Merge commit '2e56ba' from staging into master

pkgs/applications/misc/gnuradio/default.nix

···
     addGRCBlocksPath() {
       addToSearchPath GRC_BLOCKS_PATH $1/share/gnuradio/grc/blocks
     }
-    envHooks+=(addGRCBlocksPath)
+    addEnvHooks "$targetOffset" addGRCBlocksPath
   '';
 
   setupHook = [ grcSetupHook ];

pkgs/applications/video/gnome-mpv/default.nix

···
   '';
 
   doCheck = true;
-  checkPhase = "meson test";
 
   meta = with stdenv.lib; {
     description = "Simple GTK+ frontend for the mpv video player";

pkgs/build-support/fetchbower/default.nix

···
 
   fetchbower = name: version: target: outputHash: stdenvNoCC.mkDerivation {
     name = "${cleanName name}-${bowerVersion version}";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
     buildCommand = ''
       fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
       # In some cases, the result of fetchBower is different depending
···
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     inherit outputHash;
-    nativeBuildInputs = [ bower2nix ];
+    nativeBuildInputs = [ bower2nix cacert ];
   };
 
 in fetchbower

pkgs/build-support/fetchdarcs/default.nix

···
 else
 stdenvNoCC.mkDerivation {
   name = "fetchdarcs";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   builder = ./builder.sh;
-  nativeBuildInputs = [darcs];
+  nativeBuildInputs = [cacert darcs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";

pkgs/build-support/fetchgx/default.nix

···
   name = "${name}-gxdeps";
   inherit src;
 
-  nativeBuildInputs = [ go gx gx-go ];
+  nativeBuildInputs = [ cacert go gx gx-go ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = sha256;
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
-
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   buildPhase = ''
     export GOPATH=$(pwd)/vendor

pkgs/build-support/rust/default.nix

···
 
   patchRegistryDeps = ./patch-registry-deps;
 
-  buildInputs = [ git rust.cargo rust.rustc ] ++ buildInputs;
+  buildInputs = [ cacert git rust.cargo rust.rustc ] ++ buildInputs;
 
   configurePhase = args.configurePhase or ''
     runHook preConfigure
···
     unset cargoDepsCopy
 
     export RUST_LOG=${logLevel}
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
   '' + (args.postUnpack or "");
 
   buildPhase = with builtins; args.buildPhase or ''

pkgs/build-support/rust/fetchcargo.nix

···
         exit 1
     fi
 
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
 
     cargo vendor

pkgs/data/misc/cacert/default.nix

···
     cp -v ca-bundle.crt $out/etc/ssl/certs
   '';
 
+  setupHook = ./setup-hook.sh;
+
   meta = {
     homepage = https://curl.haxx.se/docs/caextract.html;
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";

pkgs/data/misc/cacert/setup-hook.sh

···
+cacertHook() {
+    export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
+}
+
+addEnvHooks "$targetOffset" cacertHook

pkgs/data/misc/iana-etc/default.nix

···
 
 stdenv.mkDerivation rec {
   name = "iana-etc-${version}";
-  version = "20171106";
+  version = "20180108";
 
   src = fetchurl {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "0pbmq95gdkp66cljwklv4gzh8lvl30l4k77hfwvrxz5mfqia6qdd";
+    sha256 = "1x4jacrvjwcsan88rg2wf2a8bajsglg6w4396vbr18zh0sya84a2";
   };
 
   installPhase = ''

pkgs/data/misc/tzdata/tzdata-setup-hook.sh

···
     export TZDIR=@out@/share/zoneinfo
 }
 
-envHooks+=(tzdataHook)
-crossEnvHooks+=(tzdataHook)
+addEnvHooks "$targetOffset" tzdataHook

pkgs/desktops/gnome-3/apps/bijiben/default.nix

···
   inherit (import ./src.nix fetchurl) name src;
 
   doCheck = true;
-  checkPhase = "meson test";
 
   patches = [
     ./no-update-icon-cache.patch

pkgs/desktops/gnome-3/apps/gnome-clocks/default.nix

···
 
   prePatch = "patchShebangs build-aux/";
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Clocks;
     description = "Clock application designed for GNOME 3";

pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix

···
-{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib
-, gettext, gobjectIntrospection
-}:
+{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib, gettext }:
 
 stdenv.mkDerivation rec {
   name = "nautilus-sendto-${version}";
···
     sha256 = "164d7c6e8bae29c4579bcc67a7bf50d783662b1545b62f3008e7ea3c0410e04d";
   };
 
