Merge remote-tracking branch 'origin/master' into staging

33 files changed, 1518 insertions, 83 deletions

diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index a23324c7fdac..8dab9e32f982 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -24,6 +24,15 @@ in stdenv.mkDerivation rec {
     sha256 = "0hzcns8gf5yb0rm4ss8jd8qzarcaplp5cylk6plwilsqfvxj4xn2";
   };
 
+  patches = [
+    # build with GStreamer 1.14 https://bugzilla.gnome.org/show_bug.cgi?id=788706
+    (fetchurl {
+      name = "fmradio-Fix-build-with-GStreamer-master.patch";
+      url = https://bugzilla.gnome.org/attachment.cgi?id=361178;
+      sha256 = "1h09mimlglj9hcmc3pfp0d6c277mqh2khwv9fryk43pkv3904d2w";
+    })
+  ];
+
   nativeBuildInputs = [
     pkgconfig
     intltool perl perlPackages.XMLParser
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 1710c0e35531..136ef7dfc23d 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -530,18 +530,13 @@ rec {
     };
   };
 
-  spotbugs = buildEclipsePlugin rec {
+  spotbugs = buildEclipseUpdateSite rec {
     name = "spotbugs-${version}";
-    version = "3.1.2.r201802250230-59118d9";
+    version = "3.1.3";
 
-    srcFeature = fetchurl {
-      url = "https://spotbugs.github.io/eclipse/features/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "1p0pz7znpfi5h1wr60sl8clkpd7rzkh7krmc0nxc6w43gkgkg9h4";
-    };
-
-    srcPlugin = fetchurl {
-      url = "https://spotbugs.github.io/eclipse/plugins/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "1z3jjbcjif4qip1gx2dhfcm9fyhps96ms7z3ngbdcakgw7wai9v4";
+    src = fetchzip {
+      url = "https://github.com/spotbugs/spotbugs/releases/download/${version}/eclipsePlugin.zip";
+      sha256 = "01zrmk497bxzqgwgbpsvi5iz5qk9b4q949h4918abm54zvkgndlg";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index a5db33a0bb5a..4a10d68ee4dc 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -32,18 +32,18 @@ let
   ];
 in buildRustPackage rec {
   name = "alacritty-unstable-${version}";
-  version = "2018-03-04";
+  version = "2018-04-16";
 
   # At the moment we cannot handle git dependencies in buildRustPackage.
   # This fork only replaces rust-fontconfig/libfontconfig with a git submodules.
   src = fetchgit {
     url = https://github.com/Mic92/alacritty.git;
     rev = "rev-${version}";
-    sha256 = "0pxnc6r75c7rwnsqc0idi4a60arpgchl1i8yppibhv0px5w11mwa";
+    sha256 = "14qsfaij631pk0gxrhmp594f72v0z7kzymf4hnqv4k5w9xlxciwx";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "0q2yy9cldng8znkmhysgrwi43z2x7a8nb1bnxpy9z170q8ds0m0j";
+  cargoSha256 = "0gg28fbx0kisv7hqxgzqhv4z4ikk074djfjlj90nmmi4nddp017p";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index 1867ec3a9c62..eafe0b9b5c64 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, lib, cmake, xorg, plasma-framework, fetchFromGitHub
 , extra-cmake-modules, karchive, kwindowsystem, qtx11extras, kcrash }:
 
-let version = "0.7.4"; in
+let version = "0.7.5"; in
 
 mkDerivation {
   name = "latte-dock-${version}";
@@ -10,7 +10,7 @@ mkDerivation {
     owner = "psifidotos";
     repo = "Latte-Dock";
     rev = "v${version}";
-    sha256 = "0w4fphgpdvql31wrypxyfahmr4cv5ap96wjc4270yyawnrqrx0y6";
+    sha256 = "0fblbx6qk4miag1mhiyns7idsw03p9pj3xc3xxxnb5rpj1fy0ifv";
   };
 
   buildInputs = [ plasma-framework xorg.libpthreadstubs xorg.libXdmcp xorg.libSM ];
diff --git a/pkgs/applications/misc/orca/default.nix b/pkgs/applications/misc/orca/default.nix
index abc8c3e78424..e05cb0ad6f9d 100644
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, pkgconfig, fetchurl, buildPythonApplication
-, autoreconfHook, wrapGAppsHook
+, autoreconfHook, wrapGAppsHook, gobjectIntrospection
 , intltool, yelp-tools, itstool, libxmlxx3
 , python, pygobject3, gtk3, gnome3, substituteAll
 , at-spi2-atk, at-spi2-core, pyatspi, dbus, dbus-python, pyxdg
@@ -30,11 +30,12 @@ in buildPythonApplication rec {
 
   nativeBuildInputs = [
     autoreconfHook wrapGAppsHook pkgconfig libxmlxx3
-    intltool yelp-tools itstool
+    intltool yelp-tools itstool gobjectIntrospection
   ];
 
   propagatedBuildInputs = [
-    pygobject3 pyatspi dbus-python pyxdg brltty liblouis speechd gst-python setproctitle
+    # TODO: re-add liblouis when it is fixed
+    pygobject3 pyatspi dbus-python pyxdg brltty speechd gst-python setproctitle
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/misc/pcmanfm/default.nix b/pkgs/applications/misc/pcmanfm/default.nix
index 148dd427fbc7..a77b2d17ecb4 100644
--- a/pkgs/applications/misc/pcmanfm/default.nix
+++ b/pkgs/applications/misc/pcmanfm/default.nix
@@ -7,10 +7,10 @@ let
   inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "pcmanfm-1.2.5";
+  name = "pcmanfm-1.3.0";
   src = fetchurl {
     url = "mirror://sourceforge/pcmanfm/${name}.tar.xz";
-    sha256 = "0rxdh0dfzc84l85c54blq42gczygq8adhr3l9hqzy1dp530cm1hc";
+    sha256 = "1ywgfyklms5hqkapsbjps4kyx20ac0d1qk16ww74yagkyfdkwsas";
   };
 
   buildInputs = [ glib gtk libfm' libX11 pango gnome3.defaultIconTheme ];
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index 225d622c69f9..538e9a3786be 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -4,11 +4,11 @@
 , gsm, speex, portaudio, spandsp, libuuid, ccache, libvpx
 }:
 stdenv.mkDerivation rec {
-  version = "0.5.8";
+  version = "0.5.9";
   name = "baresip-${version}";
   src=fetchurl {
     url = "http://www.creytiv.com/pub/baresip-${version}.tar.gz";
-    sha256 = "0qk6y83mm7cz4j66d7zy72l7890k7ifqnqbqnjd3bjfn1yjivwfr";
+    sha256 = "02bf4fwirf3b7h3cr1jqm0xsjzza4fi9kg88424js2l0xywwzpgf";
   };
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [zlib openssl libre librem
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index fd253c389a27..32808f720bf1 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -13,13 +13,13 @@
  }:
 
 stdenv.mkDerivation rec {
-  name = "dino-unstable-2018-03-10";
+  name = "dino-unstable-2018-04-19";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "4ccdc1d0920a93b313d81b4014b6f45efb49b1fe";
-    sha256 = "0d9698zi09s107zva6cgip7xxmdby0zfmqvka4n0khxrsnii5awq";
+    rev = "e80da806022d8aaa32f77f3c7f0333cc1c80829b";
+    sha256 = "04z4k1s4ck6vmbzlbpiw096ny0wpj4zi3cd0iv9vb2iwdj22gibm";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index b1d5ad5b242c..fe9f3136e58f 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,9 +1,11 @@
-{ fetchurl, stdenv, curl, openssl, zlib, expat, perl, python, gettext, cpio
+{ fetchurl, stdenv, buildPackages
+, curl, openssl, zlib, expat, perl, python, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs
+, perlSupport ? true
 , guiSupport
 , withManual ? true
 , pythonSupport ? true
@@ -12,9 +14,12 @@
 , darwin
 }:
 
+assert sendEmailSupport -> perlSupport;
+assert svnSupport -> perlSupport;
+
 let
   version = "2.16.3";
-  svn = subversionClient.override { perlBindings = true; };
+  svn = subversionClient.override { perlBindings = perlSupport; };
 in
 
 stdenv.mkDerivation {
@@ -25,7 +30,7 @@ stdenv.mkDerivation {
     sha256 = "0j1dwvg5llnj3g0fp8hdgpms4hp90qw9f6509vqw30dhwplrjpfn";
   };
 
-  outputs = [ "out" "gitweb" ];
+  outputs = [ "out" ] ++ stdenv.lib.optional perlSupport "gitweb";
 
   hardeningDisable = [ "format" ];
 
@@ -44,9 +49,11 @@ stdenv.mkDerivation {
     done
   '';
 
-  buildInputs = [curl openssl zlib expat gettext cpio makeWrapper libiconv perl]
+  nativeBuildInputs = [ gettext perl ]
     ++ stdenv.lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
-         docbook_xsl docbook_xml_dtd_45 libxslt ]
+         docbook_xsl docbook_xml_dtd_45 libxslt ];
+  buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
+    ++ stdenv.lib.optionals perlSupport [ perl ]
     ++ stdenv.lib.optionals guiSupport [tcl tk]
     ++ stdenv.lib.optionals withpcre2 [ pcre2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.Security ];
@@ -56,19 +63,25 @@ stdenv.mkDerivation {
   NIX_LDFLAGS = stdenv.lib.optionalString (!stdenv.cc.isClang) "-lgcc_s"
               + stdenv.lib.optionalString (stdenv.isFreeBSD) "-lthr";
 
