Merge staging into staging-next

doc/languages-frameworks/rust.section.md

@@ -303,11 +303,15 @@ with import <nixpkgs> {};
 
 stdenv.mkDerivation {
   name = "rust-env";
-  buildInputs = [
+  nativeBuildInputs = [
     rustc cargo
 
-    # Example Additional Dependencies
+    # Example Build-time Additional Dependencies
-    pkgconfig openssl
+    pkgconfig
+  ];
+  buildInputs = [
+    # Example Run-time Additional Dependencies
+    openssl
   ];
 
   # Set Environment Variables

doc/stdenv.xml

@@ -2433,30 +2433,6 @@ addEnvHooks "$hostOffset" myBashFunction
       </para>
      </listitem>
     </varlistentry>
-    <varlistentry>
-     <term>
-      paxctl
-     </term>
-     <listitem>
-      <para>
-       Defines the <varname>paxmark</varname> helper for setting per-executable
-       PaX flags on Linux (where it is available by default; on all other
-       platforms, <varname>paxmark</varname> is a no-op). For example, to
-       disable secure memory protections on the executable
-       <replaceable>foo</replaceable>
-<programlisting>
-      postFixup = ''
-        paxmark m $out/bin/<replaceable>foo</replaceable>
-      '';
-    </programlisting>
-       The <literal>m</literal> flag is the most common flag and is typically
-       required for applications that employ JIT compilation or otherwise need
-       to execute code generated at run-time. Disabling PaX protections should
-       be considered a last resort: if possible, problematic features should be
-       disabled or patched to work with PaX.
-      </para>
-     </listitem>
-    </varlistentry>
     <varlistentry>
      <term>
       autoPatchelfHook

lib/default.nix

@@ -80,7 +80,7 @@ let
     inherit (strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath makePerlPath makeFullPerlPath optionalString
+      makeLibraryPath makeBinPath optionalString
       hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString

lib/strings.nix

@@ -162,26 +162,6 @@ rec {
   */
   makeBinPath = makeSearchPathOutput "bin" "bin";
 
-
-  /* Construct a perl search path (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makePerlPath [ pkgs.perlPackages.libnet ]
-       => "/nix/store/n0m1fk9c960d8wlrs62sncnadygqqc6y-perl-Net-SMTP-1.25/lib/perl5/site_perl"
-  */
-  # FIXME(zimbatm): this should be moved in perl-specific code
-  makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";
-
-  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makeFullPerlPath [ pkgs.perlPackages.CGI ]
-       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
-  */
-  makeFullPerlPath = deps: makePerlPath (lib.misc.closePropagation deps);
-
   /* Depending on the boolean `cond', return either the given string
      or the empty string. Useful to concatenate against a bigger string.
 

lib/systems/default.nix

@@ -98,7 +98,7 @@ rec {
       in
         if final.parsed.kernel.name == pkgs.stdenv.hostPlatform.parsed.kernel.name &&
            (final.parsed.cpu.name == pkgs.stdenv.hostPlatform.parsed.cpu.name ||
-            (final.platform.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
+            (final.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
         then pkgs.runtimeShell
         else if final.isWindows
         then "${wine}/bin/${wine-name}"

maintainers/scripts/nix-generate-from-cpan.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
   buildInputs = with perlPackages; [
-    makeWrapper perl CPANMeta GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];

nixos/lib/testing.nix

@@ -34,14 +34,14 @@ in rec {
         cp ${./test-driver/test-driver.pl} $out/bin/nixos-test-driver
         chmod u+x $out/bin/nixos-test-driver
 
-        libDir=$out/lib/perl5/site_perl
+        libDir=$out/${perl.libPrefix}
         mkdir -p $libDir
         cp ${./test-driver/Machine.pm} $libDir/Machine.pm
         cp ${./test-driver/Logger.pm} $libDir/Logger.pm
 
         wrapProgram $out/bin/nixos-test-driver \
           --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
-          --prefix PERL5LIB : "${with perlPackages; lib.makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/lib/perl5/site_perl"
+          --prefix PERL5LIB : "${with perlPackages; makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/${perl.libPrefix}"
       '';
   };
 

nixos/modules/config/users-groups.nix

@@ -534,8 +534,8 @@ in {
         install -m 0755 -d /home
 
         ${pkgs.perl}/bin/perl -w \
-          -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl \
+          -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} \
-          -I${pkgs.perlPackages.JSON}/lib/perl5/site_perl \
+          -I${pkgs.perlPackages.JSON}/${pkgs.perl.libPrefix} \
           ${./update-users-groups.pl} ${spec}
       '';
 

nixos/modules/installer/tools/tools.nix

@@ -37,7 +37,7 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     path = [ pkgs.btrfs-progs ];
-    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
+    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}";
     inherit (config.system.nixos) release;
   };
 

nixos/modules/module-list.nix

@@ -695,7 +695,7 @@
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
   ./services/system/localtime.nix
-  ./services/system/kerberos.nix
+  ./services/system/kerberos/default.nix
   ./services/system/nscd.nix
   ./services/system/saslauthd.nix
   ./services/system/uptimed.nix

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -16,7 +16,7 @@ let
     isExecutable = true;
     inherit (pkgs) perl;
     inherit (cfg) dbPath;
-    perlFlags = concatStrings (map (path: "-I ${path}/lib/perl5/site_perl ")
+    perlFlags = concatStrings (map (path: "-I ${path}/${pkgs.perl.libPrefix} ")
       [ pkgs.perlPackages.DBI pkgs.perlPackages.DBDSQLite pkgs.perlPackages.StringShellQuote ]);
   };
 

nixos/modules/services/desktops/gnome3/gnome-keyring.nix

@@ -33,7 +33,7 @@ with lib;
 
     environment.systemPackages = [ pkgs.gnome3.gnome-keyring ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gnome3.gcr ];
+    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];
 
   };
 

nixos/modules/services/network-filesystems/glusterfs.nix

@@ -201,7 +201,6 @@ in
 
       serviceConfig = {
         Type="simple";
-        Environment="PYTHONPATH=${glusterfs}/usr/lib/python2.7/site-packages";
         PIDFile="/run/glustereventsd.pid";
         ExecStart="${glusterfs}/sbin/glustereventsd --pid-file /run/glustereventsd.pid";
         ExecReload="/bin/kill -SIGUSR2 $MAINPID";

nixos/modules/services/search/elasticsearch-curator.nix

@@ -82,11 +82,12 @@ in {
   };
 
   config = mkIf cfg.enable {
-
     systemd.services.elasticsearch-curator = {
       startAt = cfg.interval;
       serviceConfig = {
-        ExecStart = ''${pkgs.python36Packages.elasticsearch-curator}/bin/curator --config ${curatorConfig} ${curatorAction}'';
+        ExecStart =
+          "${pkgs.python3Packages.elasticsearch-curator}/bin/curator" +
+          " --config ${curatorConfig} ${curatorAction}";
       };
     };
   };

nixos/modules/services/system/kerberos.nix

@@ -1,64 +0,0 @@
-{pkgs, config, lib, ...}:
-
-let
-
-  inherit (lib) mkOption mkIf;
-
-  inherit (pkgs) heimdalFull;
-
-  stateDir = "/var/heimdal";
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.kerberos_server = {
-
-      enable = mkOption {
-        default = false;
-        description = ''
-          Enable the kerberos authentification server.
-        '';
-      };
-
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf config.services.kerberos_server.enable {
-
-    environment.systemPackages = [ heimdalFull ];
-
-    services.xinetd.enable = true;
-    services.xinetd.services = lib.singleton
-      { name = "kerberos-adm";
-        flags = "REUSE NAMEINARGS";
-        protocol = "tcp";
-        user = "root";
-        server = "${pkgs.tcp_wrappers}/bin/tcpd";
-        serverArgs = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
-      };
-
-    systemd.services.kdc = {
-      description = "Key Distribution Center daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      script = "${heimdalFull}/libexec/heimdal/kdc";
-    };
-
-    systemd.services.kpasswdd = {
-      description = "Kerberos Password Changing daemon";
-      wantedBy = [ "multi-user.target" ];
-      script = "${heimdalFull}/libexec/heimdal/kpasswdd";
-    };
-  };
-
-}

