diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 628002c591a3..5ddc8b266ec1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5088,6 +5088,13 @@
       fingerprint = "1412 816B A9FA F62F D051 1975 D3E1 B013 B463 1293";
     }];
   };
+  ius = {
+    email = "j.de.gram@gmail.com";
+    name = "Joerie de Gram";
+    matrix = "@ius:nltrix.net";
+    github = "ius";
+    githubId = 529626;
+  };
   ivan = {
     email = "ivan@ludios.org";
     github = "ivan";
diff --git a/nixos/modules/services/monitoring/collectd.nix b/nixos/modules/services/monitoring/collectd.nix
index 6af04d22f0f7..660d108587de 100644
--- a/nixos/modules/services/monitoring/collectd.nix
+++ b/nixos/modules/services/monitoring/collectd.nix
@@ -132,7 +132,12 @@ in {
     users.users = optionalAttrs (cfg.user == "collectd") {
       collectd = {
         isSystemUser = true;
+        group = "collectd";
       };
     };
+
+    users.groups = optionalAttrs (cfg.user == "collectd") {
+      collectd = {};
+    };
   };
 }
diff --git a/nixos/modules/services/network-filesystems/drbd.nix b/nixos/modules/services/network-filesystems/drbd.nix
index 916e7eaaaa94..c730e0b34e90 100644
--- a/nixos/modules/services/network-filesystems/drbd.nix
+++ b/nixos/modules/services/network-filesystems/drbd.nix
@@ -47,19 +47,17 @@ let cfg = config.services.drbd; in
         options drbd usermode_helper=/run/current-system/sw/bin/drbdadm
       '';
 
-    environment.etc.drbd.conf =
+    environment.etc."drbd.conf" =
       { source = pkgs.writeText "drbd.conf" cfg.config; };
 
     systemd.services.drbd = {
       after = [ "systemd-udev.settle.service" "network.target" ];
       wants = [ "systemd-udev.settle.service" ];
       wantedBy = [ "multi-user.target" ];
-      script = ''
-        ${pkgs.drbd}/sbin/drbdadm up all
-      '';
-      serviceConfig.ExecStop = ''
-        ${pkgs.drbd}/sbin/drbdadm down all
-      '';
+      serviceConfig = {
+        ExecStart = "${pkgs.drbd}/sbin/drbdadm up all";
+        ExecStop = "${pkgs.drbd}/sbin/drbdadm down all";
+      };
     };
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1ff1b8d58642..a66721346926 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -111,6 +111,7 @@ in
   dokuwiki = handleTest ./dokuwiki.nix {};
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
+  drbd = handleTest ./drbd.nix {};
   ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
   ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
   ecryptfs = handleTest ./ecryptfs.nix {};
diff --git a/nixos/tests/drbd.nix b/nixos/tests/drbd.nix
new file mode 100644
index 000000000000..bede7206d706
--- /dev/null
+++ b/nixos/tests/drbd.nix
@@ -0,0 +1,87 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+    drbdPort = 7789;
+
+    drbdConfig =
+      { nodes, ... }:
+      {
+        virtualisation.emptyDiskImages = [ 1 ];
+        networking.firewall.allowedTCPPorts = [ drbdPort ];
+
+        services.drbd = {
+          enable = true;
+          config = ''
+            global {
+              usage-count yes;
+            }
+
+            common {
+              net {
+                protocol C;
+                ping-int 1;
+              }
+            }
+
+            resource r0 {
+              volume 0 {
+                device    /dev/drbd0;
+                disk      /dev/vdb;
+                meta-disk internal;
+              }
+
+              on drbd1 {
+                address ${nodes.drbd1.config.networking.primaryIPAddress}:${toString drbdPort};
+              }
+
+              on drbd2 {
+                address ${nodes.drbd2.config.networking.primaryIPAddress}:${toString drbdPort};
+              }
+            }
+          '';
+        };
+      };
+  in
+  {
+    name = "drbd";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ ryantm astro ];
+    };
+
+    nodes.drbd1 = drbdConfig;
+    nodes.drbd2 = drbdConfig;
+
+    testScript = { nodes }: ''
+      drbd1.start()
+      drbd2.start()
+
+      drbd1.wait_for_unit("network.target")
+      drbd2.wait_for_unit("network.target")
+
+      drbd1.succeed(
+          "drbdadm create-md r0",
+          "drbdadm up r0",
+          "drbdadm primary r0 --force",
+      )
+
+      drbd2.succeed("drbdadm create-md r0", "drbdadm up r0")
+
+      drbd1.succeed(
+          "mkfs.ext4 /dev/drbd0",
+          "mkdir -p /mnt/drbd",
+          "mount /dev/drbd0 /mnt/drbd",
+          "touch /mnt/drbd/hello",
+          "umount /mnt/drbd",
+          "drbdadm secondary r0",
+      )
+      drbd1.sleep(1)
+
+      drbd2.succeed(
+          "drbdadm primary r0",
+          "mkdir -p /mnt/drbd",
+          "mount /dev/drbd0 /mnt/drbd",
+          "ls /mnt/drbd/hello",
+      )
+    '';
+  }
+)
diff --git a/pkgs/applications/gis/qmapshack/default.nix b/pkgs/applications/gis/qmapshack/default.nix
index dd440dfffdac..b22a8d408deb 100644
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/applications/gis/qmapshack/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "qmapshack";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = pname;
     rev = "V_${version}";
-    sha256 = "1yzgkdjxwyg8ggbxyjwr0zjrx99ckrbz2p2524iii9i7qqn8wfsx";
+    sha256 = "sha256-2otvRKtFb51PLrIh/Hxltp69n5nyR63HGGvk73TFjqA=";
   };
 
   patches = [
diff --git a/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix b/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
index 046fcc763411..9a4d3878e8af 100644
--- a/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-branchless/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-branchless";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "arxanas";
     repo = "git-branchless";
     rev = "v${version}";
-    sha256 = "sha256-knRRjTjnhpedcQTVpJnBsrnaeRbjZ2i3aABeE0LrQ+c=";
+    sha256 = "sha256-eDVC1tvAkCioV0Mi5f/Qkc0MMTNaoFXuvWXpllZ7PgE=";
   };
 