+  configureFlags = stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "ac_cv_fread_reads_directories=yes"
+    "ac_cv_snprintf_returns_bogus=no"
+  ];
+
   preBuild = ''
     makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
   '';
 
-  makeFlags = stdenv.lib.concatStringsSep " " [
+  makeFlags = [
     "prefix=\${out}"
-    "PERL_PATH=${perl}/bin/perl"
     "SHELL_PATH=${stdenv.shell}"
-    (if pythonSupport then "PYTHON_PATH=${python}/bin/python" else "NO_PYTHON=1")
-    (if stdenv.isSunOS then "INSTALL=install NO_INET_NTOP= NO_INET_PTON=" else "")
-    (if stdenv.isDarwin then "NO_APPLE_COMMON_CRYPTO=1" else "sysconfdir=/etc/ ")
-    (if stdenv.hostPlatform.isMusl then "NO_SYS_POLL_H=1 NO_GETTEXT=YesPlease" else "")
-  ];
+  ]
+  ++ (if perlSupport then ["PERL_PATH=${perl}/bin/perl"] else ["NO_PERL=1"])
+  ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
+  ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
+  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
+  ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
+  ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1";
 
   # build git-credential-osxkeychain if darwin
   postBuild = stdenv.lib.optionalString stdenv.isDarwin ''
@@ -81,9 +94,7 @@ stdenv.mkDerivation {
   # so that `SPARSE_FLAGS' corresponds to the current architecture...
   #doCheck = true;
 
-  installFlags = "NO_INSTALL_HARDLINKS=1"
-    + (if withpcre2 then " USE_LIBPCRE2=1" else "");
-
+  installFlags = "NO_INSTALL_HARDLINKS=1";
 
   preInstall = stdenv.lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/bin
@@ -123,9 +134,10 @@ stdenv.mkDerivation {
       SCRIPT="$(cat <<'EOS'
         BEGIN{
           @a=(
-            '${perl}/bin/perl', '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
+            '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
             '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
             '${coreutils}/bin/wc', '${coreutils}/bin/tr'
+            ${stdenv.lib.optionalString perlSupport ", '${perl}/bin/perl'"}
           );
         }
         foreach $c (@a) {
@@ -141,12 +153,12 @@ stdenv.mkDerivation {
       substituteInPlace $out/libexec/git-core/git-sh-i18n \
           --subst-var-by gettext ${gettext}
 
-      # put in separate package for simpler maintenance
-      mv $out/share/gitweb $gitweb/
-
       # Also put git-http-backend into $PATH, so that we can use smart
       # HTTP(s) transports for pushing
       ln -s $out/libexec/git-core/git-http-backend $out/bin/git-http-backend
+    '' + stdenv.lib.optionalString perlSupport ''
+      # put in separate package for simpler maintenance
+      mv $out/share/gitweb $gitweb/
 
       # wrap perl commands
       gitperllib=$out/lib/perl5/site_perl
@@ -192,7 +204,7 @@ stdenv.mkDerivation {
        '')
 
    + stdenv.lib.optionalString withManual ''# Install man pages and Info manual
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${perl}/bin/perl" cmd-list.made install install-info \
+       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-info \
          -C Documentation ''
 
    + (if guiSupport then ''
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index 6ee594b33b27..0975c3478820 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -1,5 +1,10 @@
 source $stdenv/setup
 
+(echo '#!/usr/bin/env sh'; \
+ echo 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"') > ssh
+chmod +x ssh
+export CVS_RSH=$PWD/ssh
+
 # creating the export drictory and checking out there only to be able to
 # move the content without the root directory into $out ...
 # cvs -f -d "$url" export $tag -d "$out" "$module"
diff --git a/pkgs/build-support/fetchcvs/default.nix b/pkgs/build-support/fetchcvs/default.nix
index 9d9deb3f629e..1f7947d4d452 100644
--- a/pkgs/build-support/fetchcvs/default.nix
+++ b/pkgs/build-support/fetchcvs/default.nix
@@ -3,18 +3,18 @@
 # tag="<tagname>" (get version by tag name)
 # If you don't specify neither one date="NOW" will be used (get latest)
 
-{stdenvNoCC, cvs}:
+{stdenvNoCC, cvs, openssh}:
 
 {cvsRoot, module, tag ? null, date ? null, sha256}:
 
 stdenvNoCC.mkDerivation {
   name = "cvs-export";
   builder = ./builder.sh;
-  nativeBuildInputs = [cvs];
+  nativeBuildInputs = [cvs openssh];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = sha256;
-  
+
   inherit cvsRoot module sha256 tag date;
 }
diff --git a/pkgs/development/libraries/appstream-glib/default.nix b/pkgs/development/libraries/appstream-glib/default.nix
index 2499a424c85c..6ad6b158826f 100644
--- a/pkgs/development/libraries/appstream-glib/default.nix
+++ b/pkgs/development/libraries/appstream-glib/default.nix
@@ -4,7 +4,7 @@
 , libuuid, json-glib, meson, gperf, ninja
 }:
 stdenv.mkDerivation rec {
-  name = "appstream-glib-0.7.7";
+  name = "appstream-glib-0.7.8";
 
   outputs = [ "out" "dev" "man" "installedTests" ];
   outputBin = "dev";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "appstream-glib";
     rev = stdenv.lib.replaceStrings ["." "-"] ["_" "_"] name;
-    sha256 = "127m5ds355i1vfvmn9nd4zqqnqm16jpqcn4p2p2pvn7i4wqxra40";
+    sha256 = "10hcl3sl3g8ajg9mssq3g4dbzz0d4b2ybimrcq71cpycqrqhilhx";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index c8716bfdc796..31567f0049dd 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -95,12 +95,7 @@ stdenv.mkDerivation ({
       ./allow-kernel-2.6.32.patch
     ]
     ++ lib.optional stdenv.isx86_64 ./fix-x64-abi.patch
-    ++ lib.optional stdenv.hostPlatform.isMusl
-      (fetchpatch {
-        name = "fix-with-musl.patch";
-        url = "https://sourceware.org/bugzilla/attachment.cgi?id=10151&action=diff&collapsed=&headers=1&format=raw";
-        sha256 = "18kk534k6da5bkbsy1ivbi77iin76lsna168mfcbwv4ik5vpziq2";
-      });
+    ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch;
 
   postPatch =
     ''
diff --git a/pkgs/development/libraries/glibc/fix-rpc-types-musl-conflicts.patch b/pkgs/development/libraries/glibc/fix-rpc-types-musl-conflicts.patch
new file mode 100644
index 000000000000..19f8bfc7cce8
--- /dev/null
+++ b/pkgs/development/libraries/glibc/fix-rpc-types-musl-conflicts.patch
@@ -0,0 +1,38 @@
+@@ -, +, @@ 
+---
+ sunrpc/rpc/types.h | 22 ++++++----------------
+ 1 file changed, 6 insertions(+), 16 deletions(-)
+--- a/sunrpc/rpc/types.h	
++++ a/sunrpc/rpc/types.h	
+@@ -69,24 +69,14 @@ typedef unsigned long rpcport_t;
+ #include <sys/types.h>
+ #endif
+ 
+-#if defined __APPLE_CC__ || defined __FreeBSD__
+-# define __u_char_defined
+-# define __daddr_t_defined
+-#endif
+-
+-#ifndef __u_char_defined
+-typedef __u_char u_char;
+-typedef __u_short u_short;
+-typedef __u_int u_int;
+-typedef __u_long u_long;
+-typedef __quad_t quad_t;
+-typedef __u_quad_t u_quad_t;
+-typedef __fsid_t fsid_t;
++/* IMPORTANT NOTE: This has been modified to build against the musl C
++ * library and it probably now ONLY builds with the musl C library.
++ *
++ * See: https://sourceware.org/bugzilla/show_bug.cgi?id=21604
++ */
+ # define __u_char_defined
+-#endif
+ #ifndef __daddr_t_defined
+-typedef __daddr_t daddr_t;
+-typedef __caddr_t caddr_t;
++typedef int daddr_t;
+ # define __daddr_t_defined
+ #endif
+ 
+-- 
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 4bc1d1addcfb..7e1a2b549681 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -22,6 +22,9 @@ in stdenv.mkDerivation rec {
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
   ];
 
