summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--pkgs/applications/editors/emacs/macport.nix2
-rw-r--r--pkgs/development/compilers/go/1.10.nix4
-rw-r--r--pkgs/development/compilers/llvm/5/clang/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/5/compiler-rt.nix37
-rw-r--r--pkgs/development/compilers/llvm/5/default.nix35
-rw-r--r--pkgs/development/compilers/llvm/5/llvm.nix16
-rw-r--r--pkgs/development/compilers/smlnj/default.nix2
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/libedit/default.nix4
-rw-r--r--pkgs/development/libraries/libidn/default.nix4
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libnftnl/default.nix4
-rw-r--r--pkgs/development/libraries/libunistring/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix4
-rw-r--r--pkgs/development/libraries/libvorbis/default.nix5
-rw-r--r--pkgs/development/libraries/sqlite/analyzer.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/python-modules/Cython/default.nix10
-rw-r--r--pkgs/development/python-modules/certifi/default.nix5
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix2
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix23
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix8
-rw-r--r--pkgs/os-specific/darwin/security-tool/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/servers/sql/mariadb/default.nix4
-rw-r--r--pkgs/shells/bash/bash-4.4-patches.nix4
-rw-r--r--pkgs/stdenv/darwin/default.nix39
-rw-r--r--pkgs/test/cc-wrapper/default.nix2
-rw-r--r--pkgs/tools/networking/unbound/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix6
-rw-r--r--pkgs/top-level/perl-packages.nix16
-rw-r--r--pkgs/top-level/stage.nix2
-rw-r--r--pkgs/top-level/unix-tools.nix4
38 files changed, 167 insertions, 137 deletions
diff --git a/pkgs/applications/editors/emacs/macport.nix b/pkgs/applications/editors/emacs/macport.nix
index 9a32ea7f19f..4cdbdfb78f1 100644
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     description = "GNU Emacs 25, the extensible, customizable text editor";
     homepage    = http://www.gnu.org/software/emacs/;
     license     = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jwiegley ];
+    maintainers = with maintainers; [ jwiegley matthewbauer ];
     platforms   = platforms.darwin;
 
     longDescription = ''
diff --git a/pkgs/development/compilers/go/1.10.nix b/pkgs/development/compilers/go/1.10.nix
index 23e7ec222a6..6f5a65bd03c 100644
--- a/pkgs/development/compilers/go/1.10.nix
+++ b/pkgs/development/compilers/go/1.10.nix
@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "1lbxnlj5l9i8k1dg33dh8ndx9vspk9dkpcbg06jbbswy6kadmx6f";
+    sha256 = "0i89298dgnmpmam3ifkm0ax266vvbq1yz7wfw8wwrcma0szrbrnb";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 8027733bc52..07738048f8e 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -30,10 +30,7 @@ let
       "-DSPHINX_OUTPUT_MAN=ON"
       "-DSPHINX_OUTPUT_HTML=OFF"
       "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-    ]
-    # Maybe with compiler-rt this won't be needed?
-    ++ stdenv.lib.optional stdenv.isLinux "-DGCC_INSTALL_PREFIX=${gcc}"
-    ++ stdenv.lib.optional (stdenv.cc.libc != null) "-DC_INCLUDE_DIRS=${stdenv.cc.libc}/include";
+    ];
 
     patches = [ ./purity.patch ];
 
@@ -50,13 +47,12 @@ let
 
     outputs = [ "out" "lib" "python" ];
 
+    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      # Clang expects to find LLVMgold in its own prefix
       if [ -e ${llvm}/lib/LLVMgold.so ]; then
         ln -sv ${llvm}/lib/LLVMgold.so $out/lib
       fi
-      # Clang expects to find sanitizer libraries in its own prefix
-      ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
+
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output
diff --git a/pkgs/development/compilers/llvm/5/compiler-rt.nix b/pkgs/development/compilers/llvm/5/compiler-rt.nix
new file mode 100644
index 00000000000..19833e4d3d4
--- /dev/null
+++ b/pkgs/development/compilers/llvm/5/compiler-rt.nix
@@ -0,0 +1,37 @@
+{ stdenv, version, fetch, cmake, python, llvm, libcxxabi }:
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "compiler-rt-${version}";
+  inherit version;
+  src = fetch "compiler-rt" "0ipd4jdxpczgr2w6lzrabymz6dhzj69ywmyybjjc1q397zgrvziy";
+
+  nativeBuildInputs = [ cmake python llvm ];
+  buildInputs = stdenv.lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
+
+  configureFlags = [
+    "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  patches = [
+    ./compiler-rt-codesign.patch # Revert compiler-rt commit that makes codesign mandatory
+  ] ++ optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch;
+
+  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
+  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
+  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
+  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
+  # a flag and turn the flag off during the stdenv build.
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace cmake/config-ix.cmake \
+      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+  '';
+
+  # Hack around weird upsream RPATH bug
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    ln -s "$out/lib"/*/* "$out/lib"
+  '';
+
+  enableParallelBuilding = true;
+}
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index c3c1d87f2e4..ef2e1c29088 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -14,7 +14,6 @@ let
     inherit sha256;
   };
 