nixos/modules/services/system/kerberos/default.nix

@@ -0,0 +1,80 @@
+{pkgs, config, lib, ...}:
+
+let
+  inherit (lib) mkOption mkIf types length attrNames;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+
+  aclEntry = {
+    options = {
+      principal = mkOption {
+        type = types.str;
+        description = "Which principal the rule applies to";
+      };
+      access = mkOption {
+        type = types.either
+          (types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
+          (types.enum ["all"]);
+        default = "all";
+        description = "The changes the principal is allowed to make.";
+      };
+      target = mkOption {
+        type = types.str;
+        default = "*";
+        description = "The principals that 'access' applies to.";
+      };
+    };
+  };
+
+  realm = {
+    options = {
+      acl = mkOption {
+        type = types.listOf (types.submodule aclEntry);
+        default = [
+          { principal = "*/admin"; access = "all"; }
+          { principal = "admin"; access = "all"; }
+        ];
+        description = ''
+          The privileges granted to a user.
+        '';
+      };
+    };
+  };
+in
+
+{
+  imports = [
+    ./mit.nix
+    ./heimdal.nix
+  ];
+
+  ###### interface
+  options = {
+    services.kerberos_server = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable the kerberos authentification server.
+        '';
+      };
+
+      realms = mkOption {
+        type = types.attrsOf (types.submodule realm);
+        description = ''
+          The realm(s) to serve keys for.
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ kerberos ];
+    assertions = [{
+      assertion = length (attrNames cfg.realms) <= 1;
+      message = "Only one realm per server is currently supported.";
+    }];
+  };
+}

nixos/modules/services/system/kerberos/heimdal.nix

@@ -0,0 +1,68 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs
+    mapAttrsToList attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/heimdal";
+  aclFiles = mapAttrs
+    (name: {acl, ...}: pkgs.writeText "${name}.acl" (concatMapStrings ((
+      {principal, access, target, ...} :
+      "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
+    )) acl)) cfg.realms;
+
+  kdcConfigs = mapAttrsToList (name: value: ''
+    database = {
+      dbname = ${stateDir}/heimdal
+      acl_file = ${value}
+    }
+  '') aclFiles;
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [kdc]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+in
+
+{
+  # No documentation about correct triggers, so guessing at them.
+
+  config = mkIf (cfg.enable && kerberos == pkgs.heimdalFull) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    systemd.services.kpasswdd = {
+      description = "Kerberos Password Changing daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    environment.etc = {
+      # Can be set via the --config-file option to KDC
+      "heimdal-kdc/kdc.conf".source = kdcConfFile;
+    };
+  };
+}

nixos/modules/services/system/kerberos/mit.nix

@@ -0,0 +1,68 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList
+    mapAttrs mapAttrsToList attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/lib/krb5kdc";
+  PIDFile = "/run/kdc.pid";
+  aclMap = {
+    add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
+    all = "*";
+  };
+  aclFiles = mapAttrs
+    (name: {acl, ...}: (pkgs.writeText "${name}.acl" (concatMapStrings (
+      {principal, access, target, ...} :
+      let access_code = map (a: aclMap.${a}) (toList access); in
+      "${principal} ${concatStrings access_code} ${target}\n"
+    ) acl))) cfg.realms;
+  kdcConfigs = mapAttrsToList (name: value: ''
+    ${name} = {
+      acl_file = ${value}
+    }
+  '') aclFiles;
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [realms]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+  env = {
+    # What Debian uses, could possibly link directly to Nix store?
+    KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
+  };
+in
+
+{
+  config = mkIf (cfg.enable && kerberos == pkgs.krb5Full) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/bin/kadmind -nofork";
+      restartTriggers = [ kdcConfFile ];
+      environment = env;
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = PIDFile;
+        ExecStart = "${kerberos}/bin/krb5kdc -P ${PIDFile}";
+      };
+      restartTriggers = [ kdcConfFile ];
+      environment = env;
+    };
+
+    environment.etc = {
+      "krb5kdc/kdc.conf".source = kdcConfFile;
+    };
+    environment.variables = env;
+  };
+}

nixos/modules/services/web-servers/lighttpd/collectd.nix

@@ -48,7 +48,7 @@ in
           "/collectd" => "${cfg.collectionCgi}"
         )
         setenv.add-environment = (
-          "PERL5LIB" => "${with pkgs; lib.makePerlPath [ perlPackages.CGI perlPackages.HTMLParser perlPackages.URI rrdtool ]}",
+          "PERL5LIB" => "${with pkgs.perlPackages; makePerlPath [ CGI HTMLParser URI pkgs.rrdtool ]}",
           "COLLECTION_CONF" => "${collectionConf}"
         )
       }

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix

@@ -3,6 +3,6 @@
 pkgs.substituteAll {
   src = ./extlinux-conf-builder.sh;
   isExecutable = true;
-  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
+  path = [pkgs.buildPackages.coreutils pkgs.buildPackages.gnused pkgs.buildPackages.gnugrep];
-  inherit (pkgs) bash;
+  inherit (pkgs.buildPackages) bash;
 }

nixos/modules/system/boot/loader/grub/grub.nix

@@ -586,7 +586,7 @@ in
         in pkgs.writeScript "install-grub.sh" (''
         #!${pkgs.runtimeShell}
         set -e
-        export PERL5LIB=${makePerlPath (with pkgs.perlPackages; [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ])}
+        export PERL5LIB=${with pkgs.perlPackages; makePerlPath [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ]}
         ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"}
       '' + flip concatMapStrings cfg.mirroredBoots (args: ''
         ${pkgs.perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@

nixos/modules/system/etc/etc.nix

@@ -154,7 +154,7 @@ in
       ''
         # Set up the statically computed bits of /etc.
         echo "setting up /etc..."
-        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl ${./setup-etc.pl} ${etc}/etc
+        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} ${./setup-etc.pl} ${etc}/etc
       '';
 
   };

nixos/modules/testing/service-runner.nix

@@ -6,7 +6,7 @@ let
 
   makeScript = name: service: pkgs.writeScript "${name}-runner"
     ''
-      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl
+      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}
 
       use File::Slurp;
 

nixos/tests/all-tests.nix

@@ -109,6 +109,7 @@ in
   ipv6 = handleTest ./ipv6.nix {};
   jenkins = handleTest ./jenkins.nix {};
   #kafka = handleTest ./kafka.nix {}; # broken since openjdk: 8u181 -> 8u192
+  kerberos = handleTest tests/kerberos/default.nix {};
   kernel-latest = handleTest ./kernel-latest.nix {};
   kernel-lts = handleTest ./kernel-lts.nix {};
   keymap = handleTest ./keymap.nix {};

nixos/tests/kerberos/default.nix

@@ -0,0 +1,5 @@
+{ system ? builtins.currentSystem }:
+{
+  mit = import ./mit.nix { inherit system; };
+  heimdal = import ./heimdal.nix { inherit system; };
+}

nixos/tests/kerberos/heimdal.nix

@@ -0,0 +1,53 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-heimdal";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.heimdalFull;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kadmin -l init --realm-max-ticket-life='8 day' \\
+       --realm-max-renewable-life='10 day' FOO.BAR"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+    $machine->waitForUnit("kpasswdd.service");
+
+    $machine->succeed(
+      "kadmin -l add --password=admin_pw --use-defaults admin"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=admin.keytab admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -K admin.keytab add --password=alice_pw --use-defaults \\
+       alice"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=alice.keytab alice"
+    );
+    $machine->succeed("kinit -kt alice.keytab alice");
+  '';
+})

nixos/tests/kerberos/mit.nix

@@ -0,0 +1,45 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-mit";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.krb5Full;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+    users.extraUsers.alice = { isNormalUser = true; };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kdb5_util create -s -r FOO.BAR -P master_key"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+
+    $machine->succeed(
+      "kadmin.local add_principal -pw admin_pw admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -w admin_pw addprinc -pw alice_pw alice"
+    );
+    $machine->succeed("echo alice_pw | sudo -u alice kinit");
+  '';
+})

pkgs/applications/altcoins/parity-ui/default.nix

@@ -34,8 +34,6 @@ in stdenv.mkDerivation rec {
 
     find $out/share/parity-ui -name "*.node" -exec patchelf --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" {} \;
 
-    paxmark m $out/share/parity-ui/parity-ui
-
     mkdir -p $out/bin
     ln -s $out/share/parity-ui/parity-ui $out/bin/parity-ui
   '';

pkgs/applications/audio/abcde/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, libcdio-paranoia, cddiscid, wget, which, vorbis-tools, id3v2, eyeD3
 , lame, flac, glyr
-, perl, MusicBrainz, MusicBrainzDiscID
+, perlPackages
 , makeWrapper }:
 
 let version = "2.9.2";
@@ -29,7 +29,7 @@ in
 
     nativeBuildInputs = [ makeWrapper ];
 