+  # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
+  configureFlags  = stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-tls";
+
   # Upstream patch fixing use of libdl, should be in next release.
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/libraries/liblouis/default.nix b/pkgs/development/libraries/liblouis/default.nix
index bde1ff4e4936..a6005d66b4d6 100644
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@@ -50,6 +50,7 @@ in stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Open-source braille translator and back-translator";
     homepage = http://liblouis.org/;
+    broken = true;
     license = licenses.lgpl21;
     maintainers = with maintainers; [ jtojnar ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libre/default.nix b/pkgs/development/libraries/libre/default.nix
index ebe765a0d0d4..c996c5c25f94 100644
--- a/pkgs/development/libraries/libre/default.nix
+++ b/pkgs/development/libraries/libre/default.nix
@@ -1,10 +1,10 @@
 {stdenv, fetchurl, zlib, openssl}:
 stdenv.mkDerivation rec {
-  version = "0.5.7";
+  version = "0.5.8";
   name = "libre-${version}";
   src = fetchurl {
     url = "http://www.creytiv.com/pub/re-${version}.tar.gz";
-    sha256 = "0f8h224xfzvnb2ngvhxz8gzxqjlkkfr6d0nj8zqivzr81ihibk2x";
+    sha256 = "0w0f8j43j0nzgvkmv3ayzrssppgjmsh6z8mpa5iqsz8nv99dc3qr";
   };
   buildInputs = [ zlib openssl ];
   makeFlags = [ "USE_ZLIB=1" "USE_OPENSSL=1" "PREFIX=$(out)" ]
diff --git a/pkgs/development/libraries/librem/default.nix b/pkgs/development/libraries/librem/default.nix
index f6e041e57322..b173eddda7d0 100644
--- a/pkgs/development/libraries/librem/default.nix
+++ b/pkgs/development/libraries/librem/default.nix
@@ -1,10 +1,10 @@
 {stdenv, fetchurl, zlib, openssl, libre}:
 stdenv.mkDerivation rec {
-  version = "0.5.2";
+  version = "0.5.3";
   name = "librem-${version}";
   src=fetchurl {
     url = "http://www.creytiv.com/pub/rem-${version}.tar.gz";
-    sha256 = "1sv4986yyq42irk9alwp20gc3r5y0r6kix15sl8qmljgxn0lxigv";
+    sha256 = "0l401sn8lkzz9gvnvww6839xa0ys1q7w66krln194w6l8ycsg64z";
   };
   buildInputs = [zlib openssl libre];
   makeFlags = [
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index fae83a95f3ca..1033c87b54c3 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -125,7 +125,8 @@ let self = stdenv.mkDerivation {
     "--enable-gles1"
     "--enable-gles2"
     "--enable-glx"
-    "--enable-glx-tls"
+    # https://bugs.freedesktop.org/show_bug.cgi?id=35268
+    (enableFeature (!stdenv.hostPlatform.isMusl) "glx-tls")
     "--enable-gallium-osmesa" # used by wine
     "--enable-llvm"
     "--enable-egl"
diff --git a/pkgs/development/python-modules/entrypoints/default.nix b/pkgs/development/python-modules/entrypoints/default.nix
index c4f5410bc518..9ee0810571ad 100644
--- a/pkgs/development/python-modules/entrypoints/default.nix
+++ b/pkgs/development/python-modules/entrypoints/default.nix
@@ -15,9 +15,9 @@ buildPythonPackage rec {
     sha256 = "d2d587dde06f99545fb13a383d2cd336a8ff1f359c5839ce3a64c917d10c029f";
   };
 
-  checkInputs = [ pytest];
+  checkInputs = [ pytest ];
 
-  propagatedBuildInputs = [] ++ lib.optional (!isPy3k) [ configparser ];
+  propagatedBuildInputs = lib.optional (!isPy3k) configparser;
 
   checkPhase = ''
     py.test tests
@@ -28,4 +28,4 @@ buildPythonPackage rec {
     homepage = https://github.com/takluyver/entrypoints;
     license = lib.licenses.mit;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/pyatspi/default.nix b/pkgs/development/python-modules/pyatspi/default.nix
index 6192f94445f3..5960551abc72 100644
--- a/pkgs/development/python-modules/pyatspi/default.nix
+++ b/pkgs/development/python-modules/pyatspi/default.nix
@@ -1,29 +1,35 @@
-{ stdenv, fetchurl, pkgconfig, at-spi2-core, pythonPackages }:
+{ stdenv, fetchurl, pkgconfig, buildPythonPackage, isPy3k, at-spi2-core, pygobject3, gnome3 }:
 
-stdenv.mkDerivation rec {
+buildPythonPackage rec {
   pname = "pyatspi";
-  version = "2.18.0";
-  name = "${pname}-${version}";
+  version = "2.26.0";
+  format = "other";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/pyatspi/2.18/${name}.tar.xz";
-    sha256 = "0imbyk2v6c11da7pkwz91313pkkldxs8zfg81zb2ql6h0nnh6vzq";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0xdnix7gxzgf75xy9ris4dd6b05mqwicw190b98xqmypydyf95n6";
   };
 
-  broken = true;
-
   buildInputs = [
     at-spi2-core
     pkgconfig
-    pythonPackages.python
-    pythonPackages.pygobject3
+    pygobject3
   ];
 
+  disabled = !isPy3k;
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "python3.pkgs.${pname}";
+    };
+  };
+
   meta = with stdenv.lib; {
-    description = "Python 3 bindings for at-spi";
-    homepage = http://www.linuxfoundation.org/en/AT-SPI_on_D-Bus;
+    description = "Python client bindings for D-Bus AT-SPI";
+    homepage = https://wiki.linuxfoundation.org/accessibility/d-bus;
     license = licenses.gpl2;
-    maintainers = with maintainers; [ jgeerds ];
+    maintainers = with maintainers; [ jgeerds jtojnar ];
     platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 8a3f7796aef4..d6b3b6a98706 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -232,11 +232,10 @@ in with stdenv.lib.licenses;
 