-  cargoSha256 = "sha256-NyzsY5d4iC3zMSzmh9Qmd211oT6lmhUdvIfQdnzrtok=";
+  cargoSha256 = "sha256-wtG/WTmZ13jxIawI9j9QKQm7jPx5TUs7MjqX+lq/Vf0=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -42,6 +42,11 @@ rustPlatform.buildRustPackage rec {
     export PATH_TO_GIT=${git}/bin/git
     export GIT_EXEC_PATH=$(${git}/bin/git --exec-path)
   '';
+  # FIXME: these tests deadlock when run in the Nix sandbox
+  checkFlags = [
+    "--skip=test_checkout_pty"
+    "--skip=test_next_ambiguous_interactive"
+  ];
 
   meta = with lib; {
     description = "A suite of tools to help you visualize, navigate, manipulate, and repair your commit history";
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index 1afab167308f..7b45656c5e9c 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "19.0";
+  version = "20.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0h3varacv9696mih8zrz3fp6xa8hxxvwzkrslhpf9ilcjs1bjihd";
+    sha256 = "1j2p2phv1fxsa2mdr66gyswqgij33m3sdaa460xrf98dm581bqw2";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;
 
-  cargoSha256 = "015r9m9fr634ppn4qy0b8w1khjlxsv3wbpf3s7crmklzy57wakxl";
+  cargoSha256 = "12fmpq1y29mawa3xdwbwa3fw2hnhy5rqhlx54qp0s3x9g2jd7gsa";
 
   meta = with lib; {
     homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 209d9fbdb92a..678744f037c6 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -136,7 +136,7 @@ let self = stdenv.mkDerivation rec {
   PKG_CONFIG_UDEV_UDEVDIR = "${placeholder "out"}/lib/udev";
 
   passthru = {
-    libdir = "${self}/lib/mutter-8";
+    libdir = "${self}/lib/mutter-9";
 
     tests = {
       libdirExists = runCommand "mutter-libdir-exists" {} ''
diff --git a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
index bd4bbbae13a4..9e796670aa02 100644
--- a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
@@ -30,7 +30,7 @@
 }:
 let
   pname = "gnome-flashback";
-  version = "3.42.0";
+  version = "3.42.1";
 
   # From data/sessions/Makefile.am
   requiredComponentsCommon = enableGnomePanel:
@@ -61,7 +61,7 @@ let
 
     src = fetchurl {
       url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${name}.tar.xz";
-      sha256 = "1CcdwHrHOyceS07cgfMfZPVzGqbUSOehXX2TOXbc3Us=";
+      sha256 = "sha256:0kl4m05whm03m2v0y3jd69lghkggn8s0hxdhvchcas7jmhh940n8";
     };
 
     # make .desktop Execs absolute
diff --git a/pkgs/development/libraries/cgreen/default.nix b/pkgs/development/libraries/cgreen/default.nix
index 5a1dd2d26400..85532bfd74b0 100644
--- a/pkgs/development/libraries/cgreen/default.nix
+++ b/pkgs/development/libraries/cgreen/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cgreen";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "cgreen-devs";
     repo = "cgreen";
     rev = version;
-    sha256 = "JEpvkM0EZiiQUZRngICNxHbNqS/qjqkEdMPckGbdWac=";
+    sha256 = "sha256-aQrfsiPuNrEMscZrOoONiN665KlNmnOiYj9ZIyzW304=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 123703d4aa35..6824f0afdf38 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -12,15 +12,6 @@ buildPythonPackage rec {
     sha256 = "b41a590b49caf8e6498a57db628e580d5f8dc6febda0f42de5d783aed5b7f808";
   };
 
-  # click  is only used for the repl, in most cases this shouldn't impact
-  # downstream packages
-  postPatch = ''
-    substituteInPlace requirements/test.txt \
-      --replace "moto==1.3.7" moto
-    substituteInPlace requirements/default.txt \
-      --replace "click>=7.0,<8.0" click
-  '';
-
   propagatedBuildInputs = [ billiard click click-didyoumean click-plugins click-repl kombu pytz vine ];
 
   checkInputs = [ boto3 case moto pytest pytest-celery pytest-subtests pytest-timeout ];
diff --git a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
index 638f10f01873..460ee0041472 100644
--- a/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
+++ b/pkgs/development/tools/build-managers/redo-apenwarr/default.nix
@@ -4,13 +4,13 @@
 }: stdenv.mkDerivation rec {
 
   pname = "redo-apenwarr";
-  version = "0.42c";
+  version = "0.42d";
 
   src = fetchFromGitHub rec {
     owner = "apenwarr";
     repo = "redo";
     rev = "${repo}-${version}";
-    sha256 = "0kc2gag1n5583195gs38gjm8mb7in9y70c07fxibsay19pvvb8iw";
+    sha256 = "/QIMXpVhVLAIJa3LiOlRKzbUztIWZygkWZUKN4Nrh+M=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/kibana/6.x.nix b/pkgs/development/tools/misc/kibana/6.x.nix
index 9ba19c836b59..c728f7375436 100644
--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@@ -27,11 +27,11 @@ let
     };
 
 in stdenv.mkDerivation rec {
-  name = "kibana-${optionalString (!enableUnfree) "oss-"}${version}";
+  pname = "kibana${optionalString (!enableUnfree) "-oss"}";
   version = elk6Version;
 
   src = fetchurl {
-    url = "https://artifacts.elastic.co/downloads/kibana/${name}-${plat}-${arch}.tar.gz";
+    url = "https://artifacts.elastic.co/downloads/kibana/${pname}-${version}-${plat}-${arch}.tar.gz";
     sha256 = shas.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
   };
 