-    buildInputs = [ perl MusicBrainz MusicBrainzDiscID ];
+    buildInputs = with perlPackages; [ perl MusicBrainz MusicBrainzDiscID ];
 
     installFlags = [ "sysconfdir=$(out)/etc" ];
 

pkgs/applications/audio/crip/default.nix

@@ -2,7 +2,6 @@
 , fetchurl
 , makeWrapper
 
-, perl
 , perlPackages
 
 , cdparanoia
@@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pk9152wll6fmkj1pki3fz3ijlf06jyk32v31yarwvdkwrk7s9xz";
   };
 
-  buildInputs = [ perl perlPackages.CDDB_get ];
+  buildInputs = [ perlPackages.perl perlPackages.CDDB_get ];
   nativeBuildInputs = [ makeWrapper ];
 
   toolDeps = makeBinPath [
@@ -53,7 +52,7 @@ stdenv.mkDerivation rec {
         --replace '$editor = "vim";' '$editor = "${nano}/bin/nano";'
 
       wrapProgram $out/bin/$script \
-        --set PERL5LIB "${makePerlPath [ perlPackages.CDDB_get ]}" \
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.CDDB_get ]}" \
         --set PATH "${toolDeps}"
     done
   '';

pkgs/applications/audio/fluidsynth/default.nix

@@ -11,8 +11,8 @@ let
       sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
     };
     "2" = {
-      fluidsynthVersion = "2.0.1";
+      fluidsynthVersion = "2.0.2";
-      sha256 = "1mqyym5qkh8xd1rqj3yhfxbw5dxjcrljb6nkfqzvcarlv4h6rjn7";
+      sha256 = "02vs5sfsyh1dl7wlcvgs4w3x0qcmsl7vi000qgp99ynwh3wjb274";
     };
   };
 in

pkgs/applications/audio/lollypop/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchgit, meson, ninja, pkgconfig
 , python3, gtk3, gst_all_1, libsecret, libsoup
-, appstream-glib, desktop-file-utils, gnome3
+, appstream-glib, desktop-file-utils, totem-pl-parser
 , gobject-introspection, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec  {
@@ -28,7 +28,6 @@ python3.pkgs.buildPythonApplication rec  {
   ];
 
   buildInputs = with gst_all_1; [
-    gnome3.totem-pl-parser
     gst-libav
     gst-plugins-bad
     gst-plugins-base
@@ -38,6 +37,7 @@ python3.pkgs.buildPythonApplication rec  {
     gtk3
     libsecret
     libsoup
+    totem-pl-parser
   ];
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/applications/audio/rhythmbox/default.nix

@@ -6,6 +6,7 @@
 , intltool
 , libsoup
 , gnome3
+, totem-pl-parser
 , tdb
 , json-glib
 , itstool
@@ -48,7 +49,7 @@ in stdenv.mkDerivation rec {
 
     gtk3
     gnome3.libpeas
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.defaultIconTheme
 
     gst_all_1.gstreamer

pkgs/applications/editors/atom/default.nix

@@ -70,9 +70,6 @@ let
       ln -s ${pkgs.git}/bin/git $dugite/git/libexec/git-core/git
 
       find $share -name "*.node" -exec patchelf --set-rpath "${atomEnv.libPath}:$share" {} \;
-
-      paxmark m $share/atom
-      paxmark m $share/resources/app/apm/bin/node
     '';
 
     meta = with stdenv.lib; {

pkgs/applications/editors/gnome-builder/default.nix

@@ -7,6 +7,7 @@
 , flatpak
 , glibcLocales
 , gnome3
+, libgit2-glib
 , gobject-introspection
 , gspell
 , gtk-doc
@@ -26,6 +27,7 @@
 , sysprof
 , template-glib
 , vala
+, vte
 , webkitgtk
 , wrapGAppsHook
 }:
@@ -61,9 +63,9 @@ in stdenv.mkDerivation {
     ctags
     flatpak
     gnome3.devhelp
-    gnome3.libgit2-glib
+    libgit2-glib
     gnome3.libpeas
-    gnome3.vte
+    vte
     gspell
     gtk3
     gtksourceview4

pkgs/applications/graphics/feh/default.nix

@@ -35,9 +35,9 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
+  checkInputs = [ perlPackages.TestCommand ];
   preCheck = ''
-    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
+    export PERL5LIB="${perlPackages.TestCommand}/${perlPackages.perl.libPrefix}"
   '';
 
   doCheck = true;

pkgs/applications/graphics/shotwell/default.nix

@@ -1,5 +1,5 @@
 { fetchurl, stdenv, meson, ninja, gtk3, libexif, libgphoto2, libsoup, libxml2, vala, sqlite
-, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib
+, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib, gcr
 , gettext, desktop-file-utils, gdk_pixbuf, librsvg, wrapGAppsHook
 , gobject-introspection, itstool, libgdata, python3 }:
 
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.libgee
     libgudev gnome3.gexiv2 gnome3.gsettings-desktop-schemas
     libraw json-glib glib gdk_pixbuf librsvg gnome3.rest
-    gnome3.gcr gnome3.defaultIconTheme libgdata
+    gcr gnome3.defaultIconTheme libgdata
   ];
 
   postPatch = ''

pkgs/applications/graphics/shutter/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
+{ stdenv, fetchurl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
 , hicolor-icon-theme, procps
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl procps gdk_pixbuf librsvg ] ++ perlModules;
+  buildInputs = [ perlPackages.perl procps gdk_pixbuf librsvg ] ++ perlModules;
 
   installPhase = ''
     mkdir -p "$out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     (cd "$out" && mv CHANGES README COPYING "$out/share/doc/shutter")
 
     wrapProgram $out/bin/shutter \
-      --set PERL5LIB "${stdenv.lib.makePerlPath perlModules}" \
+      --set PERL5LIB "${perlPackages.makePerlPath perlModules}" \
       --prefix PATH : "${imagemagick.out}/bin" \
       --suffix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"

pkgs/applications/misc/extract_url/default.nix

@@ -1,14 +1,13 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, perl
+{ stdenv, lib, fetchFromGitHub, makeWrapper, perlPackages
-, MIMEtools, HTMLParser
+, cursesSupport ? true
-, cursesSupport ? true, CursesUI
+, uriFindSupport ? true
-, uriFindSupport ? true, URIFind
 }:
 
 let
   perlDeps =
-    [ MIMEtools HTMLParser ]
+    [ perlPackages.MIMEtools perlPackages.HTMLParser ]
-    ++ lib.optional cursesSupport CursesUI
+    ++ lib.optional cursesSupport perlPackages.CursesUI
-    ++ lib.optional uriFindSupport URIFind;
+    ++ lib.optional uriFindSupport perlPackages.URIFind;
 
 in stdenv.mkDerivation rec {
   name = "extract_url-${version}";
@@ -22,14 +21,14 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ] ++ perlDeps;
+  buildInputs = [ perlPackages.perl ] ++ perlDeps;
 
   makeFlags = [ "prefix=$(out)" ];
   installFlags = [ "INSTALL=install" ];
 
   postFixup = ''
     wrapProgram "$out/bin/extract_url" \
-      --set PERL5LIB "${lib.makeFullPerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makeFullPerlPath perlDeps}"
   '';
 
   meta = with lib; {

pkgs/applications/misc/ikiwiki/default.nix

@@ -1,13 +1,9 @@
-{ stdenv, fetchurl, perl, gettext, makeWrapper, PerlMagick, YAML
+{ stdenv, fetchurl, perlPackages, gettext, makeWrapper, PerlMagick, which
-, TextMarkdown, URI, HTMLParser, HTMLScrubber, HTMLTemplate, TimeDate
-, CGISession, CGIFormBuilder, DBFile, LocaleGettext, RpcXML, XMLSimple
-, YAMLLibYAML, which, HTMLTree, AuthenPassphrase, NetOpenIDConsumer
-, LWPxParanoidAgent, CryptSSLeay
 , gitSupport ? false, git ? null
 , docutilsSupport ? false, python ? null, docutils ? null
 , monotoneSupport ? false, monotone ? null
 , bazaarSupport ? false, bazaar ? null
-, cvsSupport ? false, cvs ? null, cvsps ? null, Filechdir ? null
+, cvsSupport ? false, cvs ? null, cvsps ? null
 , subversionSupport ? false, subversion ? null
 , mercurialSupport ? false, mercurial ? null
 , extraUtils ? []
@@ -17,7 +13,7 @@ assert docutilsSupport -> (python != null && docutils != null);
 assert gitSupport -> (git != null);
 assert monotoneSupport -> (monotone != null);
 assert bazaarSupport -> (bazaar != null);
-assert cvsSupport -> (cvs != null && cvsps != null && Filechdir != null);
+assert cvsSupport -> (cvs != null && cvsps != null && perlPackages.Filechdir != null);
 assert subversionSupport -> (subversion != null);
 assert mercurialSupport -> (mercurial != null);
 
