From 2de3c4bd7840af8bf6a37e06a1124e10db40ac20 Mon Sep 17 00:00:00 2001
From: SLNOS <anonymous@wired>
Date: Tue, 1 May 2018 00:00:00 +0000
Subject: [PATCH 01/29] nixos/tor: add tor-init service to fix directory
 ownerships, fix hardenings

This reverts a part of 5bd12c694bfebaef1d03eb7f74a6eca01b86f546.

Apparently there's no way to specify user for RuntimeDirectory in systemd
service file (it's always root) but tor won't create control socket if the dir
is owned by anybody except the tor user.

These hardenings were adopted from the upstream service file, checked
against systemd.service(5) and systemd.exec(5) manuals, and tested to
actually work with all the options enabled.

`PrivateDevices` implies `DevicePolicy=closed` according to systemd.exec(5),
removed.

`--RunAsDaemon 0` is the default value according to tor(5), removed.
---
 nixos/modules/services/security/tor.nix | 47 +++++++++++++++++--------
 1 file changed, 32 insertions(+), 15 deletions(-)

diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 806252f49b8..4f4f11907a7 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -695,19 +695,38 @@ in
         uid         = config.ids.uids.tor;
       };
 
+    # We have to do this instead of using RuntimeDirectory option in
+    # the service below because systemd has no way to set owners of
+    # RuntimeDirectory and putting this into the service below
+    # requires that service to relax it's sandbox since this needs
+    # writable /run
+    systemd.services.tor-init =
+      { description = "Tor Daemon Init";
+        wantedBy = [ "tor.service" ];
+        after = [ "local-fs.target" ];
+        script = ''
+          install -m 0700 -o tor -g tor -d ${torDirectory} ${torDirectory}/onion
+          install -m 0750 -o tor -g tor -d ${torRunDirectory}
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+      };
+
     systemd.services.tor =
       { description = "Tor Daemon";
         path = [ pkgs.tor ];
 
         wantedBy = [ "multi-user.target" ];
-        after    = [ "network.target" ];
+        after    = [ "tor-init.service" "network.target" ];
         restartTriggers = [ torRcFile ];
 
         serviceConfig =
           { Type         = "simple";
             # Translated from the upstream contrib/dist/tor.service.in
             ExecStartPre = "${pkgs.tor}/bin/tor -f ${torRcFile} --verify-config";
-            ExecStart    = "${pkgs.tor}/bin/tor -f ${torRcFile} --RunAsDaemon 0";
+            ExecStart    = "${pkgs.tor}/bin/tor -f ${torRcFile}";
             ExecReload   = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
             KillSignal   = "SIGINT";
             TimeoutSec   = 30;
@@ -715,20 +734,18 @@ in
             LimitNOFILE  = 32768;
 
             # Hardening
-            # Note: DevicePolicy is set to 'closed', although the
-            # minimal permissions are really:
-            #   DeviceAllow /dev/null rw
-            #   DeviceAllow /dev/urandom r
-            # .. but we can't specify DeviceAllow multiple times. 'closed'
-            # is close enough.
-            RuntimeDirectory        = "tor";
-            StateDirectory          = [ "tor" "tor/onion" ];
-            PrivateTmp              = "yes";
-            DevicePolicy            = "closed";
-            InaccessibleDirectories = "/home";
-            ReadOnlyDirectories     = "/";
-            ReadWriteDirectories    = [torDirectory torRunDirectory];
+            # this seems to unshare /run despite what systemd.exec(5) says
+            PrivateTmp              = mkIf (!cfg.controlSocket.enable) "yes";
+            PrivateDevices          = "yes";
+            ProtectHome             = "yes";
+            ProtectSystem           = "strict";
+            InaccessiblePaths       = "/home";
+            ReadOnlyPaths           = "/";
+            ReadWritePaths          = [ torDirectory torRunDirectory ];
             NoNewPrivileges         = "yes";
+
+            # tor.service.in has this in, but this line it fails to spawn a namespace when using hidden services
+            #CapabilityBoundingSet   = "CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE";
           };
       };
 

From adab27a352fcd6956dc910fc09a5829c2000bc17 Mon Sep 17 00:00:00 2001
From: SLNOS <anonymous@wired>
Date: Tue, 1 May 2018 00:00:00 +0000
Subject: [PATCH 02/29] nixos/tor: use ControlPort for controlSocket for
 simplicity

---
 nixos/modules/services/security/tor.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix
index 4f4f11907a7..c2de1c45a39 100644
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@@ -39,7 +39,7 @@ let
     ''}
 
     ${optint "ControlPort" cfg.controlPort}
-    ${optionalString cfg.controlSocket.enable "ControlSocket ${torRunDirectory}/control GroupWritable RelaxDirModeCheck"}
+    ${optionalString cfg.controlSocket.enable "ControlPort unix:${torRunDirectory}/control GroupWritable RelaxDirModeCheck"}
   ''
   # Client connection config
   + optionalString cfg.client.enable ''

From 4d07170dc0b81b0d7d156919e7e101a1c6d1cc60 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Mon, 11 Jun 2018 16:50:01 +0000
Subject: [PATCH 03/29] network-interfaces.nix: remove duplicate code

---
 nixos/modules/tasks/network-interfaces.nix | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 14f9b956751..a3534e10bb1 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -46,22 +46,6 @@ let
     '';
   });
 
-  # Collect all interfaces that are defined for a device
-  # as device:interface key:value pairs.
-  wlanDeviceInterfaces =
-    let
-      allDevices = unique (mapAttrsToList (_: v: v.device) cfg.wlanInterfaces);
-      interfacesOfDevice = d: filterAttrs (_: v: v.device == d) cfg.wlanInterfaces;
-    in
-      genAttrs allDevices (d: interfacesOfDevice d);
-
-  # Convert device:interface key:value pairs into a list, and if it exists,
-  # place the interface which is named after the device at the beginning.
-  wlanListDeviceFirst = device: interfaces:
-    if hasAttr device interfaces
-    then mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n==device) interfaces) ++ mapAttrsToList (n: v: v//{_iName=n;}) (filterAttrs (n: _: n!=device) interfaces)
-    else mapAttrsToList (n: v: v // {_iName = n;}) interfaces;
-
   # We must escape interfaces due to the systemd interpretation
   subsystemDevice = interface:
     "sys-subsystem-net-devices-${escapeSystemdPath interface}.device";

From 7a0b9139fa56540f6013715ee85eb01d998978b4 Mon Sep 17 00:00:00 2001
From: Yurii Rashkovskii <yrashk@gmail.com>
Date: Tue, 12 Jun 2018 18:00:30 -0700
Subject: [PATCH 04/29] powershell: fix the build

For some reason, building powershell derivation started failing with
these errors:

```
  liblttng-ust.so.0 -> not found!
  ...
  libpam.so.0 -> not found!
```

This patch adds these dependencies
---
 pkgs/shells/powershell/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index 93749491611..e1596472005 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchgit, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl, cacert,
-  makeWrapper, less, openssl }:
+{ stdenv, fetchgit, autoPatchelfHook, fetchzip, libunwind, libuuid, icu, curl,
+  makeWrapper, less, openssl, pam, lttng-ust }:
 
 let platformString = if stdenv.isDarwin then "osx"
                      else if stdenv.isLinux then "linux"
@@ -10,6 +10,7 @@ let platformString = if stdenv.isDarwin then "osx"
     platformLdLibraryPath = if stdenv.isDarwin then "DYLD_FALLBACK_LIBRARY_PATH"
                      else if stdenv.isLinux then "LD_LIBRARY_PATH"
                      else throw "unsupported platform";
+    libraries = [ libunwind libuuid icu curl openssl lttng-ust ] ++ (if stdenv.isLinux then [ pam ] else []);
 in
 stdenv.mkDerivation rec {
   name = "powershell-${version}";
@@ -21,8 +22,7 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ autoPatchelfHook makeWrapper ];
-  propagatedBuildInputs = [ libunwind libuuid icu curl cacert less openssl ];
+  buildInputs = [ autoPatchelfHook makeWrapper less ] ++ libraries;
 
