summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
authorChristian Kögler <ck3d@gmx.de>2018-04-29 19:02:46 +0200
committerChristian Kögler <ck3d@gmx.de>2018-04-29 19:02:46 +0200
commit56b1a13ea9f3d6c37017e76dfb5b726318370bc3 (patch)
tree2b8933e516cbc3df3c5858fcf06d92a26a2d3d23 /pkgs/os-specific
parent884e6a7b9fbea0e776e199ed4c11d36f2f3dedb8 (diff)
parent75cfbdf33b0423c2bd8f9fb20393267ef02bbf9d (diff)
downloadnixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar.gz
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar.bz2
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar.lz
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar.xz
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.tar.zst
nixlib-56b1a13ea9f3d6c37017e76dfb5b726318370bc3.zip
Merge remote-tracking branch 'channels/nixpkgs-unstable' into tbs
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/default.nix8
-rw-r--r--pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh18
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix405
-rw-r--r--pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh16
-rw-r--r--pkgs/os-specific/bsd/netbsd/getent.patch455
-rw-r--r--pkgs/os-specific/bsd/openbsd/default.nix42
-rw-r--r--pkgs/os-specific/bsd/openbsd/nc.patch421
-rw-r--r--pkgs/os-specific/darwin/CoreSymbolication/default.nix19
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh8
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix41
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix32
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix45
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile1
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix38
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix31
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix117
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix25
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/top/default.nix15
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix14
-rw-r--r--pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch98
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix51
-rw-r--r--pkgs/os-specific/darwin/cctools/support-ios.patch13
-rw-r--r--pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch17
-rw-r--r--pkgs/os-specific/darwin/darling/default.nix34
-rw-r--r--pkgs/os-specific/darwin/ios-cross/default.nix61
-rw-r--r--pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix68
-rw-r--r--pkgs/os-specific/darwin/maloader/default.nix1
-rw-r--r--pkgs/os-specific/darwin/opencflite/default.nix2
-rw-r--r--pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix (renamed from pkgs/os-specific/darwin/swift-corefoundation/default.nix)0
-rw-r--r--pkgs/os-specific/darwin/swift-corelibs/default.nix8
-rw-r--r--pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix12
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-lib/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-oss/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-plugins/default.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix4
-rw-r--r--pkgs/os-specific/linux/autofs/default.nix8
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix4
-rw-r--r--pkgs/os-specific/linux/bluez/bluez5_28.nix82
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix10
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix4
-rw-r--r--pkgs/os-specific/linux/checksec/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix10
-rw-r--r--pkgs/os-specific/linux/exfat/default.nix6
-rw-r--r--pkgs/os-specific/linux/gogoclient/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix6
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix9
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix16
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.15.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.16.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix11
-rw-r--r--pkgs/os-specific/linux/kmod/aggregator.nix6
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix4
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix4
-rw-r--r--pkgs/os-specific/linux/mcelog/default.nix4
-rw-r--r--pkgs/os-specific/linux/musl/default.nix29
-rw-r--r--pkgs/os-specific/linux/musl/fts-setup-hook.sh17
-rw-r--r--pkgs/os-specific/linux/musl/fts.nix2
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix4
-rw-r--r--pkgs/os-specific/linux/pam_u2f/default.nix4
-rw-r--r--pkgs/os-specific/linux/policycoreutils/default.nix1
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix10
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix36
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix6
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix6
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix4
-rw-r--r--pkgs/os-specific/linux/spl/default.nix1
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix17
-rw-r--r--pkgs/os-specific/linux/tmon/default.nix24
-rw-r--r--pkgs/os-specific/linux/uclibc/default.nix2
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix10
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix4
-rw-r--r--pkgs/os-specific/linux/xf86-input-wacom/default.nix4
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix13
98 files changed, 2310 insertions, 348 deletions
diff --git a/pkgs/os-specific/bsd/default.nix b/pkgs/os-specific/bsd/default.nix
new file mode 100644
index 000000000000..a8301ea2a8fc
--- /dev/null
+++ b/pkgs/os-specific/bsd/default.nix
@@ -0,0 +1,8 @@
+{ callPackages, recurseIntoAttrs }:
+
+rec {
+  netbsd = recurseIntoAttrs (callPackages ./netbsd {});
+  openbsd = recurseIntoAttrs (callPackages ./openbsd {
+    inherit (netbsd) compat netBSDDerivation libcurses;
+  });
+}
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
new file mode 100644
index 000000000000..d47d602e2edb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -0,0 +1,18 @@
+setupCompatFlags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lnbcompat"
+    export NIX_${role}CFLAGS_COMPILE+=" -DHAVE_NBTOOL_CONFIG_H"
+    export NIX_${role}CFLAGS_COMPILE+=" -include nbtool_config.h"
+}
+
+addEnvHooks "$hostOffset" setupCompatFlags
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
new file mode 100644
index 000000000000..42633232c71a
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -0,0 +1,405 @@
+{ stdenv, hostPlatform, fetchcvs, lib, groff, mandoc, zlib, coreutils
+, yacc, flex, libressl, bash }:
+
+let
+  fetchNetBSD = path: version: sha256: fetchcvs {
+    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+    module = "src/${path}";
+    inherit sha256;
+    tag = "netbsd-${builtins.replaceStrings ["."] ["-"] version}-RELEASE";
+  };
+
+  netBSDDerivation = attrs: stdenv.mkDerivation ((rec {
+    name = "${attrs.pname or (baseNameOf attrs.path)}-netbsd-${attrs.version}";
+    src = fetchNetBSD attrs.path attrs.version attrs.sha256;
+
+    extraPaths = [ ];
+
+    nativeBuildInputs = [ makeMinimal mandoc groff install yacc flex ];
+    buildInputs = [ compat ];
+    installFlags = [ "includes" ];
+
+    # These should be coverd in nbcompat, but are missing, sadly
+    NIX_CFLAGS_COMPILE = [
+      "-D__noinline="
+      "-D__warn_references(a,b)="
+      "-D__strong_alias(a,b)="
+      "-D__va_list=va_list"
+    ];
+
+    # Definitions passed to share/mk/*.mk. Should be pretty simple -
+    # eventually maybe move it to a configure script.