@@ -35,20 +31,21 @@ stdenv.mkDerivation {
     sha256 = "00d7yzv426fvqbhvzyafddv7fa6b4j2647b0wi371wd5yjj9j3sz";
   };
 
-  buildInputs = [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
+  buildInputs = [ which ]
-    TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
+    ++ (with perlPackages; [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
-    RpcXML XMLSimple PerlMagick YAML YAMLLibYAML which HTMLTree AuthenPassphrase
+          TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
-    NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ]
+          RpcXML XMLSimple PerlMagick YAML YAMLLibYAML HTMLTree AuthenPassphrase
+          NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ])
     ++ lib.optionals docutilsSupport [python docutils]
     ++ lib.optionals gitSupport [git]
     ++ lib.optionals monotoneSupport [monotone]
     ++ lib.optionals bazaarSupport [bazaar]
-    ++ lib.optionals cvsSupport [cvs cvsps Filechdir]
+    ++ lib.optionals cvsSupport [cvs cvsps perlPackages.Filechdir]
     ++ lib.optionals subversionSupport [subversion]
     ++ lib.optionals mercurialSupport [mercurial];
 
   patchPhase = ''
-    sed -i s@/usr/bin/perl@${perl}/bin/perl@ pm_filter mdwn2man
+    sed -i s@/usr/bin/perl@${perlPackages.perl}/bin/perl@ pm_filter mdwn2man
     sed -i s@/etc/ikiwiki@$out/etc@ Makefile.PL
     sed -i /ENV{PATH}/d ikiwiki.in
     # State the gcc dependency, and make the cgi use our wrapper
@@ -60,7 +57,7 @@ stdenv.mkDerivation {
 
   postInstall = ''
     for a in "$out/bin/"*; do
-      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perl}/bin:$out/bin \
+      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perlPackages.perl}/bin:$out/bin \
       ${lib.optionalString gitSupport ''--prefix PATH : ${git}/bin \''}
       ${lib.optionalString monotoneSupport ''--prefix PATH : ${monotone}/bin \''}
       ${lib.optionalString bazaarSupport ''--prefix PATH : ${bazaar}/bin \''}

pkgs/applications/misc/plank/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, vala, atk, cairo, glib, gnome3, gtk3, libwnck3
 , libX11, libXfixes, libXi, pango, intltool, pkgconfig, libxml2
-, bamf, gdk_pixbuf, libdbusmenu-gtk3, file
+, bamf, gdk_pixbuf, libdbusmenu-gtk3, file, gnome-menus
 , wrapGAppsHook, autoreconfHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  buildInputs = [ vala atk cairo glib gnome3.gnome-menus
+  buildInputs = [ vala atk cairo glib gnome-menus
                   gtk3 gnome3.libgee libwnck3 libX11 libXfixes
                   libXi pango gnome3.gnome-common bamf gdk_pixbuf
                   libdbusmenu-gtk3 gnome3.dconf ];

pkgs/applications/misc/pmenu/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, python2Packages, gnome3 }:
+{ stdenv, fetchFromGitLab, python2Packages, gnome-menus }:
 
 stdenv.mkDerivation rec {
   name = "pmenu-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ python2Packages.wrapPython ];
 
-  buildInputs = [ python2Packages.pygtk gnome3.gnome-menus ];
+  buildInputs = [ python2Packages.pygtk gnome-menus ];
 
   pythonPath = [ python2Packages.pygtk ];
     

pkgs/applications/misc/qdirstat/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qmake
 , coreutils, xdg_utils, bash
-, perl, makeWrapper, perlPackages }:
+, makeWrapper, perlPackages }:
 
 let
   version = "1.4";
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ qmake makeWrapper ];
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
 
   preBuild = ''
     substituteInPlace scripts/scripts.pro \
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/qdirstat-cache-writer \
-      --set PERL5LIB "${stdenv.lib.makePerlPath [ perlPackages.URI ]}"
+      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.URI ]}"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/misc/rxvt_unicode/default.nix

@@ -51,8 +51,8 @@ stdenv.mkDerivation (rec {
     ''
     # make urxvt find its perl file lib/perl5/site_perl is added to PERL5LIB automatically
     + stdenv.lib.optionalString perlSupport ''
-      mkdir -p $out/lib/perl5
+      mkdir -p $(dirname ${perl.libPrefix})
-      ln -s $out/{lib/urxvt,lib/perl5/site_perl}
+      ln -s $out/lib/urxvt $out/${perl.libPrefix}
     '';
 
   postInstall = ''

pkgs/applications/misc/slic3r/default.nix

@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pg4jxzb7f58ls5s8mygza8kqdap2c50kwlsdkf28bz1xi611zbi";
   };
 
-  buildInputs = 
+  buildInputs =
-  [boost] ++ 
+  [boost] ++
   (with perlPackages; [ perl makeWrapper which
-    EncodeLocale MathClipper ExtUtilsXSpp threads
+    EncodeLocale MathClipper ExtUtilsXSpp
     MathConvexHullMonotoneChain MathGeometryVoronoi MathPlanePath Moo
     IOStringy ClassXSAccessor Wx GrowlGNTP NetDBus ImportInto XMLSAX
     ExtUtilsMakeMaker OpenGL WxGLCanvas ModuleBuild LWP

pkgs/applications/misc/slic3r/prusa3d.nix

@@ -74,7 +74,6 @@ stdenv.mkDerivation rec {
     Moo
     NetDBus
     OpenGL
-    threads
     XMLSAX
   ]);
 

pkgs/applications/misc/terminator/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python2, keybinder3, intltool, file, gtk3, gobject-introspection
-, libnotify, wrapGAppsHook, gnome3
+, libnotify, wrapGAppsHook, vte
 }:
 
 python2.pkgs.buildPythonApplication rec {
@@ -12,7 +12,7 @@ python2.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ file intltool wrapGAppsHook gobject-introspection ];
-  buildInputs = [ gtk3 gnome3.vte libnotify keybinder3 ];
+  buildInputs = [ gtk3 vte libnotify keybinder3 ];
   propagatedBuildInputs = with python2.pkgs; [ pygobject3 psutil pycairo ];
 
   postPatch = ''

pkgs/applications/misc/termite/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk3, ncurses, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, pkgconfig, vte-ng, gtk3, ncurses, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "termite-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
 
-  buildInputs = [ vte gtk3 ncurses ];
+  buildInputs = [ vte-ng gtk3 ncurses ];
 
   nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
 

pkgs/applications/misc/yarssr/default.nix

@@ -1,8 +1,4 @@
-{
+{ fetchFromGitHub, stdenv, lib, gettext, gtk2, makeWrapper, perlPackages, gnome2 }:
-fetchFromGitHub, stdenv, lib,
-makeWrapper, pkgs,
-perl, perlPackages,
-gnome2 }:
 
 let
   perlDeps = with perlPackages; [
@@ -24,7 +20,7 @@ let
   ];
   libs = [
     stdenv.cc.cc.lib
-    pkgs.gtk2
+    gtk2
   ];
 in
 stdenv.mkDerivation rec {
@@ -38,7 +34,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x7hz8x8qyp3i1vb22zhcnvwxm3jhmmmlr22jqc5b09vpmbw1l45";
   };
 
-  nativeBuildInputs = [ perl pkgs.gettext makeWrapper ];
+  nativeBuildInputs = [ perlPackages.perl gettext makeWrapper ];
   buildInputs = perlDeps ++ [gnome2.libglade];
   propagatedBuildInputs = libs ++ perlDeps;
 
@@ -55,7 +51,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     wrapProgram $out/bin/yarssr \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath libs} \
-      --set PERL5LIB "${lib.makePerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makePerlPath perlDeps}"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/networking/browsers/chromium/common.nix

@@ -282,8 +282,6 @@ let
           MENUNAME="Chromium"
           process_template chrome/app/resources/manpage.1.in "${buildPath}/chrome.1"
         )
-      '' + optionalString (target == "mksnapshot" || target == "chrome") ''
-        paxmark m "${buildPath}/${target}"
       '';
       targets = extraAttrs.buildTargets or [];
       commands = map buildCommand targets;

pkgs/applications/networking/browsers/firefox/common.nix

@@ -263,20 +263,12 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = false; # "--disable-tests" above
 
