From 310203565c860f5c9f8074aee85871089a1f234e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 21 Dec 2017 17:53:25 +0100
Subject: [PATCH 01/63] wrapPythonPrograms: do not propagate disabling user
 site-packages to child-processes

The `PYTHONNOUSERSITE` was exported to prevent impurities during
runtime. The downside of exporting environment variables is that they
always propagate all the way down the process tree, unless they are
explicitly unset at some point. Using the `-s` argument applies it only
to the process executed in the wrapper. That way, subprocesses are free
to do impure things.
---
 pkgs/development/interpreters/python/wrap.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 01b573e6ad5..394ea5337d0 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -67,7 +67,7 @@ wrapPythonProgramsIn() {
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
                                     --prefix PATH ':' "$program_PATH"
-                                    --set PYTHONNOUSERSITE "true"
+                                    --add-flags '-s'
                                     )
 
                     # Add any additional arguments provided by makeWrapperArgs

From bfccf8e42cb42a3876b4ed7c4514552f53e66d90 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sat, 23 Dec 2017 15:13:29 +0100
Subject: [PATCH 02/63] cacert: add hook that sets SSL_CERT_FILE

Fixes #32981
---
 pkgs/data/misc/cacert/default.nix   | 2 ++
 pkgs/data/misc/cacert/setup-hook.sh | 6 ++++++
 2 files changed, 8 insertions(+)
 create mode 100644 pkgs/data/misc/cacert/setup-hook.sh

diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 275ae6dc2d8..91af84c4224 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation rec {
     cp -v ca-bundle.crt $out/etc/ssl/certs
   '';
 
+  setupHook = ./setup-hook.sh;
+
   meta = {
     homepage = https://curl.haxx.se/docs/caextract.html;
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
new file mode 100644
index 00000000000..ff68bf0e180
--- /dev/null
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -0,0 +1,6 @@
+cacertHook() {
+    export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+}
+
+envHooks+=(cacertHook)
+crossEnvHooks+=(cacertHook)

From 091c2b9f04189301f18ff0bc8336541d137f1d61 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Wed, 27 Dec 2017 21:26:36 +0100
Subject: [PATCH 03/63] cacert: cleanup exporting SSL_CERT_FILE

---
 pkgs/build-support/fetchbower/default.nix                   | 3 +--
 pkgs/build-support/fetchdarcs/default.nix                   | 3 +--
 pkgs/build-support/fetchgx/default.nix                      | 4 +---
 pkgs/build-support/rust/default.nix                         | 3 +--
 pkgs/build-support/rust/fetchcargo.nix                      | 1 -
 pkgs/development/compilers/go/1.7.nix                       | 4 +---
 pkgs/development/compilers/go/1.8.nix                       | 4 +---
 pkgs/development/compilers/go/1.9.nix                       | 4 +---
 pkgs/development/compilers/rust/cargo.nix                   | 4 +---
 pkgs/development/r-modules/default.nix                      | 6 ++----
 .../linux/firmware/firmware-linux-nonfree/default.nix       | 3 +--
 11 files changed, 11 insertions(+), 28 deletions(-)

diff --git a/pkgs/build-support/fetchbower/default.nix b/pkgs/build-support/fetchbower/default.nix
index 3e1f0eff84a..ba1c8420e91 100644
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@@ -11,7 +11,6 @@ let
 
   fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
     name = "${cleanName name}-${bowerVersion version}";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
     buildCommand = ''
       fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
       # In some cases, the result of fetchBower is different depending
@@ -23,7 +22,7 @@ let
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     inherit outputHash;
-    buildInputs = [ bower2nix ];
+    buildInputs = [ cacert bower2nix ];
   };
 
 in fetchbower
diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 2df1b136c55..48d87cc5d10 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -7,9 +7,8 @@ if md5 != "" then
 else
 stdenv.mkDerivation {
   name = "fetchdarcs";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   builder = ./builder.sh;
-  buildInputs = [darcs];
+  buildInputs = [cacert darcs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchgx/default.nix b/pkgs/build-support/fetchgx/default.nix
index ea91a0854d1..65061ce0f63 100644
--- a/pkgs/build-support/fetchgx/default.nix
+++ b/pkgs/build-support/fetchgx/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   name = "${name}-gxdeps";
   inherit src;
 
-  buildInputs = [ go gx gx-go ];
+  buildInputs = [ cacert go gx gx-go ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -14,8 +14,6 @@ stdenv.mkDerivation {
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   buildPhase = ''
     export GOPATH=$(pwd)/vendor
     mkdir -p vendor
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 57948c33bbc..d720532e147 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation (args // {
 
   patchRegistryDeps = ./patch-registry-deps;
 
-  buildInputs = [ git rust.cargo rust.rustc ] ++ buildInputs;
+  buildInputs = [ cacert git rust.cargo rust.rustc ] ++ buildInputs;
 
   configurePhase = args.configurePhase or ''
     runHook preConfigure
@@ -60,7 +60,6 @@ in stdenv.mkDerivation (args // {
     unset cargoDepsCopy
 
     export RUST_LOG=${logLevel}
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
   '' + (args.postUnpack or "");
 
   buildPhase = with builtins; args.buildPhase or ''
diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index 9b3ba530339..8c136d86488 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation {
         exit 1
     fi
 
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
 
     cargo vendor
diff --git a/pkgs/development/compilers/go/1.7.nix b/pkgs/development/compilers/go/1.7.nix
index b1230da5a14..82ed9b53c60 100644
--- a/pkgs/development/compilers/go/1.7.nix
+++ b/pkgs/development/compilers/go/1.7.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch ];
-  buildInputs = [ pcre ];
+  buildInputs = [ cacert pcre ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
@@ -116,8 +116,6 @@ stdenv.mkDerivation rec {
       })
     ];
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.8.nix b/pkgs/development/compilers/go/1.8.nix
index 210f259df89..050a2f3c865 100644
--- a/pkgs/development/compilers/go/1.8.nix
+++ b/pkgs/development/compilers/go/1.8.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -122,8 +122,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.9.nix b/pkgs/development/compilers/go/1.9.nix
index 8708bd762c4..8b8481c2656 100644
--- a/pkgs/development/compilers/go/1.9.nix
+++ b/pkgs/development/compilers/go/1.9.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -128,8 +128,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index fb3001bbf17..386ffa62294 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   passthru.rustc = rustc;
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ file curl python openssl cmake zlib makeWrapper libgit2 ]
+  buildInputs = [ cacert file curl python openssl cmake zlib makeWrapper libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv ];
 
   LIBGIT2_SYS_USE_PKG_CONFIG=1;
@@ -48,8 +48,6 @@ rustPlatform.buildRustPackage rec {
   '';
 
   checkPhase = ''
-    # Export SSL_CERT_FILE as without it one test fails with SSL verification error
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     # Disable cross compilation tests
     export CFG_DISABLE_CROSS_TESTS=1
     cargo test
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 76c0e522777..de800f701e3 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -3,7 +3,7 @@
 { R, pkgs, overrides }:
 
 let
-  inherit (pkgs) fetchurl stdenv lib;
+  inherit (pkgs) cacert fetchurl stdenv lib;
 
   buildRPackage = pkgs.callPackage ./generic-builder.nix {
     inherit R;
@@ -912,9 +912,7 @@ let
     });
 
     geojsonio = old.geojsonio.overrideDerivation (attrs: {
-      preConfigure = ''
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        '';
+      buildInputs = [ cacert ] ++ attrs.buildInputs;
     });
 
     rstan = old.rstan.overrideDerivation (attrs: {
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 0044a3f6f4a..3bd03d7b40c 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
     # traffic, so don't do that.
     preferLocalBuild = true;
 
-    buildInputs = [ git gnupg ];
-    NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    buildInputs = [ cacert git gnupg ];
   } ''
     git init src && (
       cd src

From d672a9a5cd754cadcf9c2b39328f029bc22a8691 Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Sat, 30 Dec 2017 14:28:40 +0100
Subject: [PATCH 04/63] apparmor: 2.10 -> 2.12.0

---
 pkgs/os-specific/linux/apparmor/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index b576ca71d58..b026e91cc0b 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -9,8 +9,10 @@
 }:
 
 let
-  apparmor-series = "2.10";
-  apparmor-version = apparmor-series;
+
+  apparmor-series = "2.12";
+  apparmor-patchver = "0";
+  apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
     homepage = http://apparmor.net/;
@@ -21,8 +23,8 @@ let
   };
 
   apparmor-sources = fetchurl {
-    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "1x06qmmbha9krx7880pxj2k3l8fxy3nm945xjjv735m2ax1243jd";
+    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-series}.tar.gz";
+    sha256 = "0mm0mcp0w18si9wl15drndysm7v27az2942p1xjd197shg80qawa";
   };
 
   prePatchCommon = ''
@@ -96,7 +98,7 @@ let
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${pythonPackages.python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-exec aa-notify ; do
+      for prog in aa-notify ; do
         wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
       done
     '';

From 812f7714e26a2fdd1446b21e43642c4c023045df Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 31 Dec 2017 11:07:57 +0100
Subject: [PATCH 05/63] clang: move libclang to separate lib output

Currently clang-unwrapped can't be used as a buildInput without also
shadowing clang/clang++ of a clang based stdenv.
---
 pkgs/development/compilers/llvm/3.8/clang/default.nix | 6 ++++--
 pkgs/development/compilers/llvm/3.8/default.nix       | 2 ++
 pkgs/development/compilers/llvm/3.9/clang/default.nix | 6 ++++--
 pkgs/development/compilers/llvm/3.9/default.nix       | 2 ++
 pkgs/development/compilers/llvm/4/clang/default.nix   | 7 ++++---
 pkgs/development/compilers/llvm/4/default.nix         | 1 +
 pkgs/development/compilers/llvm/5/clang/default.nix   | 7 ++++---
 pkgs/development/compilers/llvm/5/default.nix         | 1 +
 8 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/compilers/llvm/3.8/clang/default.nix b/pkgs/development/compilers/llvm/3.8/clang/default.nix
index 90b8ea2581e..388c24e6336 100644
--- a/pkgs/development/compilers/llvm/3.8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/clang/default.nix
@@ -29,7 +29,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -38,6 +38,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -51,7 +54,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.8/default.nix b/pkgs/development/compilers/llvm/3.8/default.nix
index bd79db012a6..2f3d59434bb 100644
--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/3.9/clang/default.nix b/pkgs/development/compilers/llvm/3.9/clang/default.nix
index ec2ec27df36..f215aadc4d9 100644
--- a/pkgs/development/compilers/llvm/3.9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/clang/default.nix
@@ -31,7 +31,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -40,6 +40,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -53,7 +56,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.9/default.nix b/pkgs/development/compilers/llvm/3.9/default.nix
index 5ce51bc9c12..b17d86b5751 100644
--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index 8d40ee3c8aa..404b65c56ab 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -49,7 +49,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -59,13 +59,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -79,7 +81,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index fa61a6c22e7..5a54468f655 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index fa8502ebd67..a63b8b9cdf2 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -50,7 +50,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -60,13 +60,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -80,7 +82,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 9891f3090ac..2c26fb4ac35 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 

From b0c043d26c7ecebe737c7a03d87a732f1285d993 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Tue, 2 Jan 2018 00:52:22 +0100
Subject: [PATCH 06/63] stdenv: allow lib output of clang on darwin

---
 pkgs/stdenv/darwin/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index d202186c29b..cba988b8cc7 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -365,7 +365,7 @@ in rec {
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
       bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped patch pcre.out gettext
+      gnugrep llvmPackages.clang-unwrapped llvmPackages.clang-unwrapped.lib patch pcre.out gettext
       binutils-raw.bintools binutils binutils.bintools
       cc.expand-response-params
     ]) ++ (with pkgs.darwin; [

From 48aca230ce09c744fa61b985c1d0fc3064f92f23 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 3 Jan 2018 13:37:08 -0600
Subject: [PATCH 07/63] Use ncurses6 on all platforms

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eb1ed030f79..60f9f8ba4d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10189,7 +10189,7 @@ with pkgs;
 
   ncurses5 = callPackage ../development/libraries/ncurses { abiVersion = "5"; };
   ncurses6 = callPackage ../development/libraries/ncurses { abiVersion = "6"; };
-  ncurses = if stdenv.isDarwin then ncurses5 else ncurses6;
+  ncurses = ncurses6;
 
   neardal = callPackage ../development/libraries/neardal { };
 

From d51897e439b23fc656e40dfef602df26f24db17e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
Date: Wed, 3 Jan 2018 18:19:59 -0200
Subject: [PATCH 08/63] glib: fix pre phases

*Phases are strings, not arrays.
---
 pkgs/development/libraries/glib/setup-hook.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index 98341376fdf..233845c6541 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -11,7 +11,7 @@ addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 glibPreInstallPhase() {
   installFlagsArray+=("gsettingsschemadir=${!outputLib}/share/gsettings-schemas/$name/glib-2.0/schemas/")
 }
-preInstallPhases+=(glibPreInstallPhase)
+preInstallPhases+=" glibPreInstallPhase"
 
 glibPreFixupPhase() {
     # Move gschemas in case the install flag didn't help
@@ -22,5 +22,4 @@ glibPreFixupPhase() {
 
     addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name"
 }
-preFixupPhases+=(glibPreFixupPhase)
-
+preFixupPhases+=" glibPreFixupPhase"

From edd5be9effd3e444bc21d1a79de3e29bd19a4448 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 2 Jan 2018 05:50:50 +0100
Subject: [PATCH 09/63] meson: set checkPhase in setup hook

---
 .../tools/build-managers/meson/setup-hook.sh         | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 25e2e69ef31..8f96e6146be 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -25,3 +25,15 @@ if [ -z "$dontUseMesonConfigure" -a -z "$configurePhase" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
+
+mesonCheckPhase() {
+    runHook preCheck
+
+    meson test
+
+    runHook postCheck
+}
+
+if [ -z "$dontUseMesonCheck" -a -z "$checkPhase" ]; then
+    checkPhase=mesonCheckPhase
+fi

From d75f95d2a25567948d98a6bd8da69c68a5c06d3f Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 2 Jan 2018 06:08:51 +0100
Subject: [PATCH 10/63] packages using meson: remove unnecessary checkPhase

---
 pkgs/applications/video/gnome-mpv/default.nix            | 1 -
 pkgs/desktops/gnome-3/apps/bijiben/default.nix           | 1 -
 pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix      | 2 --
 pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix  | 2 --
 pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix | 2 --
 pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix  | 3 ---
 pkgs/desktops/gnome-3/core/libgepub/default.nix          | 2 --
 pkgs/desktops/gnome-3/core/simple-scan/default.nix       | 2 --
 pkgs/desktops/gnome-3/core/totem/default.nix             | 2 --
 pkgs/development/libraries/json-glib/default.nix         | 2 --
 pkgs/development/libraries/libinput/default.nix          | 2 --
 11 files changed, 21 deletions(-)

diff --git a/pkgs/applications/video/gnome-mpv/default.nix b/pkgs/applications/video/gnome-mpv/default.nix
index 2f073d1731d..b60d405d5b9 100644
--- a/pkgs/applications/video/gnome-mpv/default.nix
+++ b/pkgs/applications/video/gnome-mpv/default.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
-  checkPhase = "meson test";
 
   meta = with stdenv.lib; {
     description = "Simple GTK+ frontend for the mpv video player";
diff --git a/pkgs/desktops/gnome-3/apps/bijiben/default.nix b/pkgs/desktops/gnome-3/apps/bijiben/default.nix
index ddff55c96a0..ca266d73fd3 100644
--- a/pkgs/desktops/gnome-3/apps/bijiben/default.nix
+++ b/pkgs/desktops/gnome-3/apps/bijiben/default.nix
@@ -8,7 +8,6 @@ stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
   doCheck = true;
-  checkPhase = "meson test";
 
   patches = [
     ./no-update-icon-cache.patch
diff --git a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
index df8c6befc60..5441f1e5edc 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
 
   prePatch = "patchShebangs build-aux/";
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Clocks;
     description = "Clock application designed for GNOME 3";
diff --git a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
index 72d1602eee4..6cfdd45c2f9 100644
--- a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
@@ -14,8 +14,6 @@ stdenv.mkDerivation rec {
                         desktop_file_utils appstream-glib libxslt docbook_xsl docbook_xml_dtd_43];
   buildInputs = [ gtk glib gnome3.gsettings_desktop_schemas ];
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Dictionary;
     description = "Dictionary is the GNOME application to look up definitions";
diff --git a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
index cdf119d83a3..dade56158fb 100644
--- a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
@@ -7,8 +7,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gettext wrapGAppsHook libxml2 ];
   buildInputs = [ gtk3 glib gnome3.gnome_desktop gnome3.defaultIconTheme ];
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 69a967d6d24..5986b07229f 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -7,9 +7,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
-
   postPatch = ''
     chmod +x build-aux/postinstall.py # patchShebangs requires executable file
     patchShebangs build-aux/postinstall.py
diff --git a/pkgs/desktops/gnome-3/core/libgepub/default.nix b/pkgs/desktops/gnome-3/core/libgepub/default.nix
index f1e13e10fd9..10d676d11d6 100644
--- a/pkgs/desktops/gnome-3/core/libgepub/default.nix
+++ b/pkgs/desktops/gnome-3/core/libgepub/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gobjectIntrospection ];
   buildInputs = [ glib webkitgtk libsoup libxml2 libarchive ];
 
diff --git a/pkgs/desktops/gnome-3/core/simple-scan/default.nix b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
index a30467c1862..4a3420ea5f5 100644
--- a/pkgs/desktops/gnome-3/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
@@ -39,8 +39,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     description = "Simple scanning utility";
     longDescription = ''
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index 651b7cff226..c26b9b45dfd 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ gobjectIntrospection python3Packages.pylint python3Packages.pygobject2 ];
 
-  checkPhase = "meson test";
-
   patches = [
     (fetchurl {
       name = "remove-pycompile.patch";
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 2414931e76a..73fa1f311bf 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = http://live.gnome.org/JsonGlib;
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index db4c0c7738d..a0f7807786e 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
 
   doCheck = testsSupport;
 
-  checkPhase = "meson test";
-
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
     homepage    = http://www.freedesktop.org/wiki/Software/libinput;

From 95ecb1f203075bb0e0bfe7d38232ffafa74fc093 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sbrofeldt@gmail.com>
Date: Sat, 6 Jan 2018 14:32:30 +0100
Subject: [PATCH 11/63] gettext: Don't use envHooks anymore

---
 pkgs/development/libraries/gettext/gettext-setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index fe3ef1f9e15..5932ef6a44f 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -4,4 +4,4 @@ gettextDataDirsHook() {
     fi
 }
 
-envHooks+=(gettextDataDirsHook)
+addEnvHooks "$hostOffset" gettextDataDirsHook

From 63ba455e539ae6392702a14eebf30ffee829da0e Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Thu, 4 Jan 2018 16:48:29 +0100
Subject: [PATCH 12/63] bluez: 5.47 -> 5.48

---
 pkgs/os-specific/linux/bluez/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index e9a1f314abc..6871f1fa8e1 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -5,11 +5,11 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.47";
+  name = "bluez-5.48";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1j22hfjz0fp4pgclgz9mfcwjbr4wqgah3gd2qhfg4r6msmybyxfg";
+    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
   };
 
   pythonPath = with pythonPackages;

From 6e2cb1dd8c3732e1c78fd39563c827c298359341 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Thu, 4 Jan 2018 16:48:46 +0100
Subject: [PATCH 13/63] bluez: use `dbus-python` for the python bindings.
 `dbus` does not provide any

---
 pkgs/os-specific/linux/bluez/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 6871f1fa8e1..62c3986569d 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
+    [ dbus-python pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs = [
     pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython

From 2b230efb7f45a5035186b233952aea11a90af7d9 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 3 Jan 2018 17:26:59 -0600
Subject: [PATCH 14/63] sharutils: don't hardcode AR to 'ar' (doesn't exist on
 cross)

Instead, let the default value of $AR indicate what should be used.