   mame = (mkLibRetroCore {
     core = "mame";
-    version = "2018-03-02";
     src = fetchRetro {
       repo = "mame";
-      rev = "893f1ac2231b348b63209fd5b2545f770458ae8f";
-      sha256 = "1j9p82q9jhf5lf4w392zd09bq0j4iw1afhznymg0v60jv592h3gz";
+      rev = "9f8a36adeb4dc54ec2ecac992ce91bcdb377519e";
+      sha256 = "0blfvq28hgv9kkpijd8c9d9sa5g2qr448clwi7wrj8kqfdnrr8m1";
     };
     description = "Port of MAME to libretro";
     license = gpl2Plus;
diff --git a/pkgs/os-specific/bsd/default.nix b/pkgs/os-specific/bsd/default.nix
new file mode 100644
index 000000000000..a8301ea2a8fc
--- /dev/null
+++ b/pkgs/os-specific/bsd/default.nix
@@ -0,0 +1,8 @@
+{ callPackages, recurseIntoAttrs }:
+
+rec {
+  netbsd = recurseIntoAttrs (callPackages ./netbsd {});
+  openbsd = recurseIntoAttrs (callPackages ./openbsd {
+    inherit (netbsd) compat netBSDDerivation libcurses;
+  });
+}
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
new file mode 100644
index 000000000000..d47d602e2edb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -0,0 +1,18 @@
+setupCompatFlags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lnbcompat"
+    export NIX_${role}CFLAGS_COMPILE+=" -DHAVE_NBTOOL_CONFIG_H"
+    export NIX_${role}CFLAGS_COMPILE+=" -include nbtool_config.h"
+}
+
+addEnvHooks "$hostOffset" setupCompatFlags
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
new file mode 100644
index 000000000000..42633232c71a
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -0,0 +1,405 @@
+{ stdenv, hostPlatform, fetchcvs, lib, groff, mandoc, zlib, coreutils
+, yacc, flex, libressl, bash }:
+
+let
+  fetchNetBSD = path: version: sha256: fetchcvs {
+    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+    module = "src/${path}";
+    inherit sha256;
+    tag = "netbsd-${builtins.replaceStrings ["."] ["-"] version}-RELEASE";
+  };
+
+  netBSDDerivation = attrs: stdenv.mkDerivation ((rec {
+    name = "${attrs.pname or (baseNameOf attrs.path)}-netbsd-${attrs.version}";
+    src = fetchNetBSD attrs.path attrs.version attrs.sha256;
+
+    extraPaths = [ ];
+
+    nativeBuildInputs = [ makeMinimal mandoc groff install yacc flex ];
+    buildInputs = [ compat ];
+    installFlags = [ "includes" ];
+
+    # These should be coverd in nbcompat, but are missing, sadly
+    NIX_CFLAGS_COMPILE = [
+      "-D__noinline="
+      "-D__warn_references(a,b)="
+      "-D__strong_alias(a,b)="
+      "-D__va_list=va_list"
+    ];
+
+    # Definitions passed to share/mk/*.mk. Should be pretty simple -
+    # eventually maybe move it to a configure script.
+    DESTDIR = "$(out)";
+    TOOLDIR = "$(out)";
+    USETOOLS = "never";
+    NOCLANGERROR="yes";
+    NOGCCERROR="yes";
+    LEX = "flex";
+
+    # libs will be provided by cc-wrapper
+    LIBCRT0="";
+    LIBCRTI="";
+    LIBCRTEND="";
+    LIBCRTBEGIN="";
+    LIBC="";
+    LIBUTIL="";
+    LIBSSL = "";
+    LIBCRYPTO = "";
+    LIBCURSES = "";
+    "LIBDO.terminfo" = "_external";
+    _GCC_CRTBEGIN = "";
+    _GCC_CRTBEGINS = "";
+    _GCC_CRTEND = "";
+    _GCC_CRTENDS = "";
+    _GCC_LIBGCCDIR = "";
+    _GCC_CRTI = "";
+    _GCC_CRTDIR = "";
+    _GCC_CRTN = "";
+
+    # all dirs will be prefixed with DESTDIR
+    BINDIR = "/bin";
+    LIBDIR = "/lib";
+    SHLIBDIR = "/lib";
+    MANDIR = "/share/man";
+    INFODIR = "/share/info";
+    DOCDIR = "/share/doc";
+    LOCALEDIR = "/share/locale";
+    X11BINDIR = "/bin";
+    X11USRLIBDIR = "/lib";
+    X11MANDIR = "/share/man";
+    SHLINKDIR = "/usr/libexec";
+
+    HOST_SH = "${bash}/bin/sh";
+
+    # not using bsd binutils
+    SHLIB_WARNTEXTREL = "no";
+    SHLIB_MKMAP = "no";
+    OBJCOPY = "true";
+    PRESERVE = "-p";
+
+    MACHINE_ARCH = hostPlatform.parsed.cpu.name;
+    MACHINE_CPU = hostPlatform.parsed.cpu.name;
+
+    # NetBSD makefiles should be able to detect this
+    # but without they end up using gcc on Darwin stdenv
+    preConfigure = ''
+      export HAVE_${if stdenv.cc.isGNU then "GCC" else "LLVM"}=${lib.head (lib.splitString "." (lib.getVersion stdenv.cc.cc))}
+    '' + lib.optionalString (!builtins.hasAttr "nativeBuildInputs" attrs) ''
+      # hack until #38657 is fixed
+      export PATH=${install}/bin:$PATH
+    '';
+
+    postUnpack = ''
+      # merge together all extra paths
+      # there should be a better way to do this
+      sourceRoot=$PWD/$sourceRoot
+      export NETBSDSRCDIR=$sourceRoot
+      export BSDSRCDIR=$NETBSDSRCDIR
+      chmod -R u+w $sourceRoot
+      for path in $extraPaths; do
+        cd $path
+        find . -type d -exec mkdir -p $sourceRoot/\{} \;
+        find . -type f -exec cp -pr \{} $sourceRoot/\{} \;
+        chmod -R u+w $sourceRoot
+      done
+
+      cd $sourceRoot
+      if [ -d ${attrs.path} ]
+        then sourceRoot=$sourceRoot/${attrs.path}
+      fi
+    '';
+
+    # need to create directories for xinstall to work
+    preInstall = ''
+      mkdir -p $out$BINDIR $out$LIBDIR $out$INFODIR \
+               $out$DOCDIR $out$LOCALEDIR
+      for i in 1 2 3 4 5 6 7 8 9; do
+        mkdir -p $out$MANDIR/man$i $out$MANDIR/html$i $out$DOCDIR/reference/ref$i
+      done
+      mkdir -p $out/usr/include
+    '';
+
+    postInstall = ''
+      # Remove lingering /usr references
+      if [ -d $out/usr ]; then
+        cd $out/usr
+        find . -type d -exec mkdir -p $out/\{} \;
+        find . -type f -exec mv \{} $out/\{} \;
+        find . -type d -delete
+      fi
+
+      find $out -type d -empty -delete
+    '';
+
+    meta = with lib; {
+      maintainers = with maintainers; [matthewbauer];
+      platforms = platforms.unix;
+      license = licenses.bsd2;
+    };
+  }) // attrs);
+
+  # BOOTSTRAPPING
+  makeMinimal = netBSDDerivation rec {
+    path = "tools/make";
+    sha256 = "0l4794zwj2haark3azf9xwcwqlkbrifhb2glaa9iba4dkg2mklsb";
+    version = "7.1.2";
+
+    buildInputs = [];
+    nativeBuildInputs = [];
+    NIX_CFLAGS_COMPILE = "";
+    NIX_LDFLAGS = "";
+
+    patchPhase = ''
+      patchShebangs configure
+      ${make.patchPhase}
+    '';
+    buildPhase = "sh ./buildmake.sh";
+    installPhase = ''
+      install -D nbmake $out/bin/nbmake
+      ln -s $out/bin/nbmake $out/bin/make
+      mkdir -p $out/share
+      cp -r ../../share/mk $out/share/mk
+    '';
+    extraPaths = [ make.src ] ++ make.extraPaths;
+  };
+
+  compat = netBSDDerivation {
+    path = "tools/compat";
+    sha256 = "17phkfafybxwhzng44k5bhmag6i55br53ky1nwcmw583kg2fa86z";
+    version = "7.1.2";
+
+    setupHook = ./compat-setup-hook.sh;
+
+    # override defaults to prevent infinite recursion
+    nativeBuildInputs = [ makeMinimal ];
+    buildInputs = [ zlib ];
+    NIX_CFLAGS_COMPILE = "";
+    NIX_LDFLAGS = "";
+
+    # temporarily use gnuinstall for bootstrapping
+    # bsdinstall will be built later
+    makeFlags = "INSTALL=${coreutils}/bin/install";
+    RENAME = "-D";
+
+    postInstall = ''
+      mv $out/include/compat/* $out/include
+      rmdir $out/include/compat
+
+      # why aren't these installed by netbsd?
+      install -D compat_defs.h $out/include/compat_defs.h
+      install -D $NETBSDSRCDIR/include/cdbw.h $out/include/cdbw.h
+      install -D $NETBSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
+      install -D $NETBSDSRCDIR/sys/sys/featuretest.h \
+                 $out/include/sys/featuretest.h
+      install -D $NETBSDSRCDIR/sys/sys/md5.h $out/include/md5.h
+      install -D $NETBSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
+      install -D $NETBSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
+      install -D $NETBSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
+      install -D $NETBSDSRCDIR/include/vis.h $out/include/vis.h
+    '';
+    extraPaths = [ libc.src libutil.src
+      (fetchNetBSD "include" "7.1.2" "1vc58xrhrp202biiv1chhlh0jwnjr7k3qq91pm46k6v5j95j0qwp")
+      (fetchNetBSD "external/bsd/flex" "7.1.2" "0m0m72r3zzc9gi432h3xkqdzspr4n0hj4m8h7j74pwbvpfg9d9qq")
+      (fetchNetBSD "sys/sys" "7.1.2" "1vwnv5nk7rlgn5w9nkdqj9652hmwmfwqxj3ymcz0zk10abbaib93")
+    ] ++ libutil.extraPaths ++ libc.extraPaths;
+  };
+
+  install = netBSDDerivation {
+    path = "usr.bin/xinstall";
+    version = "7.1.2";
