to 'as' and used for parsing
+   configuration files: */
 
-#define MAX_AS_LINE         8192
+#define MAX_LINE            8192
 
 /* Environment variable used to pass SHM ID to the called program. */
 

pkgs/tools/security/afl/qemu-patches/cpu-exec.patch

@@ -1,15 +1,15 @@
---- qemu-2.2.0/cpu-exec.c.orig     2014-12-09 14:45:40.000000000 +0000
-+++ qemu-2.2.0/cpu-exec.c  2015-02-20 22:07:02.966000000 +0000
-@@ -25,6 +25,8 @@
- #include "sysemu/qtest.h"
- #include "qemu/timer.h"
+--- qemu-2.3.0/cpu-exec.c.orig     2014-12-09 14:45:40.000000000 +0000
++++ qemu-2.3.0/cpu-exec.c  2015-02-20 22:07:02.966000000 +0000
+@@ -28,6 +28,8 @@
+ #include "exec/memory-internal.h"
+ #include "qemu/rcu.h"
 
 +#include "afl-qemu-cpu-inl.h"
 +
  /* -icount align implementation. */
 
  typedef struct SyncClocks {
-@@ -262,8 +264,11 @@
+@@ -296,8 +298,11 @@
      }
   not_found:
     /* if no translated code available, then translate it now */
@@ -21,7 +21,7 @@
   found:
      /* Move the last found TB to the head of the list */
      if (likely(*ptb1)) {
-@@ -455,6 +460,9 @@
+@@ -492,6 +497,9 @@
                      next_tb = 0;
                      tcg_ctx.tb_ctx.tb_invalidated_flag = 0;
                  }

pkgs/tools/security/afl/qemu-patches/elfload.patch

@@ -1,5 +1,5 @@
---- qemu-2.2.0/linux-user/elfload.c.orig	2014-12-09 14:45:42.000000000 +0000
-+++ qemu-2.2.0/linux-user/elfload.c	2015-01-28 02:51:23.719000000 +0000
+--- qemu-2.3.0/linux-user/elfload.c.orig	2014-12-09 14:45:42.000000000 +0000
++++ qemu-2.3.0/linux-user/elfload.c	2015-01-28 02:51:23.719000000 +0000
 @@ -28,6 +28,8 @@
  
  #define ELF_OSABI   ELFOSABI_SYSV
@@ -9,7 +9,7 @@
  /* from personality.h */
  
  /*
-@@ -1886,6 +1888,8 @@
+@@ -1889,6 +1891,8 @@
      info->brk = 0;
      info->elf_flags = ehdr->e_flags;
  
@@ -18,7 +18,7 @@
      for (i = 0; i < ehdr->e_phnum; i++) {
          struct elf_phdr *eppnt = phdr + i;
          if (eppnt->p_type == PT_LOAD) {
-@@ -1919,9 +1923,11 @@
+@@ -1922,9 +1926,11 @@
              if (elf_prot & PROT_EXEC) {
                  if (vaddr < info->start_code) {
                      info->start_code = vaddr;

pkgs/tools/security/afl/qemu-patches/syscall.patch

@@ -1,5 +1,5 @@
---- qemu-2.2.0/linux-user/syscall.c.orig	2014-12-09 14:45:43.000000000 +0000
-+++ qemu-2.2.0/linux-user/syscall.c	2015-03-27 06:33:00.736000000 +0000
+--- qemu-2.3.0/linux-user/syscall.c.orig	2014-12-09 14:45:43.000000000 +0000
++++ qemu-2.3.0/linux-user/syscall.c	2015-03-27 06:33:00.736000000 +0000
 @@ -227,7 +227,21 @@
  _syscall3(int,sys_rt_sigqueueinfo,int,pid,int,sig,siginfo_t *,uinfo)
  _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)

pkgs/tools/security/afl/qemu-patches/translate-all.patch

@@ -1,6 +1,6 @@
---- qemu-2.2.0/translate-all.c.orig     2014-12-09 14:45:46.000000000 +0000
-+++ qemu-2.2.0/translate-all.c  2015-01-28 22:37:42.383000000 +0000
-@@ -387,8 +387,13 @@
+--- qemu-2.3.0/translate-all.c.orig     2014-12-09 14:45:46.000000000 +0000
++++ qemu-2.3.0/translate-all.c  2015-01-28 22:37:42.383000000 +0000
+@@ -393,8 +393,13 @@
      /* We can't use g_malloc because it may recurse into a locked mutex. */
  # define ALLOC(P, SIZE)                                 \
      do {                                                \

pkgs/tools/security/afl/qemu.nix

@@ -7,7 +7,7 @@
 with stdenv.lib;
 
 let
-  n = "qemu-2.2.0";
+  n = "qemu-2.3.0";
 
   aflHeaderFile = writeText "afl-qemu-cpu-inl.h"
     (builtins.readFile ./qemu-patches/afl-qemu-cpu-inl.h);
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://wiki.qemu.org/download/${n}.tar.bz2";
-    sha256 = "1703c3scl5n07gmpilg7g2xzyxnr7jczxgx6nn4m8kv9gin9p35n";
+    sha256 = "120m53c3p28qxmfzllicjzr8syjv6v4d9rsyrgkp7gnmcgvvgfmn";
   };
 
   buildInputs =

pkgs/tools/security/aide/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = "http://aide.sourceforge.net/";
-    description = "Advanced Intrusion Detection Environment (AIDE) is a file and directory integrity checker";
+    description = "A file and directory integrity checker";
     license = licenses.free;
     maintainers = [ maintainers.tstrobel ];
     platforms = platforms.linux;

pkgs/tools/security/bmrsa/11.nix

@@ -1,5 +1,5 @@
-args :  
-let 
+args @ {unzip, ... } :
+let
   lib = args.lib;
   fetchurl = args.fetchurl;
   fullDepEntry = args.fullDepEntry;

pkgs/tools/security/ccid/default.nix

@@ -1,23 +1,25 @@
 { stdenv, fetchurl, pcsclite, pkgconfig, libusb1, perl }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.18";
+  version = "1.4.20";
   name = "ccid-${version}";
 
   src = fetchurl {
-    url = "http://ftp.de.debian.org/debian/pool/main/c/ccid/ccid_${version}.orig.tar.bz2";
-    sha256 = "1aj14lkmfaxkhk5swqfgn2x18j7fijxs0jnxnx9cdc9f5mxaknsz";
+    url = "https://alioth.debian.org/frs/download.php/file/4140/ccid-1.4.20.tar.bz2";
+    sha256 = "1g0w4pv6q30d8lhs3kd6nywkhh34nhf9fbcbcvbxdvk3pdjvh320";
   };
 
   patchPhase = ''
-    sed -i 's,/usr/bin/env perl,${perl}/bin/perl,' src/*.pl
+    patchShebangs .
     substituteInPlace src/Makefile.in --replace /bin/echo echo
   '';
+
   preConfigure = ''
-    configureFlags="$configureFlags --enable-usbdropdir=$out/pcsc/drivers"
+    configureFlagsArray+=("--enable-usbdropdir=$out/pcsc/drivers")
   '';
 
-  buildInputs = [ pcsclite pkgconfig libusb1 ];
+  nativeBuildInputs = [ pkgconfig perl ];
+  buildInputs = [ pcsclite libusb1 ];
 
   meta = with stdenv.lib; {
     description = "ccid drivers for pcsclite";

pkgs/tools/security/chaps/default.nix

@@ -0,0 +1,81 @@
+{ stdenv, fetchgit, fetchurl, trousers, leveldb, unzip, scons, pkgconfig
+, glib, dbus_cplusplus, dbus, protobuf, openssl, snappy, pam }:
+
+let
+  src_chromebase = fetchgit {
+    url = "https://chromium.googlesource.com/chromium/src/base.git";
+    rev = "2dfe404711e15e24e79799516400c61b2719d7af";
+    sha256 = "2bd93a3ace4b6767db2c1bd1e16f426c97b8d2133a9cb15f8372b2516cfa65c5";
+  };
+
+  src_gmock = fetchurl {
+    url = "https://googlemock.googlecode.com/files/gmock-1.7.0.zip";
+    sha256 = "0nq98cpnv2jsx2byp4ilam6kydcnziflkc16ikydajmp4mcvpz16";
+  };
+
+  src_platform2 = fetchgit {
+    url = "https://chromium.googlesource.com/chromiumos/platform2";
+    rev = "e999e989eaa71c3db7314fc7b4e20829b2b5473b";
+    sha256 = "bb43ef7918ec6219711cbba3ce91236413738f1341261a1845256b3d6cc9f843";
+  };
+
+in
+
+stdenv.mkDerivation rec {
+  name = "chaps-0.42-6812";
+  version = "0.42-6812";
+
+  src = fetchgit {
+    url = "https://github.com/google/chaps-linux";
+    rev = "989aadc45cdb216ca35b0c97d13fc691576fa1d7";
+    sha256 = "c58e08e89d36050cd831116819d555f0e24e7bf11047cb18f2a2eead45ba67be";
+  };
+
+  patches = [ ./fix_absolute_path.patch  ./fix_environment_variables.patch  ./fix_scons.patch  ./insert_prefetches.patch ];
+
+  postPatch = ''
+    substituteInPlace makefile --replace @@NIXOS_SRC_CHROMEBASE@@ ${src_chromebase}
+    substituteInPlace makefile --replace @@NIXOS_SRC_GMOCK@@ ${src_gmock}
+    substituteInPlace makefile --replace @@NIXOS_SRC_PLATFORM2@@ ${src_platform2}
+    substituteInPlace makefile --replace @@NIXOS_LEVELDB@@ ${leveldb}
+    '';
+
+  nativeBuildInputs = [ unzip scons pkgconfig ];
+
+  buildInputs = [ trousers glib dbus_cplusplus dbus protobuf openssl snappy leveldb pam ];
+
+  buildPhase = ''
+    make build
+    '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ${name}/out/chapsd $out/bin/.
+    cp ${name}/out/chaps_client $out/bin/.
+
+    mkdir -p $out/lib
+    cp ${name}/out/libchaps.so.* $out/lib/.
+    mkdir -p $out/lib/security
+    cp ${name}/out/pam_chaps.so $out/lib/security/.
+
+    mkdir -p $out/include
+    cp -r ${name}/out/chaps $out/include/.
+
+    mkdir -p $out/etc/dbus-1/system.d
+    cp ${name}/out/org.chromium.Chaps.conf $out/etc/dbus-1/system.d/.
+    mkdir -p $out/etc/dbus-1/system-services
+    cp ${name}/platform2/chaps/org.chromium.Chaps.service $out/etc/dbus-1/system-services/.
+
+    mkdir -p $out/usr/share/pam-configs/chaps
+    mkdir -p $out/usr/share/man/man8
+    cp ${name}/man/* $out/usr/share/man/man8/.
+    '';
+
+  meta = with stdenv.lib; {
+    description = "PKCS #11 implementation based on trusted platform module (TPM)";
+    homepage = "https://www.chromium.org/developers/design-documents/chaps-technical-design";
+    maintainers = [ maintainers.tstrobel ];
+    platforms = [ "x86_64-linux" ];
+    license = licenses.bsd3;
+  };
+}