-  compiler-rt_src = fetch "compiler-rt" "0ipd4jdxpczgr2w6lzrabymz6dhzj69ywmyybjjc1q397zgrvziy";
   clang-tools-extra_src = fetch "clang-tools-extra" "018b3fiwah8f8br5i26qmzh6sjvzchpn358sn8v079m49f2jldm3";
 
   # Add man output without introducing extra dependencies.
@@ -24,12 +23,19 @@ let
 
   tools = stdenv.lib.makeExtensible (tools: let
     callPackage = newScope (tools // { inherit stdenv cmake libxml2 python2 isl release_version version fetch; });
+    mkExtraBuildCommands = cc: ''
+      rsrc="$out/resource-root"
+      mkdir "$rsrc"
+      ln -s "${cc}/lib/clang/${release_version}/include" "$rsrc"
+      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+    '' + stdenv.lib.optionalString stdenv.targetPlatform.isLinux ''
+      echo "--gcc-toolchain=${tools.clang-unwrapped.gcc}" >> $out/nix-support/cc-cflags
+    '';
   in {
 
-    llvm = overrideManOutput (callPackage ./llvm.nix {
-      inherit compiler-rt_src;
-      inherit (targetLlvmLibraries) libcxxabi;
-    });
+    llvm = overrideManOutput (callPackage ./llvm.nix { });
+
     clang-unwrapped = overrideManOutput (callPackage ./clang {
       inherit clang-tools-extra_src;
     });
@@ -40,14 +46,23 @@ let
 
     clang = if stdenv.cc.isGNU then tools.libstdcxxClang else tools.libcxxClang;
 
-    libstdcxxClang = wrapCCWith {
+    libstdcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
-      extraPackages = [ libstdcxxHook ];
+      extraPackages = [
+        libstdcxxHook
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
     };
 
-    libcxxClang = wrapCCWith {
+    libcxxClang = wrapCCWith rec {
       cc = tools.clang-unwrapped;
-      extraPackages = [ targetLlvmLibraries.libcxx targetLlvmLibraries.libcxxabi ];
+      extraPackages = [
+        targetLlvmLibraries.libcxx
+        targetLlvmLibraries.libcxxabi
+        targetLlvmLibraries.compiler-rt
+      ];
+      extraBuildCommands = mkExtraBuildCommands cc;
     };
 
     lld = callPackage ./lld.nix {};
@@ -59,6 +74,8 @@ let
     callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python2 isl release_version version fetch; });
   in {
 
+    compiler-rt = callPackage ./compiler-rt.nix {};
+
     stdenv = overrideCC stdenv buildLlvmTools.clang;
 
     libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 5070de1f48b..8809859b590 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -11,7 +11,6 @@
 , version
 , release_version
 , zlib
-, compiler-rt_src
 , libcxxabi
 , debugVersion ? false
 , enableManpages ? false
@@ -32,8 +31,6 @@ in stdenv.mkDerivation (rec {
     unpackFile ${src}
     mv llvm-${version}* llvm
     sourceRoot=$PWD/llvm
-    unpackFile ${compiler-rt_src}
-    mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
   outputs = [ "out" "python" ]
@@ -48,15 +45,7 @@ in stdenv.mkDerivation (rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
-  # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
-  # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
-  # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
-  # a flag and turn the flag off during the stdenv build.
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
-    substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
-      --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
-
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
@@ -70,9 +59,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-
-    # Revert compiler-rt commit that makes codesign mandatory
-    patch -p1 -i ${./compiler-rt-codesign.patch} -d projects/compiler-rt
   '' + stdenv.lib.optionalString stdenv.isAarch64 ''
     patch -p0 < ${../aarch64.patch}
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -80,7 +66,6 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
-    patch -p1 -i ${./sanitizers-nongnu.patch} -d projects/compiler-rt
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -95,7 +80,6 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_ENABLE_RTTI=ON"
-    "-DCOMPILER_RT_INCLUDE_TESTS=OFF" # FIXME: requires clang source code
   ]
   ++ stdenv.lib.optional enableSharedLibraries
     "-DLLVM_LINK_LLVM_DYLIB=ON"
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index 75daad36f76..9b4816bb282 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation {
   '' + stdenv.lib.optionalString stdenv.isDarwin (with darwin; ''
     sed -i '/^[[:space:]]*\*x86-darwin\*)$/,/^[[:space:]]*\*) ;;/ c\
 \  \*x86-darwin\*)\
-\    INCLFILE=${apple_sdk.sdk}/include/unistd.h\
+\    INCLFILE=${stdenv.lib.getDev apple_sdk.sdk}/include/unistd.h\
 \    ;;\
 \  \*) ;;
 ' base/runtime/config/gen-posix-names.sh
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index d098dd8fd14..81a2c869179 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.7.6";
+  version = "1.8.0";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "16rf7qwgy1gza74v2ws79zdwwb1lpvgz2abwwm8ws9j82cwysyys";
+    sha256 = "18wnbq919k5h8pfm1pfy38gs1qzj1hnfr1wq989bix1n2jiii1d1";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index 15412814420..da4bbcad4fb 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ncurses, groff }:
 
 stdenv.mkDerivation rec {
-  name = "libedit-20170329-3.1";
+  name = "libedit-20180525-3.1";
 
   src = fetchurl {
     url = "http://thrysoee.dk/editline/${name}.tar.gz";
-    sha256 = "1gnlgl0x8g9ky59s70nriy5gv47676d1s4ypvbv8y11apl7xkwli";
+    sha256 = "05iicng4kag5hxdc7adbyj1gm3qbmvcc33m9cyx5gys0s67yl6y4";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index b6f08a9206e..66ae352525f 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, libiconv }:
 
 stdenv.mkDerivation rec {
-  name = "libidn-1.34";
+  name = "libidn-1.35";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${name}.tar.gz";
-    sha256 = "0g3fzypp0xjcgr90c5cyj57apx1cmy0c6y9lvw2qdcigbyby469p";
+    sha256 = "07pyy0afqikfq51z5kbzbj9ldbd12mri0zvx0mfv3ds6bc0g26pi";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 6773b7c1b1f..3b4e3233d55 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.10.3";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "0002xk9cqzpqrlhgav1wp8nimsbp9d2w8rd8mgygczq2hjar0lhd";
+    sha256 = "04mwl1v51b785h7q3v23hahr0qzr48qq1jzj7d3msjvgh97nr8v4";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libnftnl/default.nix b/pkgs/development/libraries/libnftnl/default.nix
index 6570d1eb3c0..0d4d6504142 100644
--- a/pkgs/development/libraries/libnftnl/default.nix
+++ b/pkgs/development/libraries/libnftnl/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
   name = "libnftnl-${version}";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/libnftnl/files/${name}.tar.bz2";
-    sha256 = "0v4gywcjvv2vg4zk632al1zv3ad0lx87nshynv110l8n3fhsq3pc";
+    sha256 = "1wmgjfcb35mscb2srzia5931srygywrs1aznxmg67v177x0nasjx";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 356462e8a4a..24da3a8e2c7 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libunistring-${version}";
-  version = "0.9.9";
+  version = "0.9.10";
 
   src = fetchurl {
     url = "mirror://gnu/libunistring/${name}.tar.gz";
-    sha256 = "0jm8pr469y7ybb90ll8k1585rciqm8ckzif0laipqhp5z440rsgm";
+    sha256 = "02v17za10mxnj095x4pvm80jxyqwk93kailfc2j8xa1r6crmnbm8";
   };
 