   # TODO: remove PAGER after upgrading to v6.1.0-preview.1 or later as it has been addressed in
   # https://github.com/PowerShell/PowerShell/pull/6144
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/powershell
     cp -r * $out/share/powershell
     rm $out/share/powershell/DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
-    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath [ libunwind libuuid icu openssl curl ]}" \
+    makeWrapper $out/share/powershell/pwsh $out/bin/pwsh --prefix ${platformLdLibraryPath} : "${stdenv.lib.makeLibraryPath libraries}" \
                                            --set PAGER ${less}/bin/less --set TERM xterm
   '';
 

From bea4323acf44bad55bf3083926ea0c188aebd74d Mon Sep 17 00:00:00 2001
From: Frank Doepper <fd@taz.de>
Date: Wed, 13 Jun 2018 12:38:15 +0200
Subject: [PATCH 05/29] nixos/zfs: enable zfs services

---
 nixos/modules/tasks/filesystems/zfs.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index de735e9ba11..c54cfd4e1aa 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -414,12 +414,15 @@ in
               ${packages.zfsUser}/sbin/zfs set nixos:shutdown-time="$(date)" "${pool}"
             '';
           };
+        createZfsService = serv:
+          nameValuePair serv {
+            after = [ "systemd-modules-load.service" ];
+            wantedBy = [ "zfs.target" ];
+          };
 
-      in listToAttrs (map createImportService dataPools ++ map createSyncService allPools) // {
-        "zfs-mount" = { after = [ "systemd-modules-load.service" ]; };
-        "zfs-share" = { after = [ "systemd-modules-load.service" ]; };
-        "zfs-zed" = { after = [ "systemd-modules-load.service" ]; };
-      };
+      in listToAttrs (map createImportService dataPools ++
+                      map createSyncService allPools ++
+                      map createZfsService [ "zfs-mount" "zfs-share" "zfs-zed" ]);
 
       systemd.targets."zfs-import" =
         let

From 2a5688574c5c5d9797f4b010325f799910b42af6 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Wed, 25 Apr 2018 06:26:13 +0000
Subject: [PATCH 06/29] nixos: doc: make `relatedPackages` a bit smarter

---
 nixos/doc/manual/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 2c6309474b3..fef6b2f86c8 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -31,11 +31,12 @@ let
                   else p;
       describe = args:
         let
+          title = args.title or null;
           name = args.name or (lib.concatStringsSep "." args.path);
           path = args.path or [ args.name ];
           package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}'") pkgs);
         in "<listitem>"
-        + "<para><literal>pkgs.${name} (${package.meta.name})</literal>"
+        + "<para><literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name} (${package.meta.name})</literal>"
         + lib.optionalString (!package.meta.available) " <emphasis>[UNAVAILABLE]</emphasis>"
         + ": ${package.meta.description or "???"}.</para>"
         + lib.optionalString (args ? comment) "\n<para>${args.comment}</para>"
@@ -51,7 +52,7 @@ let
   // lib.optionalAttrs (opt ? example) { example = substFunction opt.example; }
   // lib.optionalAttrs (opt ? default) { default = substFunction opt.default; }
   // lib.optionalAttrs (opt ? type) { type = substFunction opt.type; }
-  // lib.optionalAttrs (opt ? relatedPackages) { relatedPackages = genRelatedPackages opt.relatedPackages; });
+  // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages; });
 
   # We need to strip references to /nix/store/* from options,
   # including any `extraSources` if some modules came from elsewhere,

From b01ccbb89918b0c0ab2347405a4a101544045c86 Mon Sep 17 00:00:00 2001
From: Jan Malakhovski <oxij@oxij.org>
Date: Wed, 25 Apr 2018 07:12:04 +0000
Subject: [PATCH 07/29] nixos: xserver: add related packages

---
 nixos/modules/services/x11/xserver.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 1404231f837..3048cd02683 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -244,6 +244,13 @@ in
           "ati_unfree" "amdgpu" "amdgpu-pro"
           "nv" "nvidia" "nvidiaLegacy340" "nvidiaLegacy304"
         ];
+        # TODO(@oxij): think how to easily add the rest, like those nvidia things
+        relatedPackages = concatLists
+          (mapAttrsToList (n: v:
+            optional (hasPrefix "xf86video" n) {
+              path  = [ "xorg" n ];
+              title = removePrefix "xf86video" n;
+            }) pkgs.xorg);
         description = ''
           The names of the video drivers the configuration
           supports. They will be tried in order until one that

From c4de089cbd4a5fb8f94ee7404ff7a7b946df724a Mon Sep 17 00:00:00 2001
From: Michael Fellinger <m.fellinger@gmail.com>
Date: Wed, 13 Jun 2018 18:56:28 +0200
Subject: [PATCH 08/29] Riemann-tools: 0.2.6 -> 0.2.13 (#41927)

---
 pkgs/tools/misc/riemann-tools/Gemfile      |   2 +-
 pkgs/tools/misc/riemann-tools/Gemfile.lock | 136 +------
 pkgs/tools/misc/riemann-tools/gemset.nix   | 444 ++-------------------
 3 files changed, 36 insertions(+), 546 deletions(-)

diff --git a/pkgs/tools/misc/riemann-tools/Gemfile b/pkgs/tools/misc/riemann-tools/Gemfile
index 3d56cd85c61..ac6abd42c89 100644
--- a/pkgs/tools/misc/riemann-tools/Gemfile
+++ b/pkgs/tools/misc/riemann-tools/Gemfile
@@ -1,3 +1,3 @@
 source 'https://rubygems.org'
 