+    sha256 = "0nzhyh714m19h61m45gzc5dszkbafp5iaphbp5mza6w020fzf2y8";
+    extraPaths = [ mtree.src make.src ];
+    nativeBuildInputs = [ makeMinimal mandoc groff compat ];
+    RENAME = "-D";
+  };
+  # END BOOTSTRAPPING
+
+  libutil = netBSDDerivation {
+    path = "lib/libutil";
+    version = "7.1.2";
+    sha256 = "12848ynizz13mvn2kndrkq482xhkw323b7c8fg0zli1nhfsmwsm8";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libutil" "7.1.2" "0q3ixrf36lip1dx0gafs0a03qfs5cs7n0myqq7af4jpjd6kh1831")
+    ];
+  };
+
+  libc = netBSDDerivation {
+    path = "lib/libc";
+    version = "7.1.2";
+    sha256 = "13rcx3mbx2644z01zgk9gggdfr0hqdbsvd7zrsm2l13yf9aix6pg";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libc" "7.1.2" "1va8zd4lqyrc1d0c9q04r8y88cfxpkhwcxasggxxvhksd3khkpha")
+    ];
+  };
+
+  make = netBSDDerivation {
+    path = "usr.bin/make";
+    sha256 = "0srkkg6qdzqlccfi4xh19gl766ks6hpss76bnfvwmd0zg4q4zdar";
+    version = "7.1.2";
+    patchPhase = ''
+      # make needs this to pick up our sys make files
+      NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+      # can't set owner or group in Nix build
+      # maybe there is a better way to trick it?
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.prog.mk \
+        --replace '-o ''${SCRIPTSOWN_''${.ALLSRC:T}:U''${SCRIPTSOWN}}' "" \
+        --replace '-g ''${SCRIPTSGRP_''${.ALLSRC:T}:U''${SCRIPTSGRP}}' "" \
+        --replace '-o ''${RUMPBINOWN} -g ''${RUMPBINGRP}' "" \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
+        --replace '-o ''${RUMPBINOWN} -g ''${RUMPBINGRP}' "" \
+        --replace '-o ''${DEBUGOWN} -g ''${DEBUGGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.doc.mk \
+        --replace '-o ''${DOCOWN} -g ''${DOCGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.man.mk \
+        --replace '-o ''${MANOWN} -g ''${MANGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.files.mk \
+        --replace '-o ''${FILESOWN_''${.ALLSRC:T}:U''${FILESOWN}}' "" \
+        --replace '-g ''${FILESGRP_''${.ALLSRC:T}:U''${FILESGRP}}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.inc.mk \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace '-o ''${DEBUGOWN} -g ''${DEBUGGRP}' "" \
+        --replace '-o ''${LIBOWN} -g ''${LIBGRP}' ""
+
+      substituteInPlace $NETBSDSRCDIR/share/mk/Makefile \
+        --replace /usr/share/mk /share/mk
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace ' ''${_ARFL} ''${.TARGET} `NM=''${NM} ''${LORDER} ''${.ALLSRC:M*o} | ''${TSORT}`' ' ''${_ARFL} ''${.TARGET} ''${.ALLSRC:M*o}' \
+        --replace '-Wl,-soname,''${_LIB}.so.''${SHLIB_SOVERSION}' "" \
+        --replace '-Wl,--whole-archive' "" \
+        --replace '-Wl,--no-whole-archive' ""
+    '';
+    postInstall = ''
+      (cd $NETBSDSRCDIR/share/mk && make install)
+    '';
+    extraPaths = [
+      (fetchNetBSD "share/mk" "7.1.2" "0570v0siv0wygn8ygs1yy9pgk9xjw9x1axr5qg4xrddv3lskf9xa")
+    ];
+  };
+
+  mtree = netBSDDerivation {
+    path = "usr.sbin/mtree";
+    version = "7.1.2";
+    sha256 = "1dhsyfvcm67kf5zdbg5dmx5y8fimnbll6qxwp3gjfmbxqigmc52m";
+  };
+
+in rec {
+  inherit compat libc libutil install make mtree netBSDDerivation;
+
+  getent = netBSDDerivation {
+    path = "usr.bin/getent";
+    sha256 = "1ylhw4dnpyrmcy8n5kjcxywm8qc9p124dqnm17x4magiqx1kh9iz";
+    version = "7.1.2";
+    patches = [ ./getent.patch ];
+  };
+
+  getconf = netBSDDerivation {
+    path = "usr.bin/getconf";
+    sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
+    version = "7.1.2";
+  };
+
+  fts = netBSDDerivation {
+    pname = "fts";
+    path = "include/fts.h";
+    sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
+    version = "7.1.2";
+    nativeBuildInputs = [ ];
+    extraPaths = [
+      (fetchNetBSD "lib/libc/gen/fts.c" "7.1.2" "1yfd2liypj6xky2h0mgxi5lgpflmkkg4zf3ii3apz5cf8jq9gmn9")
+      (fetchNetBSD "lib/libc/include/namespace.h" "7.1.2" "0kwd4v8y0mfjhmwplsk52pvzbcpvpp2qy2g8c0jmfraam63q6q1y")
+      (fetchNetBSD "lib/libc/gen/fts.3" "7.1.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+    ];
+    buildPhase = ''
+      cc  -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+          -o lib/libc/gen/fts.o
+      ar -rsc libfts.a lib/libc/gen/fts.o
+    '';
+    installPhase = ''
+      install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
+      install -D include/fts.h $out/include/fts.h
+      install -D lib/libc/include/namespace.h $out/include/namespace.h
+      install -D libfts.a $out/lib/libfts.a
+    '';
+    setupHook = ./fts-setup-hook.sh;
+  };
+
+  games = netBSDDerivation {
+    path = "games";
+    sha256 = "04wjsang8f8kxsifiayklbxaaxmm3vx9rfr91hfbxj4hk8gkqzy1";
+    version = "7.1.2";
+    patchPhase = ''
+      sed -i '1i #include <time.h>' adventure/save.c
+    '';
+  };
+
+  who = netBSDDerivation {
+    path = "usr.bin/who";
+    version = "7.1.2";
+    sha256 = "17ffwww957m3qw0b6fkgjpp12pd5ydg2hs9dxkkw0qpv11j00d88";
+  };
+
+  finger = netBSDDerivation {
+    path = "usr.bin/finger";
+    sha256 = "0jl672z50f2yf7ikp682b3xrarm6bnrrx9vi94xnp2fav8m8zfyi";
+    version = "7.1.2";
+    extraPaths = [ who.src ];
+  };
+
+  fingerd = netBSDDerivation {
+    path = "usr.bin/fingerd";
+    sha256 = "04wjsang8f8kxsifiayklbxaaxmm3vx9rfr91hfbxj4hk8gkqz00";
+    version = "7.1.2";
+  };
+
+  libedit = netBSDDerivation {
+    path = "lib/libedit";
+    buildInputs = [ compat libterminfo ];
+    patchPhase = ''
+      sed -i '1i #undef bool_t' el.h
+    '';
+    version = "7.1.2";
+    sha256 = "0qvr52j4qih10m7fa8nddn1psyjy9l0pa4ix02acyssjvgbz2kca";
+  };
+
+  libterminfo = netBSDDerivation {
+    path = "lib/libterminfo";
+    version = "7.1.2";
+    sha256 = "06plg0bjqgbb0aghpb9qlk8wkp1l2izdlr64vbr5laqyw8jg84zq";
+    buildInputs = [ compat tic nbperf ];
+    extraPaths = [
+      (fetchNetBSD "share/terminfo" "7.1.2" "1z5vzq8cw24j05r6df4vd6r57cvdbv7vbm4h962kplp14xrbg2h3")
+    ];
+  };
+
+  libcurses = netBSDDerivation {
+    path = "lib/libcurses";
+    version = "7.1.2";
+    sha256 = "04djah9dadzw74nswn0xydkxn900kav8xdvxlxdl50nbrynxg9yf";
+    buildInputs = [ compat libterminfo ];
+    MKDOC = "no"; # missing vfontedpr
+  };
+
+  nbperf = netBSDDerivation {
+    path = "usr.bin/nbperf";
+    version = "7.1.2";
+    sha256 = "0gzm0zv2400lasnsswnjw9bwzyizhxzdbrcjwcl1k65aj86aqyqb";
+  };
+
+  tic = netBSDDerivation {
+    path = "tools/tic";
+    version = "7.1.2";
+    sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
+    HOSTPROG = "tic";
+    buildInputs = [ compat nbperf ];
+    extraPaths = [
+      libterminfo.src
+      (fetchNetBSD "usr.bin/tic" "7.1.2" "1ghwsaag4gbwvgp3lfxscnh8hn27n8cscwmgjwp3bkx5vl85nfsa")
+      (fetchNetBSD "tools/Makefile.host" "7.1.2" "076r3amivb6xranpvqjmg7x5ibj4cbxaa3z2w1fh47h7d55dw9w8")
+    ];
+  };
+
+}
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
new file mode 100644
index 000000000000..6b7064174931
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
@@ -0,0 +1,16 @@
+ftsLdflags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lfts"
+}
+
+addEnvHooks "$hostOffset" ftsLdflags
diff --git a/pkgs/os-specific/bsd/netbsd/getent.patch b/pkgs/os-specific/bsd/netbsd/getent.patch
new file mode 100644
index 000000000000..e9e34d19a315
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/getent.patch
@@ -0,0 +1,455 @@
+Author: Matthew Bauer
+Description: Remove unavailable getent databases
+Version: 7.1.2
+--- a/getent.c	2018-04-16 13:33:49.000000000 -0500
++++ b/getent.c	2018-04-16 13:29:30.000000000 -0500
+@@ -42,7 +42,6 @@
+ #include <grp.h>
+ #include <limits.h>
+ #include <netdb.h>
+-#include <netgroup.h>
+ #include <pwd.h>
+ #include <stdio.h>
+ #include <stdarg.h>
+@@ -57,27 +56,16 @@
+ #include <arpa/nameser.h>
+ 
+ #include <net/if.h>
+-#include <net/if_ether.h>
+ 
+ #include <netinet/in.h>		/* for INET6_ADDRSTRLEN */
+ 
+-#include <rpc/rpcent.h>
+-
+-#include <disktab.h>
+-
+ static int	usage(void) __attribute__((__noreturn__));
+ static int	parsenum(const char *, unsigned long *);
+-static int	disktab(int, char *[]);
+-static int	gettytab(int, char *[]);
+-static int	ethers(int, char *[]);
+ static int	group(int, char *[]);
+ static int	hosts(int, char *[]);