+    DESTDIR = "$(out)";
+    TOOLDIR = "$(out)";
+    USETOOLS = "never";
+    NOCLANGERROR="yes";
+    NOGCCERROR="yes";
+    LEX = "flex";
+
+    # libs will be provided by cc-wrapper
+    LIBCRT0="";
+    LIBCRTI="";
+    LIBCRTEND="";
+    LIBCRTBEGIN="";
+    LIBC="";
+    LIBUTIL="";
+    LIBSSL = "";
+    LIBCRYPTO = "";
+    LIBCURSES = "";
+    "LIBDO.terminfo" = "_external";
+    _GCC_CRTBEGIN = "";
+    _GCC_CRTBEGINS = "";
+    _GCC_CRTEND = "";
+    _GCC_CRTENDS = "";
+    _GCC_LIBGCCDIR = "";
+    _GCC_CRTI = "";
+    _GCC_CRTDIR = "";
+    _GCC_CRTN = "";
+
+    # all dirs will be prefixed with DESTDIR
+    BINDIR = "/bin";
+    LIBDIR = "/lib";
+    SHLIBDIR = "/lib";
+    MANDIR = "/share/man";
+    INFODIR = "/share/info";
+    DOCDIR = "/share/doc";
+    LOCALEDIR = "/share/locale";
+    X11BINDIR = "/bin";
+    X11USRLIBDIR = "/lib";
+    X11MANDIR = "/share/man";
+    SHLINKDIR = "/usr/libexec";
+
+    HOST_SH = "${bash}/bin/sh";
+
+    # not using bsd binutils
+    SHLIB_WARNTEXTREL = "no";
+    SHLIB_MKMAP = "no";
+    OBJCOPY = "true";
+    PRESERVE = "-p";
+
+    MACHINE_ARCH = hostPlatform.parsed.cpu.name;
+    MACHINE_CPU = hostPlatform.parsed.cpu.name;
+
+    # NetBSD makefiles should be able to detect this
+    # but without they end up using gcc on Darwin stdenv
+    preConfigure = ''
+      export HAVE_${if stdenv.cc.isGNU then "GCC" else "LLVM"}=${lib.head (lib.splitString "." (lib.getVersion stdenv.cc.cc))}
+    '' + lib.optionalString (!builtins.hasAttr "nativeBuildInputs" attrs) ''
+      # hack until #38657 is fixed
+      export PATH=${install}/bin:$PATH
+    '';
+
+    postUnpack = ''
+      # merge together all extra paths
+      # there should be a better way to do this
+      sourceRoot=$PWD/$sourceRoot
+      export NETBSDSRCDIR=$sourceRoot
+      export BSDSRCDIR=$NETBSDSRCDIR
+      chmod -R u+w $sourceRoot
+      for path in $extraPaths; do
+        cd $path
+        find . -type d -exec mkdir -p $sourceRoot/\{} \;
+        find . -type f -exec cp -pr \{} $sourceRoot/\{} \;
+        chmod -R u+w $sourceRoot
+      done
+
+      cd $sourceRoot
+      if [ -d ${attrs.path} ]
+        then sourceRoot=$sourceRoot/${attrs.path}
+      fi
+    '';
+
+    # need to create directories for xinstall to work
+    preInstall = ''
+      mkdir -p $out$BINDIR $out$LIBDIR $out$INFODIR \
+               $out$DOCDIR $out$LOCALEDIR
+      for i in 1 2 3 4 5 6 7 8 9; do
+        mkdir -p $out$MANDIR/man$i $out$MANDIR/html$i $out$DOCDIR/reference/ref$i
+      done
+      mkdir -p $out/usr/include
+    '';
+
+    postInstall = ''
+      # Remove lingering /usr references
+      if [ -d $out/usr ]; then
+        cd $out/usr
+        find . -type d -exec mkdir -p $out/\{} \;
+        find . -type f -exec mv \{} $out/\{} \;
+        find . -type d -delete
+      fi
+
+      find $out -type d -empty -delete
+    '';
+
+    meta = with lib; {
+      maintainers = with maintainers; [matthewbauer];
+      platforms = platforms.unix;
+      license = licenses.bsd2;
+    };
+  }) // attrs);
+
+  # BOOTSTRAPPING
+  makeMinimal = netBSDDerivation rec {
+    path = "tools/make";
+    sha256 = "0l4794zwj2haark3azf9xwcwqlkbrifhb2glaa9iba4dkg2mklsb";
+    version = "7.1.2";
+
+    buildInputs = [];
+    nativeBuildInputs = [];
+    NIX_CFLAGS_COMPILE = "";
+    NIX_LDFLAGS = "";
+
+    patchPhase = ''