-gem "riemann-tools", "0.2.6"
+gem "riemann-tools", "0.2.13"
diff --git a/pkgs/tools/misc/riemann-tools/Gemfile.lock b/pkgs/tools/misc/riemann-tools/Gemfile.lock
index 58c12fd5151..9fc17ccea56 100644
--- a/pkgs/tools/misc/riemann-tools/Gemfile.lock
+++ b/pkgs/tools/misc/riemann-tools/Gemfile.lock
@@ -1,142 +1,24 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    CFPropertyList (2.3.1)
-    beefcake (1.1.0)
-    builder (3.2.2)
-    excon (0.45.3)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    fission (0.5.0)
-      CFPropertyList (~> 2.2)
-    fog (1.31.0)
-      fog-atmos
-      fog-aws (~> 0.0)
-      fog-brightbox (~> 0.4)
-      fog-core (~> 1.30)
-      fog-ecloud
-      fog-google (>= 0.0.2)
-      fog-json
-      fog-local
-      fog-powerdns (>= 0.1.1)
-      fog-profitbricks
-      fog-radosgw (>= 0.0.2)
-      fog-riakcs
-      fog-sakuracloud (>= 0.0.4)
-      fog-serverlove
-      fog-softlayer
-      fog-storm_on_demand
-      fog-terremark
-      fog-vmfusion
-      fog-voxel
-      fog-xml (~> 0.1.1)
-      ipaddress (~> 0.5)
-      nokogiri (~> 1.5, >= 1.5.11)
-    fog-atmos (0.1.0)
-      fog-core
-      fog-xml
-    fog-aws (0.6.0)
-      fog-core (~> 1.27)
-      fog-json (~> 1.0)
-      fog-xml (~> 0.1)
-      ipaddress (~> 0.8)
-    fog-brightbox (0.7.2)
-      fog-core (~> 1.22)
-      fog-json
-      inflecto (~> 0.0.2)
-    fog-core (1.31.1)
-      builder
-      excon (~> 0.45)
-      formatador (~> 0.2)
-      mime-types
-      net-scp (~> 1.1)
-      net-ssh (>= 2.1.3)
-    fog-ecloud (0.3.0)
-      fog-core
-      fog-xml
-    fog-google (0.0.6)
-      fog-core
-      fog-json
-      fog-xml
-    fog-json (1.0.2)
-      fog-core (~> 1.0)
-      multi_json (~> 1.10)
-    fog-local (0.2.1)
-      fog-core (~> 1.27)
-    fog-powerdns (0.1.1)
-      fog-core (~> 1.27)
-      fog-json (~> 1.0)
-      fog-xml (~> 0.1)
-    fog-profitbricks (0.0.3)
-      fog-core
-      fog-xml
-      nokogiri
-    fog-radosgw (0.0.4)
-      fog-core (>= 1.21.0)
-      fog-json
-      fog-xml (>= 0.0.1)
-    fog-riakcs (0.1.0)
-      fog-core
-      fog-json
-      fog-xml
-    fog-sakuracloud (1.0.1)
-      fog-core
-      fog-json
-    fog-serverlove (0.1.2)
-      fog-core
-      fog-json
-    fog-softlayer (0.4.7)
-      fog-core
-      fog-json
-    fog-storm_on_demand (0.1.1)
-      fog-core
-      fog-json
-    fog-terremark (0.1.0)
-      fog-core
-      fog-xml
-    fog-vmfusion (0.1.0)
-      fission
-      fog-core
-    fog-voxel (0.1.0)
-      fog-core
-      fog-xml
-    fog-xml (0.1.2)
-      fog-core
-      nokogiri (~> 1.5, >= 1.5.11)
-    formatador (0.2.5)
-    inflecto (0.0.2)
-    ipaddress (0.8.0)
-    mime-types (2.6.1)
-    mini_portile (0.6.2)
+    beefcake (1.0.0)
+    json (1.8.6)
     mtrc (0.0.4)
-    multi_json (1.11.1)
-    multipart-post (2.0.0)
-    munin-ruby (0.2.5)
-    net-scp (1.2.1)
-      net-ssh (>= 2.6.5)
-    net-ssh (2.9.2)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    riemann-client (0.2.5)
-      beefcake (>= 0.3.5)
+    riemann-client (0.2.6)
+      beefcake (>= 0.3.5, <= 1.0.0)
       mtrc (>= 0.0.4)
       trollop (>= 1.16.2)
-    riemann-tools (0.2.6)
-      faraday (>= 0.8.5)
-      fog (>= 1.4.0)
-      munin-ruby (>= 0.2.1)
-      nokogiri (>= 1.5.6)
-      riemann-client (>= 0.2.2)
+    riemann-tools (0.2.13)
+      json (~> 1.8)
+      riemann-client (>= 0.2.6)
       trollop (>= 1.16.2)
-      yajl-ruby (>= 1.1.0)
     trollop (2.1.2)
-    yajl-ruby (1.2.1)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  riemann-tools (= 0.2.6)
+  riemann-tools (= 0.2.13)
 