pkgs/tools/security/chaps/fix_absolute_path.patch

@@ -0,0 +1,18 @@
+diff --git a/patches/platform2/fix_echo.patch b/patches/platform2/fix_echo.patch
+new file mode 100644
+index 0000000..d2272f6
+--- /dev/null
++++ b/patches/platform2/fix_echo.patch
+@@ -0,0 +1,12 @@
++diff -uNr platform2/common-mk/common.mk platform2-new/common-mk/common.mk
++--- platform2/common-mk/common.mk	2015-07-03 12:07:47.482745292 +0200
+++++ platform2-new/common-mk/common.mk	2015-07-03 12:08:16.868600569 +0200
++@@ -263,7 +263,7 @@
++ $(eval $(call override_var,STRIP,strip))
++ 
++ RMDIR ?= rmdir
++-ECHO = /bin/echo -e
+++ECHO = echo -e
++ 
++ ifeq ($(lastword $(subst /, ,$(CC))),clang)
++ CDRIVER = clang

pkgs/tools/security/chaps/fix_environment_variables.patch

@@ -0,0 +1,42 @@
+diff --git a/extrasrc/Makefile b/extrasrc/Makefile
+index fb95845..77125c0 100644
+--- a/extrasrc/Makefile
++++ b/extrasrc/Makefile
+@@ -10,11 +10,11 @@ OUTDIR=$(SRCDIR)/out
+ GMOCK_DIR=$(SRCDIR)/gmock-$(GMOCK_VER)
+ GTEST_DIR=$(GMOCK_DIR)/gtest
+ 
+-INCLUDES="-I$(SRCDIR)/include -I$(SRCDIR)/platform2/libchromeos -isystem $(GTEST_DIR)/include -I$(GMOCK_DIR)/include -I$(SRCDIR)/leveldb/include"
++INCLUDES="-I$(SRCDIR)/include -I$(SRCDIR)/platform2/libchromeos -isystem $(GTEST_DIR)/include -I$(GMOCK_DIR)/include -I$(SRCDIR)/leveldb/include $(NIX_LDFLAG) $(NIX_CFLAGS_COMPILE)"
+ 
+ # To build Chaps, defer to platform2/chaps/Makefile
+ all: libchrome-$(BASE_VER).a libchromeos-$(BASE_VER).a | out
+-	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR) CXXFLAGS=$(INCLUDES) OUT=$(OUTDIR) CHAPS_VERSION_MAJOR=$(CHAPS_VERSION_MAJOR) CHAPS_VERSION_MINOR=$(CHAPS_VERSION_MINOR) $(MAKE)
++	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR):$(PKG_CONFIG_PATH) CXXFLAGS=$(INCLUDES) OUT=$(OUTDIR) CHAPS_VERSION_MAJOR=$(CHAPS_VERSION_MAJOR) CHAPS_VERSION_MINOR=$(CHAPS_VERSION_MINOR) $(MAKE)
+ 
+ # To build required Chromium components, defer to scons file.
+ libchrome-$(BASE_VER).a:
+@@ -38,7 +38,7 @@ out/libgmock.a: out/gmock-all.o
+ 	ar -rv $@ $<
+ 
+ test: out/libgtest.a out/libgmock.a libchrome-$(BASE_VER).a libchromeos-$(BASE_VER).a | out
+-	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR) CXXFLAGS=$(INCLUDES) LDLIBS="-L$(OUTDIR)" OUT=$(OUTDIR) $(MAKE) tests
++	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR):$(PKG_CONFIG_PATH) CXXFLAGS=$(INCLUDES) LDLIBS="-L$(OUTDIR)" OUT=$(OUTDIR) $(MAKE) tests
+ 
+ clean: clean_chaps clean_chromeos clean_chromebase clean_gmock clean_debian
+ clean_gmock:
+@@ -49,7 +49,7 @@ clean_chromebase:
+ clean_chromeos:
+ 	-BASE_VER=$(BASE_VER) scons -f Sconstruct.libchromeos -c
+ clean_chaps:
+-	-cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR) $(MAKE) clean
++	-cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR):$(PKG_CONFIG_PATH) $(MAKE) clean
+ 	rm -rf out
+ clean_debian:
+ 	dh_clean
+@@ -64,4 +64,4 @@ install_man:
+ 	$(INSTALL) -m 0644 -D man/chapsd.8 $(MANDIR)/man8/chapsd.8
+ 	$(INSTALL) -m 0644 -D man/chaps_client.8 $(MANDIR)/man8/chaps_client.8
+ install: install_man
+-	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR) CXXFLAGS=$(INCLUDES) OUT=$(OUTDIR) CHAPS_VERSION_MAJOR=$(CHAPS_VERSION_MAJOR) CHAPS_VERSION_MINOR=$(CHAPS_VERSION_MINOR) $(MAKE) install_files
++	cd platform2/chaps && BASE_VER=$(BASE_VER) LINUX_BUILD=1 PKG_CONFIG_PATH=$(SRCDIR):$(PKG_CONFIG_PATH) CXXFLAGS=$(INCLUDES) OUT=$(OUTDIR) CHAPS_VERSION_MAJOR=$(CHAPS_VERSION_MAJOR) CHAPS_VERSION_MINOR=$(CHAPS_VERSION_MINOR) $(MAKE) install_files

pkgs/tools/security/chaps/fix_scons.patch

@@ -0,0 +1,26 @@
+diff --git a/extrasrc/Sconstruct.libchrome b/extrasrc/Sconstruct.libchrome
+index 4feb76d..311fe8a 100644
+--- a/extrasrc/Sconstruct.libchrome
++++ b/extrasrc/Sconstruct.libchrome
+@@ -103,7 +103,7 @@ base_lib = {
+     'pc_libs' : 'glib-2.0',
+ }
+ 
+-env = Environment()
++env = Environment(ENV = os.environ)
+ 
+ BASE_VER = os.environ.get('BASE_VER', '0')
+ GTEST_DIR = os.environ.get('GTEST_DIR', '0')
+diff --git a/extrasrc/Sconstruct.libchromeos b/extrasrc/Sconstruct.libchromeos
+index 1da6001..66f9acb 100644
+--- a/extrasrc/Sconstruct.libchromeos
++++ b/extrasrc/Sconstruct.libchromeos
+@@ -18,7 +18,7 @@ base_lib = {
+     'pc_libs' : 'dbus-c++-1',
+ }
+ 
+-env = Environment()
++env = Environment(ENV = os.environ)
+ 
+ PKG_CONFIG = os.environ.get('PKG_CONFIG', 'pkg-config')
+ BASE_VER = os.environ.get('BASE_VER', '0')

pkgs/tools/security/chaps/insert_prefetches.patch

@@ -0,0 +1,51 @@
+diff --git a/makefile b/makefile
+index b6865f3..c14f5ec 100644
+--- a/makefile
++++ b/makefile
+@@ -53,8 +53,8 @@ $(SRCDIR)/include/trousers/scoped_tss_type.h: extrasrc/scoped_tss_type.h | $(SRC
+ 	cp $< $@
+ # Chromium includes <leveldb/memenv.h>.  This requires an install of libleveldb-dev that has
+ # memenv support included; move this into a local leveldb/ subdirectory
+-$(SRCDIR)/include/leveldb/memenv.h: /usr/include/leveldb/helpers/memenv.h | $(SRCDIR)/include/leveldb
+-	cp $< $@
++$(SRCDIR)/include/leveldb/memenv.h: $(SRCDIR)/include/leveldb
++	cp @@NIXOS_LEVELDB@@/include/leveldb/helpers/memenv.h $@
+ # Chromium includes <include/testing/gtest/include/gtest/gtest_prod.h>, so have a local copy.
+ $(SRCDIR)/include/testing/gtest/include/gtest/gtest_prod.h: extrasrc/gtest_prod.h | $(SRCDIR)/include/testing/gtest/include/gtest
+ 	cp $< $@
+@@ -80,7 +80,7 @@ GMOCK_DIR=$(SRCDIR)/gmock-$(GMOCK_VERSION)
+ GTEST_DIR=$(GMOCK_DIR)/gtest
+ src_gmock: $(GMOCK_DIR)/LICENSE
+ $(GMOCK_DIR)/LICENSE: | $(SRCDIR)
+-	cd $(SRCDIR) && wget $(GMOCK_URL)
++	cd $(SRCDIR) && cp @@NIXOS_SRC_GMOCK@@ gmock-$(GMOCK_VERSION).zip && chmod +w gmock-$(GMOCK_VERSION).zip
+ 	cd $(SRCDIR) && unzip -q gmock-$(GMOCK_VERSION).zip
+ 	rm $(SRCDIR)/gmock-$(GMOCK_VERSION).zip
+ 	touch $@
+@@ -107,8 +107,7 @@ src_chromebase: $(SRCDIR)/base/base64.h
+ $(SRCDIR)/base: | $(SRCDIR)
+ 	mkdir -p $@
+ $(SRCDIR)/base/base64.h: | $(SRCDIR)/base
+-	git clone $(CHROMEBASE_GIT) $(SRCDIR)/base
+-	cd $(SRCDIR)/base && git checkout $(CHROMEBASE_COMMIT)
++	cp -r @@NIXOS_SRC_CHROMEBASE@@/. $(SRCDIR)/base && chmod -R +w $(SRCDIR)/base
+ 
+ # We need two subdirectories from the platform2 repository from ChromiumOS:
+ #   - chaps/ for the Chaps source code
+@@ -119,14 +118,8 @@ $(SRCDIR)/platform2:
+ PLATFORM2_GIT=https://chromium.googlesource.com/chromiumos/platform2
+ PATCHES=$(wildcard $(CURDIR)/patches/platform2/*.patch)
+ $(SRCDIR)/platform2/chaps/Makefile: | $(SRCDIR)/platform2
+-	cd $(SRCDIR)/platform2 && git init . && git remote add -f origin $(PLATFORM2_GIT)
+-	cd $(SRCDIR)/platform2 && git config core.sparsecheckout true
+-	cd $(SRCDIR)/platform2 && echo "chaps" > .git/info/sparse-checkout
+-	cd $(SRCDIR)/platform2 && echo "libchromeos/chromeos" >> .git/info/sparse-checkout
+-	cd $(SRCDIR)/platform2 && echo "common-mk/common.mk" >> .git/info/sparse-checkout
+-	cd $(SRCDIR)/platform2 && git pull origin master
+-	cd $(SRCDIR)/platform2 && git checkout $(CROS_BRANCH)
+-	cd $(SRCDIR)/platform2 && if [ ! -z "$(PATCHES)" ]; then git am $(PATCHES); fi
++	cd $(SRCDIR)/platform2 && cp -r @@NIXOS_SRC_PLATFORM2@@/. . && chmod -R +w $(SRCDIR)/platform2
++	cd $(SRCDIR)/platform2 && if [ ! -z "$(PATCHES)" ]; then patch -p1 < $(PATCHES); fi
+ 
+ 
+ # Copy man pages