-  preInstall = ''
-    # The following is needed for startup cache creation on grsecurity kernels.
-    paxmark m dist/bin/xpcshell
-  '';
-
   installPhase = if stdenv.isDarwin then ''
     mkdir -p $out/Applications
     cp -LR dist/Firefox.app $out/Applications
   '' else null;
 
   postInstall = lib.optionalString stdenv.isLinux ''
-    # For grsecurity kernels
-    paxmark m $out/lib/firefox*/{firefox,firefox-bin,plugin-container}
-
     # Remove SDK cruft. FIXME: move to a separate output?
     rm -rf $out/share/idl $out/include $out/lib/firefox-devel-*
 

pkgs/applications/networking/browsers/midori/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook
+{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook, gcr
 , gtk3, webkitgtk, sqlite, gsettings-desktop-schemas, libsoup, glib-networking, gnome3
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk3 webkitgtk sqlite gsettings-desktop-schemas gnome3.gcr
+    gtk3 webkitgtk sqlite gsettings-desktop-schemas gcr
     (libsoup.override { gnomeSupport = true; }) gnome3.libpeas
     glib-networking
   ];

pkgs/applications/networking/browsers/w3m/default.nix

@@ -4,7 +4,7 @@
 , graphicsSupport ? true, imlib2 ? null
 , x11Support ? graphicsSupport, libX11 ? null
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses ? null
-, perl, man, pkgconfig
+, perl, man, pkgconfig, buildPackages, w3m
 }:
 
 assert sslSupport -> openssl != null;
@@ -14,7 +14,17 @@ assert mouseSupport -> gpm-ncurses != null;
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+let
+  mktable = buildPackages.stdenv.mkDerivation rec {
+    name = "w3m-mktable";
+    inherit (w3m) src;
+    nativeBuildInputs = [ pkgconfig boehmgc ];
+    makeFlags = [ "mktable" ];
+    installPhase = ''
+      install -D mktable $out/bin/mktable
+    '';
+  };
+in stdenv.mkDerivation rec {
   name = "w3m-0.5.3+git20180125";
 
   src = fetchFromGitHub {
@@ -31,6 +41,8 @@ stdenv.mkDerivation rec {
   PERL = "${perl}/bin/perl";
   MAN = "${man}/bin/man";
 
+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
   patches = [
     ./RAND_egd.libressl.patch
     (fetchpatch {
@@ -40,8 +52,14 @@ stdenv.mkDerivation rec {
     })
   ] ++ optional (graphicsSupport && !x11Support) [ ./no-x11.patch ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  postPatch = optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-  buildInputs = [ ncurses boehmgc gettext zlib ]
+    ln -s ${mktable}/bin/mktable mktable
+    # stop make from recompiling mktable
+    sed -ie 's!mktable.*:.*!mktable:!' Makefile.in
+  '';
+
+  nativeBuildInputs = [ pkgconfig gettext ];
+  buildInputs = [ ncurses boehmgc zlib ]
     ++ optional sslSupport openssl
     ++ optional mouseSupport gpm-ncurses
     ++ optional graphicsSupport imlib2

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
         patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
                  $out/opt/discord/Discord
 
-        paxmark m $out/opt/discord/Discord
-
         wrapProgram $out/opt/discord/Discord --prefix LD_LIBRARY_PATH : ${libPath}
 
         ln -s $out/opt/discord/Discord $out/bin/

pkgs/applications/networking/instant-messengers/franz/default.nix

@@ -54,7 +54,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/franz/Franz
     wrapProgram $out/opt/franz/Franz --prefix PATH : ${xdg_utils}/bin
   '';
 

pkgs/applications/networking/instant-messengers/wavebox/default.nix

@@ -52,7 +52,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/wavebox/Wavebox
     makeWrapper $out/opt/wavebox/Wavebox $out/bin/wavebox \
       --prefix PATH : ${xdg_utils}/bin
   '';

pkgs/applications/networking/irc/weechat/wrapper.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, runCommand, writeScriptBin, buildEnv
-, pythonPackages, perl, perlPackages
+, pythonPackages, perlPackages
 }:
 
 weechat:
@@ -10,7 +10,7 @@ let
   }:
 
   let
-    perlInterpreter = perl;
+    perlInterpreter = perlPackages.perl;
     availablePlugins = let
         simplePlugin = name: {pluginFile = "${weechat.${name}}/lib/weechat/plugins/${name}.so";};
       in rec {
@@ -29,7 +29,7 @@ let
           withPackages = pkgsFun: (perl // {
             extraEnv = ''
               ${perl.extraEnv}
-              export PERL5LIB=${lib.makeFullPerlPath (pkgsFun perlPackages)}
+              export PERL5LIB=${perlPackages.makeFullPerlPath (pkgsFun perlPackages)}
             '';
           });
         };

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -100,7 +100,7 @@ in stdenv.mkDerivation rec {
     ''
       cxxLib=$( echo -n ${gcc}/include/c++/* )
       archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
-  
+
       test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
 
       configureScript="$(realpath ./configure)"
@@ -108,18 +108,9 @@ in stdenv.mkDerivation rec {
       cd ../objdir
     '';
 
-  preInstall =
-    ''
-      # The following is needed for startup cache creation on grsecurity kernels.
-      paxmark m ../objdir/dist/bin/xpcshell
-    '';
-
   dontWrapGApps = true; # we do it ourselves
   postInstall =
     ''
-      # For grsecurity kernels
-      paxmark m $out/lib/thunderbird/thunderbird
-
       # TODO: Move to a dev output?
       rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
 

pkgs/applications/networking/newsreaders/pan/default.nix

@@ -2,7 +2,7 @@
 , stdenv, fetchurl, pkgconfig, gtk3, gtkspell3 ? null
 , perl, gmime2, gettext, intltool, itstool, libxml2, dbus-glib, libnotify, gnutls
 , makeWrapper, gnupg
-, gnomeSupport ? true, gnome3, libsecret
+, gnomeSupport ? true, libsecret, gcr
 }:
 
 assert spellChecking -> gtkspell3 != null;
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig gettext intltool itstool libxml2 makeWrapper ];
   buildInputs = [ gtk3 gmime2 libnotify gnutls ]
     ++ stdenv.lib.optional spellChecking gtkspell3
-    ++ stdenv.lib.optionals gnomeSupport [ libsecret gnome3.gcr ];
+    ++ stdenv.lib.optionals gnomeSupport [ libsecret gcr ];
 
   configureFlags = [
     "--with-dbus"

pkgs/applications/networking/sieve-connect/default.nix

@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl, perlPackages }: stdenv.mkDerivation rec {
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages }:
+
+stdenv.mkDerivation rec {
   name = "sieve-connect-${version}";
   version = "0.89";
 
@@ -9,7 +11,7 @@
     sha256 = "0g7cv29wd5673inl4c87xb802k86bj6gcwh131xrbbg0a0g1c8fp";
   };
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
   nativeBuildInputs = [ makeWrapper ];
 
   preBuild = ''
@@ -20,7 +22,7 @@
     echo "$(date +%Y-%m-%d)" > datefile
   '';
 
-  buildFlags = [ "PERL5LIB=${stdenv.lib.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
+  buildFlags = [ "PERL5LIB=${perlPackages.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
@@ -28,9 +30,9 @@
     gzip -c sieve-connect.1 > $out/share/man/man1/sieve-connect.1.gz
 
     wrapProgram $out/bin/sieve-connect \
-      --prefix PERL5LIB : "${stdenv.lib.makePerlPath (with perlPackages; [
+      --prefix PERL5LIB : "${with perlPackages; makePerlPath [
-        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS PodUsage
+        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS
-        TermReadKey TermReadLineGnu ])}"
+        TermReadKey TermReadLineGnu ]}"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/networking/tsung/default.nix

@@ -1,7 +1,7 @@
 { fetchurl, stdenv, lib, makeWrapper,
   erlang,
   python2, python2Packages,
-  perl, perlPackages,
+  perlPackages,
   gnuplot }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     erlang
     gnuplot
-    perl
+    perlPackages.perl
     perlPackages.TemplateToolkit
     python2
     python2Packages.matplotlib
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     # Add Template Toolkit and gnuplot to tsung_stats.pl
     wrapProgram $out/bin/tsung_stats.pl \
         --prefix PATH : ${lib.makeBinPath [ gnuplot ]} \
-        --set PERL5LIB "${lib.makePerlPath [ perlPackages.TemplateToolkit ]}"
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.TemplateToolkit ]}"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/office/mendeley/default.nix