-  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext ];
   buildInputs = [ glib ];
 
   meta = with stdenv.lib; {

pkgs/desktops/gnome-3/core/gnome-dictionary/default.nix

···
                         desktop_file_utils appstream-glib libxslt docbook_xsl docbook_xml_dtd_43];
   buildInputs = [ gtk glib gnome3.gsettings_desktop_schemas ];
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Dictionary;
     description = "Dictionary is the GNOME application to look up definitions";

pkgs/desktops/gnome-3/core/gnome-font-viewer/default.nix

···
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gettext wrapGAppsHook libxml2 ];
   buildInputs = [ gtk3 glib gnome3.gnome_desktop gnome3.defaultIconTheme ];
 

pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix

···
 { stdenv, gettext, libxml2, fetchurl, pkgconfig, libcanberra_gtk3
 , bash, gtk3, glib, meson, ninja, wrapGAppsHook, appstream-glib
-, gnome3, librsvg, gdk_pixbuf, gobjectIntrospection }:
+, gnome3, librsvg, gdk_pixbuf }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
-
   postPatch = ''
     chmod +x build-aux/postinstall.py # patchShebangs requires executable file
     patchShebangs build-aux/postinstall.py
···
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
   propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2
-                        wrapGAppsHook gobjectIntrospection ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2 wrapGAppsHook ];
   buildInputs = [ bash gtk3 glib libcanberra_gtk3
                   gnome3.gsettings_desktop_schemas ];
 

pkgs/desktops/gnome-3/core/libgepub/default.nix

···
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   nativeBuildInputs = [ meson ninja pkgconfig gobjectIntrospection ];
   buildInputs = [ glib webkitgtk libsoup libxml2 libarchive ];
 

pkgs/desktops/gnome-3/core/simple-scan/default.nix

···
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     description = "Simple scanning utility";
     longDescription = ''

pkgs/desktops/gnome-3/core/totem/default.nix

···
 
   propagatedBuildInputs = [ gobjectIntrospection python3Packages.pylint python3Packages.pygobject2 ];
 
-  checkPhase = "meson test";
-
   patches = [
     (fetchurl {
       name = "remove-pycompile.patch";

pkgs/development/compilers/go/1.7.nix

···
 
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch ];
-  buildInputs = [ pcre ];
+  buildInputs = [ cacert pcre ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
···
         sha256 = "1ny5l3f8a9dpjjrnjnsplb66308a0x13sa0wwr4j6yrkc8j4qxqi";
       })
     ];
-
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"

pkgs/development/compilers/go/1.8.nix

···
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
···
     echo "substitute hardcoded dsymutil with ${llvm}/bin/llvm-dsymutil"
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
-
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"

pkgs/development/compilers/go/1.9.nix

···
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
···
     echo "substitute hardcoded dsymutil with ${llvm}/bin/llvm-dsymutil"
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
-
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"

pkgs/development/compilers/llvm/3.8/clang/default.nix

···
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
···
       ln -sv ${llvm}/lib/LLVMgold.so $out/lib
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
 
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
···
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {

pkgs/development/compilers/llvm/3.8/default.nix

···
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {

pkgs/development/compilers/llvm/3.9/clang/default.nix

···
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
···
       ln -sv ${llvm}/lib/LLVMgold.so $out/lib
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
+
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
 
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
···
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {

pkgs/development/compilers/llvm/3.9/default.nix

···
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {

pkgs/development/compilers/llvm/4/clang/default.nix

···
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
···
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
···
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {

pkgs/development/compilers/llvm/4/default.nix

···
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 

pkgs/development/compilers/llvm/5/clang/default.nix

···
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
···
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
···
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {

pkgs/development/compilers/llvm/5/default.nix

···
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 

pkgs/development/compilers/rust/cargo.nix

···
   passthru.rustc = rustc;
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ file curl python openssl cmake zlib makeWrapper libgit2 ]
+  buildInputs = [ cacert file curl python openssl cmake zlib makeWrapper libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv ];
 
   LIBGIT2_SYS_USE_PKG_CONFIG=1;
···
   '';
 
   checkPhase = ''
-    # Export SSL_CERT_FILE as without it one test fails with SSL verification error
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     # Disable cross compilation tests
     export CFG_DISABLE_CROSS_TESTS=1
     cargo test

pkgs/development/interpreters/erlang/R16B02-basho.nix

···
     tar xf "${manpages}" -C "$out/lib/erlang"
     for i in "$out"/lib/erlang/man/man[0-9]/*.[0-9]; do
       prefix="''${i%/*}"
-      ensureDir "$out/share/man/''${prefix##*/}"
+      mkdir -p "$out/share/man/''${prefix##*/}"
       ln -s "$i" "$out/share/man/''${prefix##*/}/''${i##*/}erl"
     done
   '';

pkgs/development/libraries/boehm-gc/default.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.6.0";
+  name = "boehm-gc-${version}";
+  version = "7.6.2";
 
   src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.6.0.tar.gz;
-    sha256 = "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1";
+    urls = [
+      "http://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
+      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
+    ];
+    sha256 = "07nli9hgdzc09qzw169sn7gchkrn5kqgyniv2rspcy1xaq2j04dx";
   };
 
   buildInputs = [ libatomic_ops ];
···
 
   # Don't run the native `strip' when cross-compiling.
   dontStrip = hostPlatform != buildPlatform;
-
-  postInstall =
-    ''
-      mkdir -p $out/share/doc
-      mv $out/share/gc $out/share/doc/gc
-    '';
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/dleyna-core/setup-hook.sh