   outputs = [ "out" "dev" "info" "doc" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index ed4397c88f0..4dc601745a4 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.20.2";
+  version = "1.20.3";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "14zlf59fr03v684ryapc57r9nfrznyk5xvcd59q04rb435ibib48";
+    sha256 = "1a8a679wni560z7x6w5i431vh2g0f34cznflcn52klx1vwcggrg7";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/libvorbis/default.nix b/pkgs/development/libraries/libvorbis/default.nix
index 2f9bca5ed95..5457b1075a3 100644
--- a/pkgs/development/libraries/libvorbis/default.nix
+++ b/pkgs/development/libraries/libvorbis/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
       sha256 = "0v21p59cb3z77ch1v6q5dcrd733h91f3m8ifnd7kkkr8gzn17d5x";
       name = "CVE-2017-14160";
     })
+    (fetchpatch {
+      url = "https://gitlab.xiph.org/xiph/vorbis/commit/112d3bd0aaa.diff";
+      sha256 = "1k77y3q36npy8mkkz40f6cb46l2ldrwyrd191m29s8rnbhnafdf7";
+      name = "CVE-2018-10392.patch";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
index a0b1220b217..031dd8f4f9c 100644
--- a/pkgs/development/libraries/sqlite/analyzer.nix
+++ b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-analyzer-${version}";
-  version = "3.23.1";
+  version = "3.24.0";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2018/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "1z3xr8d8ds4l8ndkg34cii13d0w790nlxdkrw6virinqi7wmmd1d";
+    sha256 = "19ck2sg13i6ga5vapxak42jn6050vpfid0zrmah7jh32mksh58vj";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 03f2f5c7199..ed25fcb5b80 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-${version}";
-  version = "3.23.1";
+  version = "3.24.0";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2018/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "09ggapjhqjb2pzk0wkfczil77plijg3d77m2bpzlwx2y7ql2p14j";
+    sha256 = "0jmprv2vpggzhy7ma4ynmv1jzn3pfiwzkld0kkg6hvgvqs44xlfr";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 189468a2daa..1c391d3495d 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -9,6 +9,7 @@
 , gdb
 , numpy
 , ncurses
+, fetchpatch
 }:
 
 let
@@ -48,6 +49,15 @@ in buildPythonPackage rec {
         ''--exclude="(${builtins.concatStringsSep "|" excludedTests})"''}
   '';
 
+  patches = [
+    # The following is in GitHub in 0.28.3 but not in the `sdist`.
+    # https://github.com/cython/cython/issues/2319
+    (fetchpatch {
+      url = https://github.com/cython/cython/commit/c485b1b77264c3c75d090a3c526de24966830d42.patch;
+      sha256 = "1p6jj9rb097kqvhs5j5127sj5zy18l7x9v0p478cjyzh41khh9r0";
+    })
+  ];
+
   meta = {
     description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
     homepage = http://cython.org;
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index d36f0f308d3..3bc686121cf 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -5,12 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2018.1.18";
-  name = "${pname}-${version}";
+  version = "2018.4.16";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "edbc3f203427eef571f79a7692bb160a2b0f7ccaa31953e99bd17e307cf63f7d";
+    sha256 = "13e698f54293db9f89122b0581843a782ad0934a4fe0172d2a980ba77fc61bb7";
   };
 
   meta = {
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index de316d0e5e7..0b71c6719dc 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -103,6 +103,8 @@ stdenv.mkDerivation rec {
     then "-Wno-string-plus-int -Wno-deprecated-declarations"
     else "-static-libgcc";
 
+  hardeningDisable = [ "format" ];
+
   # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
   configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (targetPlatform != hostPlatform) "target";
 
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index e89aba67999..9ccac251ab8 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -3,11 +3,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   name = "elfutils-${version}";
-  version = "0.170";
+  version = "0.171";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${name}.tar.bz2";
-    sha256 = "0rp0r54z44is49c594qy7hr211nhb00aa5y7z74vsybbaxslg10z";
+    sha256 = "0rph73czyhg7rv1vxrkyf9k12vscyxd688yw36xs7l75zzn87s6c";
   };
 
   patches = ./debug-info-from-env.patch;
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 7f6f0cdd0c4..a62182f1d34 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xar, xz, cpio, pkgs, python }:
+{ stdenv, fetchurl, xar, xz, cpio, pkgs, python, lib }:
 
 let
   # TODO: make this available to other packages and generalize the unpacking a bit
@@ -27,6 +27,7 @@ let
     buildInputs = [ xar xz cpio python ];
 
     phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+    outputs = [ "out" "dev" "man" ];
 
     unpackPhase = ''
       xar -x -f $src
@@ -87,13 +88,13 @@ let
         # ApplicationServices in the 10.9 SDK
         local isChild
 