+      patchShebangs configure
+      ${make.patchPhase}
+    '';
+    buildPhase = "sh ./buildmake.sh";
+    installPhase = ''
+      install -D nbmake $out/bin/nbmake
+      ln -s $out/bin/nbmake $out/bin/make
+      mkdir -p $out/share
+      cp -r ../../share/mk $out/share/mk
+    '';
+    extraPaths = [ make.src ] ++ make.extraPaths;
+  };
+
+  compat = netBSDDerivation {
+    path = "tools/compat";
+    sha256 = "17phkfafybxwhzng44k5bhmag6i55br53ky1nwcmw583kg2fa86z";
+    version = "7.1.2";
+
+    setupHook = ./compat-setup-hook.sh;
+
+    # override defaults to prevent infinite recursion
+    nativeBuildInputs = [ makeMinimal ];
+    buildInputs = [ zlib ];
+    NIX_CFLAGS_COMPILE = "";
+    NIX_LDFLAGS = "";
+
+    # temporarily use gnuinstall for bootstrapping
+    # bsdinstall will be built later
+    makeFlags = "INSTALL=${coreutils}/bin/install";
+    RENAME = "-D";
+
+    postInstall = ''
+      mv $out/include/compat/* $out/include
+      rmdir $out/include/compat
+
+      # why aren't these installed by netbsd?
+      install -D compat_defs.h $out/include/compat_defs.h
+      install -D $NETBSDSRCDIR/include/cdbw.h $out/include/cdbw.h
+      install -D $NETBSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
+      install -D $NETBSDSRCDIR/sys/sys/featuretest.h \
+                 $out/include/sys/featuretest.h
+      install -D $NETBSDSRCDIR/sys/sys/md5.h $out/include/md5.h
+      install -D $NETBSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
+      install -D $NETBSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
+      install -D $NETBSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
+      install -D $NETBSDSRCDIR/include/vis.h $out/include/vis.h
+    '';
+    extraPaths = [ libc.src libutil.src
+      (fetchNetBSD "include" "7.1.2" "1vc58xrhrp202biiv1chhlh0jwnjr7k3qq91pm46k6v5j95j0qwp")
+      (fetchNetBSD "external/bsd/flex" "7.1.2" "0m0m72r3zzc9gi432h3xkqdzspr4n0hj4m8h7j74pwbvpfg9d9qq")
+      (fetchNetBSD "sys/sys" "7.1.2" "1vwnv5nk7rlgn5w9nkdqj9652hmwmfwqxj3ymcz0zk10abbaib93")
+    ] ++ libutil.extraPaths ++ libc.extraPaths;
+  };
+
+  install = netBSDDerivation {
+    path = "usr.bin/xinstall";
+    version = "7.1.2";
+    sha256 = "0nzhyh714m19h61m45gzc5dszkbafp5iaphbp5mza6w020fzf2y8";
+    extraPaths = [ mtree.src make.src ];
+    nativeBuildInputs = [ makeMinimal mandoc groff compat ];
+    RENAME = "-D";
+  };
+  # END BOOTSTRAPPING
+
+  libutil = netBSDDerivation {
+    path = "lib/libutil";
+    version = "7.1.2";
+    sha256 = "12848ynizz13mvn2kndrkq482xhkw323b7c8fg0zli1nhfsmwsm8";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libutil" "7.1.2" "0q3ixrf36lip1dx0gafs0a03qfs5cs7n0myqq7af4jpjd6kh1831")
+    ];
+  };
+
+  libc = netBSDDerivation {
+    path = "lib/libc";
+    version = "7.1.2";
+    sha256 = "13rcx3mbx2644z01zgk9gggdfr0hqdbsvd7zrsm2l13yf9aix6pg";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libc" "7.1.2" "1va8zd4lqyrc1d0c9q04r8y88cfxpkhwcxasggxxvhksd3khkpha")
+    ];
+  };
+
+  make = netBSDDerivation {
+    path = "usr.bin/make";
+    sha256 = "0srkkg6qdzqlccfi4xh19gl766ks6hpss76bnfvwmd0zg4q4zdar";
+    version = "7.1.2";
+    patchPhase = ''
+      # make needs this to pick up our sys make files
+      NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+      # can't set owner or group in Nix build
+      # maybe there is a better way to trick it?