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 7e69f18e124f..fdc91503ff5c 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , rustPlatform
 , CoreServices
 , cmake
@@ -12,14 +11,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2021-10-25";
-  cargoSha256 = "sha256-PCQxXNpv4krdLBhyINoZT5QxV2hCqXpp1mqs0dUu4Ag=";
+  version = "2021-11-29";
+  cargoSha256 = "sha256-UgYR0e3Pt3lcbkSDnizlwtwjnqTaqGlXRgR724U4rSU=";
 
   src = fetchFromGitHub {
     owner = "rust-analyzer";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-3AMRwtEmITIvUdR/NINQTPatkjhmS1dQsbbsefIDYAE=";
+    sha256 = "sha256-vh7z8jupVxXPOko3sWUsOB7eji/7lKfwJ/CE3iw97Sw=";
   };
 
   patches = [
@@ -28,32 +27,6 @@ rustPlatform.buildRustPackage rec {
     ./ignore-git-and-rustfmt-tests.patch
   ];
 
-  # Revert edition 2021 related code since we have rust 1.55.0 in nixpkgs currently.
-  # Remove them when we have rust >= 1.56.0
-  # They change Cargo.toml so go `cargoPatches`.
-  cargoPatches = [
-    (fetchpatch {
-      url = "https://github.com/rust-analyzer/rust-analyzer/commit/f0ad6fa68bf98d317518bb75da01b7bb7abe98d3.patch";
-      revert = true;
-      sha256 = "sha256-ksX2j1Pgtd+M+FmXTEljm1nUxJwcY8GDQ9784Lb1uM4=";
-    })
-    (fetchpatch {
-      url = "https://github.com/rust-analyzer/rust-analyzer/commit/8457ae34bdbca117b2ef73787b214161440e21f9.patch";
-      revert = true;
-      sha256 = "sha256-w1Py1bvZ2/tDQDZVMNmPRo6i6uA4H3YYZY4rXlo0iqg=";
-    })
-    (fetchpatch {
-      url = "https://github.com/rust-analyzer/rust-analyzer/commit/ca44b6892e3e66765355d4e645f74df3d184c03b.patch";
-      revert = true;
-      sha256 = "sha256-N1TWlLxEg6oxFkns1ieVVvLAkrHq2WOr1tbkNvZvDFg=";
-    })
-    (fetchpatch {
-      url = "https://github.com/rust-analyzer/rust-analyzer/commit/1294bfce865c556184c9327af4a8953ca940aec8.patch";
-      revert = true;
-      sha256 = "sha256-65eZxAjsuUln6lzSihIP26x15PELLDL4yk9wiVzJ0hE=";
-    })
-  ];
-
   buildAndTestSubdir = "crates/rust-analyzer";
 
   nativeBuildInputs = lib.optional useMimalloc cmake;
@@ -84,8 +57,8 @@ rustPlatform.buildRustPackage rec {
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {
-    description = "An experimental modular compiler frontend for the Rust language";
-    homepage = "https://github.com/rust-analyzer/rust-analyzer";
+    description = "A modular compiler frontend for the Rust language";
+    homepage = "https://rust-analyzer.github.io";
     license = with licenses; [ mit asl20 ];
     maintainers = with maintainers; [ oxalica ];
   };
diff --git a/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json b/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json
index 6b01ee57ff2e..54a931eee86a 100644
--- a/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json
+++ b/pkgs/misc/vscode-extensions/rust-analyzer/build-deps/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rust-analyzer",
-  "version": "0.2.792",
+  "version": "0.2.834",
   "dependencies": {
     "https-proxy-agent": "^5.0.0",
     "node-fetch": "^2.6.1",
@@ -20,7 +20,7 @@
     "tslib": "^2.3.0",
     "typescript": "^4.3.5",
     "typescript-formatter": "^7.2.2",
-    "vsce": "=1.95.1",
+    "vsce": "^1.95.1",
     "vscode-test": "^1.5.1"
   }
 }
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 3055a91161b3..7b29f5a0e5cf 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,14 +1,12 @@
 { lib, stdenv, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
 , libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto }:
 
-let
+stdenv.mkDerivation rec {
   version = "5.1.6";
-  name = "autofs-${version}";
-in stdenv.mkDerivation {
-  inherit name;
+  pname = "autofs";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/daemons/autofs/v5/${name}.tar.xz";
+    url = "mirror://kernel/linux/daemons/autofs/v5/autofs-${version}.tar.xz";
     sha256 = "1vya21mb4izj3khcr3flibv7xc15vvx2v0rjfk5yd31qnzcy7pnx";
   };
 
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index 85be205749ac..0c5acd0ac064 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -1,49 +1,128 @@
-{ lib, stdenv, fetchurl, flex, systemd, perl }:
+{ lib
+, stdenv
+, docbook_xml_dtd_44
+, docbook_xml_dtd_45
+, docbook_xsl
+, asciidoctor
+, fetchurl
+, flex
+, kmod
+, libxslt
+, nixosTests
+, perl
+, systemd
+
+# drbd-utils are compiled twice, once with forOCF = true to extract
+# its OCF definitions for use in the ocf-resource-agents derivation,
+# then again with forOCF = false, where the ocf-resource-agents is
+# provided as the OCF_ROOT.
+, forOCF ? false
+, ocf-resource-agents
+}:
 
 stdenv.mkDerivation rec {
   pname = "drbd";
-  version = "8.4.4";
+  version = "9.19.1";
 
   src = fetchurl {
-    url = "http://oss.linbit.com/drbd/8.4/drbd-${version}.tar.gz";
-    sha256 = "1w4889h1ak7gy9w33kd4fgjlfpgmp6hzfya16p1pkc13bjf22mm0";
+    url = "https://pkg.linbit.com/downloads/drbd/utils/${pname}-utils-${version}.tar.gz";
+    sha256 = "1l99kcrb0j85wxxmrdihpx9bk1a4sdi7wlp5m1x5l24k8ck1m5cf";
   };
 
-  patches = [ ./pass-force.patch ./fix-glibc-compilation.patch ];
+  nativeBuildInputs = [
+    flex
+    libxslt
+    docbook_xsl
+    asciidoctor
+  ];
 