···
     fi
 }
 
-envHooks+=(addDleynaConnectorPath)
-
+addEnvHooks "$targetOffset" addDleynaConnectorPath

pkgs/development/libraries/gdbm/default.nix

···
 { stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.13";
+  name = "gdbm-1.14";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "0lx201q20dvc70f8a3c9s7s18z15inlxvbffph97ngvrgnyjq9cx";
+    sha256 = "02dakgrq93xwgln8qfv3vs5jyz5yvds5nyzkx6rhg9v585x478dd";
   };
 
   doCheck = true; # not cross;

pkgs/development/libraries/gettext/gettext-setup-hook.sh

···
     fi
 }
 
-envHooks+=(gettextDataDirsHook)
+addEnvHooks "$hostOffset" gettextDataDirsHook

pkgs/development/libraries/glib/setup-hook.sh

···
 glibPreInstallPhase() {
   installFlagsArray+=("gsettingsschemadir=${!outputLib}/share/gsettings-schemas/$name/glib-2.0/schemas/")
 }
-preInstallPhases+=(glibPreInstallPhase)
+preInstallPhases+=" glibPreInstallPhase"
 
 glibPreFixupPhase() {
     # Move gschemas in case the install flag didn't help
···
 
     addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name"
 }
-preFixupPhases+=(glibPreFixupPhase)
-
+preFixupPhases+=" glibPreFixupPhase"

pkgs/development/libraries/glibc/common.nix

···
 
 let
   version = "2.26";
-  patchSuffix = "-115";
+  patchSuffix = "-131";
   sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
···
       */
       ./2.26-75.patch.gz
       ./2.26-75to115.diff.gz
+      # contains fix for CVE-2018-1000001 as the last commit:
+      # https://sourceware.org/git/?p=glibc.git;a=commit;h=fabef2edbc
+      ./2.26-115to131.diff.gz
 
       /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
···
         and we lose early mismatch detection on 2.6.32.
 
         On major glibc updates we should check that the patched kernel supports
-        all the required features.  ATM it's verified up to glibc-2.26-115.
+        all the required features.  ATM it's verified up to glibc-2.26-131.
         # HOWTO: check glibc sources for changes in kernel requirements
         git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
         # get kernel sources (update the URL)

pkgs/development/libraries/json-glib/default.nix

···
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = http://live.gnome.org/JsonGlib;
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";

pkgs/development/libraries/libatomic_ops/default.nix

···
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.0";
+  version = "7.6.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 ="03ylfr29g9zc0r6b6axz3i68alj5qmxgzknxwam3jlx0sz8hcb4f";
+    sha256 ="1rif2hjscq5mh639nsnjhb90c01gnmy1sbmj6x6hsn1xmpnj95r1";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isCygwin [ autoconf automake libtool ];

pkgs/development/libraries/libinput/default.nix

···
 
   doCheck = testsSupport;
 
-  checkPhase = "meson test";
-
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
     homepage    = http://www.freedesktop.org/wiki/Software/libinput;

pkgs/development/python-modules/aniso8601/default.nix

···
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.3.0";
+  version = "2.0.0";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
···
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3b5246f5601b6ae5671911bc4ee5b3e3fe94752e8afab5ce074d8b1232952f1";
+    sha256 = "085786415d3550e89785ffbedaa9bb37d41de0707a1268bdbba11249064b71d1";
   };
 }

pkgs/development/python-modules/argon2_cffi/default.nix

···
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "16.3.0";
+  version = "18.1.0";
   name    = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ap3il3j1pjyprrhpfyhc21izpmhzhfb5s69vlzc65zvd1nj99cr";
+    sha256 = "7e4b75611b73f53012117ad21cdde7a17b32d1e99ff6799f22d827eb83a2a59b";
   };
 
   propagatedBuildInputs = [ cffi six ];

pkgs/development/python-modules/backports_lzma/default.nix

···
 
 buildPythonPackage rec {
   pname = "backports.lzma";
-  version = "0.0.8";
+  version = "0.0.9";
 
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "200584ad5079d8ca6b1bfe14890c7be58666ab0128d8ca26cfb2669b476085f3";
+    sha256 = "9ba5d94214a79900ee297a594b8e154cd8e4a54d26eb06243c0e2f3ad5286539";
   };
 
   buildInputs = [ lzma ];

pkgs/development/python-modules/bootstrapped-pip/default.nix

···
   };
   setuptools_source = fetchPypi {
     pname = "setuptools";
-    version = "38.2.5";
+    version = "38.4.0";
     format = "wheel";
-    sha256 = "bcf0d4f3e2f7890e658db11e218b8643afffb905a0e2f2a7d5a6a3e949bb87e6";
+    sha256 = "155c2ec9fdcc00c3973d966b416e1cf3a1e7ce75f4c09fb760b23f94b935926e";
   };
 
   # TODO: Shouldn't be necessary anymore for pip > 9.0.1!

pkgs/development/python-modules/cytoolz/default.nix

···
   checkInputs = [ nose ];
   propagatedBuildInputs = [ toolz ];
 