 BUNDLED WITH
-   1.10.2
+   1.14.6
diff --git a/pkgs/tools/misc/riemann-tools/gemset.nix b/pkgs/tools/misc/riemann-tools/gemset.nix
index 07818fc76bc..a57139d2f7c 100644
--- a/pkgs/tools/misc/riemann-tools/gemset.nix
+++ b/pkgs/tools/misc/riemann-tools/gemset.nix
@@ -1,444 +1,52 @@
 {
-  "CFPropertyList" = {
-    version = "2.3.1";
+  beefcake = {
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10gid0a7pdllh3qmjiqkqxgfqvd7m1f2dmcm4gcd19s63pv620gv";
       type = "gem";
-      sha256 = "1wnk3gxnhfafbhgp0ic7qhzlx3lhv04v8nws2s31ii5s8135hs6k";
     };
+    version = "1.0.0";
   };
-  "beefcake" = {
-    version = "1.1.0";
+  json = {
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
       type = "gem";
-      sha256 = "009gzy9jp81lsnxnwisinhc58cd0qljdiipj2701lzzrha5d826z";
     };
+    version = "1.8.6";
   };
-  "builder" = {
-    version = "3.2.2";
+  mtrc = {
     source = {
-      type = "gem";
-      sha256 = "14fii7ab8qszrvsvhz6z2z3i4dw0h41a62fjr2h1j8m41vbrmyv2";
-    };
-  };
-  "excon" = {
-    version = "0.45.3";
-    source = {
-      type = "gem";
-      sha256 = "183kfxfjjlc97w4rxkrxjw3kis4lxm65vppmvl4bkblvlw4nq94j";
-    };
-  };
-  "faraday" = {
-    version = "0.9.1";
-    source = {
-      type = "gem";
-      sha256 = "1h33znnfzxpscgpq28i9fcqijd61h61zgs3gabpdgqfa1043axsn";
-    };
-    dependencies = [
-      "multipart-post"
-    ];
-  };
-  "fission" = {
-    version = "0.5.0";
-    source = {
-      type = "gem";
-      sha256 = "09pmp1j1rr8r3pcmbn2na2ls7s1j9ijbxj99xi3a8r6v5xhjdjzh";
-    };
-    dependencies = [
-      "CFPropertyList"
-    ];
-  };
-  "fog" = {
-    version = "1.31.0";
-    source = {
-      type = "gem";
-      sha256 = "0xr8xyrrkljm2hxi420x4qr5v6wqcj8d63v0qy1g6rkb3b1yhl9i";
-    };
-    dependencies = [
-      "fog-atmos"
-      "fog-aws"
-      "fog-brightbox"
-      "fog-core"
-      "fog-ecloud"
-      "fog-google"
-      "fog-json"
-      "fog-local"
-      "fog-powerdns"
-      "fog-profitbricks"
-      "fog-radosgw"
-      "fog-riakcs"
-      "fog-sakuracloud"
-      "fog-serverlove"
-      "fog-softlayer"
-      "fog-storm_on_demand"
-      "fog-terremark"
-      "fog-vmfusion"
-      "fog-voxel"
-      "fog-xml"
-      "ipaddress"
-      "nokogiri"
-    ];
-  };
-  "fog-atmos" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1aaxgnw9zy96gsh4h73kszypc32sx497s6bslvhfqh32q9d1y8c9";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-aws" = {
-    version = "0.6.0";
-    source = {
-      type = "gem";
-      sha256 = "1m79s5ha6qq60pxqqxr9qs9fg8fwaz79sfxckidyhxdydcsjwx6z";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-      "ipaddress"
-    ];
-  };
-  "fog-brightbox" = {
-    version = "0.7.2";
-    source = {
-      type = "gem";
-      sha256 = "0636sqaf2w1rh4i2hxfgs24374l4ai8dgch8a7nycqhvjk2dm0aq";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "inflecto"
-    ];
-  };
-  "fog-core" = {
-    version = "1.31.1";
-    source = {
-      type = "gem";
-      sha256 = "1bcsy4cq7vyjmdf3h2v7q6hfj64v6phn0rfvwgj5wfza7yaxnhk7";
-    };
-    dependencies = [
-      "builder"
-      "excon"
-      "formatador"
-      "mime-types"
-      "net-scp"
-      "net-ssh"
-    ];
-  };
-  "fog-ecloud" = {
-    version = "0.3.0";
-    source = {
-      type = "gem";
-      sha256 = "18rb4qjad9xwwqvvpj8r2h0hi9svy71pm4d3fc28cdcnfarmdi06";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-google" = {
-    version = "0.0.6";
-    source = {
-      type = "gem";
-      sha256 = "1g3ykk239nxpdsr5anhprkp8vzk106gi4q6aqjh4z8q4bii0dflm";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-json" = {
-    version = "1.0.2";
-    source = {
-      type = "gem";
-      sha256 = "0advkkdjajkym77r3c0bg2rlahl2akj0vl4p5r273k2qmi16n00r";
-    };
-    dependencies = [
-      "fog-core"
-      "multi_json"
-    ];
-  };
-  "fog-local" = {
-    version = "0.2.1";
-    source = {
-      type = "gem";
-      sha256 = "0i5hxwzmc2ag3z9nlligsaf679kp2pz39cd8n2s9cmxaamnlh2s3";
-    };
-    dependencies = [
-      "fog-core"
-    ];
-  };
-  "fog-powerdns" = {
-    version = "0.1.1";
-    source = {
-      type = "gem";
-      sha256 = "08zavzwfkk344gz83phz4sy9nsjznsdjsmn1ifp6ja17bvydlhh7";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-profitbricks" = {
-    version = "0.0.3";
-    source = {
-      type = "gem";
-      sha256 = "01a3ylfkjkyagf4b4xg9x2v20pzapr3ivn9ydd92v402bjsm1nmr";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-      "nokogiri"
-    ];
-  };
-  "fog-radosgw" = {
-    version = "0.0.4";
-    source = {
-      type = "gem";
-      sha256 = "1pxbvmr4dsqx4x2klwnciyhki4r5ryr9y0hi6xmm3n6fdv4ii7k3";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-riakcs" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "1nbxc4dky3agfwrmgm1aqmi59p6vnvfnfbhhg7xpg4c2cf41whxm";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-      "fog-xml"
-    ];
-  };
-  "fog-sakuracloud" = {
-    version = "1.0.1";
-    source = {
-      type = "gem";
-      sha256 = "1s16b48kh7y03hjv74ccmlfwhqqq7j7m4k6cywrgbyip8n3258n8";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-serverlove" = {
-    version = "0.1.2";
-    source = {
-      type = "gem";
-      sha256 = "0hxgmwzygrw25rbsy05i6nzsyr0xl7xj5j2sjpkb9n9wli5sagci";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-softlayer" = {
-    version = "0.4.7";
-    source = {
-      type = "gem";
-      sha256 = "0fgfbhqnyp8ywymvflflhvbns54d1432x57pgpnfy8k1cxvhv9b8";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-storm_on_demand" = {
-    version = "0.1.1";
-    source = {
-      type = "gem";
-      sha256 = "0fif1x8ci095b2yyilf65n7x6iyvn448azrsnmwsdkriy8vxxv3y";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-json"
-    ];
-  };
-  "fog-terremark" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "01lfkh9jppj0iknlklmwyb7ym3bfhkq58m3absb6rf5a5mcwi3lf";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-vmfusion" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "0g0l0k9ylxk1h9pzqr6h2ba98fl47lpp3j19lqv4jxw0iw1rqxn4";
-    };
-    dependencies = [
-      "fission"
-      "fog-core"
-    ];
-  };
-  "fog-voxel" = {
-    version = "0.1.0";
-    source = {
-      type = "gem";
-      sha256 = "10skdnj59yf4jpvq769njjrvh2l0wzaa7liva8n78qq003mvmfgx";
-    };
-    dependencies = [
-      "fog-core"
-      "fog-xml"
-    ];
-  };
-  "fog-xml" = {
-    version = "0.1.2";
-    source = {
-      type = "gem";
-      sha256 = "1576sbzza47z48p0k9h1wg3rhgcvcvdd1dfz3xx1cgahwr564fqa";
-    };
-    dependencies = [
-      "fog-core"
-      "nokogiri"
-    ];
-  };
-  "formatador" = {
-    version = "0.2.5";
-    source = {
-      type = "gem";
-      sha256 = "1gc26phrwlmlqrmz4bagq1wd5b7g64avpx0ghxr9xdxcvmlii0l0";
-    };
-  };
-  "inflecto" = {
-    version = "0.0.2";
-    source = {
-      type = "gem";
-      sha256 = "085l5axmvqw59mw5jg454a3m3gr67ckq9405a075isdsn7bm3sp4";
-    };
-  };
-  "ipaddress" = {
-    version = "0.8.0";
-    source = {
-      type = "gem";
-      sha256 = "0cwy4pyd9nl2y2apazp3hvi12gccj5a3ify8mi8k3knvxi5wk2ir";
-    };
-  };
-  "mime-types" = {
-    version = "2.6.1";
-    source = {
-      type = "gem";
-      sha256 = "1vnrvf245ijfyxzjbj9dr6i1hkjbyrh4yj88865wv9bs75axc5jv";
-    };
-  };
-  "mini_portile" = {
-    version = "0.6.2";
-    source = {
-      type = "gem";
-      sha256 = "0h3xinmacscrnkczq44s6pnhrp4nqma7k056x5wv5xixvf2wsq2w";
-    };
-  };
-  "mtrc" = {
-    version = "0.0.4";
-    source = {
-      type = "gem";
+      remotes = ["https://rubygems.org"];
       sha256 = "0xj2pv4cpn0ad1xw38sinsxfzwhgqs6ff18hw0cwz5xmsf3zqmiz";
-    };
-  };
-  "multi_json" = {
-    version = "1.11.1";
-    source = {
       type = "gem";
-      sha256 = "0lrmadw2scqwz7nw3j5pfdnmzqimlbaxlxi37xsydrpbbr78qf6g";
     };
+    version = "0.0.4";
   };
-  "multipart-post" = {
-    version = "2.0.0";
+  riemann-client = {
+    dependencies = ["beefcake" "mtrc" "trollop"];
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02rp8x2y8h61x8mx9c8kwgm2yyvgg63g8km93zmwmkpp5fyi3fi8";
       type = "gem";
-      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
     };
-  };
-  "munin-ruby" = {
-    version = "0.2.5";
-    source = {
-      type = "gem";
-      sha256 = "0378jyf0hdbfs2vvk7v8k7hqilzi1rfkpn271dyrqqal7g2lnjl2";
-    };
-  };
-  "net-scp" = {
-    version = "1.2.1";
-    source = {
-      type = "gem";
-      sha256 = "0b0jqrcsp4bbi4n4mzyf70cp2ysyp6x07j8k8cqgxnvb4i3a134j";
-    };
-    dependencies = [
-      "net-ssh"
-    ];
-  };
-  "net-ssh" = {
-    version = "2.9.2";
-    source = {
-      type = "gem";
-      sha256 = "1p0bj41zrmw5lhnxlm1pqb55zfz9y4p9fkrr9a79nrdmzrk1ph8r";
-    };
-  };
-  "nokogiri" = {
-    version = "1.6.6.2";
-    source = {
-      type = "gem";
-      sha256 = "1j4qv32qjh67dcrc1yy1h8sqjnny8siyy4s44awla8d6jk361h30";
-    };
-    dependencies = [
-      "mini_portile"
-    ];
-  };
-  "riemann-client" = {
-    version = "0.2.5";
-    source = {
-      type = "gem";
-      sha256 = "1myhyh31f290jm1wlhhjvf331n5l8qdm7axkxyacdgjsfg4szsjc";
-    };
-    dependencies = [
-      "beefcake"
-      "mtrc"
-      "trollop"
-    ];
-  };
-  "riemann-tools" = {
     version = "0.2.6";
-    source = {
-      type = "gem";
-      sha256 = "0qjm7p55h70l5bs876hhvz3isr204663f97py9g0ajxz2z8jkzpi";
-    };
-    dependencies = [
-      "faraday"
-      "fog"
-      "munin-ruby"
-      "nokogiri"
-      "riemann-client"
-      "trollop"
-      "yajl-ruby"
-    ];
   };
-  "trollop" = {
-    version = "2.1.2";
+  riemann-tools = {
+    dependencies = ["json" "riemann-client" "trollop"];
     source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0brf44cq4xz0nqhs189zlg76527bfv3jr453yc00410qdzz8fpxa";
       type = "gem";
+    };
+    version = "0.2.13";
+  };
+  trollop = {
+    source = {
+      remotes = ["https://rubygems.org"];
       sha256 = "0415y63df86sqj43c0l82and65ia5h64if7n0znkbrmi6y0jwhl8";
-    };
-  };
-  "yajl-ruby" = {
-    version = "1.2.1";
-    source = {
       type = "gem";
-      sha256 = "0zvvb7i1bl98k3zkdrnx9vasq0rp2cyy5n7p9804dqs4fz9xh9vf";
     };
+    version = "2.1.2";
   };
 }
\ No newline at end of file