-  nativeBuildInputs = [ flex ];
-  buildInputs = [ perl ];
+  buildInputs = [
+    perl
+    # perlPackages.Po4a used by ja documentation
+  ];
 
   configureFlags = [
-    "--without-distro"
-    "--without-pacemaker"
+    "--libdir=${placeholder "out"}/lib"
+    "--sbindir=${placeholder "out"}/bin"
     "--localstatedir=/var"
     "--sysconfdir=/etc"
+    "--without-distro"
   ];
 
-  preConfigure =
-    ''
-      export PATH=${systemd}/sbin:$PATH
-      substituteInPlace user/Makefile.in \
-        --replace /sbin '$(sbindir)'
-      substituteInPlace user/legacy/Makefile.in \
-        --replace '$(DESTDIR)/lib/drbd' '$(DESTDIR)$(LIBDIR)'
-      substituteInPlace user/drbdadm_usage_cnt.c --replace /lib/drbd $out/lib/drbd
-      substituteInPlace scripts/drbd.rules --replace /usr/sbin/drbdadm $out/sbin/drbdadm
-    '';
-
-  makeFlags = [ "SHELL=${stdenv.shell}" ];
+  makeFlags = [
+    "SOURCE_DATE_EPOCH=1"
+    "WANT_DRBD_REPRODUCIBLE_BUILD=1"
+  ] ++ lib.optional (!forOCF) "OCF_ROOT=${ocf-resource-agents}/usr/lib/ocf}";
 
   installFlags = [
-    "localstatedir=$(TMPDIR)/var"
-    "sysconfdir=$(out)/etc"
-    "INITDIR=$(out)/etc/init.d"
+    "prefix="
+    "DESTDIR=${placeholder "out"}"
+    "localstatedir=/var"
+    "DRBD_LIB_DIR=/var/lib"
+    "INITDIR=/etc/init.d"
+    "udevrulesdir=/etc/udev/rules.d"
+    "sysconfdir=/etc"
+    "sbindir=/bin"
+    "datadir="
+    "LIBDIR=/lib/drbd"
+    "mandir=/share/man"
   ];
 
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace user/v84/drbdadm_usage_cnt.c \
+      --replace '"/lib/drbd");' \
+                '"${placeholder "out"}/lib/drbd");'
+    substituteInPlace user/v9/drbdsetup_linux.c \
+      --replace 'ret = system("/sbin/modprobe drbd");' \
+                'ret = system("${kmod}/bin/modprobe drbd");'
+    substituteInPlace user/v84/drbdsetup.c \
+      --replace 'system("/sbin/modprobe drbd")' \
+                'system("${kmod}/bin/modprobe drbd")'
+    substituteInPlace documentation/ra2refentry.xsl \
+      --replace "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" \
+                "${docbook_xml_dtd_44}/xml/dtd/docbook/docbookx.dtd"
+    function patch_docbook45() {
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
+                  "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook45 documentation/v9/drbd.conf.xml.in
+    patch_docbook45 documentation/v9/drbdsetup.xml.in
+    patch_docbook45 documentation/v84/drbdsetup.xml
+    patch_docbook45 documentation/v84/drbd.conf.xml
+    # The ja documentation is disabled because:
+    # make[1]: Entering directory '/build/drbd-utils-9.16.0/documentation/ja/v84'
+    # /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/bin/po4a-translate -f docbook -M utf-8 -L utf-8 -keep 0 -m ../../v84/drbdsetup.xml -p drbdsetup.xml.po -l drbdsetup.xml
+    # Use of uninitialized value $args[1] in sprintf at /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/lib/perl5/site_perl/Locale/Po4a/Common.pm line 134.
+    # Invalid po file drbdsetup.xml.po:
+    substituteInPlace Makefile.in \
+      --replace 'DOC_DIRS    := documentation/v9 documentation/ja/v9' \
+                'DOC_DIRS    := documentation/v9' \
+      --replace 'DOC_DIRS    += documentation/v84 documentation/ja/v84' \
+                'DOC_DIRS    += documentation/v84' \
+      --replace '$(MAKE) -C documentation/ja/v9 doc' \
+                "" \
+      --replace '$(MAKE) -C documentation/ja/v84 doc' \
+                ""
+    substituteInPlace user/v9/drbdtool_common.c \
+      --replace 'add_component_to_path("/lib/drbd");' \
+                'add_component_to_path("${placeholder "out"}/lib/drbd");'
+  '';
+
+  preConfigure = ''
+    export PATH=${systemd}/sbin:$PATH
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru.tests.drbd = nixosTests.drbd;
+
   meta = with lib; {
-    homepage = "http://www.drbd.org/";
-    description = "Distributed Replicated Block Device, a distributed storage system for Linux";
-    license = licenses.gpl2;
+    homepage = "https://linbit.com/drbd/";
+    description = "Distributed Replicated Block Device, a distributed storage system for Linux (userspace utilities)";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ ryantm astro ];
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch b/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch
deleted file mode 100644
index 621a2dd995db..000000000000
--- a/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/user/drbdadm_adjust.c b/user/drbdadm_adjust.c
-index cb23270..3a751ca 100644
---- a/user/drbdadm_adjust.c
-+++ b/user/drbdadm_adjust.c
-@@ -29,6 +29,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <sys/wait.h>
-+#include <sys/sysmacros.h>
- #include <unistd.h>
- #include <fcntl.h>
- 
-diff --git a/user/legacy/drbdadm_adjust.c b/user/legacy/drbdadm_adjust.c
-index c79163c..6990ffb 100644
---- a/user/legacy/drbdadm_adjust.c
-+++ b/user/legacy/drbdadm_adjust.c
-@@ -27,6 +27,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <sys/wait.h>
-+#include <sys/sysmacros.h>
- #include <unistd.h>
- #include <fcntl.h>
- 
diff --git a/pkgs/os-specific/linux/drbd/pass-force.patch b/pkgs/os-specific/linux/drbd/pass-force.patch
deleted file mode 100644
index 8f0201100f72..000000000000
--- a/pkgs/os-specific/linux/drbd/pass-force.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Propagate the --force flag in the legacy drbdadm to drbdsetup.
-Otherwise "drbdadm primary --force" won't work as expected (the kernel
-will say "State change failed: Need access to UpToDate data").
-
-diff -ru -x '*~' drbd-8.4.0-orig/user/legacy/drbdadm_main.c drbd-8.4.0/user/legacy/drbdadm_main.c
---- drbd-8.4.0-orig/user/legacy/drbdadm_main.c	2011-07-07 06:55:39.000000000 -0400
-+++ drbd-8.4.0/user/legacy/drbdadm_main.c	2011-11-02 14:51:04.000000000 -0400
-@@ -1547,6 +1547,7 @@
- 	for (i = 0; i < soi; i++) {
- 		argv[NA(argc)] = setup_opts[i];
- 	}
-+	if (force) argv[NA(argc)] = "--force";
- 	argv[NA(argc)] = 0;
- 
- 	setenv("DRBD_RESOURCE", res->name, 1);
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
index 83ac93fbf71c..75c0f1c3d1bc 100644
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ b/pkgs/os-specific/linux/gogoclient/default.nix
@@ -1,11 +1,8 @@
 {lib, stdenv, fetchurl, openssl, nettools, iproute2, sysctl}:
 