+  # File as accidentally included in release
+  # See https://github.com/pytoolz/cytoolz/issues/116#issuecomment-355770073
+  postPatch = ''
+    rm cytoolz/tests/test_curried_doctests.py
+  '';
+
   # Disable failing test https://github.com/pytoolz/cytoolz/issues/97
   checkPhase = ''
     NOSE_EXCLUDE=test_curried_exceptions nosetests -v $out/${python.sitePackages}

pkgs/development/python-modules/daphne/default.nix

···
 buildPythonPackage rec {
   pname = "daphne";
   name = "${pname}-${version}";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xmmjp21m1w88ljsgnkf6cbzw5nxamh9cfmfgzxffpn4cdmvn96i";
+    sha256 = "302725f223853b05688f28c361e050f8db9568b1ce27340c76272c26b49e6d72";
   };
 
   buildInputs = [ hypothesis ];

pkgs/development/python-modules/datashape/default.nix

···
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
 , mock
 , numpy
···
 , dateutil
 }:
 
-buildPythonPackage rec {
+let
+  # Fetcher function looks similar to fetchPypi.
+  # Allows for easier overriding, without having to know
+  # how the source is actually fetched.
+  fetcher = {pname, version, sha256}: fetchFromGitHub {
+    owner = "blaze";
+    repo = pname;
+    rev = version;
+    inherit sha256;
+  };
+
+in buildPythonPackage rec {
   pname = "datashape";
-  version = "0.5.2";
-  name = "${pname}-${version}";
+  version = "0.5.4";
 
-  src = fetchPypi {
+  src = fetcher {
     inherit pname version;
-    sha256 = "2356ea690c3cf003c1468a243a9063144235de45b080b3652de4f3d44e57d783";
+    sha256 = "0rhlj2kjj1vx5m73wnc5518rd6cs1zsbgpsvzk893n516k69shcf";
   };
 
   checkInputs = [ pytest mock ];

pkgs/development/python-modules/dyn/default.nix

···
 
 buildPythonPackage rec {
   pname = "dyn";
-  version = "1.8.0";
+  version = "1.8.1";
   name  = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ab3cd9a1478674cf2d2aa6740fb0ddf77daaa9ab3e35e5d2bc92f60301f8523";
+    sha256 = "e112149d48b4500c18b3cfb6e0e6e780bb5aa0e56ff87cac412280200b9ec8bf";
   };
 
   buildInputs = [ glibcLocales ];

pkgs/development/python-modules/filelock/default.nix

···
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "2.0.14";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ee355eb66e4c2e5d95689e1253515aad5b3177c274abdd00a57d5ab1aa6d071a";
+    sha256 = "b3ad481724adfb2280773edd95ce501e497e88fa4489c6e41e637ab3fd9a456c";
   };
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/grpcio/default.nix

···
 
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ea1336f0d1158c4e00e96a94df84b75f6bbff9816abb6cc68cbdc9442a9ac55";
+    sha256 = "6ce5fd3093ddc09a152981d5c477ac645eda19dfcc819e45d8c57da6b743bd53";
   };
 
   propagatedBuildInputs = [ six protobuf ]

pkgs/development/python-modules/jupyter_client/default.nix

···
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca30cf1786047925ebacd6f6faa3a993efaa004b584f7d83bc8b807f7cd3f6bb";
+    sha256 = "462790d46b244f0a631ea5e3cd5cdbad6874d5d24cc0ff512deb7c16cdf8653d";
   };
 
   checkInputs = [ ipykernel ipython mock pytest ];
···
   checkPhase = ''
     py.test
   '';
-
-  patches = [
-    ./wheel_workaround.patch
-  ];
 
   # Circular dependency with ipykernel
   doCheck = false;

pkgs/development/python-modules/jupyter_client/wheel_workaround.patch

···
-diff --git a/setup.py b/setup.py
-index 95d4774..ee72cbc 100644
---- a/setup.py
-+++ b/setup.py
-@@ -86,7 +86,7 @@ setup_args = dict(
-     extras_require   = {
-         'test': ['ipykernel', 'ipython', 'mock'],
-         'test:python_version == "3.3"': ['pytest<3.3.0'],
--        'test:python_version >= "3.4" or python_version == "2.7"': ['pytest'],
-+        'test:(python_version >= "3.4" or python_version == "2.7")': ['pytest'],
-     },
-     cmdclass         = {
-         'bdist_egg': bdist_egg if 'bdist_egg' in sys.argv else bdist_egg_disabled,

pkgs/development/python-modules/pillow/default.nix

···
-{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
-  nose, olefile,
-  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy
+, olefile
+, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, pytestrunner
+, pytest
+}:
 buildPythonPackage rec {
   pname = "Pillow";
-  version = "4.3.0";
+  version = "5.0.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a97c715d44efd5b4aa8d739b8fad88b93ed79f1b33fc2822d5802043f3b1b527";
+    sha256 = "12f29d6c23424f704c66b5b68c02fe0b571504459605cfe36ab8158359b0e1bb";
   };
 
   doCheck = !stdenv.isDarwin && !isPyPy;
···
 
   propagatedBuildInputs = [ olefile ];
 
+  checkInputs = [ pytest pytestrunner ];
+
   buildInputs = [
-    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
     ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
 
   # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.

pkgs/development/python-modules/psutil/default.nix

···
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.4.2";
+  version = "5.4.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00a1f9ff8d1e035fba7bfdd6977fa8ea7937afdb4477339e5df3dba78194fe11";
+    sha256 = "e2467e9312c2fa191687b89ff4bc2ad8843be4af6fb4dc95a7cc5f7d7a327b18";
   };
 