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.prog.mk \
+        --replace '-o ''${SCRIPTSOWN_''${.ALLSRC:T}:U''${SCRIPTSOWN}}' "" \
+        --replace '-g ''${SCRIPTSGRP_''${.ALLSRC:T}:U''${SCRIPTSGRP}}' "" \
+        --replace '-o ''${RUMPBINOWN} -g ''${RUMPBINGRP}' "" \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
+        --replace '-o ''${RUMPBINOWN} -g ''${RUMPBINGRP}' "" \
+        --replace '-o ''${DEBUGOWN} -g ''${DEBUGGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.doc.mk \
+        --replace '-o ''${DOCOWN} -g ''${DOCGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.man.mk \
+        --replace '-o ''${MANOWN} -g ''${MANGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.files.mk \
+        --replace '-o ''${FILESOWN_''${.ALLSRC:T}:U''${FILESOWN}}' "" \
+        --replace '-g ''${FILESGRP_''${.ALLSRC:T}:U''${FILESGRP}}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.inc.mk \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace '-o ''${DEBUGOWN} -g ''${DEBUGGRP}' "" \
+        --replace '-o ''${LIBOWN} -g ''${LIBGRP}' ""
+
+      substituteInPlace $NETBSDSRCDIR/share/mk/Makefile \
+        --replace /usr/share/mk /share/mk
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace ' ''${_ARFL} ''${.TARGET} `NM=''${NM} ''${LORDER} ''${.ALLSRC:M*o} | ''${TSORT}`' ' ''${_ARFL} ''${.TARGET} ''${.ALLSRC:M*o}' \
+        --replace '-Wl,-soname,''${_LIB}.so.''${SHLIB_SOVERSION}' "" \
+        --replace '-Wl,--whole-archive' "" \
+        --replace '-Wl,--no-whole-archive' ""
+    '';
+    postInstall = ''
+      (cd $NETBSDSRCDIR/share/mk && make install)
+    '';
+    extraPaths = [
+      (fetchNetBSD "share/mk" "7.1.2" "0570v0siv0wygn8ygs1yy9pgk9xjw9x1axr5qg4xrddv3lskf9xa")
+    ];
+  };
+
+  mtree = netBSDDerivation {
+    path = "usr.sbin/mtree";
+    version = "7.1.2";
+    sha256 = "1dhsyfvcm67kf5zdbg5dmx5y8fimnbll6qxwp3gjfmbxqigmc52m";
+  };
+
+in rec {
+  inherit compat libc libutil install make mtree netBSDDerivation;
+
+  getent = netBSDDerivation {
+    path = "usr.bin/getent";
+    sha256 = "1ylhw4dnpyrmcy8n5kjcxywm8qc9p124dqnm17x4magiqx1kh9iz";
+    version = "7.1.2";
+    patches = [ ./getent.patch ];
+  };
+
+  getconf = netBSDDerivation {
+    path = "usr.bin/getconf";
+    sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
+    version = "7.1.2";
+  };
+
+  fts = netBSDDerivation {
+    pname = "fts";
+    path = "include/fts.h";
+    sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
+    version = "7.1.2";
+    nativeBuildInputs = [ ];
+    extraPaths = [
+      (fetchNetBSD "lib/libc/gen/fts.c" "7.1.2" "1yfd2liypj6xky2h0mgxi5lgpflmkkg4zf3ii3apz5cf8jq9gmn9")
+      (fetchNetBSD "lib/libc/include/namespace.h" "7.1.2" "0kwd4v8y0mfjhmwplsk52pvzbcpvpp2qy2g8c0jmfraam63q6q1y")
+      (fetchNetBSD "lib/libc/gen/fts.3" "7.1.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+    ];
+    buildPhase = ''
+      cc  -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+          -o lib/libc/gen/fts.o
+      ar -rsc libfts.a lib/libc/gen/fts.o
+    '';
+    installPhase = ''
+      install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
+      install -D include/fts.h $out/include/fts.h
+      install -D lib/libc/include/namespace.h $out/include/namespace.h
+      install -D libfts.a $out/lib/libfts.a
+    '';
+    setupHook = ./fts-setup-hook.sh;
+  };
+
+  games = netBSDDerivation {
+    path = "games";
+    sha256 = "04wjsang8f8kxsifiayklbxaaxmm3vx9rfr91hfbxj4hk8gkqzy1";
+    version = "7.1.2";
+    patchPhase = ''
+      sed -i '1i #include <time.h>' adventure/save.c
+    '';
+  };
+
+  who = netBSDDerivation {
+    path = "usr.bin/who";
+    version = "7.1.2";
+    sha256 = "17ffwww957m3qw0b6fkgjpp12pd5ydg2hs9dxkkw0qpv11j00d88";
+  };
+
+  finger = netBSDDerivation {