@@ -112,7 +112,6 @@ stdenv.mkDerivation {
     patchelf --set-interpreter $interpreter \
              --set-rpath ${stdenv.lib.makeLibraryPath deps}:$out/lib \
              $out/bin/mendeleydesktop
-    paxmark m $out/bin/mendeleydesktop
 
     wrapProgram $out/bin/mendeleydesktop \
       --add-flags "--unix-distro-build" \

pkgs/applications/science/biology/N3/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, MNI-Perllib, GetoptTabular,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl MNI-Perllib GetoptTabular ];
+  propagatedBuildInputs = with perlPackages; [ perl MNI-Perllib GetoptTabular ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 

pkgs/applications/science/biology/conglomerate/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, fetchFromGitHub, cmake, coreutils, perl, bicpl, libminc, zlib, minc_tools,
+{ stdenv, fetchFromGitHub, cmake, coreutils, perlPackages, bicpl, libminc, zlib, minc_tools,
-  makeWrapper, GetoptTabular, MNI-Perllib }:
+  makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "conglomerate";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc zlib bicpl ];
-  propagatedBuildInputs = [ coreutils minc_tools perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = [ coreutils minc_tools ] ++ (with perlPackages; [ perl GetoptTabular MNI-Perllib ]);
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBICPL_DIR=${bicpl}/lib/" ];
 

pkgs/applications/science/biology/inormalize/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 

pkgs/applications/science/biology/minc-tools/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perl, TextFormat, libminc, libjpeg, zlib }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perlPackages, libminc, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "minc-tools";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake flex bison makeWrapper ];
   buildInputs = [ libminc libjpeg zlib ];
-  propagatedBuildInputs = [ perl TextFormat ];
+  propagatedBuildInputs = with perlPackages; [ perl TextFormat ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" ];
 

pkgs/applications/science/biology/minc-widgets/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, octave, coreutils, minc_tools }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib octave coreutils minc_tools ];
+  propagatedBuildInputs = (with perlPackages; [ perl GetoptTabular MNI-Perllib ]) ++ [ octave coreutils minc_tools ];
 
   postFixup = ''
     for p in $out/bin/*; do

pkgs/applications/science/biology/mni_autoreg/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, perl, GetoptTabular, MNI-Perllib, libminc }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, perlPackages, libminc }:
 
 stdenv.mkDerivation rec {
   pname = "mni_autoreg";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBUILD_TESTING=FALSE" ];
   # testing broken: './minc_wrapper: Permission denied' from Testing/ellipse0.mnc

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -1,5 +1,5 @@
 { fetchurl, stdenv, buildPackages
-, curl, openssl, zlib, expat, perl, python, gettext, cpio
+, curl, openssl, zlib, expat, perlPackages, python, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
@@ -59,11 +59,11 @@ stdenv.mkDerivation {
         --subst-var-by gettext ${gettext}
   '';
 
-  nativeBuildInputs = [ gettext perl ]
+  nativeBuildInputs = [ gettext perlPackages.perl ]
     ++ stdenv.lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
-    ++ stdenv.lib.optionals perlSupport [ perl ]
+    ++ stdenv.lib.optionals perlSupport [ perlPackages.perl ]
     ++ stdenv.lib.optionals guiSupport [tcl tk]
     ++ stdenv.lib.optionals withpcre2 [ pcre2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.Security ]
@@ -86,7 +86,7 @@ stdenv.mkDerivation {
     "prefix=\${out}"
     "SHELL_PATH=${stdenv.shell}"
   ]
-  ++ (if perlSupport then ["PERL_PATH=${perl}/bin/perl"] else ["NO_PERL=1"])
+  ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
   ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
@@ -133,7 +133,6 @@ stdenv.mkDerivation {
       # Install contrib stuff.
       mkdir -p $out/share/git
       cp -a contrib $out/share/git/
-      ln -s "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/
       mkdir -p $out/share/emacs/site-lisp
       ln -s "$out/share/git/contrib/emacs/"*.el $out/share/emacs/site-lisp/
       mkdir -p $out/etc/bash_completion.d
@@ -153,7 +152,7 @@ stdenv.mkDerivation {
             '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
             '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
             '${coreutils}/bin/wc', '${coreutils}/bin/tr'
-            ${stdenv.lib.optionalString perlSupport ", '${perl}/bin/perl'"}
+            ${stdenv.lib.optionalString perlSupport ", '${perlPackages.perl}/bin/perl'"}
           );
         }
         foreach $c (@a) {
@@ -174,47 +173,37 @@ stdenv.mkDerivation {
       mv $out/share/gitweb $gitweb/
 
       # wrap perl commands
-      gitperllib=$out/lib/perl5/site_perl
+      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/git-credential-netrc \
-      for i in ${builtins.toString perlLibs}; do
+                  --set PERL5LIB   "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
-        gitperllib=$gitperllib:$i/lib/perl5/site_perl
-      done
       wrapProgram $out/libexec/git-core/git-cvsimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-add--interactive \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-archimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-instaweb \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsexportcommit \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
     ''
 
-   + (if svnSupport then
+   + (if svnSupport then ''
-
+        # wrap git-svn
-      ''# wrap git-svn
+        wrapProgram $out/libexec/git-core/git-svn                                                                                \
-        gitperllib=$out/lib/perl5/site_perl
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
-        for i in ${builtins.toString perlLibs} ${svn.out}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
-        wrapProgram $out/libexec/git-core/git-svn     \
-                     --set GITPERLLIB "$gitperllib"   \
                      --prefix PATH : "${svn.out}/bin" ''
        else '' # replace git-svn by notification script
         notSupported $out/libexec/git-core/git-svn
-       '')
+     '')
 
-   + (if sendEmailSupport then
+   + (if sendEmailSupport then ''
-      ''# wrap git-send-email
+        # wrap git-send-email
-        gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString smtpPerlLibs}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
         wrapProgram $out/libexec/git-core/git-send-email \
-                     --set GITPERLLIB "$gitperllib" ''
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath smtpPerlLibs}"
-       else '' # replace git-send-email by notification script
+      '' else ''
+        # replace git-send-email by notification script
         notSupported $out/libexec/git-core/git-send-email
-       '')
+      '')
 
    + stdenv.lib.optionalString withManual ''# Install man pages and Info manual
        make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-info \
@@ -236,9 +225,9 @@ stdenv.mkDerivation {
    + stdenv.lib.optionalString stdenv.isDarwin ''
     # enable git-credential-osxkeychain by default if darwin
     cat > $out/etc/gitconfig << EOF
-[credential]
+    [credential]
-	helper = osxkeychain
+      helper = osxkeychain
-EOF
+    EOF
   '';
 
 

pkgs/applications/version-management/git-and-tools/gitweb/default.nix

@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
           $out/gitweb.cgi
       # Give access to CGI.pm and friends (was removed from perl core in 5.22)
       for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
-          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
+          sed -i -e "/use CGI /i use lib \"$p/${perlPackages.perl.libPrefix}\";" \
               "$out/gitweb.cgi"
       done
 

pkgs/applications/version-management/git-and-tools/grv/default.nix

@@ -1,11 +1,11 @@
-{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2_0_27, ncurses, pkgconfig, readline }:
+{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2, ncurses, pkgconfig, readline }:
 let
   version = "0.3.0";
 in
 buildGo19Package {
   name = "grv-${version}";
 
-  buildInputs = [ ncurses readline curl libgit2_0_27 ];
+  buildInputs = [ ncurses readline curl libgit2 ];
   nativeBuildInputs = [ pkgconfig ];
 
   goPackagePath = "github.com/rgburke/grv";

pkgs/applications/version-management/monotone/default.nix

@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/share/${name}
     cp -rv contrib/ $out/share/${name}/contrib
-    mkdir -p $out/lib/perl5/site_perl/${perlVersion}
+    mkdir -p $out/${perl.libPrefix}/${perlVersion}
-    cp -v contrib/Monotone.pm $out/lib/perl5/site_perl/${perlVersion}
+    cp -v contrib/Monotone.pm $out/${perl.libPrefix}/${perlVersion}
   '';
 
   #doCheck = true; # some tests fail (and they take VERY long)

pkgs/applications/version-management/vcsh/default.nix

@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, which, git, ronn, perl, ShellCommand
+{ stdenv, fetchFromGitHub, which, git, ronn, perlPackages }:
-, TestMost, TestDifferences, TestDeep, TestException, TestWarn
-}:
 
 stdenv.mkDerivation rec {
   version = "1.20170915";       # date of commit we're pulling
@@ -13,10 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wfzp8167lcq6akdpbi8fikjv0z3h1i5minh3423dljc04q0klm1";
   };
 