From 27e7143cf70a5586cffb49b9d2c9db304a4b5f4b Mon Sep 17 00:00:00 2001
From: Frank Doepper <github@woffs.de>
Date: Wed, 13 Jun 2018 19:38:11 +0200
Subject: [PATCH 09/29] zfs: fix substitution of /bin/rm (#41930)

---
 pkgs/os-specific/linux/zfs/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 232d647e122..c44d64b8fa8 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -77,7 +77,7 @@ let
         substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
         substituteInPlace ./module/Makefile.in        --replace "/bin/cp"                 "cp"
         substituteInPlace ./etc/systemd/system/zfs-share.service.in \
-          --replace "@bindir@/rm " "${coreutils}/bin/rm "
+          --replace "/bin/rm " "${coreutils}/bin/rm "
 
         for f in ./udev/rules.d/*
         do

From 903292a2d845a3d7eececfec364fb871f9ff2317 Mon Sep 17 00:00:00 2001
From: tilpner <till@hoeppner.ws>
Date: Wed, 13 Jun 2018 19:47:26 +0200
Subject: [PATCH 10/29] nixos/awesome: Add noArgb option

Add option to disable client transparency support in awesome,
which greatly improves performance in my setup
(and presumably will in some others).
---
 nixos/modules/services/x11/window-managers/awesome.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/x11/window-managers/awesome.nix b/nixos/modules/services/x11/window-managers/awesome.nix
index 71eb02ec595..089e9f769f0 100644
--- a/nixos/modules/services/x11/window-managers/awesome.nix
+++ b/nixos/modules/services/x11/window-managers/awesome.nix
@@ -37,6 +37,11 @@ in
         apply = pkg: if pkg == null then pkgs.awesome else pkg;
       };
 
+      noArgb = mkOption {
+        default = false;
+        type = types.bool;
+        description = "Disable client transparency support, which can be greatly detrimental to performance in some setups";
+      };
     };
 
   };
@@ -50,7 +55,7 @@ in
       { name = "awesome";
         start =
           ''
-            ${awesome}/bin/awesome ${makeSearchPath cfg.luaModules} &
+            ${awesome}/bin/awesome ${lib.optionalString cfg.noArgb "--no-argb"} ${makeSearchPath cfg.luaModules} &
             waitPID=$!
           '';
       };

From 7ba1016f91c9d9ccebc287cfd1b964f37062d510 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 13 Jun 2018 17:58:18 +0200
Subject: [PATCH 11/29] =?UTF-8?q?gnome3.gnome-documents:=203.28.0=20?=
 =?UTF-8?q?=E2=86=92=203.28.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/desktops/gnome-3/apps/gnome-documents/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
index 3bd3222dc0c..7db21d9e748 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-documents-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-documents/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "174q59gk9j0083bvv8sd2k66xrd4lydy2rcqbwsbzsy22fbhwcha";
+    sha256 = "1i0s246bg9xcjxgbajph744pn65bq5gk6r9kkl3f5iwdq3rjc0pm";
   };
 
   doCheck = true;

From 42a08e62f58870fcf8bbc3d2ef1e91454e6dff68 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 13 Jun 2018 17:58:34 +0200
Subject: [PATCH 12/29] =?UTF-8?q?gnome3.epiphany:=203.28.2.1=20=E2=86=92?=
 =?UTF-8?q?=203.28.3.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/desktops/gnome-3/core/epiphany/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index f55be458add..9613606f777 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "epiphany-${version}";
-  version = "3.28.2.1";
+  version = "3.28.3.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0ba0qqsbg3cv1k1pcj971y7l8kqib5l7kbr743x9a7hbmkqfk95s";
+    sha256 = "1xz6xl6b0iihvczyr0cs1z5ifvpai6anb4m0ng1caiph06klc1b9";
   };
 
   # Tests need an X display

From 79b78085978db9a8c7057025320aa83082b10921 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 13 Jun 2018 17:59:02 +0200
Subject: [PATCH 13/29] =?UTF-8?q?phpPackages.php-cs-fixer:=202.12.0=20?=
 =?UTF-8?q?=E2=86=92=202.12.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/top-level/php-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 0aa78e3178d..a1015c78024 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -383,11 +383,11 @@ let
 
   php-cs-fixer = pkgs.stdenv.mkDerivation rec {
     name = "php-cs-fixer-${version}";
-    version = "2.12.0";
+    version = "2.12.1";
 
     src = pkgs.fetchurl {
       url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-      sha256 = "1vz3s0hbqp1rzgrqfnr0jj5qds1jnw7kyhpl4qjlpd4s40x0n4b1";
+      sha256 = "1ifwb30wddp5blqnrkdmf0x11dk7nbxj4z2v5403fn7wfhgvibd2";
     };
 
     phases = [ "installPhase" ];

From eb969e2f8917b52c207730c0f836258d73431f63 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 13 Jun 2018 18:09:33 +0200
Subject: [PATCH 14/29] =?UTF-8?q?flatpak:=200.11.7=20=E2=86=92=200.11.8.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../development/libraries/flatpak/default.nix |  4 +-
 .../libraries/flatpak/fix-test-paths.patch    | 57 +++++++++++++------
 2 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/libraries/flatpak/default.nix b/pkgs/development/libraries/flatpak/default.nix
index f26dad3ce15..eeaa1e32496 100644
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@@ -4,7 +4,7 @@
 , libsoup, lzma, ostree, polkit, python3, systemd, xlibs, valgrind, glib_networking, makeWrapper, gnome3 }:
 
 let
-  version = "0.11.7";
+  version = "0.11.8.2";
   desktop_schemas = gnome3.gsettings_desktop_schemas;
 in stdenv.mkDerivation rec {
   name = "flatpak-${version}";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${version}/${name}.tar.xz";
-    sha256 = "1vq4j7v68lp4fsvpas1bcsx1z4snpj0mkbq2mi00kx3jb48z768h";
+    sha256 = "03c2fx0y7irvws25858x217xmbacn2vfdypf8vc32hkrbh9i6df7";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/flatpak/fix-test-paths.patch b/pkgs/development/libraries/flatpak/fix-test-paths.patch
index a548f388286..0c2b7da79eb 100644
--- a/pkgs/development/libraries/flatpak/fix-test-paths.patch
+++ b/pkgs/development/libraries/flatpak/fix-test-paths.patch
@@ -1,6 +1,6 @@
 --- a/tests/libtest.sh
 +++ b/tests/libtest.sh
-@@ -322,7 +322,7 @@
+@@ -324,7 +324,7 @@
          # running installed-tests: assume we know what we're doing
          :
      elif ! "$FLATPAK_BWRAP" --unshare-ipc --unshare-net --unshare-pid \
@@ -9,7 +9,7 @@
          sed -e 's/^/# /' < bwrap-result
          echo "1..0 # SKIP Cannot run bwrap"
          exit 0
-@@ -330,7 +330,7 @@
+@@ -332,7 +332,7 @@
  }
  
  skip_without_python2 () {
@@ -18,7 +18,7 @@
          echo "1..0 # SKIP this test requires /usr/bin/python2 (2.7) support"
          exit 0
      fi
-@@ -350,12 +350,12 @@
+@@ -352,12 +352,12 @@
  export DBUS_SESSION_BUS_ADDRESS="$(cat dbus-session-bus-address)"
  DBUS_SESSION_BUS_PID="$(cat dbus-session-bus-pid)"
  
@@ -28,30 +28,51 @@
  fi
  
  cleanup () {
--    /bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
-+    @coreutils@/bin/kill $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
+-    /bin/kill -9 $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
++    @coreutils@/bin/kill -9 $DBUS_SESSION_BUS_PID ${FLATPAK_HTTP_PID:-}
      gpg-connect-agent --homedir "${FL_GPG_HOMEDIR}" killagent /bye || true
      fusermount -u $XDG_RUNTIME_DIR/doc || :
      if test -n "${TEST_SKIP_CLEANUP:-}"; then
 --- a/tests/make-test-runtime.sh
 +++ b/tests/make-test-runtime.sh
-@@ -21,6 +21,7 @@
- cat ${DIR}/metadata
+@@ -26,6 +26,7 @@
+ PATH="$PATH:/usr/sbin:/sbin"
  
