Merge branch 'staging'

There are some Darwin regressions and a mysterious Lisp issue, but also a security update of curl...
2018-02-03 10:56:07 +01:00 · 2018-02-03 10:56:07 +01:00 · dd57c63793
commit dd57c63793
parent 84fb5c6a0d 55e0f12761
68 changed files with 438 additions and 161 deletions
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -69,7 +69,6 @@ in
          [ (self: super: {
              openssh = super.openssh.override {
                hpnSupport = true;
-                withKerberos = true;
                kerberos = self.libkrb5;
              };
            };
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
    sha256 = "0irh9b4haz0pzzxrb4hwcss91a0xb499kjrcrmr2s59p3zq8bbd9";
  };

-  buildInputs = [ gmp cmake ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ gmp ];
  enableParallelBuilding = true;

  preConfigure = ''
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@ -41,7 +41,6 @@ with luaPackages; stdenv.mkDerivation rec {
  #cmakeFlags = "-DGENERATE_MANPAGES=ON";
  cmakeFlags = "-DOVERRIDE_VERSION=${version}";

-  LD_LIBRARY_PATH = "${stdenv.lib.makeLibraryPath [ cairo pango gobjectIntrospection ]}";
  GI_TYPELIB_PATH = "${pango.out}/lib/girepository-1.0";
  LUA_CPATH = "${lgi}/lib/lua/${lua.luaversion}/?.so";
  LUA_PATH  = "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua";
@ -52,7 +51,6 @@ with luaPackages; stdenv.mkDerivation rec {
      --add-flags '--search ${lgi}/lib/lua/${lua.luaversion}' \
      --add-flags '--search ${lgi}/share/lua/${lua.luaversion}' \
      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
      --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"

    wrapProgram $out/bin/awesome-client \
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@ -54,7 +54,11 @@ patchShebangs() {
                echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                # escape the escape chars so that sed doesn't interpret them
                escapedInterpreterLine=$(echo "$newInterpreterLine" | sed 's|\\|\\\\|g')
+                # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
+                touch -r "$f" "$f.timestamp"
                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+                touch -r "$f.timestamp" "$f"
+                rm "$f.timestamp"
            fi
        fi
    done
--- a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
+++ b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
@ -1,8 +1,8 @@
-{ lib, stdenv, fetchurl, findXMLCatalogs, writeScriptBin, ruby, bash }:
+{ lib, stdenv, fetchurl, fetchpatch, findXMLCatalogs, writeScriptBin, ruby, bash }:

 let

-  common = { pname, sha256 }: let self = stdenv.mkDerivation rec {
+  common = { pname, sha256, patches ? [] }: let self = stdenv.mkDerivation rec {
    name = "${pname}-1.79.1";

    src = fetchurl {
@ -10,6 +10,8 @@ let
      inherit sha256;
    };

+    inherit patches;
+
    propagatedBuildInputs = [ findXMLCatalogs ];

    dontBuild = true;
@ -44,6 +46,15 @@ in {
  docbook_xsl = common {
    pname = "docbook-xsl";
    sha256 = "0s59lihif2fr7rznckxr2kfyrvkirv76r1zvidp9b5mj28p4apvj";
+
+    patches = [(fetchpatch {
+      name = "potential-infinite-template-recursion.patch";
+      url = "https://src.fedoraproject.org/cgit/rpms/docbook-style-xsl.git/"
+          + "plain/docbook-style-xsl-non-recursive-string-subst.patch?id=bf9e5d16fd";
+      sha256 = "1pfb468bsj3j879ip0950waih0r1s6rzfbm2p70glbz0g3903p7h";
+      stripLen = "1";
+    })];
+
  };

  docbook_xsl_ns = common {
--- a/pkgs/desktops/plasma-5/kwin/default.nix
+++ b/pkgs/desktops/plasma-5/kwin/default.nix
@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, copyPathsToStore,
+  mkDerivation, lib, copyPathsToStore, fetchpatch,
  extra-cmake-modules, kdoctools,

  epoxy,libICE, libSM, libinput, libxkbcommon, udev, wayland, xcb-util-cursor,
@ -29,7 +29,14 @@ mkDerivation {
    kwayland kwidgetsaddons kwindowsystem kxmlgui plasma-framework
  ];
  outputs = [ "bin" "dev" "out" ];
-  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series);
+  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series)
+    ++ [(fetchpatch {
+        name = "cmake-3.10.diff";
+        # included upstream for kwin >= 5.11.95
+        url = "https://github.com/KDE/kwin/commit/cd544890ced4192.diff";
+        sha256 = "0z5nbcg712v10mskb7r9v0jcx5h8q4ixb7fjbb0kicmzsc266yd5";
+    })]
+    ;
  CXXFLAGS = [
    ''-DNIXPKGS_XWAYLAND=\"${lib.getBin xwayland}/bin/Xwayland\"''
  ];
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@ -37,9 +37,6 @@ let

    patches = [ ./purity.patch ];

-    # XXX: TODO: This should be removed on next rebuild
-    postBuild = "";
-
    postPatch = ''
      sed -i -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/Tools.cpp
      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@ -1,8 +1,6 @@
 { stdenv
 , fetch
 , fetchpatch
-, perl
-, groff
 , cmake
 , python
 , libffi
@ -41,7 +39,7 @@ in stdenv.mkDerivation (rec {
  outputs = [ "out" ]
    ++ stdenv.lib.optional enableSharedLibraries "lib";

-  nativeBuildInputs = [ perl groff cmake python ]
+  nativeBuildInputs = [ cmake python ]
    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;

  buildInputs = [ libxml2 libffi ]
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@ -37,9 +37,6 @@ let

    patches = [ ./purity.patch ];

-    # XXX: TODO: This should be removed on next rebuild
-    postBuild = "";
-
    postPatch = ''
      sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \
             -e 's/Args.hasArg(options::OPT_nostdlibinc)/true/' \
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@ -1,8 +1,6 @@
 { stdenv
 , fetch
 , fetchpatch
-, perl
-, groff
 , cmake
 , python
 , libffi
@ -41,7 +39,7 @@ in stdenv.mkDerivation (rec {
  outputs = [ "out" ]
    ++ stdenv.lib.optional enableSharedLibraries "lib";

-  nativeBuildInputs = [ perl groff cmake python ]
+  nativeBuildInputs = [ cmake python ]
    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;

  buildInputs = [ libxml2 libffi ]
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    patch -p1 < ${./data-dirs-from-nix-profiles.patch}
  '';

-  buildInputs = [ perl ];
+  nativeBuildInputs = [ perl ];

  doCheck = true;