-        if [ -d "${sdk}/Library/Frameworks/$path/Versions/$current/Headers" ]; then
+        if [ -d "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" ]; then
           isChild=1
-          cp -R "${sdk}/Library/Frameworks/$path/Versions/$current/Headers" .
+          cp -R "${sdk.out}/Library/Frameworks/$path/Versions/$current/Headers" .
         else
           isChild=0
           current="$(readlink "/System/Library/Frameworks/$name.framework/Versions/Current")"
-          cp -R "${sdk}/Library/Frameworks/$name.framework/Versions/$current/Headers" .
+          cp -R "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current/Headers" .
         fi
         ln -s -L "/System/Library/Frameworks/$path/Versions/$current/$name"
         ln -s -L "/System/Library/Frameworks/$path/Versions/$current/Resources"
@@ -103,9 +104,9 @@ let
         fi
 
         if [ $isChild -eq 1 ]; then
-          pushd "${sdk}/Library/Frameworks/$path/Versions/$current" >/dev/null
+          pushd "${sdk.out}/Library/Frameworks/$path/Versions/$current" >/dev/null
         else
-          pushd "${sdk}/Library/Frameworks/$name.framework/Versions/$current" >/dev/null
+          pushd "${sdk.out}/Library/Frameworks/$name.framework/Versions/$current" >/dev/null
         fi
         local children=$(echo Frameworks/*.framework)
         if [ "$name" == "ApplicationServices" ]; then
@@ -159,8 +160,8 @@ in rec {
       installPhase = ''
         mkdir -p $out/include
         pushd $out/include >/dev/null
-        ln -s "${sdk}/include/xpc"
-        ln -s "${sdk}/include/launch.h"
+        ln -s "${lib.getDev sdk}/include/xpc"
+        ln -s "${lib.getDev sdk}/include/launch.h"
         popd >/dev/null
       '';
     };
@@ -178,7 +179,7 @@ in rec {
 
       installPhase = ''
         mkdir -p $out/include $out/lib
-        ln -s "${sdk}/include/Xplugin.h" $out/include/Xplugin.h
+        ln -s "${lib.getDev sdk}/include/Xplugin.h" $out/include/Xplugin.h
         ln -s "/usr/lib/libXplugin.1.dylib" $out/lib/libXplugin.dylib
       '';
     };
@@ -190,8 +191,8 @@ in rec {
       installPhase = ''
         mkdir -p $out/include
         pushd $out/include >/dev/null
-        ln -s "${sdk}/include/utmp.h"
-        ln -s "${sdk}/include/utmpx.h"
+        ln -s "${lib.getDev sdk}/include/utmp.h"
+        ln -s "${lib.getDev sdk}/include/utmpx.h"
         popd >/dev/null
       '';
     };
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
index 1018100ba9c..639d377d1b6 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
@@ -13,7 +13,7 @@ appleDerivation {
       lib/RawSigner.h lib/MD2Object.h lib/HMACSHA1.h lib/bfContext.h lib/rc4Context.h; do
       substituteInPlace ''$file --replace \
         '"CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h"' \
-        '"${apple_sdk.sdk}/include/MacTypes.h"'
+        '"${stdenv.lib.getDev apple_sdk.sdk}/include/MacTypes.h"'
     done
 
     for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
index 2a05855bd52..f5035a06f1e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -25,7 +25,7 @@ appleDerivation {
     mkdir -p include/securityd_client
     cp Security-*/libsecurityd/lib/*.h include/securityd_client
     mkdir -p include/xpc
-    cp ${apple_sdk.sdk}/include/xpc/*.h include/xpc
+    cp ${apple_sdk.sdk.out}/include/xpc/*.h include/xpc
 