+-static int	netgroup(int, char *[]);
+ static int	networks(int, char *[]);
+ static int	passwd(int, char *[]);
+-static int	printcap(int, char *[]);
+ static int	protocols(int, char *[]);
+-static int	rpc(int, char *[]);
+ static int	services(int, char *[]);
+ static int	shells(int, char *[]);
+ 
+@@ -92,17 +80,11 @@
+ 	const char	*name;
+ 	int		(*callback)(int, char *[]);
+ } databases[] = {
+-	{	"disktab",	disktab,	},
+-	{	"ethers",	ethers,		},
+-	{	"gettytab",	gettytab,	},
+ 	{	"group",	group,		},
+ 	{	"hosts",	hosts,		},
+-	{	"netgroup",	netgroup,	},
+ 	{	"networks",	networks,	},
+ 	{	"passwd",	passwd,		},
+-	{	"printcap",	printcap,	},
+ 	{	"protocols",	protocols,	},
+-	{	"rpc",		rpc,		},
+ 	{	"services",	services,	},
+ 	{	"shells",	shells,		},
+ 
+@@ -195,49 +177,6 @@
+ 	(void)printf("\n");
+ }
+ 
+-
+-		/*
+-		 * ethers
+-		 */
+-
+-static int
+-ethers(int argc, char *argv[])
+-{
+-	char		hostname[MAXHOSTNAMELEN + 1], *hp;
+-	struct ether_addr ea, *eap;
+-	int		i, rv;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define ETHERSPRINT	(void)printf("%-17s  %s\n", ether_ntoa(eap), hp)
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on ethers");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if ((eap = ether_aton(argv[i])) == NULL) {
+-				eap = &ea;
+-				hp = argv[i];
+-				if (ether_hostton(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			} else {
+-				hp = hostname;
+-				if (ether_ntohost(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			}
+-			ETHERSPRINT;
+-		}
+-	}
+-	return rv;
+-}
+-
+ 		/*
+ 		 * group
+ 		 */
+@@ -298,7 +237,7 @@
+ hosts(int argc, char *argv[])
+ {
+ 	struct hostent	*he;
+-	char		addr[IN6ADDRSZ];
++	char		addr[NS_IN6ADDRSZ];
+ 	int		i, rv;
+ 
+ 	assert(argc > 1);
+@@ -312,9 +251,9 @@
+ 	} else {
+ 		for (i = 2; i < argc; i++) {
+ 			if (inet_pton(AF_INET6, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, IN6ADDRSZ, AF_INET6);
++				he = gethostbyaddr(addr, NS_IN6ADDRSZ, AF_INET6);
+ 			else if (inet_pton(AF_INET, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, INADDRSZ, AF_INET);
++				he = gethostbyaddr(addr, NS_INADDRSZ, AF_INET);
+ 			else
+ 				he = gethostbyname(argv[i]);
+ 			if (he != NULL)
+@@ -330,48 +269,6 @@
+ }
+ 
+ 		/*
+-		 * netgroup
+-		 */
+-static int
+-netgroup(int argc, char *argv[])
+-{
+-	int		rv, i;
+-	bool		first;
+-	const char	*host, *user, *domain;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define NETGROUPPRINT(s)	(((s) != NULL) ? (s) : "")
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on netgroup");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			setnetgrent(argv[i]);
+-			first = true;
+-			while (getnetgrent(&host, &user, &domain) != 0) {
+-				if (first) {
+-					first = false;
+-					(void)fputs(argv[i], stdout);
+-				}
+-				(void)printf(" (%s,%s,%s)",
+-				    NETGROUPPRINT(host),
+-				    NETGROUPPRINT(user),
+-				    NETGROUPPRINT(domain));
+-			}
+-			if (!first)
+-				(void)putchar('\n');
+-			endnetgrent();
+-		}
+-	}
+-
+-	return rv;
+-}
+-
+-		/*
+ 		 * networks
+ 		 */
+ 
+@@ -464,227 +361,6 @@
+ 	return rv;
+ }
+ 
+-static char *
+-mygetent(const char * const * db_array, const char *name)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = cgetent(&buf, db_array, name)) {
+-	case -3:
+-		warnx("tc= loop in record `%s' in `%s'", name, db_array[0]);
+-		break;
+-	case -2:
+-		warn("system error fetching record `%s' in `%s'", name,
+-		    db_array[0]);
+-		break;
+-	case -1:
+-	case 0:
+-		break;
+-	case 1:
+-		warnx("tc= reference not found in record for `%s' in `%s'",
+-		    name, db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in record `%s' in `%s'", error, name,
+-		    db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static char *
+-mygetone(const char * const * db_array, int first)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = (first ? cgetfirst : cgetnext)(&buf, db_array)) {
+-	case -2:
+-		warnx("tc= loop in `%s'", db_array[0]);
+-		break;
+-	case -1:
+-		warn("system error fetching record in `%s'", db_array[0]);
+-		break;
+-	case 0:
+-	case 1:
+-		break;
+-	case 2:
+-		warnx("tc= reference not found in `%s'", db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in `%s'", error, db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static void
+-capprint(const char *cap)
+-{
+-	char *c = strchr(cap, ':');
+-	if (c)
+-		if (c == cap)
+-			(void)printf("true\n");
+-		else {
+-			int l = (int)(c - cap);
+-			(void)printf("%*.*s\n", l, l, cap);
+-		}
+-	else
+-		(void)printf("%s\n", cap);
+-}
+-
+-static void
+-prettyprint(char *b)
+-{
+-#define TERMWIDTH 65
+-	int did = 0;
+-	size_t len;
+-	char *s, c;
+-
+-	for (;;) {
+-		len = strlen(b);
+-		if (len <= TERMWIDTH) {
+-done:
+-			if (did)
+-				printf("\t:");
+-			printf("%s\n", b);
+-			return;
+-		}
+-		for (s = b + TERMWIDTH; s > b && *s != ':'; s--)
+-			continue;
+-		if (*s++ != ':')
+-			goto done;
+-		c = *s;
+-		*s = '\0';
+-		if (did)
+-			printf("\t:");
+-		did++;
+-		printf("%s\\\n", b);
+-		*s = c;
+-		b = s;
+-	}
+-}
+-
+-static void
+-handleone(const char * const *db_array, char *b, int recurse, int pretty,
+-    int level)
+-{
+-	char *tc;
+-
+-	if (level && pretty)
+-		printf("\n");
+-	if (pretty)
+-		prettyprint(b);
+-	else
+-		printf("%s\n", b);
+-	if (!recurse || cgetstr(b, "tc", &tc) <= 0)
+-		return;
+-
+-	b = mygetent(db_array, tc);
+-	free(tc);
+-
+-	if (b == NULL)
+-		return;
+-
+-	handleone(db_array, b, recurse, pretty, ++level);
+-	free(b);
+-}
+-
+-static int
+-handlecap(const char *db, int argc, char *argv[])
+-{
+-	static const char sfx[] = "=#:";
+-	const char *db_array[] = { db, NULL };
+-	char	*b, *cap;
+-	int	i, rv, c;
+-	size_t	j;
+-	int	expand = 1, recurse = 0, pretty = 0;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-	argc--;
+-	argv++;
+-	while ((c = getopt(argc, argv, "pnr")) != -1)
+-		switch (c) {
+-		case 'n':
+-			expand = 0;
+-			break;
+-		case 'r':
+-			expand = 0;
+-			recurse = 1;
+-			break;
+-		case 'p':
+-			pretty = 1;
+-			break;
+-		default:
+-			usage();
+-			break;
+-		}
+-
+-	argc -= optind;
+-	argv += optind;
+-	csetexpandtc(expand);
+-	rv = RV_OK;
+-	if (argc == 0) {
+-		for (b = mygetone(db_array, 1); b; b = mygetone(db_array, 0)) {
+-			handleone(db_array, b, recurse, pretty, 0);
+-			free(b);
+-		}
+-	} else {
+-		if ((b = mygetent(db_array, argv[0])) == NULL)
+-			return RV_NOTFOUND;
+-		if (argc == 1)
+-			handleone(db_array, b, recurse, pretty, 0);
+-		else {
+-			for (i = 2; i < argc; i++) {
+-				for (j = 0; j < sizeof(sfx) - 1; j++) {
+-					cap = cgetcap(b, argv[i], sfx[j]);
+-					if (cap) {
+-						capprint(cap);
+-						break;
+-					} 
+-				}
+-				if (j == sizeof(sfx) - 1)
+-					printf("false\n");
+-			}
+-		}
+-		free(b);
+-	}
+-	return rv;
+-}
+-
+-		/*
+-		 * gettytab
+-		 */
+-
+-static int
+-gettytab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_GETTYTAB, argc, argv);
+-}
+-
+-		/*
+-		 * printcap
+-		 */
+-
+-static int
+-printcap(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_PRINTCAP, argc, argv);
+-}
+-
+-		/*
+-		 * disktab
+-		 */
+-
+-static int
+-disktab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_DISKTAB, argc, argv);
+-}
+-
+ 		/*
+ 		 * protocols
+ 		 */
+@@ -726,47 +402,6 @@
+ }
+ 
+ 		/*
+-		 * rpc
+-		 */
+-
+-static int
+-rpc(int argc, char *argv[])
+-{
+-	struct rpcent	*re;
+-	unsigned long	id;
+-	int		i, rv;
+-	
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define RPCPRINT	printfmtstrings(re->r_aliases, "  ", " ", \
+-				"%-16s  %6d", \
+-				re->r_name, re->r_number)
+-
+-	setrpcent(1);
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		while ((re = getrpcent()) != NULL)
+-			RPCPRINT;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if (parsenum(argv[i], &id))
+-				re = getrpcbynumber((int)id);
+-			else
+-				re = getrpcbyname(argv[i]);
+-			if (re != NULL)
+-				RPCPRINT;
+-			else {
+-				rv = RV_NOTFOUND;
+-				break;
+-			}
+-		}
+-	}
+-	endrpcent();
+-	return rv;
+-}
+-
+-		/*
+ 		 * services
+ 		 */
+ 
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
new file mode 100644
index 000000000000..9ccc0adaa2df
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -0,0 +1,42 @@