   # No tests in archive

pkgs/development/python-modules/pwntools/default.nix

···
 , requests, tox, pandoc, unicorn, intervaltree }:
 
 buildPythonPackage rec {
-  version = "3.10.0";
+  version = "3.11.0";
   pname = "pwntools";
   name = pname + "-" + version;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1l8hb30mwxqd1y7r5ihd7kzmjm2mz6m5aiphd3hwzmxkmxbxj8zk";
+    sha256 = "609b3f0ba47c975f4dbedd3da2af4c5ca1b3a2aa13fb99240531b6a68edb87be";
   };
 
   propagatedBuildInputs = [ Mako packaging pysocks pygments ROPGadget capstone paramiko pip psutil pyelftools pypandoc pyserial dateutil requests tox pandoc unicorn intervaltree ];

pkgs/development/python-modules/pytest/default.nix

···
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k
 }:
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "3.3.2";
   pname = "pytest";
 
   preCheck = ''
···
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf8436dc59d8695346fcd3ab296de46425ecab00d64096cebe79fb51ecb2eb93";
+    sha256 = "53548280ede7818f4dc2ad96608b9f08ae2cc2ca3874f2ceb6f97e3583f25bc4";
   };
 
   checkInputs = [ hypothesis ];

pkgs/development/python-modules/python-stdnum/default.nix

···
 { lib, fetchurl, buildPythonPackage, isPy3k }:
 
 buildPythonPackage rec {
-  version = "1.7";
+  version = "1.8.1";
   pname = "python-stdnum";
   name = "${pname}-${version}";
   # Failing tests and dependency issue on Py3k
   disabled = isPy3k;
   src = fetchurl {
     url = "mirror://pypi/p/python-stdnum/${name}.tar.gz";
-    sha256 = "987c25e1047e8742131bcf29dac7a406987adb1463465749e2daaba8cb19d264";
+    sha256 = "d7162fdb29337aebed65700cc7297016f6cd32cae4ad7aed8f7e7531f0217943";
   };
   meta = {
     homepage = http://arthurdejong.org/python-stdnum/;

pkgs/development/python-modules/ropper/default.nix

···
 
 buildPythonApplication rec {
   pname = "ropper";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2183feedfe8b01a27301eee07383b481ece01b2319bdba3afebe33e19ca14aa3";
+    sha256 = "77d9b03083d0a098261a1d2856cd330ea3db520511a78472e421a00526aa220c";
   };
   # XXX tests rely on user-writeable /dev/shm to obtain process locks and return PermissionError otherwise
   # workaround: sudo chmod 777 /dev/shm

pkgs/development/python-modules/setuptools/default.nix

···
 # Should use buildPythonPackage here somehow
 stdenv.mkDerivation rec {
   pname = "setuptools";
-  version = "38.2.5";
+  version = "38.4.0";
   name = "${python.libPrefix}-${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b080f276cc868670540b2c03cee06cc14d2faf9da7bec0f15058d1b402c94507";
+    sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
   };
 
   buildInputs = [ python wrapPython unzip ];

pkgs/development/python-modules/sqlmap/default.nix

···
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.1.12";
+  version = "1.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "86a1078ceb1e79f891633c7e4c7b07949fd9135a0e4c0738abd5111e2e6b96c0";
+    sha256 = "18ac6392a710f0cc106c28c4e27e43e8f1b25cb46fb8b6714836212607c07b10";
   };
 
   # No tests in archive

pkgs/development/python-modules/texttable/default.nix

···
 
 buildPythonPackage rec {
   pname = "texttable";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "44674d1d470a9fc264c4d1eba44b74463ca0066d7b954453dd5a4f8057779c9c";
+    sha256 = "c89dc0148ae29645917aab7e970a30d1af565b3ca276cef8ab1a60469f0d8100";
   };
 
   meta = {

pkgs/development/python-modules/tornado/default.nix

···
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "4.5.2";
+  version = "4.5.3";
   name = "${pname}-${version}";
 
   propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
···
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fb8e494cd46c674d86fac5885a3ff87b0e283937a47d74eb3c02a48c9e89ad0";
+    sha256 = "6d14e47eab0e15799cf3cdcc86b0b98279da68522caace2bd7ce644287685f0a";
   };
 }

pkgs/development/python-modules/typeguard/default.nix

···
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "typeguard";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l3pih5ca469v7if255h5rqymirsw46bi6s7p885jxhq1gv6cfpk";
+    sha256 = "40b22d18d2215b76b3ddda2564acfbddfa6e702968637fbd969187c2a6fb99da";
   };
 
   buildInputs = [ setuptools_scm ];

pkgs/development/python-modules/unidecode/default.nix

···
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "Unidecode";
-  version = "0.04.21";
+  version = "1.0.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lfhp9c5xrbpjvbpr12ji52g1lx04404bzzdg6pvabhzisw6l2i8";
+    sha256 = "8c33dd588e0c9bc22a76eaa0c715a5434851f726131bd44a6c26471746efabf5";
   };
 