-let baseName = "gogoclient";
-    version  = "1.2";
-in
-
 stdenv.mkDerivation rec {
-  name = "${baseName}-${version}";
+  pname = "gogoclient";
+  version  = "1.2";
 
   src = fetchurl {
     #url = "http://gogo6.com/downloads/gogoc-1_2-RELEASE.tar.gz";
@@ -21,9 +18,9 @@ stdenv.mkDerivation rec {
   buildInputs = [openssl];
 
   preFixup = ''
-    mkdir -p $out/share/${name}
+    mkdir -p $out/share/gogoclient-${version}
     chmod 444 $out/bin/gogoc.conf
-    mv $out/bin/gogoc.conf $out/share/${name}/gogoc.conf.sample
+    mv $out/bin/gogoc.conf $out/share/gogoclient-${version}/gogoc.conf.sample
     rm $out/bin/gogoc.conf.sample
 
     substituteInPlace "$out/template/linux.sh" \
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
new file mode 100644
index 000000000000..9c9557c7be85
--- /dev/null
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -0,0 +1,56 @@
+{ stdenv
+, lib
+, runCommand
+, lndir
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, python3
+, glib
+, drbd
+}:
+
+let
+  drbdForOCF = drbd.override {
+    forOCF = true;
+  };
+
+  resource-agentsForOCF = stdenv.mkDerivation rec {
+    pname = "resource-agents";
+    version = "4.10.0";
+
+    src = fetchFromGitHub {
+      owner = "ClusterLabs";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "0haryi3yrszdfpqnkfnppxj1yiy6ipah6m80snvayc7v0ss0wnir";
+    };
+
+    nativeBuildInputs = [
+      autoreconfHook
+      pkg-config
+    ];
+
+    buildInputs = [
+      glib
+      python3
+    ];
+
+    meta = with lib; {
+      homepage = "https://github.com/ClusterLabs/resource-agents";
+      description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
+      license = licenses.gpl2Plus;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ ryantm astro ];
+    };
+  };
+
+in
+
+# This combines together OCF definitions from other derivations.
+# https://github.com/ClusterLabs/resource-agents/blob/master/doc/dev-guides/ra-dev-guide.asc
+runCommand "ocf-resource-agents" {} ''
+  mkdir -p $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${resource-agentsForOCF}/lib/ocf/" $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${drbdForOCF}/usr/lib/ocf/" $out/usr/lib/ocf
+''
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index d2d59ba21a5e..8ec7519bf1ad 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -1,7 +1,8 @@
 { lib, mkDerivation, fetchpatch, qtbase, qmake, inkscape, imagemagick, wpa_supplicant }:
 
 mkDerivation {
-  name = "wpa_gui-${wpa_supplicant.version}";
+  pname = "wpa_gui";
+  version = wpa_supplicant.version;
 
   inherit (wpa_supplicant) src;
 
diff --git a/pkgs/servers/ma1sd/default.nix b/pkgs/servers/ma1sd/default.nix
index 46578019194d..91d291c58dab 100644
--- a/pkgs/servers/ma1sd/default.nix
+++ b/pkgs/servers/ma1sd/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, jre, git, gradle_6, perl, makeWrapper }:
 
 let
-  name = "ma1sd-${version}";
+  pname = "ma1sd";
   version = "2.4.0";
   rev = version;
 
@@ -14,8 +14,8 @@ let
 
 
   deps = stdenv.mkDerivation {
-    name = "${name}-deps";
-    inherit src;
+    pname = "${pname}-deps";
+    inherit src version;
     nativeBuildInputs = [ gradle_6 perl git ];
 
     buildPhase = ''
@@ -40,7 +40,7 @@ let
 
 in
 stdenv.mkDerivation {
-  inherit name src version;
+  inherit pname src version;
   nativeBuildInputs = [ gradle_6 perl makeWrapper ];
   buildInputs = [ jre ];
 
diff --git a/pkgs/shells/loksh/default.nix b/pkgs/shells/loksh/default.nix
index d8463d1773c4..b9f7d5ef7e7f 100644
--- a/pkgs/shells/loksh/default.nix
+++ b/pkgs/shells/loksh/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "loksh";
-  version = "6.9";
+  version = "7.0";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "0x33plxqhh5202hgqidgccz5hpg8d2q71ylgnm437g60mfi9z0px";
+    sha256 = "sha256-q5RiY9/xEFCk+oHlxgNwDOB+TNjRWHKzU2kQH2LjCWY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/X11/xgeometry-select/default.nix b/pkgs/tools/X11/xgeometry-select/default.nix
index 87c643af483d..9f9b50feab90 100644
--- a/pkgs/tools/X11/xgeometry-select/default.nix
+++ b/pkgs/tools/X11/xgeometry-select/default.nix
@@ -1,8 +1,7 @@
 { lib, stdenv, fetchurl, libX11 }:
 
 stdenv.mkDerivation rec {
-  name     = "${baseName}-${version}";
-  baseName = "xgeometry-select";
+  pname = "xgeometry-select";
   version  = "0.1";
 