pkgs/tools/security/chkrootkit/default.nix

@@ -1,16 +1,15 @@
 {stdenv, fetchurl}:
-  
+
 stdenv.mkDerivation {
-  name = "chkrootkit-0.48";
-  
+  name = "chkrootkit-0.50";
+
   src = fetchurl {
     url = ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz;
-    sha256 = "1yzid6bw092nf8k83y1119kc4ns7r0l3zsfah5xal8kh19ad7cxl";
+    sha256 = "1ivclp7ixndacjmf7xgj8lfa6h7ihx44mzzsapqdvf0c5f9gqj4m";
   };
 
   installPhase = "
     mkdir -p $out/sbin
     cp check_wtmpx chkdirs chklastlog chkproc chkrootkit chkutmp chkwtmp ifpromisc strings-static $out/sbin
   ";
-  
 }

pkgs/tools/security/chntpw/default.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = http://pogostick.net/~pnh/ntpasswd/;
     description = "An utility to reset the password of any user that has a valid local account on a Windows system";
+    maintainers = with stdenv.lib.maintainers; [ deepfire ];
     license = licenses.gpl2;
   };
 }

pkgs/tools/security/clamav/default.nix

@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl }:
+{ stdenv, fetchurl, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl
+, libmilter }:
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
-  version = "0.98.6";
+  version = "0.98.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/clamav/clamav-${version}.tar.gz";
-    sha256 = "0l99a0shgzpl8rvrrgbm1ki2zxlb7g1n82bhq7f2snj4amfj94b5";
+    sha256 = "0wp2ad8km4cqmlndni5ljv7q3lfxm6y4r3giv0yf23bl0yvif918";
   };
 
-  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv ];
+  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl libiconv libmilter ];
 
   configureFlags = [
     "--with-zlib=${zlib}"
@@ -18,6 +19,7 @@ stdenv.mkDerivation rec {
     "--with-openssl=${openssl}"
     "--with-libncurses-prefix=${ncurses}"
     "--with-libcurl=${curl}"
+    "--enable-milter"
     "--disable-clamav"
   ];
 
@@ -25,7 +27,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.clamav.net;
     description = "Antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats";
     license = licenses.gpl2;
-    maintainers = [ maintainers.phreedom maintainers.robberer ];
+    maintainers = with maintainers; [ phreedom robberer qknight ];
     platforms = platforms.linux;
   };
 }

pkgs/tools/security/crackxls/default.nix

@@ -0,0 +1,34 @@
+{ stdenv, fetchgit, pkgconfig, autoconf, automake, openssl, libgsf, gmp }:
+
+stdenv.mkDerivation rec {
+
+  name = "crackxls-${version}";
+  version = "0.4";
+
+  src = fetchgit {
+    url = https://github.com/GavinSmith0123/crackxls2003.git;
+    rev = "refs/tags/v${version}";
+    sha256 = "0q5jl7hcds3f0rhly3iy4fhhbyh9cdrfaw7zdrazzf1wswwhyssz";
+  };
+
+  buildInputs = [ pkgconfig autoconf automake openssl libgsf gmp ];
+
+  patchPhase = ''
+    substituteInPlace Makefile.in \
+      --replace '-march=native' "" \
+      --replace '-mtune=native' ""
+  '';
+
+  installPhase =
+  ''
+    mkdir -p $out/bin
+    cp crackxls2003 $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/GavinSmith0123/crackxls2003/;
+    description = "Used to break the encryption on old Microsoft Excel and Microsoft Word files";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+}

pkgs/tools/security/ecryptfs/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchurl, pkgconfig, perl, utillinux, keyutils, nss, nspr, python, pam
-, intltool, makeWrapper, coreutils, bash, gettext, cryptsetup, lvm2, rsync, which }:
+, intltool, makeWrapper, coreutils, bash, gettext, cryptsetup, lvm2, rsync, which, lsof }:
 
 stdenv.mkDerivation rec {
   name = "ecryptfs-${version}";
-  version = "106";
+  version = "108";
 
   src = fetchurl {
     url = "http://launchpad.net/ecryptfs/trunk/${version}/+download/ecryptfs-utils_${version}.orig.tar.gz";
-    sha256 = "1d5nlzcbl8ch639zi3lq6d14gkk4964j6dqhfs87i67867fhlghp";
+    sha256 = "1pfpzc907m4qi5h2rxmkqq072c6g22pik2rilj4bl4qishd8p0sj";
   };
 
   #TODO: replace wrapperDir below with from <nixos> config.security.wrapperDir;
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
         --prefix PATH ":" "${rsync}/bin" \
         --prefix PATH ":" "${keyutils}/bin" \
         --prefix PATH ":" "${which}/bin" \
+        --prefix PATH ":" "${lsof}/bin" \
         --prefix PATH ":" "$out/bin"
     done
   '';

pkgs/tools/security/eid-mw/default.nix

@@ -1,18 +1,23 @@
 { stdenv, fetchFromGitHub, autoreconfHook, gtk2, nssTools, pcsclite
 , pkgconfig }:
 
-let version = "4.1.2"; in
-stdenv.mkDerivation rec {
+let version = "4.1.6"; in
+stdenv.mkDerivation {
   name = "eid-mw-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "034ar1v2qamdyq71nklh1nvqbmw6ryz63jdwnnc873f639mf5w94";
+    sha256 = "006s7093wqmk36mrlakjv89bqddyh599rvmgv0zgsp15vf9160zi";
     rev = "v${version}";
     repo = "eid-mw";
     owner = "Fedict";
   };
 
-  buildInputs = [ autoreconfHook gtk2 pcsclite pkgconfig ];
+  buildInputs = [ gtk2 pcsclite ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  postPatch = ''
+    sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
+  '';
 
   enableParallelBuilding = true;
 
@@ -22,12 +27,15 @@ stdenv.mkDerivation rec {
     install -D ${./eid-nssdb.in} $out/bin/eid-nssdb
     substituteInPlace $out/bin/eid-nssdb \
       --replace "modutil" "${nssTools}/bin/modutil"
+
+    # Only provides a useless "about-eid-mw.desktop" that segfaults anyway:
+    rm -rf $out/share/applications $out/bin/about-eid-mw
   '';
 
   meta = with stdenv.lib; {
     description = "Belgian electronic identity card (eID) middleware";
     homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
-    license = with licenses; lgpl3;
+    license = licenses.lgpl3;
     longDescription = ''
       Allows user authentication and digital signatures with Belgian ID cards.
       Also requires a running pcscd service and compatible card reader.
@@ -47,6 +55,6 @@ stdenv.mkDerivation rec {
       and remove all ~/.pki and/or /etc/pki directories no longer needed.
     '';
     maintainers = with maintainers; [ nckx ];
-    platforms = with platforms; linux;
+    platforms = platforms.linux;
   };
 }

pkgs/tools/security/eid-mw/eid-nssdb.in

@@ -59,6 +59,9 @@ fi
 
 dbdir="sql:$dbdir"
 
+echo "NSS database: $dbdir"
+echo "BEID library: $libfile"
+
 case "$1" in
 add)	echo "Adding $dbentry to database:"
 	modutil -dbdir "$dbdir" -add "$dbentry" -libfile "$libfile" ||
@@ -75,9 +78,6 @@ esac
 
 ret=$?
 
-echo "NSS database: $dbdir"
-echo "BEID library: $libfile"
-
 modutil -dbdir "$dbdir" -list "$dbentry" 2>/dev/null
 
 exit $ret

pkgs/tools/security/eid-viewer/default.nix

@@ -1,17 +1,20 @@
 { stdenv, fetchurl, jre, makeWrapper, pcsclite }:
 
-stdenv.mkDerivation rec {
+let
   # TODO: find out what the version components actually mean, if anything:
-  package = "eid-viewer-4.0.7-195";
-  build = "tcm406-258907";
-  name = "${package}-${build}";
+  major = "4.1.4-v4.1.4";
+  minor = "tcm406-270732";
+  version = "${major}-${minor}";
+in stdenv.mkDerivation rec {
+  name = "eid-viewer-${version}";
 
   src = fetchurl {
-    url = "http://eid.belgium.be/en/binaries/${package}.src.tar_${build}.gz";
-    sha256 = "e263e6751ef7c185e278a607fdc46c207306d9a56c6ddb2ce6f58fb4464a2893";
+    url = "http://eid.belgium.be/en/binaries/eid-viewer-${major}.src.tar_${minor}.gz";
+    sha256 = "06kda45y7c3wvvqby153zcasgz4jibjypv8gvfwvrwvn4ag2z934";
   };
 
-  buildInputs = [ jre makeWrapper pcsclite ];
+  buildInputs = [ jre pcsclite ];
+  nativeBuildInputs = [ makeWrapper ];
 
   unpackPhase = "tar -xzf ${src} --strip-components=1";
 
@@ -30,9 +33,10 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
+    inherit version;
     description = "Belgian electronic identity card (eID) viewer";
     homepage = http://eid.belgium.be/en/using_your_eid/installing_the_eid_software/linux/;
-    license = with licenses; lgpl3;
+    license = licenses.lgpl3;
     longDescription = ''
       A simple, graphical Java application to view, print and save data from
       Belgian electronic identity cards. Independent of the eid-mw package,

pkgs/tools/security/fail2ban/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python, pythonPackages, unzip, systemd, gamin }:
+{ stdenv, fetchzip, python, pythonPackages, unzip, systemd, gamin }:
 
 let version = "0.9.1"; in
 
@@ -6,10 +6,10 @@ pythonPackages.buildPythonPackage {
   name = "fail2ban-${version}";
   namePrefix = "";
 
-  src = fetchurl {
-    url    = "https://github.com/fail2ban/fail2ban/zipball/${version}";
-    name   = "fail2ban-${version}.zip";
-    sha256 = "0lk720r212mbpk1654qihyxcj5wmglzkg7v4pyiy5qq9qy58jmyr";
+  src = fetchzip {
+    name   = "fail2ban-${version}-src";
+    url    = "https://github.com/fail2ban/fail2ban/archive/${version}.tar.gz";
+    sha256 = "111xvy2gxwn868kn0zy2fmdfa423z6fk57i7wsfrc0l74p1cdvs5";
   };
 
   buildInputs = [ unzip ];

pkgs/tools/security/fprint_demo/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchgit, autoreconfHook, pkgconfig, libfprint, gtk2 }:
 
 stdenv.mkDerivation rec {
-  name = "fprint_demo";
+  name = "fprint_demo-2008-03-03";
 
   src = fetchgit {
     url = "git://github.com/dsd/fprint_demo";

pkgs/tools/security/gnupg/20.nix

@@ -12,11 +12,11 @@ with stdenv.lib;
 assert x11Support -> pinentry != null;
 
 stdenv.mkDerivation rec {
-  name = "gnupg-2.0.27";
+  name = "gnupg-2.0.29";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1wihx7dphacg9fy5wfj93h236lr1w5gwzh7ir3js37wi9cz6sr2p";
+    sha256 = "1jaakn0mi6pi2b3g3imxj3qzxw2zg0ifxs30baq2b157dcw6pvb8";
   };
 
   buildInputs

pkgs/tools/security/gnupg/21.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libgcrypt, libassuan, libksba, npth
+{ fetchurl, stdenv, pkgconfig, libgcrypt, libassuan, libksba, libiconv, npth
 , autoreconfHook, gettext, texinfo, pcsclite
 