+{ fetchcvs, netBSDDerivation, compat, libcurses, libressl }:
+
+let
+  fetchOpenBSD = path: version: sha256: fetchcvs {
+    cvsRoot = "anoncvs@anoncvs.ca.openbsd.org:/cvs";
+    module = "src/${path}";
+    inherit sha256;
+    tag = "OPENBSD_${builtins.replaceStrings ["."] ["_"] version}";
+  };
+
+  # OpenBSD is a fork of NetBSD
+  # We can build it with minimal changes
+  openBSDDerivation = attrs: netBSDDerivation (attrs // {
+    name = "${attrs.pname or (baseNameOf attrs.path)}-openbsd-${attrs.version}";
+    src = fetchOpenBSD attrs.path attrs.version attrs.sha256;
+  });
+
+in {
+
+  mg = openBSDDerivation {
+    path = "usr.bin/mg";
+    version = "6.3";
+    sha256 = "0n3hwa81c2mcjwbmidrbvi1l25jh8hy939kqrigbv78jixpynffc";
+    buildInputs = [ compat libcurses ];
+    patchPhase = ''
+      NIX_CFLAGS_COMPILE+=" -I$BSDSRCDIR/sys"
+    '';
+    extraPaths = [
+      (fetchOpenBSD "sys/sys/tree.h" "6.3" "0rimh41wn9wz5m510zk9i27z3s450qqgq2k5xn8kp3885hygbcj9")
+      (fetchOpenBSD "sys/sys/_null.h" "6.3" "0l2rgg9ai4ivfl07zmbqli19vnm3lj7qkxpikqplmzrfp36qpzgr")
+    ];
+  };
+
+  nc = openBSDDerivation {
+    path = "usr.bin/nc";
+    version = "6.3";
+    sha256 = "0fmnh6ccxab0qvhmgspyd3wra1ps2516i0j6hwkvna2lcny20xvr";
+    patches = [ ./nc.patch ];
+    buildInputs = [ compat libressl ];
+  };
+
+}
diff --git a/pkgs/os-specific/bsd/openbsd/nc.patch b/pkgs/os-specific/bsd/openbsd/nc.patch
new file mode 100644
index 000000000000..de6fb2d04c41
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/nc.patch
@@ -0,0 +1,421 @@
+--- a/nc.1
++++ b/nc.1
+@@ -204,9 +204,6 @@ Proxy authentication is only supported f
+ Specifies the source port
+ .Nm
+ should use, subject to privilege restrictions and availability.
+-It is an error to use this option in conjunction with the
+-.Fl l
+-option.
+ .It Fl R Ar CAfile
+ Specifies the filename from which the root CA bundle for certificate
+ verification is loaded, in PEM format.
+@@ -258,6 +255,7 @@ For IPv4 TOS value
+ may be one of
+ .Ar critical ,
+ .Ar inetcontrol ,
++.Ar lowcost ,
+ .Ar lowdelay ,
+ .Ar netcontrol ,
+ .Ar throughput ,
+--- a/netcat.c
++++ b/netcat.c
+@@ -32,6 +32,8 @@
+  * *Hobbit* <hobbit@avian.org>.
+  */
+ 
++#define _GNU_SOURCE
++
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <sys/uio.h>
+@@ -41,6 +43,49 @@
+ #include <netinet/tcp.h>
+ #include <netinet/ip.h>
+ #include <arpa/telnet.h>
++#ifdef __linux__
++# include <linux/in6.h>
++#endif
++
++#ifndef IPTOS_LOWDELAY
++# define IPTOS_LOWDELAY 0x10
++# define IPTOS_THROUGHPUT 0x08
++# define IPTOS_RELIABILITY 0x04
++# define IPTOS_LOWCOST 0x02
++# define IPTOS_MINCOST IPTOS_LOWCOST
++#endif /* IPTOS_LOWDELAY */
++
++# ifndef IPTOS_DSCP_AF11
++# define	IPTOS_DSCP_AF11		0x28
++# define	IPTOS_DSCP_AF12		0x30
++# define	IPTOS_DSCP_AF13		0x38
++# define	IPTOS_DSCP_AF21		0x48
++# define	IPTOS_DSCP_AF22		0x50
++# define	IPTOS_DSCP_AF23		0x58
++# define	IPTOS_DSCP_AF31		0x68
++# define	IPTOS_DSCP_AF32		0x70
++# define	IPTOS_DSCP_AF33		0x78
++# define	IPTOS_DSCP_AF41		0x88
++# define	IPTOS_DSCP_AF42		0x90
++# define	IPTOS_DSCP_AF43		0x98
++# define	IPTOS_DSCP_EF		0xb8
++#endif /* IPTOS_DSCP_AF11 */
++
++#ifndef IPTOS_DSCP_CS0
++# define	IPTOS_DSCP_CS0		0x00
++# define	IPTOS_DSCP_CS1		0x20
++# define	IPTOS_DSCP_CS2		0x40
++# define	IPTOS_DSCP_CS3		0x60
++# define	IPTOS_DSCP_CS4		0x80
++# define	IPTOS_DSCP_CS5		0xa0
++# define	IPTOS_DSCP_CS6		0xc0
++# define	IPTOS_DSCP_CS7		0xe0
++#endif /* IPTOS_DSCP_CS0 */
++
++#ifndef IPTOS_DSCP_EF
++# define	IPTOS_DSCP_EF		0xb8
++#endif /* IPTOS_DSCP_EF */
++
+ 
+ #include <err.h>
+ #include <errno.h>
+@@ -268,10 +315,14 @@ main(int argc, char *argv[])
+ 			uflag = 1;
+ 			break;
+ 		case 'V':
++# if defined(RT_TABLEID_MAX)
+ 			rtableid = (int)strtonum(optarg, 0,
+ 			    RT_TABLEID_MAX, &errstr);
+ 			if (errstr)
+ 				errx(1, "rtable %s: %s", errstr, optarg);
++# else
++			errx(1, "no alternate routing table support available");
++# endif
+ 			break;
+ 		case 'v':
+ 			vflag = 1;
+@@ -320,7 +371,11 @@ main(int argc, char *argv[])
+ 			oflag = optarg;
+ 			break;
+ 		case 'S':
++# if defined(TCP_MD5SIG)
+ 			Sflag = 1;
++# else
++			errx(1, "no TCP MD5 signature support available");
++# endif
+ 			break;
+ 		case 'T':
+ 			errstr = NULL;
+@@ -345,35 +400,23 @@ main(int argc, char *argv[])
+ 	argc -= optind;
+ 	argv += optind;
+ 
++# if defined(RT_TABLEID_MAX)
+ 	if (rtableid >= 0)
+ 		if (setrtable(rtableid) == -1)
+ 			err(1, "setrtable");
+-
+-	if (family == AF_UNIX) {
+-		if (pledge("stdio rpath wpath cpath tmppath unix", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Fflag && Pflag) {
+-		if (pledge("stdio inet dns sendfd tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Fflag) { 
+-		if (pledge("stdio inet dns sendfd", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Pflag && usetls) {
+-		if (pledge("stdio rpath inet dns tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Pflag) {
+-		if (pledge("stdio inet dns tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (usetls) {
+-		if (pledge("stdio rpath inet dns", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (pledge("stdio inet dns", NULL) == -1)
+-		err(1, "pledge");
++# endif
+ 
+ 	/* Cruft to make sure options are clean, and used properly. */
+ 	if (argv[0] && !argv[1] && family == AF_UNIX) {
+ 		host = argv[0];
+ 		uport = NULL;
++	} else if (!argv[0] && lflag) {
++		if (sflag)
++			errx(1, "cannot use -s and -l");
++		if (pflag)
++			errx(1, "cannot use -p and -l");
++		if (zflag)
++			errx(1, "cannot use -z and -l");
+ 	} else if (argv[0] && !argv[1]) {
+ 		if (!lflag)
+ 			usage(1);
+@@ -385,12 +428,6 @@ main(int argc, char *argv[])
+ 	} else
+ 		usage(1);
+ 
+-	if (lflag && sflag)
+-		errx(1, "cannot use -s and -l");
+-	if (lflag && pflag)
+-		errx(1, "cannot use -p and -l");
+-	if (lflag && zflag)
+-		errx(1, "cannot use -z and -l");
+ 	if (!lflag && kflag)
+ 		errx(1, "must use -l with -k");
+ 	if (uflag && usetls)
+@@ -425,8 +462,8 @@ main(int argc, char *argv[])
+ 		} else {
+ 			strlcpy(unix_dg_tmp_socket_buf, "/tmp/nc.XXXXXXXXXX",
+ 			    UNIX_DG_TMP_SOCKET_SIZE);
+-			if (mktemp(unix_dg_tmp_socket_buf) == NULL)
+-				err(1, "mktemp");
++			if (mkstemp(unix_dg_tmp_socket_buf) == -1)
++				err(1, "mkstemp");
+ 			unix_dg_tmp_socket = unix_dg_tmp_socket_buf;
+ 		}
+ 	}
+@@ -901,8 +938,10 @@ remote_connect(const char *host, const c
+ 		if (sflag || pflag) {
+ 			struct addrinfo ahints, *ares;
+ 
++# if defined (SO_BINDANY)
+ 			/* try SO_BINDANY, but don't insist */
+ 			setsockopt(s, SOL_SOCKET, SO_BINDANY, &on, sizeof(on));
++# endif
+ 			memset(&ahints, 0, sizeof(struct addrinfo));
+ 			ahints.ai_family = res->ai_family;
+ 			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+@@ -994,9 +1033,15 @@ local_listen(char *host, char *port, str
+ 		    res->ai_protocol)) < 0)
+ 			continue;
+ 
++		ret = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
++		if (ret == -1)
++			err(1, NULL);
++
++# if defined(SO_REUSEPORT)
+ 		ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
+ 		if (ret == -1)
+ 			err(1, NULL);
++# endif
+ 
+ 		set_common_sockopts(s, res->ai_family);
+ 
+@@ -1452,11 +1497,13 @@ set_common_sockopts(int s, int af)
+ {
+ 	int x = 1;
+ 
++# if defined(TCP_MD5SIG)
+ 	if (Sflag) {
+ 		if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG,
+ 			&x, sizeof(x)) == -1)
+ 			err(1, NULL);
+ 	}
++# endif
+ 	if (Dflag) {
+ 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
+ 			&x, sizeof(x)) == -1)
+@@ -1467,9 +1514,14 @@ set_common_sockopts(int s, int af)
+ 		    IP_TOS, &Tflag, sizeof(Tflag)) == -1)
+ 			err(1, "set IP ToS");
+ 
++#if defined(IPV6_TCLASS)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_TCLASS, &Tflag, sizeof(Tflag)) == -1)
+ 			err(1, "set IPv6 traffic class");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 traffic class (unavailable)");
++#endif
+ 	}
+ 	if (Iflag) {
+ 		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
+@@ -1487,19 +1539,34 @@ set_common_sockopts(int s, int af)
+ 		    IP_TTL, &ttl, sizeof(ttl)))
+ 			err(1, "set IP TTL");
+ 
++#if defined(IPV6_UNICAST_HOPS)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_UNICAST_HOPS, &ttl, sizeof(ttl)))