+    path = "usr.bin/finger";
+    sha256 = "0jl672z50f2yf7ikp682b3xrarm6bnrrx9vi94xnp2fav8m8zfyi";
+    version = "7.1.2";
+    extraPaths = [ who.src ];
+  };
+
+  fingerd = netBSDDerivation {
+    path = "usr.bin/fingerd";
+    sha256 = "04wjsang8f8kxsifiayklbxaaxmm3vx9rfr91hfbxj4hk8gkqz00";
+    version = "7.1.2";
+  };
+
+  libedit = netBSDDerivation {
+    path = "lib/libedit";
+    buildInputs = [ compat libterminfo ];
+    patchPhase = ''
+      sed -i '1i #undef bool_t' el.h
+    '';
+    version = "7.1.2";
+    sha256 = "0qvr52j4qih10m7fa8nddn1psyjy9l0pa4ix02acyssjvgbz2kca";
+  };
+
+  libterminfo = netBSDDerivation {
+    path = "lib/libterminfo";
+    version = "7.1.2";
+    sha256 = "06plg0bjqgbb0aghpb9qlk8wkp1l2izdlr64vbr5laqyw8jg84zq";
+    buildInputs = [ compat tic nbperf ];
+    extraPaths = [
+      (fetchNetBSD "share/terminfo" "7.1.2" "1z5vzq8cw24j05r6df4vd6r57cvdbv7vbm4h962kplp14xrbg2h3")
+    ];
+  };
+
+  libcurses = netBSDDerivation {
+    path = "lib/libcurses";
+    version = "7.1.2";
+    sha256 = "04djah9dadzw74nswn0xydkxn900kav8xdvxlxdl50nbrynxg9yf";
+    buildInputs = [ compat libterminfo ];
+    MKDOC = "no"; # missing vfontedpr
+  };
+
+  nbperf = netBSDDerivation {
+    path = "usr.bin/nbperf";
+    version = "7.1.2";
+    sha256 = "0gzm0zv2400lasnsswnjw9bwzyizhxzdbrcjwcl1k65aj86aqyqb";
+  };
+
+  tic = netBSDDerivation {
+    path = "tools/tic";
+    version = "7.1.2";
+    sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
+    HOSTPROG = "tic";
+    buildInputs = [ compat nbperf ];
+    extraPaths = [
+      libterminfo.src
+      (fetchNetBSD "usr.bin/tic" "7.1.2" "1ghwsaag4gbwvgp3lfxscnh8hn27n8cscwmgjwp3bkx5vl85nfsa")
+      (fetchNetBSD "tools/Makefile.host" "7.1.2" "076r3amivb6xranpvqjmg7x5ibj4cbxaa3z2w1fh47h7d55dw9w8")
+    ];
+  };
+
+}
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
new file mode 100644
index 000000000000..6b7064174931
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
@@ -0,0 +1,16 @@
+ftsLdflags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lfts"
+}
+
+addEnvHooks "$hostOffset" ftsLdflags
diff --git a/pkgs/os-specific/bsd/netbsd/getent.patch b/pkgs/os-specific/bsd/netbsd/getent.patch
new file mode 100644
index 000000000000..e9e34d19a315
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/getent.patch
@@ -0,0 +1,455 @@
+Author: Matthew Bauer
+Description: Remove unavailable getent databases
+Version: 7.1.2
+--- a/getent.c	2018-04-16 13:33:49.000000000 -0500
++++ b/getent.c	2018-04-16 13:29:30.000000000 -0500
+@@ -42,7 +42,6 @@
+ #include <grp.h>
+ #include <limits.h>
+ #include <netdb.h>
+-#include <netgroup.h>
+ #include <pwd.h>
+ #include <stdio.h>
+ #include <stdarg.h>
+@@ -57,27 +56,16 @@
+ #include <arpa/nameser.h>
+ 
+ #include <net/if.h>
+-#include <net/if_ether.h>
+ 
+ #include <netinet/in.h>		/* for INET6_ADDRSTRLEN */
+ 
+-#include <rpc/rpcent.h>
+-
+-#include <disktab.h>
+-
+ static int	usage(void) __attribute__((__noreturn__));
+ static int	parsenum(const char *, unsigned long *);
+-static int	disktab(int, char *[]);
+-static int	gettytab(int, char *[]);
+-static int	ethers(int, char *[]);
+ static int	group(int, char *[]);
+ static int	hosts(int, char *[]);
+-static int	netgroup(int, char *[]);
+ static int	networks(int, char *[]);
+ static int	passwd(int, char *[]);
+-static int	printcap(int, char *[]);
+ static int	protocols(int, char *[]);
+-static int	rpc(int, char *[]);
+ static int	services(int, char *[]);
+ static int	shells(int, char *[]);
+ 
+@@ -92,17 +80,11 @@
+ 	const char	*name;
+ 	int		(*callback)(int, char *[]);
+ } databases[] = {
+-	{	"disktab",	disktab,	},
+-	{	"ethers",	ethers,		},
+-	{	"gettytab",	gettytab,	},
+ 	{	"group",	group,		},
+ 	{	"hosts",	hosts,		},
+-	{	"netgroup",	netgroup,	},
+ 	{	"networks",	networks,	},