--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -43,7 +43,7 @@ let
  '';

  ver_maj = "2.54";
-  ver_min = "2";
+  ver_min = "3";
 in

 stdenv.mkDerivation rec {
@ -51,7 +51,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "bb89e5c5aad33169a8c7f28b45671c7899c12f74caf707737f784d7102758e6c";
+    sha256 = "963fdc6685dc3da8e5381dfb9f15ca4b5709b28be84d9d05a9bb8e446abac0a8";
  };

  patches = optional stdenv.isDarwin ./darwin-compilation.patch
@ -75,8 +75,15 @@ stdenv.mkDerivation rec {
  # internal pcre would only add <200kB, but it's relatively common
  configureFlags = [ "--with-pcre=system" ]
    ++ optional stdenv.isDarwin "--disable-compile-warnings"
-    ++ optional (stdenv.isFreeBSD || stdenv.isSunOS) "--with-libiconv=gnu"
-    ++ optional stdenv.isSunOS "--disable-dtrace";
+    # glibc inclues GNU libiconv, but Darwin's iconv function is good enonugh.
+    ++ optional (stdenv.hostPlatform.libc != "glibc" && !stdenv.hostPlatform.isDarwin)
+      "--with-libiconv=gnu"
+    ++ optional stdenv.isSunOS "--disable-dtrace"
+    # Can't run this test when cross-compiling
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+       [ "glib_cv_stack_grows=no" "glib_cv_uscore=no" ]
+    # GElf only supports elf64 hosts
+    ++ optional (!stdenv.hostPlatform.is64bit) "--disable-libelf";

  NIX_CFLAGS_COMPILE = optional stdenv.isDarwin "-lintl"
    ++ optional stdenv.isSunOS "-DBSD_COMP";
--- a/pkgs/development/libraries/gnutls/3.6.nix
+++ b/pkgs/development/libraries/gnutls/3.6.nix
@ -11,9 +11,10 @@ callPackage ./generic.nix (args // rec {
  # Skip two tests introduced in 3.5.11.  Probable reasons of failure:
  #  - pkgconfig: building against the result won't work before installing
  #  - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox
+  # Change p11-kit test to use pkg-config to find p11-kit
  postPatch = ''
    sed '2iexit 77' -i tests/pkgconfig.sh
    sed '/^void doit(void)/,$s/{/{ exit(77);/; t' -i tests/trust-store.c
-    # TODO: remove just this line on some rebuild
+    sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
  '';
 })
--- a/pkgs/development/libraries/gobject-introspection/absolute_gir_path.patch
+++ b/pkgs/development/libraries/gobject-introspection/absolute_gir_path.patch
@ -0,0 +1,11 @@
+--- a/gir/cairo-1.0.gir.in
+++ b/gir/cairo-1.0.gir.in
+@@ -5,7 +5,7 @@
+             xmlns:glib="http://www.gtk.org/introspection/glib/1.0">
+   <package name="%CAIRO_GIR_PACKAGE%"/>
+   <namespace name="cairo" version="1.0"
+-	     shared-library="%CAIRO_SHARED_LIBRARY%"
+	     shared-library="@cairoLib@/%CAIRO_SHARED_LIBRARY%"
+ 	     c:identifier-prefixes="cairo"
+ 	     c:symbol-prefixes="cairo">
+     <record name="Context" c:type="cairo_t" foreign="1"
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, glib, flex, bison, pkgconfig, libffi, python
-, libintlOrEmpty, cctools
+, libintlOrEmpty, cctools, cairo
 , substituteAll, nixStoreDir ? builtins.storeDir
 }:
 # now that gobjectIntrospection creates large .gir files (eg gtk3 case)
@ -38,10 +38,17 @@ stdenv.mkDerivation rec {

  setupHook = ./setup-hook.sh;

-  patches = stdenv.lib.singleton (substituteAll {
-    src = ./absolute_shlib_path.patch;
-    inherit nixStoreDir;
-  });
+  patches = [
+    (substituteAll {
+      src = ./absolute_shlib_path.patch;
+      inherit nixStoreDir;
+    })
+    # https://github.com/NixOS/nixpkgs/issues/34080
+    (substituteAll {
+      src = ./absolute_gir_path.patch;
+      cairoLib = "${getLib cairo}/lib";
+    })
+  ];

  meta = with stdenv.lib; {
    description = "A middleware layer between C libraries and language bindings";
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@ -12,11 +12,11 @@ assert cupsSupport -> cups != null;
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.31";
+  name = "gtk+-2.24.32";

  src = fetchurl {
    url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "68c1922732c7efc08df4656a5366dcc3afdc8791513400dac276009b40954658";
+    sha256 = "b6c8a93ddda5eabe3bfee1eb39636c9a03d2a56c7b62828b359bf197943c582e";
  };

  outputs = [ "out" "dev" "devdoc" ];
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@ -34,6 +34,9 @@ stdenv.mkDerivation {

  preConfigure = ''
    sed -i -e "s|/bin/sh|${stdenv.shell}|" configure
+
+    # $(includedir) is different from $(prefix)/include due to multiple outputs
+    sed -i -e 's|^\(CPPFLAGS = .*\) -I\$(prefix)/include|\1 -I$(includedir)|' config/Makefile.inc.in
  '' + stdenv.lib.optionalString stdenv.isArm ''
    # From https://archlinuxarm.org/packages/armv7h/icu/files/icudata-stdlibs.patch
    sed -e 's/LDFLAGSICUDT=-nodefaultlibs -nostdlib/LDFLAGSICUDT=/' -i config/mh-linux
@ -45,6 +48,9 @@ stdenv.mkDerivation {
  # remove dependency on bootstrap-tools in early stdenv build
  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
    sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
+  '' + ''
+    substituteInPlace "$dev/bin/icu-config" \
+      --replace \''${pkglibdir}/Makefile.inc "$dev/lib/icu/Makefile.inc"
  '';

  postFixup = ''moveToOutput lib/icu "$dev" '';
--- a/pkgs/development/libraries/libdaemon/default.nix
+++ b/pkgs/development/libraries/libdaemon/default.nix
@ -8,7 +8,11 @@ stdenv.mkDerivation rec {
    sha256 = "0d5qlq5ab95wh1xc87rqrh1vx6i8lddka1w3f1zcqvcqdxgyn8zx";
  };

-  configureFlags = [ "--disable-lynx" ];
+  configureFlags = [ "--disable-lynx" ]
+    ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ # Can't run this test while cross-compiling
+      "ac_cv_func_setpgrp_void=yes"
+    ];

  meta = {
    description = "Lightweight C library that eases the writing of UNIX daemons";
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "dev" ];

  # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
-  NROFF = "${groff}/bin/nroff";
+  # NROFF = "${groff}/bin/nroff";

  patches = [ ./01-cygwin.patch ];