     sed -i '1i #define bool int' lib/security_codesigning.d
     dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
index fb1ea2509d7..435cd0f069f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -1,4 +1,4 @@
-{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk }:
+{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk, lib }:
 appleDerivation {
   buildInputs = [
     libsecurity_utilities
@@ -7,7 +7,7 @@ appleDerivation {
   ];
   patchPhase = ''
     cp ${osx_private_sdk}/include/sandbox_private.h .
-    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${apple_sdk.sdk}/include/sandbox.h"'
+    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${lib.getDev apple_sdk.sdk}/include/sandbox.h"'
     substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
index 93857ea792c..2783e4edb43 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -15,13 +15,13 @@ name: version: sha256: args: let
         grep -Rl MacErrors.h . | while read file; do
           substituteInPlace "''$file" --replace \
             '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-            '"${pkgs.darwin.apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+            '"${pkgs.darwin.apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
         done || true # grep returns 1 if it can't find the string
-        
+
         grep -Rl MacTypes.h . | while read file; do
           substituteInPlace "''$file" --replace \
             '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
-            '"${pkgs.darwin.apple_sdk.sdk}/include/MacTypes.h"'
+            '"${pkgs.darwin.apple_sdk.sdk.out}/include/MacTypes.h"'
         done || true # grep returns 1 if it can't find the string
       '';
       preBuild = ''
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
index 06137879410..07a3186caee 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -1,4 +1,4 @@
-{ CF, Security, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp }:
+{ CF, Security, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp, lib }:
 appleDerivation {
   buildInputs = [
     libsecurity_utilities
@@ -19,7 +19,7 @@ appleDerivation {
     substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
 
     cp ${osx_private_sdk}/include/xpc/private.h xpc
-    cp ${apple_sdk.sdk}/include/xpc/*.h xpc
+    cp ${lib.getDev apple_sdk.sdk}/include/xpc/*.h xpc
     cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h
 
     substituteInPlace lib/SecItemPriv.h \
@@ -29,7 +29,7 @@ appleDerivation {
 
     substituteInPlace lib/Keychains.cpp --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
 
     substituteInPlace lib/CertificateValues.cpp --replace \
       '#include <Security/SecCertificatePriv.h>' ""
@@ -42,6 +42,6 @@ appleDerivation {
 
     substituteInPlace lib/KCEventNotifier.h --replace \
       'CoreFoundation/CFNotificationCenter.h' \
-      '${apple_sdk.sdk}/Library/Frameworks/CoreFoundation.framework/Versions/A/Headers/CFNotificationCenter.h'
+      '${apple_sdk.sdk.out}/Library/Frameworks/CoreFoundation.framework/Versions/A/Headers/CFNotificationCenter.h'
   '';
 }
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
index 2b8c7718aee..e6846aef750 100644
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
 
     substituteInPlace cmsutil.c --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
     substituteInPlace createFVMaster.c --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
   '';
 
   postUnpack = ''
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 8ccb0c20380..3f5ed788bb2 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
-  version = "4.16.0";
+  version = "4.17.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "02pfalg319jpbjz273ph725br8dnkzpfvi98azi9yd6p1w128p0c";
+    sha256 = "0vmynikcamfhakvwyk5dsffy0ymgi5mdqiwybdvqfn1ijaq93abg";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index fee35a62333..4b254262f9f 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -177,11 +177,11 @@ everything = stdenv.mkDerivation (common // {
 
 connector-c = stdenv.mkDerivation rec {
   name = "mariadb-connector-c-${version}";
-  version = "2.3.5";
+  version = "2.3.6";
 
   src = fetchurl {
     url = "https://downloads.mariadb.org/interstitial/connector-c-${version}/mariadb-connector-c-${version}-src.tar.gz/from/http%3A//ftp.hosteurope.de/mirror/archive.mariadb.org/?serve";
-    sha256 = "0vvlfs56hxin130vh8pcs5w7jpv1yc6g76bhpzg88hnp4v1z8frg";
+    sha256 = "15iy5iqp0njbwbn086x2dq8qnbkaci7ydvi84cf5z8fxvljis9vb";
     name   = "mariadb-connector-c-${version}-src.tar.gz";
   };
 
diff --git a/pkgs/shells/bash/bash-4.4-patches.nix b/pkgs/shells/bash/bash-4.4-patches.nix
index 2d512812029..a79ec90213a 100644
--- a/pkgs/shells/bash/bash-4.4-patches.nix
+++ b/pkgs/shells/bash/bash-4.4-patches.nix
@@ -20,4 +20,8 @@ patch: [
 (patch "017" "0w6jpj2giakji1ir83rpkx1y7n7xqppah3j748m6dm38hywr0gvp")
 (patch "018" "1k58h4wxbsg7r4rwhrvzx5hfbapba2nxjysbhh6qp6ki5ys99i2v")
 (patch "019" "07n1i5610lbs672x1s8g82qn3qfj06s0ip3z80sri0g8vxp0s5r7")
+(patch "020" "0b2jk5n1af1vh590qfc52hv65mafb4vl1xv26s8j5a3byb5y4h0q")
+(patch "021" "1hblcd2xmqqlp0idnavw66570n7m0yv5rbbr873c2gkn982mk3xx")
+(patch "022" "0yfbjzr79vzjs2hyi5m8iy2b38fq7vikdfa4zqdvjsp36q4iycs5")
+(patch "023" "1dlism6qdx60nvzj0v7ndr7lfahl4a8zmzckp13hqgdx7xpj7v2g")
 ]
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 71de45bb1d7..366be391580 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -239,9 +239,11 @@ in rec {
         openssh sqlite sed serf openldap db cyrus-sasl expat apr-util
         findfreetype libssh curl cmake autoconf automake libtool cpio;
 