   src = fetchurl {
@@ -15,12 +14,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 ];
 
   buildPhase = ''
-    gcc -Wall -lX11 ${src} -o ${baseName}
+    gcc -Wall -lX11 ${src} -o xgeometry-select
   '';
 
   installPhase = ''
     mkdir -p $out/bin
-    mv -v ${baseName} $out/bin
+    mv -v xgeometry-select $out/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/audio/alsaequal/default.nix b/pkgs/tools/audio/alsaequal/default.nix
index c6c25fd39966..13e3e756b6ac 100644
--- a/pkgs/tools/audio/alsaequal/default.nix
+++ b/pkgs/tools/audio/alsaequal/default.nix
@@ -3,7 +3,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "alsaequal";
+  pname = "alsaequal";
   version = "0.6";
 
   src = fetchurl {
diff --git a/pkgs/tools/audio/kaldi/default.nix b/pkgs/tools/audio/kaldi/default.nix
index ef725408b13e..662a6f2b5348 100644
--- a/pkgs/tools/audio/kaldi/default.nix
+++ b/pkgs/tools/audio/kaldi/default.nix
@@ -17,19 +17,19 @@ let
   openfst = fetchFromGitHub {
     owner = "kkm000";
     repo = "openfst";
-    rev = "0bca6e76d24647427356dc242b0adbf3b5f1a8d9";
-    sha256 = "1802rr14a03zl1wa5a0x1fa412kcvbgprgkadfj5s6s3agnn11rx";
+    rev = "338225416178ac36b8002d70387f5556e44c8d05";
+    sha256 = "sha256-MGEUuw7ex+WcujVdxpO2Bf5sB6Z0edcAeLGqW/Lo1Hs=";
   };
 in
 stdenv.mkDerivation {
   pname = "kaldi";
-  version = "2020-12-26";
+  version = "2021-12-03";
 
   src = fetchFromGitHub {
     owner = "kaldi-asr";
     repo = "kaldi";
-    rev = "813b73185a18725e4f6021981d17221d6ee23a19";
-    sha256 = "sha256-lTqXTG5ZTPmhCgt+BVzOwjKEIj+bLGUa+IxJq+XtHUg=";
+    rev = "2b016ab8cb018e031ab3bf01ec36cc2950c7e509";
+    sha256 = "sha256-R8CrY7cwU5XfeGEgeFuZ0ApsEcEmWN/lrZaCjz85tyk=";
   };
 
   cmakeFlags = [
@@ -37,6 +37,8 @@ stdenv.mkDerivation {
     "-DBUILD_SHARED_LIBS=on"
   ];
 
+  enableParallelBuilding = true;
+
   preConfigure = ''
     mkdir bin
     cat > bin/git <<'EOF'
diff --git a/pkgs/tools/backup/s3ql/default.nix b/pkgs/tools/backup/s3ql/default.nix
index 00d3b427d60e..50b5279383db 100644
--- a/pkgs/tools/backup/s3ql/default.nix
+++ b/pkgs/tools/backup/s3ql/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "s3ql";
-  version = "3.7.3";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "release-${version}";
-    sha256 = "042fvkvranfnv2xxxz9d92cgia14p1hwmpjgm0rr94pjd36n1sfs";
+    sha256 = "0a6ll5vs7faj1klfz3j674399qfbhy3blp3c5wwsqvcdkpcjcx11";
   };
 
   checkInputs = [ which ] ++ (with python3Packages; [ cython pytest pytest-trio ]);
diff --git a/pkgs/tools/bluetooth/bluez-tools/default.nix b/pkgs/tools/bluetooth/bluez-tools/default.nix
index 6b87a54be63a..dfb7147d08eb 100644
--- a/pkgs/tools/bluetooth/bluez-tools/default.nix
+++ b/pkgs/tools/bluetooth/bluez-tools/default.nix
@@ -2,14 +2,13 @@
 , fetchFromGitHub, glib, pkg-config }:
 
 stdenv.mkDerivation rec {
-  date    = "2016-12-12";
-  name    = "bluez-tools-${date}";
-  rev     = "97efd29";
+  version = "unstable-2016-12-12";
+  pname = "bluez-tools";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner = "khvzak";
     repo = "bluez-tools";
+    rev = "97efd293491ad7ec96a655665339908f2478b3d1";
     sha256 = "08xp77sf5wnq5086halmyk3vla4bfls06q1zrqdcq36hw6d409i6";
   };
 
diff --git a/pkgs/tools/cd-dvd/xorriso/default.nix b/pkgs/tools/cd-dvd/xorriso/default.nix
index e1cd7cc4046e..2dd1b24adbba 100644
--- a/pkgs/tools/cd-dvd/xorriso/default.nix
+++ b/pkgs/tools/cd-dvd/xorriso/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, lib, stdenv, libcdio, zlib, bzip2, readline, acl, attr, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "xorriso-${version}";
+  pname = "xorriso";
   version = "1.5.4.pl02";
 
   src = fetchurl {
-    url = "mirror://gnu/xorriso/${name}.tar.gz";
+    url = "mirror://gnu/xorriso/xorriso-${version}.tar.gz";
     sha256 = "sha256-Psc5PUqdy/X3QwnCikFfVSJ+xidwuVrpk6yNejsVKXI=";
   };
 
diff --git a/pkgs/tools/filesystems/hfsprogs/default.nix b/pkgs/tools/filesystems/hfsprogs/default.nix
index 8a2a8572b5ca..877d95c5b3d9 100644
--- a/pkgs/tools/filesystems/hfsprogs/default.nix
+++ b/pkgs/tools/filesystems/hfsprogs/default.nix
@@ -1,12 +1,11 @@
 { lib, stdenv, fetchurl, openssl, libbsd }:
 