--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext }:
+{ stdenv, buildPackages, fetchurl, gettext }:

 stdenv.mkDerivation rec {
  name = "libgpg-error-${version}";
@ -16,7 +16,8 @@ stdenv.mkDerivation rec {

  # If architecture-dependent MO files aren't available, they're generated
  # during build, so we need gettext for cross-builds.
-  crossAttrs.buildInputs = [ gettext ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ gettext ];

  postConfigure =
    stdenv.lib.optionalString stdenv.isSunOS
@ -27,7 +28,7 @@ stdenv.mkDerivation rec {
    # Thus, re-run it with Bash.
      "${stdenv.shell} config.status";

-  doCheck = true;
+  doCheck = true; # not cross

  meta = with stdenv.lib; {
    homepage = https://www.gnupg.org/related_software/libgpg-error/index.html;
@ -45,4 +46,3 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.fuuzetsu maintainers.vrthra ];
  };
 }
-
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "libinput-${version}";
-  version = "1.9.3";
+  version = "1.9.4";

  src = fetchurl {
    url = "http://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "09wkc5qqk1k2a68cwfy4x853z8z35wf2qkijh66kacsvc2fjq394";
+    sha256 = "142icwzpirwddl7ghfmynxpnsbjg53rjxpzv4arjsaiw9r6bvk8b";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libogg/default.nix
+++ b/pkgs/development/libraries/libogg/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "libogg-1.3.2";
+  name = "libogg-1.3.3";

  src = fetchurl {
    url = "http://downloads.xiph.org/releases/ogg/${name}.tar.xz";
-    sha256 = "16z74q422jmprhyvy7c9x909li8cqzmvzyr8cgbm52xcsp6pqs1z";
+    sha256 = "022wjlzn8fx7mfby4pcgyjwx8zir7jr7cizichh3jgaki8bwcgsg";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/libomxil-bellagio/default.nix
+++ b/pkgs/development/libraries/libomxil-bellagio/default.nix
@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
    url = "mirror://sourceforge/omxil/omxil/Bellagio%20${version}/${name}.tar.gz";
    sha256 = "0k6p6h4npn8p1qlgq6z3jbfld6n1bqswzvxzndki937gr0lhfg2r";
  };
-  
+
+  configureFlags =
+    stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "ac_cv_func_malloc_0_nonnull=yes" ];
+
  patches = [ ./fedora-fixes.patch ];

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "libseccomp-${version}";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchurl {
    url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "3ddc8c037956c0a5ac19664ece4194743f59e1ccd4adde848f4f0dae7f77bca1";
+    sha256 = "0mdiyfljrkfl50q1m3ws8yfcyfjwf1zgkvcva8ffcwncji18zhkz";
  };

  buildInputs = [ getopt makeWrapper ];
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@ -1,20 +1,20 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, zlib, libjpeg, xz }:

 let
-  version = "4.0.8";
+  version = "4.0.9";
 in
 stdenv.mkDerivation rec {
  name = "libtiff-${version}";

  src = fetchurl {
    url = "http://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "0419mh6kkhz5fkyl77gv0in8x4d2jpdpfs147y8mj86rrjlabmsr";
+    sha256 = "1kfg4q01r4mqn7dj63ifhi6pmqzbf4xax6ni6kkk81ri5kndwyvf";
  };

-  prePatch =let
+  prePatch = let
      debian = fetchurl {
-        url = http://snapshot.debian.org/archive/debian-debug/20170928T093547Z/pool/main/t/tiff/tiff_4.0.8-5.debian.tar.xz;
-        sha256 = "11qkiliw04dmdvdd5z2lv5hh2fiwa29qbhkxvlvmb4yslnmyywha";
+        url = http://snapshot.debian.org/archive/debian-debug/20180128T155203Z//pool/main/t/tiff/tiff_4.0.9-3.debian.tar.xz;
+        sha256 = "0wya42y7kcq093g3h7ca10cm5sns1mgnkjmdd2qdi59v8arga4y4";
      };
    in ''
      tar xf '${debian}'
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "libwebp-${version}";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchurl {
    url = "http://downloads.webmproject.org/releases/webp/${name}.tar.gz";
-    sha256 = "0h1brwkyxc7lb8lc53aacdks5vc1y9hzngqi41gg7y6l56912a69";
+    sha256 = "1ayq2zq0zbgf5yizbm32zh7p1vb8kibw74am6am1n5cz5mw3ql06";
  };

  configureFlags = [
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@ -11,22 +11,15 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "libxslt";
-  version = "1.1.29";
+  version = "1.1.32";
  name = pname + "-" + version;

  src = fetchurl {
    url = "http://xmlsoft.org/sources/${name}.tar.gz";
-    sha256 = "1klh81xbm9ppzgqk339097i39b7fnpmlj8lzn8bpczl3aww6x5xm";
+    sha256 = "0q2l6m56iv3ysxgm2walhg4c9wp7q183jb328687i9zlp85csvjj";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2017-5029";
-      url = "https://git.gnome.org/browse/libxslt/"
-        + "patch/?id=08ab2774b870de1c7b5a48693df75e8154addae5";
-      sha256 = "10azfmyffjf9d7b5js4ipxw9f20qi0kw3zq34bpqmbcpq3l338ky";
-    })
-  ] ++ stdenv.lib.optional stdenv.isSunOS ./patch-ah.patch;
+  patches = stdenv.lib.optional stdenv.isSunOS ./patch-ah.patch;

  # fixes: can't build x86_64-unknown-cygwin shared library unless -no-undefined is specified
  postPatch = optionalString hostPlatform.isCygwin ''
@ -40,12 +33,13 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ findXMLCatalogs ];

-  # TODO move cryptoSupport as last flag, when upgrading libxslt
-  configureFlags = optional (!cryptoSupport) "--without-crypto" ++ [
+  configureFlags = [
+    "--with-libxml-prefix=${libxml2.dev}"
    "--without-debug"
    "--without-mem-debug"
    "--without-debugger"
-  ] ++ optional pythonSupport "--with-python=${python2}";
+  ] ++ optional pythonSupport "--with-python=${python2}"
+    ++ optional (!cryptoSupport) "--without-crypto";

  postFixup = ''
    moveToOutput bin/xslt-config "$dev"
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -66,7 +66,7 @@ let
 in

 let
-  version = "17.2.8";
+  version = "17.3.3";
  branch  = head (splitString "." version);
  driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@ -81,7 +81,7 @@ stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
      "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
    ];
-    sha256 = "0pq9kmmyllgd63d936f3x1zsg7sqaswx47khbn0gvbgari2h753f";
+    sha256 = "16rpm4rwmzd4kdgipa1gw262jqg3346gih0y3bsc3bgn1vgcbfj1";
  };

  prePatch = "patchShebangs .";
@ -134,7 +134,7 @@ stdenv.mkDerivation {
    "--enable-shared-glapi"
    "--enable-sysfs"
    "--enable-llvm-shared-libs"
-    "--enable-omx"
+    "--enable-omx-bellagio"
    "--enable-va"
    "--disable-opencl"
  ];
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  name = "p11-kit-${version}";
-  version = "0.23.7";
+  version = "0.23.9";

  src = fetchFromGitHub {
    owner = "p11-glue";
    repo = "p11-kit";
    rev = version;
-    sha256 = "1l8sg0g74k2mk0y6vz19hc103dzizxa0h579gdhvxifckglb01hy";
+    sha256 = "0lyv6m2jflvs23m0i6l64d470p5a315lz6vs4bflsqv8i1zrrcsh";
  };

  outputs = [ "out" "dev"];
--- a/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
+++ b/pkgs/development/python-modules/backports_functools_lru_cache/default.nix
@ -2,9 +2,10 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools_scm
+, pythonOlder
 }:

-buildPythonPackage rec {
+if !(pythonOlder "3.3") then null else buildPythonPackage rec {
  pname = "backports.functools_lru_cache";
  version = "1.4";

--- a/pkgs/development/python-modules/backports_lzma/default.nix
+++ b/pkgs/development/python-modules/backports_lzma/default.nix
@ -4,9 +4,10 @@
 , isPy3k
 , lzma
 , python
+, pythonOlder
 }:

-buildPythonPackage rec {
+if !(pythonOlder "3.3") then null else buildPythonPackage rec {
  pname = "backports.lzma";
  version = "0.0.9";

--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@ -46,7 +46,8 @@ in stdenv.mkDerivation rec {
    mkdir -p $out/bin
  '';

-  buildInputs = [ python makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ python ];

  installPhase = ''

--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@ -8,6 +8,7 @@
 , enableQt ? false, pyqt4
 , libcxx
 , Cocoa
+, pythonOlder
 }:

 assert enableGhostscript -> ghostscript != null;
@ -39,8 +40,8 @@ buildPythonPackage rec {

  propagatedBuildInputs =
    [ cycler dateutil nose numpy pyparsing tornado freetype
-      libpng pkgconfig mock pytz backports_functools_lru_cache
-    ]
+      libpng pkgconfig mock pytz ]
+    ++ stdenv.lib.optional (pythonOlder "3.3") backports_functools_lru_cache
    ++ stdenv.lib.optional enableGtk2 pygtk
    ++ stdenv.lib.optionals enableGtk3 [ cairo pycairo gtk3 gobjectIntrospection pygobject3 ]
    ++ stdenv.lib.optionals enableTk [ tcl tk tkinter libX11 ]
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
    sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
  };

-  buildInputs = [ python wrapPython unzip ];
+  nativeBuildInputs = [ unzip wrapPython ];
+  buildInputs = [ python ];
  doCheck = false;  # requires pytest
  installPhase = ''
      dst=$out/${python.sitePackages}
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@ -6,6 +6,7 @@
 , backports_ssl_match_hostname
 , certifi
 , singledispatch
+, pythonOlder
 }:

 buildPythonPackage rec {
@ -13,7 +14,8 @@ buildPythonPackage rec {
  version = "4.5.3";
  name = "${pname}-${version}";

-  propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
+  propagatedBuildInputs = [ backports_abc  certifi singledispatch ]
+    ++ lib.optional (pythonOlder "3.5") backports_ssl_match_hostname;

  # We specify the name of the test files to prevent
  # https://github.com/NixOS/nixpkgs/issues/14634
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@ -1,5 +1,6 @@
 { stdenv, fetchurl, pkgconfig
 , bzip2, curl, expat, libarchive, xz, zlib, libuv, rhash
+, majorVersion ? "3.10"
 # darwin attributes
 , ps
 , isBootstrap ? false
@ -14,10 +15,23 @@ assert useQt4 -> withQt5 == false;

 with stdenv.lib;

+with (
+  {
+    "3.10" = {
+      minorVersion = "2";
+      sha256 = "80d0faad4ab56de07aa21a7fc692c88c4ce6156d42b0579c6962004a70a3218b";
+    };
+    "3.9" = {
+      minorVersion = "6";
+      sha256 = "7410851a783a41b521214ad987bb534a7e4a65e059651a2514e6ebfc8f46b218";
+    };
+
+  }.${majorVersion}
+    or (abort ''Unsupported configuration for cmake: majorVersion = "${majorVersion}";'')
+);
+
 let
  os = stdenv.lib.optionalString;
-  majorVersion = "3.9";
-  minorVersion = "6";
  version = "${majorVersion}.${minorVersion}";
 in

@ -28,8 +42,8 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.9/cmake-3.9.6-SHA-256.txt
-    sha256 = "7410851a783a41b521214ad987bb534a7e4a65e059651a2514e6ebfc8f46b218";
+    # from https://cmake.org/files/v3.10/cmake-3.10.2-SHA-256.txt
+    inherit sha256;
  };

  prePatch = optionalString (!useSharedLibraries) ''
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
    sha256 = "1bzd9g32dfm4rsbw93ld9x7b5nc1y6i4m6zp032qf1i28a8s6sxg";
  };

-  buildInputs = [ perl autoconf ];
+  nativeBuildInputs = [ autoconf perl ];
+  buildInputs = [ autoconf ];

  setupHook = ./setup-hook.sh;

--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "lib" ];

-  nativeBuildInputs = [ perl help2man ];
+  nativeBuildInputs = [ perl help2man m4 ];
  propagatedBuildInputs = [ m4 ];

  # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses }:
+{ stdenv, fetchurl, buildPackages, ncurses }:

 let dialect = with stdenv.lib; last (splitString "-" stdenv.system); in

@ -6,6 +6,7 @@ stdenv.mkDerivation rec {
  name = "lsof-${version}";
  version = "4.89";

+  depsBuildBuild = [ buildPackages.stdenv.cc ];
  buildInputs = [ ncurses ];

  src = fetchurl {
@ -31,7 +32,7 @@ stdenv.mkDerivation rec {

  # Stop build scripts from searching global include paths
  LSOF_INCLUDE = "${stdenv.cc.libc}/include";
-  configurePhase = "./Configure -n ${dialect}";
+  configurePhase = "LINUX_CONF_CC=$CC_FOR_BUILD LSOF_CC=$CC LSOF_AR=\"$AR cr\" LSOF_RANLIB=$RANLIB ./Configure -n ${dialect}";
  preBuild = ''
    sed -i Makefile -e 's/^CFGF=/&	-DHASIPv6=1/;' -e 's/-lcurses/-lncurses/'
    for filepath in $(find dialects/${dialect} -type f); do
--- a/pkgs/development/tools/misc/texinfo/5.2.nix
+++ b/pkgs/development/tools/misc/texinfo/5.2.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, perl, xz, procps, interactive ? false }:
+{ stdenv, buildPackages, fetchurl, ncurses, perl, xz, procps, interactive ? false }:

 with stdenv.lib;