   LC_ALL="en_US.UTF-8";

pkgs/development/python-modules/zeep/default.nix

···
 
 let
   pname = "zeep";
-  version = "2.4.0";
+  version = "2.5.0";
 in buildPythonPackage {
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8631e2735c5f2219eb18ca4f0615ae482455628518508f69c3690dbfb8238aee";
+    sha256 = "4f9db52c7d269813fc6251da4cb050869158858aeea75a055b4550f19e52ac84";
   };
 
   propagatedBuildInputs = [

pkgs/development/r-modules/default.nix

···
 { R, pkgs, overrides }:
 
 let
-  inherit (pkgs) fetchurl stdenv lib;
+  inherit (pkgs) cacert fetchurl stdenv lib;
 
   buildRPackage = pkgs.callPackage ./generic-builder.nix {
     inherit R;
···
     });
 
     geojsonio = old.geojsonio.overrideDerivation (attrs: {
-      preConfigure = ''
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        '';
+      buildInputs = [ cacert ] ++ attrs.buildInputs;
     });
 
     rstan = old.rstan.overrideDerivation (attrs: {

pkgs/development/tools/build-managers/cmake/setup-hook.sh

···
     # libraries are in a system path or in the same directory as the
     # executable. This flag makes the shared library accessible from its
     # nix/store directory.
-    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=$prefix/lib $cmakeFlags"
+    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_INCLUDEDIR=${!outputDev}/include $cmakeFlags"
 

pkgs/development/tools/build-managers/meson/setup-hook.sh

···
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
+
+mesonCheckPhase() {
+    runHook preCheck
+
+    meson test
+
+    runHook postCheck
+}
+
+if [ -z "$dontUseMesonCheck" -a -z "$checkPhase" ]; then
+    checkPhase=mesonCheckPhase
+fi

pkgs/os-specific/linux/apparmor/default.nix

···
 }:
 
 let
-  apparmor-series = "2.10";
-  apparmor-version = apparmor-series;
+
+  apparmor-series = "2.12";
+  apparmor-patchver = "0";
+  apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
     homepage = http://apparmor.net/;
···
   };
 
   apparmor-sources = fetchurl {
-    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "1x06qmmbha9krx7880pxj2k3l8fxy3nm945xjjv735m2ax1243jd";
+    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-series}.tar.gz";
+    sha256 = "0mm0mcp0w18si9wl15drndysm7v27az2942p1xjd197shg80qawa";
   };
 
   prePatchCommon = ''
···
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${pythonPackages.python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-exec aa-notify ; do
+      for prog in aa-notify ; do
         wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
       done
     '';

pkgs/os-specific/linux/bluez/default.nix

···
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.47";
+  name = "bluez-5.48";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1j22hfjz0fp4pgclgz9mfcwjbr4wqgah3gd2qhfg4r6msmybyxfg";
+    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
+    [ dbus-python pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs = [
     pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython

pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix

···
     # traffic, so don't do that.
     preferLocalBuild = true;
 
-    nativeBuildInputs = [ git gnupg ];
-    NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    nativeBuildInputs = [ cacert git gnupg ];
   } ''
     git init src && (
       cd src

pkgs/os-specific/linux/kernel/common-config.nix

···
 
   # Bump the maximum number of CPUs to support systems like EC2 x1.*
   # instances and Xeon Phi.
-  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
+  ${optionalString (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") ''
     NR_CPUS 384
   ''}
 
···
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
-  ${if versionOlder version "3.14" then ''
-    CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
-  '' else ''
-    CC_STACKPROTECTOR_REGULAR? y
-  ''}
+  ${optionalString (! stdenv.hostPlatform.isArm)
+    (if versionOlder version "3.14" then ''
+        CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
+      '' else ''
+        CC_STACKPROTECTOR_REGULAR? y
+      '')}
   ${optionalString (versionAtLeast version "3.12") ''
     USER_NS y # Support for user namespaces
   ''}

pkgs/os-specific/linux/kernel/generic.nix

···
-{ stdenv, perl, buildLinux
+{ stdenv, buildPackages, perl, buildLinux
 
 , # The kernel source tarball.
   src
···
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc" ||
+                       hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 , hostPlatform
 , ...
···
     netfilterRPFilter = true;
   } // features) kernelPatches;
 
-  configWithPlatform = kernelPlatform: import ./common-config.nix {
-    inherit stdenv version kernelPlatform extraConfig;
+  config = import ./common-config.nix {
+    inherit stdenv version extraConfig;
+    kernelPlatform = hostPlatform;
     features = kernelFeatures; # Ensure we know of all extra patches, etc.
   };
-
-  config = configWithPlatform stdenv.platform;
-  configCross = configWithPlatform hostPlatform.platform;
 
   kernelConfigFun = baseConfig:
     let
···
 
     kernelConfig = kernelConfigFun config;
 
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl ];
 