-      llvmPackages_5 = super.llvmPackages_5 // {
-        inherit (llvmPackages_5) libcxx libcxxabi;
-      };
+      llvmPackages_5 = super.llvmPackages_5 // (let
+        libraries = super.llvmPackages_5.libraries.extend (_: _: {
+          inherit (llvmPackages_5) libcxx libcxxabi;
+        });
+      in { inherit libraries; } // libraries);
 
       darwin = super.darwin // {
         inherit (darwin)
@@ -280,12 +282,11 @@ in rec {
         coreutils findutils diffutils patchutils;
 
       llvmPackages_5 = super.llvmPackages_5 // (let
-        tools = super.llvmPackages_5.tools.extend (_: _: {
-          llvm = llvmPackages_5.llvm.override { inherit libcxxabi; };
-          clang-unwrapped = llvmPackages_5.clang-unwrapped.override { llvm = self.llvmPackages_5.llvm; };
+        tools = super.llvmPackages_5.tools.extend (llvmSelf: _: {
+          inherit (llvmPackages_5) llvm clang-unwrapped;
         });
-        libraries = super.llvmPackages_5.libraries.extend (_: _: {
-          inherit (llvmPackages_5) libcxx libcxxabi;
+        libraries = super.llvmPackages_5.libraries.extend (llvmSelf: _: {
+          inherit (llvmPackages_5) libcxx libcxxabi compiler-rt;
         });
       in { inherit tools libraries; } // tools // libraries);
 
@@ -335,7 +336,7 @@ in rec {
             llvmPackages_5.clang-unwrapped;
         });
         libraries = super.llvmPackages_5.libraries.extend (_: _: {
-          inherit (llvmPackages_5) libcxx libcxxabi;
+          inherit (llvmPackages_5) compiler-rt libcxx libcxxabi;
         });
       in { inherit tools libraries; } // tools // libraries);
 
@@ -369,20 +370,9 @@ in rec {
     initialPath = import ../common-path.nix { inherit pkgs; };
     shell       = "${pkgs.bash}/bin/bash";
 
-    cc = lib.callPackageWith {} ../../build-support/cc-wrapper {
-      inherit (pkgs) stdenvNoCC;
-      inherit shell;
-      nativeTools = false;
-      nativeLibc  = false;
-      buildPackages = {
-        inherit (prevStage) stdenv;
-      };
-      inherit (pkgs) coreutils gnugrep;
-      # Hack to avoid man pages in stdenv to avoid mass rebuild
-      cc       = builtins.removeAttrs pkgs.llvmPackages.clang-unwrapped [ "man" ];
-      bintools = pkgs.darwin.binutils;
-      libc     = pkgs.darwin.Libsystem;
-      extraPackages = [ pkgs.libcxx ];
+    # Hack to avoid man pages in stdenv, building bootstrap python
+    cc = pkgs.llvmPackages.libcxxClang.override {
+      cc = builtins.removeAttrs pkgs.llvmPackages.clang-unwrapped [ "man" ];
     };
 