@ -10,10 +10,17 @@ stdenv.mkDerivation rec {
    sha256 = "1njfwh2z34r2c4r0iqa7v24wmjzvsfyz4vplzry8ln3479lfywal";
  };

+  # We need a native compiler to build perl XS extensions
+  # when cross-compiling.
+  depsBuildBuild = [ buildPackages.stdenv.cc perl ];
+
  buildInputs = [ perl xz.bin ]
    ++ optional interactive ncurses
    ++ optional doCheck procps; # for tests

+  configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
+    ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
+
  preInstall = ''
    installFlags="TEXMF=$out/texmf-dist";
    installTargets="install install-tex";
--- a/pkgs/development/tools/misc/texinfo/6.5.nix
+++ b/pkgs/development/tools/misc/texinfo/6.5.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, perl, xz, libiconv, gawk, procps, interactive ? false }:
+{ stdenv, buildPackages, fetchurl, ncurses, perl, xz, libiconv, gawk, procps, interactive ? false }:

 with stdenv.lib;

@ -10,12 +10,17 @@ stdenv.mkDerivation rec {
    sha256 = "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp";
  };

-  buildInputs = [ perl xz ]
+  # We need a native compiler to build perl XS extensions
+  # when cross-compiling.
+  depsBuildBuild = [ buildPackages.stdenv.cc perl ];
+
+  buildInputs = [ xz ]
    ++ optionals stdenv.isSunOS [ libiconv gawk ]
    ++ optional interactive ncurses
    ++ optional doCheck procps; # for tests

-  configureFlags = stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
+  configureFlags = [ "PERL=${buildPackages.perl}/bin/perl" ]
+    ++ stdenv.lib.optional stdenv.isSunOS "AWK=${gawk}/bin/awk";

  preInstall = ''
    installFlags="TEXMF=$out/texmf-dist";
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, bison, m4
+{ stdenv, buildPackages, fetchurl, bison, m4
 , fetchpatch, autoreconfHook, help2man
 }:

@ -19,28 +19,27 @@ stdenv.mkDerivation rec {
        + "/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
    sha256 = "1aarhcmz7mfrgh15pkj6f7ikxa2m0mllw1i1vscsf1kw5d05lw6f";
  })];
+  postPatch = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    substituteInPlace Makefile.in --replace "tests" " "
+
+    substituteInPlace doc/Makefile.am --replace 'flex.1: $(top_srcdir)/configure.ac' 'flex.1: '
+  '';
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ autoreconfHook help2man ];
-
  buildInputs = [ bison ];
-
  propagatedBuildInputs = [ m4 ];

+  preConfigure = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    export ac_cv_func_malloc_0_nonnull=yes
+    export ac_cv_func_realloc_0_nonnull=yes
+  '';
+
  postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
    sed -i Makefile -e 's/-no-undefined//;'
  '';

-  crossAttrs = {
-
-    # disable tests which can't run on build machine
-    postPatch = ''
-      substituteInPlace Makefile.in --replace "tests" " ";
-    '';
-
-    preConfigure = ''
-      export ac_cv_func_malloc_0_nonnull=yes
-      export ac_cv_func_realloc_0_nonnull=yes
-    '';
-  };
+  dontDisableStatic = stdenv.buildPlatform != stdenv.hostPlatform;

  meta = {
    homepage = https://github.com/westes/flex;
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
      --replace "which" "type -p" \
      --replace "lspci" "${pciutils}/bin/lspci"
  '';
-  buildInputs = [ gettext alsaLib ncurses libsamplerate fftw ];
+  nativeBuildInputs = [ gettext ];
+  buildInputs = [ alsaLib ncurses libsamplerate fftw ];

  configureFlags = "--disable-xmlto --with-udev-rules-dir=$(out)/lib/udev/rules.d";

--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@ -1,5 +1,5 @@
 {
-  stdenv, fetchurl,
+  stdenv, buildPackages, fetchurl,
  enablePython ? false, python ? null,
 }:

@ -15,6 +15,7 @@ stdenv.mkDerivation rec {

  outputs = [ "bin" "dev" "out" "man" ];

+  depsBuildBuild = [ buildPackages.stdenv.cc ];
  buildInputs = stdenv.lib.optional enablePython python;

  configureFlags = [
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@ -1,11 +1,12 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "net-tools-1.60_p20161110235919";
+  name = "net-tools-${version}";
+  version = "1.60_p20170221182432";

  src = fetchurl {
    url = "mirror://gentoo/distfiles/${name}.tar.xz";
-    sha256 = "1kbgwkys45kb5wqhchi1kf0sfw93c1cl0hgyw7yhacxzdfxjmdfr";
+    sha256 = "08r4r2a24g5bm8jwgfa998gs1fld7fgbdf7pilrpsw1m974xn04a";
  };

  preBuild =
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@ -16,7 +16,10 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  # Too red
-  configureFlags = [ "--disable-modern-top" ];
+  configureFlags = [ "--disable-modern-top" ]
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ "ac_cv_func_malloc_0_nonnull=yes"
+      "ac_cv_func_realloc_0_nonnull=yes" ];

  meta = {
    homepage = https://sourceforge.net/projects/procps-ng/;
--- a/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/pkgs/os-specific/linux/wireless-tools/default.nix
@ -1,18 +1,20 @@
 {stdenv, fetchurl}:

-stdenv.mkDerivation {
-  name = "wireless-tools-29";
+stdenv.mkDerivation rec {
+  name = "wireless-tools-${version}";
+  version = "30.pre2";

  src = fetchurl {
-    url = http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.29.tar.gz;
-    sha256 = "18g5wa3rih89i776nc2n2s50gcds4611gi723h9ki190zqshkf3g";
+    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    sha256 = "01lgf592nk8fnk7l5afqvar4szkngwpgcv4xh58qsg9wkkjlhnls";
  };

  preBuild = "
-    makeFlagsArray=(PREFIX=$out)
+    makeFlagsArray=(PREFIX=$out CC=$CC LDCONFIG=: AR=$AR RANLIB=$RANLIB)
  ";

  meta = {
    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2;
  };
 }
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
  patches = [ ./dont-keep-configure-flags.patch ./remove-mkdir-var.patch ] ++
    stdenv.lib.optional stdenv.isDarwin ./darwin-openssl-linking-fix.patch;

-  buildInputs = [ openssl libtool perl libxml2 ] ++
+  nativeBuildInputs = [ perl ];
+  buildInputs = [ openssl libtool libxml2 ] ++
    stdenv.lib.optional enableSeccomp libseccomp;