(which will be something like `armv6l-unknown-linux-gnueabihf-ar`)
---
 pkgs/tools/archivers/sharutils/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 9f161ac7525..02281468942 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
     in ''
       substituteInPlace tests/shar-1 --replace '${shar_sub}' '${shar_sub} -s submitter'
       substituteInPlace tests/shar-2 --replace '${shar_sub}' '${shar_sub} -s submitter'
+
+      substituteInPlace intl/Makefile.in --replace "AR = ar" ""
     '';
 
   doCheck = true;

From 497cde8fd7a60e44454b80b7d23c9b05bf6dfc1c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:06 +0100
Subject: [PATCH 15/63] python: aniso8601: 1.3.0 -> 2.0.0

---
 pkgs/development/python-modules/aniso8601/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aniso8601/default.nix b/pkgs/development/python-modules/aniso8601/default.nix
index 6e61e84a5d5..ba60922856e 100644
--- a/pkgs/development/python-modules/aniso8601/default.nix
+++ b/pkgs/development/python-modules/aniso8601/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.3.0";
+  version = "2.0.0";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
@@ -16,6 +16,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3b5246f5601b6ae5671911bc4ee5b3e3fe94752e8afab5ce074d8b1232952f1";
+    sha256 = "085786415d3550e89785ffbedaa9bb37d41de0707a1268bdbba11249064b71d1";
   };
 }

From c15e8f09e93e10d7fb8eb9ec8d7feeb55b962793 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:11 +0100
Subject: [PATCH 16/63] python: argon2_cffi: 16.3.0 -> 18.1.0

---
 pkgs/development/python-modules/argon2_cffi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/argon2_cffi/default.nix b/pkgs/development/python-modules/argon2_cffi/default.nix
index 80985f868c7..f46efd9f496 100644
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "16.3.0";
+  version = "18.1.0";
   name    = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ap3il3j1pjyprrhpfyhc21izpmhzhfb5s69vlzc65zvd1nj99cr";
+    sha256 = "7e4b75611b73f53012117ad21cdde7a17b32d1e99ff6799f22d827eb83a2a59b";
   };
 
   propagatedBuildInputs = [ cffi six ];

From 9f6387de4cf960c74cb635893449b96377d8f856 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:15 +0100
Subject: [PATCH 17/63] python: backports.lzma: 0.0.8 -> 0.0.9

---
 pkgs/development/python-modules/backports_lzma/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports_lzma/default.nix b/pkgs/development/python-modules/backports_lzma/default.nix
index 9b622eb6b06..6f7a45a4fe8 100644
--- a/pkgs/development/python-modules/backports_lzma/default.nix
+++ b/pkgs/development/python-modules/backports_lzma/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "backports.lzma";
-  version = "0.0.8";
+  version = "0.0.9";
 
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "200584ad5079d8ca6b1bfe14890c7be58666ab0128d8ca26cfb2669b476085f3";
+    sha256 = "9ba5d94214a79900ee297a594b8e154cd8e4a54d26eb06243c0e2f3ad5286539";
   };
 
   buildInputs = [ lzma ];

From 2eaa6c4ca8cb0b58d7f0e326030ea7a7d6aaad6d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:19 +0100
Subject: [PATCH 18/63] python: botocore: 1.8.21 -> 1.8.23

---
 pkgs/development/python-modules/botocore/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index f8dd1649949..5ecaacb9d20 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "botocore";
-  version = "1.8.21";
+  version = "1.8.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4513a02f68e7efd7494ee56db201d87620218ca879aae361abbb71bcde3aa5f";
+    sha256 = "cc5df29da7c3f523edfc6086e082204b80945b5c73bf82a181018b7f1a5d6975";
   };
 
   propagatedBuildInputs = [

From 8cc70cac8be3a96f78a80a39c537272052a23f3e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:24 +0100
Subject: [PATCH 19/63] python: daphne: 1.3.0 -> 1.4.2

---
 pkgs/development/python-modules/daphne/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index c90fb61ce03..f819a234146 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -4,11 +4,11 @@
 buildPythonPackage rec {
   pname = "daphne";
   name = "${pname}-${version}";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xmmjp21m1w88ljsgnkf6cbzw5nxamh9cfmfgzxffpn4cdmvn96i";
+    sha256 = "302725f223853b05688f28c361e050f8db9568b1ce27340c76272c26b49e6d72";
   };
 
   buildInputs = [ hypothesis ];

From 721eed9b34999abbe3483d6a186d60c852d86ee5 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:28 +0100
Subject: [PATCH 20/63] python: dyn: 1.8.0 -> 1.8.1

---
 pkgs/development/python-modules/dyn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dyn/default.nix b/pkgs/development/python-modules/dyn/default.nix
index 881f51b69aa..efb9cab8048 100644
--- a/pkgs/development/python-modules/dyn/default.nix
+++ b/pkgs/development/python-modules/dyn/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "dyn";
-  version = "1.8.0";
+  version = "1.8.1";
   name  = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ab3cd9a1478674cf2d2aa6740fb0ddf77daaa9ab3e35e5d2bc92f60301f8523";
+    sha256 = "e112149d48b4500c18b3cfb6e0e6e780bb5aa0e56ff87cac412280200b9ec8bf";
   };
 
   buildInputs = [ glibcLocales ];

From fe0b84df8256f78215eb5e4f075556ee8753e045 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:33 +0100
Subject: [PATCH 21/63] python: filelock: 2.0.14 -> 3.0.0

---
 pkgs/development/python-modules/filelock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index a22e1581b68..5d617ba9369 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "2.0.14";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ee355eb66e4c2e5d95689e1253515aad5b3177c274abdd00a57d5ab1aa6d071a";
+    sha256 = "b3ad481724adfb2280773edd95ce501e497e88fa4489c6e41e637ab3fd9a456c";
   };
 
   meta = with stdenv.lib; {

From 35fa14484ed4e1901ad321540042c255bb3602d0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:37 +0100
Subject: [PATCH 22/63] python: grpcio: 1.8.2 -> 1.8.3

---
 pkgs/development/python-modules/grpcio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index eeb51fb5843..3fe7dc751c8 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ea1336f0d1158c4e00e96a94df84b75f6bbff9816abb6cc68cbdc9442a9ac55";
+    sha256 = "6ce5fd3093ddc09a152981d5c477ac645eda19dfcc819e45d8c57da6b743bd53";
   };
 
   propagatedBuildInputs = [ six protobuf ]

From 881d6a9e646e41adc1d7a8a72b39afa53bdaeb3c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:42 +0100
Subject: [PATCH 23/63] python: jupyter_client: 5.2.0 -> 5.2.1

---
 .../python-modules/jupyter_client/default.nix       |  8 ++------
 .../jupyter_client/wheel_workaround.patch           | 13 -------------
 2 files changed, 2 insertions(+), 19 deletions(-)
 delete mode 100644 pkgs/development/python-modules/jupyter_client/wheel_workaround.patch

diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index e88b7f937a5..42d7752eda3 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca30cf1786047925ebacd6f6faa3a993efaa004b584f7d83bc8b807f7cd3f6bb";
+    sha256 = "462790d46b244f0a631ea5e3cd5cdbad6874d5d24cc0ff512deb7c16cdf8653d";
   };
 
   checkInputs = [ ipykernel ipython mock pytest ];
@@ -29,10 +29,6 @@ buildPythonPackage rec {
     py.test
   '';
 
-  patches = [
-    ./wheel_workaround.patch
-  ];
-
   # Circular dependency with ipykernel
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch b/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
deleted file mode 100644
index 926fcb26448..00000000000
--- a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 95d4774..ee72cbc 100644
---- a/setup.py
-+++ b/setup.py
-@@ -86,7 +86,7 @@ setup_args = dict(
-     extras_require   = {
-         'test': ['ipykernel', 'ipython', 'mock'],
-         'test:python_version == "3.3"': ['pytest<3.3.0'],
--        'test:python_version >= "3.4" or python_version == "2.7"': ['pytest'],
-+        'test:(python_version >= "3.4" or python_version == "2.7")': ['pytest'],
-     },
-     cmdclass         = {
-         'bdist_egg': bdist_egg if 'bdist_egg' in sys.argv else bdist_egg_disabled,

From 6f10cfc7777def2dcbcd15dfd9e2789770945584 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Tue, 2 Jan 2018 20:18:41 +0100
Subject: [PATCH 24/63] cmake: fix INSTALL_NAME_DIR for darwin libraries

When there's a lib output libraries won't be intalled to $prefix causing
output cycles.
---
 pkgs/development/tools/build-managers/cmake/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index a92d54b3f14..a0f1cf00814 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -43,7 +43,7 @@ cmakeConfigurePhase() {
     # libraries are in a system path or in the same directory as the
     # executable. This flag makes the shared library accessible from its
     # nix/store directory.
-    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=$prefix/lib $cmakeFlags"
+    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_INCLUDEDIR=${!outputDev}/include $cmakeFlags"
 

From dc2ae3aef603a33f83d6c560c39574df56ba8856 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 09:45:56 +0100
Subject: [PATCH 25/63] brotli: remove darwin cmake fix

---
 pkgs/tools/compression/brotli/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index f4fbb368535..9a35013e381 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -21,10 +21,6 @@ stdenv.mkDerivation rec {
   # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
   prePatch = "rm BUILD";
 
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    cmakeFlagsArray+=("-DCMAKE_INSTALL_NAME_DIR=$lib/lib")
-  '';
-
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
 

From 56b429c252429c42c20fb6c01cf05679f01aed86 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:52 +0100
Subject: [PATCH 26/63] python: Pillow: 4.3.0 -> 5.0.0

---
 .../python-modules/pillow/default.nix           | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 4be9c911f71..03474825527 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -1,14 +1,17 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
-  nose, olefile,
-  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy
+, olefile
+, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, pytestrunner
+, pytest
+}:
 buildPythonPackage rec {
   pname = "Pillow";
-  version = "4.3.0";
+  version = "5.0.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a97c715d44efd5b4aa8d739b8fad88b93ed79f1b33fc2822d5802043f3b1b527";
+    sha256 = "12f29d6c23424f704c66b5b68c02fe0b571504459605cfe36ab8158359b0e1bb";
   };
 
   doCheck = !stdenv.isDarwin && !isPyPy;
@@ -21,8 +24,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ olefile ];
 
+  checkInputs = [ pytest pytestrunner ];
+
   buildInputs = [
-    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
     ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
 
   # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.

From 792b448b9b6aa4f36251360c491ba045629c6a7c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:57 +0100
Subject: [PATCH 27/63] python: psutil: 5.4.2 -> 5.4.3

---
 pkgs/development/python-modules/psutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index b9d07a3fa9b..6221e08ae57 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.4.2";
+  version = "5.4.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00a1f9ff8d1e035fba7bfdd6977fa8ea7937afdb4477339e5df3dba78194fe11";
+    sha256 = "e2467e9312c2fa191687b89ff4bc2ad8843be4af6fb4dc95a7cc5f7d7a327b18";
   };
 
   # No tests in archive

From b6ea6d51c25cd076d1ad611d8b8e5b27ff3f00c8 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:01 +0100
Subject: [PATCH 28/63] python: pwntools: 3.10.0 -> 3.11.0

---
 pkgs/development/python-modules/pwntools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pwntools/default.nix b/pkgs/development/python-modules/pwntools/default.nix
index a186c399548..b98930dfe59 100644
--- a/pkgs/development/python-modules/pwntools/default.nix
+++ b/pkgs/development/python-modules/pwntools/default.nix
@@ -5,13 +5,13 @@
 , requests, tox, pandoc, unicorn, intervaltree }:
 
 buildPythonPackage rec {
-  version = "3.10.0";
+  version = "3.11.0";
   pname = "pwntools";
   name = pname + "-" + version;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1l8hb30mwxqd1y7r5ihd7kzmjm2mz6m5aiphd3hwzmxkmxbxj8zk";
+    sha256 = "609b3f0ba47c975f4dbedd3da2af4c5ca1b3a2aa13fb99240531b6a68edb87be";
   };
 
   propagatedBuildInputs = [ Mako packaging pysocks pygments ROPGadget capstone paramiko pip psutil pyelftools pypandoc pyserial dateutil requests tox pandoc unicorn intervaltree ];

From 13c5dc200a56858b01fc39febe358871bfa57928 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:06 +0100
Subject: [PATCH 29/63] python: pytest: 3.3.1 -> 3.3.2

---
 pkgs/development/python-modules/pytest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index d45fe7deb12..91e22baa4ad 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -2,7 +2,7 @@
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k
 }:
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "3.3.2";
   pname = "pytest";
 
   preCheck = ''
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf8436dc59d8695346fcd3ab296de46425ecab00d64096cebe79fb51ecb2eb93";
+    sha256 = "53548280ede7818f4dc2ad96608b9f08ae2cc2ca3874f2ceb6f97e3583f25bc4";
   };
 
   checkInputs = [ hypothesis ];

From 7b52360cb6594520645af0e46e04fc9ca645cff3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:11 +0100
Subject: [PATCH 30/63] python: python-stdnum: 1.7 -> 1.8.1

---
 pkgs/development/python-modules/python-stdnum/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index a78b1ffbee2..44a6b522a4e 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchurl, buildPythonPackage, isPy3k }:
 
 buildPythonPackage rec {
-  version = "1.7";
+  version = "1.8.1";
   pname = "python-stdnum";
   name = "${pname}-${version}";
   # Failing tests and dependency issue on Py3k
   disabled = isPy3k;
   src = fetchurl {
     url = "mirror://pypi/p/python-stdnum/${name}.tar.gz";
-    sha256 = "987c25e1047e8742131bcf29dac7a406987adb1463465749e2daaba8cb19d264";
+    sha256 = "d7162fdb29337aebed65700cc7297016f6cd32cae4ad7aed8f7e7531f0217943";
   };
   meta = {
     homepage = http://arthurdejong.org/python-stdnum/;

From 4fbd01c5c1a76ece5d24b31b8b31b92769384fd9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:15 +0100
Subject: [PATCH 31/63] python: ropper: 1.11.2 -> 1.11.3

---
 pkgs/development/python-modules/ropper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ropper/default.nix b/pkgs/development/python-modules/ropper/default.nix
index 62ef3f8db19..b35145872dd 100644
--- a/pkgs/development/python-modules/ropper/default.nix
+++ b/pkgs/development/python-modules/ropper/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonApplication rec {
   pname = "ropper";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2183feedfe8b01a27301eee07383b481ece01b2319bdba3afebe33e19ca14aa3";
+    sha256 = "77d9b03083d0a098261a1d2856cd330ea3db520511a78472e421a00526aa220c";
   };
   # XXX tests rely on user-writeable /dev/shm to obtain process locks and return PermissionError otherwise
   # workaround: sudo chmod 777 /dev/shm

From 3726bbc26237f54657266786e78fa3ab83c9c3f6 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:20 +0100
Subject: [PATCH 32/63] python: setuptools: 38.2.5 -> 38.4.0