  # Add bash and dependencies
 +mkdir -p ${DIR}/nix/store
  mkdir -p ${DIR}/usr/bin
  mkdir -p ${DIR}/usr/lib
  ln -s ../lib ${DIR}/usr/lib64
-@@ -30,47 +31,27 @@
+@@ -35,73 +36,27 @@
  else
      cp `which ldconfig` ${DIR}/usr/bin
  fi
--T=`mktemp`
--for i in $@; do
+-LIBS=`mktemp`
+-BINS=`mktemp`
+-
+-add_bin() {
+-    local f=$1
+-    shift
+-
+-    if grep -qFe "${f}" $BINS; then
+-        # Already handled
+-        return 0
+-    fi
+-
+-    echo $f >> $BINS
+-
+-    # Add library dependencies
+-    (ldd "${f}" | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | sort -u -o $LIBS $LIBS -)  || true
+-
+-    local shebang=$(sed -n '1s/^#!\([^ ]*\).*/\1/p' "${f}")
+-    if [ x$shebang != x ]; then
+-        add_bin "$shebang"
+-    fi
+-}
+-
+ for i in $@; do
 -    I=`which $i`
--    cp $I ${DIR}/usr/bin
--    ldd $I | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | grep ^/ >> $T
+-    add_bin $I
 -    if test $i == python2; then
 -        mkdir -p ${DIR}/usr/lib/python2.7/lib-dynload
 -        # This is a hardcoded minimal set of modules we need in the current tests.
@@ -78,10 +99,13 @@
 -        done
 -    fi
 -done
- ln -s bash ${DIR}/usr/bin/sh
--for i in `sort -u $T`; do
+-for i in `cat $BINS`; do
+-    echo Adding binary $i 1>&2
+-    cp "$i" ${DIR}/usr/bin/
+-done
+-for i in `cat $LIBS`; do
+-    echo Adding library $i 1>&2
 -    cp "$i" ${DIR}/usr/lib/
-+for i in $@; do
 +    I=$(readlink -f $(which $i))
 +    requisites=$(nix-store --query --requisites "$I")
 +    for r in $requisites; do
@@ -92,6 +116,7 @@
 +    done
 +    ln -s $I ${DIR}/usr/bin/$i
  done
+ ln -s bash ${DIR}/usr/bin/sh
  
 -# We copy the C.UTF8 locale and call it en_US. Its a bit of a lie, but
 -# the real en_US locale is often not available, because its in the
@@ -110,7 +135,7 @@
      collection_args=--collection-id=${COLLECTION_ID}
 --- a/tests/testlibrary.c
 +++ b/tests/testlibrary.c
-@@ -378,7 +378,7 @@
+@@ -610,7 +610,7 @@
      {
        gint exit_code = 0;
        char *argv[] = { (char *)bwrap, "--unshare-ipc", "--unshare-net",

From 1c479b27fa41e0b92374d59a2847f5488586fcd9 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm+bot@ryantm.com>
Date: Wed, 13 Jun 2018 11:16:12 -0700
Subject: [PATCH 15/29] xmr-stak: 2.4.4 -> 2.4.5

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/xmr-stak/versions.

These checks were done:

- built on NixOS
- /nix/store/wbq2l97g7y24hnbz1zzs17yl8qh1csd3-xmr-stak-2.4.5/bin/xmr-stak passed the binary check.
- Warning: no invocation of /nix/store/wbq2l97g7y24hnbz1zzs17yl8qh1csd3-xmr-stak-2.4.5/bin/libxmrstak_opencl_backend.so had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 2.4.5 with grep in /nix/store/wbq2l97g7y24hnbz1zzs17yl8qh1csd3-xmr-stak-2.4.5
- directory tree listing: https://gist.github.com/d748f1490c29ab43e9426b5d283a5e4e
- du listing: https://gist.github.com/06e416d3c3db5caf733655c9ab632eea
---
 pkgs/applications/misc/xmr-stak/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index 5dcaeb1226e..05530af1254 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -12,13 +12,13 @@ in
 
 stdenv'.mkDerivation rec {
   name = "xmr-stak-${version}";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "fireice-uk";
     repo = "xmr-stak";
     rev = "${version}";
-    sha256 = "1j75466hfs18w05k64yb60pw865ah226vjib46qr1wb1mcd82i5s";
+    sha256 = "0ix4vqhcm4x9j5p6pwdfwkm2ml6wmwsyn3ppzvxllhp4dj8blzwf";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";

From e49dd6157b80ceafb265ad129a928bdb1512b727 Mon Sep 17 00:00:00 2001
From: Vladyslav M <dywedir@pm.me>
Date: Wed, 13 Jun 2018 22:13:22 +0300
Subject: [PATCH 16/29] skim: 0.4.0 -> 0.5.0 (#41936)

---
 pkgs/tools/misc/skim/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/skim/default.nix b/pkgs/tools/misc/skim/default.nix
index 169389928d0..31303dcdd4d 100644
--- a/pkgs/tools/misc/skim/default.nix
+++ b/pkgs/tools/misc/skim/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   name = "skim-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "lotabout";
     repo = "skim";
     rev = "v${version}";
-    sha256 = "067ds1sdi9ya1yqz9saczj1vml8arwzd46w35gmvdxgmxx4wmihs";
+    sha256 = "0hk19mqfmrsyx28lb8h1hixivl6zrc8dg3imygk1ppgn66c0zf00";
   };
 
   outputs = [ "out" "vim" ];
@@ -17,6 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   patchPhase = ''
     sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/skim.vim
+    # fix Cargo.lock version
+    sed -i -e '168s|0.4.0|0.5.0|' Cargo.lock
   '';
 
   postInstall = ''

From b5476e4c985a96b792327561fc3a394d7e9aaa89 Mon Sep 17 00:00:00 2001
From: Jens Binkert <jensbin+git@pm.me>
Date: Wed, 13 Jun 2018 19:49:14 +0000
Subject: [PATCH 17/29] terraform-provider-ibm: 0.9.1 -> 0.10.0 (#41942)

---
 .../networking/cluster/terraform-provider-ibm/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix b/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
index 304df0947ac..66bf20c2b84 100644
--- a/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-provider-ibm/default.nix
@@ -12,7 +12,7 @@
 
 buildGoPackage rec {
   name = "terraform-provider-ibm-${version}";
-  version = "0.9.1";
+  version = "0.10.0";
 
   goPackagePath = "github.com/terraform-providers/terraform-provider-ibm";
   subPackages = [ "./" ];
@@ -20,7 +20,7 @@ buildGoPackage rec {
   src = fetchFromGitHub {
     owner = "IBM-Cloud";
     repo = "terraform-provider-ibm";
-    sha256 = "1j8v7r5lsvrg1afdbwxi8vq665qr47a9pddqgmpkirh99pzixgr6";
+    sha256 = "03drvhhh6pkk8yzzp8iiq478kcky9swxvxadxzxh0v4jzdprg9lr";
     rev = "v${version}";
   };
 

From d7895c2810864934356131ee47de2ba18947c844 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 13 Jun 2018 16:25:12 -0400
Subject: [PATCH 18/29] darwin stdenv: fix llvmPackage overrides

It may seem nice and abstract to just override the default version, but
that breaks the alias relationship where the original llvmPackages_* is
no longer in sync. Put another away, modifying the referee rather
instead of breaking the reference "copy-on-write" is impossible.
---
 pkgs/stdenv/darwin/default.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 951c96877f9..57b59f26204 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -275,10 +275,9 @@ in rec {
         libcxxabi libcxx ncurses libffi zlib gmp pcre gnugrep
         coreutils findutils diffutils patchutils;
 
-       llvmPackages = let llvmOverride = llvmPackages.llvm.override { inherit libcxxabi; };
-       in super.llvmPackages // {
-         llvm = llvmOverride;
-         clang-unwrapped = llvmPackages.clang-unwrapped.override { llvm = llvmOverride; };
+       llvmPackages_5 = super.llvmPackages_5 // {
+         llvm = llvmPackages_5.llvm.override { inherit libcxxabi; };
+         clang-unwrapped = llvmPackages_5.clang-unwrapped.override { llvm = self.llvmPackages_5.llvm; };
        };
 
       darwin = super.darwin // {
@@ -314,8 +313,8 @@ in rec {
         libcxxabi libcxx ncurses libffi zlib llvm gmp pcre gnugrep
         coreutils findutils diffutils patchutils;
 
-      llvmPackages = super.llvmPackages // {
-        inherit (llvmPackages) llvm clang-unwrapped;
+      llvmPackages_5 = super.llvmPackages_5 // {
+        inherit (llvmPackages_5) llvm clang-unwrapped;
       };
 
       darwin = super.darwin // {

From 45c70e496f9cd6cd733bcc6578f353ce304a52d8 Mon Sep 17 00:00:00 2001
From: Matthew Justin Bauer <mjbauer95@gmail.com>
Date: Wed, 13 Jun 2018 16:34:50 -0400
Subject: [PATCH 19/29] ghcjs-ng: add haskellCompilerName attribute

This is needed by some old code in Nixpkgs. Adding it here will fix some eval errors.

/cc @ElvishJerricco

Fixes #41943
---
 pkgs/development/compilers/ghcjs-ng/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/compilers/ghcjs-ng/default.nix b/pkgs/development/compilers/ghcjs-ng/default.nix
index 6e883aeafe8..dda414620e0 100644
--- a/pkgs/development/compilers/ghcjs-ng/default.nix
+++ b/pkgs/development/compilers/ghcjs-ng/default.nix
@@ -47,6 +47,8 @@ let
     # Relics of the old GHCJS build system
     stage1Packages = [];
     mkStage2 = _: {};
+
+    haskellCompilerName = "ghcjs";
   };
 
   bootGhcjs = haskellLib.justStaticExecutables passthru.bootPkgs.ghcjs;

From e2bc05edc6d931dfe29324b6c7a0b93ab4608dd7 Mon Sep 17 00:00:00 2001
From: Meghea Iulian <iulian.meghea@gmail.com>
Date: Thu, 14 Jun 2018 00:32:21 +0300
Subject: [PATCH 20/29] avocode: 2.26.4 -> 3.0.0 (#41947)

---
 pkgs/applications/graphics/avocode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 89a728f1a99..9f9e965c6a9 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "avocode-${version}";
-  version = "2.26.4";
+  version = "3.0.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "0qbir023zyd53ly6y8zcm3kbhbhjjpclcgp9d0mqb5lc9zajxv12";
+    sha256 = "1lm0zzqhnk5gm68l8fkmlkh3gl71f1xw0amy23460a7hm9wcwjr7";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; with gnome2; [

From e5a990a3c2460037694d7673fedffa2555b8780d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 13 Jun 2018 23:08:46 +0100
Subject: [PATCH 21/29] powershell:  autoPatchelfHook/makeWrapper belongs to
 nativeBuildInputs

---
 pkgs/shells/powershell/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/shells/powershell/default.nix b/pkgs/shells/powershell/default.nix
index e1596472005..a053884bb88 100644
--- a/pkgs/shells/powershell/default.nix
+++ b/pkgs/shells/powershell/default.nix
@@ -22,7 +22,8 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
-  buildInputs = [ autoPatchelfHook makeWrapper less ] ++ libraries;
+  buildInputs = [ less ] ++ libraries;
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
 
   # TODO: remove PAGER after upgrading to v6.1.0-preview.1 or later as it has been addressed in
   # https://github.com/PowerShell/PowerShell/pull/6144

From 706fc08b38586b4bfea9393a02b2bc08b814a883 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 13 Jun 2018 18:11:51 -0400
Subject: [PATCH 22/29] linux: 4.4.136 -> 4.4.137

---
 pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index ecef71fd604..999952dba69 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.136";
+  version = "4.4.137";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0svb6qbhc376jk26r67qssh7lradx63s60qlm1q2kd4xjhxyj5a3";
+    sha256 = "01hjnwfrx0fr9zbd6qcqfxsp0xm34ai7k49i7ndxwcrhzdipkl9i";
   };
 } // (args.argsOverride or {}))

From 6845d1829f5b2158ddc2246c86fe92d79fbe6e44 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 13 Jun 2018 18:12:02 -0400
Subject: [PATCH 23/29] linux: 4.9.107 -> 4.9.108

---
 pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index bcc4aad7fcc..d9b821b8f15 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.107";
+  version = "4.9.108";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lya48grdgjjbzw8x5kvvblanfas23dcmchysnhwv5p0rq7g9rrw";
+    sha256 = "0ha0bvjfxz6nx3nrcrpciqlrphy318xi04lv4k7jr5hpialjpzkk";
   };
 } // (args.argsOverride or {}))

From acec84f92885175a282e134d99e574c27cd8c7bb Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Wed, 13 Jun 2018 22:13:42 +0000
Subject: [PATCH 24/29] fzf: 0.17.3 -> 0.17.4

---
 pkgs/tools/misc/fzf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index d9da04c1fa1..ba85c5376db 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "fzf-${version}";
-  version = "0.17.3";
+  version = "0.17.4";
   rev = "${version}";
 
   goPackagePath = "github.com/junegunn/fzf";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "junegunn";
     repo = "fzf";
-    sha256 = "1wsyykvnss5r0sx344kjbprnb87849462p9rg9xj37cp7qzciwdn";
+    sha256 = "10k21v9x82imly36lgra8a7rlvz5a1jd49db16g9xc11wx7cdg8g";
   };
 
   outputs = [ "bin" "out" "man" ];

From 9f00b07aa40fd776706239b427424408a54cb2bc Mon Sep 17 00:00:00 2001
From: Sebastien Maret <sebastien.maret@univ-grenoble-alpes.fr>
Date: Thu, 14 Jun 2018 00:41:03 +0200
Subject: [PATCH 25/29] ispell: fix compilation on Darwin

Closes #41948.
---
 pkgs/tools/text/ispell/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/text/ispell/default.nix b/pkgs/tools/text/ispell/default.nix
index b2219d1e66d..d35a3d61b1b 100644
--- a/pkgs/tools/text/ispell/default.nix
+++ b/pkgs/tools/text/ispell/default.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
     ./patches/0030-Display-whole-multibyte-character.patch
   ];
   postPatch = ''
+    if [ ! stdenv.isDarwin ]; then echo "#define USG" >> local.h; fi
     cat >> local.h <<EOF
-    #define USG
     #define TERMLIB "-lncurses"
     #define LANGUAGES "{american,MASTERDICTS=american.med,HASHFILES=americanmed.hash}"
     #define MASTERHASH "americanmed.hash"

From aa68838ea780a33466c4219f4b723e1bd98e4352 Mon Sep 17 00:00:00 2001
From: Sebastien Maret <sebastien.maret@univ-grenoble-alpes.fr>
Date: Thu, 14 Jun 2018 01:13:10 +0200
Subject: [PATCH 26/29] ispell: use optionalString instead of a bash
 conditional

---
 pkgs/tools/text/ispell/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/text/ispell/default.nix b/pkgs/tools/text/ispell/default.nix
index d35a3d61b1b..dbec8d353d9 100644
--- a/pkgs/tools/text/ispell/default.nix
+++ b/pkgs/tools/text/ispell/default.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
     ./patches/0030-Display-whole-multibyte-character.patch
   ];
   postPatch = ''
-    if [ ! stdenv.isDarwin ]; then echo "#define USG" >> local.h; fi
     cat >> local.h <<EOF
+    ${stdenv.lib.optionalString (!stdenv.isDarwin) "#define USG"}
     #define TERMLIB "-lncurses"
     #define LANGUAGES "{american,MASTERDICTS=american.med,HASHFILES=americanmed.hash}"
     #define MASTERHASH "americanmed.hash"

From dfa28951818189a983079bacbbc06d92a584e953 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Wed, 13 Jun 2018 18:38:40 -0400
Subject: [PATCH 27/29] androidndk: fixup asm linking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes cross compiling to android that is currently broken. The
asm symlink needs to be set on versions /newer/ than 10e not the other
way around. We also need to use hostInfo’s triple here because ...

/cc @ericson2314 @bkchr
---
 pkgs/development/mobile/androidenv/androidndk-pkgs.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/mobile/androidenv/androidndk-pkgs.nix b/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
index 1323466ea86..9541d62e160 100644
--- a/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
+++ b/pkgs/development/mobile/androidenv/androidndk-pkgs.nix
@@ -110,7 +110,8 @@ rec {
       mkdir -p $out
       cp -r ${includePath} $out/include
       chmod +w $out/include
-      ${lib.optionalString (lib.versionOlder buildAndroidndk.version "10e") "ln -s $out/include/${targetInfo.triple}/asm $out/include/asm"}
+      ${lib.optionalString (lib.versionOlder "10e" buildAndroidndk.version)
+        "ln -s $out/include/${hostInfo.triple}/asm $out/include/asm"}
       ln -s ${libPath} $out/lib
     '';
 }

From e358fff0d668d825e6e9b8376466bf56e0422d7b Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 13 Jun 2018 21:01:29 -0400
Subject: [PATCH 28/29] llvm: use native cmake for libc++abi

Finish what 1cb1b9193b64c74df3b269dabb520c9ae73ee8d5 started.
---
 pkgs/development/compilers/llvm/3.7/libc++abi.nix | 3 ++-
 pkgs/development/compilers/llvm/3.8/libc++abi.nix | 3 ++-
 pkgs/development/compilers/llvm/3.9/libc++abi.nix | 1 -
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/3.7/libc++abi.nix b/pkgs/development/compilers/llvm/3.7/libc++abi.nix
index d2be57b1a5f..2c79d7b3b1b 100644
--- a/pkgs/development/compilers/llvm/3.7/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.7/libc++abi.nix
@@ -11,7 +11,8 @@ in stdenv.mkDerivation {
 
   src = fetch "libcxxabi" "0ambfcmr2nh88hx000xb7yjm9lsqjjz49w5mlf6dlxzmj3nslzx4";
 
-  buildInputs = [ cmake ] ++ stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
     unpackFile ${libcxx.src}
diff --git a/pkgs/development/compilers/llvm/3.8/libc++abi.nix b/pkgs/development/compilers/llvm/3.8/libc++abi.nix
index 6b98a5726cf..45fb7b5be4f 100644
--- a/pkgs/development/compilers/llvm/3.8/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.8/libc++abi.nix
@@ -5,7 +5,8 @@ stdenv.mkDerivation {
 
   src = fetch "libcxxabi" "1qfs2iis1i0ppv11jndc98cvd7s25pj46pq2sfyldmzswdxmzdg1";
 
-  buildInputs = [ cmake ] ++ stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''
     unpackFile ${libcxx.src}
diff --git a/pkgs/development/compilers/llvm/3.9/libc++abi.nix b/pkgs/development/compilers/llvm/3.9/libc++abi.nix
index 65345ca6992..dc508757ab6 100644
--- a/pkgs/development/compilers/llvm/3.9/libc++abi.nix
+++ b/pkgs/development/compilers/llvm/3.9/libc++abi.nix
@@ -6,7 +6,6 @@ stdenv.mkDerivation {
   src = fetch "libcxxabi" "1qi9q06zanqm8awzq83810avmvi52air6gr9zfip8mbg5viqn3cj";
 
   nativeBuildInputs = [ cmake ];
-
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD) libunwind;
 
   postUnpack = ''

From 7156f469495188b631cfc42d93330ecc2656e408 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 13 Jun 2018 17:18:19 -0400
Subject: [PATCH 29/29] llvm 3.8+: Remove unneeded libcxxabi dependency

Evidentally this hasn't been needed for a while
---
 pkgs/development/compilers/llvm/3.8/default.nix | 1 -
 pkgs/development/compilers/llvm/3.8/llvm.nix    | 4 +---
 pkgs/development/compilers/llvm/3.9/default.nix | 1 -
 pkgs/development/compilers/llvm/3.9/llvm.nix    | 3 +--
 pkgs/development/compilers/llvm/4/default.nix   | 1 -
 pkgs/development/compilers/llvm/4/llvm.nix      | 4 +---
 pkgs/development/compilers/llvm/5/llvm.nix      | 3 ++-
 pkgs/development/compilers/llvm/6/default.nix   | 4 +---
 pkgs/development/compilers/llvm/6/llvm.nix      | 4 +---
 9 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/compilers/llvm/3.8/default.nix b/pkgs/development/compilers/llvm/3.8/default.nix
index 6fa1a0cf2e2..3f0cd7d0a76 100644
--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@@ -20,7 +20,6 @@ let
  in {
     llvm = callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     };
 
     clang-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index 0f259977f70..2c65234b6a4 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -13,7 +13,6 @@
 , version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableSharedLibraries ? true
 }:
@@ -31,8 +30,7 @@ in stdenv.mkDerivation rec {
     mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ]
-    ++ stdenv.lib.optional stdenv.isDarwin libcxxabi;
+  buildInputs = [ perl groff cmake libxml2 python libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/3.9/default.nix b/pkgs/development/compilers/llvm/3.9/default.nix
index c3bf0b48d64..3735fb6a02c 100644
--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@@ -20,7 +20,6 @@ let
   in {
     llvm = callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     };
 
     clang-unwrapped = callPackage ./clang {
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index f8020116750..71b67aa7dc5 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -13,7 +13,6 @@
 , version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableSharedLibraries ? (buildPlatform == hostPlatform)
 , darwin
@@ -53,7 +52,7 @@ in stdenv.mkDerivation rec {
     groff
     libxml2
     libffi
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index fecf65136bc..c46e520a33d 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -28,7 +28,6 @@ let
 
     llvm = overrideManOutput (callPackage ./llvm.nix {
       inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
     });
     clang-unwrapped = overrideManOutput (callPackage ./clang {
       inherit clang-tools-extra_src;
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index bc8453f743a..a371296db32 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -12,7 +12,6 @@
 , release_version
 , zlib
 , compiler-rt_src
-, libcxxabi
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
@@ -42,8 +41,7 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
-  buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 66985861e38..5070de1f48b 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -43,7 +43,8 @@ in stdenv.mkDerivation (rec {
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+    # TODO(@Ericson2314): Remove next mass rebuild
+    ++ stdenv.lib.optionals (stdenv.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform) [ libcxxabi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/llvm/6/default.nix b/pkgs/development/compilers/llvm/6/default.nix
index 17c743c0408..bbac21ef679 100644
--- a/pkgs/development/compilers/llvm/6/default.nix
+++ b/pkgs/development/compilers/llvm/6/default.nix
@@ -25,9 +25,7 @@ let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python2 isl release_version version fetch; });
   in {
 
-    llvm = overrideManOutput (callPackage ./llvm.nix {
-      inherit (targetLlvmLibraries) libcxxabi;
-    });
+    llvm = overrideManOutput (callPackage ./llvm.nix { });
     clang-unwrapped = overrideManOutput (callPackage ./clang {
       inherit clang-tools-extra_src;
     });
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 8877ccd1162..9cae65ef103 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -11,7 +11,6 @@
 , version
 , release_version
 , zlib
-, libcxxabi
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
@@ -40,8 +39,7 @@ in stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake python ]
     ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
 
-  buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi ];
+  buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];