  STD_CDEFINES = [ "-DDIG_SIGCHASE=1" ]; # support +sigchase
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@ -769,7 +769,7 @@ _defaultUnpack() {
        # We can't preserve hardlinks because they may have been
        # introduced by store optimization, which might break things
        # in the build.
-        cp -pr --reflink=auto "$fn" "$(stripHash "$fn")"
+        cp -pr --reflink=auto -- "$fn" "$(stripHash "$fn")"

    else

--- a/pkgs/tools/archivers/unrar/default.nix
+++ b/pkgs/tools/archivers/unrar/default.nix
@ -10,7 +10,10 @@ stdenv.mkDerivation rec {
  };

  postPatch = ''
-    sed 's/^CXX=g++/#CXX/' -i makefile
+    substituteInPlace makefile \
+      --replace "CXX=" "#CXX=" \
+      --replace "STRIP=" "#STRIP=" \
+      --replace "AR=" "#AR="
  '';

  buildPhase = ''
--- a/pkgs/tools/archivers/zip/default.nix
+++ b/pkgs/tools/archivers/zip/default.nix
@ -12,6 +12,9 @@ stdenv.mkDerivation {
    ];
    sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
  };
+  patchPhase = ''
+    substituteInPlace unix/Makefile --replace 'CC = cc' ""
+  '';

  hardeningDisable = [ "format" ];

--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@ -2,15 +2,13 @@

 stdenv.mkDerivation rec {
  name = "gzip-${version}";
-  version = "1.8";
+  version = "1.9";

  src = fetchurl {
    url = "mirror://gnu/gzip/${name}.tar.xz";
-    sha256 = "1lxv3p4iyx7833mlihkn5wfwmz4cys5nybwpz3dfawag8kn6f5zz";
+    sha256 = "16h8g4acy7fgfxcjacr3wijjsnixwsfd2jhz3zwdi2qrzi262l5f";
  };

-  patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
-
  outputs = [ "out" "man" "info" ];

  enableParallelBuilding = true;
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libuuid, gettext, texinfo }:
+{ stdenv, buildPackages, fetchurl, pkgconfig, libuuid, gettext, texinfo }:

 stdenv.mkDerivation rec {
  name = "e2fsprogs-1.43.8";
@ -10,15 +10,10 @@ stdenv.mkDerivation rec {

  outputs = [ "bin" "dev" "out" "man" "info" ];

+  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ pkgconfig texinfo ];
  buildInputs = [ libuuid ] ++ stdenv.lib.optional (!stdenv.isLinux) gettext;

-  crossAttrs = {
-    preConfigure = ''
-      export CC=$crossConfig-gcc
-    '';
-  };
-
  configureFlags =
    if stdenv.isLinux then [
      "--enable-elf-shlibs" "--enable-symlink-install" "--enable-relative-symlinks"
--- a/pkgs/tools/misc/bc/cross-bc.patch
+++ b/pkgs/tools/misc/bc/cross-bc.patch
@ -0,0 +1,169 @@
+commit fdda59736ddc048cf38a2c7103f4f5d9eeaf995e
+Author: Ben Gamari <ben@smart-cactus.org>
+Date:   Tue Oct 17 10:51:34 2017 -0400
+
+    Try implementing cross-compilation
+
+diff --git a/bc/Makefile.am b/bc/Makefile.am
+index d9d412e..fdef633 100644
+--- a/bc/Makefile.am
+++ b/bc/Makefile.am
+@@ -17,6 +17,7 @@ MAINTAINERCLEANFILES = Makefile.in bc.c bc.h scan.c \
+ 
+ AM_CPPFLAGS = -I$(srcdir) -I$(srcdir)/../h
+ LIBBC = ../lib/libbc.a
+LIBBC_HOST = ../lib/libbc_host.a
+ LIBL = @LEXLIB@
+ LDADD = $(LIBBC) $(LIBL) @READLINELIB@
+ 
+@@ -29,12 +30,20 @@ $(PROGRAMS): libmath.h $(LIBBC)
+ scan.o: bc.h
+ global.o: libmath.h
+
+main_host.c : main.c
+	cp $< $@
+ 
+-fbcOBJ = main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o
+fbcOBJ = $(addsuffix _host,main.o bc.o scan.o execute.o load.o storage.o util.o warranty.o)
+
+%.o_host : CC:=$(CC_FOR_BUILD)
+
+%.o_host : %.c
+	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
+ 
+-libmath.h: libmath.b $(fbcOBJ) $(LIBBC)
+libmath.h: libmath.b $(fbcOBJ) $(LIBBC_HOST)
+ 	echo '{0}' > libmath.h
+-	$(MAKE) global.o
+-	$(LINK) -o fbc $(fbcOBJ) global.o $(LIBBC) $(LIBL) $(READLINELIB) $(LIBS)
+	$(MAKE) global.o_host
+	$(CC_FOR_BUILD) -o fbc $(fbcOBJ) global.o_host $(LIBBC_HOST) $(LIBL) ${READLINELIB} $(LIBS)
+ 	./fbc -c $(srcdir)/libmath.b </dev/null >libmath.h
+ 	$(srcdir)/fix-libmath_h
+ 	rm -f ./fbc ./global.o
+diff --git a/configure.ac b/configure.ac
+index fc74573..5cabb73 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -20,6 +20,7 @@ m4_define([dc_version], 1.4.1)
+ 
+ AC_INIT([bc],[bc_version])
+ AC_CONFIG_SRCDIR(doc/bc.1)
+AC_CONFIG_MACRO_DIR([m4])
+ AM_INIT_AUTOMAKE([dist-bzip2])
+ AC_CONFIG_HEADERS(config.h)
+ 
+@@ -35,6 +36,7 @@ AC_DEFINE([DC_COPYRIGHT],
+ 	  [Define the dc copyright line.])
+ 
+ AC_PROG_CC
+AX_CC_FOR_BUILD
+ AC_USE_SYSTEM_EXTENSIONS
+ 
+ AM_PROG_LEX
+diff --git a/lib/Makefile.am b/lib/Makefile.am
+index ec4bf59..c670f5b 100644
+--- a/lib/Makefile.am
+++ b/lib/Makefile.am
+@@ -1,5 +1,5 @@
+ ## Process this file with automake to produce Makefile.in
+-noinst_LIBRARIES = libbc.a
+noinst_LIBRARIES = libbc.a libbc_host.a
+ 
+ AM_CPPFLAGS = -I. -I.. -I$(srcdir)/../h
+ 
+@@ -24,3 +24,11 @@ testmul: testmul.o number.o
+ 
+ specialnumber: newnumber.o
+ 	cp newnumber.o number.o
+
+%.o_host : CC:=$(CC_FOR_BUILD)
+%.o_host : %.c
+	$(COMPILE) -c $(CFLAGS) $(INCLUDES) -o $@ $<
+
+libbc_host.a : $(addsuffix _host,$(libbc_a_OBJECTS))
+	ar cru $@ $+
+	ranlib $@
+diff --git a/m4/cc_for_build.m4 b/m4/cc_for_build.m4
+new file mode 100644
+index 0000000..c62ffad
+--- /dev/null
+++ b/m4/cc_for_build.m4
+@@ -0,0 +1,77 @@
+# ===========================================================================
+#     https://www.gnu.org/software/autoconf-archive/ax_cc_for_build.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CC_FOR_BUILD
+#
+# DESCRIPTION
+#
+#   Find a build-time compiler. Sets CC_FOR_BUILD and EXEEXT_FOR_BUILD.
+#
+# LICENSE
+#
+#   Copyright (c) 2010 Reuben Thomas <rrt@sc3d.org>
+#   Copyright (c) 1999 Richard Henderson <rth@redhat.com>
+#
+#   This program is free software: you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation, either version 3 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 3
+
+dnl Get a default for CC_FOR_BUILD to put into Makefile.
+AC_DEFUN([AX_CC_FOR_BUILD],
+[# Put a plausible default for CC_FOR_BUILD in Makefile.
+if test -z "$CC_FOR_BUILD"; then
+  if test "x$cross_compiling" = "xno"; then
+    CC_FOR_BUILD='$(CC)'
+  else
+    CC_FOR_BUILD=gcc
+  fi
+fi
+AC_SUBST(CC_FOR_BUILD)
+# Also set EXEEXT_FOR_BUILD.
+if test "x$cross_compiling" = "xno"; then
+  EXEEXT_FOR_BUILD='$(EXEEXT)'
+else
+  AC_CACHE_CHECK([for build system executable suffix], bfd_cv_build_exeext,
+    [rm -f conftest*
+     echo 'int main () { return 0; }' > conftest.c
+     bfd_cv_build_exeext=
+     ${CC_FOR_BUILD} -o conftest conftest.c 1>&5 2>&5
+     for file in conftest.*; do
+       case $file in
+       *.c | *.o | *.obj | *.ilk | *.pdb) ;;
+       *) bfd_cv_build_exeext=`echo $file | sed -e s/conftest//` ;;
+       esac
+     done
+     rm -f conftest*
+     test x"${bfd_cv_build_exeext}" = x && bfd_cv_build_exeext=no])
+  EXEEXT_FOR_BUILD=""
+  test x"${bfd_cv_build_exeext}" != xno && EXEEXT_FOR_BUILD=${bfd_cv_build_exeext}
+fi
+AC_SUBST(EXEEXT_FOR_BUILD)])dnl
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchurl, flex, readline, ed, texinfo}:
+{stdenv, autoreconfHook, buildPackages, fetchurl, flex, readline, ed, texinfo}:

 stdenv.mkDerivation rec {
  name = "bc-1.07.1";
@ -9,9 +9,24 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--with-readline" ];

-  buildInputs = [flex readline ed texinfo];
+  # As of 1.07 cross-compilation is quite complicated as the build system wants
+  # to build a code generator, bc/fbc, on the build machine.
+  patches = [ ./cross-bc.patch ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    # Tools
+    autoreconfHook ed flex texinfo
+    # Libraries for build
+    buildPackages.readline buildPackages.ncurses
+  ];
+  buildInputs = [ readline ];

-  doCheck = true;
+  doCheck = true; # not cross
+
+  # Hack to make sure we never to the relaxation `$PATH` and hooks support for
+  # compatability. This will be replaced with something clearer in a future
+  # masss-rebuild.
+  crossConfig = true;

  meta = {
    description = "GNU software calculator";
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib }:
+{ stdenv, fetchurl, file, zlib }:

 stdenv.mkDerivation rec {
  name = "file-${version}";
@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
    sha256 = "0l1bfa0icng9vdwya00ff48fhvjazi5610ylbhl35qi13d6xqfc6";
  };

+  nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
  buildInputs = [ zlib ];

  doCheck = true;
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -24,11 +24,11 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> kerberos != null;

 stdenv.mkDerivation rec {
-  name = "curl-7.57.0";
+  name = "curl-7.58.0";

  src = fetchurl {
    url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "09j88lzqmi79rvvg2l7bjcs56330bq388f5p468hgblf6hdf6by9";
+    sha256 = "0cg7klhf1ksnbw5wvwa802qir877zv4y3dj7swz1xh07g3wq3c0w";
  };

  outputs = [ "bin" "dev" "out" "man" "devdoc" ];
--- a/pkgs/tools/networking/jwhois/default.nix
+++ b/pkgs/tools/networking/jwhois/default.nix
@ -15,6 +15,8 @@ stdenv.mkDerivation {

  patches = [ ./connect.patch ./service-name.patch ];

+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
  meta = {
    description = "A client for the WHOIS protocol allowing you to query the owner of a domain name";
    homepage = http://www.gnu.org/software/jwhois/;
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@ -1,15 +1,12 @@
 { stdenv, fetchurl, fetchpatch, zlib, openssl, perl, libedit, pkgconfig, pam, autoreconfHook
 , etcDir ? null
 , hpnSupport ? false
-, withKerberos ? false
+, withKerberos ? true
 , withGssapiPatches ? false
 , kerberos
 , linkOpenssl? true
 }:

-assert withKerberos -> kerberos != null;
-assert withGssapiPatches -> withKerberos;
-
 let

  # **please** update this patch when you update to a new openssh release.
@ -23,8 +20,6 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  # Please ensure that openssh_with_kerberos still builds when
-  # bumping the version here!
  name = "openssh-${version}";
  version = if hpnSupport then "7.5p1" else "7.6p1";

@ -47,7 +42,7 @@ stdenv.mkDerivation rec {
      # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
      ./dont_create_privsep_path.patch
    ]
-    ++ optional withGssapiPatches gssapiPatch;
+    ++ optional withGssapiPatches (assert withKerberos; gssapiPatch);

  postPatch =
    # On Hydra this makes installation fail (sometimes?),
@ -59,7 +54,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ zlib openssl libedit pam ]
    ++ optional withKerberos kerberos
-    ++ optional hpnSupport autoreconfHook;
+    ++ optional hpnSupport autoreconfHook
+    ;

  preConfigure = ''
    # Setting LD causes `configure' and `make' to disagree about which linker
@ -78,7 +74,7 @@ stdenv.mkDerivation rec {
    "--disable-strip"
    (if pam != null then "--with-pam" else "--without-pam")
  ] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
-    ++ optional withKerberos "--with-kerberos5=${kerberos}"
+    ++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
    ++ optional stdenv.isDarwin "--disable-libutil"
    ++ optional (!linkOpenssl) "--without-openssl";