-  buildInputs = [
+  buildInputs = [ which git ronn ]
-    which git ronn perl ShellCommand TestMost TestDifferences TestDeep
+    ++ (with perlPackages; [ perl ShellCommand TestMost TestDifferences TestDeep TestException TestWarn ]);
-    TestException TestWarn
-  ];
 
   installPhase = "make install PREFIX=$out";
 

pkgs/applications/video/pitivi/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, itstool, python3, wrapGAppsHook
 , python3Packages, gst_all_1, gtk3
-, gobject-introspection, librsvg, gnome3, libnotify
+, gobject-introspection, librsvg, gnome3, libnotify, gsound
 , meson, ninja
 }:
 
@@ -47,7 +47,7 @@ in python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [ meson ninja pkgconfig intltool itstool python3 wrapGAppsHook ];
 
   buildInputs = [
-    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gnome3.gsound
+    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gsound
     gnome3.defaultIconTheme
     gnome3.gsettings-desktop-schemas libnotify
     gst-transcoder

pkgs/applications/virtualization/qemu/default.nix

@@ -8,7 +8,7 @@
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, gnome3
+, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, vte
 , vncSupport ? true, libjpeg, libpng
 , smartcardSupport ? true, libcacard
 , spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     ++ optionals numaSupport [ numactl ]
     ++ optionals pulseSupport [ libpulseaudio ]
     ++ optionals sdlSupport [ SDL2 ]
-    ++ optionals gtkSupport [ gtk3 gettext gnome3.vte ]
+    ++ optionals gtkSupport [ gtk3 gettext vte ]
     ++ optionals vncSupport [ libjpeg libpng ]
     ++ optionals smartcardSupport [ libcacard ]
     ++ optionals spiceSupport [ spice-protocol spice ]
@@ -125,9 +125,6 @@ stdenv.mkDerivation rec {
 
   postFixup =
     ''
-      for exe in $out/bin/qemu-system-* ; do
-        paxmark m $exe
-      done
       # copy qemu-ga (guest agent) to separate output
       mkdir -p $ga/bin
       cp $out/bin/qemu-ga $ga/bin/

pkgs/build-support/writers/default.nix

@@ -192,12 +192,12 @@ rec {
       name = "perl-environment";
       paths = libraries;
       pathsToLink = [
-        "/lib/perl5/site_perl"
+        "/${pkgs.perl.libPrefix}"
       ];
     };
   in
   makeScriptWriter {
-    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/lib/perl5/site_perl";
+    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/${pkgs.perl.libPrefix}";
   } name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)

pkgs/data/misc/iana-etc/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchzip }:
 
 let
-  version = "20180905";
+  version = "20181219";
 in fetchzip {
   name = "iana-etc-${version}";
   url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-  sha256 = "1vl3by24xddl267cjq9bcwb7yvfd7gqalwgd5sgx8i7kz9bk40q2";
+  sha256 = "0i3f7shvf1g6dp984w8xfix6id3q5c10b292wz2qw3v5n7h6wkm3";
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1

pkgs/desktops/deepin/default.nix

@@ -23,7 +23,7 @@ let
     deepin-shortcut-viewer = callPackage ./deepin-shortcut-viewer { };
     deepin-sound-theme = callPackage ./deepin-sound-theme { };
     deepin-terminal = callPackage ./deepin-terminal {
-      inherit (pkgs.gnome3) libgee vte;
+      inherit (pkgs.gnome3) libgee;
       wnck = pkgs.libwnck3;
     };
     deepin-wallpapers = callPackage ./deepin-wallpapers { };

pkgs/desktops/gnome-3/apps/seahorse/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, vala, meson, ninja
 , pkgconfig, gtk3, glib, gobject-introspection
 , wrapGAppsHook, itstool, gnupg, libsoup
-, gnome3, gpgme, python3, openldap
+, gnome3, gpgme, python3, openldap, gcr
 , libsecret, avahi, p11-kit, openssh }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     python3 gobject-introspection
   ];
   buildInputs = [
-    gtk3 glib gnome3.gcr
+    gtk3 glib gcr
     gnome3.gsettings-desktop-schemas gnupg
     gnome3.defaultIconTheme gpgme
     libsecret avahi libsoup p11-kit

pkgs/desktops/gnome-3/core/evolution-data-server/default.nix

@@ -1,5 +1,5 @@
 { fetchurl, stdenv, substituteAll, pkgconfig, gnome3, python3, gobject-introspection
-, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3
+, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3, gcr
 , p11-kit, db, nspr, nss, libical, gperf, wrapGAppsHook, glib-networking, pcre
 , vala, cmake, ninja, kerberos, openldap, webkitgtk, libaccounts-glib, json-glib }:
 

pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, meson, ninja, gettext, pkgconfig, spidermonkey_52, glib
-, gnome3, substituteAll }:
+, gnome3, gnome-menus, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "gnome-shell-extensions-${version}";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix_gmenu.patch;
-      gmenu_path = "${gnome3.gnome-menus}/lib/girepository-1.0";
+      gmenu_path = "${gnome-menus}/lib/girepository-1.0";
     })
   ];
 

pkgs/desktops/gnome-3/core/gnome-shell/default.nix

@@ -2,8 +2,8 @@
 , python3Packages, libsoup, polkit, clutter, networkmanager, docbook_xsl , docbook_xsl_ns, at-spi2-core
 , libstartup_notification, telepathy-glib, telepathy-logger, libXtst, unzip, glibcLocales, shared-mime-info
 , libgweather, libcanberra-gtk3, librsvg, geoclue2, perl, docbook_xml_dtd_42, desktop-file-utils
-, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt
+, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt, gcr
-, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet
+, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet, libgnomekbd
 , sassc, systemd, gst_all_1 }:
 
 # http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/gnome-base/gnome-shell/gnome-shell-3.10.2.1.ebuild?revision=1.3&view=markup
@@ -56,8 +56,7 @@ in stdenv.mkDerivation rec {
     })
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit (gnome3) libgnomekbd;
+      inherit libgnomekbd unzip;
-      inherit unzip;
     })
   ];
 

pkgs/desktops/gnome-3/core/grilo-plugins/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, sqlite
 , gnome3, libxml2, gupnp, gssdp, lua5, liboauth, gupnp-av
-, gmime, json-glib, avahi, tracker, dleyna-server, itstool }:
+, gmime, json-glib, avahi, tracker, dleyna-server, itstool, totem-pl-parser }:
 
 let
   pname = "grilo-plugins";
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     gnome3.grilo libxml2 gupnp gssdp gnome3.libgdata
     lua5 liboauth gupnp-av sqlite gnome3.gnome-online-accounts
-    gnome3.totem-pl-parser gnome3.rest gmime json-glib
+    totem-pl-parser gnome3.rest gmime json-glib
     avahi gnome3.libmediaart tracker dleyna-server
   ];
 

pkgs/desktops/gnome-3/core/grilo/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, vala, glib, liboauth, gtk3
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43
-, libxml2, gnome3, gobject-introspection, libsoup }:
+, libxml2, gnome3, gobject-introspection, libsoup, totem-pl-parser }:
 
 let
   pname = "grilo";
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     meson ninja pkgconfig gettext gobject-introspection vala
     gtk-doc docbook_xsl docbook_xml_dtd_43
   ];
-  buildInputs = [ glib liboauth gtk3 libxml2 libsoup gnome3.totem-pl-parser ];
+  buildInputs = [ glib liboauth gtk3 libxml2 libsoup totem-pl-parser ];
 
   passthru = {
     updateScript = gnome3.updateScript {

pkgs/desktops/gnome-3/core/totem/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, intltool, gst_all_1
 , clutter-gtk, clutter-gst, python3Packages, shared-mime-info
-, pkgconfig, gtk3, glib, gobject-introspection
+, pkgconfig, gtk3, glib, gobject-introspection, totem-pl-parser
 , wrapGAppsHook, itstool, libxml2, vala, gnome3
 , gdk_pixbuf, tracker, nautilus }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja vala pkgconfig intltool python3Packages.python itstool gobject-introspection wrapGAppsHook ];
   buildInputs = [
-    gtk3 glib gnome3.grilo clutter-gtk clutter-gst gnome3.totem-pl-parser gnome3.grilo-plugins
+    gtk3 glib gnome3.grilo clutter-gtk clutter-gst totem-pl-parser gnome3.grilo-plugins
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly gst_all_1.gst-libav gnome3.libpeas shared-mime-info
     gdk_pixbuf libxml2 gnome3.defaultIconTheme gnome3.gnome-desktop

pkgs/desktops/gnome-3/core/tracker-miners/default.nix

@@ -2,7 +2,7 @@
 , meson, ninja, pkgconfig, vala, wrapGAppsHook, bzip2, dbus, evolution-data-server
 , exempi, flac, giflib, glib, gnome3, gst_all_1, icu, json-glib, libcue, libexif
 , libgrss, libgsf, libiptcdata, libjpeg, libpng, libseccomp, libsoup, libtiff, libuuid
-, libvorbis, libxml2, poppler, taglib, upower }:
+, libvorbis, libxml2, poppler, taglib, upower, totem-pl-parser }:
 
 let
   pname = "tracker-miners";
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
     giflib
     glib
     gnome3.gexiv2
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.tracker
     gst_all_1.gst-plugins-base
     gst_all_1.gstreamer

pkgs/desktops/gnome-3/default.nix

@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd vte vte_290 vte-ng gnome-menus;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -47,6 +47,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   gtkmm = gtkmm3;
   vala = pkgs.vala_0_42;
   gegl_0_4 = pkgs.gegl_0_4.override { inherit gtk; };
+  rest = librest;
 