 # Each of the dependencies below are optional.
@@ -13,21 +13,19 @@ with stdenv.lib;
 assert x11Support -> pinentry != null;
 
 stdenv.mkDerivation rec {
-  name = "gnupg-2.1.3";
+  name = "gnupg-2.1.8";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1vf8fmwcq81abzw2mypz5j7m4xy0vl4z6lri5lxfbd2bsyq7ygi1";
+    sha256 = "18w14xp0ynzzwpklyplkzbrncds1hly4k2gjx115swch8qgd1f53";
   };
 
-  patches = [ ./socket-activate-2.1.1.patch ];
-
   postPatch = stdenv.lib.optionalString stdenv.isLinux ''
     sed -i 's,"libpcsclite\.so[^"]*","${pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c
   '';
 
   buildInputs = [
-    pkgconfig libgcrypt libassuan libksba npth
+    pkgconfig libgcrypt libassuan libksba libiconv npth
     autoreconfHook gettext texinfo
     readline libusb gnutls adns openldap zlib bzip2
   ];

pkgs/tools/security/gnupg/socket-activate-2.1.1.patch

@@ -1,170 +0,0 @@
-Port Shea Levy's socket activation patch to version 2.1.1.
-
-diff -Naur gnupg-2.1.1-upstream/agent/gpg-agent.c gnupg-2.1.1/agent/gpg-agent.c
---- gnupg-2.1.1-upstream/agent/gpg-agent.c	2014-12-01 05:04:57.000000000 -0430
-+++ gnupg-2.1.1/agent/gpg-agent.c	2014-12-23 17:13:48.029286035 -0430
-@@ -125,7 +125,9 @@
-   oPuttySupport,
-   oDisableScdaemon,
-   oDisableCheckOwnSocket,
--  oWriteEnvFile
-+  oWriteEnvFile,
-+  oAgentFD,
-+  oSSHAgentFD
- };
- 
- 
-@@ -143,6 +145,8 @@
-   ARGPARSE_group (301, N_("@Options:\n ")),
- 
-   ARGPARSE_s_n (oDaemon,  "daemon", N_("run in daemon mode (background)")),
-+  ARGPARSE_s_i (oAgentFD,  "agent-fd", "@"),
-+  ARGPARSE_s_i (oSSHAgentFD,  "ssh-agent-fd", "@"),
-   ARGPARSE_s_n (oServer,  "server", N_("run in server mode (foreground)")),
-   ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
-   ARGPARSE_s_n (oQuiet,	  "quiet",     N_("be somewhat more quiet")),
-@@ -627,6 +631,31 @@
-   return 1; /* handled */
- }
- 
-+/* Handle agent socket(s) */
-+static void
-+handle_agent_socks(int fd, int fd_extra, int fd_ssh)
-+{
-+#ifndef HAVE_W32_SYSTEM
-+  if (chdir("/"))
-+    {
-+      log_error ("chdir to / failed: %s\n", strerror (errno));
-+      exit (1);
-+    }
-+
-+  {
-+    struct sigaction sa;
-+
-+    sa.sa_handler = SIG_IGN;
-+    sigemptyset (&sa.sa_mask);
-+    sa.sa_flags = 0;
-+    sigaction (SIGPIPE, &sa, NULL);
-+  }
-+#endif /*!HAVE_W32_SYSTEM*/
-+
-+  log_info ("%s %s started\n", strusage(11), strusage(13) );
-+  handle_connections (fd, fd_extra, fd_ssh);
-+  assuan_sock_close (fd);
-+}
- 
- /* The main entry point.  */
- int
-@@ -643,6 +672,8 @@
-   int default_config =1;
-   int pipe_server = 0;
-   int is_daemon = 0;
-+  int fd_agent = GNUPG_INVALID_FD;
-+  int fd_ssh_agent = GNUPG_INVALID_FD;
-   int nodetach = 0;
-   int csh_style = 0;
-   char *logfile = NULL;
-@@ -850,6 +881,8 @@
-         case oSh: csh_style = 0; break;
-         case oServer: pipe_server = 1; break;
-         case oDaemon: is_daemon = 1; break;
-+        case oAgentFD: fd_agent = pargs.r.ret_int; break;
-+        case oSSHAgentFD: fd_ssh_agent = pargs.r.ret_int; break;
- 
-         case oDisplay: default_display = xstrdup (pargs.r.ret_str); break;
-         case oTTYname: default_ttyname = xstrdup (pargs.r.ret_str); break;
-@@ -940,7 +973,8 @@
-     bind_textdomain_codeset (PACKAGE_GT, "UTF-8");
- #endif
- 
--  if (!pipe_server && !is_daemon && !gpgconf_list)
-+  if (!pipe_server && !is_daemon && !gpgconf_list &&
-+                                                  fd_agent == GNUPG_INVALID_FD)
-     {
-      /* We have been called without any options and thus we merely
-         check whether an agent is already running.  We do this right
-@@ -1090,6 +1124,10 @@
-       agent_deinit_default_ctrl (ctrl);
-       xfree (ctrl);
-     }
-+  else if (fd_agent != GNUPG_INVALID_FD)
-+    {
-+      handle_agent_socks(fd_agent, GNUPG_INVALID_FD, fd_ssh_agent);
-+    }
-   else if (!is_daemon)
-     ; /* NOTREACHED */
-   else
-@@ -1287,26 +1325,8 @@
-           log_set_prefix (NULL, oldflags | JNLIB_LOG_RUN_DETACHED);
-           opt.running_detached = 1;
-         }
--
--      if (chdir("/"))
--        {
--          log_error ("chdir to / failed: %s\n", strerror (errno));
--          exit (1);
--        }
--
--      {
--        struct sigaction sa;
--
--        sa.sa_handler = SIG_IGN;
--        sigemptyset (&sa.sa_mask);
--        sa.sa_flags = 0;
--        sigaction (SIGPIPE, &sa, NULL);
--      }
--#endif /*!HAVE_W32_SYSTEM*/
--
--      log_info ("%s %s started\n", strusage(11), strusage(13) );
--      handle_connections (fd, fd_extra, fd_ssh);
--      assuan_sock_close (fd);
-+#endif /*!HAVE_W32_SYSTEM*/      
-+      handle_agent_socks(fd, fd_extra, fd_ssh);
-     }
- 
-   return 0;
-diff -Naur gnupg-2.1.1-upstream/doc/gpg-agent.texi gnupg-2.1.1/doc/gpg-agent.texi
---- gnupg-2.1.1-upstream/doc/gpg-agent.texi	2014-12-05 09:56:37.000000000 -0430
-+++ gnupg-2.1.1/doc/gpg-agent.texi	2014-12-23 16:26:38.366391186 -0430
-@@ -43,7 +43,15 @@
- .IR file ]
- .RI [ options ]
- .B  \-\-daemon
--.RI [ command_line ]
-+.br
-+.B  gpg-agent
-+.RB [ \-\-homedir
-+.IR dir ]
-+.RB [ \-\-options
-+.IR file ]
-+.RI [ options ]
-+.B  \-\-agent-fd
-+.IR fd
- @end ifset
- 
- @mansect description
-@@ -186,6 +194,11 @@
- a new process as a child of gpg-agent: @code{gpg-agent --daemon
- /bin/sh}.  This way you get a new shell with the environment setup
- properly; if you exit from this shell, gpg-agent terminates as well.
-+
-+@item --agent-fd @var{fd}
-+@opindex  agent-fd
-+Start the gpg-agent using @var{fd} as the listening socket. This is useful for
-+socket activation a la systemd and launchd.
- @end table
- 
- @mansect options
-@@ -545,6 +558,12 @@
- remote machine.
- 
- 
-+@item --ssh-agent-fd @var{fd}
-+@opindex ssh-agent-fd
-+
-+When starting the agent with @option{--agent-fd}, use this to pass in a socket
-+to be used for the OpenSSH agent protocol.
-+
- @anchor{option --enable-ssh-support}
- @item --enable-ssh-support
- @opindex enable-ssh-support

pkgs/tools/security/hashcat/default.nix

@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, p7zip, patchelf }:
+{ stdenv, fetchurl, p7zip, patchelf, gmp }:
 
 assert stdenv.isLinux;
 
 let
   bits    = if stdenv.system == "x86_64-linux" then "64" else "32";
-  libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.libc ];
+  libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.libc gmp ];
 
   fixBin = x: ''
     patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   name    = "hashcat-${version}";
-  version = "0.47";
+  version = "0.49";
 
   src = fetchurl {
     url    = "http://hashcat.net/files/${name}.7z";
-    sha256 = "0mc4lv4qfxabp794xfzgr63fhwk7lvbg12pry8a96lldp0jwp6i3";
+    sha256 = "0va07flncihgmnri5wj0jn636w86x5qwm4jmj2halcyg7qwqijh2";
   };
 
   buildInputs = [ p7zip patchelf ];

pkgs/tools/security/knockknock/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, buildPythonPackage, python, pycrypto, hping }:
+
+buildPythonPackage rec {
+  rev  = "bf14bbff";
+  name = "knockknock-r${rev}";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner  = "moxie0";
+    repo   = "knockknock";
+    sha256 = "1chpfs3w2vkjrgay69pbdr116z1jldv53fi768a1i05fdqhy1px4";
+  };
+
+  propagatedBuildInputs = [ pycrypto ];
+
+  patchPhase = ''
+    substituteInPlace setup.py --replace "/etc" "$out/etc"
+    substituteInPlace knockknock.py --replace 'existsInPath("hping3")' '"${hping}/bin/hping3"'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simple, secure port knocking daemon and client written in Python";
+    homepage    = "http://www.thoughtcrime.org/software/knockknock/";
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = with platforms; linux;
+  };
+}
+

pkgs/tools/security/kpcli/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
-  version = "2.8";
+  version = "3.0";
   name = "kpcli-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/kpcli/${name}.pl";
-    sha256 = "1vmj131ii3skm1dx0pmcvq19h6a94a2vjldmqlf1b3dxjvz1ld91";
+    sha256 = "1704b412f8h9cls85xcpqm9k4n5vga26r4xq9ghp4pr1hl27nywl";
   };
 
   buildInputs = [ makeWrapper perl ];

pkgs/tools/security/ksshaskpass/default.nix

@@ -1,4 +1,6 @@
-{stdenv, fetchurl, kdelibs}:
+{ stdenv, fetchurl, kdelibs
+, automoc4, cmake, perl, pkgconfig
+}:
 
 stdenv.mkDerivation {
   name = "ksshaskpass-0.5.3";
@@ -8,6 +10,8 @@ stdenv.mkDerivation {
     sha256 = "0911i8jr0nzqah8xidb8wba55a2skaidj3klv3cw6bm5fjx7x953";
   };
 