---
 pkgs/development/python-modules/setuptools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index b185be62a69..5535a80fd4a 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,13 +8,13 @@
 # Should use buildPythonPackage here somehow
 stdenv.mkDerivation rec {
   pname = "setuptools";
-  version = "38.2.5";
+  version = "38.4.0";
   name = "${python.libPrefix}-${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b080f276cc868670540b2c03cee06cc14d2faf9da7bec0f15058d1b402c94507";
+    sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
   };
 
   buildInputs = [ python wrapPython unzip ];

From 671fdc2c8544b88497a9d7f85e2bc798fb757d0b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:24 +0100
Subject: [PATCH 33/63] python: sqlmap: 1.1.12 -> 1.2

---
 pkgs/development/python-modules/sqlmap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index e89abbd595a..dd7fdc173e5 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.1.12";
+  version = "1.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "86a1078ceb1e79f891633c7e4c7b07949fd9135a0e4c0738abd5111e2e6b96c0";
+    sha256 = "18ac6392a710f0cc106c28c4e27e43e8f1b25cb46fb8b6714836212607c07b10";
   };
 
   # No tests in archive

From 3a6f8b5f928bd6fc04ebf51fdcf9c61346bef320 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:29 +0100
Subject: [PATCH 34/63] python: texttable: 1.1.1 -> 1.2.1

---
 pkgs/development/python-modules/texttable/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/texttable/default.nix b/pkgs/development/python-modules/texttable/default.nix
index 38cffcee296..fc97297c010 100644
--- a/pkgs/development/python-modules/texttable/default.nix
+++ b/pkgs/development/python-modules/texttable/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "texttable";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "44674d1d470a9fc264c4d1eba44b74463ca0066d7b954453dd5a4f8057779c9c";
+    sha256 = "c89dc0148ae29645917aab7e970a30d1af565b3ca276cef8ab1a60469f0d8100";
   };
 
   meta = {

From deb4d8ec76ce0039641a8ef0fec22919f961f25c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:34 +0100
Subject: [PATCH 35/63] python: tornado: 4.5.2 -> 4.5.3

---
 pkgs/development/python-modules/tornado/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index bc39745945d..db513d1c614 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "4.5.2";
+  version = "4.5.3";
   name = "${pname}-${version}";
 
   propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
@@ -23,6 +23,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fb8e494cd46c674d86fac5885a3ff87b0e283937a47d74eb3c02a48c9e89ad0";
+    sha256 = "6d14e47eab0e15799cf3cdcc86b0b98279da68522caace2bd7ce644287685f0a";
   };
 }

From 75afdc028993d5094b08bba58ad15b7a2cceae84 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:43 +0100
Subject: [PATCH 36/63] python: typeguard: 2.1.3 -> 2.1.4

---
 pkgs/development/python-modules/typeguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index b441ad8052c..0af8c47e35c 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -9,11 +9,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "typeguard";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l3pih5ca469v7if255h5rqymirsw46bi6s7p885jxhq1gv6cfpk";
+    sha256 = "40b22d18d2215b76b3ddda2564acfbddfa6e702968637fbd969187c2a6fb99da";
   };
 
   buildInputs = [ setuptools_scm ];

From 57e9ed3719e5cef086a3463513e8805c761c3cf4 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:47 +0100
Subject: [PATCH 37/63] python: Unidecode: 0.04.21 -> 1.0.22

---
 pkgs/development/python-modules/unidecode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unidecode/default.nix b/pkgs/development/python-modules/unidecode/default.nix
index 9b81a28f085..3cffe380490 100644
--- a/pkgs/development/python-modules/unidecode/default.nix
+++ b/pkgs/development/python-modules/unidecode/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "Unidecode";
-  version = "0.04.21";
+  version = "1.0.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lfhp9c5xrbpjvbpr12ji52g1lx04404bzzdg6pvabhzisw6l2i8";
+    sha256 = "8c33dd588e0c9bc22a76eaa0c715a5434851f726131bd44a6c26471746efabf5";
   };
 
   LC_ALL="en_US.UTF-8";

From f3878bb4c30b928a9821bc4fa0593085bb359253 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:52 +0100
Subject: [PATCH 38/63] python: zeep: 2.4.0 -> 2.5.0

---
 pkgs/development/python-modules/zeep/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zeep/default.nix b/pkgs/development/python-modules/zeep/default.nix
index e00d6c7e24b..64b2874ef62 100644
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -25,13 +25,13 @@
 
 let
   pname = "zeep";
-  version = "2.4.0";
+  version = "2.5.0";
 in buildPythonPackage {
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8631e2735c5f2219eb18ca4f0615ae482455628518508f69c3690dbfb8238aee";
+    sha256 = "4f9db52c7d269813fc6251da4cb050869158858aeea75a055b4550f19e52ac84";
   };
 
   propagatedBuildInputs = [

From 87340d32bb2a0abe45a23f801849bcd8aada7d13 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:06:35 +0100
Subject: [PATCH 39/63] python.pkgs.bootstrapped-pip update setuptools 38.2.5
 -> 38.4.0

---
 pkgs/development/python-modules/bootstrapped-pip/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 1a20639c2de..88209ad3fd1 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -9,9 +9,9 @@ let
   };
   setuptools_source = fetchPypi {
     pname = "setuptools";
-    version = "38.2.5";
+    version = "38.4.0";
     format = "wheel";
-    sha256 = "bcf0d4f3e2f7890e658db11e218b8643afffb905a0e2f2a7d5a6a3e949bb87e6";
+    sha256 = "155c2ec9fdcc00c3973d966b416e1cf3a1e7ce75f4c09fb760b23f94b935926e";
   };
 
   # TODO: Shouldn't be necessary anymore for pip > 9.0.1!

From a83fc51d486aa30f7d63222ecce5f672f2a7fe2a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:24:31 +0100
Subject: [PATCH 40/63] awscli: 1.14.17 -> 1.14.19

---
 pkgs/tools/admin/awscli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index b6c7270a425..6ad9b7598e4 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -26,12 +26,12 @@ let
 
 in buildPythonPackage rec {
   pname = "awscli";
-  version = "1.14.17";
+  version = "1.14.19";
   namePrefix = "";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "456499acc41ab67671062a08e218a22aa1a1ff64ae531e694163d0371e8a1dd0";
+    sha256 = "bcb01f4ecdde236a648b94efdd9ca57e59f67c592ba124ca1e45ddf834ce4f5b";
   };
 
   # No tests included

From c8aead477f46572a7e7d39109a28026aa12c0f7c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:38:55 +0100
Subject: [PATCH 41/63] python.pkgs.datashape: 0.5.2 -> 0.5.4

---
 .../python-modules/datashape/default.nix      | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/datashape/default.nix b/pkgs/development/python-modules/datashape/default.nix
index 81ead843169..9177e9f0ff4 100644
--- a/pkgs/development/python-modules/datashape/default.nix
+++ b/pkgs/development/python-modules/datashape/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
 , mock
 , numpy
@@ -8,14 +8,24 @@
 , dateutil
 }:
 
-buildPythonPackage rec {
-  pname = "datashape";
-  version = "0.5.2";
-  name = "${pname}-${version}";
+let
+  # Fetcher function looks similar to fetchPypi.
+  # Allows for easier overriding, without having to know
+  # how the source is actually fetched.
+  fetcher = {pname, version, sha256}: fetchFromGitHub {
+    owner = "blaze";
+    repo = pname;
+    rev = version;
+    inherit sha256;
+  };
 
-  src = fetchPypi {
+in buildPythonPackage rec {
+  pname = "datashape";
+  version = "0.5.4";
+
+  src = fetcher {
     inherit pname version;
-    sha256 = "2356ea690c3cf003c1468a243a9063144235de45b080b3652de4f3d44e57d783";
+    sha256 = "0rhlj2kjj1vx5m73wnc5518rd6cs1zsbgpsvzk893n516k69shcf";
   };
 
   checkInputs = [ pytest mock ];

From dceec247054bc565c66354f2a332142fdee186e8 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 10:02:48 +0100
Subject: [PATCH 42/63] python.pkgs.cytoolz: fix build

---
 pkgs/development/python-modules/cytoolz/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 83b1c893719..9c5a2b2110c 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -23,6 +23,12 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
   propagatedBuildInputs = [ toolz ];
 
+  # File as accidentally included in release
+  # See https://github.com/pytoolz/cytoolz/issues/116#issuecomment-355770073
+  postPatch = ''
+    rm cytoolz/tests/test_curried_doctests.py
+  '';
+
   # Disable failing test https://github.com/pytoolz/cytoolz/issues/97
   checkPhase = ''
     NOSE_EXCLUDE=test_curried_exceptions nosetests -v $out/${python.sitePackages}

From e527eb03734ba4aa9188fbce44dbd3c609729225 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 11:21:28 +0100
Subject: [PATCH 43/63] Revert "wrapPythonPrograms: do not propagate disabling
 user site-packages to child-processes"

This reverts commit 310203565c860f5c9f8074aee85871089a1f234e.

See https://github.com/NixOS/nixpkgs/commit/310203565c860f5c9f8074aee85871089a1f234e#commitcomment-26697890
---
 pkgs/development/interpreters/python/wrap.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 394ea5337d0..01b573e6ad5 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -67,7 +67,7 @@ wrapPythonProgramsIn() {
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
                                     --prefix PATH ':' "$program_PATH"
-                                    --add-flags '-s'
+                                    --set PYTHONNOUSERSITE "true"
                                     )
 
                     # Add any additional arguments provided by makeWrapperArgs

From 11c4e8ae29d145e6cf4ebdebb7e06d5ef475a140 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sbrofeldt@gmail.com>
Date: Sun, 7 Jan 2018 15:17:53 +0100
Subject: [PATCH 44/63] Revert "gnome3.nautilus-sendto: fix build"

This reverts commit d3ad52a58eb3e4513f962eb059918579d6813a39.

In order to see if https://github.com/NixOS/nixpkgs/pull/33524 is
sufficient
---
 pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
index b185778fe86..2812e7673b4 100644
--- a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
+++ b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib
-, gettext, gobjectIntrospection
-}:
+{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib, gettext }:
 
 stdenv.mkDerivation rec {
   name = "nautilus-sendto-${version}";
@@ -12,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "164d7c6e8bae29c4579bcc67a7bf50d783662b1545b62f3008e7ea3c0410e04d";
   };
 
-  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext ];
   buildInputs = [ glib ];
 
   meta = with stdenv.lib; {

From 406e162884b4d836127f4739e51e8204be45319b Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:22:53 +0100
Subject: [PATCH 45/63] cacert: use addEnvHooks

---
 pkgs/data/misc/cacert/setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
index ff68bf0e180..b704a6a919e 100644
--- a/pkgs/data/misc/cacert/setup-hook.sh
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -2,5 +2,4 @@ cacertHook() {
     export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
 }
 
-envHooks+=(cacertHook)
-crossEnvHooks+=(cacertHook)
+addEnvHooks "$targetOffset" cacertHook

From 6c39c9cbfa583fd341954d25a40168c316252676 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:26:22 +0100
Subject: [PATCH 46/63] tzdata: use addEnvHooks

---
 pkgs/data/misc/tzdata/tzdata-setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/data/misc/tzdata/tzdata-setup-hook.sh b/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
index 9ae9b46d85c..9975d0aec31 100644
--- a/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
+++ b/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
@@ -2,5 +2,4 @@ tzdataHook() {
     export TZDIR=@out@/share/zoneinfo
 }
 
-envHooks+=(tzdataHook)
-crossEnvHooks+=(tzdataHook)
+addEnvHooks "$targetOffset" tzdataHook

From d01cb0c1eaf363f126af2fffb73b4b7238983103 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:27:27 +0100
Subject: [PATCH 47/63] dleyna-core: use addEnvHooks

---
 pkgs/development/libraries/dleyna-core/setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/dleyna-core/setup-hook.sh b/pkgs/development/libraries/dleyna-core/setup-hook.sh
index 046a77d5a4d..87b5c67dff5 100644
--- a/pkgs/development/libraries/dleyna-core/setup-hook.sh
+++ b/pkgs/development/libraries/dleyna-core/setup-hook.sh
@@ -5,5 +5,4 @@ addDleynaConnectorPath () {
     fi
 }
 
-envHooks+=(addDleynaConnectorPath)
-
+addEnvHooks "$targetOffset" addDleynaConnectorPath

From bfb1db7a751879c83eabe823b767a71924a45bc5 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:28:50 +0100
Subject: [PATCH 48/63] gnuradio: use addEnvHooks

---
 pkgs/applications/misc/gnuradio/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/misc/gnuradio/default.nix b/pkgs/applications/misc/gnuradio/default.nix
index 470e046e85e..58d8e9fae61 100644
--- a/pkgs/applications/misc/gnuradio/default.nix
+++ b/pkgs/applications/misc/gnuradio/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     addGRCBlocksPath() {
       addToSearchPath GRC_BLOCKS_PATH $1/share/gnuradio/grc/blocks
     }
-    envHooks+=(addGRCBlocksPath)
+    addEnvHooks "$targetOffset" addGRCBlocksPath
   '';
 
   setupHook = [ grcSetupHook ];

From 03dca870abdffa3bf827a98f40e7baaa34dbcb43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Mon, 8 Jan 2018 17:36:11 +0100
Subject: [PATCH 49/63] Revert "gnome3.gnome-screenshot: fix build"

This reverts commit 2a1425d8b7504572dbceb69e851aa27f05b4fc34.
See https://github.com/NixOS/nixpkgs/issues/33458
---
 pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 4e0e6ecb997..5986b07229f 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -1,6 +1,6 @@
 { stdenv, gettext, libxml2, fetchurl, pkgconfig, libcanberra_gtk3
 , bash, gtk3, glib, meson, ninja, wrapGAppsHook, appstream-glib
-, gnome3, librsvg, gdk_pixbuf, gobjectIntrospection }:
+, gnome3, librsvg, gdk_pixbuf }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
@@ -15,8 +15,7 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
   propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2
-                        wrapGAppsHook gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2 wrapGAppsHook ];
   buildInputs = [ bash gtk3 glib libcanberra_gtk3
                   gnome3.gsettings_desktop_schemas ];
 

From c2316114bcc6568bb186f8c4f49eb4e817fedec1 Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Tue, 9 Jan 2018 11:14:48 +0800
Subject: [PATCH 50/63] stdenv: Kill off ensureDir

---
 pkgs/development/interpreters/erlang/R16B02-basho.nix |  2 +-
 pkgs/servers/x11/xorg/overrides.nix                   |  2 +-
 pkgs/stdenv/generic/setup.sh                          | 10 ----------
 pkgs/tools/networking/bud/default.nix                 |  4 ++--
 4 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/R16B02-basho.nix b/pkgs/development/interpreters/erlang/R16B02-basho.nix
index 33c34f7fecc..714924514ed 100644
--- a/pkgs/development/interpreters/erlang/R16B02-basho.nix
+++ b/pkgs/development/interpreters/erlang/R16B02-basho.nix
@@ -36,7 +36,7 @@ mkDerivation rec {
     tar xf "${manpages}" -C "$out/lib/erlang"
     for i in "$out"/lib/erlang/man/man[0-9]/*.[0-9]; do
       prefix="''${i%/*}"
-      ensureDir "$out/share/man/''${prefix##*/}"
+      mkdir -p "$out/share/man/''${prefix##*/}"
       ln -s "$i" "$out/share/man/''${prefix##*/}/''${i##*/}erl"
     done
   '';
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index ca1a773c4a2..f56d22d7b7e 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -546,7 +546,7 @@ in
           "--with-sha1=CommonCrypto"
         ];
         preConfigure = ''
-          ensureDir $out/Applications
+          mkdir -p $out/Applications
           export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
           substituteInPlace hw/xquartz/pbproxy/Makefile.in --replace -F/System -F${args.apple_sdk.frameworks.ApplicationServices}
         '';
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index d2c67cce81a..dbbe45e45f3 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -188,16 +188,6 @@ addToSearchPath() {
     addToSearchPathWithCustomDelimiter "${PATH_DELIMITER}" "$@"
 }
 
-
-ensureDir() {
-    echo "warning: ‘ensureDir’ is deprecated; use ‘mkdir’ instead" >&2
-    local dir
-    for dir in "$@"; do
-        if ! [ -x "$dir" ]; then mkdir -p "$dir"; fi
-    done
-}
-
-
 # Add $1/lib* into rpaths.
 # The function is used in multiple-outputs.sh hook,
 # so it is defined here but tried after the hook.
diff --git a/pkgs/tools/networking/bud/default.nix b/pkgs/tools/networking/bud/default.nix
index 48ae772e127..c0383b7c822 100644
--- a/pkgs/tools/networking/bud/default.nix
+++ b/pkgs/tools/networking/bud/default.nix
@@ -14,14 +14,14 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python gyp
   ] ++ lib.optional stdenv.isLinux utillinux;
- 
+
   buildPhase = ''
     python ./gyp_bud -f make
     make -C out
   '';
 
   installPhase = ''
-    ensureDir $out/bin
+    mkdir -p $out/bin
     cp out/Release/bud $out/bin
   '';
 

From 28a7865e05ac6e20f094757f484aa122cd9455db Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Thu, 11 Jan 2018 01:19:12 +0800
Subject: [PATCH 51/63] e2fsprogs: 1.43.7 -> 1.43.8