-let version = "332.25";
-    package_name = "hfsprogs"; in
-stdenv.mkDerivation {
-  name = "${package_name}-${version}";
+stdenv.mkDerivation rec {
+  version = "332.25";
+  pname = "hfsprogs";
   srcs = [
     (fetchurl {
-      url = "http://ftp.de.debian.org/debian/pool/main/h/hfsprogs/${package_name}_${version}-11.debian.tar.gz";
+      url = "http://ftp.de.debian.org/debian/pool/main/h/hfsprogs/hfsprogs_${version}-11.debian.tar.gz";
       sha256 = "62d9b8599c66ebffbc57ce5d776e20b41341130d9b27341d63bda08460ebde7c";
     })
     (fetchurl {
@@ -29,13 +28,13 @@ stdenv.mkDerivation {
   installPhase = ''
     # Create required package directories
     install -m 755 -d "$out/bin"
-    install -m 755 -d "$out/share/${package_name}"
+    install -m 755 -d "$out/share/hfsprogs"
     install -m 755 -d "$out/share/man/man8/"
     # Copy executables
     install -m 755 "newfs_hfs.tproj/newfs_hfs" "$out/bin/mkfs.hfsplus"
     install -m 755 "fsck_hfs.tproj/fsck_hfs" "$out/bin/fsck.hfsplus"
     # Copy shared data
-    install -m 644 "newfs_hfs.tproj/hfsbootdata.img" "$out/share/${package_name}/hfsbootdata"
+    install -m 644 "newfs_hfs.tproj/hfsbootdata.img" "$out/share/hfsprogs/hfsbootdata"
     # Copy man pages
     install -m 644 "newfs_hfs.tproj/newfs_hfs.8" "$out/share/man/man8/mkfs.hfsplus.8"
     install -m 644 "fsck_hfs.tproj/fsck_hfs.8" "$out/share/man/man8/fsck.hfsplus.8"
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index ca349c7f42e4..95cec1803807 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -1,14 +1,11 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, systemd, util-linux, coreutils }:
 
-let
-  v = "2.02.106";
-in
-
 stdenv.mkDerivation {
-  name = "lvm2-${v}";
+  pname = "lvm2";
+  version = "2.02.106";
 
   src = fetchurl {
-    url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${v}.tgz";
+    url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${version}.tgz";
     sha256 = "0nr833bl0q4zq52drjxmmpf7bs6kqxwa5kahwwxm9411khkxz0vc";
   };
 
diff --git a/pkgs/tools/filesystems/wiimms-iso-tools/default.nix b/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
index 8f6e0db7ea27..2b107d1af191 100644
--- a/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
+++ b/pkgs/tools/filesystems/wiimms-iso-tools/default.nix
@@ -1,7 +1,7 @@
 {lib, stdenv, fetchurl, fetchpatch, zlib, ncurses, fuse}:
 
 stdenv.mkDerivation rec {
-  name = "wiimms-iso-tools";
+  pname = "wiimms-iso-tools";
   version = "3.02a";
 
   src = fetchurl {
diff --git a/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix b/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
index 94a7d2444bf9..269611f4bd7c 100644
--- a/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
+++ b/pkgs/tools/inputmethods/fcitx-engines/fcitx-mozc/default.nix
@@ -13,7 +13,7 @@ let
     sha256 = "10bdjn481jsh32vll7r756l392anz44h6207vjqwby3rplk31np1";
   };
 in clangStdenv.mkDerivation rec {
-  name    = "fcitx-mozc-${version}";
+  pname = "fcitx-mozc";
   version = "2.23.2815.102";
 
   src = fetchFromGitHub {
diff --git a/pkgs/tools/misc/mdbtools/default.nix b/pkgs/tools/misc/mdbtools/default.nix
index 7eb57863575f..b03ac6c785fe 100644
--- a/pkgs/tools/misc/mdbtools/default.nix
+++ b/pkgs/tools/misc/mdbtools/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mdbtools";
-  version = "0.9.4";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "mdbtools";
     repo = "mdbtools";
     rev = "v${version}";
-    sha256 = "sha256-Hnub8h0a3qx5cxVn1tp/IVbz9aORjGGWizD3Z4rPl2s=";
+    sha256 = "sha256-e9rgTWu8cwuccpp/wAfas1ZeQPTpGcgE6YjLz7KRnhw=";
   };
 
   configureFlags = [ "--disable-scrollkeeper" ];
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index b88da7599d1d..e33c4c2fb03a 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -5,23 +5,23 @@
 with lib;
 
 let
-  qemuName = "qemu-2.10.0";
   cpuTarget = if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux-user"
     else if stdenv.hostPlatform.system == "i686-linux" then "i386-linux-user"
     else throw "afl: no support for ${stdenv.hostPlatform.system}!";
 in
-stdenv.mkDerivation {
-  name = "afl-${qemuName}";
+stdenv.mkDerivation rec {
+  pname = "afl-qemu";
+  version = "2.10.0";
 
   srcs = [
     (fetchurl {
-      url = "http://wiki.qemu.org/download/${qemuName}.tar.bz2";
+      url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
       sha256 = "0j3dfxzrzdp1w21k21fjvmakzc6lcha1rsclaicwqvbf63hkk7vy";
     })
     afl.src
   ];
 
-  sourceRoot = qemuName;
+  sourceRoot = "qemu-${version}";
 
   postUnpack = ''
     cp ${afl.src.name}/types.h $sourceRoot/afl-types.h
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index ff416f793e1c..69bea2ac54ff 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -11,7 +11,7 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "nmap${optionalString graphicalSupport "-graphical"}-${version}";
+  pname = "nmap${optionalString graphicalSupport "-graphical"}";
   version = "7.92";
 
   src = fetchurl {
diff --git a/pkgs/tools/security/open-ecard/default.nix b/pkgs/tools/security/open-ecard/default.nix
index 00ff112ba844..470e5f6530fc 100644
--- a/pkgs/tools/security/open-ecard/default.nix
+++ b/pkgs/tools/security/open-ecard/default.nix
@@ -2,7 +2,6 @@
 
 let
   version = "1.2.4";
-
   srcs = {
     richclient = fetchurl {
       url = "https://jnlp.openecard.org/richclient-${version}-20171212-0958.jar";
@@ -18,8 +17,8 @@ let
     };
   };
 in stdenv.mkDerivation rec {
-  appName = "open-ecard";
-  name = "${appName}-${version}";
+  pname = "open-ecard";
+  inherit version;
 
   src = srcs.richclient;
 