+  nativeBuildInputs = [ automoc4 cmake perl pkgconfig ];
+
   buildInputs = [ kdelibs ];
 
   patchPhase = ''

pkgs/tools/security/logkeys/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "5ef6b0dcb9e3";
 
   src = fetchgit {
-    url = "https://code.google.com/p/logkeys/";
+    url = https://github.com/kernc/logkeys;
     rev = "5ef6b0dcb9e38e6137ad1579d624ec12107c56c3";
     sha256 = "02p0l92l0fq069g31ks6xbqavzxa9njj9460vw2jsa7livcn2z9d";
   };
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A GNU/Linux keylogger that works!";
     license = licenses.gpl3;
-    homepage = http://code.google.com/p/logkeys/;
+    homepage = https://github.com/kernc/logkeys;
     maintainers = with maintainers; [offline];
     platforms = with platforms; linux;
   };

pkgs/tools/security/metasploit/3.1.nix

@@ -1,4 +1,4 @@
-args : with args; 
+args @ { makeWrapper, ... }: with args;
 rec {
   src = fetchurl {
     url = http://www.packetstormsecurity.nl/UNIX/utilities/framework-3.1.tar.gz;
@@ -21,7 +21,7 @@ rec {
 
   /* doConfigure should be specified separately */
   phaseNames = ["doInstall" (doPatchShebangs "$out/share/msf")];
-      
+
   name = "metasploit-framework-3.1";
   meta = {
     description = "Metasploit Framework - a collection of exploits";

pkgs/tools/security/minisign/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, fetchurl, cmake, libsodium }:
+
+stdenv.mkDerivation rec {
+  name = "minisign-${version}";
+  version = "0.4";
+
+  src = fetchurl {
+    url = "https://github.com/jedisct1/minisign/archive/${version}.tar.gz";
+    sha256 = "1k1dk6piaz8pw4b9zg55n4wcpyc301mkxb873njm8mki7r8raxnw";
+  };
+
+  buildInputs = [ cmake libsodium ];
+
+  meta = with stdenv.lib; {
+    description = "A simple tool for signing files and verifying signatures";
+    longDescription = ''
+      minisign uses public key cryptography to help facilitate secure (but not
+      necessarily private) file transfer, e.g., of software artefacts. minisign
+      is similar to and compatible with OpenBSD's signify.
+    '';
+    homepage = https://jedisct1.github.io/minisign/;
+    license = licenses.isc;
+    maintainers = with maintainers; [ joachifm ];
+  };
+}

pkgs/tools/security/modsecurity/default.nix

@@ -0,0 +1,45 @@
+{ stdenv, lib, fetchurl
+, curl, apacheHttpd, pcre, apr, aprutil, libxml2 }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "modsecurity-${version}";
+  version = "2.9.0";
+
+  src = fetchurl {
+    url = "https://www.modsecurity.org/tarball/${version}/${name}.tar.gz";
+    sha256 = "e2bbf789966c1f80094d88d9085a81bde082b2054f8e38e0db571ca49208f434";
+  };
+
+  buildInputs = [ curl apacheHttpd pcre apr aprutil libxml2 ];
+  configureFlags = [
+    "--enable-standalone-module"
+    "--enable-static"
+    "--with-curl=${curl}"
+    "--with-apxs=${apacheHttpd}/bin/apxs"
+    "--with-pcre=${pcre}"
+    "--with-apr=${apr}"
+    "--with-apu=${aprutil}/bin/apu-1-config"
+    "--with-libxml=${libxml2}"
+  ];
+
+  outputs = ["out" "nginx"];
+
+  preBuild = ''
+    substituteInPlace apache2/Makefile.in --replace "install -D " "# install -D"
+  '';
+
+  postInstall = ''
+    mkdir -p $nginx
+    cp -R * $nginx
+  '';
+
+  meta = {
+    description = "Open source, cross-platform web application firewall (WAF)";
+    license = licenses.asl20;
+    homepage = https://www.modsecurity.org/;
+    maintainers = with maintainers; [offline];
+    platforms = with platforms; linux;
+  };
+}

pkgs/tools/security/monkeysphere/default.nix

@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, perl, makeWrapper, perlPackages }:
+
+stdenv.mkDerivation rec {
+  name = "monkeysphere-${version}";
+  version = "0.37";
+
+  src = fetchurl {
+    url = "http://archive.monkeysphere.info/debian/pool/monkeysphere/m/monkeysphere/monkeysphere_0.37.orig.tar.gz";
+    sha256 = "0nbfd220miflah5l2y20qlmgfpbqi0j8h7qgx1b06h7v2jjbh45m";
+  };
+
+  buildInputs = [ makeWrapper perl ];
+
+  patches = [ ./monkeysphere.patch ];
+
+  makeFlags = ''
+    PREFIX=/
+    DESTDIR=$(out)
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/openpgp2ssh --prefix PERL5LIB : \
+      "${with perlPackages; stdenv.lib.makePerlPath [
+        CryptOpenSSLRSA
+        CryptOpenSSLBignum
+      ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://web.monkeysphere.info/;
+    description = "Leverage the OpenPGP web of trust for SSH and TLS authentication";
+    longDescription = ''
+      The Monkeysphere project's goal is to extend OpenPGP's web of
+      trust to new areas of the Internet to help us securely identify
+      servers we connect to, as well as each other while we work online.
+      The suite of Monkeysphere utilities provides a framework to
+      transparently leverage the web of trust for authentication of
+      TLS/SSL communications through the normal use of tools you are
+      familiar with, such as your web browser0 or secure shell.
+    '';
+    license = licenses.gpl3;
+    platforms = platforms.all;
+  };
+}

pkgs/tools/security/monkeysphere/monkeysphere.patch

@@ -0,0 +1,92 @@
+diff -rupN monkeysphere-0.37/Makefile monkeysphere-0.37-patched/Makefile
+--- monkeysphere-0.37/Makefile	2014-08-06 19:27:38.000000000 +0200
++++ monkeysphere-0.37-patched/Makefile	2015-07-31 19:51:57.539373097 +0200
+@@ -42,11 +42,11 @@ install: all installman
+ 	mkdir -p $(DESTDIR)$(PREFIX)/share/doc/monkeysphere
+ 	printf "Monkeysphere %s\n" $(MONKEYSPHERE_VERSION) > $(DESTDIR)$(PREFIX)/share/monkeysphere/VERSION
+ 	install src/monkeysphere $(DESTDIR)$(PREFIX)/bin
+-	sed -i 's:__SYSSHAREDIR_PREFIX__:$(PREFIX):' $(DESTDIR)$(PREFIX)/bin/monkeysphere
++	sed -i 's:__SYSSHAREDIR_PREFIX__:$(DESTDIR):' $(DESTDIR)$(PREFIX)/bin/monkeysphere
+ 	install src/monkeysphere-host $(DESTDIR)$(PREFIX)/sbin
+-	sed -i 's:__SYSSHAREDIR_PREFIX__:$(PREFIX):' $(DESTDIR)$(PREFIX)/sbin/monkeysphere-host
++	sed -i 's:__SYSSHAREDIR_PREFIX__:$(DESTDIR):' $(DESTDIR)$(PREFIX)/sbin/monkeysphere-host
+ 	install src/monkeysphere-authentication $(DESTDIR)$(PREFIX)/sbin
+-	sed -i 's:__SYSSHAREDIR_PREFIX__:$(PREFIX):' $(DESTDIR)$(PREFIX)/sbin/monkeysphere-authentication
++	sed -i 's:__SYSSHAREDIR_PREFIX__:$(DESTDIR):' $(DESTDIR)$(PREFIX)/sbin/monkeysphere-authentication
+ 	install src/monkeysphere-authentication-keys-for-user $(DESTDIR)$(PREFIX)/share/monkeysphere
+ 	install -m 0755 src/share/common $(DESTDIR)$(PREFIX)/share/monkeysphere
+ 	install -m 0644 src/share/defaultenv $(DESTDIR)$(PREFIX)/share/monkeysphere
+@@ -59,8 +59,8 @@ install: all installman
+ 	ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/openpgp2pem
+ 	ln -sf ../share/monkeysphere/keytrans $(DESTDIR)$(PREFIX)/bin/openpgp2spki
+ 	install -m 0744 src/transitions/* $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions
+-	sed -i 's:__SYSSHAREDIR_PREFIX__:$(PREFIX):' $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions/0.23
+-	sed -i 's:__SYSSHAREDIR_PREFIX__:$(PREFIX):' $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions/0.28
++	sed -i 's:__SYSSHAREDIR_PREFIX__:$(DESTDIR):' $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions/0.23
++	sed -i 's:__SYSSHAREDIR_PREFIX__:$(DESTDIR):' $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions/0.28
+ 	install -m 0644 src/transitions/README.txt $(DESTDIR)$(PREFIX)/share/monkeysphere/transitions
+ 	install -m 0644 src/share/m/* $(DESTDIR)$(PREFIX)/share/monkeysphere/m
+ 	install -m 0644 src/share/mh/* $(DESTDIR)$(PREFIX)/share/monkeysphere/mh
+diff -rupN monkeysphere-0.37/src/share/checkperms monkeysphere-0.37-patched/src/share/checkperms
+--- monkeysphere-0.37/src/share/checkperms	2014-08-06 19:27:38.000000000 +0200
++++ monkeysphere-0.37-patched/src/share/checkperms	2015-07-31 19:52:18.170675985 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl -T
++#!/usr/bin/perl
+ 
+ # checkperms: ensure as best we can that a given file can only be
+ # modified by the given user (or the superuser, naturally).  This
+diff -rupN monkeysphere-0.37/src/share/keytrans monkeysphere-0.37-patched/src/share/keytrans
+--- monkeysphere-0.37/src/share/keytrans	2014-08-06 19:27:38.000000000 +0200
++++ monkeysphere-0.37-patched/src/share/keytrans	2015-07-31 20:13:36.664514290 +0200
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl -T
++#!/usr/bin/perl
+ 
+ # keytrans: this is an RSA key translation utility; it is capable of
+ # transforming RSA keys (both public keys and secret keys) between
+@@ -1069,7 +1069,7 @@ sub packetwalk {
+ 
+ 
+ for (basename($0)) {
+-  if (/^pem2openpgp$/) {
++  if (/pem2openpgp/) {
+     my $rsa;
+     my $stdin;
+ 
+@@ -1107,7 +1107,7 @@ for (basename($0)) {
+ 		      }
+ 		     );
+   }
+-  elsif (/^openpgp2ssh$/) {
++  elsif (/openpgp2ssh/) {
+       my $fpr = shift;
+       my $instream;
+       open($instream,'-');
+@@ -1123,7 +1123,7 @@ for (basename($0)) {
+ 	die "No matching key found.\n";
+       }
+   }
+-  elsif (/^openpgp2pem$/) {
++  elsif (/openpgp2pem/) {
+       my $fpr = shift;
+       my $instream;
+       open($instream,'-');
+@@ -1139,7 +1139,7 @@ for (basename($0)) {
+ 	die "No matching key found.\n";
+       }
+   }
+-  elsif (/^openpgp2spki$/) {
++  elsif (/openpgp2spki/) {
+       my $fpr = shift;
+       my $instream;
+       open($instream,'-');
+@@ -1151,7 +1151,7 @@ for (basename($0)) {
+ 	die "No matching key found.\n";
+       }
+   }
+-  elsif (/^keytrans$/) {
++  elsif (/keytrans/) {
+     # subcommands when keytrans is invoked directly are UNSUPPORTED,
+     # UNDOCUMENTED, and WILL NOT BE MAINTAINED.
+     my $subcommand = shift;