---
 pkgs/tools/filesystems/e2fsprogs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 22dc9e74723..e6a83e32632 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "e2fsprogs-1.43.7";
+  name = "e2fsprogs-1.43.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/e2fsprogs/${name}.tar.gz";
-    sha256 = "1i51w5l45zhz3i98k92xbbvkqklvjrvw3zvqky3gk9cdmqp5y0w7";
+    sha256 = "1pn33rap3lcjm3gx07pmgyhx4j634gja63phmi4g5dq8yj0z8ciz";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];

From e47fa2a92b352adedfb698a943981e23a0cf798f Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Thu, 11 Jan 2018 14:07:52 +0100
Subject: [PATCH 52/63] gdbm: 1.13 -> 1.14

See http://lists.gnu.org/archive/html/info-gnu/2018-01/msg00000.html
for release information
---
 pkgs/development/libraries/gdbm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 3b78225a447..8d645bde777 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.13";
+  name = "gdbm-1.14";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "0lx201q20dvc70f8a3c9s7s18z15inlxvbffph97ngvrgnyjq9cx";
+    sha256 = "02dakgrq93xwgln8qfv3vs5jyz5yvds5nyzkx6rhg9v585x478dd";
   };
 
   doCheck = stdenv.buildPlatform == stdenv.hostPlatform;

From efc17cbd2189b24163e89a28b8cd24f7bbd31045 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 13 Jan 2018 09:45:51 +0000
Subject: [PATCH 53/63] iana-etc: 20171106 -> 20180108

---
 pkgs/data/misc/iana-etc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 249f0e5dcb9..6b1abad02d7 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iana-etc-${version}";
-  version = "20171106";
+  version = "20180108";
 
   src = fetchurl {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "0pbmq95gdkp66cljwklv4gzh8lvl30l4k77hfwvrxz5mfqia6qdd";
+    sha256 = "1x4jacrvjwcsan88rg2wf2a8bajsglg6w4396vbr18zh0sya84a2";
   };
 
   installPhase = ''

From c4e9e4a4d696bfe5225c9360a4a8616136cf9ec1 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 26 Dec 2017 18:03:12 -0600
Subject: [PATCH 54/63] boehm-gc, libatomic_ops: 7.6.0 -> 7.6.2

These should be the same version.
---
 pkgs/development/libraries/boehm-gc/default.nix  | 16 +++++++---------
 .../libraries/libatomic_ops/default.nix          |  4 ++--
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 421d7072397..35ea5471dbe 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -3,11 +3,15 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.6.0";
+  name = "boehm-gc-${version}";
+  version = "7.6.2";
 
   src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.6.0.tar.gz;
-    sha256 = "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1";
+    urls = [
+      "http://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
+      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
+    ];
+    sha256 = "07nli9hgdzc09qzw169sn7gchkrn5kqgyniv2rspcy1xaq2j04dx";
   };
 
   buildInputs = [ libatomic_ops ];
@@ -25,12 +29,6 @@ stdenv.mkDerivation rec {
   # Don't run the native `strip' when cross-compiling.
   dontStrip = hostPlatform != buildPlatform;
 
-  postInstall =
-    ''
-      mkdir -p $out/share/doc
-      mv $out/share/gc $out/share/doc/gc
-    '';
-
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index eedc0993d73..3aae754be40 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.0";
+  version = "7.6.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 ="03ylfr29g9zc0r6b6axz3i68alj5qmxgzknxwam3jlx0sz8hcb4f";
+    sha256 ="1rif2hjscq5mh639nsnjhb90c01gnmy1sbmj6x6hsn1xmpnj95r1";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isCygwin [ autoconf automake libtool ];

From 990ff97c6d82eb27486ec8dc3e9dbc453da88aa8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sun, 14 Jan 2018 20:39:49 +0100
Subject: [PATCH 55/63] glibc: 2.26-115 -> 2.26-131 to fix CVE-2018-1000001

/cc https://github.com/NixOS/nixpkgs/issues/33826#issuecomment-357436030
---
 .../libraries/glibc/2.26-115to131.diff.gz       | Bin 0 -> 20022 bytes
 pkgs/development/libraries/glibc/common.nix     |   7 +++++--
 2 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/glibc/2.26-115to131.diff.gz