     extraNativeBuildInputs = [];
@@ -399,7 +389,8 @@ in rec {
 
     allowedRequisites = (with pkgs; [
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
-      bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
+      bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib llvmPackages.compiler-rt llvmPackages.compiler-rt.dev
+      zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
       gnugrep llvmPackages.clang-unwrapped llvmPackages.clang-unwrapped.lib patch pcre.out gettext
       binutils.bintools darwin.binutils darwin.binutils.bintools
diff --git a/pkgs/test/cc-wrapper/default.nix b/pkgs/test/cc-wrapper/default.nix
index f9c6e9e7779..7bd82b4ab2a 100644
--- a/pkgs/test/cc-wrapper/default.nix
+++ b/pkgs/test/cc-wrapper/default.nix
@@ -4,7 +4,7 @@ let
   # Sanitizers are not supported on Darwin.
   # Sanitizer headers aren't available in older libc++ stdenvs due to a bug
   sanitizersWorking =
-       (stdenv.cc.isClang && versionAtLeast (getVersion stdenv.cc.name) "6.0.0")
+       (stdenv.cc.isClang && versionAtLeast (getVersion stdenv.cc.name) "5.0.0")
     || (stdenv.cc.isGNU && stdenv.isLinux);
 in stdenv.mkDerivation {
   name = "cc-wrapper-test";
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index d7ef54a2497..6e28e15c4c1 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "13b210hd200xxvaffyzqb4g58knv1sfigph70ai74lrcb3pqbq2n";
+    sha256 = "187a8l4292b43wwam2w12pzc33dvirii484b2b7r46bi6jxwfpx8";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     # get rid of runtime dependencies on $dev outputs
   + ''substituteInPlace "$lib/lib/libunbound.la" ''
     + stdenv.lib.concatMapStrings
-      (pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' ")
+      (pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' --replace '-R${pkg.dev}/lib' '-R${pkg.out}/lib'")
       buildInputs;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f310fd156c3..5dafcfe2257 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1,4 +1,4 @@
-self:
+lib: self: super:
 
 with self;
 
@@ -19,7 +19,7 @@ let
 
   # Make sure that we are not shadowing something from
   # all-packages.nix.
-  checkInPkgs = n: alias: if builtins.hasAttr n self
+  checkInPkgs = n: alias: if builtins.hasAttr n super
                           then throw "Alias ${n} is still in all-packages.nix"
                           else alias;
 
@@ -32,7 +32,7 @@ in
 
   ### Deprecated aliases - for backward compatibility
 
-mapAliases (rec {
+mapAliases ({
   PPSSPP = ppsspp; # added 2017-10-01
   QmidiNet = qmidinet;  # added 2016-05-22
   accounts-qt = libsForQt5.accounts-qt; # added 2015-12-19
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6c2b726a06b..00689e1f5b2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1464,21 +1464,7 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  CatalystPluginUnicodeEncoding = buildPerlPackage {
-    name = "Catalyst-Plugin-Unicode-Encoding-1.9";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/B/BO/BOBTFISH/Catalyst-Plugin-Unicode-Encoding-1.9.tar.gz;
-      sha256 = "1glxkh79zz71bmgk44hnhsi37z2mgxcwf7bkmwlnwv3jh1iaz0ah";
-    };
-    buildInputs = [ HTTPMessage IOStringy ];
-    propagatedBuildInputs = [ CatalystRuntime ClassDataInheritable LWP TryTiny URI ];
-    meta = {
-      description = "Unicode aware Catalyst";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-      maintainers = with maintainers; [ ];
-      platforms   = stdenv.lib.platforms.unix;
-    };
-  };
+  CatalystPluginUnicodeEncoding = CatalystRuntime;
 
   CatalystPluginHTMLWidget = buildPerlPackage rec {
     name = "Catalyst-Plugin-HTML-Widget-1.1";
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index e38f5442d3a..f9941a1c500 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -98,7 +98,7 @@ let
     in res;
 
   aliases = self: super: if config.skipAliases or false then {}
-                         else import ./aliases.nix super;
+                         else import ./aliases.nix lib self super;
 
   # stdenvOverrides is used to avoid having multiple of versions
   # of certain dependencies that were used in bootstrapping the
diff --git a/pkgs/top-level/unix-tools.nix b/pkgs/top-level/unix-tools.nix
index 362715e8262..c1bd46ad68d 100644
--- a/pkgs/top-level/unix-tools.nix
+++ b/pkgs/top-level/unix-tools.nix
@@ -19,14 +19,12 @@ let
     in runCommand "${cmd}-${version}" {
       meta.platforms = map (n: { kernel.name = n; }) (pkgs.lib.attrNames providers);
     } ''
-      mkdir -p $out/bin
-
       if ! [ -x "${provider}" ]; then
         echo "Cannot find command ${cmd}"
         exit 1
       fi
 
-      ln -s "${provider}" "$out/bin/${cmd}"
+      install -D "${provider}" "$out/bin/${cmd}"
     '';
 
   # more is unavailable in darwin