pkgs/tools/security/mpw/default.nix

@@ -0,0 +1,42 @@
+{ stdenv, fetchurl, autoconf, automake, openssl, libxml2 }:
+
+let
+  scrypt_src = fetchurl {
+    url = "http://masterpasswordapp.com/libscrypt-b12b554.tar.gz";
+    sha256 = "02vz4i66v1acd15xjgki4ilmmp28m6a5603gi4hf8id3d3ndl9n7";
+  };
+
+in stdenv.mkDerivation {
+  name = "mpw-2.1-cli4";
+
+  srcs = [
+    (fetchurl {
+      url = "https://ssl.masterpasswordapp.com/mpw-2.1-cli4-0-gf6b2287.tar.gz";
+      sha256 = "141bzb3nj18rbnbpdvsri8cdwwwxz4d6akyhfa834542xf96b9vf";
+    })
+    scrypt_src
+  ];
+
+  sourceRoot = ".";
+
+  postUnpack = ''
+    cp -R libscrypt-b12b554/* lib/scrypt
+  '';
+
+  prePatch = ''
+    patchShebangs .
+  '';
+
+  NIX_CFLAGS_COMPILE = "-I${libxml2}/include/libxml2";
+
+  buildInputs = [ autoconf automake openssl libxml2 ];
+
+  buildPhase = ''
+    targets="mpw mpw-tests" ./build
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv mpw $out/bin/mpw
+  '';
+}

pkgs/tools/security/muscleframework/default.nix

@@ -20,11 +20,11 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmusclecard pkgconfig pcsclite];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "MUSCLE smart card framework - mcard plugin";
     homepage = http://muscleplugins.alioth.debian.org/;
-    license = "BSD";
-    maintainers = with stdenv.lib.maintainers; [viric];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [viric];
     # XXX: don't build before libmusclecard is fixed
     # platforms = with stdenv.lib.platforms; linux;
   };

pkgs/tools/security/muscletool/default.nix

@@ -9,11 +9,11 @@ stdenv.mkDerivation {
 
   buildInputs = [ libmusclecard pcsclite pkgconfig ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Smart card applications for use with MUSCLE plugins";
     homepage = http://muscleapps.alioth.debian.org/;
-    license = "BSD"; # http://anonscm.debian.org/viewvc/muscleapps/trunk/muscleTool/COPYING?view=markup
-    maintainers = with stdenv.lib.maintainers; [viric];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [viric];
     # XXX: don't build before libmusclecard is fixed
     # platforms = with stdenv.lib.platforms; linux;
   };

pkgs/tools/security/nmap/default.nix

@@ -13,11 +13,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
-  version = "6.47";
+  version = "6.49BETA4";
 
   src = fetchurl {
     url = "http://nmap.org/dist/nmap-${version}.tar.bz2";
-    sha256 = "14d53aji4was68c01pf105n5ylha257wmdbx40ddiqiw42g1x8cg";
+    sha256 = "042fg73w7596b3h6ha9y62ckc0hd352zv1shwip3dx14v5igrsna";
   };
 
   patches = ./zenmap.patch;

pkgs/tools/security/nsjail/default.nix

@@ -0,0 +1,30 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation rec {
+  name = "nsjail-git-2015-08-10";
+
+  src = fetchgit {
+    url = https://github.com/google/nsjail;
+    rev = "8b951e6c2827386786cde4a124cd1846d25b9404";
+    sha256 = "b3b863423cc676111d2d1afbac524eee6fa824588cafccb7c42ff470508a13b1";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp nsjail $out/bin
+  '';
+
+  meta = {
+    description = ''
+      A light-weight process isolation tool, making use of Linux namespaces
+      and seccomp-bpf syscall filters
+      '';
+    homepage = http://google.github.io/nsjail;
+
+    license = stdenv.lib.licenses.apsl20;
+
+    maintainers = [ stdenv.lib.maintainers.bosu ];
+
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/tools/security/oath-toolkit/default.nix

@@ -1,5 +1,10 @@
-{ stdenv, fetchurl, pam }:
+{ stdenv, fetchurl, pam, xmlsec }:
 
+let
+  securityDependency =
+    if stdenv.isDarwin then xmlsec
+    else pam;
+in
 stdenv.mkDerivation rec {
   name = "oath-toolkit-2.4.1";
 
@@ -8,11 +13,12 @@ stdenv.mkDerivation rec {
     sha256 = "094vbq66sn5f2dsy14hajpsfdnaivjxf70xzs91nrsq0q75l5ylv";
   };
 
-  buildInputs = [ pam ];
+  
+  buildInputs = [ securityDependency ];
 
   meta = {
     homepage = http://www.nongnu.org/oath-toolkit/;
     description = "Components for building one-time password authentication systems";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
   };
 }

pkgs/tools/security/omapd/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, cmake, qt4, gdb, zlib }:
+stdenv.mkDerivation rec {
+
+  name = "omapd-${version}";
+  version = "0.9.2";
+
+  src = fetchurl {
+    url = "http://omapd.googlecode.com/files/${name}.tgz";
+    sha256 = "0d7lgv957jhbsav60j50jhdy3rpcqgql74qsniwnnpm3yqj9p0xc";
+  };
+
+  patches = [ ./zlib.patch ];
+
+  buildInputs = [ cmake qt4 zlib gdb ];
+
+  phases = [ "unpackPhase" "patchPhase" "buildPhase" "installPhase" ];
+
+  buildPhase = ''
+    (cd plugins/RAMHashTables; qmake; make)
+    qmake
+    make
+    '';
+
+  installPhase = ''
+    mkdir -p $out $out/bin $out/etc $out/usr/lib/omapd/plugins
+    cp omapd $out/bin/.
+    cp omapd.conf $out/etc/.
+    cp plugins/libRAMHashTables.so $out/usr/lib/omapd/plugins/.
+    ln -s $out/usr/lib/omapd/plugins $out/bin/plugins
+    '';
+
+  meta = with stdenv.lib; {
+    homepage = http://code.google.com/p/omapd;
+    description = "IF-MAP Server that implements the IF-MAP v1.1 and v2.0 specifications published by the Trusted Computing Group (TCG)";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.tstrobel ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/security/omapd/zlib.patch

@@ -0,0 +1,9 @@
+diff -uNr omapd-0.9.2-old/omapd.pro omapd-0.9.2/omapd.pro
+--- omapd-0.9.2-old/omapd.pro	2015-08-03 09:46:47.463420480 +0200
++++ omapd-0.9.2/omapd.pro	2015-08-03 09:48:32.238657105 +0200
+@@ -37,4 +37,4 @@
+     clientconfiguration.h \
+     managementserver.h \
+     json.h
+-INCLUDEPATH += $$[QT_INSTALL_PREFIX]/src/3rdparty/zlib
++LIBS += -lz

pkgs/tools/security/opensc/default.nix

@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, zlib, readline, openssl
-, libiconv, pcsclite, libassuan1, libXt
+, libiconv, pcsclite, libassuan, libXt
 , docbook_xsl, libxslt, docbook_xml_dtd_412
 }:
 
 stdenv.mkDerivation rec {
   name = "opensc-${version}";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "OpenSC";
     repo = "OpenSC";
     rev = version;
-    sha256 = "02q3rndcfd7lga1ph0xcl556rgigzpp9bpwqyn42rfbx8lll7gzv";
+    sha256 = "16y3ryx606nry2li05hm88bllrragdj3sfl3yh7pf71777n4lsk4";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    autoreconfHook pkgconfig zlib readline openssl pcsclite libassuan1
+    autoreconfHook pkgconfig zlib readline openssl pcsclite libassuan
     libXt libxslt libiconv docbook_xml_dtd_412
   ];
 
@@ -37,6 +37,10 @@ stdenv.mkDerivation rec {
     "--with-pcsc-provider=${pcsclite}/lib/libpcsclite.so"
   ];
 
+  installFlags = [
+    "sysconfdir=\${out}/etc"
+  ];
+
   meta = with stdenv.lib; {
     description = "Set of libraries and utilities to access smart cards";
     homepage = https://github.com/OpenSC/OpenSC/wiki;

pkgs/tools/security/pass/default.nix

@@ -3,7 +3,7 @@
 , makeWrapper
 
 , xclip ? null, xdotool ? null, dmenu ? null
-, x11Support ? true
+, x11Support ? !stdenv.isDarwin
 }:
 
 assert x11Support -> xclip != null
@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
     getopt
     git
     gnupg
+    pwgen
     tree
     which
   ] ++ ifEnable x11Support [ dmenu xclip xdotool ]);

pkgs/tools/security/pcsclite/default.nix

@@ -1,23 +1,22 @@
 { stdenv, fetchurl, pkgconfig, udev, dbus_libs, perl }:
 
 stdenv.mkDerivation rec {
-  name = "pcsclite-1.8.13";
+  name = "pcsclite-1.8.14";
 
   src = fetchurl {
-    url = "https://alioth.debian.org/frs/download.php/file/4126/pcsc-lite-1.8.13.tar.bz2";
-    sha256 = "0fxwzckbjsckfp1f01yp3x6y1wlaaivhy12a5hka6qwdh1z085gk";
+    url = "https://alioth.debian.org/frs/download.php/file/4138/pcsc-lite-1.8.14.tar.bz2";
+    sha256 = "0kik09dif6hih09vvprd7zvj31lnrclrbrh5y10mlca2c209f7xr";
   };
 
-  # The OS should care on preparing the drivers into this location
   configureFlags = [
+    # The OS should care on preparing the drivers into this location
     "--enable-usbdropdir=/var/lib/pcsc/drivers"
-    "--with-systemdsystemunitdir=$out/etc/systemd/system"
-    "--enable-confdir=$out/etc"
+    "--with-systemdsystemunitdir=\${out}/etc/systemd/system"
+    "--enable-confdir=/etc"
   ];
 
-  buildInputs = [ udev dbus_libs perl ];
-
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig perl ];
+  buildInputs = [ udev dbus_libs ];
 
   meta = with stdenv.lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";

pkgs/tools/security/pinentry/default.nix

@@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig
-, libcap ? null, ncurses ? null, gtk2 ? null, qt4 ? null
+, libgpgerror, libassuan, libcap ? null, ncurses ? null, gtk2 ? null, qt4 ? null
 }:
 
 let
@@ -10,14 +10,24 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "pinentry-0.9.1";
+  name = "pinentry-0.9.5";
 
   src = fetchurl {
     url = "mirror://gnupg/pinentry/${name}.tar.bz2";
-    sha256 = "15cn7q6wg3k433l9ks48pz4dbikp7ysp0h8jqynz6p9rdf2qxl4w";
+    sha256 = "1338hj1h3sh34897120y30x12b64wyj3xjzzk5asm2hdzhxgsmva";
   };
 