diff --git a/pkgs/development/libraries/glibc/2.26-115to131.diff.gz b/pkgs/development/libraries/glibc/2.26-115to131.diff.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3d866c567a790b088e2446bf2d4048710a19a9eb
GIT binary patch
literal 20022
zcmb2|=3oE;Cgwd+*~PcrHvP@H_E%8YQgrgO-<m;vu|X;~FX~2q>I&Kv=ibWN*x13r
zQt(mW=#D@4-@ly4$Pq9_Ieq&gekFtcdGqGg&B^O|Yt@%wmVd`(#@oX?U*11)`GMP+
zYv)C;Z-2U1g756RcMGfy($`)~(V6RcT(W1^qT4Tf*qXgI-_$v`{>tmGLcM=$FTOGR
zwdh{1&#t8U{Xy?bcRfy9e*4Y07K^AIo?C?WZ#lAZPjRhc-Iq7JYcG4-T=#z;?O5`8
zS<w0`^J{;-jDJ+Q-u%|wn8$BFOn<Bv%*g-a^`e(cJHj{W9^Ntc*SlJ2{qo#p7xzu<
z+`1)t+6t+*s&#KWw=a9%IWzNam&$=R(l1Y+*jlo`Kz8Dpr5tBd^ps{UnW&#@7|nT?
z_mSAy^5lo?6YlBo?J=3Cn|7G@mggLks~6OMb$Fe=C7fQQDI}@>bHn#%YfEDMyR=M?
zKX`Ru+tFz!RTy*1#f7rV)R_)HD^gr+eOdUwQSHl0wI^xMde_>AJhuCm@75^x$hdL;
ze^YTIvG#eAcfCG7ejk|hwe0&<|I=JzsgdQsuB#s0^(^B;+=*7x{;1$d%c|7&y=S^E
zc5rTwjD7^yoMed|bxO)-%yV!1-Z^l-?4bL7N&CMq<n1GcLMN@M$?595&c}1z{6L_9
ziko<jZ~om0d_pcBhaPDAE#Y*NeK<oe<Bq`UX_DSqR(96*cDr@vmP;IYw^y*`6942&
znqOXsT=J+|_eJr_3H}!>C5P?ozf|kStEG09?e<#4o#CHg_<!P)^t1LGIgjZ-VLFr|
zn{sUJ&MkSJcT@7zoZKS#OBU3v%-^^$(SKh@@aai~F-cqQS6VGzqj*1S!rsJ#3LBqf
z7~Ono>vcZ!cHCudpKZ1pRvHq5nkHox9@avB0-QTJCX2555cX^13{Ml!#LF{xiM=@D
zdF1!9JjM6Um-{`ZbA3L)&d=YtRM^timY-c>w{bqJ*U{osr)>+T8(v9h7FT?|=9bX0
zhMk`R>u#FP;9I+L<qK8M>t-`_XTJZT-%;_sYPJjS?dE;EJ015N$zHp#%-XNVV(!t-
z*#`_e4JIv=oarerQDx16X-vP{Kiy}YHgihl8>9aGy$VIX@qe^pEkrlG(D|8ZKgq15
z;H}QQjJYaTB|SxzR6n<9=`>yO=czxtQ|Rw9LHS9`doLUCEIKlw<kU@{PpJztb7x*Z
zyeIg3nBHBB_g9yNDuqAr@G$-qmTJk<YT^4(WBKP2#(3YP4<F>tU#=B;uJhr{wE5Hc
zR$EKN*~e;WX$0_O)RqQ`X<id_n%t1Mp}pfj+p+6?VfNR)89el`TJZiDTO{jmO^c;R
zzP5b1d2ted@q=Ysrv3fN<hI1A^k0<S>HV40ivy3&6Vu*v{flPpX|)V)jz>EeOu3aR
z5~+H<*44LmQN^__=1)Jr*{`>2IhS@ypyq?+i&uDrDfZcOiHWTH({iO$jOE__qh~@h
zW*5|#B{V9&Sovk`e-8of%l^LWdF8h-Z21(`xu@LqtBRPqL*t_$^Ubk)+E+Ji6If+o
z^{-XgJ#F)os_V-+FDdo&HLF*}1qx=*X#3!xP;Db==C;UA^1Jlzmd&lpZqH;Ww4Irk
zrZqQle|c}{HKud}mkg;6zKQ2JBLscR`HpL!+&XD`)0~r=gWj}$obS6_VPa(8ho%Q+
zypq+76-SaBH_ltoVX4fop;cz6YH9tiw9BWdu0-k5X12+3+tbgst-ZF+SnhP^n{w-?
zE-me=Wm@DtjSeR=AAa@4xH08ONL1#NL-C2ZFWPlQI=a4VF*syvG@n^yFV(rza|esy
zT^{EJYP%KFG&iI;eW+jPC#mx6f?k6`e(T0*GmlNm$o$Vf=@5&+&X1WjtJMTPczAL3
z{9)GG+LihH>!VjJOTHcH%x4W$S<901W83nlRUaQd_>|6MEgqi!Cxf*viHT>y@86%h
zCzq?IyYx(X_u$eDIr+F)nadwuUOhQ+Mqt<jr$1p6svbCS6=YA&6xt*(&$>Ir{^r`I
z^G*&48|Jy(&@*I~IhZ!(^X&Ab>PO43EbN%@=*Xv>1_wRmWig`DiaA1-2S+MjOy<#k
z8=-SIMb6>esfibkE!Z8oZ0UpPbBq3X*E;ALxL%r4{P`U3r4EnGhw~?u3mD`+agpYX
zSzRMge7X3|gErkylMaP3r0iR=H2tNoj!#&aK|%Y&BXTF4Sr<49Ngk2AIa^@<uElo~
zpGQ?}^G#%yoY)aG-+9k8*+w3@9oCY4>sm$E9%7ltWqIP}m&2@IPP9CzaPnDn`jYxB
z%`+>n`0xI+L?=|_jnK3cZK7u`?O0>J&3&g&Uc(u7o~(wS7yKm~Cu%Mb+?6Egb-Se~
zIw@1@=jO1@3m&nAIj{0jn9g?jVP@3ghg)~Z_s?3~cxy_r{Os~gu|M)JZsS<u#v*cp
zU29<$*Y4zw{#xD{6FWKVovYs*6Jpcef9I<QpVf{7TjTuJ+i5(%u6W;k-iFt|y_dUp
zf436eu)ghW=k|BDJTiV+ss=B@&RW^m^B;Zu#HqLW@fTT*6cOQH=TG!pOX1n;*vuxC
zHfhGS7@ZdxD=HqiOuAyJcF|~Q!Z+(JF2b*rlCRu+B<IIsnBsToKqNy}>eqIg&54UI
zDGSULTC31g_31_N<9m*qAGA$Y2v{)vTyvt-29r!rzBP|~x*4|>cWo|kI<4&fY|V-E
z4@)9nRTX^CdaH1xaaa9>f)n45ypx~QA%93#e?mz{k?oV78zDybh3zC}tmTkA@Koh<
zt4izQm;>j69No_`^PjsvDN$`oocw1_4&m4ciIwp_J-at#*?)+=VYdGLP2=^Jl7$DJ
zKF`a4b53lHfpC~a#oA*}>@Urz<3Gkczw`6YEd_@wOm>K!)=*HgXxP@ie3|SLkq6IW
z8V)3SS<mm8duPSX_uRACX5Oth=(G0MyDxv#AAfrC<wZou^@oWTx87beGTMFE$9s#>
zkxI8Ub9P*tUi!Cr^E0NMcOCOXF28c(Oc!(OnEKwozvuGg`FebMc2Y9A3azC@ohLSy
z=*~QQcWz9!e)QYx3zpYCyEOm7#m=@9J5MEZZTo32`mx(8<6`z#x7h&;=SZGE^<K)R
zXTh<#`>sk_G4TIAx$dfLe|4Co&6MYwB7u3zS0%r&_tu49d0Boz@vWwqxr=Cql92w-
zrH-MEA{VWVl2+_8eV%f+flK$u>FF2NUGbJm`5yCRVdh32Y0-}}{lZKm9%@%9MjJga
z%E;1*>pr*I%UF663){|#;aV)Z&trnuL@BmOhTLKB4g9N^?9sM$){l3ls~NH<1f0Hj
zKYWMl7bf*m({)?c1#J1`cXkzf`+*v+M^pY?dpvXd`jAAItIZLI+Fo2M+Vpn%qx)IL
z`Vs3-WKQA|<+kg1p?~`(%XPufj{a}I9&JCzz2f`k^D$3<b=N%kt&uBm_$A{bwXpey
z^WztLta;6F%q?Pt!zaHISwBY^3q#q)8@qOfO>WKKdp$jC@s`PNd_-9fwH&b9bl``u
zYlUZBUxNP9>`j+y)NV{yxH5U?;=lK2ey?ZXj^EO;^4Twj2#<hfsS`D7K|OL0o^pHf
zYkB{^Y}&H(a@PAjj{<9qZcWL`VkxaT=~5%1<Mc`T2<x>Sl}lu{M_Mk4nBXZ<F-Pgl
zt_9-jU4NapIjwxji<)yURz}2Ky|pxbioes=8qK*LVQ+d%JgwY1<|?~{hhBK>vF-A`
zm734K*yKJra$5SLsQn*?#@a>OmoX$URO{c;_jqzvO{#eBpKVJsE?vGBc>7Ye==U<V
zKl~A0M?7BjYfWs^&FElWQ5143Ozpn;qRl(6mH(U<lD*fDt9e;XxqsZ6ib?U2p0h6=
zzPeAtef9SfnfW};BHmi2KlFvz+!?kDI>_;;8S|Z5xk1M*(92=xj3oCp-}5AT*m|yf
zzZ1=w5%zS_tc9LeJFdRJV^M8ha-gx9seh|f`|`l`?ibRoyf@p$+~p^IH7D@ytEZ)p
zPh0dz&r*%Q^qoccWZbdkmkP8w!r$<})@eAsbwPLON2jfE)~UA^c2&-|y3Sg@bnS`^
zm#iDNem1XuCe1O)DgJA=;a0U-cWb77+uZl^Xpni`!Z+)D{MQ~0414PqP}Cu-BY3Se
z*CBDg^=0p+cFrlYg65mnC@tS1)%^6*Bi9h=V|&CBdiXNR%dfoPb*(L5q-DA&=A`=1
zbsrm^x0)`^TeC54Mr&SB>-1l-t>&_)W*-&kWpvx*@E|X2*7?}u)B0xot0^d~2{E{o
z+!yvJqe^mmPhh(x_rJeeEv!rp4p`Xix7wXz7vhs+cjazOai-i)&rOkM+dr)=lbYp|
z?CbET<r4?vyuKw`o2JU_IrpOb#%76cmOC`&O=hsDKKu3PNBebt8#4KxpQ(O!v$K;e
zcjGaopl<mU5v#AA>veE{^fl_W?bAXp*UT=)Ep@S-D@;mGU!OTg)7HydEN|J*n3Jw2
zUldB(O}G0{AUVg@YS)Y1eMZ+8c&SQT%zq@d$U5_A^bD>;HFa9WKW??YT(9+Lro!pP
zi6O$wSpiI14?jOT{x0&PuJ#+ty%*0&_PvQ*{j?-)o9Vm$^vy<Q`sad9?74BM>}sRs
z)t~lpKR2J)oL;^D=gOHuD;;fx7$WVzURnJ7NUQ(*N9H*_ckE4%u4Y~IRM&S=<7;=X
zE!^w7qb)>i#GmWs{XKB*x9oM!FWzws%ThMKR5_iPIq%n}H#2ss+2u&{8Z4f9zF?BY
z@3ZF4SLdlsao~J=(s}zGM}@V8vOnt={i+qcxcX#feem7rj5R4d?+@#rwU{!^d)NP{
znt0x{{q5&!d3QhV=0EXI?#0n<yM<omZ2uZk^LKC0YtETX8mh0J)UOS@|EB+!^73|{
z*;|(9p5DD}e$~CG;%!0dy01*EO2Si39_`lJF!9ebPsR1U&tt5YzB+yRa&)W_YYA`o
z#A;*z39qiLaI+W7*L>m2%+a-qFTeT9cFEV~D;VxPisU&}`T7U%S&fr-9`4?(U8v!=
zGiUbHRLicZRvBXL*CN(`@><grlCHeXyRO8o=hDs}W!4Xbv^-~a*=9VcTDNbafbOG5
zkCso$YJVhqcj3X4^&aVRwY!gh3BEqbZVq=)+k_}avz-kd#`3p6X)DGy<@r3&^Z&K`
zb(P-boPfNLR>MSbLGgJ^^8c>Kb85YGzj<c;spP%6)~g%OCbGYp#`^8d$M~zq=U&M+
zP+ax*e^t@X&p)p&wXpcDQD?hjhlR!NKR>j>87kF9b;}Rl=U&kuHPf!B$6@D-@5ja4
z?UT<P^jBZ5K3zUjIp1IJeBbimkKg_{$#n3ui%(Z?4`0qM{^;=4qwSwx8rHlDIpy=n
zYuoK5^StLwu&Ix0Jk55a-`KL|$jt1gstnDWw=bza&e0Zd*IZ6Jbo-`DH`;3A1=SjA
z0}eKJJ3l&JIjQAi-0r<GdeP=}UgEO1<|&D8zn?KBVx@g~?P>4CyY`=4r(gTyyHVFK
zr`%h5!tu1lzmDBcWBBWF{}<Q6Z*_lvd*nBrx%i;}d;izN$8QK8k+wB@WcPJp(>J&L
zg&Tv;Z%Pg24!SNakQNs>-);4>sY@&r$~HR1C~RNQA6#J9GUbql!k<eESUSF1?GIt;
zva9-$Geue>#)?TJLHnd|wbG58RpDj(e(f=-FJW906wY@^;m4Ws*Q;vu-z<H~Iz^uG
zrSYl#;kOm8OvzpT&FiK5{2i;Lu6|~^F=@l*zSE&i`*<6?<O(X!O!#8U^Gw21$2adq
zbxbScewp|=d;WGj?U>+awQc=z?WgjqS6Q!}>t^?7|AtwPu9bnQ&-RP(UH>}SD>gnb
z(CD<w*0+niLUr9H{NBAr{&{*z(At+hTED$MouBOe_*G8T*N2CH9)0?8;<HrUYNrlK
z$v3u)b!tcB=GT-yPu!66PD5|gOua`kzNNLvYfEbU7p@TKon&FsJl97me!IeJUrFnn
zz0T&hZ>?c;+MmsL+<5n8>8(-UQZ8(EE4m>+HSpQBms}<}Zy&W(ADKV>qw%AX-8B=e
zthJ^*m#EQSU@vm8%w(<4=G}9p#D6Tgd+TIYUr1nz>(zPEiYGr!_$8+Iw^QrTk(2h<
zU6r<`DTXic&;Q~#b%zjhm&w&HsfQk}Wynh_Y8PH?qkmqQ!%Ii!Y~}jJLDPCa-z*AG
z+O{=v{`mtF&uuW4ICpIAwF52Tay{vH4?g>uGjrbD^V9V9)!v!8BHwnh+xFSDZ*J~4
zUVQ$^o?OZLllh;H6*7F8l_Fo`GckB|N3D37VxQpK`?9O~j~IVl8J)h|NASE)uid(%
zOAJGtdxg7>%-NOZ>bYw5Gx>KG7TKR_VwVKnKlSMG8^tsC6(?mq5t{t^d%?Y_RT8JK
z@XfkuQCi+;|4ndG$n`+86-K<i{p&eGUU`XLdpUouXlJEn*Y8hqGZ!(%B+Xw}r&_Yy
z+5YyWh20K*uk!15oaEU%K{n4URa5E9!uK<hPiJjC*8H%-=0(J}9cyIxmuVfXxZvY;
z@xAFT=fLIj4PUY_w8&lWX?V23Q;YZSvVDgGIL}R=!o6B7y6TzNtyA-hyH}}7cic8m
zH@Uj9s%*YQ2#;B?e?M1K>%udA@n6dmzlq&p;5L!jW%qau&%Zo<)3rTYtJ^1sn_6U7
zUkKq6U)tw1=SBwq!mdp(cK=^;KcM{Ysl`U8S`TdadMvGSmK4)Zz2+C+HaZHNKIFr*
z>#@UX>t~0)hV}C;%ocd@<g|SZuPk3^=mYKJb0#|8;8wbQAwJUVSJ3?gR=usq4rpFz
zvx(H_Z1B6jK#TiWj{2!^X$g;4`mRs&)HWD2?w2!DHkh<7VA;a$)>3A>Y*`j_uKa%8
zye9riOEpubQ8i!9`~tcBC-=U|c<a~YFHiKhw>m1x7q4@2-r{K6tDXvmy27uR<Qg{b
zOx?dYYJ!NG&E&S~6QW!E?!JD1^Ovihf>fs7rgE*VFJ$|F_ikL_Z`EtR`SI_7yS)pn
zB_=X1pXG8eD_Z<&()O)~Z8Ya@dRD{Own{(RZNd3nPiOPr*1WSME#>vUU*>1#D|VMW
zO|D7b8y#_e*EF^Al^qt#Ru_EDE5Grgcb?X^1KZ7Jc1^Qbd^>mbt9d7u&F2k#xi59e
z?`>ziYww2tUsl;K8^2IoX`icy;h%zJpEvh(&Qwg!lVQ4)7ukQ?JH~C9bb9-&P`0m2
zcpj(bUz3eL9kAZeDMjdsevX3U3`zMNMpviq{4@8_Ub)_dMz>dMeNH<(>4g5CwMqM;
zm)v{tIOv>Irt6DaH>GzfRfT0;x}W;M<c-$tM_lpC#9}1>PW})mvv}|3x5wG`RG%v=
zJi&ZEI{dGz_^v!%&Y#k&CvRzA>);a3&9%aDdxnJ3X5HPlXY*92tu~dJrM%p@kZtc<
z1C`m4Zi<oGyVnWck2+k>=Ql?;|MUA6<0+HZUy9W%vd@g!XYTZHvExh?pPSQPanF-I
z5pi8(X4=D|ygK&jq8CNnFBkv4x$4M~W1TCewC(@%(*MIUwrw4EYdjygxoxztt*bsc
zeVv})y}xVbT{(4g)348Ox`acO9Mc`IZx)UXt>8Q1F<-Jv^ZWnp-=D_k#`rF>f4qOu
zVVT>LCbpER2v_rM^gJXjUBhtv<mOtFweQ5fMBH9Jji;vX{{4ShJF~y%Dl*Q?DG>60
zwQu{oxX|s_4hh^iG0A<><we_X$>&ZxB>tZ7pWTPGQpfhH>NE;Z`}A>z?TsIcIpsnk
zB&O{9`uL|pUt5-5Vv2!@u*jz)D<-`D`r&rUh1Zp>y8UgDI){S)IIS;R|2C9QW1e=4
z>-}lW!V7xJo|cDI+X=_sj;&mGChaOeYmfEz-JiDXpSdt)>eSaIfs#Dxc6rZ?Ztl8h
z=KQ?rMEZW_Fc-_JQm3Hla?yLLTAK_XEec;9@^RU`x*J+MtET?DeZ<PiyXTwnN;#zs
zXTNlOu3oBs{>`+%S6+q3t&h05A#D4m%kS77We$lSn3u)c_K#;<on&6mW22KzFXvx*
z@|;H?a?VKyUz4xvUex|SGg)8cKvHIJru>l=9Ws+mcdyw0@>a_AZ>Mgoy<U<%H8Xx=
zbk(h`p`7<$vQA^1vR)@nwCa0%@xs}T?;I4Q7`3GI-O5{j?Yko@7Mh{v*U)(=ZgOKw
z?W<F!Th3{&W$3!D#eCXE%ezr>feOnz4*%~q2dn?M_DC7r_1wHO`+UN=`-|Nx*%NaE
zeth5i{N8@o8>`nD7R{XFn5O<UE!l_nl2y35#9~vA<YNtII1}Q_-{;I<cCk78y4~k#
zXG7l!)c>z-y*q8Y|MbRFkykExEijAiNP7~`Dbwt`pidz0xAB7QoDU6pxA^o;2vhZK
z3ZL`MV(Si#?SAj)Of}@aWU!@p>W_&#How%7JAZSr+|oI3lBQlyWzAaYlWzOx`9qF+
zn~JUXUr$ZQS<lD!^0se)=AXappN~D8b94WLD-55!Wn~WaEH%-X^=y*u{gv}GGuRfj
z@;YAFC)V2biD7AVMe5Pt+>%@yMUAhR?5v(qw#V!X-}m}k*0v7qmL^wP|6PzhRAF=Z
zUshX;>~+&b_3s%KOSjJb+gYF;z#jZr^NHA^`m^W6a*mlOeAPU#obT_Z@2_%qnSWVx
zq;F1Jz431AGZ(WOzKQRhbKuE@j(O$c+7|>roILpd?)B{||2)56J~&n4@_yx&{nO_<
z>*oCD+9ofp{J_tyU+=F#R_~3MtnY3V=W@*78@Q}IH}R%wk?5TqN$p4LoaS%1y6V+Q
z^KEavOjmYCq|3}bSoUjAp6Q(1U)zu0{-gHTxc|~A+oxWy`zO49C=hx1*8$`Hg&QL;
z3VY6aJVD55MO37K!z4CU_5{hkJ0?+Fj<3$hdFr2>#Fjs=wfn^X5T)ae3f>h_)raPp
zuT|O7qGWq`<Bs{iy;xOWl|-))=F*zFV5jkl&}hdiaY`MAjut9L&$30%UO8#MCN6Z}
z6+U5+_g2CpW`4d?eQqzcxW^fJ)55ce%fpssU!2jxs2k5_1btpQ<I0A2=2?F=?z{}w