@@ -28,12 +27,12 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
 
   desktopItem = makeDesktopItem {
-    name = appName;
+    name = pname;
     desktopName = "Open eCard App";
     genericName = "eCard App";
     comment = "Client side implementation of the eCard-API-Framework";
     icon = "oec_logo_bg-transparent.svg";
-    exec = appName;
+    exec = pname;
     categories = "Utility;Security;";
   };
 
@@ -47,7 +46,7 @@ in stdenv.mkDerivation rec {
     cp ${srcs.logo} $out/share/pixmaps/oec_logo_bg-transparent.svg
 
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/${appName} \
+    makeWrapper ${jre}/bin/java $out/bin/${pname} \
       --add-flags "-cp $out/share/java/cifs-${version}.jar" \
       --add-flags "-jar $out/share/java/richclient-${version}.jar" \
       --suffix LD_LIBRARY_PATH ':' ${lib.getLib pcsclite}/lib
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 87be68c9975b..d6cc09acb798 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -61,7 +61,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  # disable tests on aarch64-darwin, the following tests fail there:
+  # oom/circbuf: [forking]
+  #   FAIL src/test/test_oom.c:187: assert(c1->marked_for_close)
+  #   [circbuf FAILED]
+  # oom/streambuf: [forking]
+  #   FAIL src/test/test_oom.c:287: assert(x_ OP_GE 500 - 5): 0 vs 495
+  #   [streambuf FAILED]
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   postInstall = ''
     mkdir -p $geoip/share/tor
diff --git a/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch b/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch
index a95a373bbb64..bb124c394f25 100644
--- a/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch
+++ b/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch
@@ -2,7 +2,7 @@ diff --git a/src/test/test_util.c b/src/test/test_util.c
 index 0d86a5ab5..e93c6ba89 100644
 --- a/src/test/test_util.c
 +++ b/src/test/test_util.c
-@@ -5829,13 +5829,9 @@ test_util_monotonic_time(void *arg)
+@@ -6490,13 +6490,9 @@ test_util_monotonic_time(void *arg)
    /* We need to be a little careful here since we don't know the system load.
     */
    tt_i64_op(monotime_diff_msec(&mt1, &mt2), OP_GE, 175);
@@ -16,11 +16,33 @@ index 0d86a5ab5..e93c6ba89 100644
  
    tt_u64_op(msec1, OP_GE, nsec1 / 1000000);
    tt_u64_op(usec1, OP_GE, nsec1 / 1000);
-@@ -5849,7 +5845,6 @@ test_util_monotonic_time(void *arg)
+@@ -6509,8 +6509,6 @@ test_util_monotonic_time(void *arg)
+ 
    uint64_t coarse_stamp_diff =
      monotime_coarse_stamp_units_to_approx_msec(stamp2-stamp1);
-   tt_u64_op(coarse_stamp_diff, OP_GE, 120);
+-  tt_u64_op(coarse_stamp_diff, OP_GE, 120);
 -  tt_u64_op(coarse_stamp_diff, OP_LE, 1200);
  
    {
      uint64_t units = monotime_msec_to_approx_coarse_stamp_units(5000);
+@@ -6515,8 +6515,8 @@ test_util_monotonic_time(void *arg)
+   {
+     uint64_t units = monotime_msec_to_approx_coarse_stamp_units(5000);
+     uint64_t ms = monotime_coarse_stamp_units_to_approx_msec(units);
+-    tt_u64_op(ms, OP_GE, 4950);
+-    tt_u64_op(ms, OP_LT, 5050);
++    tt_u64_op(ms, OP_GE, 4000);
++    tt_u64_op(ms, OP_LT, 6000);
+   }
+ 
+  done:
+@@ -6640,9 +6640,6 @@ test_util_monotonic_time_add_msec(void *arg)
+   monotime_coarse_add_msec(&ct2, &ct1, 1337);
+   tt_i64_op(monotime_diff_msec(&t1, &t2), OP_EQ, 1337);
+   tt_i64_op(monotime_coarse_diff_msec(&ct1, &ct2), OP_EQ, 1337);
+-  // The 32-bit variant must be within 1% of the regular one.
+-  tt_int_op(monotime_coarse_diff_msec32_(&ct1, &ct2), OP_GT, 1323);
+-  tt_int_op(monotime_coarse_diff_msec32_(&ct1, &ct2), OP_LT, 1350);
+ 
+   /* Add 1337 msec twice more; make sure that any second rollover issues
+    * worked. */
diff --git a/pkgs/tools/system/lshw/default.nix b/pkgs/tools/system/lshw/default.nix
index 040f065acd72..1f29176fd0f0 100644
--- a/pkgs/tools/system/lshw/default.nix
+++ b/pkgs/tools/system/lshw/default.nix
@@ -2,14 +2,12 @@
 , withGUI ? false, gtk2, pkg-config, sqlite # compile GUI
 }:
 
-let numVersion = "02.18"; # :(
-in
 stdenv.mkDerivation rec {
-  name = "lshw-${numVersion}b";
-  version = numVersion;
+  pname = "lshw";
+  version = "B.02.18";
 
   src = fetchurl {
-    url = "https://ezix.org/software/files/lshw-B.${version}.tar.gz";
+    url = "https://ezix.org/software/files/lshw-${version}.tar.gz";
     sha256 = "0brwra4jld0d53d7jsgca415ljglmmx1l2iazpj4ndilr48yy8mf";
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2c98f7a23f79..e311640b814c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22389,6 +22389,8 @@ with pkgs;
 
   system76-firmware = callPackage ../os-specific/linux/firmware/system76-firmware { };
 
+  ocf-resource-agents = callPackage ../os-specific/linux/ocf-resource-agents { };
+
   open-vm-tools = callPackage ../applications/virtualization/open-vm-tools { };
   open-vm-tools-headless = open-vm-tools.override { withX = false; };