-    platformName = stdenv.platform.name;
-    kernelBaseConfig = stdenv.platform.kernelBaseConfig;
-    kernelTarget = stdenv.platform.kernelTarget;
-    autoModules = stdenv.platform.kernelAutoModules;
-    preferBuiltin = stdenv.platform.kernelPreferBuiltin or false;
-    arch = stdenv.platform.kernelArch;
-
-    crossAttrs = let
-        cp = hostPlatform.platform;
-      in {
-        arch = cp.kernelArch;
-        platformName = cp.name;
-        kernelBaseConfig = cp.kernelBaseConfig;
-        kernelTarget = cp.kernelTarget;
-        autoModules = cp.kernelAutoModules;
-
-        # Just ignore all options that don't apply (We are lazy).
-        ignoreConfigErrors = true;
-
-        kernelConfig = kernelConfigFun configCross;
-
-        inherit (kernel.crossDrv) src patches preUnpack;
-      };
+    platformName = hostPlatform.platform.name;
+    kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
+    kernelTarget = hostPlatform.platform.kernelTarget;
+    autoModules = hostPlatform.platform.kernelAutoModules;
+    preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
+    arch = hostPlatform.platform.kernelArch;
 
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
···
       cd $buildRoot
 
       # Get a basic config file for later refinement with $generateConfig.
-      make -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
+      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
 
       # Create the config file.
       echo "generating kernel configuration..."
···
   };
 
   kernel = buildLinux {
-    inherit version modDirVersion src kernelPatches stdenv extraMeta;
-
-    configfile = configfile.nativeDrv or configfile;
-
-    crossConfigfile = configfile.crossDrv or configfile;
+    inherit version modDirVersion src kernelPatches stdenv extraMeta configfile;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-
-    crossConfig = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };
 
   passthru = {
···
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
   };
 
-  addPassthru' = lib.extendDerivation true passthru;
-
-  nativeDrv = addPassthru' kernel.nativeDrv;
-
-  crossDrv = addPassthru' kernel.crossDrv;
-
-in if kernel ? crossDrv
-   then nativeDrv // { inherit nativeDrv crossDrv; }
-   else addPassthru' kernel
+in lib.extendDerivation true passthru kernel

pkgs/os-specific/linux/kernel/linux-4.13.nix

···
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.13.16";

pkgs/os-specific/linux/kernel/linux-4.14.nix

···
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 

pkgs/os-specific/linux/kernel/linux-4.4.nix

···
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.4.111";

pkgs/os-specific/linux/kernel/linux-4.9.nix

···
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.9.76";

pkgs/os-specific/linux/kernel/linux-beagleboard.nix

···
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.61";

pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix

···
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 

pkgs/os-specific/linux/kernel/linux-mptcp.nix

···
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (rec {
   mptcpVersion = "0.93";

pkgs/os-specific/linux/kernel/linux-rpi.nix

···
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.59";

pkgs/os-specific/linux/kernel/linux-samus-4.12.nix

···
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.12.2";

pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix

···
-{ stdenv, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.11.2017.08.23";

pkgs/os-specific/linux/kernel/linux-testing.nix

···
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 import ./generic.nix (args // rec {
   version = "4.15-rc8";

pkgs/os-specific/linux/kernel/manual-config.nix

···
-{ runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
-, libelf ? null
-, utillinux ? null
+{ buildPackages, runCommand, nettools, bc, perl, gmp, libmpc, mpfr, openssl
+, libelf
+, utillinux
 , writeTextFile, ubootTools
 , hostPlatform
 }:
···
   src,
   # Any patches
   kernelPatches ? [],
-  # Patches for native compiling only
-  nativeKernelPatches ? [],
-  # Patches for cross compiling only
-  crossKernelPatches ? [],
-  # The native kernel .config file
+  # The kernel .config file
   configfile,
-  # The cross kernel .config file
-  crossConfigfile ? configfile,
   # Manually specified nixexpr representing the config
   # If unspecified, this will be autodetected from the .config
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
-  # Cross-compiling config
-  crossConfig ? if allowImportFromDerivation then (readConfig crossConfigfile) else config,
   # Use defaultMeta // extraMeta
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
···
 
   commonMakeFlags = [
     "O=$(buildRoot)"
-  ] ++ stdenv.lib.optionals (stdenv.platform ? kernelMakeFlags)
-    stdenv.platform.kernelMakeFlags;
+  ] ++ stdenv.lib.optionals (hostPlatform.platform ? kernelMakeFlags)
+    hostPlatform.platform.kernelMakeFlags;
 
   drvAttrs = config_: platform: kernelPatches: configfile:
     let
···
             echo "stripping FHS paths in \`$mf'..."
             sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
         done
-        sed -i Makefile -e 's|= depmod|= ${kmod}/bin/depmod|'
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
       '';
 
       configurePhase = ''
···
         find -empty -type d -delete
 
         # Remove reference to kmod
-        sed -i Makefile -e 's|= ${kmod}/bin/depmod|= depmod|'
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '' else optionalString installsFirmware ''
         make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"
···
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;
 assert stdenv.lib.versionAtLeast version "4.15" -> utillinux != null;
-stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKernelPatches) configfile) // {
+stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches configfile) // {
   name = "linux-${version}";
 
   enableParallelBuilding = true;
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
-      ++ optional (stdenv.platform.kernelTarget == "uImage") ubootTools
+      ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
       ;
···
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
 