-  buildInputs = [ libcap gtk2 ncurses qt4 ];
+  buildInputs = [ libgpgerror libassuan libcap gtk2 ncurses qt4 ];
+
+  prePatch = ''
+    substituteInPlace pinentry/pinentry-curses.c --replace ncursesw ncurses
+  '';
+
+  # configure cannot find moc on its own
+  preConfigure = stdenv.lib.optionalString (qt4 != null) ''
+    export QTDIR="${qt4}"
+    export MOC="${qt4}/bin/moc"
+  '';
 
   configureFlags = [
     (mkWith   (libcap != null)  "libcap")
@@ -36,8 +46,9 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.all;
     longDescription = ''
-      Pinentry provides a console and a GTK+ GUI that allows users to
-      enter a passphrase when `gpg' or `gpg2' is run and needs it.
+      Pinentry provides a console and (optional) GTK+ and Qt GUIs allowing users
+      to enter a passphrase when `gpg' or `gpg2' is run and needs it.
     '';
+    maintainers = [ stdenv.lib.maintainers.ttuegel ];
   };
 }

pkgs/tools/security/polkit-kde-agent/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, kdelibs, polkit_qt4, gettext }:
+{ stdenv, fetchurl, automoc4, cmake, gettext, perl, pkgconfig
+, kdelibs, polkit_qt4 }:
 
 stdenv.mkDerivation rec {
   name = "polkit-kde-agent-1-0.99.0";
@@ -10,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kdelibs polkit_qt4 ];
 
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [ automoc4 cmake gettext perl pkgconfig ];
 
   patchPhase = "sed -e s/KDE4_AUTOSTART/AUTOSTART/ -i CMakeLists.txt";
 

pkgs/tools/security/prey/default.nix

@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
     cp -R ${modulesSrc}/* $out/modules/
     wrapProgram "$out/prey.sh" \
       --prefix PATH ":" "${xawtv}/bin:${imagemagick}/bin:${curl}/bin:${scrot}/bin:${inetutils}/bin:${coreutils}/bin" \
-      --set CURL_CA_BUNDLE "/etc/ssl/certs/ca-bundle.crt"
+      --set CURL_CA_BUNDLE "/etc/ssl/certs/ca-certificates.crt"
   '';
 
   meta = with stdenv.lib; {

pkgs/tools/security/rhash/default.nix

@@ -1,7 +1,8 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "rhash-1.3.3";
+  version = "1.3.3";
+  name = "rhash-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/rhash/${name}-src.tar.gz";
@@ -10,9 +11,24 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=$(out)" "PREFIX=/" ];
 
+  # we build the static library because of two makefile bugs
+  # * .h files installed for static library target only
+  # * .so.0 -> .so link only created in the static library install target
+  buildPhase = ''
+    make lib-shared lib-static build-shared
+  '';
+
+  # we don't actually want the static library, so we remove it after it
+  # gets installed
+  installPhase = ''
+    make DESTDIR="$out" PREFIX="/" install-shared install-lib-shared install-lib-static
+    rm $out/lib/librhash.a
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://rhash.anz.ru;
-    description = "Console utility for computing and verifying hash sums of files";
+    description = "Console utility and library for computing and verifying hash sums of files";
     platforms = platforms.linux;
+    maintainers = [ maintainers.andrewrk ];
   };
 }

pkgs/tools/security/rng-tools/default.nix

@@ -17,7 +17,5 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
 
     platforms = stdenv.lib.platforms.linux;
-
-    maintainers = [ stdenv.lib.maintainers.shlevy ];
   };
 }

pkgs/tools/security/sbsigntool/autoconf.patch

@@ -0,0 +1,19 @@
+diff -uNr sbsigntool/configure.ac sbsigntool-new/configure.ac
+--- sbsigntool/configure.ac	2015-07-05 12:18:18.932717136 +0200
++++ sbsigntool-new/configure.ac	2015-07-05 14:51:39.659284938 +0200
+@@ -65,7 +65,7 @@
+ 
+ dnl gnu-efi headers require extra include dirs
+ EFI_ARCH=$(uname -m)
+-EFI_CPPFLAGS="-I/usr/include/efi -I/usr/include/efi/$EFI_ARCH \
++EFI_CPPFLAGS="-I@@NIX_GNUEFI@@/include/efi -I@@NIX_GNUEFI@@/include/efi/$EFI_ARCH \
+  -DEFI_FUNCTION_WRAPPER"
+ CPPFLAGS_save="$CPPFLAGS"
+ CPPFLAGS="$CPPFLAGS $EFI_CPPFLAGS"
+@@ -74,5 +74,5 @@
+ AC_SUBST(EFI_CPPFLAGS, $EFI_CPPFLAGS)
+ 
+ AC_CONFIG_FILES([Makefile src/Makefile lib/ccan/Makefile]
+-		[docs/Makefile tests/Makefile])
++		[docs/Makefile])
+ AC_OUTPUT

pkgs/tools/security/sbsigntool/default.nix

@@ -0,0 +1,49 @@
+{ stdenv, fetchgit, autoconf, automake, utillinux, openssl, libuuid, gnu-efi
+, binutils, pkgconfig, help2man }:
+
+stdenv.mkDerivation rec {
+  name = "sbsigntool-${version}";
+  version = "0.5";
+
+  src = fetchgit {
+    url = "git://kernel.ubuntu.com/jk/sbsigntool";
+    rev = "951ee95a301674c046f55330cd7460e1314deff2";
+    sha256 = "09k8by0qq8j7ff812l1l9z9frsx5c4cmhj5in3g1sgyz3v55nfy7";
+  };
+
+  patches = [ ./autoconf.patch ];
+
+  prePatch = "patchShebangs .";
+
+  buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils pkgconfig help2man ];
+
+  configurePhase = ''
+    substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
+
+    lib/ccan.git/tools/create-ccan-tree --build-type=automake lib/ccan "talloc read_write_all build_assert array_size"
+    touch AUTHORS
+    touch ChangeLog
+
+    echo "SUBDIRS = lib/ccan src docs" >> Makefile.am
+
+    aclocal
+    autoheader
+    autoconf
+    automake --add-missing -Wno-portability
+
+    ./configure --prefix=$out
+    '';
+
+  installPhase = ''
+    mkdir -p $out
+    make install
+    '';
+
+  meta = with stdenv.lib; {
+    description = "Tools for maintaining UEFI signature databases";
+    homepage    = http://jk.ozlabs.org/docs/sbkeysync-maintaing-uefi-key-databases;
+    maintainers = [ maintainers.tstrobel ];
+    platforms   = [ "x86_64-linux" ]; # Broken on i686
+  };
+}
+

pkgs/tools/security/scrypt/default.nix

@@ -2,15 +2,24 @@
 
 stdenv.mkDerivation rec {
   name = "scrypt-${version}";
-  version = "1.1.6";
+  version = "1.2.0";
 
   src = fetchurl {
-    url = "https://www.tarsnap.com/scrypt/scrypt-1.1.6.tgz";
-    sha256 = "dfd0d1a544439265bbb9b58043ad3c8ce50a3987b44a61b1d39fd7a3ed5b7fb8";
+    url = "https://www.tarsnap.com/scrypt/${name}.tgz";
+    sha256 = "1m39hpfby0fdjam842773i5w7pa0qaj7f0r22jnchxsj824vqm0p";
   };
 
   buildInputs = [ openssl ];
 
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace "command -p mv" "mv"
+    substituteInPlace Makefile.in \
+      --replace "command -p mv" "mv"
+    substituteInPlace autocrap/Makefile.am \
+      --replace "command -p mv" "mv"
+  '';
+
   meta = {
     description = "Encryption utility";
     homepage    = https://www.tarsnap.com/scrypt.html;

pkgs/tools/security/signing-party/default.nix

@@ -0,0 +1,37 @@
+{stdenv, fetchurl, gnupg, perl, automake111x, autoconf}:
+
+stdenv.mkDerivation rec {
+  version = "2.0";
+  basename = "signing-party";
+  name = "${basename}-${version}";
+  src = fetchurl {
+    url = "mirror://debian/pool/main/s/${basename}/${basename}_${version}.orig.tar.gz";
+    sha256 = "0vn15sb2yyzd57xdblw48p5hi6fnpvgy83mqyz5ygph65y5y88yc";
+  };
+
+  sourceRoot = ".";
+
+  preBuild = ''
+    substituteInPlace sig2dot/Makefile --replace "\$(DESTDIR)/usr" "$out"
+    substituteInPlace gpgsigs/Makefile --replace "\$(DESTDIR)/usr" "$out"
+    substituteInPlace keylookup/Makefile --replace "\$(DESTDIR)/usr" "$out"
+    substituteInPlace springgraph/Makefile --replace "\$(DESTDIR)/usr" "$out"
+    substituteInPlace keyanalyze/Makefile --replace "\$(DESTDIR)/usr" "$out"
+  '';
+
+  # - perl is required for its pod2man (used in caff)
+  buildInputs = [ automake111x autoconf perl gnupg ];
+
+  patches = [ ./gpgwrap_makefile.patch ];
+
+  installFlags = [ "DESTDIR=\${out}" ];
+
+  doCheck = false; # no check rule
+
+  meta = {
+    description = "A collection for all kinds of pgp related things, including signing scripts, party preparation scripts etc";
+    homepage = http://pgp-tools.alioth.debian.org;
+    platforms = gnupg.meta.platforms;
+    license = stdenv.lib.licenses.gpl2;
+  };
+}

pkgs/tools/security/signing-party/gpgwrap_makefile.patch

@@ -0,0 +1,16 @@
+--- a/gpgwrap/Makefile	2015-06-03 16:24:48.723129144 +0200
++++ b/gpgwrap/Makefile	2015-06-03 16:24:11.639744346 +0200
+@@ -1,9 +1,12 @@
+ MAKE=make
+ 
+-.PHONY: all clean
++.PHONY: all clean install
+ 
+ all:
+ 	cd src && ${MAKE} all DIET="${DIET}"
+ 
++install:
++
++
+ clean:
+ 	cd src && ${MAKE} clean

pkgs/tools/security/ssdeep/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "ssdeep-${version}";
-  version = "2.12";
+  version = "2.13";
 
   src = fetchurl {
     url    = "mirror://sourceforge/ssdeep/${name}.tar.gz";
-    sha256 = "1pjb3qpcn6slfqjv23jf7i8zf7950b7h27b0v0dva5pxmn3rw149";
+    sha256 = "1igqy0j7jrklb8fdlrm6ald4cyl1fda5ipfl8crzyl6bax2ajk3f";
   };
 