zdb{D;oA$d|0kLK)#RRTziDLa{CR}ajxVAMr?5eck(z$u2Iq$C=4%-^kn0xE}mu9!*
znFlU3JecMG_glX4%r%jvXO`9|mM?#AzH06<g*BmCbF=o}%?;W8_t~bEAq+9bE93t0
zs$DWjF+P@QBN}|8_t1v;&#MEs2ff_B$ZF2Vxy#<qbK1Pkw*HxP(8g;XN27$FiE6YI
zXU>`WMdDuo&r}_@W{ZxAYZ=R48h?;Wcgp*6pl#xEg>6SK{(kcQRrQkWYkp^rB=!Ee
zsh&UkO~69ckb9yYdVXEeCbKLPF8h4?6d)4x>(aUO6O6_&yM9iXG2PegqD1%#n+q{h
z7EJI-GdQ5ldV2~}rtdnTE$<bs&)~koz{Pjg@WPf&F?^Fbe{SqpW0dSa<@K|SC;fko
z)21uWQ<(LC`*QWFu9)J!Te>@J)2bidt6#RZxpY!+ewgWldz`oazB=c({C1&K!E;A*
zo*mJpnFsz_J$CH8THw|Y8{gypuY^n3q&0KZj<=i3-@V=Z{_W=flHYE=o{_#jB{5g_
zLg|_XjEQ;u4Aqu$k4@{ByjgrwJYbRTYTJs}Rcm-lxemqlyz@HrWZE;HiHvs_T(Ah!
zIM2OzviM%}YWugBLv52k-gb75UcVsQZhF|M)4Nv8;Xf%Swm&TGqNEJZ&0jqH_mWP<
z>b~p~-K+c8S&}7K^>J%R%z};!jB$HJ*$&&klijl@@XDS;&q|HIf4JZMC|LAU@#LkB
zuGcM|HE{22OuwhP=0(V?U1`=KpYF-XFWi0ap7;CmfB)Y7cu-<r`@MGW_hsLo{dh2a
z@8w#J_Wj@Z`uXasYrlM3@?@&(8HNLY@&$Kx2dqn<_`zGXvTG6RDa)@#EG0F4Cc7U<
zG;E(**&`fbCZ=-N^Q&7ASJjU7Rol#6I;Y+hwOYw^zEIh#hxLS>RD0)l`)-#rOMCj8
zT16|=l8Rgw?LXx8b>?%qYo7uSmTx`i;+gpF*O?keoz7dQQqG>0V|<r;WZMz%^G7Ft
ztXUw#=H{}rF?}}wsq<(5O}BYH@m5pB?GGYlW`SS!RqPSmA2dHaA?I9iWdG+-$=L>X
zR<eHWlMlI`kaN!W*s_~D({tWQ&aOW8?49K7gERg-z8So%e8>OSneV@>`2P6b?eOJ$
z=Wh)R%4;;4FXYgA<lz1djVzz__uk|GZ7(bHE$-d^iqa&D(#{R~O?(@Y`EnD@9mDQL
zoZhie-ztGQZ|zKW>HFbNno{rh=+4LwOw41r&plr@Q2MakIgz(rP8a=IyZ`R<@yT^E
zxnP<U_ww|zJMU^=Ml#NBx}vn?lfonQlk?7t{C#A@cTQ74`Jq)*-Yv0NDq<?Uu5qc`
zB>I<L^WSpNQO;nSY)r4`N~a@<t(;%4J=A-u5bw56GWI}Rn(h4BZN1UEZcHmmuVp$N
z`{)AWj&+u|tsb9Qf1}LIb!*3>x62vCKdHzab)Mgpd&(e&U;aX)`r*SoI(6;4_S$qD
zny$^WD$zWLHE`)A9;?7BYfWF*ZddST-kzDmX0lu>W8xQv%pA#d*BO3Z3n$ng*{Cor
zT1CXEJ%M?a_HK@x-Ft+lwwA5nf2;OB?wjDm!29`Ld-j@kY*+WXKda)h%(k1mWbC9=
z{PqgI`WEJLSI*UJW5D;52mRZt*E6V2zibh`H}bRG?0Wa5dz+J@-?UXJmfb0Sz0gzW
z6#pr+SNfOBHa`|P<vV@CCcoQSDwjFuM1|-bt4*A+?(`);m8&M!wVXc6OQ$rXWmI$e
zA7oE;QkK-N2>LkJUvJ4&LmT(^Dm(%r51CfZpPa~X-=fBA{r37FLH+98(NDf;|M{BW
zy~8B1x;cRLjPP;CBPS-CGwykOYI4wlOOLh|<eZ614t>}@<Ll#x9D1voH_SNyUc3Lj
z&b$DpFKPQtSC}<h?OOEpckTY*+%JD;Nq>K_%kPe|#qY9qC9_hmTReX{i=+hnu3Vnf
z#n_>gzwFxdI;UxD%~Ry&i*Tu~4_ayQb@QKl+68wfg=<%SP4aBf*OGeB>fgvJlkUG?
zF8$u=x=qVh>{Q*ev^cM7ZKP7l^J-6awz{qIW)H1GSC&ZkMlCjeQO53lU5WMhPQ8^z
zEmy2wXzpN@pPLot{)9{8L9F=c1c9FChqs(!-w-h4s+nbyoJZ>AvxYODcUd~@UFHy|
zAIJEg<;{WJ+tq&`?=rmlal)iZlcf@kJ93Xaoh}iYlKLRZS!Wra+G{Qeh8f9*Z*?DS
zC};bxEZiQkwt@fIsUo)f)AtzvzB#jOQu-Oj>$P7T4{zSLv-d=v^}!2sx!bs(|6B3>
z-H#U^uIAsWmD8$Sf1!=bL5=^)GLD)*AuOld*78;EOkJp)_S4{=Pjp5G$G1BRZ08oN
z6y@|%S`q8hs%y+N&G7MGzO9zQ{p;plTEW3wmCVPnMciq*)gRrwDN1S<QEz?sbbBz&
zkLi&-bTooxrkt{o1fSuCtJZ~+UFvpDd9|g0^_fI&!RBPCef3{X|NGd#zVDvmcIle%
zE&0L+lJ>VR{!tjNC)~rs>Yi+QJiy`h#Dn|}PP6&j54XDizmgDEbT*DFvU}a4y{UOI
z#{S#7_x`{4N^iPIUa-rA442IwE$f8irm`-xOp>)!s$9%uBXs6aj*y;#jf`%hiT!L}
zvEa0u1&$x~JoKF>b%ST|$E#}V%jcZfdLVSxf(J~OZ2~+WCh7Hw+%M=+t=?S!Cu(i*
zyMuwXhJAfpdnVRbec*K$VVI=Tl>DM~L&oNuug#lp@?XgN`stzSpWg*a8QZH}jrV>|
zQL%pz=lY<0%hcl;wHKFmm8JQc$xUKmRSy@bzh$hqxrEKN!>W42vqP63J!lKv`1Hx-
zMenBWm4EZN)<f~?vR5VlN<M6Ql4xMtrOm0s@N~k2@N!9;AiamG3)Qk&&l|1qKYKxT
z?%}8EFLj>t#6`c3p1Xhjv(oE}@^qM#cz-aLUl0{M^O#%6SG@Gg9-WJiHkkf!J(6?s
zl7U{4TK9<zMFZ!ISq$N}tEcaO9men9WwdS`&*P3q_I<vRejWQJEa25Vw14r<B`VEf
zMQhpwR1cqeb?EbRqf-kuWICKzP?mb)6D|8@8J{B`@Aj4DWtHz&T(7EM`aAbHgK5=2
z(Q6Z!)w*u_9Z?E>YU|{3DdyDLtixjJo3r*!%W5bPxORBO{j4ypy3MioGfmm7-#*>5
ziuKspRZ*@drmYNXx^4cqyXIBZHV-rQ-FY55=Ea$@lVfd`7kZj0+I;XyyLg&cduz?y
zX=^6#wQF`W$=I6pH*0lJX1Vm-sN@Up%+^QF&%SmnW_lVo?~-k^ltf&;tkip!%(L;Z
z6?B|wbjjvtnUUO)^zNA{myR_r;*g)u9A9G>EGRZ5zpo<n$?iQof}wSO4@*l;YoFe!
znbA?;A#t3={>1lvf3*KH-c{@_=6kQ|B-CryDiP~-?BAva@zRbZMQxD*qV^7}<;|X^
z-eYZ(`h0l9a;7aiXWzbBxZzTBjH*Id)s@*sCPG5uamGuo-M(nE;qVH<;&ZyLkI#S1
zIh5I$awTD(Yq3xAidi!YD`r@Kh`zi2?#Zt*Mt8z4s~#?mpIiK7=g!{L^<UpcZNByH
z+G^{yx8q-bjw<!6``%Qqn{;Zi@kSnzeC?NKHwOPX?OFNyYS3Ocv&|w-DyjmJYR5FJ
zlVz9r)EAVoh$?Jbv!_M(cGS@Zp^Hg3PwtuepUY=D&!?Dk4<n6&W*-)=3_i{0!+(TN
zYM;-ygP+eGPuw&^y--3jY+GylVkK_FQ#&_a&pg(5VHN9x4URcMpSDHToBuwtQ#Ee>
z7YnCK&y4SG6Z_3}JQv&S?mcIQnDH*{DNgPju4yl>DLrlr?tV7aWhH-Mjra<cmZ!Tu
z1k0#g)U{gE>U&0&;YN9Jv`d>#VtxPj_yv-eI=6TVCGz<$+;Y@#cY4*6`bn!!ZsFW)
z67}prgVU`gH(%U&DQ15COq|gAQ<3i?;)^!RmgFz?nJ*K*=CE+;q?B)$qV-z**}oJC
zt@V*~bX=tICS3Yz*!HlME&mo=%-}6sw^$)EB2R0QuKJC4W*hHXYi_$e-}i6snTazF
zwR@?&Su1s~%+mf{#cJksL#^1<UBz?SrcIfo_-ohQstdPXzB@3*eQid-=f7$DH(r{e
zU#J`v_DSk|@19Qa&f7+teO7v2FTWp=&KVZTFugc1PVgn~^?cq}Z?l%mg=&S~=g-=}
zRr%^eOn~?EyWgx=B`(^l`@{Tw*UX~Kld)6R+JCXQuy&2x#pv0*f(GYp^Gg3t+CP8J
z>1we_?Vm$Ru7`;6Nq$!2oz1$m^|M^<#Vx@*W>3m9E@f1>tDA7U#ijQR&-zyzZ@Rxq
zyk!+EY<f}eYwiCpPx<#YAHMwe@!`GUY!`*L%EoS3?XmLx;SEm=wF5pqS+T80Mm{fV
z$1{`EtaXN=Zn4$7HXSiBO;xd+^mFzX*4rF@9QVt@tse1B-#$kus4QeXUzGLNtd73u
z!1RFT_jR>Pndd!bnI8VC&EjjnN{rs|vgdbpaj(nTb^E1Rw(o&0Zwpqwd}rD_Q_o8`
z^JMiJrp-U^RTy@qO;O-oeXMih$G7*ozJpPD=yw%yw^I@xOL&A_<~W^R(3;m-w#BuJ
zG4V*bfMZa=(YGDf9WDy-h%37;v{CT$-|Jg=`Rb}r&c!o!b=k`BInSPA`7V3Kre-HU
z-PwVc1qE1n_b*xQ_waw{OTOQKc80&G@ZU1!2J5uBE-hw${p$kuww#L*EB6dop;1_O
zevkW=cA=+J^>*2MzO(5%d6sF$9gVV+zY@K#bw?B(PEa-P4lZgIP+j>#Wu=Pv%Y?<h
zY*t7*OzdJkaPQ~I%k2*@tFm0tjya;Z>_)Z3q}C^gH_Qml{rqj=+QrM|{2Z32nDp-d
z?Ej$j?}Fq7w<lUvy4lXY@@iQ|OoEj1n#p?`OT>c%R;-`B={(P|t`}3Hc8A=Uk?mqU
zbH-D@y3>JPw*tx*`E9>?SJFglYFhg8i+QH2{${`V7IWdwn(3>Tl;-+&XUv&aq1{?s
zuv%|@V6UBk)Y(5AAH<v<A36I>c;-xf_wOr>g=el#vY9G%enWizyEi{-cZ6=4W&O46
zaK4MBl>g>!wy&Q_Yp*Ko4O%_h%4A`WvD>BZ6D1$NZ`m36DzYZQ!^Bxgr0UX(kl-en
zr!i8yT#T#qHd}3N_jF5-{Ip`zAxAI9PJyn<o8FhFpO@LHdhmjHvKM!Vu}_oHFYj1K
zA8tDV79rQQ_U?x@)2g@g91FfUcar}_gIUUAO3cNXw&$xq&Z;eW7n7eUcvsFPQC;SW
z(*B^#FV<_zlviDiy8d?Y=R36}dch@IES=qbXSy!Gy6aff<ztCAzX|iKDc|wE>OMzm
z>EzrMO0k=*u9vGFb8>QeweIMIclIZ&+bu4?5%_xe-pPIHYra~9>pb(Bd2W$o%}U>0
z$3E^Co5(0KdpehZ@e!Fu!9q{1c{A69ZFpMZshm4$s$i_j^!U$DCb&+@J@_`Y_m}_o
z`27z9+J2sMdTH>^Ea}vqn47cBR+(BQ7GL-{J?^9|uf+8a>xx$VJ?P&McR6vQcCzYU
zsh<aPit4%d?{B?-|4{h;*83Oy6=w$@DvdXveAaR@uaFt{Im_SMiV}R4CZ2Ih@|_X4
z^z+uwe;!_yclKKGn=!h;J#O#h;KhAe4~t}l?=H<MDb6z4;KumNX!haMU5sB-rn-fO
z{LEspp16{g=YRW-ceY<&ojPZici?<m?fK)+xns}Ntvg-(RqEfmom`)!^TUsNEv#P=
zCcSWrbmb$~RqIc0xc`2urod9g?Gc(2^UTwgvgdT1+pF?*`yVfZ>@CKR_}=uiCF}{A
zpQ*aXb#3mREsVzsq+7o81l%ZC9_C(O`K<QiDv?wrUN^CoN4`#4UT@NM`jp<8P2Hxa
z;@G!uth!mzYj;HLj%#h@&23jZznR)@^U}X{{p;dwY;QvRrA%KQoVacEnP>YB`d{ua
z2yQA5c{p+A{HterI_n-43jNp|AhA(F=En54$7$>CusE-EQ}Wj6d@R=RjB9qriVq?c
zx7FQ(B1|67)H`v#h^_U(QUfi?0#%(h&)u#Zl3#K-9xfO79Lqo5>6*t1&B=9!tOhd~
zV^;<FE>-cI9m)4Db8m5Phbk|#YV5^?e^*v7Oxd*T$fSciHyad|`x_QAOp)ub4_z5k
z98&akQ}yMzYa8$G$`S~;aVhWG*}Sg(9_80#?_PZ9RvOv9S$2Zb*0RZYPQ6uyHy23V
zINkOt?C~r|(;mmxRnwMD$tXI~mh<b$o&`r*jIMvwN&2m~Q{8aIB^j%(^wYI-ii%~$
z<Q~4Cv^_J4=SxsivtU3$TlYLW#qH+{vhT%(Y+8Nh=*f!BuhyQ-|Mj(Mc^H4z^?S2?
zUL2d6>CPH%<J#2g;kEqnr1Go3yD$B9efe)u$?TNxUOIcXu3C6B_RgNX>0kd{n!3+!
z{@(P=%dav|h|ZcQd7?Gtbyf@i$rskz_eAp<!@FZXOa5FHxj*B$mDDk13t3Z_xl`U(
zu=yy?)fD=(@wA5Ute-4TtLErt>vYVrKOUx`5nWRGE}27_=jp@xw%RVuNgpHXKJ^&v
ziJo(9p~BQ-CB;wk?-%Qr?Om(u{C8=}`E6MWZy!F+tu)mw3iCY@z^8ER&_<!e<842u
zw|ukv$H6N9yI)g4sc%of7rCmh+t^liDamO4UHI$9CUfD*K22^~T*r^j`M#9x@~w?O
zB(22W@4aVlYgJWR@+0_Sn*6>cQzv988?4R>3$1cI(7^A^XM9v|kJtRPOtzD8J}={p
z-v8cUZohP1ooW3oL9?ehC#EeeQn<TgN8GGyc{MCmx8C>)-aq5_tc&gW+L`Y}=1hum
zIvYHb*<aLr&n#EBi*vT!y}V3z{?d}#HxE5`CT-G>X*0OFdBNeJPk!r{HpFgG%(+r(
z;Q#Qu_MSy&>oW5*-k1OQ^{Ar$y~y81PgjaB+-#)$@Htcc9ogdTvz(?D8?1ld{WPd$
zne8T#H*3<i-Fmg{w&P~8yHUogr4s#DtFdmHGB51?iQ3!ZQruk{hZqGq4)4)p3b#1o
zdXKMt%d-!h*~jw&@86o~b!68nbIog^n}6;Xd98I=cFKC?U!M(n*vglme6}@(>Acf*
z_UP$*cp|-J?21Jer@ol4I_X{UUIWIGcPCfvvJe+#=QXq!-4e1+Oi%Py7~2w_-b0G)
zLE0i`Uq3WxTBrEhM_;(rxFqv;gY)HOs*@yia*Q+!?bwStmdQLj@vyYsXbXFHXu*b%
z&@ds^-i1LMMccTZzN=WmFwsq`^w3l54gLpq3Z1wyNB7$?<D~B#K4%xOM5(dVR{i<*
zfweZ+Q0LZLv)S9D)hd%&7Vns^E82Eg!6x<KkBGVES#PU?A2c&uTBjcKXNqF|qNH%8
zy{1flKHd?G$!gh?t7F{w!W3g!jZbrg2Nqc=JIweu`wer>=LQjz!=DY9`R4MTRx&E)
zN@Kfs<@TY33&kHB{v5c}==tKz$yQ<SY0@daxt?0}?6Zx|8=es@3QAITUvctT)j~DV
zB{>}@^Xz$k_4?iDxW;X`(&694g{t{(4*z!<s_(9UG-Gnv-0AE4?!A%UmBhW;JiBeG
z$%(CtE{U|B=P`ZxS8<`*$?tdh&mGP4P>R(yTz$e?a_x1VAAio<32?gcDf8Htr?DQW
z-DLE9WA>GZ-kQ@=mL@!Bo8Rfwq^X5HDt&0YdHvI6k=iNmpC;Hfe?79{P`SXm>rKxN
zEOs=0<<^_EdY77<>A`;s6RT3~|K&ASy{_Nyu=l%QWxmwJ@Z2KNsn<)&9n>y!ozU(+
zy<pEGkGg=k%}ka(eC=)(ajXjWdG2<eXxkuZf0t8e@`OzsYhJzI^5@-xdDF8@#2Y;)
z)T?}2WcTN;K=|kLT{}*Ff06F{rTFuNH~iZ~nwb6^{e7o#w^}n}so4FPIqr`SocncD
zFCb`{Ux13&WK&n&Qg^YX`^%NBSe=x1PWpbqsYGwX%^a`Qix13{S1&(&+|z?kZe3VD
z``ZPAKeHD(aDM7{Y5cw8@@b*>mEy){q>UE0?Wq2)b4ULCq0E%Z^M~$EXkC0(XX=S`
zwe4#69$b!L^PMtr$En5Z?%vYAutoLMtBqxOYmXZpNDqyy6WL-_clZ14?O~})eHLB2
zoOY9A#ga+emrk6R^O!#%<?8PGDAzE9&(9B5_V>E156;M4D^+r2pYgr9ubi!Pq;CBz
zxx2qX?ubF<wq^3pxy51nuMJt9zjE~(*lZX09Y1GsFE86n@8j;jqF04(d$W;M<m~&I
z%gY(p>zxT;HQw;iy!QFkyN_qxk9IROTNI`+{pa*q3woAKJC<~5nX1;w?sxi(o8QI<
z&2Ct$`a~^4b<?Da*WU*nIF~k=n^7lUDaQ2C#%<j<b!G+f>*ijMI;B?eY;)o3Sc98t
zTXYuRy`RbUcAfo)>!DUN6aFtbv+dm@+rzcz3;y#;<ZWFjdU@?Fkt4yP6-Iq}53)~w
zWZT6U?^|}a!P_7;Ht^ESUD4r@Gn>ylm;HFtXCT{rYSGTByX#vY`dz*sDSy`RjJ<x}
z;eU5ehrLf-U2l1F)x2PnNA11dQtu=4&#mAK?$5MI-}n89x#*pfHOpssaW<_wEtR=Y
z%ix(o%e{Xe3;Cug3#dfR&AR>4<iPEYV9{qMlh(Rz-7MUCHEVgD@tUJ*j$hSSZ{?g?
zJZ<Zh8@n#r@%986NSf4Y-^}o6ZlCfe<N7_8dtKEIH~sH4SXm`?KD~50R*?0%9^aPj
z#~Qy~yXjriTNHG8Zt2REO;hjANL>B;x^?e{dr{@dS_|}6UOV+g#C**jBdgHfduKV{
z^)88;G-K;Or#rhem+#uhI79Hjn|c2<Bj*^W=LT)se0O<Lo8r+)SA{OyG`_rQlDgh@
zW>3|j8KuEjZg0sxsSvkaY~|rw$>-FUyX>vb?%dTjPjtogsJi`PS8qFhzQ$B~_e}27
zmuCNU5Bw8U`f_W2Xv@2vP4(uEyzc{w^hACpu}a!^9BBBS$6TMZoslO-=<H&L8?V(~
z{CoGfr}w-?&B=;I$*RnA8+SdGs=WH>al|w6Wl9@P$N!%H;8WMJ14eV2d&=5>#%N~y
zE6E%!R8i{q;IQL!^_>Nu3=a4*v$&|)KG-gEIMin4s}*j)Rw;d7P{z8Y=#G`>idB=$
zzF)YSn!QSYUA5P`kf?bU!i}fWnS9yrKJ%*=C}aEUwe%kE->lt&Pg;|&lm>f5+Aa_1
zc^h>6c2j+}mGj@HCi6atKCJz#eClHB$}dS#%a^C5HJ>lMr@vY4R!!Q}%CgR;u!36^