+ 	{	"passwd",	passwd,		},
+-	{	"printcap",	printcap,	},
+ 	{	"protocols",	protocols,	},
+-	{	"rpc",		rpc,		},
+ 	{	"services",	services,	},
+ 	{	"shells",	shells,		},
+ 
+@@ -195,49 +177,6 @@
+ 	(void)printf("\n");
+ }
+ 
+-
+-		/*
+-		 * ethers
+-		 */
+-
+-static int
+-ethers(int argc, char *argv[])
+-{
+-	char		hostname[MAXHOSTNAMELEN + 1], *hp;
+-	struct ether_addr ea, *eap;
+-	int		i, rv;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define ETHERSPRINT	(void)printf("%-17s  %s\n", ether_ntoa(eap), hp)
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on ethers");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if ((eap = ether_aton(argv[i])) == NULL) {
+-				eap = &ea;
+-				hp = argv[i];
+-				if (ether_hostton(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			} else {
+-				hp = hostname;
+-				if (ether_ntohost(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			}
+-			ETHERSPRINT;
+-		}
+-	}
+-	return rv;
+-}
+-
+ 		/*
+ 		 * group
+ 		 */
+@@ -298,7 +237,7 @@
+ hosts(int argc, char *argv[])
+ {
+ 	struct hostent	*he;
+-	char		addr[IN6ADDRSZ];
++	char		addr[NS_IN6ADDRSZ];
+ 	int		i, rv;
+ 
+ 	assert(argc > 1);
+@@ -312,9 +251,9 @@
+ 	} else {
+ 		for (i = 2; i < argc; i++) {
+ 			if (inet_pton(AF_INET6, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, IN6ADDRSZ, AF_INET6);
++				he = gethostbyaddr(addr, NS_IN6ADDRSZ, AF_INET6);
+ 			else if (inet_pton(AF_INET, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, INADDRSZ, AF_INET);
++				he = gethostbyaddr(addr, NS_INADDRSZ, AF_INET);
+ 			else
+ 				he = gethostbyname(argv[i]);
+ 			if (he != NULL)
+@@ -330,48 +269,6 @@
+ }
+ 
+ 		/*
+-		 * netgroup
+-		 */
+-static int
+-netgroup(int argc, char *argv[])
+-{
+-	int		rv, i;
+-	bool		first;
+-	const char	*host, *user, *domain;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define NETGROUPPRINT(s)	(((s) != NULL) ? (s) : "")
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on netgroup");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			setnetgrent(argv[i]);
+-			first = true;
+-			while (getnetgrent(&host, &user, &domain) != 0) {
+-				if (first) {
+-					first = false;
+-					(void)fputs(argv[i], stdout);
+-				}
+-				(void)printf(" (%s,%s,%s)",
+-				    NETGROUPPRINT(host),
+-				    NETGROUPPRINT(user),
+-				    NETGROUPPRINT(domain));
+-			}
+-			if (!first)
+-				(void)putchar('\n');
+-			endnetgrent();
+-		}
+-	}
+-
+-	return rv;
+-}
+-
+-		/*
+ 		 * networks
+ 		 */
+ 
+@@ -464,227 +361,6 @@
+ 	return rv;
+ }
+ 
+-static char *
+-mygetent(const char * const * db_array, const char *name)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = cgetent(&buf, db_array, name)) {
+-	case -3:
+-		warnx("tc= loop in record `%s' in `%s'", name, db_array[0]);
+-		break;
+-	case -2:
+-		warn("system error fetching record `%s' in `%s'", name,
+-		    db_array[0]);
+-		break;
+-	case -1:
+-	case 0:
+-		break;
+-	case 1:
+-		warnx("tc= reference not found in record for `%s' in `%s'",
+-		    name, db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in record `%s' in `%s'", error, name,
+-		    db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static char *
+-mygetone(const char * const * db_array, int first)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = (first ? cgetfirst : cgetnext)(&buf, db_array)) {
+-	case -2:
+-		warnx("tc= loop in `%s'", db_array[0]);
+-		break;
+-	case -1:
+-		warn("system error fetching record in `%s'", db_array[0]);
+-		break;
+-	case 0:
+-	case 1:
+-		break;
+-	case 2:
+-		warnx("tc= reference not found in `%s'", db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in `%s'", error, db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static void
+-capprint(const char *cap)
+-{
+-	char *c = strchr(cap, ':');
+-	if (c)
+-		if (c == cap)