   makeFlags = commonMakeFlags ++ [
-    "ARCH=${stdenv.platform.kernelArch}"
+    "HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc"
+    "ARCH=${stdenv.hostPlatform.platform.kernelArch}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
-  karch = stdenv.platform.kernelArch;
-
-  crossAttrs = let cp = hostPlatform.platform; in
-    (drvAttrs crossConfig cp (kernelPatches ++ crossKernelPatches) crossConfigfile) // {
-      makeFlags = commonMakeFlags ++ [
-        "ARCH=${cp.kernelArch}"
-        "CROSS_COMPILE=$(crossConfig)-"
-      ];
-
-      karch = cp.kernelArch;
-
-      nativeBuildInputs = optional (cp.kernelTarget == "uImage") ubootTools;
-  };
+  karch = hostPlatform.platform.kernelArch;
 })

pkgs/os-specific/linux/kernel/perf.nix

···
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, libiberty, libaudit
+, libiberty, libaudit, libbfd
 , zlib, withGtk ? false, gtk2 ? null }:
 
 with lib;
···
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
-  inherit (kernel) src;
+  inherit (kernel) src makeFlags;
 
   preConfigure = ''
     cd tools/perf
···
   '';
 
   # perf refers both to newt and slang
-  # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty libaudit makeWrapper pkgconfig ];
-  buildInputs = [ elfutils python perl newt slang libunwind binutils zlib ] ++
+      flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
+  buildInputs = [ elfutils newt slang libunwind libbfd zlib ] ++
     stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
···
     wrapProgram $out/bin/perf \
       --prefix PATH : "${binutils}/bin"
   '';
-
-  crossAttrs = {
-    /* I don't want cross-python or cross-perl -
-       I don't know if cross-python even works */
-    propagatedBuildInputs = [ elfutils.crossDrv newt.crossDrv ];
-    makeFlags = "CROSS_COMPILE=${stdenv.cc.targetPrefix}";
-    elfutils = elfutils.crossDrv;
-    inherit (kernel.crossDrv) src patches;
-  };
 
   meta = {
     homepage = https://perf.wiki.kernel.org/;

pkgs/servers/x11/xorg/overrides.nix

···
           "--with-sha1=CommonCrypto"
         ];
         preConfigure = ''
-          ensureDir $out/Applications
+          mkdir -p $out/Applications
           export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
           substituteInPlace hw/xquartz/pbproxy/Makefile.in --replace -F/System -F${args.apple_sdk.frameworks.ApplicationServices}
         '';

pkgs/stdenv/darwin/default.nix

···
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
       bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped patch pcre.out gettext
+      gnugrep llvmPackages.clang-unwrapped llvmPackages.clang-unwrapped.lib patch pcre.out gettext
       binutils-raw.bintools binutils binutils.bintools
       cc.expand-response-params
     ]) ++ (with pkgs.darwin; [

pkgs/stdenv/generic/setup.sh

···
     addToSearchPathWithCustomDelimiter "${PATH_DELIMITER}" "$@"
 }
 
-
-ensureDir() {
-    echo "warning: ‘ensureDir’ is deprecated; use ‘mkdir’ instead" >&2
-    local dir
-    for dir in "$@"; do
-        if ! [ -x "$dir" ]; then mkdir -p "$dir"; fi
-    done
-}
-
-
 # Add $1/lib* into rpaths.
 # The function is used in multiple-outputs.sh hook,
 # so it is defined here but tried after the hook.

pkgs/tools/archivers/sharutils/default.nix

···
     in ''
       substituteInPlace tests/shar-1 --replace '${shar_sub}' '${shar_sub} -s submitter'
       substituteInPlace tests/shar-2 --replace '${shar_sub}' '${shar_sub} -s submitter'
+
+      substituteInPlace intl/Makefile.in --replace "AR = ar" ""
     '';
 
   doCheck = true;

pkgs/tools/compression/brotli/default.nix

···
   # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
   prePatch = "rm BUILD";
 
-  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
-    cmakeFlagsArray+=("-DCMAKE_INSTALL_NAME_DIR=$lib/lib")
-  '';
-
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
 

pkgs/tools/filesystems/e2fsprogs/default.nix

···
 { stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "e2fsprogs-1.43.7";
+  name = "e2fsprogs-1.43.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/e2fsprogs/${name}.tar.gz";
-    sha256 = "1i51w5l45zhz3i98k92xbbvkqklvjrvw3zvqky3gk9cdmqp5y0w7";
+    sha256 = "1pn33rap3lcjm3gx07pmgyhx4j634gja63phmi4g5dq8yj0z8ciz";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];

pkgs/tools/networking/bud/default.nix

···
   buildInputs = [
     python gyp
   ] ++ lib.optional stdenv.isLinux utillinux;
- 
+
   buildPhase = ''
     python ./gyp_bud -f make
     make -C out
   '';
 
   installPhase = ''
-    ensureDir $out/bin
+    mkdir -p $out/bin
     cp out/Release/bud $out/bin
   '';
 

pkgs/top-level/all-packages.nix

···
 
   ncurses5 = callPackage ../development/libraries/ncurses { abiVersion = "5"; };
   ncurses6 = callPackage ../development/libraries/ncurses { abiVersion = "6"; };
-  ncurses = if stdenv.isDarwin then ncurses5 else ncurses6;
+  ncurses = ncurses6;
 
   neardal = callPackage ../development/libraries/neardal { };