+ 			err(1, "set IPv6 unicast hops");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 unicast hops (unavailable)");
++#endif
+ 	}
+ 
+ 	if (minttl != -1) {
++#if defined(IP_MINTTL)
+ 		if (af == AF_INET && setsockopt(s, IPPROTO_IP,
+ 		    IP_MINTTL, &minttl, sizeof(minttl)))
+ 			err(1, "set IP min TTL");
++#else
++		if (af == AF_INET)
++			errx(1, "can't set IP min TTL (unavailable)");
++#endif
+ 
++#if defined(IPV6_MINHOPCOUNT)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_MINHOPCOUNT, &minttl, sizeof(minttl)))
+ 			err(1, "set IPv6 min hop count");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 min hop count (unavailable)");
++#endif
+ 	}
+ }
+ 
+@@ -1534,6 +1601,7 @@ process_tos_opt(char *s, int *val)
+ 		{ "cs7",		IPTOS_DSCP_CS7 },
+ 		{ "ef",			IPTOS_DSCP_EF },
+ 		{ "inetcontrol",	IPTOS_PREC_INTERNETCONTROL },
++		{ "lowcost",		IPTOS_LOWCOST },
+ 		{ "lowdelay",		IPTOS_LOWDELAY },
+ 		{ "netcontrol",		IPTOS_PREC_NETCONTROL },
+ 		{ "reliability",	IPTOS_RELIABILITY },
+@@ -1741,7 +1812,7 @@ help(void)
+ 	\t-Z		Peer certificate file\n\
+ 	\t-z		Zero-I/O mode [used for scanning]\n\
+ 	Port numbers can be individual or ranges: lo-hi [inclusive]\n");
+-	exit(1);
++	exit(0);
+ }
+ 
+ void
+--- a/socks.c
++++ b/socks.c
+@@ -219,11 +219,11 @@ socks_connect(const char *host, const ch
+ 		buf[2] = SOCKS_NOAUTH;
+ 		cnt = atomicio(vwrite, proxyfd, buf, 3);
+ 		if (cnt != 3)
+-			err(1, "write failed (%zu/3)", cnt);
++			err(1, "write failed (%zu/3)", (size_t)cnt);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 2);
+ 		if (cnt != 2)
+-			err(1, "read failed (%zu/3)", cnt);
++			err(1, "read failed (%zu/3)", (size_t)cnt);
+ 
+ 		if (buf[1] == SOCKS_NOMETHOD)
+ 			errx(1, "authentication method negotiation failed");
+@@ -272,11 +272,11 @@ socks_connect(const char *host, const ch
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ 		if (cnt != wlen)
+-			err(1, "write failed (%zu/%zu)", cnt, wlen);
++			err(1, "write failed (%zu/%zu)", (size_t)cnt, (size_t)wlen);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 4);
+ 		if (cnt != 4)
+-			err(1, "read failed (%zu/4)", cnt);
++			err(1, "read failed (%zu/4)", (size_t)cnt);
+ 		if (buf[1] != 0) {
+ 			errx(1, "connection failed, SOCKSv5 error: %s",
+ 			    socks5_strerror(buf[1]));
+@@ -285,12 +285,12 @@ socks_connect(const char *host, const ch
+ 		case SOCKS_IPV4:
+ 			cnt = atomicio(read, proxyfd, buf + 4, 6);
+ 			if (cnt != 6)
+-				err(1, "read failed (%zu/6)", cnt);
++				err(1, "read failed (%zu/6)", (size_t)cnt);
+ 			break;
+ 		case SOCKS_IPV6:
+ 			cnt = atomicio(read, proxyfd, buf + 4, 18);
+ 			if (cnt != 18)
+-				err(1, "read failed (%zu/18)", cnt);
++				err(1, "read failed (%zu/18)", (size_t)cnt);
+ 			break;
+ 		default:
+ 			errx(1, "connection failed, unsupported address type");
+@@ -310,11 +310,11 @@ socks_connect(const char *host, const ch
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ 		if (cnt != wlen)
+-			err(1, "write failed (%zu/%zu)", cnt, wlen);
++			err(1, "write failed (%zu/%zu)", (size_t)cnt, (size_t)wlen);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 8);
+ 		if (cnt != 8)
+-			err(1, "read failed (%zu/8)", cnt);
++			err(1, "read failed (%zu/8)", (size_t)cnt);
+ 		if (buf[1] != 90) {
+ 			errx(1, "connection failed, SOCKSv4 error: %s",
+ 			    socks4_strerror(buf[1]));
+@@ -328,39 +328,39 @@ socks_connect(const char *host, const ch
+ 
+ 		/* Try to be sane about numeric IPv6 addresses */
+ 		if (strchr(host, ':') != NULL) {
+-			r = snprintf(buf, sizeof(buf),
++			r = snprintf((char*)buf, sizeof(buf),
+ 			    "CONNECT [%s]:%d HTTP/1.0\r\n",
+ 			    host, ntohs(serverport));
+ 		} else {
+-			r = snprintf(buf, sizeof(buf),
++			r = snprintf((char*)buf, sizeof(buf),
+ 			    "CONNECT %s:%d HTTP/1.0\r\n",
+ 			    host, ntohs(serverport));
+ 		}
+ 		if (r == -1 || (size_t)r >= sizeof(buf))
+ 			errx(1, "hostname too long");
+-		r = strlen(buf);
++		r = strlen((char*)buf);
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, r);
+ 		if (cnt != r)
+-			err(1, "write failed (%zu/%d)", cnt, r);
++			err(1, "write failed (%zu/%d)", (size_t)cnt, (int)r);
+ 
+ 		if (authretry > 1) {
+ 			char resp[1024];
+ 
+ 			proxypass = getproxypass(proxyuser, proxyhost);
+-			r = snprintf(buf, sizeof(buf), "%s:%s",
++			r = snprintf((char*)buf, sizeof(buf), "%s:%s",
+ 			    proxyuser, proxypass);
+ 			if (r == -1 || (size_t)r >= sizeof(buf) ||
+-			    b64_ntop(buf, strlen(buf), resp,
++			    b64_ntop(buf, strlen((char*)buf), resp,
+ 			    sizeof(resp)) == -1)
+ 				errx(1, "Proxy username/password too long");
+-			r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
++			r = snprintf((char*)buf, sizeof(buf), "Proxy-Authorization: "
+ 			    "Basic %s\r\n", resp);
+ 			if (r == -1 || (size_t)r >= sizeof(buf))
+ 				errx(1, "Proxy auth response too long");
+-			r = strlen(buf);
++			r = strlen((char*)buf);
+ 			if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != r)
+-				err(1, "write failed (%zu/%d)", cnt, r);
++				err(1, "write failed (%zu/%d)", (size_t)cnt, r);
+ 		}
+ 
+ 		/* Terminate headers */
+@@ -368,22 +368,22 @@ socks_connect(const char *host, const ch
+ 			err(1, "write failed (%zu/2)", cnt);
+ 
+ 		/* Read status reply */
+-		proxy_read_line(proxyfd, buf, sizeof(buf));
++		proxy_read_line(proxyfd, (char*)buf, sizeof(buf));
+ 		if (proxyuser != NULL &&
+-		    strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
++		    strncmp((char*)buf, "HTTP/1.0 407 ", 12) == 0) {
+ 			if (authretry > 1) {
+ 				fprintf(stderr, "Proxy authentication "
+ 				    "failed\n");
+ 			}
+ 			close(proxyfd);
+ 			goto again;
+-		} else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
+-		    strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
++		} else if (strncmp((char*)buf, "HTTP/1.0 200 ", 12) != 0 &&
++		    strncmp((char*)buf, "HTTP/1.1 200 ", 12) != 0)
+ 			errx(1, "Proxy error: \"%s\"", buf);
+ 
+ 		/* Headers continue until we hit an empty line */
+ 		for (r = 0; r < HTTP_MAXHDRS; r++) {
+-			proxy_read_line(proxyfd, buf, sizeof(buf));
++			proxy_read_line(proxyfd, (char*)buf, sizeof(buf));
+ 			if (*buf == '\0')
+ 				break;
+ 		}
\ No newline at end of file
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 55eb54622d51..5efa4bfcfd5d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -512,6 +512,8 @@ in
           "--with-xkb-path=${xorg.xkeyboardconfig}/share/X11/xkb"
           "--with-xkb-output=$out/share/X11/xkb/compiled"
           "--enable-glamor"
+        ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+          "--disable-tls"
         ];
         postInstall = ''
           rm -fr $out/share/X11/xkb/compiled # otherwise X will try to write in it
diff --git a/pkgs/tools/networking/gupnp-tools/default.nix b/pkgs/tools/networking/gupnp-tools/default.nix
index 1b306bc5e363..4d1796eb2ac9 100644
--- a/pkgs/tools/networking/gupnp-tools/default.nix
+++ b/pkgs/tools/networking/gupnp-tools/default.nix
@@ -2,13 +2,13 @@
 
 let
   pname = "gupnp-tools";
-  version = "0.8.13";
+  version = "0.8.14";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1vbr4iqi7nl7kq982agd3liw10gx67s95idd0pjy5h1jsnwyqgda";
+    sha256 = "1ykybsljjnngj8rsn808a0h37r2jx99c2jbmsb3ihf7l7hmraav8";
   };
 
   nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 79d42d12c827..92927bbf9d91 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21357,4 +21357,7 @@ with pkgs;
   inherit (unixtools) hexdump ps logger eject umount
                       mount wall hostname more sysctl getconf
                       getent;
+
+  inherit (recurseIntoAttrs (callPackages ../os-specific/bsd { }))
+          netbsd openbsd;
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ba587a49b85b..051caa95dc0e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -315,7 +315,7 @@ in {
     inherit (pkgs) arrow-cpp cmake pkgconfig;
   };
 
-  pyatspi = disabledIf (!isPy3k) (callPackage ../development/python-modules/pyatspi { });
+  pyatspi = callPackage ../development/python-modules/pyatspi { };
 
   pyaxmlparser = callPackage ../development/python-modules/pyaxmlparser { };