+-			(void)printf("true\n");
+-		else {
+-			int l = (int)(c - cap);
+-			(void)printf("%*.*s\n", l, l, cap);
+-		}
+-	else
+-		(void)printf("%s\n", cap);
+-}
+-
+-static void
+-prettyprint(char *b)
+-{
+-#define TERMWIDTH 65
+-	int did = 0;
+-	size_t len;
+-	char *s, c;
+-
+-	for (;;) {
+-		len = strlen(b);
+-		if (len <= TERMWIDTH) {
+-done:
+-			if (did)
+-				printf("\t:");
+-			printf("%s\n", b);
+-			return;
+-		}
+-		for (s = b + TERMWIDTH; s > b && *s != ':'; s--)
+-			continue;
+-		if (*s++ != ':')
+-			goto done;
+-		c = *s;
+-		*s = '\0';
+-		if (did)
+-			printf("\t:");
+-		did++;
+-		printf("%s\\\n", b);
+-		*s = c;
+-		b = s;
+-	}
+-}
+-
+-static void
+-handleone(const char * const *db_array, char *b, int recurse, int pretty,
+-    int level)
+-{
+-	char *tc;
+-
+-	if (level && pretty)
+-		printf("\n");
+-	if (pretty)
+-		prettyprint(b);
+-	else
+-		printf("%s\n", b);
+-	if (!recurse || cgetstr(b, "tc", &tc) <= 0)
+-		return;
+-
+-	b = mygetent(db_array, tc);
+-	free(tc);
+-
+-	if (b == NULL)
+-		return;
+-
+-	handleone(db_array, b, recurse, pretty, ++level);
+-	free(b);
+-}
+-
+-static int
+-handlecap(const char *db, int argc, char *argv[])
+-{
+-	static const char sfx[] = "=#:";
+-	const char *db_array[] = { db, NULL };
+-	char	*b, *cap;
+-	int	i, rv, c;
+-	size_t	j;
+-	int	expand = 1, recurse = 0, pretty = 0;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-	argc--;
+-	argv++;
+-	while ((c = getopt(argc, argv, "pnr")) != -1)
+-		switch (c) {
+-		case 'n':
+-			expand = 0;
+-			break;
+-		case 'r':
+-			expand = 0;
+-			recurse = 1;
+-			break;
+-		case 'p':
+-			pretty = 1;
+-			break;
+-		default:
+-			usage();
+-			break;
+-		}
+-
+-	argc -= optind;
+-	argv += optind;
+-	csetexpandtc(expand);
+-	rv = RV_OK;
+-	if (argc == 0) {
+-		for (b = mygetone(db_array, 1); b; b = mygetone(db_array, 0)) {
+-			handleone(db_array, b, recurse, pretty, 0);
+-			free(b);
+-		}
+-	} else {
+-		if ((b = mygetent(db_array, argv[0])) == NULL)
+-			return RV_NOTFOUND;
+-		if (argc == 1)
+-			handleone(db_array, b, recurse, pretty, 0);
+-		else {
+-			for (i = 2; i < argc; i++) {
+-				for (j = 0; j < sizeof(sfx) - 1; j++) {
+-					cap = cgetcap(b, argv[i], sfx[j]);
+-					if (cap) {
+-						capprint(cap);
+-						break;
+-					} 
+-				}
+-				if (j == sizeof(sfx) - 1)
+-					printf("false\n");
+-			}
+-		}
+-		free(b);
+-	}
+-	return rv;
+-}
+-
+-		/*
+-		 * gettytab
+-		 */
+-
+-static int
+-gettytab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_GETTYTAB, argc, argv);
+-}
+-
+-		/*
+-		 * printcap
+-		 */
+-
+-static int
+-printcap(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_PRINTCAP, argc, argv);
+-}
+-
+-		/*
+-		 * disktab
+-		 */
+-
+-static int
+-disktab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_DISKTAB, argc, argv);
+-}
+-
+ 		/*
+ 		 * protocols
+ 		 */
+@@ -726,47 +402,6 @@
+ }
+ 
+ 		/*
+-		 * rpc
+-		 */
+-
+-static int
+-rpc(int argc, char *argv[])
+-{
+-	struct rpcent	*re;
+-	unsigned long	id;
+-	int		i, rv;
+-	
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define RPCPRINT	printfmtstrings(re->r_aliases, "  ", " ", \
+-				"%-16s  %6d", \
+-				re->r_name, re->r_number)
+-
+-	setrpcent(1);
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		while ((re = getrpcent()) != NULL)
+-			RPCPRINT;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if (parsenum(argv[i], &id))
+-				re = getrpcbynumber((int)id);
+-			else
+-				re = getrpcbyname(argv[i]);
+-			if (re != NULL)
+-				RPCPRINT;
+-			else {
+-				rv = RV_NOTFOUND;
+-				break;
+-			}
+-		}
+-	}
+-	endrpcent();
+-	return rv;
+-}
+-
+-		/*
+ 		 * services
+ 		 */
+ 
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
new file mode 100644
index 000000000000..9ccc0adaa2df
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -0,0 +1,42 @@