 # Simplify the nixos module and gnome packages
   defaultIconTheme = adwaita-icon-theme;
@@ -73,10 +74,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   evolution-data-server = callPackage ./core/evolution-data-server { };
 
-  geocode-glib = callPackage ./core/geocode-glib { };
-
-  gcr = callPackage ./core/gcr { }; # ToDo: tests fail
-
   gdm = callPackage ./core/gdm { };
 
   gjs = callPackage ./core/gjs { };
@@ -107,16 +104,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-font-viewer = callPackage ./core/gnome-font-viewer { };
 
-  gnome-menus = callPackage ./core/gnome-menus { };
-
   gnome-keyring = callPackage ./core/gnome-keyring { };
 
   libgnome-keyring = callPackage ./core/libgnome-keyring { };
 
-  libgnomekbd = callPackage ./core/libgnomekbd { };
-
-  folks = callPackage ./core/folks { };
-
   gnome-online-accounts = callPackage ./core/gnome-online-accounts { };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
@@ -153,30 +144,12 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gsettings-desktop-schemas = callPackage ./core/gsettings-desktop-schemas { };
 
-  gsound = callPackage ./core/gsound { };
-
   gucharmap = callPackage ./core/gucharmap { };
 
   gvfs = pkgs.gvfs.override { gnome = gnome3; gnomeSupport = true; };
 
   eog = callPackage ./core/eog { };
 
-  libcroco = callPackage ./core/libcroco {};
-
-  libgee = callPackage ./core/libgee { };
-
-  libgepub = callPackage ./core/libgepub { };
-
-  libgdata = callPackage ./core/libgdata { };
-
-  libgxps = callPackage ./core/libgxps { };
-
-  libpeas = callPackage ./core/libpeas {};
-
-  libgweather = callPackage ./core/libgweather { };
-
-  libzapojit = callPackage ./core/libzapojit { };
-
   mutter = callPackage ./core/mutter { };
 
   # Needed for elementary's gala and greeter until they get around to adapting to all the API breaking changes in libmutter-3
@@ -214,8 +187,6 @@ lib.makeScope pkgs.newScope (self: with self; {
     withGnome = true;
   };
 
-  rest = callPackage ./core/rest { };
-
   rygel = callPackage ./core/rygel { };
 
   simple-scan = callPackage ./core/simple-scan { };
@@ -224,18 +195,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   totem = callPackage ./core/totem { };
 
-  totem-pl-parser = callPackage ./core/totem-pl-parser { };
-
   tracker = callPackage ./core/tracker { };
 
   tracker-miners = callPackage ./core/tracker-miners { };
 
-  vte = callPackage ./core/vte { };
-
-  vte_290 = callPackage ./core/vte/2.90.nix { };
-
-  vte-ng = callPackage ./core/vte/ng.nix { };
-
   vino = callPackage ./core/vino { };
 
   yelp = callPackage ./core/yelp { };
@@ -361,18 +324,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   geary = callPackage ./misc/geary { };
 
-  gfbgraph = callPackage ./misc/gfbgraph { };
-
   gitg = callPackage ./misc/gitg { };
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
 
-  libgit2-glib = callPackage ./misc/libgit2-glib { };
-
-  libmediaart = callPackage ./misc/libmediaart { };
-
-  gexiv2 = callPackage ./misc/gexiv2 { };
-
   gnome-applets = callPackage ./misc/gnome-applets { };
 
   gnome-flashback = callPackage ./misc/gnome-flashback { };

pkgs/desktops/gnome-3/misc/geary/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, intltool, pkgconfig, gtk3, vala_0_40, enchant
 , wrapGAppsHook, gdk_pixbuf, cmake, ninja, desktop-file-utils
 , libnotify, libcanberra-gtk3, libsecret, gmime, isocodes
-, gobject-introspection, libpthreadstubs, sqlite
+, gobject-introspection, libpthreadstubs, sqlite, gcr
 , gnome3, librsvg, gnome-doc-utils, webkitgtk, fetchpatch }:
 
 let
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ vala_0_40 intltool pkgconfig wrapGAppsHook cmake ninja desktop-file-utils gnome-doc-utils gobject-introspection ];
   buildInputs = [
     gtk3 enchant webkitgtk libnotify libcanberra-gtk3 gnome3.libgee libsecret gmime sqlite
-    libpthreadstubs gnome3.gsettings-desktop-schemas gnome3.gcr isocodes
+    libpthreadstubs gnome3.gsettings-desktop-schemas gcr isocodes
     gdk_pixbuf librsvg gnome3.defaultIconTheme
   ];
 

pkgs/desktops/gnome-3/misc/gitg/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, vala, intltool, pkgconfig, gtk3, glib
+{ stdenv, fetchurl, fetchpatch, vala, intltool, pkgconfig, gtk3, glib
 , json-glib, wrapGAppsHook, libpeas, bash, gobject-introspection
 , gnome3, gtkspell3, shared-mime-info, libgee, libgit2-glib, libsecret
 , meson, ninja, python3
@@ -15,6 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "1fz8q1aiql6k740savdjh0vzbyhcflgf94cfdhvzcrrvm929n2ss";
   };
 
+  patches = [
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gitg/commit/42bceea265f53fe7fd4a41037b936deed975fc6c.patch;
+      sha256 = "1xq245rsi1bi66lswk33pdiazfaagxf77836ds5q73900rx4r7fw";
+    })
+  ];
+
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py

pkgs/desktops/mate/mate-terminal/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, wrapGAppsHook }:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, gtk3, vte, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "mate-terminal-${version}";
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
      mate.mate-desktop
 
-     gnome3.vte
+     vte
-     gnome3.gtk
+     gtk3
      gnome3.dconf
   ];
 

pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
+{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, vte_290, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   majorVersion = "0.4";

pkgs/desktops/xfce4-13/default.nix

@@ -81,9 +81,7 @@ makeScope newScope (self: with self; {
 
   xfce4-taskmanager = callPackage ./xfce4-taskmanager { };
 
-  xfce4-terminal = callPackage ./xfce4-terminal {
+  xfce4-terminal = callPackage ./xfce4-terminal { };
-    inherit (gnome3) vte;
-  };
 
   xfce4-volumed-pulse = callPackage ./xfce4-volumed-pulse { };
 

pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix

@@ -61,14 +61,6 @@ let result = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    # Set PaX markings
-    exes=$(file $sourceRoot/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file"
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''}
-    done
-
     mv $sourceRoot $out
 
     rm -rf $out/demo

pkgs/development/compilers/gcc/builder.sh

@@ -282,11 +282,6 @@ postInstall() {
         fi
     done
 
-    # Disable RANDMMAP on grsec, which causes segfaults when using
-    # precompiled headers.
-    # See https://bugs.gentoo.org/show_bug.cgi?id=301299#c31
-    paxmark r $out/libexec/gcc/*/*/{cc1,cc1plus}
-
     # Two identical man pages are shipped (moving and compressing is done later)
     ln -sf gcc.1 "$out"/share/man/man1/g++.1
 }

pkgs/development/compilers/ghc/8.2.2-binary.nix

@@ -105,8 +105,6 @@ stdenv.mkDerivation rec {
           --replace-needed libtinfo.so libtinfo.so.5 \
           --interpreter ${glibcDynLinker} {} \;
 
-      paxmark m ./ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
-
       sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
       sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
     '';

pkgs/development/compilers/ghc/8.2.2.nix

@@ -238,11 +238,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 

pkgs/development/compilers/ghc/8.4.4.nix

@@ -214,11 +214,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 

pkgs/development/compilers/ghc/8.6.1.nix

@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 

pkgs/development/compilers/ghc/8.6.2.nix

@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 

pkgs/development/compilers/ghc/8.6.3.nix

@@ -192,11 +192,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc