From 310203565c860f5c9f8074aee85871089a1f234e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 21 Dec 2017 17:53:25 +0100
Subject: [PATCH 01/63] wrapPythonPrograms: do not propagate disabling user
 site-packages to child-processes

The `PYTHONNOUSERSITE` was exported to prevent impurities during
runtime. The downside of exporting environment variables is that they
always propagate all the way down the process tree, unless they are
explicitly unset at some point. Using the `-s` argument applies it only
to the process executed in the wrapper. That way, subprocesses are free
to do impure things.
---
 pkgs/development/interpreters/python/wrap.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 01b573e6ad5d..394ea5337d05 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -67,7 +67,7 @@ wrapPythonProgramsIn() {
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
                                     --prefix PATH ':' "$program_PATH"
-                                    --set PYTHONNOUSERSITE "true"
+                                    --add-flags '-s'
                                     )
 
                     # Add any additional arguments provided by makeWrapperArgs

From bfccf8e42cb42a3876b4ed7c4514552f53e66d90 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sat, 23 Dec 2017 15:13:29 +0100
Subject: [PATCH 02/63] cacert: add hook that sets SSL_CERT_FILE

Fixes #32981
---
 pkgs/data/misc/cacert/default.nix   | 2 ++
 pkgs/data/misc/cacert/setup-hook.sh | 6 ++++++
 2 files changed, 8 insertions(+)
 create mode 100644 pkgs/data/misc/cacert/setup-hook.sh

diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 275ae6dc2d86..91af84c42245 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation rec {
     cp -v ca-bundle.crt $out/etc/ssl/certs
   '';
 
+  setupHook = ./setup-hook.sh;
+
   meta = {
     homepage = https://curl.haxx.se/docs/caextract.html;
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
new file mode 100644
index 000000000000..ff68bf0e1808
--- /dev/null
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -0,0 +1,6 @@
+cacertHook() {
+    export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+}
+
+envHooks+=(cacertHook)
+crossEnvHooks+=(cacertHook)

From 091c2b9f04189301f18ff0bc8336541d137f1d61 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Wed, 27 Dec 2017 21:26:36 +0100
Subject: [PATCH 03/63] cacert: cleanup exporting SSL_CERT_FILE

---
 pkgs/build-support/fetchbower/default.nix                   | 3 +--
 pkgs/build-support/fetchdarcs/default.nix                   | 3 +--
 pkgs/build-support/fetchgx/default.nix                      | 4 +---
 pkgs/build-support/rust/default.nix                         | 3 +--
 pkgs/build-support/rust/fetchcargo.nix                      | 1 -
 pkgs/development/compilers/go/1.7.nix                       | 4 +---
 pkgs/development/compilers/go/1.8.nix                       | 4 +---
 pkgs/development/compilers/go/1.9.nix                       | 4 +---
 pkgs/development/compilers/rust/cargo.nix                   | 4 +---
 pkgs/development/r-modules/default.nix                      | 6 ++----
 .../linux/firmware/firmware-linux-nonfree/default.nix       | 3 +--
 11 files changed, 11 insertions(+), 28 deletions(-)

diff --git a/pkgs/build-support/fetchbower/default.nix b/pkgs/build-support/fetchbower/default.nix
index 3e1f0eff84af..ba1c8420e91c 100644
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@@ -11,7 +11,6 @@ let
 
   fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
     name = "${cleanName name}-${bowerVersion version}";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
     buildCommand = ''
       fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
       # In some cases, the result of fetchBower is different depending
@@ -23,7 +22,7 @@ let
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     inherit outputHash;
-    buildInputs = [ bower2nix ];
+    buildInputs = [ cacert bower2nix ];
   };
 
 in fetchbower
diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 2df1b136c559..48d87cc5d108 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -7,9 +7,8 @@ if md5 != "" then
 else
 stdenv.mkDerivation {
   name = "fetchdarcs";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   builder = ./builder.sh;
-  buildInputs = [darcs];
+  buildInputs = [cacert darcs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchgx/default.nix b/pkgs/build-support/fetchgx/default.nix
index ea91a0854d16..65061ce0f63e 100644
--- a/pkgs/build-support/fetchgx/default.nix
+++ b/pkgs/build-support/fetchgx/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   name = "${name}-gxdeps";
   inherit src;
 
-  buildInputs = [ go gx gx-go ];
+  buildInputs = [ cacert go gx gx-go ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -14,8 +14,6 @@ stdenv.mkDerivation {
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   buildPhase = ''
     export GOPATH=$(pwd)/vendor
     mkdir -p vendor
diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 57948c33bbc3..d720532e1479 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation (args // {
 
   patchRegistryDeps = ./patch-registry-deps;
 
-  buildInputs = [ git rust.cargo rust.rustc ] ++ buildInputs;
+  buildInputs = [ cacert git rust.cargo rust.rustc ] ++ buildInputs;
 
   configurePhase = args.configurePhase or ''
     runHook preConfigure
@@ -60,7 +60,6 @@ in stdenv.mkDerivation (args // {
     unset cargoDepsCopy
 
     export RUST_LOG=${logLevel}
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
   '' + (args.postUnpack or "");
 
   buildPhase = with builtins; args.buildPhase or ''
diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index 9b3ba5303398..8c136d864883 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation {
         exit 1
     fi
 
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
 
     cargo vendor
diff --git a/pkgs/development/compilers/go/1.7.nix b/pkgs/development/compilers/go/1.7.nix
index b1230da5a142..82ed9b53c60f 100644
--- a/pkgs/development/compilers/go/1.7.nix
+++ b/pkgs/development/compilers/go/1.7.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch ];
-  buildInputs = [ pcre ];
+  buildInputs = [ cacert pcre ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
@@ -116,8 +116,6 @@ stdenv.mkDerivation rec {
       })
     ];
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.8.nix b/pkgs/development/compilers/go/1.8.nix
index 210f259df89a..050a2f3c865e 100644
--- a/pkgs/development/compilers/go/1.8.nix
+++ b/pkgs/development/compilers/go/1.8.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -122,8 +122,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.9.nix b/pkgs/development/compilers/go/1.9.nix
index 8708bd762c4d..8b8481c2656a 100644
--- a/pkgs/development/compilers/go/1.9.nix
+++ b/pkgs/development/compilers/go/1.9.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -128,8 +128,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index fb3001bbf17b..386ffa622944 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   passthru.rustc = rustc;
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ file curl python openssl cmake zlib makeWrapper libgit2 ]
+  buildInputs = [ cacert file curl python openssl cmake zlib makeWrapper libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv ];
 
   LIBGIT2_SYS_USE_PKG_CONFIG=1;
@@ -48,8 +48,6 @@ rustPlatform.buildRustPackage rec {
   '';
 
   checkPhase = ''
-    # Export SSL_CERT_FILE as without it one test fails with SSL verification error
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     # Disable cross compilation tests
     export CFG_DISABLE_CROSS_TESTS=1
     cargo test
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 76c0e5227773..de800f701e37 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -3,7 +3,7 @@
 { R, pkgs, overrides }:
 
 let
-  inherit (pkgs) fetchurl stdenv lib;
+  inherit (pkgs) cacert fetchurl stdenv lib;
 
   buildRPackage = pkgs.callPackage ./generic-builder.nix {
     inherit R;
@@ -912,9 +912,7 @@ let
     });
 
     geojsonio = old.geojsonio.overrideDerivation (attrs: {
-      preConfigure = ''
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        '';
+      buildInputs = [ cacert ] ++ attrs.buildInputs;
     });
 
     rstan = old.rstan.overrideDerivation (attrs: {
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 0044a3f6f4ab..3bd03d7b40ca 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
     # traffic, so don't do that.
     preferLocalBuild = true;
 
-    buildInputs = [ git gnupg ];
-    NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    buildInputs = [ cacert git gnupg ];
   } ''
     git init src && (
       cd src

From d672a9a5cd754cadcf9c2b39328f029bc22a8691 Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Sat, 30 Dec 2017 14:28:40 +0100
Subject: [PATCH 04/63] apparmor: 2.10 -> 2.12.0

---
 pkgs/os-specific/linux/apparmor/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index b576ca71d580..b026e91cc0bf 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -9,8 +9,10 @@
 }:
 
 let
-  apparmor-series = "2.10";
-  apparmor-version = apparmor-series;
+
+  apparmor-series = "2.12";
+  apparmor-patchver = "0";
+  apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
     homepage = http://apparmor.net/;
@@ -21,8 +23,8 @@ let
   };
 
   apparmor-sources = fetchurl {
-    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "1x06qmmbha9krx7880pxj2k3l8fxy3nm945xjjv735m2ax1243jd";
+    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-series}.tar.gz";
+    sha256 = "0mm0mcp0w18si9wl15drndysm7v27az2942p1xjd197shg80qawa";
   };
 
   prePatchCommon = ''
@@ -96,7 +98,7 @@ let
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${pythonPackages.python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-exec aa-notify ; do
+      for prog in aa-notify ; do
         wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
       done
     '';

From 812f7714e26a2fdd1446b21e43642c4c023045df Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 31 Dec 2017 11:07:57 +0100
Subject: [PATCH 05/63] clang: move libclang to separate lib output

Currently clang-unwrapped can't be used as a buildInput without also
shadowing clang/clang++ of a clang based stdenv.
---
 pkgs/development/compilers/llvm/3.8/clang/default.nix | 6 ++++--
 pkgs/development/compilers/llvm/3.8/default.nix       | 2 ++
 pkgs/development/compilers/llvm/3.9/clang/default.nix | 6 ++++--
 pkgs/development/compilers/llvm/3.9/default.nix       | 2 ++
 pkgs/development/compilers/llvm/4/clang/default.nix   | 7 ++++---
 pkgs/development/compilers/llvm/4/default.nix         | 1 +
 pkgs/development/compilers/llvm/5/clang/default.nix   | 7 ++++---
 pkgs/development/compilers/llvm/5/default.nix         | 1 +
 8 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/compilers/llvm/3.8/clang/default.nix b/pkgs/development/compilers/llvm/3.8/clang/default.nix
index 90b8ea2581e8..388c24e63364 100644
--- a/pkgs/development/compilers/llvm/3.8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/clang/default.nix
@@ -29,7 +29,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -38,6 +38,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -51,7 +54,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.8/default.nix b/pkgs/development/compilers/llvm/3.8/default.nix
index bd79db012a63..2f3d59434bba 100644
--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/3.9/clang/default.nix b/pkgs/development/compilers/llvm/3.9/clang/default.nix
index ec2ec27df363..f215aadc4d98 100644
--- a/pkgs/development/compilers/llvm/3.9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/clang/default.nix
@@ -31,7 +31,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -40,6 +40,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -53,7 +56,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.9/default.nix b/pkgs/development/compilers/llvm/3.9/default.nix
index 5ce51bc9c122..b17d86b57517 100644
--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index 8d40ee3c8aa2..404b65c56ab7 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -49,7 +49,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -59,13 +59,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -79,7 +81,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index fa61a6c22e71..5a54468f6553 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index fa8502ebd67a..a63b8b9cdf2a 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -50,7 +50,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -60,13 +60,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -80,7 +82,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index 9891f3090ac1..2c26fb4ac358 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 

From b0c043d26c7ecebe737c7a03d87a732f1285d993 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Tue, 2 Jan 2018 00:52:22 +0100
Subject: [PATCH 06/63] stdenv: allow lib output of clang on darwin

---
 pkgs/stdenv/darwin/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index d202186c29b2..cba988b8cc76 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -365,7 +365,7 @@ in rec {
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
       bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped patch pcre.out gettext
+      gnugrep llvmPackages.clang-unwrapped llvmPackages.clang-unwrapped.lib patch pcre.out gettext
       binutils-raw.bintools binutils binutils.bintools
       cc.expand-response-params
     ]) ++ (with pkgs.darwin; [

From 48aca230ce09c744fa61b985c1d0fc3064f92f23 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 3 Jan 2018 13:37:08 -0600
Subject: [PATCH 07/63] Use ncurses6 on all platforms

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eb1ed030f79a..60f9f8ba4d84 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10189,7 +10189,7 @@ with pkgs;
 
   ncurses5 = callPackage ../development/libraries/ncurses { abiVersion = "5"; };
   ncurses6 = callPackage ../development/libraries/ncurses { abiVersion = "6"; };
-  ncurses = if stdenv.isDarwin then ncurses5 else ncurses6;
+  ncurses = ncurses6;
 
   neardal = callPackage ../development/libraries/neardal { };
 

From d51897e439b23fc656e40dfef602df26f24db17e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
Date: Wed, 3 Jan 2018 18:19:59 -0200
Subject: [PATCH 08/63] glib: fix pre phases

*Phases are strings, not arrays.
---
 pkgs/development/libraries/glib/setup-hook.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index 98341376fdf6..233845c6541f 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -11,7 +11,7 @@ addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 glibPreInstallPhase() {
   installFlagsArray+=("gsettingsschemadir=${!outputLib}/share/gsettings-schemas/$name/glib-2.0/schemas/")
 }
-preInstallPhases+=(glibPreInstallPhase)
+preInstallPhases+=" glibPreInstallPhase"
 
 glibPreFixupPhase() {
     # Move gschemas in case the install flag didn't help
@@ -22,5 +22,4 @@ glibPreFixupPhase() {
 
     addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name"
 }
-preFixupPhases+=(glibPreFixupPhase)
-
+preFixupPhases+=" glibPreFixupPhase"

From edd5be9effd3e444bc21d1a79de3e29bd19a4448 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 2 Jan 2018 05:50:50 +0100
Subject: [PATCH 09/63] meson: set checkPhase in setup hook

---
 .../tools/build-managers/meson/setup-hook.sh         | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 25e2e69ef315..8f96e6146be0 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -25,3 +25,15 @@ if [ -z "$dontUseMesonConfigure" -a -z "$configurePhase" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
+
+mesonCheckPhase() {
+    runHook preCheck
+
+    meson test
+
+    runHook postCheck
+}
+
+if [ -z "$dontUseMesonCheck" -a -z "$checkPhase" ]; then
+    checkPhase=mesonCheckPhase
+fi

From d75f95d2a25567948d98a6bd8da69c68a5c06d3f Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 2 Jan 2018 06:08:51 +0100
Subject: [PATCH 10/63] packages using meson: remove unnecessary checkPhase

---
 pkgs/applications/video/gnome-mpv/default.nix            | 1 -
 pkgs/desktops/gnome-3/apps/bijiben/default.nix           | 1 -
 pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix      | 2 --
 pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix  | 2 --
 pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix | 2 --
 pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix  | 3 ---
 pkgs/desktops/gnome-3/core/libgepub/default.nix          | 2 --
 pkgs/desktops/gnome-3/core/simple-scan/default.nix       | 2 --
 pkgs/desktops/gnome-3/core/totem/default.nix             | 2 --
 pkgs/development/libraries/json-glib/default.nix         | 2 --
 pkgs/development/libraries/libinput/default.nix          | 2 --
 11 files changed, 21 deletions(-)

diff --git a/pkgs/applications/video/gnome-mpv/default.nix b/pkgs/applications/video/gnome-mpv/default.nix
index 2f073d1731dc..b60d405d5b99 100644
--- a/pkgs/applications/video/gnome-mpv/default.nix
+++ b/pkgs/applications/video/gnome-mpv/default.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
-  checkPhase = "meson test";
 
   meta = with stdenv.lib; {
     description = "Simple GTK+ frontend for the mpv video player";
diff --git a/pkgs/desktops/gnome-3/apps/bijiben/default.nix b/pkgs/desktops/gnome-3/apps/bijiben/default.nix
index ddff55c96a09..ca266d73fd35 100644
--- a/pkgs/desktops/gnome-3/apps/bijiben/default.nix
+++ b/pkgs/desktops/gnome-3/apps/bijiben/default.nix
@@ -8,7 +8,6 @@ stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
   doCheck = true;
-  checkPhase = "meson test";
 
   patches = [
     ./no-update-icon-cache.patch
diff --git a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
index df8c6befc603..5441f1e5edc9 100644
--- a/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
 
   prePatch = "patchShebangs build-aux/";
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Clocks;
     description = "Clock application designed for GNOME 3";
diff --git a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
index 72d1602eee45..6cfdd45c2f9c 100644
--- a/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix
@@ -14,8 +14,6 @@ stdenv.mkDerivation rec {
                         desktop_file_utils appstream-glib libxslt docbook_xsl docbook_xml_dtd_43];
   buildInputs = [ gtk glib gnome3.gsettings_desktop_schemas ];
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Dictionary;
     description = "Dictionary is the GNOME application to look up definitions";
diff --git a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
index cdf119d83a3c..dade56158fb1 100644
--- a/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix
@@ -7,8 +7,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gettext wrapGAppsHook libxml2 ];
   buildInputs = [ gtk3 glib gnome3.gnome_desktop gnome3.defaultIconTheme ];
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 69a967d6d247..5986b07229f5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -7,9 +7,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
-
   postPatch = ''
     chmod +x build-aux/postinstall.py # patchShebangs requires executable file
     patchShebangs build-aux/postinstall.py
diff --git a/pkgs/desktops/gnome-3/core/libgepub/default.nix b/pkgs/desktops/gnome-3/core/libgepub/default.nix
index f1e13e10fd9e..10d676d11d63 100644
--- a/pkgs/desktops/gnome-3/core/libgepub/default.nix
+++ b/pkgs/desktops/gnome-3/core/libgepub/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gobjectIntrospection ];
   buildInputs = [ glib webkitgtk libsoup libxml2 libarchive ];
 
diff --git a/pkgs/desktops/gnome-3/core/simple-scan/default.nix b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
index a30467c1862d..4a3420ea5f5b 100644
--- a/pkgs/desktops/gnome-3/core/simple-scan/default.nix
+++ b/pkgs/desktops/gnome-3/core/simple-scan/default.nix
@@ -39,8 +39,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     description = "Simple scanning utility";
     longDescription = ''
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index 651b7cff226d..c26b9b45dfdf 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ gobjectIntrospection python3Packages.pylint python3Packages.pygobject2 ];
 
-  checkPhase = "meson test";
-
   patches = [
     (fetchurl {
       name = "remove-pycompile.patch";
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 2414931e76aa..73fa1f311bff 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = http://live.gnome.org/JsonGlib;
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index db4c0c7738de..a0f7807786ea 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
 
   doCheck = testsSupport;
 
-  checkPhase = "meson test";
-
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
     homepage    = http://www.freedesktop.org/wiki/Software/libinput;

From 95ecb1f203075bb0e0bfe7d38232ffafa74fc093 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sbrofeldt@gmail.com>
Date: Sat, 6 Jan 2018 14:32:30 +0100
Subject: [PATCH 11/63] gettext: Don't use envHooks anymore

---
 pkgs/development/libraries/gettext/gettext-setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index fe3ef1f9e15d..5932ef6a44f9 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -4,4 +4,4 @@ gettextDataDirsHook() {
     fi
 }
 
-envHooks+=(gettextDataDirsHook)
+addEnvHooks "$hostOffset" gettextDataDirsHook

From 63ba455e539ae6392702a14eebf30ffee829da0e Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Thu, 4 Jan 2018 16:48:29 +0100
Subject: [PATCH 12/63] bluez: 5.47 -> 5.48

---
 pkgs/os-specific/linux/bluez/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index e9a1f314abc1..6871f1fa8e10 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -5,11 +5,11 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.47";
+  name = "bluez-5.48";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1j22hfjz0fp4pgclgz9mfcwjbr4wqgah3gd2qhfg4r6msmybyxfg";
+    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
   };
 
   pythonPath = with pythonPackages;

From 6e2cb1dd8c3732e1c78fd39563c827c298359341 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Thu, 4 Jan 2018 16:48:46 +0100
Subject: [PATCH 13/63] bluez: use `dbus-python` for the python bindings.
 `dbus` does not provide any

---
 pkgs/os-specific/linux/bluez/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 6871f1fa8e10..62c3986569d0 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
+    [ dbus-python pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs = [
     pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython

From 2b230efb7f45a5035186b233952aea11a90af7d9 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 3 Jan 2018 17:26:59 -0600
Subject: [PATCH 14/63] sharutils: don't hardcode AR to 'ar' (doesn't exist on
 cross)

Instead, let the default value of $AR indicate what should be used.

(which will be something like `armv6l-unknown-linux-gnueabihf-ar`)
---
 pkgs/tools/archivers/sharutils/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 9f161ac7525a..022814689428 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
     in ''
       substituteInPlace tests/shar-1 --replace '${shar_sub}' '${shar_sub} -s submitter'
       substituteInPlace tests/shar-2 --replace '${shar_sub}' '${shar_sub} -s submitter'
+
+      substituteInPlace intl/Makefile.in --replace "AR = ar" ""
     '';
 
   doCheck = true;

From 497cde8fd7a60e44454b80b7d23c9b05bf6dfc1c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:06 +0100
Subject: [PATCH 15/63] python: aniso8601: 1.3.0 -> 2.0.0

---
 pkgs/development/python-modules/aniso8601/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aniso8601/default.nix b/pkgs/development/python-modules/aniso8601/default.nix
index 6e61e84a5d53..ba60922856ef 100644
--- a/pkgs/development/python-modules/aniso8601/default.nix
+++ b/pkgs/development/python-modules/aniso8601/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.3.0";
+  version = "2.0.0";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
@@ -16,6 +16,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3b5246f5601b6ae5671911bc4ee5b3e3fe94752e8afab5ce074d8b1232952f1";
+    sha256 = "085786415d3550e89785ffbedaa9bb37d41de0707a1268bdbba11249064b71d1";
   };
 }

From c15e8f09e93e10d7fb8eb9ec8d7feeb55b962793 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:11 +0100
Subject: [PATCH 16/63] python: argon2_cffi: 16.3.0 -> 18.1.0

---
 pkgs/development/python-modules/argon2_cffi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/argon2_cffi/default.nix b/pkgs/development/python-modules/argon2_cffi/default.nix
index 80985f868c7a..f46efd9f496e 100644
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "16.3.0";
+  version = "18.1.0";
   name    = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ap3il3j1pjyprrhpfyhc21izpmhzhfb5s69vlzc65zvd1nj99cr";
+    sha256 = "7e4b75611b73f53012117ad21cdde7a17b32d1e99ff6799f22d827eb83a2a59b";
   };
 
   propagatedBuildInputs = [ cffi six ];

From 9f6387de4cf960c74cb635893449b96377d8f856 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:15 +0100
Subject: [PATCH 17/63] python: backports.lzma: 0.0.8 -> 0.0.9

---
 pkgs/development/python-modules/backports_lzma/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports_lzma/default.nix b/pkgs/development/python-modules/backports_lzma/default.nix
index 9b622eb6b065..6f7a45a4fe88 100644
--- a/pkgs/development/python-modules/backports_lzma/default.nix
+++ b/pkgs/development/python-modules/backports_lzma/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "backports.lzma";
-  version = "0.0.8";
+  version = "0.0.9";
 
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "200584ad5079d8ca6b1bfe14890c7be58666ab0128d8ca26cfb2669b476085f3";
+    sha256 = "9ba5d94214a79900ee297a594b8e154cd8e4a54d26eb06243c0e2f3ad5286539";
   };
 
   buildInputs = [ lzma ];

From 2eaa6c4ca8cb0b58d7f0e326030ea7a7d6aaad6d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:19 +0100
Subject: [PATCH 18/63] python: botocore: 1.8.21 -> 1.8.23

---
 pkgs/development/python-modules/botocore/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index f8dd16499491..5ecaacb9d207 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "botocore";
-  version = "1.8.21";
+  version = "1.8.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e4513a02f68e7efd7494ee56db201d87620218ca879aae361abbb71bcde3aa5f";
+    sha256 = "cc5df29da7c3f523edfc6086e082204b80945b5c73bf82a181018b7f1a5d6975";
   };
 
   propagatedBuildInputs = [

From 8cc70cac8be3a96f78a80a39c537272052a23f3e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:24 +0100
Subject: [PATCH 19/63] python: daphne: 1.3.0 -> 1.4.2

---
 pkgs/development/python-modules/daphne/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index c90fb61ce03a..f819a234146b 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -4,11 +4,11 @@
 buildPythonPackage rec {
   pname = "daphne";
   name = "${pname}-${version}";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xmmjp21m1w88ljsgnkf6cbzw5nxamh9cfmfgzxffpn4cdmvn96i";
+    sha256 = "302725f223853b05688f28c361e050f8db9568b1ce27340c76272c26b49e6d72";
   };
 
   buildInputs = [ hypothesis ];

From 721eed9b34999abbe3483d6a186d60c852d86ee5 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:28 +0100
Subject: [PATCH 20/63] python: dyn: 1.8.0 -> 1.8.1

---
 pkgs/development/python-modules/dyn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dyn/default.nix b/pkgs/development/python-modules/dyn/default.nix
index 881f51b69aa0..efb9cab8048d 100644
--- a/pkgs/development/python-modules/dyn/default.nix
+++ b/pkgs/development/python-modules/dyn/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "dyn";
-  version = "1.8.0";
+  version = "1.8.1";
   name  = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ab3cd9a1478674cf2d2aa6740fb0ddf77daaa9ab3e35e5d2bc92f60301f8523";
+    sha256 = "e112149d48b4500c18b3cfb6e0e6e780bb5aa0e56ff87cac412280200b9ec8bf";
   };
 
   buildInputs = [ glibcLocales ];

From fe0b84df8256f78215eb5e4f075556ee8753e045 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:33 +0100
Subject: [PATCH 21/63] python: filelock: 2.0.14 -> 3.0.0

---
 pkgs/development/python-modules/filelock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index a22e1581b68d..5d617ba9369b 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "2.0.14";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ee355eb66e4c2e5d95689e1253515aad5b3177c274abdd00a57d5ab1aa6d071a";
+    sha256 = "b3ad481724adfb2280773edd95ce501e497e88fa4489c6e41e637ab3fd9a456c";
   };
 
   meta = with stdenv.lib; {

From 35fa14484ed4e1901ad321540042c255bb3602d0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:37 +0100
Subject: [PATCH 22/63] python: grpcio: 1.8.2 -> 1.8.3

---
 pkgs/development/python-modules/grpcio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index eeb51fb58434..3fe7dc751c86 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ea1336f0d1158c4e00e96a94df84b75f6bbff9816abb6cc68cbdc9442a9ac55";
+    sha256 = "6ce5fd3093ddc09a152981d5c477ac645eda19dfcc819e45d8c57da6b743bd53";
   };
 
   propagatedBuildInputs = [ six protobuf ]

From 881d6a9e646e41adc1d7a8a72b39afa53bdaeb3c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:42 +0100
Subject: [PATCH 23/63] python: jupyter_client: 5.2.0 -> 5.2.1

---
 .../python-modules/jupyter_client/default.nix       |  8 ++------
 .../jupyter_client/wheel_workaround.patch           | 13 -------------
 2 files changed, 2 insertions(+), 19 deletions(-)
 delete mode 100644 pkgs/development/python-modules/jupyter_client/wheel_workaround.patch

diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index e88b7f937a55..42d7752eda3b 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca30cf1786047925ebacd6f6faa3a993efaa004b584f7d83bc8b807f7cd3f6bb";
+    sha256 = "462790d46b244f0a631ea5e3cd5cdbad6874d5d24cc0ff512deb7c16cdf8653d";
   };
 
   checkInputs = [ ipykernel ipython mock pytest ];
@@ -29,10 +29,6 @@ buildPythonPackage rec {
     py.test
   '';
 
-  patches = [
-    ./wheel_workaround.patch
-  ];
-
   # Circular dependency with ipykernel
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch b/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
deleted file mode 100644
index 926fcb26448b..000000000000
--- a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 95d4774..ee72cbc 100644
---- a/setup.py
-+++ b/setup.py
-@@ -86,7 +86,7 @@ setup_args = dict(
-     extras_require   = {
-         'test': ['ipykernel', 'ipython', 'mock'],
-         'test:python_version == "3.3"': ['pytest<3.3.0'],
--        'test:python_version >= "3.4" or python_version == "2.7"': ['pytest'],
-+        'test:(python_version >= "3.4" or python_version == "2.7")': ['pytest'],
-     },
-     cmdclass         = {
-         'bdist_egg': bdist_egg if 'bdist_egg' in sys.argv else bdist_egg_disabled,

From 6f10cfc7777def2dcbcd15dfd9e2789770945584 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Tue, 2 Jan 2018 20:18:41 +0100
Subject: [PATCH 24/63] cmake: fix INSTALL_NAME_DIR for darwin libraries

When there's a lib output libraries won't be intalled to $prefix causing
output cycles.
---
 pkgs/development/tools/build-managers/cmake/setup-hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index a92d54b3f144..a0f1cf00814c 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -43,7 +43,7 @@ cmakeConfigurePhase() {
     # libraries are in a system path or in the same directory as the
     # executable. This flag makes the shared library accessible from its
     # nix/store directory.
-    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=$prefix/lib $cmakeFlags"
+    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_INCLUDEDIR=${!outputDev}/include $cmakeFlags"
 

From dc2ae3aef603a33f83d6c560c39574df56ba8856 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 09:45:56 +0100
Subject: [PATCH 25/63] brotli: remove darwin cmake fix

---
 pkgs/tools/compression/brotli/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index f4fbb3685354..9a35013e3814 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -21,10 +21,6 @@ stdenv.mkDerivation rec {
   # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
   prePatch = "rm BUILD";
 
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    cmakeFlagsArray+=("-DCMAKE_INSTALL_NAME_DIR=$lib/lib")
-  '';
-
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
 

From 56b429c252429c42c20fb6c01cf05679f01aed86 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:52 +0100
Subject: [PATCH 26/63] python: Pillow: 4.3.0 -> 5.0.0

---
 .../python-modules/pillow/default.nix           | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 4be9c911f71a..034748255277 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -1,14 +1,17 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
-  nose, olefile,
-  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy
+, olefile
+, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, pytestrunner
+, pytest
+}:
 buildPythonPackage rec {
   pname = "Pillow";
-  version = "4.3.0";
+  version = "5.0.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a97c715d44efd5b4aa8d739b8fad88b93ed79f1b33fc2822d5802043f3b1b527";
+    sha256 = "12f29d6c23424f704c66b5b68c02fe0b571504459605cfe36ab8158359b0e1bb";
   };
 
   doCheck = !stdenv.isDarwin && !isPyPy;
@@ -21,8 +24,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ olefile ];
 
+  checkInputs = [ pytest pytestrunner ];
+
   buildInputs = [
-    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
     ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
 
   # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.

From 792b448b9b6aa4f36251360c491ba045629c6a7c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:00:57 +0100
Subject: [PATCH 27/63] python: psutil: 5.4.2 -> 5.4.3

---
 pkgs/development/python-modules/psutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index b9d07a3fa9b9..6221e08ae574 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.4.2";
+  version = "5.4.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00a1f9ff8d1e035fba7bfdd6977fa8ea7937afdb4477339e5df3dba78194fe11";
+    sha256 = "e2467e9312c2fa191687b89ff4bc2ad8843be4af6fb4dc95a7cc5f7d7a327b18";
   };
 
   # No tests in archive

From b6ea6d51c25cd076d1ad611d8b8e5b27ff3f00c8 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:01 +0100
Subject: [PATCH 28/63] python: pwntools: 3.10.0 -> 3.11.0

---
 pkgs/development/python-modules/pwntools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pwntools/default.nix b/pkgs/development/python-modules/pwntools/default.nix
index a186c3995488..b98930dfe594 100644
--- a/pkgs/development/python-modules/pwntools/default.nix
+++ b/pkgs/development/python-modules/pwntools/default.nix
@@ -5,13 +5,13 @@
 , requests, tox, pandoc, unicorn, intervaltree }:
 
 buildPythonPackage rec {
-  version = "3.10.0";
+  version = "3.11.0";
   pname = "pwntools";
   name = pname + "-" + version;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1l8hb30mwxqd1y7r5ihd7kzmjm2mz6m5aiphd3hwzmxkmxbxj8zk";
+    sha256 = "609b3f0ba47c975f4dbedd3da2af4c5ca1b3a2aa13fb99240531b6a68edb87be";
   };
 
   propagatedBuildInputs = [ Mako packaging pysocks pygments ROPGadget capstone paramiko pip psutil pyelftools pypandoc pyserial dateutil requests tox pandoc unicorn intervaltree ];

From 13c5dc200a56858b01fc39febe358871bfa57928 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:06 +0100
Subject: [PATCH 29/63] python: pytest: 3.3.1 -> 3.3.2

---
 pkgs/development/python-modules/pytest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index d45fe7deb124..91e22baa4ad1 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -2,7 +2,7 @@
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k
 }:
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "3.3.2";
   pname = "pytest";
 
   preCheck = ''
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf8436dc59d8695346fcd3ab296de46425ecab00d64096cebe79fb51ecb2eb93";
+    sha256 = "53548280ede7818f4dc2ad96608b9f08ae2cc2ca3874f2ceb6f97e3583f25bc4";
   };
 
   checkInputs = [ hypothesis ];

From 7b52360cb6594520645af0e46e04fc9ca645cff3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:11 +0100
Subject: [PATCH 30/63] python: python-stdnum: 1.7 -> 1.8.1

---
 pkgs/development/python-modules/python-stdnum/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index a78b1ffbee26..44a6b522a4ee 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchurl, buildPythonPackage, isPy3k }:
 
 buildPythonPackage rec {
-  version = "1.7";
+  version = "1.8.1";
   pname = "python-stdnum";
   name = "${pname}-${version}";
   # Failing tests and dependency issue on Py3k
   disabled = isPy3k;
   src = fetchurl {
     url = "mirror://pypi/p/python-stdnum/${name}.tar.gz";
-    sha256 = "987c25e1047e8742131bcf29dac7a406987adb1463465749e2daaba8cb19d264";
+    sha256 = "d7162fdb29337aebed65700cc7297016f6cd32cae4ad7aed8f7e7531f0217943";
   };
   meta = {
     homepage = http://arthurdejong.org/python-stdnum/;

From 4fbd01c5c1a76ece5d24b31b8b31b92769384fd9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:15 +0100
Subject: [PATCH 31/63] python: ropper: 1.11.2 -> 1.11.3

---
 pkgs/development/python-modules/ropper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ropper/default.nix b/pkgs/development/python-modules/ropper/default.nix
index 62ef3f8db19e..b35145872dd1 100644
--- a/pkgs/development/python-modules/ropper/default.nix
+++ b/pkgs/development/python-modules/ropper/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonApplication rec {
   pname = "ropper";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2183feedfe8b01a27301eee07383b481ece01b2319bdba3afebe33e19ca14aa3";
+    sha256 = "77d9b03083d0a098261a1d2856cd330ea3db520511a78472e421a00526aa220c";
   };
   # XXX tests rely on user-writeable /dev/shm to obtain process locks and return PermissionError otherwise
   # workaround: sudo chmod 777 /dev/shm

From 3726bbc26237f54657266786e78fa3ab83c9c3f6 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:20 +0100
Subject: [PATCH 32/63] python: setuptools: 38.2.5 -> 38.4.0

---
 pkgs/development/python-modules/setuptools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index b185be62a693..5535a80fd4a9 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,13 +8,13 @@
 # Should use buildPythonPackage here somehow
 stdenv.mkDerivation rec {
   pname = "setuptools";
-  version = "38.2.5";
+  version = "38.4.0";
   name = "${python.libPrefix}-${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b080f276cc868670540b2c03cee06cc14d2faf9da7bec0f15058d1b402c94507";
+    sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
   };
 
   buildInputs = [ python wrapPython unzip ];

From 671fdc2c8544b88497a9d7f85e2bc798fb757d0b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:24 +0100
Subject: [PATCH 33/63] python: sqlmap: 1.1.12 -> 1.2

---
 pkgs/development/python-modules/sqlmap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index e89abbd595a9..dd7fdc173e5e 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.1.12";
+  version = "1.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "86a1078ceb1e79f891633c7e4c7b07949fd9135a0e4c0738abd5111e2e6b96c0";
+    sha256 = "18ac6392a710f0cc106c28c4e27e43e8f1b25cb46fb8b6714836212607c07b10";
   };
 
   # No tests in archive

From 3a6f8b5f928bd6fc04ebf51fdcf9c61346bef320 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:29 +0100
Subject: [PATCH 34/63] python: texttable: 1.1.1 -> 1.2.1

---
 pkgs/development/python-modules/texttable/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/texttable/default.nix b/pkgs/development/python-modules/texttable/default.nix
index 38cffcee2963..fc97297c0106 100644
--- a/pkgs/development/python-modules/texttable/default.nix
+++ b/pkgs/development/python-modules/texttable/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "texttable";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "44674d1d470a9fc264c4d1eba44b74463ca0066d7b954453dd5a4f8057779c9c";
+    sha256 = "c89dc0148ae29645917aab7e970a30d1af565b3ca276cef8ab1a60469f0d8100";
   };
 
   meta = {

From deb4d8ec76ce0039641a8ef0fec22919f961f25c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:34 +0100
Subject: [PATCH 35/63] python: tornado: 4.5.2 -> 4.5.3

---
 pkgs/development/python-modules/tornado/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index bc39745945d9..db513d1c6140 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "4.5.2";
+  version = "4.5.3";
   name = "${pname}-${version}";
 
   propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
@@ -23,6 +23,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fb8e494cd46c674d86fac5885a3ff87b0e283937a47d74eb3c02a48c9e89ad0";
+    sha256 = "6d14e47eab0e15799cf3cdcc86b0b98279da68522caace2bd7ce644287685f0a";
   };
 }

From 75afdc028993d5094b08bba58ad15b7a2cceae84 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:43 +0100
Subject: [PATCH 36/63] python: typeguard: 2.1.3 -> 2.1.4

---
 pkgs/development/python-modules/typeguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index b441ad8052c0..0af8c47e35cb 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -9,11 +9,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "typeguard";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l3pih5ca469v7if255h5rqymirsw46bi6s7p885jxhq1gv6cfpk";
+    sha256 = "40b22d18d2215b76b3ddda2564acfbddfa6e702968637fbd969187c2a6fb99da";
   };
 
   buildInputs = [ setuptools_scm ];

From 57e9ed3719e5cef086a3463513e8805c761c3cf4 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:47 +0100
Subject: [PATCH 37/63] python: Unidecode: 0.04.21 -> 1.0.22

---
 pkgs/development/python-modules/unidecode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unidecode/default.nix b/pkgs/development/python-modules/unidecode/default.nix
index 9b81a28f085e..3cffe3804900 100644
--- a/pkgs/development/python-modules/unidecode/default.nix
+++ b/pkgs/development/python-modules/unidecode/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "Unidecode";
-  version = "0.04.21";
+  version = "1.0.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lfhp9c5xrbpjvbpr12ji52g1lx04404bzzdg6pvabhzisw6l2i8";
+    sha256 = "8c33dd588e0c9bc22a76eaa0c715a5434851f726131bd44a6c26471746efabf5";
   };
 
   LC_ALL="en_US.UTF-8";

From f3878bb4c30b928a9821bc4fa0593085bb359253 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:01:52 +0100
Subject: [PATCH 38/63] python: zeep: 2.4.0 -> 2.5.0

---
 pkgs/development/python-modules/zeep/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zeep/default.nix b/pkgs/development/python-modules/zeep/default.nix
index e00d6c7e24ba..64b2874ef627 100644
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -25,13 +25,13 @@
 
 let
   pname = "zeep";
-  version = "2.4.0";
+  version = "2.5.0";
 in buildPythonPackage {
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8631e2735c5f2219eb18ca4f0615ae482455628518508f69c3690dbfb8238aee";
+    sha256 = "4f9db52c7d269813fc6251da4cb050869158858aeea75a055b4550f19e52ac84";
   };
 
   propagatedBuildInputs = [

From 87340d32bb2a0abe45a23f801849bcd8aada7d13 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:06:35 +0100
Subject: [PATCH 39/63] python.pkgs.bootstrapped-pip update setuptools 38.2.5
 -> 38.4.0

---
 pkgs/development/python-modules/bootstrapped-pip/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 1a20639c2dea..88209ad3fd1b 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -9,9 +9,9 @@ let
   };
   setuptools_source = fetchPypi {
     pname = "setuptools";
-    version = "38.2.5";
+    version = "38.4.0";
     format = "wheel";
-    sha256 = "bcf0d4f3e2f7890e658db11e218b8643afffb905a0e2f2a7d5a6a3e949bb87e6";
+    sha256 = "155c2ec9fdcc00c3973d966b416e1cf3a1e7ce75f4c09fb760b23f94b935926e";
   };
 
   # TODO: Shouldn't be necessary anymore for pip > 9.0.1!

From a83fc51d486aa30f7d63222ecce5f672f2a7fe2a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:24:31 +0100
Subject: [PATCH 40/63] awscli: 1.14.17 -> 1.14.19

---
 pkgs/tools/admin/awscli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index b6c7270a4250..6ad9b7598e4d 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -26,12 +26,12 @@ let
 
 in buildPythonPackage rec {
   pname = "awscli";
-  version = "1.14.17";
+  version = "1.14.19";
   namePrefix = "";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "456499acc41ab67671062a08e218a22aa1a1ff64ae531e694163d0371e8a1dd0";
+    sha256 = "bcb01f4ecdde236a648b94efdd9ca57e59f67c592ba124ca1e45ddf834ce4f5b";
   };
 
   # No tests included

From c8aead477f46572a7e7d39109a28026aa12c0f7c Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 09:38:55 +0100
Subject: [PATCH 41/63] python.pkgs.datashape: 0.5.2 -> 0.5.4

---
 .../python-modules/datashape/default.nix      | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/datashape/default.nix b/pkgs/development/python-modules/datashape/default.nix
index 81ead8431695..9177e9f0ff48 100644
--- a/pkgs/development/python-modules/datashape/default.nix
+++ b/pkgs/development/python-modules/datashape/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
 , mock
 , numpy
@@ -8,14 +8,24 @@
 , dateutil
 }:
 
-buildPythonPackage rec {
-  pname = "datashape";
-  version = "0.5.2";
-  name = "${pname}-${version}";
+let
+  # Fetcher function looks similar to fetchPypi.
+  # Allows for easier overriding, without having to know
+  # how the source is actually fetched.
+  fetcher = {pname, version, sha256}: fetchFromGitHub {
+    owner = "blaze";
+    repo = pname;
+    rev = version;
+    inherit sha256;
+  };
 
-  src = fetchPypi {
+in buildPythonPackage rec {
+  pname = "datashape";
+  version = "0.5.4";
+
+  src = fetcher {
     inherit pname version;
-    sha256 = "2356ea690c3cf003c1468a243a9063144235de45b080b3652de4f3d44e57d783";
+    sha256 = "0rhlj2kjj1vx5m73wnc5518rd6cs1zsbgpsvzk893n516k69shcf";
   };
 
   checkInputs = [ pytest mock ];

From dceec247054bc565c66354f2a332142fdee186e8 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 10:02:48 +0100
Subject: [PATCH 42/63] python.pkgs.cytoolz: fix build

---
 pkgs/development/python-modules/cytoolz/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 83b1c893719d..9c5a2b2110ce 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -23,6 +23,12 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
   propagatedBuildInputs = [ toolz ];
 
+  # File as accidentally included in release
+  # See https://github.com/pytoolz/cytoolz/issues/116#issuecomment-355770073
+  postPatch = ''
+    rm cytoolz/tests/test_curried_doctests.py
+  '';
+
   # Disable failing test https://github.com/pytoolz/cytoolz/issues/97
   checkPhase = ''
     NOSE_EXCLUDE=test_curried_exceptions nosetests -v $out/${python.sitePackages}

From e527eb03734ba4aa9188fbce44dbd3c609729225 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sun, 7 Jan 2018 11:21:28 +0100
Subject: [PATCH 43/63] Revert "wrapPythonPrograms: do not propagate disabling
 user site-packages to child-processes"

This reverts commit 310203565c860f5c9f8074aee85871089a1f234e.

See https://github.com/NixOS/nixpkgs/commit/310203565c860f5c9f8074aee85871089a1f234e#commitcomment-26697890
---
 pkgs/development/interpreters/python/wrap.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 394ea5337d05..01b573e6ad5d 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -67,7 +67,7 @@ wrapPythonProgramsIn() {
                     # (see pkgs/build-support/setup-hooks/make-wrapper.sh)
                     local -a wrap_args=("$f"
                                     --prefix PATH ':' "$program_PATH"
-                                    --add-flags '-s'
+                                    --set PYTHONNOUSERSITE "true"
                                     )
 
                     # Add any additional arguments provided by makeWrapperArgs

From 11c4e8ae29d145e6cf4ebdebb7e06d5ef475a140 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sbrofeldt@gmail.com>
Date: Sun, 7 Jan 2018 15:17:53 +0100
Subject: [PATCH 44/63] Revert "gnome3.nautilus-sendto: fix build"

This reverts commit d3ad52a58eb3e4513f962eb059918579d6813a39.

In order to see if https://github.com/NixOS/nixpkgs/pull/33524 is
sufficient
---
 pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
index b185778fe860..2812e7673b40 100644
--- a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
+++ b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib
-, gettext, gobjectIntrospection
-}:
+{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib, gettext }:
 
 stdenv.mkDerivation rec {
   name = "nautilus-sendto-${version}";
@@ -12,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "164d7c6e8bae29c4579bcc67a7bf50d783662b1545b62f3008e7ea3c0410e04d";
   };
 
-  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext ];
   buildInputs = [ glib ];
 
   meta = with stdenv.lib; {

From 406e162884b4d836127f4739e51e8204be45319b Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:22:53 +0100
Subject: [PATCH 45/63] cacert: use addEnvHooks

---
 pkgs/data/misc/cacert/setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/data/misc/cacert/setup-hook.sh b/pkgs/data/misc/cacert/setup-hook.sh
index ff68bf0e1808..b704a6a919e0 100644
--- a/pkgs/data/misc/cacert/setup-hook.sh
+++ b/pkgs/data/misc/cacert/setup-hook.sh
@@ -2,5 +2,4 @@ cacertHook() {
     export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
 }
 
-envHooks+=(cacertHook)
-crossEnvHooks+=(cacertHook)
+addEnvHooks "$targetOffset" cacertHook

From 6c39c9cbfa583fd341954d25a40168c316252676 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:26:22 +0100
Subject: [PATCH 46/63] tzdata: use addEnvHooks

---
 pkgs/data/misc/tzdata/tzdata-setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/data/misc/tzdata/tzdata-setup-hook.sh b/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
index 9ae9b46d85c5..9975d0aec31a 100644
--- a/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
+++ b/pkgs/data/misc/tzdata/tzdata-setup-hook.sh
@@ -2,5 +2,4 @@ tzdataHook() {
     export TZDIR=@out@/share/zoneinfo
 }
 
-envHooks+=(tzdataHook)
-crossEnvHooks+=(tzdataHook)
+addEnvHooks "$targetOffset" tzdataHook

From d01cb0c1eaf363f126af2fffb73b4b7238983103 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:27:27 +0100
Subject: [PATCH 47/63] dleyna-core: use addEnvHooks

---
 pkgs/development/libraries/dleyna-core/setup-hook.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/dleyna-core/setup-hook.sh b/pkgs/development/libraries/dleyna-core/setup-hook.sh
index 046a77d5a4dd..87b5c67dff58 100644
--- a/pkgs/development/libraries/dleyna-core/setup-hook.sh
+++ b/pkgs/development/libraries/dleyna-core/setup-hook.sh
@@ -5,5 +5,4 @@ addDleynaConnectorPath () {
     fi
 }
 
-envHooks+=(addDleynaConnectorPath)
-
+addEnvHooks "$targetOffset" addDleynaConnectorPath

From bfb1db7a751879c83eabe823b767a71924a45bc5 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 7 Jan 2018 21:28:50 +0100
Subject: [PATCH 48/63] gnuradio: use addEnvHooks

---
 pkgs/applications/misc/gnuradio/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/misc/gnuradio/default.nix b/pkgs/applications/misc/gnuradio/default.nix
index 470e046e85e5..58d8e9fae618 100644
--- a/pkgs/applications/misc/gnuradio/default.nix
+++ b/pkgs/applications/misc/gnuradio/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     addGRCBlocksPath() {
       addToSearchPath GRC_BLOCKS_PATH $1/share/gnuradio/grc/blocks
     }
-    envHooks+=(addGRCBlocksPath)
+    addEnvHooks "$targetOffset" addGRCBlocksPath
   '';
 
   setupHook = [ grcSetupHook ];

From 03dca870abdffa3bf827a98f40e7baaa34dbcb43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Mon, 8 Jan 2018 17:36:11 +0100
Subject: [PATCH 49/63] Revert "gnome3.gnome-screenshot: fix build"

This reverts commit 2a1425d8b7504572dbceb69e851aa27f05b4fc34.
See https://github.com/NixOS/nixpkgs/issues/33458
---
 pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 4e0e6ecb997d..5986b07229f5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -1,6 +1,6 @@
 { stdenv, gettext, libxml2, fetchurl, pkgconfig, libcanberra_gtk3
 , bash, gtk3, glib, meson, ninja, wrapGAppsHook, appstream-glib
-, gnome3, librsvg, gdk_pixbuf, gobjectIntrospection }:
+, gnome3, librsvg, gdk_pixbuf }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
@@ -15,8 +15,7 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
   propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2
-                        wrapGAppsHook gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2 wrapGAppsHook ];
   buildInputs = [ bash gtk3 glib libcanberra_gtk3
                   gnome3.gsettings_desktop_schemas ];
 

From c2316114bcc6568bb186f8c4f49eb4e817fedec1 Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Tue, 9 Jan 2018 11:14:48 +0800
Subject: [PATCH 50/63] stdenv: Kill off ensureDir

---
 pkgs/development/interpreters/erlang/R16B02-basho.nix |  2 +-
 pkgs/servers/x11/xorg/overrides.nix                   |  2 +-
 pkgs/stdenv/generic/setup.sh                          | 10 ----------
 pkgs/tools/networking/bud/default.nix                 |  4 ++--
 4 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/R16B02-basho.nix b/pkgs/development/interpreters/erlang/R16B02-basho.nix
index 33c34f7fecc0..714924514edb 100644
--- a/pkgs/development/interpreters/erlang/R16B02-basho.nix
+++ b/pkgs/development/interpreters/erlang/R16B02-basho.nix
@@ -36,7 +36,7 @@ mkDerivation rec {
     tar xf "${manpages}" -C "$out/lib/erlang"
     for i in "$out"/lib/erlang/man/man[0-9]/*.[0-9]; do
       prefix="''${i%/*}"
-      ensureDir "$out/share/man/''${prefix##*/}"
+      mkdir -p "$out/share/man/''${prefix##*/}"
       ln -s "$i" "$out/share/man/''${prefix##*/}/''${i##*/}erl"
     done
   '';
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index ca1a773c4a28..f56d22d7b7ee 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -546,7 +546,7 @@ in
           "--with-sha1=CommonCrypto"
         ];
         preConfigure = ''
-          ensureDir $out/Applications
+          mkdir -p $out/Applications
           export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
           substituteInPlace hw/xquartz/pbproxy/Makefile.in --replace -F/System -F${args.apple_sdk.frameworks.ApplicationServices}
         '';
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index d2c67cce81a2..dbbe45e45f3f 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -188,16 +188,6 @@ addToSearchPath() {
     addToSearchPathWithCustomDelimiter "${PATH_DELIMITER}" "$@"
 }
 
-
-ensureDir() {
-    echo "warning: ‘ensureDir’ is deprecated; use ‘mkdir’ instead" >&2
-    local dir
-    for dir in "$@"; do
-        if ! [ -x "$dir" ]; then mkdir -p "$dir"; fi
-    done
-}
-
-
 # Add $1/lib* into rpaths.
 # The function is used in multiple-outputs.sh hook,
 # so it is defined here but tried after the hook.
diff --git a/pkgs/tools/networking/bud/default.nix b/pkgs/tools/networking/bud/default.nix
index 48ae772e1271..c0383b7c822f 100644
--- a/pkgs/tools/networking/bud/default.nix
+++ b/pkgs/tools/networking/bud/default.nix
@@ -14,14 +14,14 @@ stdenv.mkDerivation rec {
   buildInputs = [
     python gyp
   ] ++ lib.optional stdenv.isLinux utillinux;
- 
+
   buildPhase = ''
     python ./gyp_bud -f make
     make -C out
   '';
 
   installPhase = ''
-    ensureDir $out/bin
+    mkdir -p $out/bin
     cp out/Release/bud $out/bin
   '';
 

From 28a7865e05ac6e20f094757f484aa122cd9455db Mon Sep 17 00:00:00 2001
From: adisbladis <adis@blad.is>
Date: Thu, 11 Jan 2018 01:19:12 +0800
Subject: [PATCH 51/63] e2fsprogs: 1.43.7 -> 1.43.8

---
 pkgs/tools/filesystems/e2fsprogs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
index 22dc9e747233..e6a83e32632c 100644
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "e2fsprogs-1.43.7";
+  name = "e2fsprogs-1.43.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/e2fsprogs/${name}.tar.gz";
-    sha256 = "1i51w5l45zhz3i98k92xbbvkqklvjrvw3zvqky3gk9cdmqp5y0w7";
+    sha256 = "1pn33rap3lcjm3gx07pmgyhx4j634gja63phmi4g5dq8yj0z8ciz";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];

From e47fa2a92b352adedfb698a943981e23a0cf798f Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Thu, 11 Jan 2018 14:07:52 +0100
Subject: [PATCH 52/63] gdbm: 1.13 -> 1.14

See http://lists.gnu.org/archive/html/info-gnu/2018-01/msg00000.html
for release information
---
 pkgs/development/libraries/gdbm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 3b78225a447f..8d645bde7770 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.13";
+  name = "gdbm-1.14";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "0lx201q20dvc70f8a3c9s7s18z15inlxvbffph97ngvrgnyjq9cx";
+    sha256 = "02dakgrq93xwgln8qfv3vs5jyz5yvds5nyzkx6rhg9v585x478dd";
   };
 
   doCheck = stdenv.buildPlatform == stdenv.hostPlatform;

From efc17cbd2189b24163e89a28b8cd24f7bbd31045 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 13 Jan 2018 09:45:51 +0000
Subject: [PATCH 53/63] iana-etc: 20171106 -> 20180108

---
 pkgs/data/misc/iana-etc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index 249f0e5dcb91..6b1abad02d74 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iana-etc-${version}";
-  version = "20171106";
+  version = "20180108";
 
   src = fetchurl {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "0pbmq95gdkp66cljwklv4gzh8lvl30l4k77hfwvrxz5mfqia6qdd";
+    sha256 = "1x4jacrvjwcsan88rg2wf2a8bajsglg6w4396vbr18zh0sya84a2";
   };
 
   installPhase = ''

From c4e9e4a4d696bfe5225c9360a4a8616136cf9ec1 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 26 Dec 2017 18:03:12 -0600
Subject: [PATCH 54/63] boehm-gc, libatomic_ops: 7.6.0 -> 7.6.2

These should be the same version.
---
 pkgs/development/libraries/boehm-gc/default.nix  | 16 +++++++---------
 .../libraries/libatomic_ops/default.nix          |  4 ++--
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 421d7072397b..35ea5471dbeb 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -3,11 +3,15 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.6.0";
+  name = "boehm-gc-${version}";
+  version = "7.6.2";
 
   src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.6.0.tar.gz;
-    sha256 = "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1";
+    urls = [
+      "http://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
+      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
+    ];
+    sha256 = "07nli9hgdzc09qzw169sn7gchkrn5kqgyniv2rspcy1xaq2j04dx";
   };
 
   buildInputs = [ libatomic_ops ];
@@ -25,12 +29,6 @@ stdenv.mkDerivation rec {
   # Don't run the native `strip' when cross-compiling.
   dontStrip = hostPlatform != buildPlatform;
 
-  postInstall =
-    ''
-      mkdir -p $out/share/doc
-      mv $out/share/gc $out/share/doc/gc
-    '';
-
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index eedc0993d736..3aae754be405 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.0";
+  version = "7.6.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 ="03ylfr29g9zc0r6b6axz3i68alj5qmxgzknxwam3jlx0sz8hcb4f";
+    sha256 ="1rif2hjscq5mh639nsnjhb90c01gnmy1sbmj6x6hsn1xmpnj95r1";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isCygwin [ autoconf automake libtool ];

From 990ff97c6d82eb27486ec8dc3e9dbc453da88aa8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sun, 14 Jan 2018 20:39:49 +0100
Subject: [PATCH 55/63] glibc: 2.26-115 -> 2.26-131 to fix CVE-2018-1000001

/cc https://github.com/NixOS/nixpkgs/issues/33826#issuecomment-357436030
---
 .../libraries/glibc/2.26-115to131.diff.gz       | Bin 0 -> 20022 bytes
 pkgs/development/libraries/glibc/common.nix     |   7 +++++--
 2 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/glibc/2.26-115to131.diff.gz

diff --git a/pkgs/development/libraries/glibc/2.26-115to131.diff.gz b/pkgs/development/libraries/glibc/2.26-115to131.diff.gz
new file mode 100644
index 0000000000000000000000000000000000000000..3d866c567a790b088e2446bf2d4048710a19a9eb
GIT binary patch
literal 20022
zcmb2|=3oE;Cgwd+*~PcrHvP@H_E%8YQgrgO-<m;vu|X;~FX~2q>I&Kv=ibWN*x13r
zQt(mW=#D@4-@ly4$Pq9_Ieq&gekFtcdGqGg&B^O|Yt@%wmVd`(#@oX?U*11)`GMP+
zYv)C;Z-2U1g756RcMGfy($`)~(V6RcT(W1^qT4Tf*qXgI-_$v`{>tmGLcM=$FTOGR
zwdh{1&#t8U{Xy?bcRfy9e*4Y07K^AIo?C?WZ#lAZPjRhc-Iq7JYcG4-T=#z;?O5`8
zS<w0`^J{;-jDJ+Q-u%|wn8$BFOn<Bv%*g-a^`e(cJHj{W9^Ntc*SlJ2{qo#p7xzu<
z+`1)t+6t+*s&#KWw=a9%IWzNam&$=R(l1Y+*jlo`Kz8Dpr5tBd^ps{UnW&#@7|nT?
z_mSAy^5lo?6YlBo?J=3Cn|7G@mggLks~6OMb$Fe=C7fQQDI}@>bHn#%YfEDMyR=M?
zKX`Ru+tFz!RTy*1#f7rV)R_)HD^gr+eOdUwQSHl0wI^xMde_>AJhuCm@75^x$hdL;
ze^YTIvG#eAcfCG7ejk|hwe0&<|I=JzsgdQsuB#s0^(^B;+=*7x{;1$d%c|7&y=S^E
zc5rTwjD7^yoMed|bxO)-%yV!1-Z^l-?4bL7N&CMq<n1GcLMN@M$?595&c}1z{6L_9
ziko<jZ~om0d_pcBhaPDAE#Y*NeK<oe<Bq`UX_DSqR(96*cDr@vmP;IYw^y*`6942&
znqOXsT=J+|_eJr_3H}!>C5P?ozf|kStEG09?e<#4o#CHg_<!P)^t1LGIgjZ-VLFr|
zn{sUJ&MkSJcT@7zoZKS#OBU3v%-^^$(SKh@@aai~F-cqQS6VGzqj*1S!rsJ#3LBqf
z7~Ono>vcZ!cHCudpKZ1pRvHq5nkHox9@avB0-QTJCX2555cX^13{Ml!#LF{xiM=@D
zdF1!9JjM6Um-{`ZbA3L)&d=YtRM^timY-c>w{bqJ*U{osr)>+T8(v9h7FT?|=9bX0
zhMk`R>u#FP;9I+L<qK8M>t-`_XTJZT-%;_sYPJjS?dE;EJ015N$zHp#%-XNVV(!t-
z*#`_e4JIv=oarerQDx16X-vP{Kiy}YHgihl8>9aGy$VIX@qe^pEkrlG(D|8ZKgq15
z;H}QQjJYaTB|SxzR6n<9=`>yO=czxtQ|Rw9LHS9`doLUCEIKlw<kU@{PpJztb7x*Z
zyeIg3nBHBB_g9yNDuqAr@G$-qmTJk<YT^4(WBKP2#(3YP4<F>tU#=B;uJhr{wE5Hc
zR$EKN*~e;WX$0_O)RqQ`X<id_n%t1Mp}pfj+p+6?VfNR)89el`TJZiDTO{jmO^c;R
zzP5b1d2ted@q=Ysrv3fN<hI1A^k0<S>HV40ivy3&6Vu*v{flPpX|)V)jz>EeOu3aR
z5~+H<*44LmQN^__=1)Jr*{`>2IhS@ypyq?+i&uDrDfZcOiHWTH({iO$jOE__qh~@h
zW*5|#B{V9&Sovk`e-8of%l^LWdF8h-Z21(`xu@LqtBRPqL*t_$^Ubk)+E+Ji6If+o
z^{-XgJ#F)os_V-+FDdo&HLF*}1qx=*X#3!xP;Db==C;UA^1Jlzmd&lpZqH;Ww4Irk
zrZqQle|c}{HKud}mkg;6zKQ2JBLscR`HpL!+&XD`)0~r=gWj}$obS6_VPa(8ho%Q+
zypq+76-SaBH_ltoVX4fop;cz6YH9tiw9BWdu0-k5X12+3+tbgst-ZF+SnhP^n{w-?
zE-me=Wm@DtjSeR=AAa@4xH08ONL1#NL-C2ZFWPlQI=a4VF*syvG@n^yFV(rza|esy
zT^{EJYP%KFG&iI;eW+jPC#mx6f?k6`e(T0*GmlNm$o$Vf=@5&+&X1WjtJMTPczAL3
z{9)GG+LihH>!VjJOTHcH%x4W$S<901W83nlRUaQd_>|6MEgqi!Cxf*viHT>y@86%h
zCzq?IyYx(X_u$eDIr+F)nadwuUOhQ+Mqt<jr$1p6svbCS6=YA&6xt*(&$>Ir{^r`I
z^G*&48|Jy(&@*I~IhZ!(^X&Ab>PO43EbN%@=*Xv>1_wRmWig`DiaA1-2S+MjOy<#k
z8=-SIMb6>esfibkE!Z8oZ0UpPbBq3X*E;ALxL%r4{P`U3r4EnGhw~?u3mD`+agpYX
zSzRMge7X3|gErkylMaP3r0iR=H2tNoj!#&aK|%Y&BXTF4Sr<49Ngk2AIa^@<uElo~
zpGQ?}^G#%yoY)aG-+9k8*+w3@9oCY4>sm$E9%7ltWqIP}m&2@IPP9CzaPnDn`jYxB
z%`+>n`0xI+L?=|_jnK3cZK7u`?O0>J&3&g&Uc(u7o~(wS7yKm~Cu%Mb+?6Egb-Se~
zIw@1@=jO1@3m&nAIj{0jn9g?jVP@3ghg)~Z_s?3~cxy_r{Os~gu|M)JZsS<u#v*cp
zU29<$*Y4zw{#xD{6FWKVovYs*6Jpcef9I<QpVf{7TjTuJ+i5(%u6W;k-iFt|y_dUp
zf436eu)ghW=k|BDJTiV+ss=B@&RW^m^B;Zu#HqLW@fTT*6cOQH=TG!pOX1n;*vuxC
zHfhGS7@ZdxD=HqiOuAyJcF|~Q!Z+(JF2b*rlCRu+B<IIsnBsToKqNy}>eqIg&54UI
zDGSULTC31g_31_N<9m*qAGA$Y2v{)vTyvt-29r!rzBP|~x*4|>cWo|kI<4&fY|V-E
z4@)9nRTX^CdaH1xaaa9>f)n45ypx~QA%93#e?mz{k?oV78zDybh3zC}tmTkA@Koh<
zt4izQm;>j69No_`^PjsvDN$`oocw1_4&m4ciIwp_J-at#*?)+=VYdGLP2=^Jl7$DJ
zKF`a4b53lHfpC~a#oA*}>@Urz<3Gkczw`6YEd_@wOm>K!)=*HgXxP@ie3|SLkq6IW
z8V)3SS<mm8duPSX_uRACX5Oth=(G0MyDxv#AAfrC<wZou^@oWTx87beGTMFE$9s#>
zkxI8Ub9P*tUi!Cr^E0NMcOCOXF28c(Oc!(OnEKwozvuGg`FebMc2Y9A3azC@ohLSy
z=*~QQcWz9!e)QYx3zpYCyEOm7#m=@9J5MEZZTo32`mx(8<6`z#x7h&;=SZGE^<K)R
zXTh<#`>sk_G4TIAx$dfLe|4Co&6MYwB7u3zS0%r&_tu49d0Boz@vWwqxr=Cql92w-
zrH-MEA{VWVl2+_8eV%f+flK$u>FF2NUGbJm`5yCRVdh32Y0-}}{lZKm9%@%9MjJga
z%E;1*>pr*I%UF663){|#;aV)Z&trnuL@BmOhTLKB4g9N^?9sM$){l3ls~NH<1f0Hj
zKYWMl7bf*m({)?c1#J1`cXkzf`+*v+M^pY?dpvXd`jAAItIZLI+Fo2M+Vpn%qx)IL
z`Vs3-WKQA|<+kg1p?~`(%XPufj{a}I9&JCzz2f`k^D$3<b=N%kt&uBm_$A{bwXpey
z^WztLta;6F%q?Pt!zaHISwBY^3q#q)8@qOfO>WKKdp$jC@s`PNd_-9fwH&b9bl``u
zYlUZBUxNP9>`j+y)NV{yxH5U?;=lK2ey?ZXj^EO;^4Twj2#<hfsS`D7K|OL0o^pHf
zYkB{^Y}&H(a@PAjj{<9qZcWL`VkxaT=~5%1<Mc`T2<x>Sl}lu{M_Mk4nBXZ<F-Pgl
zt_9-jU4NapIjwxji<)yURz}2Ky|pxbioes=8qK*LVQ+d%JgwY1<|?~{hhBK>vF-A`
zm734K*yKJra$5SLsQn*?#@a>OmoX$URO{c;_jqzvO{#eBpKVJsE?vGBc>7Ye==U<V
zKl~A0M?7BjYfWs^&FElWQ5143Ozpn;qRl(6mH(U<lD*fDt9e;XxqsZ6ib?U2p0h6=
zzPeAtef9SfnfW};BHmi2KlFvz+!?kDI>_;;8S|Z5xk1M*(92=xj3oCp-}5AT*m|yf
zzZ1=w5%zS_tc9LeJFdRJV^M8ha-gx9seh|f`|`l`?ibRoyf@p$+~p^IH7D@ytEZ)p
zPh0dz&r*%Q^qoccWZbdkmkP8w!r$<})@eAsbwPLON2jfE)~UA^c2&-|y3Sg@bnS`^
zm#iDNem1XuCe1O)DgJA=;a0U-cWb77+uZl^Xpni`!Z+)D{MQ~0414PqP}Cu-BY3Se
z*CBDg^=0p+cFrlYg65mnC@tS1)%^6*Bi9h=V|&CBdiXNR%dfoPb*(L5q-DA&=A`=1
zbsrm^x0)`^TeC54Mr&SB>-1l-t>&_)W*-&kWpvx*@E|X2*7?}u)B0xot0^d~2{E{o
z+!yvJqe^mmPhh(x_rJeeEv!rp4p`Xix7wXz7vhs+cjazOai-i)&rOkM+dr)=lbYp|
z?CbET<r4?vyuKw`o2JU_IrpOb#%76cmOC`&O=hsDKKu3PNBebt8#4KxpQ(O!v$K;e
zcjGaopl<mU5v#AA>veE{^fl_W?bAXp*UT=)Ep@S-D@;mGU!OTg)7HydEN|J*n3Jw2
zUldB(O}G0{AUVg@YS)Y1eMZ+8c&SQT%zq@d$U5_A^bD>;HFa9WKW??YT(9+Lro!pP
zi6O$wSpiI14?jOT{x0&PuJ#+ty%*0&_PvQ*{j?-)o9Vm$^vy<Q`sad9?74BM>}sRs
z)t~lpKR2J)oL;^D=gOHuD;;fx7$WVzURnJ7NUQ(*N9H*_ckE4%u4Y~IRM&S=<7;=X
zE!^w7qb)>i#GmWs{XKB*x9oM!FWzws%ThMKR5_iPIq%n}H#2ss+2u&{8Z4f9zF?BY
z@3ZF4SLdlsao~J=(s}zGM}@V8vOnt={i+qcxcX#feem7rj5R4d?+@#rwU{!^d)NP{
znt0x{{q5&!d3QhV=0EXI?#0n<yM<omZ2uZk^LKC0YtETX8mh0J)UOS@|EB+!^73|{
z*;|(9p5DD}e$~CG;%!0dy01*EO2Si39_`lJF!9ebPsR1U&tt5YzB+yRa&)W_YYA`o
z#A;*z39qiLaI+W7*L>m2%+a-qFTeT9cFEV~D;VxPisU&}`T7U%S&fr-9`4?(U8v!=
zGiUbHRLicZRvBXL*CN(`@><grlCHeXyRO8o=hDs}W!4Xbv^-~a*=9VcTDNbafbOG5
zkCso$YJVhqcj3X4^&aVRwY!gh3BEqbZVq=)+k_}avz-kd#`3p6X)DGy<@r3&^Z&K`
zb(P-boPfNLR>MSbLGgJ^^8c>Kb85YGzj<c;spP%6)~g%OCbGYp#`^8d$M~zq=U&M+
zP+ax*e^t@X&p)p&wXpcDQD?hjhlR!NKR>j>87kF9b;}Rl=U&kuHPf!B$6@D-@5ja4
z?UT<P^jBZ5K3zUjIp1IJeBbimkKg_{$#n3ui%(Z?4`0qM{^;=4qwSwx8rHlDIpy=n
zYuoK5^StLwu&Ix0Jk55a-`KL|$jt1gstnDWw=bza&e0Zd*IZ6Jbo-`DH`;3A1=SjA
z0}eKJJ3l&JIjQAi-0r<GdeP=}UgEO1<|&D8zn?KBVx@g~?P>4CyY`=4r(gTyyHVFK
zr`%h5!tu1lzmDBcWBBWF{}<Q6Z*_lvd*nBrx%i;}d;izN$8QK8k+wB@WcPJp(>J&L
zg&Tv;Z%Pg24!SNakQNs>-);4>sY@&r$~HR1C~RNQA6#J9GUbql!k<eESUSF1?GIt;
zva9-$Geue>#)?TJLHnd|wbG58RpDj(e(f=-FJW906wY@^;m4Ws*Q;vu-z<H~Iz^uG
zrSYl#;kOm8OvzpT&FiK5{2i;Lu6|~^F=@l*zSE&i`*<6?<O(X!O!#8U^Gw21$2adq
zbxbScewp|=d;WGj?U>+awQc=z?WgjqS6Q!}>t^?7|AtwPu9bnQ&-RP(UH>}SD>gnb
z(CD<w*0+niLUr9H{NBAr{&{*z(At+hTED$MouBOe_*G8T*N2CH9)0?8;<HrUYNrlK
z$v3u)b!tcB=GT-yPu!66PD5|gOua`kzNNLvYfEbU7p@TKon&FsJl97me!IeJUrFnn
zz0T&hZ>?c;+MmsL+<5n8>8(-UQZ8(EE4m>+HSpQBms}<}Zy&W(ADKV>qw%AX-8B=e
zthJ^*m#EQSU@vm8%w(<4=G}9p#D6Tgd+TIYUr1nz>(zPEiYGr!_$8+Iw^QrTk(2h<
zU6r<`DTXic&;Q~#b%zjhm&w&HsfQk}Wynh_Y8PH?qkmqQ!%Ii!Y~}jJLDPCa-z*AG
z+O{=v{`mtF&uuW4ICpIAwF52Tay{vH4?g>uGjrbD^V9V9)!v!8BHwnh+xFSDZ*J~4
zUVQ$^o?OZLllh;H6*7F8l_Fo`GckB|N3D37VxQpK`?9O~j~IVl8J)h|NASE)uid(%
zOAJGtdxg7>%-NOZ>bYw5Gx>KG7TKR_VwVKnKlSMG8^tsC6(?mq5t{t^d%?Y_RT8JK
z@XfkuQCi+;|4ndG$n`+86-K<i{p&eGUU`XLdpUouXlJEn*Y8hqGZ!(%B+Xw}r&_Yy
z+5YyWh20K*uk!15oaEU%K{n4URa5E9!uK<hPiJjC*8H%-=0(J}9cyIxmuVfXxZvY;
z@xAFT=fLIj4PUY_w8&lWX?V23Q;YZSvVDgGIL}R=!o6B7y6TzNtyA-hyH}}7cic8m
zH@Uj9s%*YQ2#;B?e?M1K>%udA@n6dmzlq&p;5L!jW%qau&%Zo<)3rTYtJ^1sn_6U7
zUkKq6U)tw1=SBwq!mdp(cK=^;KcM{Ysl`U8S`TdadMvGSmK4)Zz2+C+HaZHNKIFr*
z>#@UX>t~0)hV}C;%ocd@<g|SZuPk3^=mYKJb0#|8;8wbQAwJUVSJ3?gR=usq4rpFz
zvx(H_Z1B6jK#TiWj{2!^X$g;4`mRs&)HWD2?w2!DHkh<7VA;a$)>3A>Y*`j_uKa%8
zye9riOEpubQ8i!9`~tcBC-=U|c<a~YFHiKhw>m1x7q4@2-r{K6tDXvmy27uR<Qg{b
zOx?dYYJ!NG&E&S~6QW!E?!JD1^Ovihf>fs7rgE*VFJ$|F_ikL_Z`EtR`SI_7yS)pn
zB_=X1pXG8eD_Z<&()O)~Z8Ya@dRD{Own{(RZNd3nPiOPr*1WSME#>vUU*>1#D|VMW
zO|D7b8y#_e*EF^Al^qt#Ru_EDE5Grgcb?X^1KZ7Jc1^Qbd^>mbt9d7u&F2k#xi59e
z?`>ziYww2tUsl;K8^2IoX`icy;h%zJpEvh(&Qwg!lVQ4)7ukQ?JH~C9bb9-&P`0m2
zcpj(bUz3eL9kAZeDMjdsevX3U3`zMNMpviq{4@8_Ub)_dMz>dMeNH<(>4g5CwMqM;
zm)v{tIOv>Irt6DaH>GzfRfT0;x}W;M<c-$tM_lpC#9}1>PW})mvv}|3x5wG`RG%v=
zJi&ZEI{dGz_^v!%&Y#k&CvRzA>);a3&9%aDdxnJ3X5HPlXY*92tu~dJrM%p@kZtc<
z1C`m4Zi<oGyVnWck2+k>=Ql?;|MUA6<0+HZUy9W%vd@g!XYTZHvExh?pPSQPanF-I
z5pi8(X4=D|ygK&jq8CNnFBkv4x$4M~W1TCewC(@%(*MIUwrw4EYdjygxoxztt*bsc
zeVv})y}xVbT{(4g)348Ox`acO9Mc`IZx)UXt>8Q1F<-Jv^ZWnp-=D_k#`rF>f4qOu
zVVT>LCbpER2v_rM^gJXjUBhtv<mOtFweQ5fMBH9Jji;vX{{4ShJF~y%Dl*Q?DG>60
zwQu{oxX|s_4hh^iG0A<><we_X$>&ZxB>tZ7pWTPGQpfhH>NE;Z`}A>z?TsIcIpsnk
zB&O{9`uL|pUt5-5Vv2!@u*jz)D<-`D`r&rUh1Zp>y8UgDI){S)IIS;R|2C9QW1e=4
z>-}lW!V7xJo|cDI+X=_sj;&mGChaOeYmfEz-JiDXpSdt)>eSaIfs#Dxc6rZ?Ztl8h
z=KQ?rMEZW_Fc-_JQm3Hla?yLLTAK_XEec;9@^RU`x*J+MtET?DeZ<PiyXTwnN;#zs
zXTNlOu3oBs{>`+%S6+q3t&h05A#D4m%kS77We$lSn3u)c_K#;<on&6mW22KzFXvx*
z@|;H?a?VKyUz4xvUex|SGg)8cKvHIJru>l=9Ws+mcdyw0@>a_AZ>Mgoy<U<%H8Xx=
zbk(h`p`7<$vQA^1vR)@nwCa0%@xs}T?;I4Q7`3GI-O5{j?Yko@7Mh{v*U)(=ZgOKw
z?W<F!Th3{&W$3!D#eCXE%ezr>feOnz4*%~q2dn?M_DC7r_1wHO`+UN=`-|Nx*%NaE
zeth5i{N8@o8>`nD7R{XFn5O<UE!l_nl2y35#9~vA<YNtII1}Q_-{;I<cCk78y4~k#
zXG7l!)c>z-y*q8Y|MbRFkykExEijAiNP7~`Dbwt`pidz0xAB7QoDU6pxA^o;2vhZK
z3ZL`MV(Si#?SAj)Of}@aWU!@p>W_&#How%7JAZSr+|oI3lBQlyWzAaYlWzOx`9qF+
zn~JUXUr$ZQS<lD!^0se)=AXappN~D8b94WLD-55!Wn~WaEH%-X^=y*u{gv}GGuRfj
z@;YAFC)V2biD7AVMe5Pt+>%@yMUAhR?5v(qw#V!X-}m}k*0v7qmL^wP|6PzhRAF=Z
zUshX;>~+&b_3s%KOSjJb+gYF;z#jZr^NHA^`m^W6a*mlOeAPU#obT_Z@2_%qnSWVx
zq;F1Jz431AGZ(WOzKQRhbKuE@j(O$c+7|>roILpd?)B{||2)56J~&n4@_yx&{nO_<
z>*oCD+9ofp{J_tyU+=F#R_~3MtnY3V=W@*78@Q}IH}R%wk?5TqN$p4LoaS%1y6V+Q
z^KEavOjmYCq|3}bSoUjAp6Q(1U)zu0{-gHTxc|~A+oxWy`zO49C=hx1*8$`Hg&QL;
z3VY6aJVD55MO37K!z4CU_5{hkJ0?+Fj<3$hdFr2>#Fjs=wfn^X5T)ae3f>h_)raPp
zuT|O7qGWq`<Bs{iy;xOWl|-))=F*zFV5jkl&}hdiaY`MAjut9L&$30%UO8#MCN6Z}
z6+U5+_g2CpW`4d?eQqzcxW^fJ)55ce%fpssU!2jxs2k5_1btpQ<I0A2=2?F=?z{}w
zdb{D;oA$d|0kLK)#RRTziDLa{CR}ajxVAMr?5eck(z$u2Iq$C=4%-^kn0xE}mu9!*
znFlU3JecMG_glX4%r%jvXO`9|mM?#AzH06<g*BmCbF=o}%?;W8_t~bEAq+9bE93t0
zs$DWjF+P@QBN}|8_t1v;&#MEs2ff_B$ZF2Vxy#<qbK1Pkw*HxP(8g;XN27$FiE6YI
zXU>`WMdDuo&r}_@W{ZxAYZ=R48h?;Wcgp*6pl#xEg>6SK{(kcQRrQkWYkp^rB=!Ee
zsh&UkO~69ckb9yYdVXEeCbKLPF8h4?6d)4x>(aUO6O6_&yM9iXG2PegqD1%#n+q{h
z7EJI-GdQ5ldV2~}rtdnTE$<bs&)~koz{Pjg@WPf&F?^Fbe{SqpW0dSa<@K|SC;fko
z)21uWQ<(LC`*QWFu9)J!Te>@J)2bidt6#RZxpY!+ewgWldz`oazB=c({C1&K!E;A*
zo*mJpnFsz_J$CH8THw|Y8{gypuY^n3q&0KZj<=i3-@V=Z{_W=flHYE=o{_#jB{5g_
zLg|_XjEQ;u4Aqu$k4@{ByjgrwJYbRTYTJs}Rcm-lxemqlyz@HrWZE;HiHvs_T(Ah!
zIM2OzviM%}YWugBLv52k-gb75UcVsQZhF|M)4Nv8;Xf%Swm&TGqNEJZ&0jqH_mWP<
z>b~p~-K+c8S&}7K^>J%R%z};!jB$HJ*$&&klijl@@XDS;&q|HIf4JZMC|LAU@#LkB
zuGcM|HE{22OuwhP=0(V?U1`=KpYF-XFWi0ap7;CmfB)Y7cu-<r`@MGW_hsLo{dh2a
z@8w#J_Wj@Z`uXasYrlM3@?@&(8HNLY@&$Kx2dqn<_`zGXvTG6RDa)@#EG0F4Cc7U<
zG;E(**&`fbCZ=-N^Q&7ASJjU7Rol#6I;Y+hwOYw^zEIh#hxLS>RD0)l`)-#rOMCj8
zT16|=l8Rgw?LXx8b>?%qYo7uSmTx`i;+gpF*O?keoz7dQQqG>0V|<r;WZMz%^G7Ft
ztXUw#=H{}rF?}}wsq<(5O}BYH@m5pB?GGYlW`SS!RqPSmA2dHaA?I9iWdG+-$=L>X
zR<eHWlMlI`kaN!W*s_~D({tWQ&aOW8?49K7gERg-z8So%e8>OSneV@>`2P6b?eOJ$
z=Wh)R%4;;4FXYgA<lz1djVzz__uk|GZ7(bHE$-d^iqa&D(#{R~O?(@Y`EnD@9mDQL
zoZhie-ztGQZ|zKW>HFbNno{rh=+4LwOw41r&plr@Q2MakIgz(rP8a=IyZ`R<@yT^E
zxnP<U_ww|zJMU^=Ml#NBx}vn?lfonQlk?7t{C#A@cTQ74`Jq)*-Yv0NDq<?Uu5qc`
zB>I<L^WSpNQO;nSY)r4`N~a@<t(;%4J=A-u5bw56GWI}Rn(h4BZN1UEZcHmmuVp$N
z`{)AWj&+u|tsb9Qf1}LIb!*3>x62vCKdHzab)Mgpd&(e&U;aX)`r*SoI(6;4_S$qD
zny$^WD$zWLHE`)A9;?7BYfWF*ZddST-kzDmX0lu>W8xQv%pA#d*BO3Z3n$ng*{Cor
zT1CXEJ%M?a_HK@x-Ft+lwwA5nf2;OB?wjDm!29`Ld-j@kY*+WXKda)h%(k1mWbC9=
z{PqgI`WEJLSI*UJW5D;52mRZt*E6V2zibh`H}bRG?0Wa5dz+J@-?UXJmfb0Sz0gzW
z6#pr+SNfOBHa`|P<vV@CCcoQSDwjFuM1|-bt4*A+?(`);m8&M!wVXc6OQ$rXWmI$e
zA7oE;QkK-N2>LkJUvJ4&LmT(^Dm(%r51CfZpPa~X-=fBA{r37FLH+98(NDf;|M{BW
zy~8B1x;cRLjPP;CBPS-CGwykOYI4wlOOLh|<eZ614t>}@<Ll#x9D1voH_SNyUc3Lj
z&b$DpFKPQtSC}<h?OOEpckTY*+%JD;Nq>K_%kPe|#qY9qC9_hmTReX{i=+hnu3Vnf
z#n_>gzwFxdI;UxD%~Ry&i*Tu~4_ayQb@QKl+68wfg=<%SP4aBf*OGeB>fgvJlkUG?
zF8$u=x=qVh>{Q*ev^cM7ZKP7l^J-6awz{qIW)H1GSC&ZkMlCjeQO53lU5WMhPQ8^z
zEmy2wXzpN@pPLot{)9{8L9F=c1c9FChqs(!-w-h4s+nbyoJZ>AvxYODcUd~@UFHy|
zAIJEg<;{WJ+tq&`?=rmlal)iZlcf@kJ93Xaoh}iYlKLRZS!Wra+G{Qeh8f9*Z*?DS
zC};bxEZiQkwt@fIsUo)f)AtzvzB#jOQu-Oj>$P7T4{zSLv-d=v^}!2sx!bs(|6B3>
z-H#U^uIAsWmD8$Sf1!=bL5=^)GLD)*AuOld*78;EOkJp)_S4{=Pjp5G$G1BRZ08oN
z6y@|%S`q8hs%y+N&G7MGzO9zQ{p;plTEW3wmCVPnMciq*)gRrwDN1S<QEz?sbbBz&
zkLi&-bTooxrkt{o1fSuCtJZ~+UFvpDd9|g0^_fI&!RBPCef3{X|NGd#zVDvmcIle%
zE&0L+lJ>VR{!tjNC)~rs>Yi+QJiy`h#Dn|}PP6&j54XDizmgDEbT*DFvU}a4y{UOI
z#{S#7_x`{4N^iPIUa-rA442IwE$f8irm`-xOp>)!s$9%uBXs6aj*y;#jf`%hiT!L}
zvEa0u1&$x~JoKF>b%ST|$E#}V%jcZfdLVSxf(J~OZ2~+WCh7Hw+%M=+t=?S!Cu(i*
zyMuwXhJAfpdnVRbec*K$VVI=Tl>DM~L&oNuug#lp@?XgN`stzSpWg*a8QZH}jrV>|
zQL%pz=lY<0%hcl;wHKFmm8JQc$xUKmRSy@bzh$hqxrEKN!>W42vqP63J!lKv`1Hx-
zMenBWm4EZN)<f~?vR5VlN<M6Ql4xMtrOm0s@N~k2@N!9;AiamG3)Qk&&l|1qKYKxT
z?%}8EFLj>t#6`c3p1Xhjv(oE}@^qM#cz-aLUl0{M^O#%6SG@Gg9-WJiHkkf!J(6?s
zl7U{4TK9<zMFZ!ISq$N}tEcaO9men9WwdS`&*P3q_I<vRejWQJEa25Vw14r<B`VEf
zMQhpwR1cqeb?EbRqf-kuWICKzP?mb)6D|8@8J{B`@Aj4DWtHz&T(7EM`aAbHgK5=2
z(Q6Z!)w*u_9Z?E>YU|{3DdyDLtixjJo3r*!%W5bPxORBO{j4ypy3MioGfmm7-#*>5
ziuKspRZ*@drmYNXx^4cqyXIBZHV-rQ-FY55=Ea$@lVfd`7kZj0+I;XyyLg&cduz?y
zX=^6#wQF`W$=I6pH*0lJX1Vm-sN@Up%+^QF&%SmnW_lVo?~-k^ltf&;tkip!%(L;Z
z6?B|wbjjvtnUUO)^zNA{myR_r;*g)u9A9G>EGRZ5zpo<n$?iQof}wSO4@*l;YoFe!
znbA?;A#t3={>1lvf3*KH-c{@_=6kQ|B-CryDiP~-?BAva@zRbZMQxD*qV^7}<;|X^
z-eYZ(`h0l9a;7aiXWzbBxZzTBjH*Id)s@*sCPG5uamGuo-M(nE;qVH<;&ZyLkI#S1
zIh5I$awTD(Yq3xAidi!YD`r@Kh`zi2?#Zt*Mt8z4s~#?mpIiK7=g!{L^<UpcZNByH
z+G^{yx8q-bjw<!6``%Qqn{;Zi@kSnzeC?NKHwOPX?OFNyYS3Ocv&|w-DyjmJYR5FJ
zlVz9r)EAVoh$?Jbv!_M(cGS@Zp^Hg3PwtuepUY=D&!?Dk4<n6&W*-)=3_i{0!+(TN
zYM;-ygP+eGPuw&^y--3jY+GylVkK_FQ#&_a&pg(5VHN9x4URcMpSDHToBuwtQ#Ee>
z7YnCK&y4SG6Z_3}JQv&S?mcIQnDH*{DNgPju4yl>DLrlr?tV7aWhH-Mjra<cmZ!Tu
z1k0#g)U{gE>U&0&;YN9Jv`d>#VtxPj_yv-eI=6TVCGz<$+;Y@#cY4*6`bn!!ZsFW)
z67}prgVU`gH(%U&DQ15COq|gAQ<3i?;)^!RmgFz?nJ*K*=CE+;q?B)$qV-z**}oJC
zt@V*~bX=tICS3Yz*!HlME&mo=%-}6sw^$)EB2R0QuKJC4W*hHXYi_$e-}i6snTazF
zwR@?&Su1s~%+mf{#cJksL#^1<UBz?SrcIfo_-ohQstdPXzB@3*eQid-=f7$DH(r{e
zU#J`v_DSk|@19Qa&f7+teO7v2FTWp=&KVZTFugc1PVgn~^?cq}Z?l%mg=&S~=g-=}
zRr%^eOn~?EyWgx=B`(^l`@{Tw*UX~Kld)6R+JCXQuy&2x#pv0*f(GYp^Gg3t+CP8J
z>1we_?Vm$Ru7`;6Nq$!2oz1$m^|M^<#Vx@*W>3m9E@f1>tDA7U#ijQR&-zyzZ@Rxq
zyk!+EY<f}eYwiCpPx<#YAHMwe@!`GUY!`*L%EoS3?XmLx;SEm=wF5pqS+T80Mm{fV
z$1{`EtaXN=Zn4$7HXSiBO;xd+^mFzX*4rF@9QVt@tse1B-#$kus4QeXUzGLNtd73u
z!1RFT_jR>Pndd!bnI8VC&EjjnN{rs|vgdbpaj(nTb^E1Rw(o&0Zwpqwd}rD_Q_o8`
z^JMiJrp-U^RTy@qO;O-oeXMih$G7*ozJpPD=yw%yw^I@xOL&A_<~W^R(3;m-w#BuJ
zG4V*bfMZa=(YGDf9WDy-h%37;v{CT$-|Jg=`Rb}r&c!o!b=k`BInSPA`7V3Kre-HU
z-PwVc1qE1n_b*xQ_waw{OTOQKc80&G@ZU1!2J5uBE-hw${p$kuww#L*EB6dop;1_O
zevkW=cA=+J^>*2MzO(5%d6sF$9gVV+zY@K#bw?B(PEa-P4lZgIP+j>#Wu=Pv%Y?<h
zY*t7*OzdJkaPQ~I%k2*@tFm0tjya;Z>_)Z3q}C^gH_Qml{rqj=+QrM|{2Z32nDp-d
z?Ej$j?}Fq7w<lUvy4lXY@@iQ|OoEj1n#p?`OT>c%R;-`B={(P|t`}3Hc8A=Uk?mqU
zbH-D@y3>JPw*tx*`E9>?SJFglYFhg8i+QH2{${`V7IWdwn(3>Tl;-+&XUv&aq1{?s
zuv%|@V6UBk)Y(5AAH<v<A36I>c;-xf_wOr>g=el#vY9G%enWizyEi{-cZ6=4W&O46
zaK4MBl>g>!wy&Q_Yp*Ko4O%_h%4A`WvD>BZ6D1$NZ`m36DzYZQ!^Bxgr0UX(kl-en
zr!i8yT#T#qHd}3N_jF5-{Ip`zAxAI9PJyn<o8FhFpO@LHdhmjHvKM!Vu}_oHFYj1K
zA8tDV79rQQ_U?x@)2g@g91FfUcar}_gIUUAO3cNXw&$xq&Z;eW7n7eUcvsFPQC;SW
z(*B^#FV<_zlviDiy8d?Y=R36}dch@IES=qbXSy!Gy6aff<ztCAzX|iKDc|wE>OMzm
z>EzrMO0k=*u9vGFb8>QeweIMIclIZ&+bu4?5%_xe-pPIHYra~9>pb(Bd2W$o%}U>0
z$3E^Co5(0KdpehZ@e!Fu!9q{1c{A69ZFpMZshm4$s$i_j^!U$DCb&+@J@_`Y_m}_o
z`27z9+J2sMdTH>^Ea}vqn47cBR+(BQ7GL-{J?^9|uf+8a>xx$VJ?P&McR6vQcCzYU
zsh<aPit4%d?{B?-|4{h;*83Oy6=w$@DvdXveAaR@uaFt{Im_SMiV}R4CZ2Ih@|_X4
z^z+uwe;!_yclKKGn=!h;J#O#h;KhAe4~t}l?=H<MDb6z4;KumNX!haMU5sB-rn-fO
z{LEspp16{g=YRW-ceY<&ojPZici?<m?fK)+xns}Ntvg-(RqEfmom`)!^TUsNEv#P=
zCcSWrbmb$~RqIc0xc`2urod9g?Gc(2^UTwgvgdT1+pF?*`yVfZ>@CKR_}=uiCF}{A
zpQ*aXb#3mREsVzsq+7o81l%ZC9_C(O`K<QiDv?wrUN^CoN4`#4UT@NM`jp<8P2Hxa
z;@G!uth!mzYj;HLj%#h@&23jZznR)@^U}X{{p;dwY;QvRrA%KQoVacEnP>YB`d{ua
z2yQA5c{p+A{HterI_n-43jNp|AhA(F=En54$7$>CusE-EQ}Wj6d@R=RjB9qriVq?c
zx7FQ(B1|67)H`v#h^_U(QUfi?0#%(h&)u#Zl3#K-9xfO79Lqo5>6*t1&B=9!tOhd~
zV^;<FE>-cI9m)4Db8m5Phbk|#YV5^?e^*v7Oxd*T$fSciHyad|`x_QAOp)ub4_z5k
z98&akQ}yMzYa8$G$`S~;aVhWG*}Sg(9_80#?_PZ9RvOv9S$2Zb*0RZYPQ6uyHy23V
zINkOt?C~r|(;mmxRnwMD$tXI~mh<b$o&`r*jIMvwN&2m~Q{8aIB^j%(^wYI-ii%~$
z<Q~4Cv^_J4=SxsivtU3$TlYLW#qH+{vhT%(Y+8Nh=*f!BuhyQ-|Mj(Mc^H4z^?S2?
zUL2d6>CPH%<J#2g;kEqnr1Go3yD$B9efe)u$?TNxUOIcXu3C6B_RgNX>0kd{n!3+!
z{@(P=%dav|h|ZcQd7?Gtbyf@i$rskz_eAp<!@FZXOa5FHxj*B$mDDk13t3Z_xl`U(
zu=yy?)fD=(@wA5Ute-4TtLErt>vYVrKOUx`5nWRGE}27_=jp@xw%RVuNgpHXKJ^&v
ziJo(9p~BQ-CB;wk?-%Qr?Om(u{C8=}`E6MWZy!F+tu)mw3iCY@z^8ER&_<!e<842u
zw|ukv$H6N9yI)g4sc%of7rCmh+t^liDamO4UHI$9CUfD*K22^~T*r^j`M#9x@~w?O
zB(22W@4aVlYgJWR@+0_Sn*6>cQzv988?4R>3$1cI(7^A^XM9v|kJtRPOtzD8J}={p
z-v8cUZohP1ooW3oL9?ehC#EeeQn<TgN8GGyc{MCmx8C>)-aq5_tc&gW+L`Y}=1hum
zIvYHb*<aLr&n#EBi*vT!y}V3z{?d}#HxE5`CT-G>X*0OFdBNeJPk!r{HpFgG%(+r(
z;Q#Qu_MSy&>oW5*-k1OQ^{Ar$y~y81PgjaB+-#)$@Htcc9ogdTvz(?D8?1ld{WPd$
zne8T#H*3<i-Fmg{w&P~8yHUogr4s#DtFdmHGB51?iQ3!ZQruk{hZqGq4)4)p3b#1o
zdXKMt%d-!h*~jw&@86o~b!68nbIog^n}6;Xd98I=cFKC?U!M(n*vglme6}@(>Acf*
z_UP$*cp|-J?21Jer@ol4I_X{UUIWIGcPCfvvJe+#=QXq!-4e1+Oi%Py7~2w_-b0G)
zLE0i`Uq3WxTBrEhM_;(rxFqv;gY)HOs*@yia*Q+!?bwStmdQLj@vyYsXbXFHXu*b%
z&@ds^-i1LMMccTZzN=WmFwsq`^w3l54gLpq3Z1wyNB7$?<D~B#K4%xOM5(dVR{i<*
zfweZ+Q0LZLv)S9D)hd%&7Vns^E82Eg!6x<KkBGVES#PU?A2c&uTBjcKXNqF|qNH%8
zy{1flKHd?G$!gh?t7F{w!W3g!jZbrg2Nqc=JIweu`wer>=LQjz!=DY9`R4MTRx&E)
zN@Kfs<@TY33&kHB{v5c}==tKz$yQ<SY0@daxt?0}?6Zx|8=es@3QAITUvctT)j~DV
zB{>}@^Xz$k_4?iDxW;X`(&694g{t{(4*z!<s_(9UG-Gnv-0AE4?!A%UmBhW;JiBeG
z$%(CtE{U|B=P`ZxS8<`*$?tdh&mGP4P>R(yTz$e?a_x1VAAio<32?gcDf8Htr?DQW
z-DLE9WA>GZ-kQ@=mL@!Bo8Rfwq^X5HDt&0YdHvI6k=iNmpC;Hfe?79{P`SXm>rKxN
zEOs=0<<^_EdY77<>A`;s6RT3~|K&ASy{_Nyu=l%QWxmwJ@Z2KNsn<)&9n>y!ozU(+
zy<pEGkGg=k%}ka(eC=)(ajXjWdG2<eXxkuZf0t8e@`OzsYhJzI^5@-xdDF8@#2Y;)
z)T?}2WcTN;K=|kLT{}*Ff06F{rTFuNH~iZ~nwb6^{e7o#w^}n}so4FPIqr`SocncD
zFCb`{Ux13&WK&n&Qg^YX`^%NBSe=x1PWpbqsYGwX%^a`Qix13{S1&(&+|z?kZe3VD
z``ZPAKeHD(aDM7{Y5cw8@@b*>mEy){q>UE0?Wq2)b4ULCq0E%Z^M~$EXkC0(XX=S`
zwe4#69$b!L^PMtr$En5Z?%vYAutoLMtBqxOYmXZpNDqyy6WL-_clZ14?O~})eHLB2
zoOY9A#ga+emrk6R^O!#%<?8PGDAzE9&(9B5_V>E156;M4D^+r2pYgr9ubi!Pq;CBz
zxx2qX?ubF<wq^3pxy51nuMJt9zjE~(*lZX09Y1GsFE86n@8j;jqF04(d$W;M<m~&I
z%gY(p>zxT;HQw;iy!QFkyN_qxk9IROTNI`+{pa*q3woAKJC<~5nX1;w?sxi(o8QI<
z&2Ct$`a~^4b<?Da*WU*nIF~k=n^7lUDaQ2C#%<j<b!G+f>*ijMI;B?eY;)o3Sc98t
zTXYuRy`RbUcAfo)>!DUN6aFtbv+dm@+rzcz3;y#;<ZWFjdU@?Fkt4yP6-Iq}53)~w
zWZT6U?^|}a!P_7;Ht^ESUD4r@Gn>ylm;HFtXCT{rYSGTByX#vY`dz*sDSy`RjJ<x}
z;eU5ehrLf-U2l1F)x2PnNA11dQtu=4&#mAK?$5MI-}n89x#*pfHOpssaW<_wEtR=Y
z%ix(o%e{Xe3;Cug3#dfR&AR>4<iPEYV9{qMlh(Rz-7MUCHEVgD@tUJ*j$hSSZ{?g?
zJZ<Zh8@n#r@%986NSf4Y-^}o6ZlCfe<N7_8dtKEIH~sH4SXm`?KD~50R*?0%9^aPj
z#~Qy~yXjriTNHG8Zt2REO;hjANL>B;x^?e{dr{@dS_|}6UOV+g#C**jBdgHfduKV{
z^)88;G-K;Or#rhem+#uhI79Hjn|c2<Bj*^W=LT)se0O<Lo8r+)SA{OyG`_rQlDgh@
zW>3|j8KuEjZg0sxsSvkaY~|rw$>-FUyX>vb?%dTjPjtogsJi`PS8qFhzQ$B~_e}27
zmuCNU5Bw8U`f_W2Xv@2vP4(uEyzc{w^hACpu}a!^9BBBS$6TMZoslO-=<H&L8?V(~
z{CoGfr}w-?&B=;I$*RnA8+SdGs=WH>al|w6Wl9@P$N!%H;8WMJ14eV2d&=5>#%N~y
zE6E%!R8i{q;IQL!^_>Nu3=a4*v$&|)KG-gEIMin4s}*j)Rw;d7P{z8Y=#G`>idB=$
zzF)YSn!QSYUA5P`kf?bU!i}fWnS9yrKJ%*=C}aEUwe%kE->lt&Pg;|&lm>f5+Aa_1
zc^h>6c2j+}mGj@HCi6atKCJz#eClHB$}dS#%a^C5HJ>lMr@vY4R!!Q}%CgR;u!36^
zg_$#c7l(^h@-|$5tM+{Hb1vp}if`*SJ!N@tQT>Z~xr5(#hm@D6v)+bGzV!KOXw$ce
z%<XTbu6f;yI_6ciL^~p5(x=`c?jJI49aUVyU(()xd7ipaS$U(lp@5iT-mM2NyEe3l
z1{TfCnw)d%<Wu)$F=Fd>dm3~vFMh<uf9{yX_Qd}WK75II&?DqJcf*g9>~D^*t?=?H
z&$Sd-TgU%cbhq%rWlU4|w({;etFh{;)xm_b(KDKUs*7fI{kxl;`%d@nf3~REF<){s
z5>h1le$R3Ln5wy5&d&GD`bh?})NXIQpO@FaNbthUQ=CbR*NYot50#lpy!mqYoZr$*
zUsu=JXYjAe6!uB4ZA_f={zJ}|@&FFb|JPP|-1*KZ`akT&*Bv|scciEOQ`ysW{^FC*
zY!lkF;@clK%C|{7+t2*WtP=XQxA$#s|GY$>ZuV&D-3EVp6HM0fJn!z!lzztYI+=6P
zg+(rjxAcT+7}v!(e|TJwZ0F=x-F`|ar;cI&p7uC)F2xsxTMX|CPDsBh^vB<o`IG6~
zcMdCG6xprTF-vd=P?5W?krm$VebIRC6sB@V!P7gg^Z4CW{r7`sdEK5JciiNrZixJU
zOQ}fpci`>(EzM$UQudp5?0TCOv36Iuk@%FoD|Q|&sEwX+Jd^w1+kiUbRhO*WnZ+5K
z_qocf^V#lo|F6P?_=%MVtCxOfd{%Jya7D)lf#99|YN_>NbCh#U=U;U6I->3JP$o?@
z>fi(0f@p>#%lBRVdY!FS_D4gOA&dAwhOWsTLf;=cRyNE1%Ql?(`-|>QDfXJ(a~{5J
zlF|~kj$LLc(Ax1+>-gmJdneX&&VFm9antKdj@|x67o6ldTvlmvb?Z90bM~0`SiXO8
zGGBeKx{SG1py5(WLCuF(k2Fs%t5|bNL|bxU(K(^{uAd($rDR?(bycaql)v>>^M;$N
znCdUR*>Y&b<&V*;-&(U~{oEIPwBY{RErs_l?*Fj)`s3*mfzz3K^x3>#9J|<)(ljB1
z@4LlB@7eVSe%e^nlosr`-~6*?<M&rn!xIuz*PrtUlL$KXMKrba@6lW5RnM8tuMB;E
zQF+zxeZK_tPxfz@*M4o{Kk5D9#d0R)Uy|N`dGO*xqhJ@uF8!r-9PP@cfz}pZ^5#zB
z`gD9%v-z9FC${)Kou$1xBIMY)k1ZMvrMe~)T7J}X#jxL*z<>VSqOKkL<csE5KANm?
zbWOb&yU`z^xMSNVdgQBLEMU0u^MAseRjkEt-86JISMuh!#&!Ju(Q;eduqKqpQqCmR
zzM1Q9ijfN&U*gi;hbEV_sq-%G>Roo2qj<S+_en=(+y9652U$*;&fe>lEBOBV{k?Mz
zm2c1uv%12zDza+R+M?BMwK?UpWcSOOE!t)M=CN1q%$Kjr%2Gs5)VoY@S3aQZ7-fB8
zvGRe%l8GPePCTA(dt$MO*`;~4g<qa+Z$3O<Ydv3`gCm=N%O0(D^8W>yW&4VYAH@la
zOiB_-`%*t+%9Fgs?pc0@pKGkRH*M6K*vj(eO-0Sa<1dd-v%g<eo;X$O@9dT>CXaWl
zebmjt5jbhZQ5!Zkvp%7n_a1#Zzwigwl;`JmAH2`bHPiUxzKZStejhk8lV|--=cCb0
zpWZEqmf!N%-E5)$((uDqI;WKE+hV2h^ZMf&)4f79%KL=&{bg5|jS-#Vb*tnyW8L1_
zJAY~2)tPYBH}&KUf3bs=`wq;uTXI5K)G9FRT15A^-2od9K7V+z`|{=c5-x#Hvqa7s
zWpneMe-!Bd#7bz5J|~yTYwP)6+b-S+V=gMpwRcnfsVMgBwEfB#E}ly#3qEMrZr;T#
z-ZqJ+r`*%`^Xf@~E-t%$T!UM^7N30XamA_f@U+0?D!==rY<N8@O-^)V^*N<Y)89Q~
zj>`dgrK7@|&I{l8dt$kdjpfeICwVHe4rx4^xFyd)Zl5_vb>2!FyF}epGolxNx-<Wv
z=u_KQY*p*O*WF!Jn{r>y@c*BvGyB{06sNf~PEu$55OShpvD??@MjKYJUb>|rG)*t?
zlNoon;TG=NxBQDAE#rK&S1-MFuIS{``Mo>m^3|sF9_g*yCc(T)>_y~?o(N9$T!$db
zV<FQ-9Ne{fIi+nGkNQk_D|E`a&Fy2VA<y56lT6E`+Wfwzu(!6k>(2@d`YC-=%BLbq
zaN-0}k(G;%mIvIrRIhdSu}x{;@5!7o{EO;ep1X1Ow}DN4gjXq-K&A)-dsg(tf=I#U
zubn!Vg@d)u7c_PkiqF>!__3QKJ#yaqL*<KP_&?A5K3D7H!j|4eX(#`GN%;`{IP;`;
zs9Vhg+pi}Qb$i8Mcx8&3XEqtG2$9HI8oFKkwMxSj_Y!4hreEG=?z1bFhs-pQY3zOJ
zzvgnVMf-v3`h)M!%c-fxy-w#pynfF6lEWA8PqMw~=KSVNs_3}{t2x@%oAmvr7@ka;
z)e}3x+%auwNY~Yn-0yduti9kH?ry&S(W51jV%dom9P5@k-fhZBe0eES-E+Qp-OfX^
zK2=EtoZ&d$mpW~xMePg@=Ke0luW8-|8Tn<hVpApF%uWh<)7BVVy;&#h>XHrnCHAmi
zTh=b5ppq*8_K3aEBcVH|ui3dJuUMcyb3UiJygc{85ZBr7b2=BRUEK9$@73zd6`ivS
zZTIxm`tYCcy#4U!f3`C5qep&(8vgj}ufVi(LY@nE)n*>khRT|@I$_N#N%yrr37q7K
z+*}>>@vJB7y6CoulrX*aj3;Xf_&zRBjh#B-$-4it6Q?E^y*j?4!#7Zrxv+KejSZiT
zJh{8FcI>arSZ!Whd?`z4er0@y>-?8eOpXr{&Mr4#@O#z1S4eGMQgL+l>T@dJ_<H3+
zJ5p}O7TedQZ@PWWmEpwHc|RAaaa~w5=LiqSkvE#B(i<CJ7BB@Z5O`k1SiWzkkI2WF
zr8kAtN;vn-zU8giQ}?n~;(VEL5cdwgBtN6Lj2%Z<wH%HA{8)3cpJ9UU@1zX9Q#1eE
z>pOFgE2J=z;oF=k_jYa4-rw`}+v;h|`z-G*-_xA5Ch3xe^GegwTQcmMX9T7_x_tk_
zEdGDD?;KM$kaU~T+Z#OZ?9H@%qdFV+!v74Vf=iY?c-g?)5N0(egZ<TFEsui-Sgy{A
zV4h|vcY2Pr=)w&<Kdkq<aNzNg?msGNCtEhix>;(zd*AYfm!;|Z%w26xk$22@zudGb
z#wMNHI!vJNq5QYl!*47vC(0c8{803bfsoVWr1W{O_D))}+=&0^W4ZI`>yJsV`k?Yc
zT=ye~^qNz(Q|<N&dL;(9YffYR{9m&0Z2vMR*H6#Bw78cD+NQ;F^NDH)Srz1V*?bai
z$arQT^=rQJQR&awH?Cav6pH^AAZ6YfC;zoCexG&NC-YxLKMt>6EdD<=Cu7~O+OQQ<
zFSX0Pm7nJ{k@wd9eE!y@SN?fRY`v-V_QM(9t5zaAkM5t9w4g~!sV{q;LDb`SV%^(L
zWEjf%HThele7twUQ@N!!dD<(_8LAsa89tcFoXEQtaav9(^vg2OEgb5pi5twG<TM6Z
zu6Uq$>|V)Fl}%Ikzi|qTO_kVD6kuR=Qai%v_$OIm6D^j-FM_2$rI`E_d3f*Smf2}n
zyPFaudlho4!bDY8|GIkMW5=TGNlr%<PlY9aS|Z_-HeX^U_j<LOHv&Cgj2k1wntwjN
zq1)tjq4MQL$G4had7d#9yx-m+Qep8qMDVdpMa`+u)b58<Z?~KlF?+uFrGnu_gENb3
z*gkLQOnQ}Wz4ls~)%J-jB6Bte?r>#Zl{WcOUXAe5H5_6GBt0iQiN0av9sj7#i0cV&
zM)Ve?Xy>AkPjU0V)LB^6{Isr-d%s^GGP&4IMbUBgoh27{Rn6GEl=0ugizjb0XK{Ww
zvi?GZ-$mbuRTVv+rp+r%=JxAluDW=8nallKU$fpVSuGPWyW+%#P4Cod&aZ2{kdot7
z5^uEd)O0ml4c(cN!o@E>U2|EU9wE>4P-;Wu#%)V=GyFHI+&Yq0Es$r=b1`0acfyl^
zWVLB3*E*DpAJwQHI`6l1$0e_aJCAvuONmoc__^%3)!GI5zP#lZ4?S;r(6CQWsH&>-
zRE&#whq2c^<+`P5ao;}NJ=pJ|_hCmdC!<Msz!&4>I+k};?FN2+-~H~-)3DHd={D`z
z_4jShuJg|7{~%DmNc_xit8DKU@1B}9D;fRPtX@*}PuG&uwf1_tW>=2&_TT&}k2VPH
zSj%|KMsCrHi{_a@O*$`K)`^ri{q$SKSzxgJalLZO|7W6~&l%(<70B@)mJE4(b@FGI
zW5RI{&lbK<`M>4+qvy@x`qk?B^%nQ;S8uNGv3#q`@<iqKjW;Qcuf20myxl0KxPAWW
zyRm;~)UGTqdHY!YDD#@5=_}8zJ)V8H@4nH7the$<_uly|^S|1L-Fl_Ua~18%kFQ=7
z>@VN(|J{cpzwZX`zbCUtXBU%aTs_0Wv{yekJB!8s9#L6ue6jyc92aY9l3!XtUvJ2V
z^T&>Nl=|kBzf*TfQQn+-G>|on$7`q3lU*qan_js;h-KowomQP8=3j1D%b~(PKk4ab
zjtRdxK5U=<d;gQ%ZtDc={1a7rsrJt|OIBT*AuXr-CboF?`HAaJO^s4?(Qlo-cjL^2
z#7<M!>}e+%zOP%S`5;`E&ph4v+56_FQv&niUNSyXxKe&9i2JD4nq<D+YYsElq`ws3
z$`D>+-Kf;RkiUQ8Lq*{SXB4-epM22NB26~jelLgRpSJ9Kn|kY;cOT~x@6G*k-BDTT
zO!~a3=8F!*-m$sy|0JK;;_{7;5`wHai&FfbMeQ{BnetjJ!b9iF1KtO^>fM^r8-lBU
zc<rd*e<ZoZhc)1fm2_NZuf9*n--jQ%4r`t{?|J)Qrp-=?$63jnO!>1oZ|ZjU*gMa4
zlu>2kIG!qS=q^LWhL*i9jdS-3$<A=K2tC2l9XDxCv_XMJquce=7tB5v(?9)bNM*^X
z6XZOtt3T6?af{@HZU+8I(o<?1dM%aD=ak%zQkgi3@v_Zd2N}8Z-6qY)KQ79UIoR!`
zA}7ySFYbTRQ#Mlcs_!$Cl1*NYdrUrk&b`EUd%{WGi${;hFBX=TG|>L^<bmsPo2JAb
zM!Sc{Ih>`eU%1NIpNe7GxafCNih%tod!A)e$|i?NTDJJlGTnIe_4N%}t9g7Hqbg%w
z>OC>Kz4LL@ipH4}E^QH+_9|G!H&VAr`rFx;`JD+C3D$?|cf{BD=X`r;pq9_KbJ3xH
zX7$Dz*D`fG|CQc8BiEe#?f<;$SLgRGJoD$96t}U^FOhy{`GA;B60Qroa*ChMJ^Z05
z!_57V&;i|LKKDu%X&3mn9@=nwg&galNs5Ic-D)3F=T!7xRjc%QXu^~8cZRF-|EPeF
zwGUhCrwSw{=G1<bc;RW}uCI9CdbW?#6`w`roU0gFMTF-v7S8{$uyJ0GMagl4LvDWz
zOeVhbX#2F0<G7_zylvQ`Gz;EZ70)LEE8NW^&$N^;YHiLx`fJ_UFKLmXjTUikmo-Et
z&HH?kRf#)gu2^v29EURwo%`y$(jI4U2p6^H1^r-ry>OeJl+$K*!!L{vA0F|z=UuWz
z;QY#ak$)s@cRsM#+IzPD3YVqfg2_=+uHDl)bYyR`pi<C*e=N>+4<Cu=yj{`MeC3|l
zBC(}hGa3xM8+R)&I>EQAnTut^A(ahFVvDwYxR|cfrK5Ewwcw!WwN~?w4hJRNC9IhK
zGT3&P85vEv-pkWxx^DWXGs{HhAG_;#=aH((<GN3wO4oL~q<bfv)Vsr?+SRjD%q)Ug
z`_!`hK3>VD>NTq;KFGH?&31RsVb6I#FUQWAoOqw#?ysWCi*xFKrTwl{6iwc_%a(tV
zeYo1pX)|~;Lz9lo?S62n*mb+Iqm;hdX8+FeFYy*RGKmtWJBpbXynV9uFc;^eZF}lW
z9QKEnIeq(cFlL7=_iH;XmK$#iiUKc%&nj^0ojzgG0@<D&_s^tHR{ZW|qBCpCz9aLl
zn(#QA&%69dkNwR-ZRL+_pQ<{J$aA<XyL*yns+M8ptK<+P6_W$M&Mp4;Bq(cz7SoB7
zOP>7YxB9^Cy_hXhNY#bo_>-&sF$O(J(S2-d>l<8RJbo+sZ*i9qlCJ&iD)M8&j~t%q
zA@ko&>$1O8t0TDh^7I_;mxo<UpUoGEHgkMBYj1|n>d72!az%_scigxfKIwA%_veu>
zSkzuDYdA1x{)29=8>v&ii0{0-vA|yJ-0c^lGH2A^+~HMOZ-1pc{asfa%cq=v=7*{L
z-b~T_&x)oz2s;>{Rl6fq{hxx@=70*<UcnQtEpO&uF}lRkd6}!hV3{|k>>1CksYdf&
zDa`+U`K9Q_qOOqJ>KpPT%=XyXyxn`p{%-ZhVkvpgnY%i-WGxH18@iw_wy{koVN>0~
z-^biL4>35hY~1wt`=06S$L~!RDCgiQX<?MET+g**c4o@z?mG1~?5>QB*KQn^c6b-{
z{iu^h%qxy9OhGzc1}_eA$o{^Uy<>;;LO0ci*%5VmXG_hm?wOhPL94GS?&GhjqtXF;
zGCU_T1|LaIz3<z9kNxAdYsXE}`?Q;1Mff*vouTKwQ}i)g=91^LUCLK_M$g>Dsxp5M
z?{cvTF+as(JU;B($H(xPC3Ehq*8;kWkJt44>`?NIYv%e~5&k?_BSlY6%Pv^%ZNiTm
zx1x?M@%ED4({G<v%GwsoSiRlK`=e^_y_?amR;RAuvHj;?^l`=08~p;t0S?J2s`Es<
z-r8MYHCd)sIww<*X+gHZoh=75qZD#FA7q!P|NQ#k%9UfOE}u+yPp#TD^_S_|E8$s7
z^KKV?uBe-yzi*ea@r;jxP0zL6c15b5>g}>pR-P5U+p&K6U8w|y)eCNC@xEI7FN<-F
z$(rm%cOxd|Nv#c9`!@F>yZVcSRTn2e`?8zghR>uUaF)*QvIOI)clT-jX<r=e^wOy6
zZv4Z3_NTqQyb)JDcYB_HF#7`cg^j(PNj?JGcpmxudyrgzW3t&piT?%JU$4DABCTZg
z?gf|Dg2(Ko$F5qrJ~?zpY04e`4bJ&i^FP|&xw!7gi-6<b0`=2(z5iJ(xOo}-a;^a3
zH}_6g@>l5B{9dr<Q^-1t?&#CEZ|{2f<muM-#>G?G7k*go{^H5U_m!FnE50sV(WBcl
z?^<5Lmo2;JG2im==TcI0zPPxc|8hc=>%^;POjSO7;b%8mv5-qVbf=Qj?2|{oR5kS<
zob#N|&+SdZCl-}W{o5I*oeU^9WSSng?9ZYL`#*h7x#u1J(ahl4wC31@8_XY{eafoV
z{nJ#n;YqHT<$>sQcIK0LrBU}YD$O)L-DY!JcfhoAO4O9^dt~H!-*N6MV&TeXR$qI4
zw}|wr3(l%(@5N12POn*eNg?1!6i=?(()x<u$~E8m9#-{E6o1H{_H;>k!KX*hlWjhU
z&Zyz~<LG$qg?db!-RD;a#C!I4#WAf~SG+a!Zb|5&6(QR-YOXHKnDZs$Y2(yKkK1aW
zul(iozp5$huvy8*w%sE8c-_1{HoPw7sft?N$$Ew*dV)F2o;4SG%vZ_JT`uY?o3-1h
zLQ#LgE|(9BEoM4xe>rnk1;?w0D`gkRHk2x-oVW0NQ5=56@ZB^iiCSI(=F}~P-(q53
z)j7t#ojUEHfqVEO@44>VtsM3h6wd$oXrK9Popa|3_aF1RnR&<P$vMaW8KOoL)8xXA
z@4ernwIyzAsM+kjSF^I#pPc?^=ADA7-;vSo;ysn;3oU<4tjcX{l;87o4exi2nceRm
z*G<k_Q<bw@W=WvW?}HBQ(bK!qCKYjSWdGnQaz*uFjGE0|l>o`$gyJ{z`7%_MBu}|^
zOng%`y~{#5KEq_MoSRD;V|nAzBnj4HXTzd5LUH#3+>ENiul0CLUL^QEY1VhXz0-<z
ze%O|yJKgW=oZUC(37v7U_mRmmTY7!_lIt5(Hat^4I>)1DGus(ahf8I*qBzxZCz)_q
zZa$Rlb%tYU-Rf(GzGuSL25VoHem7a?`eW;=zKkgsPnSz5{Ji$L`g(Eo_0Lsz=d3fc
zo_FUxli~HU|AoTS%C?%T^-N??wq{;`qwUd*7EPu7zGBY&kBq1E`fpLz;_B<1@9_7%
ztBavU?G={aC+`RtbgXGSwDKT#a-x69(vT*H)fePCjSlUx{M);At0*&z=gYuz61~D+
z-Hi<z?~-lU?s$qV=nD~^a`_+wbB6gbpNAR~yl2jkt~zFOB<r|w!kw&lULTt>|3qDX
z_*rz_GNZHJwprJr0*zm>P4(K$T(RWhieGoXt~>l(JFfkFs939;*6e#xg8H_`Z>Lyq
zzGCCjyuGANtIzeE;U?Ml&%!UC_!`4D|A~vrajSnU^O`O5RBvVG^YhoeEwiy<@aa9t
z)Em3Suun@iW!{A8lM@y?@#TAmW!71W8@5m7$n1D`SH*MJKD|svi>#mD<2DDaUSy=O
zeUW_Mqr#s#g6)BP6P}-!=(=&LY`#WIlhyl`vvV#z|D7e*rn1muFU#x&7e#np7<s%@
z;P;A3>b_mFf1AnWt#6jSt$QB-b*kdhjO`BmS5pmZtEa4)r?+&S(k78lQ==;{Z=9MG
zZYm=fWXM}Lt<nB58%tCBC+|<LPv)Gvmm_K@HEoh4N0Z;~i>tQ(u3H+k*6pIg3ih=L
zx@R0OgdLI%ne@%K_uZL4jW?X<UiEEFGvjR(+~jzywe%U+JihyeHVWJq!**qOSI*v-
zyPG9Tg+1Ey+G5wVX$#H>sNQ#bw6)~QX|_FWQ?e_iPcLb`*Y>bus{W6n&h1g9US5Iz
zr~UKn5+*bJH*O8GF11RqF1K7MeQ=82Z>2TMwukIdS^x9D!o*8%ZQedN_D%S)G)r`;
z&)sQ0jT1ZV)tzspTz?wfwLr#bIs2LC^B0}+u8Lj}!gC=1h;qW6jm?+XCiJGXeN>oK
znDD5ONr#hv59{=(8(mwU^_^<i`0mF3UV&`hhga_hW`yp|4xBpUmin>3p7wjVPm0<{
z`<AgPS1C8SZLH;T{nk|4GF$FF%dI)qy8Di8*)>Nf^X}fAF+S67nQfomzfpO5@7a}t
zod>3Ks`l)DRiqGA)Ua}1f$>uh<FGe<yUm~KWb6}oa_VH(UAL8ei>ef|KU6x0EPCQl
z@voJ6)`WYxVu7nuCs>3Eh{i>qitqi~y7S9B^SCXawnsPazR7=Wk*&cd-gxD<=*nN$
zCtkl>u<rUSE<?`KthMIR5*u%Mx7M|N@jLrz@0)kuHd%Yd%3QK8YX1BGL^>mrYAhoI
E0A|DcTL1t6

literal 0
HcmV?d00001

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index cfec3209b98a..f68970ae13e2 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -20,7 +20,7 @@
 
 let
   version = "2.26";
-  patchSuffix = "-115";
+  patchSuffix = "-131";
   sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
@@ -48,6 +48,9 @@ stdenv.mkDerivation ({
       */
       ./2.26-75.patch.gz
       ./2.26-75to115.diff.gz
+      # contains fix for CVE-2018-1000001 as the last commit:
+      # https://sourceware.org/git/?p=glibc.git;a=commit;h=fabef2edbc
+      ./2.26-115to131.diff.gz
 
       /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
@@ -73,7 +76,7 @@ stdenv.mkDerivation ({
         and we lose early mismatch detection on 2.6.32.
 
         On major glibc updates we should check that the patched kernel supports
-        all the required features.  ATM it's verified up to glibc-2.26-115.
+        all the required features.  ATM it's verified up to glibc-2.26-131.
         # HOWTO: check glibc sources for changes in kernel requirements
         git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
         # get kernel sources (update the URL)

From 7a9b6ac39a34da8661219e00350955f51122eef8 Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Sat, 28 Oct 2017 15:09:54 -0400
Subject: [PATCH 56/63] kernel: Enable cross compiling

---
 .../linux/kernel/common-config.nix            | 13 ++---
 pkgs/os-specific/linux/kernel/generic.nix     | 50 ++++++-------------
 pkgs/os-specific/linux/kernel/linux-4.13.nix  |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.14.nix  |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.4.nix   |  2 +-
 pkgs/os-specific/linux/kernel/linux-4.9.nix   |  2 +-
 .../linux/kernel/linux-beagleboard.nix        |  2 +-
 .../kernel/linux-hardened-copperhead.nix      |  2 +-
 pkgs/os-specific/linux/kernel/linux-mptcp.nix |  2 +-
 pkgs/os-specific/linux/kernel/linux-rpi.nix   |  2 +-
 .../linux/kernel/linux-samus-4.12.nix         |  2 +-
 .../linux/kernel/linux-testing-bcachefs.nix   |  2 +-
 .../linux/kernel/linux-testing.nix            |  2 +-
 .../linux/kernel/manual-config.nix            | 45 ++++++-----------
 pkgs/os-specific/linux/kernel/perf.nix        | 17 +++----
 15 files changed, 53 insertions(+), 94 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 24ae1967570b..82a092cd5393 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -51,7 +51,7 @@ with stdenv.lib;
 
   # Bump the maximum number of CPUs to support systems like EC2 x1.*
   # instances and Xeon Phi.
-  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
+  ${optionalString (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") ''
     NR_CPUS 384
   ''}
 
@@ -347,11 +347,12 @@ with stdenv.lib;
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
-  ${if versionOlder version "3.14" then ''
-    CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
-  '' else ''
-    CC_STACKPROTECTOR_REGULAR? y
-  ''}
+  ${optionalString (! stdenv.hostPlatform.isArm)
+    (if versionOlder version "3.14" then ''
+        CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
+      '' else ''
+        CC_STACKPROTECTOR_REGULAR? y
+      '')}
   ${optionalString (versionAtLeast version "3.12") ''
     USER_NS y # Support for user namespaces
   ''}
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index b1df6c54c456..d1733f96c536 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,4 +1,4 @@
-{ stdenv, perl, buildLinux
+{ stdenv, buildPackages, perl, buildLinux
 
 , # The kernel source tarball.
   src
@@ -23,7 +23,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc"
 , extraMeta ? {}
 , hostPlatform
 , ...
@@ -58,37 +58,29 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    inherit ignoreConfigErrors;
+    #inherit ignoreConfigErrors;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
 
     kernelConfig = kernelConfigFun config;
 
-    nativeBuildInputs = [ perl ];
+    nativeBuildInputs = [ buildPackages.stdenv.cc perl ];
 
-    platformName = stdenv.platform.name;
-    kernelBaseConfig = stdenv.platform.kernelBaseConfig;
-    kernelTarget = stdenv.platform.kernelTarget;
-    autoModules = stdenv.platform.kernelAutoModules;
-    preferBuiltin = stdenv.platform.kernelPreferBuiltin or false;
-    arch = stdenv.platform.kernelArch;
+    platformName = hostPlatform.platform.name;
+    kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
+    kernelTarget = hostPlatform.platform.kernelTarget;
+    autoModules = hostPlatform.platform.kernelAutoModules;
+    preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
+    arch = hostPlatform.platform.kernelArch;
+
+    # TODO(@Ericson2314): No null next hash break
+    ignoreConfigErrors = if stdenv.hostPlatform == stdenv.buildPlatform then null else true;
 
     crossAttrs = let
         cp = hostPlatform.platform;
       in {
-        arch = cp.kernelArch;
-        platformName = cp.name;
-        kernelBaseConfig = cp.kernelBaseConfig;
-        kernelTarget = cp.kernelTarget;
-        autoModules = cp.kernelAutoModules;
-
-        # Just ignore all options that don't apply (We are lazy).
         ignoreConfigErrors = true;
-
-        kernelConfig = kernelConfigFun configCross;
-
-        inherit (kernel.crossDrv) src patches preUnpack;
       };
 
     prePatch = kernel.prePatch + ''
@@ -103,7 +95,7 @@ let
       cd $buildRoot
 
       # Get a basic config file for later refinement with $generateConfig.
-      make -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
+      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
 
       # Create the config file.
       echo "generating kernel configuration..."
@@ -122,11 +114,7 @@ let
 
     configfile = configfile.nativeDrv or configfile;
 
-    crossConfigfile = configfile.crossDrv or configfile;
-
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-
-    crossConfig = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };
 
   passthru = {
@@ -134,12 +122,4 @@ let
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
   };
 
-  addPassthru' = lib.extendDerivation true passthru;
-
-  nativeDrv = addPassthru' kernel.nativeDrv;
-
-  crossDrv = addPassthru' kernel.crossDrv;
-
-in if kernel ? crossDrv
-   then nativeDrv // { inherit nativeDrv crossDrv; }
-   else addPassthru' kernel
+in lib.extendDerivation true passthru kernel
diff --git a/pkgs/os-specific/linux/kernel/linux-4.13.nix b/pkgs/os-specific/linux/kernel/linux-4.13.nix
index 767f7e35422a..506682479c7c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.13.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.13.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.13.16";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index bd1f03c76a75..b740dc49f430 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 7ed69558fb04..a51cd29665f8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.4.111";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 9fc7e51cbef2..4efd0cfd5f7c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.9.76";
diff --git a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
index 33885a082d63..7f7a72b43ec8 100644
--- a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
+++ b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.61";
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 1ccc152bb289..20ec3a89a735 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index 92b202100a63..9720e3c0e4a8 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (rec {
   mptcpVersion = "0.93";
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index fb97aa579df0..1efb11435e2f 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.59";
diff --git a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
index 32c684668d6b..c65182271dc3 100644
--- a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.12.2";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a104cc5393c3..ac13835afdd4 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.11.2017.08.23";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index a3570fd11a43..0bbf78e804ec 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,4 +1,4 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.15-rc8";
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index e1936495921d..187c96cd9f94 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,6 @@
-{ runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
-, libelf ? null
-, utillinux ? null
+{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
+, libelf
+, utillinux
 , writeTextFile, ubootTools
 , hostPlatform
 }:
@@ -26,19 +26,11 @@ in {
   src,
   # Any patches
   kernelPatches ? [],
-  # Patches for native compiling only
-  nativeKernelPatches ? [],
-  # Patches for cross compiling only
-  crossKernelPatches ? [],
-  # The native kernel .config file
+  # The kernel .config file
   configfile,
-  # The cross kernel .config file
-  crossConfigfile ? configfile,
   # Manually specified nixexpr representing the config
   # If unspecified, this will be autodetected from the .config
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
-  # Cross-compiling config
-  crossConfig ? if allowImportFromDerivation then (readConfig crossConfigfile) else config,
   # Use defaultMeta // extraMeta
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
@@ -61,8 +53,8 @@ let
 
   commonMakeFlags = [
     "O=$(buildRoot)"
-  ] ++ stdenv.lib.optionals (stdenv.platform ? kernelMakeFlags)
-    stdenv.platform.kernelMakeFlags;
+  ] ++ stdenv.lib.optionals (hostPlatform.platform ? kernelMakeFlags)
+    hostPlatform.platform.kernelMakeFlags;
 
   drvAttrs = config_: platform: kernelPatches: configfile:
     let
@@ -233,13 +225,13 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
-      } // extraMeta;
-    };
+      };
+    } // extraMeta;
 in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;
 assert stdenv.lib.versionAtLeast version "4.15" -> utillinux != null;
-stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKernelPatches) configfile) // {
+stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches configfile) // {
   name = "linux-${version}";
 
   enableParallelBuilding = true;
@@ -253,20 +245,11 @@ stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKe
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
 
   makeFlags = commonMakeFlags ++ [
-    "ARCH=${stdenv.platform.kernelArch}"
+    "HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc"
+    "ARCH=${stdenv.hostPlatform.platform.kernelArch}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
-  karch = stdenv.platform.kernelArch;
-
-  crossAttrs = let cp = hostPlatform.platform; in
-    (drvAttrs crossConfig cp (kernelPatches ++ crossKernelPatches) crossConfigfile) // {
-      makeFlags = commonMakeFlags ++ [
-        "ARCH=${cp.kernelArch}"
-        "CROSS_COMPILE=$(crossConfig)-"
-      ];
-
-      karch = cp.kernelArch;
-
-      nativeBuildInputs = optional (cp.kernelTarget == "uImage") ubootTools;
-  };
+  karch = hostPlatform.platform.kernelArch;
 })
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 4bcf6e037e0f..fd21464a2198 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty libaudit makeWrapper pkgconfig ];
-  buildInputs = [ elfutils python perl newt slang libunwind binutils zlib ] ++
+      flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
+  buildInputs = [ elfutils newt slang libunwind binutils zlib ] ++
     stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
@@ -40,6 +40,10 @@ stdenv.mkDerivation {
       "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
     ];
 
+  makeFlags = if stdenv.hostPlatform == stdenv.buildPlatform
+    then null
+    else "CROSS_COMPILE=${stdenv.cc.prefix}";
+
   installFlags = "install install-man ASCIIDOC8=1";
 
   preFixup = ''
@@ -47,15 +51,6 @@ stdenv.mkDerivation {
       --prefix PATH : "${binutils}/bin"
   '';
 
-  crossAttrs = {
-    /* I don't want cross-python or cross-perl -
-       I don't know if cross-python even works */
-    propagatedBuildInputs = [ elfutils.crossDrv newt.crossDrv ];
-    makeFlags = "CROSS_COMPILE=${stdenv.cc.targetPrefix}";
-    elfutils = elfutils.crossDrv;
-    inherit (kernel.crossDrv) src patches;
-  };
-
   meta = {
     homepage = https://perf.wiki.kernel.org/;
     description = "Linux tools to profile with performance counters";

From 50e2bb12f6385f4244a6c52bd9ba75015ead392e Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Sat, 28 Oct 2017 21:06:18 -0400
Subject: [PATCH 57/63] kernel: Use build kmod

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 187c96cd9f94..89fa3c8fa23d 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,4 +1,4 @@
-{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
+{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, openssl
 , libelf
 , utillinux
 , writeTextFile, ubootTools
@@ -97,7 +97,7 @@ let
             echo "stripping FHS paths in \`$mf'..."
             sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
         done
-        sed -i Makefile -e 's|= depmod|= ${kmod}/bin/depmod|'
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
       '';
 
       configurePhase = ''
@@ -203,7 +203,7 @@ let
         find -empty -type d -delete
 
         # Remove reference to kmod
-        sed -i Makefile -e 's|= ${kmod}/bin/depmod|= depmod|'
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '' else optionalString installsFirmware ''
         make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"

From b4b04dd29fe25ea8d690e87218c25ee222007c5b Mon Sep 17 00:00:00 2001
From: Ben Gamari <ben@smart-cactus.org>
Date: Mon, 18 Dec 2017 21:17:15 -0500
Subject: [PATCH 58/63] kernel: Fix cross-compilation

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 89fa3c8fa23d..1defd4099a61 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -236,8 +236,8 @@ stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches config
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
-      ++ optional (stdenv.platform.kernelTarget == "uImage") ubootTools
+  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr buildPackages.stdenv.cc ]
+      ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
       ;

From a09709bf2a6571838aac2a05d7bd123e7a1d4fa9 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sat, 13 Jan 2018 21:12:06 -0500
Subject: [PATCH 59/63] kernel: don't force ignoreConfigErrors when cross
 compiling, only set the default

---
 pkgs/os-specific/linux/kernel/generic.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index d1733f96c536..8ff92ac1a0aa 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -23,7 +23,8 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? hostPlatform.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc" ||
+                       hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 , hostPlatform
 , ...
@@ -58,7 +59,7 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    #inherit ignoreConfigErrors;
+    inherit ignoreConfigErrors;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
@@ -74,9 +75,6 @@ let
     preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
     arch = hostPlatform.platform.kernelArch;
 
-    # TODO(@Ericson2314): No null next hash break
-    ignoreConfigErrors = if stdenv.hostPlatform == stdenv.buildPlatform then null else true;
-
     crossAttrs = let
         cp = hostPlatform.platform;
       in {

From 285181a1db49a9b95210ac939a1b827866b0ef29 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:41:55 -0500
Subject: [PATCH 60/63] kernel: remove leftover remnants of old cross compiling
 system

---
 pkgs/os-specific/linux/kernel/generic.nix | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 8ff92ac1a0aa..816a1363921a 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -44,14 +44,12 @@ let
     netfilterRPFilter = true;
   } // features) kernelPatches;
 
-  configWithPlatform = kernelPlatform: import ./common-config.nix {
-    inherit stdenv version kernelPlatform extraConfig;
+  config = import ./common-config.nix {
+    inherit stdenv version extraConfig;
+    kernelPlatform = hostPlatform;
     features = kernelFeatures; # Ensure we know of all extra patches, etc.
   };
 
-  config = configWithPlatform stdenv.platform;
-  configCross = configWithPlatform hostPlatform.platform;
-
   kernelConfigFun = baseConfig:
     let
       configFromPatches =
@@ -75,12 +73,6 @@ let
     preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
     arch = hostPlatform.platform.kernelArch;
 
-    crossAttrs = let
-        cp = hostPlatform.platform;
-      in {
-        ignoreConfigErrors = true;
-      };
-
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
       # generate-config.pl from the generic builder can answer them.
@@ -108,9 +100,7 @@ let
   };
 
   kernel = buildLinux {
-    inherit version modDirVersion src kernelPatches stdenv extraMeta;
-
-    configfile = configfile.nativeDrv or configfile;
+    inherit version modDirVersion src kernelPatches stdenv extraMeta configfile;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };

From 92083c3f404620b1e0260946f3330848fdbc1e6b Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:47:08 -0500
Subject: [PATCH 61/63] perf: inherit makeFlags from kernel

---
 pkgs/os-specific/linux/kernel/perf.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index fd21464a2198..5f79e1b2cac6 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -11,7 +11,7 @@ assert versionAtLeast kernel.version "3.12";
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
-  inherit (kernel) src;
+  inherit (kernel) src makeFlags;
 
   preConfigure = ''
     cd tools/perf
@@ -40,10 +40,6 @@ stdenv.mkDerivation {
       "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
     ];
 
-  makeFlags = if stdenv.hostPlatform == stdenv.buildPlatform
-    then null
-    else "CROSS_COMPILE=${stdenv.cc.prefix}";
-
   installFlags = "install install-man ASCIIDOC8=1";
 
   preFixup = ''

From 80f6b8e2ba354f85b48622acf56dde86db0c4e29 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 12:55:24 -0500
Subject: [PATCH 62/63] kernel: revert seemingly incorrect change to extraMeta
 merging

---
 pkgs/os-specific/linux/kernel/manual-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1defd4099a61..6c598e50a0aa 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -225,8 +225,8 @@ let
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
-      };
-    } // extraMeta;
+      } // extraMeta;
+    };
 in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;

From 7bb3a044be38810e525cde73d591e006b2118095 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Mon, 15 Jan 2018 22:28:45 -0500
Subject: [PATCH 63/63] kernel: fix dependencies

---
 pkgs/os-specific/linux/kernel/generic.nix       | 3 ++-
 pkgs/os-specific/linux/kernel/manual-config.nix | 3 ++-
 pkgs/os-specific/linux/kernel/perf.nix          | 5 ++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 816a1363921a..e00bda692b3c 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -64,7 +64,8 @@ let
 
     kernelConfig = kernelConfigFun config;
 
-    nativeBuildInputs = [ buildPackages.stdenv.cc perl ];
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [ perl ];
 
     platformName = hostPlatform.platform.name;
     kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6c598e50a0aa..9a7e96094107 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -236,7 +236,8 @@ stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches config
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr buildPackages.stdenv.cc ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
       ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 5f79e1b2cac6..1936f6578b6f 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, libiberty, libaudit
+, libiberty, libaudit, libbfd
 , zlib, withGtk ? false, gtk2 ? null }:
 
 with lib;
@@ -21,10 +21,9 @@ stdenv.mkDerivation {
   '';
 
   # perf refers both to newt and slang
-  # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
       flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
-  buildInputs = [ elfutils newt slang libunwind binutils zlib ] ++
+  buildInputs = [ elfutils newt slang libunwind libbfd zlib ] ++
     stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a