zg_$#c7l(^h@-|$5tM+{Hb1vp}if`*SJ!N@tQT>Z~xr5(#hm@D6v)+bGzV!KOXw$ce
z%<XTbu6f;yI_6ciL^~p5(x=`c?jJI49aUVyU(()xd7ipaS$U(lp@5iT-mM2NyEe3l
z1{TfCnw)d%<Wu)$F=Fd>dm3~vFMh<uf9{yX_Qd}WK75II&?DqJcf*g9>~D^*t?=?H
z&$Sd-TgU%cbhq%rWlU4|w({;etFh{;)xm_b(KDKUs*7fI{kxl;`%d@nf3~REF<){s
z5>h1le$R3Ln5wy5&d&GD`bh?})NXIQpO@FaNbthUQ=CbR*NYot50#lpy!mqYoZr$*
zUsu=JXYjAe6!uB4ZA_f={zJ}|@&FFb|JPP|-1*KZ`akT&*Bv|scciEOQ`ysW{^FC*
zY!lkF;@clK%C|{7+t2*WtP=XQxA$#s|GY$>ZuV&D-3EVp6HM0fJn!z!lzztYI+=6P
zg+(rjxAcT+7}v!(e|TJwZ0F=x-F`|ar;cI&p7uC)F2xsxTMX|CPDsBh^vB<o`IG6~
zcMdCG6xprTF-vd=P?5W?krm$VebIRC6sB@V!P7gg^Z4CW{r7`sdEK5JciiNrZixJU
zOQ}fpci`>(EzM$UQudp5?0TCOv36Iuk@%FoD|Q|&sEwX+Jd^w1+kiUbRhO*WnZ+5K
z_qocf^V#lo|F6P?_=%MVtCxOfd{%Jya7D)lf#99|YN_>NbCh#U=U;U6I->3JP$o?@
z>fi(0f@p>#%lBRVdY!FS_D4gOA&dAwhOWsTLf;=cRyNE1%Ql?(`-|>QDfXJ(a~{5J
zlF|~kj$LLc(Ax1+>-gmJdneX&&VFm9antKdj@|x67o6ldTvlmvb?Z90bM~0`SiXO8
zGGBeKx{SG1py5(WLCuF(k2Fs%t5|bNL|bxU(K(^{uAd($rDR?(bycaql)v>>^M;$N
znCdUR*>Y&b<&V*;-&(U~{oEIPwBY{RErs_l?*Fj)`s3*mfzz3K^x3>#9J|<)(ljB1
z@4LlB@7eVSe%e^nlosr`-~6*?<M&rn!xIuz*PrtUlL$KXMKrba@6lW5RnM8tuMB;E
zQF+zxeZK_tPxfz@*M4o{Kk5D9#d0R)Uy|N`dGO*xqhJ@uF8!r-9PP@cfz}pZ^5#zB
z`gD9%v-z9FC${)Kou$1xBIMY)k1ZMvrMe~)T7J}X#jxL*z<>VSqOKkL<csE5KANm?
zbWOb&yU`z^xMSNVdgQBLEMU0u^MAseRjkEt-86JISMuh!#&!Ju(Q;eduqKqpQqCmR
zzM1Q9ijfN&U*gi;hbEV_sq-%G>Roo2qj<S+_en=(+y9652U$*;&fe>lEBOBV{k?Mz
zm2c1uv%12zDza+R+M?BMwK?UpWcSOOE!t)M=CN1q%$Kjr%2Gs5)VoY@S3aQZ7-fB8
zvGRe%l8GPePCTA(dt$MO*`;~4g<qa+Z$3O<Ydv3`gCm=N%O0(D^8W>yW&4VYAH@la
zOiB_-`%*t+%9Fgs?pc0@pKGkRH*M6K*vj(eO-0Sa<1dd-v%g<eo;X$O@9dT>CXaWl
zebmjt5jbhZQ5!Zkvp%7n_a1#Zzwigwl;`JmAH2`bHPiUxzKZStejhk8lV|--=cCb0
zpWZEqmf!N%-E5)$((uDqI;WKE+hV2h^ZMf&)4f79%KL=&{bg5|jS-#Vb*tnyW8L1_
zJAY~2)tPYBH}&KUf3bs=`wq;uTXI5K)G9FRT15A^-2od9K7V+z`|{=c5-x#Hvqa7s
zWpneMe-!Bd#7bz5J|~yTYwP)6+b-S+V=gMpwRcnfsVMgBwEfB#E}ly#3qEMrZr;T#
z-ZqJ+r`*%`^Xf@~E-t%$T!UM^7N30XamA_f@U+0?D!==rY<N8@O-^)V^*N<Y)89Q~
zj>`dgrK7@|&I{l8dt$kdjpfeICwVHe4rx4^xFyd)Zl5_vb>2!FyF}epGolxNx-<Wv
z=u_KQY*p*O*WF!Jn{r>y@c*BvGyB{06sNf~PEu$55OShpvD??@MjKYJUb>|rG)*t?
zlNoon;TG=NxBQDAE#rK&S1-MFuIS{``Mo>m^3|sF9_g*yCc(T)>_y~?o(N9$T!$db
zV<FQ-9Ne{fIi+nGkNQk_D|E`a&Fy2VA<y56lT6E`+Wfwzu(!6k>(2@d`YC-=%BLbq
zaN-0}k(G;%mIvIrRIhdSu}x{;@5!7o{EO;ep1X1Ow}DN4gjXq-K&A)-dsg(tf=I#U
zubn!Vg@d)u7c_PkiqF>!__3QKJ#yaqL*<KP_&?A5K3D7H!j|4eX(#`GN%;`{IP;`;
zs9Vhg+pi}Qb$i8Mcx8&3XEqtG2$9HI8oFKkwMxSj_Y!4hreEG=?z1bFhs-pQY3zOJ
zzvgnVMf-v3`h)M!%c-fxy-w#pynfF6lEWA8PqMw~=KSVNs_3}{t2x@%oAmvr7@ka;
z)e}3x+%auwNY~Yn-0yduti9kH?ry&S(W51jV%dom9P5@k-fhZBe0eES-E+Qp-OfX^
zK2=EtoZ&d$mpW~xMePg@=Ke0luW8-|8Tn<hVpApF%uWh<)7BVVy;&#h>XHrnCHAmi
zTh=b5ppq*8_K3aEBcVH|ui3dJuUMcyb3UiJygc{85ZBr7b2=BRUEK9$@73zd6`ivS
zZTIxm`tYCcy#4U!f3`C5qep&(8vgj}ufVi(LY@nE)n*>khRT|@I$_N#N%yrr37q7K
z+*}>>@vJB7y6CoulrX*aj3;Xf_&zRBjh#B-$-4it6Q?E^y*j?4!#7Zrxv+KejSZiT
zJh{8FcI>arSZ!Whd?`z4er0@y>-?8eOpXr{&Mr4#@O#z1S4eGMQgL+l>T@dJ_<H3+
zJ5p}O7TedQZ@PWWmEpwHc|RAaaa~w5=LiqSkvE#B(i<CJ7BB@Z5O`k1SiWzkkI2WF
zr8kAtN;vn-zU8giQ}?n~;(VEL5cdwgBtN6Lj2%Z<wH%HA{8)3cpJ9UU@1zX9Q#1eE
z>pOFgE2J=z;oF=k_jYa4-rw`}+v;h|`z-G*-_xA5Ch3xe^GegwTQcmMX9T7_x_tk_
zEdGDD?;KM$kaU~T+Z#OZ?9H@%qdFV+!v74Vf=iY?c-g?)5N0(egZ<TFEsui-Sgy{A
zV4h|vcY2Pr=)w&<Kdkq<aNzNg?msGNCtEhix>;(zd*AYfm!;|Z%w26xk$22@zudGb
z#wMNHI!vJNq5QYl!*47vC(0c8{803bfsoVWr1W{O_D))}+=&0^W4ZI`>yJsV`k?Yc
zT=ye~^qNz(Q|<N&dL;(9YffYR{9m&0Z2vMR*H6#Bw78cD+NQ;F^NDH)Srz1V*?bai
z$arQT^=rQJQR&awH?Cav6pH^AAZ6YfC;zoCexG&NC-YxLKMt>6EdD<=Cu7~O+OQQ<
zFSX0Pm7nJ{k@wd9eE!y@SN?fRY`v-V_QM(9t5zaAkM5t9w4g~!sV{q;LDb`SV%^(L
zWEjf%HThele7twUQ@N!!dD<(_8LAsa89tcFoXEQtaav9(^vg2OEgb5pi5twG<TM6Z
zu6Uq$>|V)Fl}%Ikzi|qTO_kVD6kuR=Qai%v_$OIm6D^j-FM_2$rI`E_d3f*Smf2}n
zyPFaudlho4!bDY8|GIkMW5=TGNlr%<PlY9aS|Z_-HeX^U_j<LOHv&Cgj2k1wntwjN
zq1)tjq4MQL$G4had7d#9yx-m+Qep8qMDVdpMa`+u)b58<Z?~KlF?+uFrGnu_gENb3
z*gkLQOnQ}Wz4ls~)%J-jB6Bte?r>#Zl{WcOUXAe5H5_6GBt0iQiN0av9sj7#i0cV&
zM)Ve?Xy>AkPjU0V)LB^6{Isr-d%s^GGP&4IMbUBgoh27{Rn6GEl=0ugizjb0XK{Ww
zvi?GZ-$mbuRTVv+rp+r%=JxAluDW=8nallKU$fpVSuGPWyW+%#P4Cod&aZ2{kdot7
z5^uEd)O0ml4c(cN!o@E>U2|EU9wE>4P-;Wu#%)V=GyFHI+&Yq0Es$r=b1`0acfyl^
zWVLB3*E*DpAJwQHI`6l1$0e_aJCAvuONmoc__^%3)!GI5zP#lZ4?S;r(6CQWsH&>-
zRE&#whq2c^<+`P5ao;}NJ=pJ|_hCmdC!<Msz!&4>I+k};?FN2+-~H~-)3DHd={D`z
z_4jShuJg|7{~%DmNc_xit8DKU@1B}9D;fRPtX@*}PuG&uwf1_tW>=2&_TT&}k2VPH
zSj%|KMsCrHi{_a@O*$`K)`^ri{q$SKSzxgJalLZO|7W6~&l%(<70B@)mJE4(b@FGI
zW5RI{&lbK<`M>4+qvy@x`qk?B^%nQ;S8uNGv3#q`@<iqKjW;Qcuf20myxl0KxPAWW
zyRm;~)UGTqdHY!YDD#@5=_}8zJ)V8H@4nH7the$<_uly|^S|1L-Fl_Ua~18%kFQ=7
z>@VN(|J{cpzwZX`zbCUtXBU%aTs_0Wv{yekJB!8s9#L6ue6jyc92aY9l3!XtUvJ2V
z^T&>Nl=|kBzf*TfQQn+-G>|on$7`q3lU*qan_js;h-KowomQP8=3j1D%b~(PKk4ab
zjtRdxK5U=<d;gQ%ZtDc={1a7rsrJt|OIBT*AuXr-CboF?`HAaJO^s4?(Qlo-cjL^2
z#7<M!>}e+%zOP%S`5;`E&ph4v+56_FQv&niUNSyXxKe&9i2JD4nq<D+YYsElq`ws3
z$`D>+-Kf;RkiUQ8Lq*{SXB4-epM22NB26~jelLgRpSJ9Kn|kY;cOT~x@6G*k-BDTT
zO!~a3=8F!*-m$sy|0JK;;_{7;5`wHai&FfbMeQ{BnetjJ!b9iF1KtO^>fM^r8-lBU
zc<rd*e<ZoZhc)1fm2_NZuf9*n--jQ%4r`t{?|J)Qrp-=?$63jnO!>1oZ|ZjU*gMa4
zlu>2kIG!qS=q^LWhL*i9jdS-3$<A=K2tC2l9XDxCv_XMJquce=7tB5v(?9)bNM*^X
z6XZOtt3T6?af{@HZU+8I(o<?1dM%aD=ak%zQkgi3@v_Zd2N}8Z-6qY)KQ79UIoR!`
zA}7ySFYbTRQ#Mlcs_!$Cl1*NYdrUrk&b`EUd%{WGi${;hFBX=TG|>L^<bmsPo2JAb
zM!Sc{Ih>`eU%1NIpNe7GxafCNih%tod!A)e$|i?NTDJJlGTnIe_4N%}t9g7Hqbg%w
z>OC>Kz4LL@ipH4}E^QH+_9|G!H&VAr`rFx;`JD+C3D$?|cf{BD=X`r;pq9_KbJ3xH
zX7$Dz*D`fG|CQc8BiEe#?f<;$SLgRGJoD$96t}U^FOhy{`GA;B60Qroa*ChMJ^Z05
z!_57V&;i|LKKDu%X&3mn9@=nwg&galNs5Ic-D)3F=T!7xRjc%QXu^~8cZRF-|EPeF
zwGUhCrwSw{=G1<bc;RW}uCI9CdbW?#6`w`roU0gFMTF-v7S8{$uyJ0GMagl4LvDWz
zOeVhbX#2F0<G7_zylvQ`Gz;EZ70)LEE8NW^&$N^;YHiLx`fJ_UFKLmXjTUikmo-Et
z&HH?kRf#)gu2^v29EURwo%`y$(jI4U2p6^H1^r-ry>OeJl+$K*!!L{vA0F|z=UuWz
z;QY#ak$)s@cRsM#+IzPD3YVqfg2_=+uHDl)bYyR`pi<C*e=N>+4<Cu=yj{`MeC3|l
zBC(}hGa3xM8+R)&I>EQAnTut^A(ahFVvDwYxR|cfrK5Ewwcw!WwN~?w4hJRNC9IhK
zGT3&P85vEv-pkWxx^DWXGs{HhAG_;#=aH((<GN3wO4oL~q<bfv)Vsr?+SRjD%q)Ug
z`_!`hK3>VD>NTq;KFGH?&31RsVb6I#FUQWAoOqw#?ysWCi*xFKrTwl{6iwc_%a(tV
zeYo1pX)|~;Lz9lo?S62n*mb+Iqm;hdX8+FeFYy*RGKmtWJBpbXynV9uFc;^eZF}lW
z9QKEnIeq(cFlL7=_iH;XmK$#iiUKc%&nj^0ojzgG0@<D&_s^tHR{ZW|qBCpCz9aLl
zn(#QA&%69dkNwR-ZRL+_pQ<{J$aA<XyL*yns+M8ptK<+P6_W$M&Mp4;Bq(cz7SoB7
zOP>7YxB9^Cy_hXhNY#bo_>-&sF$O(J(S2-d>l<8RJbo+sZ*i9qlCJ&iD)M8&j~t%q
zA@ko&>$1O8t0TDh^7I_;mxo<UpUoGEHgkMBYj1|n>d72!az%_scigxfKIwA%_veu>
zSkzuDYdA1x{)29=8>v&ii0{0-vA|yJ-0c^lGH2A^+~HMOZ-1pc{asfa%cq=v=7*{L
z-b~T_&x)oz2s;>{Rl6fq{hxx@=70*<UcnQtEpO&uF}lRkd6}!hV3{|k>>1CksYdf&
zDa`+U`K9Q_qOOqJ>KpPT%=XyXyxn`p{%-ZhVkvpgnY%i-WGxH18@iw_wy{koVN>0~
z-^biL4>35hY~1wt`=06S$L~!RDCgiQX<?MET+g**c4o@z?mG1~?5>QB*KQn^c6b-{
z{iu^h%qxy9OhGzc1}_eA$o{^Uy<>;;LO0ci*%5VmXG_hm?wOhPL94GS?&GhjqtXF;
zGCU_T1|LaIz3<z9kNxAdYsXE}`?Q;1Mff*vouTKwQ}i)g=91^LUCLK_M$g>Dsxp5M
z?{cvTF+as(JU;B($H(xPC3Ehq*8;kWkJt44>`?NIYv%e~5&k?_BSlY6%Pv^%ZNiTm
zx1x?M@%ED4({G<v%GwsoSiRlK`=e^_y_?amR;RAuvHj;?^l`=08~p;t0S?J2s`Es<
z-r8MYHCd)sIww<*X+gHZoh=75qZD#FA7q!P|NQ#k%9UfOE}u+yPp#TD^_S_|E8$s7
z^KKV?uBe-yzi*ea@r;jxP0zL6c15b5>g}>pR-P5U+p&K6U8w|y)eCNC@xEI7FN<-F
z$(rm%cOxd|Nv#c9`!@F>yZVcSRTn2e`?8zghR>uUaF)*QvIOI)clT-jX<r=e^wOy6
zZv4Z3_NTqQyb)JDcYB_HF#7`cg^j(PNj?JGcpmxudyrgzW3t&piT?%JU$4DABCTZg
z?gf|Dg2(Ko$F5qrJ~?zpY04e`4bJ&i^FP|&xw!7gi-6<b0`=2(z5iJ(xOo}-a;^a3
zH}_6g@>l5B{9dr<Q^-1t?&#CEZ|{2f<muM-#>G?G7k*go{^H5U_m!FnE50sV(WBcl
z?^<5Lmo2;JG2im==TcI0zPPxc|8hc=>%^;POjSO7;b%8mv5-qVbf=Qj?2|{oR5kS<
zob#N|&+SdZCl-}W{o5I*oeU^9WSSng?9ZYL`#*h7x#u1J(ahl4wC31@8_XY{eafoV
z{nJ#n;YqHT<$>sQcIK0LrBU}YD$O)L-DY!JcfhoAO4O9^dt~H!-*N6MV&TeXR$qI4
zw}|wr3(l%(@5N12POn*eNg?1!6i=?(()x<u$~E8m9#-{E6o1H{_H;>k!KX*hlWjhU
z&Zyz~<LG$qg?db!-RD;a#C!I4#WAf~SG+a!Zb|5&6(QR-YOXHKnDZs$Y2(yKkK1aW
zul(iozp5$huvy8*w%sE8c-_1{HoPw7sft?N$$Ew*dV)F2o;4SG%vZ_JT`uY?o3-1h
zLQ#LgE|(9BEoM4xe>rnk1;?w0D`gkRHk2x-oVW0NQ5=56@ZB^iiCSI(=F}~P-(q53
z)j7t#ojUEHfqVEO@44>VtsM3h6wd$oXrK9Popa|3_aF1RnR&<P$vMaW8KOoL)8xXA
z@4ernwIyzAsM+kjSF^I#pPc?^=ADA7-;vSo;ysn;3oU<4tjcX{l;87o4exi2nceRm
z*G<k_Q<bw@W=WvW?}HBQ(bK!qCKYjSWdGnQaz*uFjGE0|l>o`$gyJ{z`7%_MBu}|^
zOng%`y~{#5KEq_MoSRD;V|nAzBnj4HXTzd5LUH#3+>ENiul0CLUL^QEY1VhXz0-<z
ze%O|yJKgW=oZUC(37v7U_mRmmTY7!_lIt5(Hat^4I>)1DGus(ahf8I*qBzxZCz)_q
zZa$Rlb%tYU-Rf(GzGuSL25VoHem7a?`eW;=zKkgsPnSz5{Ji$L`g(Eo_0Lsz=d3fc
zo_FUxli~HU|AoTS%C?%T^-N??wq{;`qwUd*7EPu7zGBY&kBq1E`fpLz;_B<1@9_7%
ztBavU?G={aC+`RtbgXGSwDKT#a-x69(vT*H)fePCjSlUx{M);At0*&z=gYuz61~D+
z-Hi<z?~-lU?s$qV=nD~^a`_+wbB6gbpNAR~yl2jkt~zFOB<r|w!kw&lULTt>|3qDX
z_*rz_GNZHJwprJr0*zm>P4(K$T(RWhieGoXt~>l(JFfkFs939;*6e#xg8H_`Z>Lyq
zzGCCjyuGANtIzeE;U?Ml&%!UC_!`4D|A~vrajSnU^O`O5RBvVG^YhoeEwiy<@aa9t
z)Em3Suun@iW!{A8lM@y?@#TAmW!71W8@5m7$n1D`SH*MJKD|svi>#mD<2DDaUSy=O
zeUW_Mqr#s#g6)BP6P}-!=(=&LY`#WIlhyl`vvV#z|D7e*rn1muFU#x&7e#np7<s%@
z;P;A3>b_mFf1AnWt#6jSt$QB-b*kdhjO`BmS5pmZtEa4)r?+&S(k78lQ==;{Z=9MG
zZYm=fWXM}Lt<nB58%tCBC+|<LPv)Gvmm_K@HEoh4N0Z;~i>tQ(u3H+k*6pIg3ih=L
zx@R0OgdLI%ne@%K_uZL4jW?X<UiEEFGvjR(+~jzywe%U+JihyeHVWJq!**qOSI*v-
zyPG9Tg+1Ey+G5wVX$#H>sNQ#bw6)~QX|_FWQ?e_iPcLb`*Y>bus{W6n&h1g9US5Iz
zr~UKn5+*bJH*O8GF11RqF1K7MeQ=82Z>2TMwukIdS^x9D!o*8%ZQedN_D%S)G)r`;
z&)sQ0jT1ZV)tzspTz?wfwLr#bIs2LC^B0}+u8Lj}!gC=1h;qW6jm?+XCiJGXeN>oK
znDD5ONr#hv59{=(8(mwU^_^<i`0mF3UV&`hhga_hW`yp|4xBpUmin>3p7wjVPm0<{
z`<AgPS1C8SZLH;T{nk|4GF$FF%dI)qy8Di8*)>Nf^X}fAF+S67nQfomzfpO5@7a}t
zod>3Ks`l)DRiqGA)Ua}1f$>uh<FGe<yUm~KWb6}oa_VH(UAL8ei>ef|KU6x0EPCQl
z@voJ6)`WYxVu7nuCs>3Eh{i>qitqi~y7S9B^SCXawnsPazR7=Wk*&cd-gxD<=*nN$
zCtkl>u<rUSE<?`KthMIR5*u%Mx7M|N@jLrz@0)kuHd%Yd%3QK8YX1BGL^>mrYAhoI
E0A|DcTL1t6