   # For some reason (probably a build system bug), the binary isn't

pkgs/tools/security/sshuttle/default.nix

@@ -1,34 +1,66 @@
-{ stdenv, fetchurl, iptables, python, pythonPackages }:
+{ stdenv, fetchFromGitHub, fetchpatch, makeWrapper, pandoc
+, coreutils, iptables, nettools, openssh, procps,  pythonPackages }:
   
+let version = "0.71"; in
 stdenv.mkDerivation rec {
   name = "sshuttle-${version}";
-  version = "0.61";
 
-  src = fetchurl {
-    url = "https://github.com/apenwarr/sshuttle/archive/sshuttle-0.61.tar.gz";
-    sha256 = "1v2v1kbwnmx6ygzhbgqcmyafx914s2p7vjp7l0pf52sa7qkliy9b";
+  src = fetchFromGitHub {
+    sha256 = "0yr8nih97jg6azfj3k7064lfbh3g36l6vwyjlngl4ph6mgcki1cm";
+    rev = name;
+    repo = "sshuttle";
+    owner = "sshuttle";
   };
 
-  preBuild = ''
-   substituteInPlace Documentation/all.do --replace "/bin/ls" "$(type -tP ls)";
-   substituteInPlace Documentation/md2man.py --replace "/usr/bin/env python" "${python}/bin/python"
+  patches = [
+    (fetchpatch {
+      sha256 = "1yrjyvdz6k6zk020dmbagf8w49w8vhfbzgfpsq9jqdh2hbykv3m3";
+      url = https://github.com/sshuttle/sshuttle/commit/3cf5002b62650c26a50e18af8d8c5c91d754bab9.patch;
+    })
+    (fetchpatch {
+      sha256 = "091gg28cnmx200q46bcnxpp9ih9p5qlq0r3bxfm0f4qalg8rmp2g";
+      url = https://github.com/sshuttle/sshuttle/commit/d70b5f2b89e593506834cf8ea10785d96c801dfc.patch;
+    })
+    (fetchpatch {
+      sha256 = "17l9h8clqlbyxdkssavxqpb902j7b3yabrrdalybfpkhj69x8ghk";
+      url = https://github.com/sshuttle/sshuttle/commit/a38963301e9c29fbe3232f0a41ea080b642c5ad2.patch;
+    })
+  ];
+
+  nativeBuildInputs = [ makeWrapper pandoc ];
+  buildInputs =
+    [ coreutils iptables nettools openssh procps pythonPackages.python ];
+  pythonPaths = with pythonPackages; [ PyXAPI ];
+
+  preConfigure = ''
+    cd src
   '';
 
-  phases = "unpackPhase installPhase";
+  installPhase = let
+    mapPath = f: x: stdenv.lib.concatStringsSep ":" (map f x);
+  in ''
+    mkdir -p $out/share/sshuttle
+    cp -R sshuttle *.py compat $out/share/sshuttle
 
-  installPhase = ''
     mkdir -p $out/bin
-    cp -R . $out
-    ln -s $out/sshuttle $out/bin/sshuttle
+    ln -s $out/share/sshuttle/sshuttle $out/bin
+    wrapProgram $out/bin/sshuttle \
+      --prefix PATH : "${mapPath (x: "${x}/bin") buildInputs}" \
+      --prefix PYTHONPATH : "${mapPath (x: "$(toPythonPath ${x})") pythonPaths}"
+
+    install -Dm644 sshuttle.8 $out/share/man/man8/sshuttle.8
   '';
   
-
-  buildInputs = [ iptables python pythonPackages.markdown pythonPackages.beautifulsoup ];
-
   meta = with stdenv.lib; {
-    homepage = https://github.com/apenwarr/sshuttle;
+    inherit version;
+    inherit (src.meta) homepage;
     description = "Transparent proxy server that works as a poor man's VPN";
-    maintainers = with maintainers; [ iElectric ];
+    longDescription = ''
+      Forward connections over SSH, without requiring administrator access to the
+      target network (though it does require Python 2 at both ends).
+      Works with Linux and Mac OS and supports DNS tunneling.
+    '';
+    maintainers = with maintainers; [ iElectric nckx ];
     platforms = platforms.unix;
   };
 }

pkgs/tools/security/stoken/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
+, libxml2, nettle
+, withGTK3 ? true, gtk3 }:
+
+stdenv.mkDerivation rec {
+  pname = "stoken";
+  version = "v0.90";
+  name = "${pname}-${version}";
+  src = fetchFromGitHub {
+    owner = "cernekee";
+    repo = pname;
+    rev = version;
+    sha256 = "1k7wn8pmp7dv646g938dsr99090lsphl7zy4m9x7qbh2zlnnf9af";
+  };
+
+  preConfigure = ''
+    aclocal
+    libtoolize --automake --copy
+    autoheader
+    automake --add-missing --copy
+    autoconf
+  '';
+  buildInputs = [
+    autoconf automake libtool pkgconfig
+    libxml2 nettle
+  ] ++ stdenv.lib.optional withGTK3 gtk3;
+
+  meta = with stdenv.lib; {
+    description = "Software Token for Linux/UNIX";
+    homepage = https://github.com/cernekee/stoken;
+    license = licenses.lgpl21Plus;
+    maintainers = [ maintainers.fuuzetsu ];
+    platforms = platforms.all;
+  };
+}

pkgs/tools/security/sudo/default.nix

@@ -1,16 +1,17 @@
 { stdenv, fetchurl, coreutils, pam, groff
 , sendmailPath ? "/var/setuid-wrappers/sendmail"
+, withInsults ? false
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.13";
+  name = "sudo-1.8.14p3";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "09asw1hpxc39a6hhydr8n33m2pni1b5m37vaj7b00761ybnyax73";
+    sha256 = "0dqj1bq2jr4jxqfrd5yg0i42a6268scd0l28jic9118kn75rg9m8";
   };
 
   configureFlags = [
@@ -20,6 +21,9 @@ stdenv.mkDerivation rec {
     "--with-vardir=/var/db/sudo"
     "--with-logpath=/var/log/sudo.log"
     "--with-sendmail=${sendmailPath}"
+  ] ++ stdenv.lib.optional withInsults [
+    "--with-insults"
+    "--with-all-insults"
   ];
 
   configureFlagsArray = [

pkgs/tools/security/tor/default.nix

@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, libevent, openssl, zlib, torsocks }:
+{ stdenv, fetchurl, libevent, openssl, zlib, torsocks, libseccomp }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.2.5.12";
+  name = "tor-0.2.6.10";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/${name}.tar.gz";
-    sha256 = "0j9byw3i2b7ji88vsqwmsxxg2nlxwkk45k5qbc1y7hdlzvzxl3sm";
+    sha256 = "0542c0efe43b86619337862fa7eb02c7a74cb23a79d587090628a5f0f1224b8d";
   };
 
   # Note: torsocks is specified as a dependency, as the distributed
   # 'torify' wrapper attempts to use it; although there is no
   # ./configure time check for any of this.
-  buildInputs = [ libevent openssl zlib torsocks ];
+  buildInputs = [ libevent openssl zlib torsocks libseccomp ];
 
-  CFLAGS = stdenv.lib.optionalString (stdenv.cc.cc.isGNU or false) "-lgcc_s";
+  NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
   # Patch 'torify' to point directly to torsocks.
   patchPhase = ''

pkgs/tools/security/tor/torbrowser.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, buildEnv
-, xlibs, alsaLib, dbus, dbus_glib, glib, gtk, atk, pango, freetype, fontconfig
+, xorg, alsaLib, dbus, dbus_glib, glib, gtk, atk, pango, freetype, fontconfig
 , gdk_pixbuf, cairo, zlib}:
 let
   bits = if stdenv.system == "x86_64-linux" then "64"
@@ -10,8 +10,8 @@ let
     name = "tor-env";
     paths = [
       stdenv.cc.cc zlib glib alsaLib dbus dbus_glib gtk atk pango freetype
-      fontconfig gdk_pixbuf cairo xlibs.libXrender xlibs.libX11 xlibs.libXext
-      xlibs.libXt
+      fontconfig gdk_pixbuf cairo xorg.libXrender xorg.libX11 xorg.libXext
+      xorg.libXt
     ];
   };
 
@@ -20,13 +20,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tor-browser-${version}";
-  version = "4.5";
+  version = "4.5.3";
 
   src = fetchurl {
     url = "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux${bits}-${version}_en-US.tar.xz";
     sha256 = if bits == "64" then
-      "15scfjzpbih7pzpqh4jd7jmc9g93sx2myfs6ykr70f5hbc7qhwmg" else
-      "0lrvhka3z9bh0snplsnxshs8i9iww187ipfn7f96hp5rxgl30p49";
+      "24c517d2aeb15ba5eeda1eb87f483ed4fb0c22b07a95ca26af9f692e0d4d9b7c" else
+      "154d659583048e91870c40921561f0519babf6d3c9ac439f6fb74ed66824463f";
   };
 
   patchPhase = ''

pkgs/tools/security/tor/torsocks.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "torsocks-${version}";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchgit {
     url    = meta.repositories.git;
     rev    = "refs/tags/v${version}";
-    sha256 = "e3868ae8baadce1854cc9e604a5fcfa0433a15e4eb1223cc9da5b3c586db0048";
+    sha256 = "1q7rbf0j54jh17qs76b6k9hzv4sh4044qfzidjrp6gx576ysrvsf";
   };
 
   buildInputs = [ autoreconfHook ];

pkgs/tools/security/tpm-luks/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchgit, autoreconfHook, gawk, trousers, cryptsetup, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "tpm-luks-${version}";
+  version = "git-2015-07-11";
+
+  src = fetchgit {
+    url = "https://github.com/momiji/tpm-luks";
+    rev = "c9c5b7fdddbcdac1cd4d2ea6baddd0617cc88ffa";
+    sha256 = "fdd451caddb4e51ede3f2406245e1ace57389596e85aa402c9f2606303707539";
+  };
+
+  buildInputs = [ autoreconfHook gawk trousers cryptsetup openssl ];
+
+  installPhase = ''
+    mkdir -p $out
+    make install DESTDIR=$out
+    mv $out/$out/sbin $out/bin
+    rm -r $out/nix
+    '';
+
+  meta = with stdenv.lib; {
+    description = "LUKS key storage in TPM NVRAM";
+    homepage    = https://github.com/shpedoikal/tpm-luks/;
+    maintainers = [ maintainers.tstrobel ];
+    platforms   = platforms.linux;
+  };
+}
+

pkgs/tools/security/trousers/default.nix

@@ -15,11 +15,12 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-usercheck" ];
 
-  NIX_CFLAGS_COMPILE = "-DALLOW_NON_TSS_CONFIG_FILE";
+  # Attempt to remove -std=gnu89 when updating if using gcc5
+  NIX_CFLAGS_COMPILE = "-std=gnu89 -DALLOW_NON_TSS_CONFIG_FILE";
   NIX_LDFLAGS = "-lgcc_s";
 
   # Fix broken libtool file
-  preFixup = ''
+  preFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     sed 's,-lcrypto,-L${openssl.out}/lib -lcrypto,' -i $out/lib/libtspi.la
   '';