--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "unbound-${version}";
-  version = "1.6.7";
+  version = "1.6.8";

  src = fetchurl {
-    url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "17qwfmlls0w9kpkya3dlpn44b3kr87wsswzg3gawc13hh8yx8ysf";
+    url = "https://unbound.net/downloads/${name}.tar.gz";
+    sha256 = "0jfxhh4gc5amhndikskz1s7da27ycn442j3l20bm992n7zijid73";
  };

  outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@ -6,7 +6,7 @@ let mkPrefetchScript = tool: src: deps:
  stdenv.mkDerivation {
    name = "nix-prefetch-${tool}";

-    buildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper ];

    unpackPhase = ":";

--- a/pkgs/tools/security/mktemp/default.nix
+++ b/pkgs/tools/security/mktemp/default.nix
@ -1,16 +1,21 @@
 { stdenv, fetchurl, groff }:

 stdenv.mkDerivation {
-  name = "mktemp-1.6";
+  name = "mktemp-1.7";

  # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
  NROFF = "${groff}/bin/nroff";

+  # Don't use "install -s"
+  postPatch = ''
+    substituteInPlace Makefile.in --replace " 0555 -s " " 0555 "
+  '';
+
  src = fetchurl {
-    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.6.tar.gz;
-    sha256 = "1nfj89b0dv1c2fyqi1pg54fyzs3462cbp7jv7lskqsxvqy4mh9x1";
+    url = ftp://ftp.mktemp.org/pub/mktemp/mktemp-1.7.tar.gz;
+    sha256 = "0x969152znxxjbj7387xb38waslr4yv6bnj5jmhb4rpqxphvk54f";
  };
-  
+
  meta = {
    platforms = stdenv.lib.platforms.unix;
  };
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
  # * .h files installed for static library target only
  # * .so.0 -> .so link only created in the static library install target
  buildPhase = ''
-    make lib-shared lib-static build-shared CC=cc PREFIX=$out
+    make lib-shared lib-static build-shared CC=$CC AR=$AR PREFIX=$out
  '';

  # we don't actually want the static library, so we remove it after it
--- a/pkgs/tools/system/cron/default.nix
+++ b/pkgs/tools/system/cron/default.nix
@ -14,7 +14,9 @@ stdenv.mkDerivation {
  preBuild = ''
    # do not set sticky bit in /nix/store 
    substituteInPlace Makefile --replace ' -o root' ' ' --replace 111 755 --replace 4755 0755
-    makeFlags="DESTROOT=$out CC=cc"
+    # do not strip during install, broken on cross and we'll do ourselves as needed
+    substituteInPlace Makefile --replace ' -s cron' ' cron'
+    makeFlags="DESTROOT=$out CC=$CC"

    # We want to ignore the $glibc/include/paths.h definition of
    # sendmail path.
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -146,6 +146,7 @@ mapAliases (rec {
  rdmd = dtools;  # added 2017-08-19
  robomongo = robo3t; #added 2017-09-28
  rssglx = rss-glx; #added 2015-03-25
+  openssh_with_kerberos = openssh; # added 2018-01-28
  rubygems = throw "deprecated 2016-03-02: rubygems is now bundled with ruby";
  rxvt_unicode_with-plugins = rxvt_unicode-with-plugins; # added 2015-04-02
  samsungUnifiedLinuxDriver = samsung-unified-linux-driver; # added 2016-01-25
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -3890,15 +3890,12 @@ with pkgs;
  openssh =
    callPackage ../tools/networking/openssh {
      hpnSupport = false;
-      withKerberos = stdenv.isDarwin;
      etcDir = "/etc/ssh";
      pam = if stdenv.isLinux then pam else null;
    };

  openssh_hpn = pkgs.appendToName "with-hpn" (openssh.override { hpnSupport = true; });

-  openssh_with_kerberos = pkgs.appendToName "with-kerberos" (openssh.override { withKerberos = true; });
-
  opensp = callPackage ../tools/text/sgml/opensp { };

  opentracker = callPackage ../applications/networking/p2p/opentracker { };
@ -6360,7 +6357,10 @@ with pkgs;
  llvmPackages_4 = callPackage ../development/compilers/llvm/4 ({
    inherit (stdenvAdapters) overrideCC;
  } // stdenv.lib.optionalAttrs stdenv.isDarwin {
-    cmake = cmake.override { isBootstrap = true; };
+    cmake = cmake.override {
+      isBootstrap = true;
+      majorVersion = "3.9"; # 3.10.2: 'ApplicationServices/ApplicationServices.h' file not found
+    };
    libxml2 = libxml2.override { pythonSupport = false; };
    python2 = callPackage ../development/interpreters/python/cpython/2.7/boot.nix { inherit (darwin) CF configd; };
  });
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -11259,7 +11259,8 @@ let self = _self // overrides; _self = with self; {
      url = "https://alioth.debian.org/frs/download.php/file/4142/po4a-0.47.tar.gz";
      sha256 = "5010e1b7df1115cbd475f46587fc05fefc97301f9bba0c2f15106005ca017507";
    };
-    propagatedBuildInputs = [ pkgs.docbook_xml_xslt TextWrapI18N LocaleGettext TermReadKey SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
+    nativeBuildInputs = [ pkgs.docbook_xml_xslt pkgs.docbook_xsl pkgs.docbook_xsl_ns ];
+    propagatedBuildInputs = [ TextWrapI18N LocaleGettext TermReadKey SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
    buildInputs = [ pkgs.gettext pkgs.libxslt pkgs.glibcLocales pkgs.docbook_xml_dtd_412 pkgs.docbook_sgml_dtd_41 pkgs.texlive.combined.scheme-basic pkgs.jade ];
    LC_ALL="en_US.UTF-8";
    SGML_CATALOG_FILES = "${pkgs.docbook_xml_dtd_412}/xml/dtd/docbook/catalog.xml";
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1019,7 +1019,7 @@ in {

  backports_shutil_get_terminal_size = callPackage ../development/python-modules/backports_shutil_get_terminal_size { };

-  backports_ssl_match_hostname_3_4_0_2 = self.buildPythonPackage rec {
+  backports_ssl_match_hostname_3_4_0_2 = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
    name = "backports.ssl_match_hostname-3.4.0.2";

    src = pkgs.fetchurl {
@ -1033,7 +1033,7 @@ in {
    };
  };

-  backports_ssl_match_hostname = self.buildPythonPackage rec {
+  backports_ssl_match_hostname = if !(pythonOlder "3.5") then null else self.buildPythonPackage rec {
    name = "backports.ssl_match_hostname-${version}";
    version = "3.5.0.1";