literal 0
HcmV?d00001

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index cfec3209b98..f68970ae13e 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -20,7 +20,7 @@
 
 let
   version = "2.26";
-  patchSuffix = "-115";
+  patchSuffix = "-131";
   sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
@@ -48,6 +48,9 @@ stdenv.mkDerivation ({
       */
       ./2.26-75.patch.gz
       ./2.26-75to115.diff.gz
+      # contains fix for CVE-2018-1000001 as the last commit:
+      # https://sourceware.org/git/?p=glibc.git;a=commit;h=fabef2edbc
+      ./2.26-115to131.diff.gz
 
       /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
@@ -73,7 +76,7 @@ stdenv.mkDerivation ({
         and we lose early mismatch detection on 2.6.32.
 
         On major glibc updates we should check that the patched kernel supports
-        all the required features.  ATM it's verified up to glibc-2.26-115.
+        all the required features.  ATM it's verified up to glibc-2.26-131.
         # HOWTO: check glibc sources for changes in kernel requirements
         git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
         # get kernel sources (update the URL)

From 7a9b6ac39a34da8661219e00350955f51122eef8 Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Sat, 28 Oct 2017 15:09:54 -0400
Subject: [PATCH 56/63] kernel: Enable cross compiling

---
 .../linux/kernel/common-config.nix            | 13 ++---
 pkgs/os-specific/linux/kernel/generic.nix     | 50 ++++++-------------
 pkgs/os-specific/linux/kernel/linux-4.13.nix  |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.14.nix  |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.4.nix   |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.9.nix   |  2 +-
 .../linux/kernel/linux-beagleboard.nix        |  2 +-
 .../kernel/linux-hardened-copperhead.nix      |  2 +-
 pkgs/os-specific/linux/kernel/linux-mptcp.nix |  2 +-
 pkgs/os-specific/linux/kernel/linux-rpi.nix   |  2 +-
 .../linux/kernel/linux-samus-4.12.nix         |  2 +-
 .../linux/kernel/linux-testing-bcachefs.nix   |  2 +-
 .../linux/kernel/linux-testing.nix            |  2 +-
 .../linux/kernel/manual-config.nix            | 45 ++++++-----------
 pkgs/os-specific/linux/kernel/perf.nix        | 17 +++----
 15 files changed, 53 insertions(+), 94 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 24ae1967570..82a092cd539 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -51,7 +51,7 @@ with stdenv.lib;
 
   # Bump the maximum number of CPUs to support systems like EC2 x1.*
   # instances and Xeon Phi.
-  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
+  ${optionalString (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") ''
     NR_CPUS 384
   ''}
 
@@ -347,11 +347,12 @@ with stdenv.lib;
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
-  ${if versionOlder version "3.14" then ''
-    CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
-  '' else ''
-    CC_STACKPROTECTOR_REGULAR? y
-  ''}
+  ${optionalString (! stdenv.hostPlatform.isArm)
+    (if versionOlder version "3.14" then ''
+        CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
+      '' else ''
+        CC_STACKPROTECTOR_REGULAR? y
+      '')}
   ${optionalString (versionAtLeast version "3.12") ''
     USER_NS y # Support for user namespaces
   ''}
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index b1df6c54c45..d1733f96c53 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,4 +1,4 @@
-{ stdenv, perl, buildLinux
+{ stdenv, buildPackages, perl, buildLinux
 
 , # The kernel source tarball.
   src
@@ -23,7 +23,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc"
 , extraMeta ? {}
 , hostPlatform
 , ...
@@ -58,37 +58,29 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    inherit ignoreConfigErrors;
+    #inherit ignoreConfigErrors;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
 
     kernelConfig = kernelConfigFun config;
 
-    nativeBuildInputs = [ perl ];
+    nativeBuildInputs = [ buildPackages.stdenv.cc perl ];
 
-    platformName = stdenv.platform.name;
-    kernelBaseConfig = stdenv.platform.kernelBaseConfig;
-    kernelTarget = stdenv.platform.kernelTarget;
-    autoModules = stdenv.platform.kernelAutoModules;
-    preferBuiltin = stdenv.platform.kernelPreferBuiltin or false;
-    arch = stdenv.platform.kernelArch;
+    platformName = hostPlatform.platform.name;
+    kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
+    kernelTarget = hostPlatform.platform.kernelTarget;
+    autoModules = hostPlatform.platform.kernelAutoModules;
+    preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
+    arch = hostPlatform.platform.kernelArch;
+
+    # TODO(@Ericson2314): No null next hash break
+    ignoreConfigErrors = if stdenv.hostPlatform == stdenv.buildPlatform then null else true;
 
     crossAttrs = let
         cp = hostPlatform.platform;
       in {
-        arch = cp.kernelArch;
-        platformName = cp.name;
-        kernelBaseConfig = cp.kernelBaseConfig;
-        kernelTarget = cp.kernelTarget;
-        autoModules = cp.kernelAutoModules;
-
-        # Just ignore all options that don't apply (We are lazy).
         ignoreConfigErrors = true;
-
-        kernelConfig = kernelConfigFun configCross;
-
-        inherit (kernel.crossDrv) src patches preUnpack;
       };
 
     prePatch = kernel.prePatch + ''
@@ -103,7 +95,7 @@ let
       cd $buildRoot
 
       # Get a basic config file for later refinement with $generateConfig.
-      make -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
+      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
 
       # Create the config file.
       echo "generating kernel configuration..."
@@ -122,11 +114,7 @@ let
 
     configfile = configfile.nativeDrv or configfile;
 
-    crossConfigfile = configfile.crossDrv or configfile;
-
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-
-    crossConfig = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };
 
   passthru = {
@@ -134,12 +122,4 @@ let
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
   };
 
-  addPassthru' = lib.extendDerivation true passthru;
-
-  nativeDrv = addPassthru' kernel.nativeDrv;
-
-  crossDrv = addPassthru' kernel.crossDrv;
-
-in if kernel ? crossDrv
-   then nativeDrv // { inherit nativeDrv crossDrv; }
-   else addPassthru' kernel
+in lib.extendDerivation true passthru kernel
diff --git a/pkgs/os-specific/linux/kernel/linux-4.13.nix b/pkgs/os-specific/linux/kernel/linux-4.13.nix
index 767f7e35422..506682479c7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.13.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.13.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.13.16";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index bd1f03c76a7..b740dc49f43 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 7ed69558fb0..a51cd29665f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.4.111";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 9fc7e51cbef..4efd0cfd5f7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.9.76";
diff --git a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
index 33885a082d6..7f7a72b43ec 100644
--- a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
+++ b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.61";
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 1ccc152bb28..20ec3a89a73 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index 92b202100a6..9720e3c0e4a 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (rec {
   mptcpVersion = "0.93";
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index fb97aa579df..1efb11435e2 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.59";
diff --git a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
index 32c684668d6..c65182271dc 100644
--- a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.12.2";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a104cc5393c..ac13835afdd 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.11.2017.08.23";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index a3570fd11a4..0bbf78e804e 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.15-rc8";
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index e1936495921..187c96cd9f9 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,6 @@
-{ runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
-, libelf ? null
-, utillinux ? null
+{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
+, libelf
+, utillinux
 , writeTextFile, ubootTools
 , hostPlatform
 }:
@@ -26,19 +26,11 @@ in {
   src,
   # Any patches
   kernelPatches ? [],
-  # Patches for native compiling only
-  nativeKernelPatches ? [],
-  # Patches for cross compiling only
-  crossKernelPatches ? [],
-  # The native kernel .config file
+  # The kernel .config file
   configfile,
-  # The cross kernel .config file
-  crossConfigfile ? configfile,
   # Manually specified nixexpr representing the config
   # If unspecified, this will be autodetected from the .config
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
-  # Cross-compiling config
-  crossConfig ? if allowImportFromDerivation then (readConfig crossConfigfile) else config,
   # Use defaultMeta // extraMeta
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
@@ -61,8 +53,8 @@ let
 
   commonMakeFlags = [
     "O=$(buildRoot)"
-  ] ++ stdenv.lib.optionals (stdenv.platform ? kernelMakeFlags)
-    stdenv.platform.kernelMakeFlags;
+  ] ++ stdenv.lib.optionals (hostPlatform.platform ? kernelMakeFlags)
+    hostPlatform.platform.kernelMakeFlags;
 
   drvAttrs = config_: platform: kernelPatches: configfile:
     let
@@ -233,13 +225,13 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
-      } // extraMeta;
-    };
+      };
+    } // extraMeta;
 in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;
 assert stdenv.lib.versionAtLeast version "4.15" -> utillinux != null;
-stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKernelPatches) configfile) // {
+stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches configfile) // {
   name = "linux-${version}";
 
   enableParallelBuilding = true;
@@ -253,20 +245,11 @@ stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKe
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
 
   makeFlags = commonMakeFlags ++ [
-    "ARCH=${stdenv.platform.kernelArch}"
+    "HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc"
+    "ARCH=${stdenv.hostPlatform.platform.kernelArch}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
-  karch = stdenv.platform.kernelArch;
-
-  crossAttrs = let cp = hostPlatform.platform; in
-    (drvAttrs crossConfig cp (kernelPatches ++ crossKernelPatches) crossConfigfile) // {
-      makeFlags = commonMakeFlags ++ [
-        "ARCH=${cp.kernelArch}"
-        "CROSS_COMPILE=$(crossConfig)-"
-      ];
-
-      karch = cp.kernelArch;
-
-      nativeBuildInputs = optional (cp.kernelTarget == "uImage") ubootTools;
-  };
+  karch = hostPlatform.platform.kernelArch;
 })
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 4bcf6e037e0..fd21464a219 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty libaudit makeWrapper pkgconfig ];
-  buildInputs = [ elfutils python perl newt slang libunwind binutils zlib ] ++
+      flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
+  buildInputs = [ elfutils newt slang libunwind binutils zlib ] ++
     stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
@@ -40,6 +40,10 @@ stdenv.mkDerivation {
       "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
     ];
 
+  makeFlags = if stdenv.hostPlatform == stdenv.buildPlatform
+    then null
+    else "CROSS_COMPILE=${stdenv.cc.prefix}";
+
   installFlags = "install install-man ASCIIDOC8=1";
 
   preFixup = ''
@@ -47,15 +51,6 @@ stdenv.mkDerivation {
       --prefix PATH : "${binutils}/bin"
   '';
 
-  crossAttrs = {
-    /* I don't want cross-python or cross-perl -
-       I don't know if cross-python even works */
-    propagatedBuildInputs = [ elfutils.crossDrv newt.crossDrv ];
-    makeFlags = "CROSS_COMPILE=${stdenv.cc.targetPrefix}";
-    elfutils = elfutils.crossDrv;
-    inherit (kernel.crossDrv) src patches;
-  };
-
   meta = {
     homepage = https://perf.wiki.kernel.org/;
     description = "Linux tools to profile with performance counters";

From 50e2bb12f6385f4244a6c52bd9ba75015ead392e Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Sat, 28 Oct 2017 21:06:18 -0400
Subject: [PATCH 57/63] kernel: Use build kmod

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 187c96cd9f9..89fa3c8fa23 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,4 +1,4 @@
-{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
+{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, openssl
 , libelf
 , utillinux
 , writeTextFile, ubootTools
@@ -97,7 +97,7 @@ let
             echo "stripping FHS paths in \`$mf'..."
             sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
         done
-        sed -i Makefile -e 's|= depmod|= ${kmod}/bin/depmod|'
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
       '';
 
       configurePhase = ''
@@ -203,7 +203,7 @@ let
         find -empty -type d -delete
 
         # Remove reference to kmod
-        sed -i Makefile -e 's|= ${kmod}/bin/depmod|= depmod|'
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '' else optionalString installsFirmware ''
         make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"

From b4b04dd29fe25ea8d690e87218c25ee222007c5b Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Mon, 18 Dec 2017 21:17:15 -0500
Subject: [PATCH 58/63] kernel: Fix cross-compilation

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 89fa3c8fa23..1defd4099a6 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -236,8 +236,8 @@ stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches config
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
-      ++ optional (stdenv.platform.kernelTarget == "uImage") ubootTools
+  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr buildPackages.stdenv.cc ]
+      ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
       ;

From a09709bf2a6571838aac2a05d7bd123e7a1d4fa9 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sat, 13 Jan 2018 21:12:06 -0500
Subject: [PATCH 59/63] kernel: don't force ignoreConfigErrors when cross
 compiling, only set the default

---
 pkgs/os-specific/linux/kernel/generic.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index d1733f96c53..8ff92ac1a0a 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -23,7 +23,8 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? hostPlatform.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc" ||
+                       hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 , hostPlatform
 , ...
@@ -58,7 +59,7 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    #inherit ignoreConfigErrors;
+    inherit ignoreConfigErrors;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
@@ -74,9 +75,6 @@ let
     preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
     arch = hostPlatform.platform.kernelArch;
 
-    # TODO(@Ericson2314): No null next hash break
-    ignoreConfigErrors = if stdenv.hostPlatform == stdenv.buildPlatform then null else true;
-
     crossAttrs = let
         cp = hostPlatform.platform;
       in {

From 285181a1db49a9b95210ac939a1b827866b0ef29 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:41:55 -0500
Subject: [PATCH 60/63] kernel: remove leftover remnants of old cross compiling
 system

---
 pkgs/os-specific/linux/kernel/generic.nix | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 8ff92ac1a0a..816a1363921 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -44,14 +44,12 @@ let
     netfilterRPFilter = true;
   } // features) kernelPatches;
 
-  configWithPlatform = kernelPlatform: import ./common-config.nix {
-    inherit stdenv version kernelPlatform extraConfig;
+  config = import ./common-config.nix {
+    inherit stdenv version extraConfig;
+    kernelPlatform = hostPlatform;
     features = kernelFeatures; # Ensure we know of all extra patches, etc.
   };
 
-  config = configWithPlatform stdenv.platform;
-  configCross = configWithPlatform hostPlatform.platform;
-
   kernelConfigFun = baseConfig:
     let
       configFromPatches =
@@ -75,12 +73,6 @@ let
     preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
     arch = hostPlatform.platform.kernelArch;
 
-    crossAttrs = let
-        cp = hostPlatform.platform;
-      in {
-        ignoreConfigErrors = true;
-      };
-
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
       # generate-config.pl from the generic builder can answer them.
@@ -108,9 +100,7 @@ let
   };
 
   kernel = buildLinux {
-    inherit version modDirVersion src kernelPatches stdenv extraMeta;
-
-    configfile = configfile.nativeDrv or configfile;
+    inherit version modDirVersion src kernelPatches stdenv extraMeta configfile;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };

From 92083c3f404620b1e0260946f3330848fdbc1e6b Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:47:08 -0500
Subject: [PATCH 61/63] perf: inherit makeFlags from kernel

---
 pkgs/os-specific/linux/kernel/perf.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index fd21464a219..5f79e1b2cac 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -11,7 +11,7 @@ assert versionAtLeast kernel.version "3.12";
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
-  inherit (kernel) src;
+  inherit (kernel) src makeFlags;
 
   preConfigure = ''
     cd tools/perf
@@ -40,10 +40,6 @@ stdenv.mkDerivation {
       "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
     ];
 
-  makeFlags = if stdenv.hostPlatform == stdenv.buildPlatform
-    then null
-    else "CROSS_COMPILE=${stdenv.cc.prefix}";
-
   installFlags = "install install-man ASCIIDOC8=1";
 
   preFixup = ''

From 80f6b8e2ba354f85b48622acf56dde86db0c4e29 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:55:24 -0500
Subject: [PATCH 62/63] kernel: revert seemingly incorrect change to extraMeta
 merging

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1defd4099a6..6c598e50a0a 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -225,8 +225,8 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
-      };
-    } // extraMeta;
+      } // extraMeta;
+    };
 in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;

From 7bb3a044be38810e525cde73d591e006b2118095 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 22:28:45 -0500
Subject: [PATCH 63/63] kernel: fix dependencies

---
 pkgs/os-specific/linux/kernel/generic.nix       | 3 ++-
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 ++-
 pkgs/os-specific/linux/kernel/perf.nix          | 5 ++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 816a1363921..e00bda692b3 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -64,7 +64,8 @@ let
 
     kernelConfig = kernelConfigFun config;
 
-    nativeBuildInputs = [ buildPackages.stdenv.cc perl ];
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [ perl ];
 
     platformName = hostPlatform.platform.name;
     kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6c598e50a0a..9a7e9609410 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -236,7 +236,8 @@ stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches config
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr buildPackages.stdenv.cc ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
       ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 5f79e1b2cac..1936f6578b6 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, libiberty, libaudit
+, libiberty, libaudit, libbfd
 , zlib, withGtk ? false, gtk2 ? null }:
 
 with lib;
@@ -21,10 +21,9 @@ stdenv.mkDerivation {
   '';
 
   # perf refers both to newt and slang
-  # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
       flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
-  buildInputs = [ elfutils newt slang libunwind binutils zlib ] ++
+  buildInputs = [ elfutils newt slang libunwind libbfd zlib ] ++
     stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a