+{ fetchcvs, netBSDDerivation, compat, libcurses, libressl }:
+
+let
+  fetchOpenBSD = path: version: sha256: fetchcvs {
+    cvsRoot = "anoncvs@anoncvs.ca.openbsd.org:/cvs";
+    module = "src/${path}";
+    inherit sha256;
+    tag = "OPENBSD_${builtins.replaceStrings ["."] ["_"] version}";
+  };
+
+  # OpenBSD is a fork of NetBSD
+  # We can build it with minimal changes
+  openBSDDerivation = attrs: netBSDDerivation (attrs // {
+    name = "${attrs.pname or (baseNameOf attrs.path)}-openbsd-${attrs.version}";
+    src = fetchOpenBSD attrs.path attrs.version attrs.sha256;
+  });
+
+in {
+
+  mg = openBSDDerivation {
+    path = "usr.bin/mg";
+    version = "6.3";
+    sha256 = "0n3hwa81c2mcjwbmidrbvi1l25jh8hy939kqrigbv78jixpynffc";
+    buildInputs = [ compat libcurses ];
+    patchPhase = ''
+      NIX_CFLAGS_COMPILE+=" -I$BSDSRCDIR/sys"
+    '';
+    extraPaths = [
+      (fetchOpenBSD "sys/sys/tree.h" "6.3" "0rimh41wn9wz5m510zk9i27z3s450qqgq2k5xn8kp3885hygbcj9")
+      (fetchOpenBSD "sys/sys/_null.h" "6.3" "0l2rgg9ai4ivfl07zmbqli19vnm3lj7qkxpikqplmzrfp36qpzgr")
+    ];
+  };
+
+  nc = openBSDDerivation {
+    path = "usr.bin/nc";
+    version = "6.3";
+    sha256 = "0fmnh6ccxab0qvhmgspyd3wra1ps2516i0j6hwkvna2lcny20xvr";
+    patches = [ ./nc.patch ];
+    buildInputs = [ compat libressl ];
+  };
+
+}
diff --git a/pkgs/os-specific/bsd/openbsd/nc.patch b/pkgs/os-specific/bsd/openbsd/nc.patch
new file mode 100644
index 000000000000..de6fb2d04c41
--- /dev/null
+++ b/pkgs/os-specific/bsd/openbsd/nc.patch
@@ -0,0 +1,421 @@
+--- a/nc.1
++++ b/nc.1
+@@ -204,9 +204,6 @@ Proxy authentication is only supported f
+ Specifies the source port
+ .Nm
+ should use, subject to privilege restrictions and availability.
+-It is an error to use this option in conjunction with the
+-.Fl l
+-option.
+ .It Fl R Ar CAfile
+ Specifies the filename from which the root CA bundle for certificate
+ verification is loaded, in PEM format.
+@@ -258,6 +255,7 @@ For IPv4 TOS value
+ may be one of
+ .Ar critical ,
+ .Ar inetcontrol ,
++.Ar lowcost ,
+ .Ar lowdelay ,
+ .Ar netcontrol ,
+ .Ar throughput ,
+--- a/netcat.c
++++ b/netcat.c
+@@ -32,6 +32,8 @@
+  * *Hobbit* <hobbit@avian.org>.
+  */
+ 
++#define _GNU_SOURCE
++
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <sys/uio.h>
+@@ -41,6 +43,49 @@
+ #include <netinet/tcp.h>
+ #include <netinet/ip.h>
+ #include <arpa/telnet.h>
++#ifdef __linux__
++# include <linux/in6.h>
++#endif
++
++#ifndef IPTOS_LOWDELAY
++# define IPTOS_LOWDELAY 0x10
++# define IPTOS_THROUGHPUT 0x08
++# define IPTOS_RELIABILITY 0x04
++# define IPTOS_LOWCOST 0x02
++# define IPTOS_MINCOST IPTOS_LOWCOST
++#endif /* IPTOS_LOWDELAY */
++
++# ifndef IPTOS_DSCP_AF11
++# define	IPTOS_DSCP_AF11		0x28
++# define	IPTOS_DSCP_AF12		0x30
++# define	IPTOS_DSCP_AF13		0x38
++# define	IPTOS_DSCP_AF21		0x48
++# define	IPTOS_DSCP_AF22		0x50
++# define	IPTOS_DSCP_AF23		0x58
++# define	IPTOS_DSCP_AF31		0x68
++# define	IPTOS_DSCP_AF32		0x70
++# define	IPTOS_DSCP_AF33		0x78
++# define	IPTOS_DSCP_AF41		0x88
++# define	IPTOS_DSCP_AF42		0x90
++# define	IPTOS_DSCP_AF43		0x98
++# define	IPTOS_DSCP_EF		0xb8
++#endif /* IPTOS_DSCP_AF11 */
++
++#ifndef IPTOS_DSCP_CS0
++# define	IPTOS_DSCP_CS0		0x00
++# define	IPTOS_DSCP_CS1		0x20
++# define	IPTOS_DSCP_CS2		0x40
++# define	IPTOS_DSCP_CS3		0x60
++# define	IPTOS_DSCP_CS4		0x80
++# define	IPTOS_DSCP_CS5		0xa0
++# define	IPTOS_DSCP_CS6		0xc0
++# define	IPTOS_DSCP_CS7		0xe0
++#endif /* IPTOS_DSCP_CS0 */
++
++#ifndef IPTOS_DSCP_EF
++# define	IPTOS_DSCP_EF		0xb8
++#endif /* IPTOS_DSCP_EF */
++
+ 
+ #include <err.h>
+ #include <errno.h>
+@@ -268,10 +315,14 @@ main(int argc, char *argv[])
+ 			uflag = 1;
+ 			break;
+ 		case 'V':
++# if defined(RT_TABLEID_MAX)
+ 			rtableid = (int)strtonum(optarg, 0,
+ 			    RT_TABLEID_MAX, &errstr);
+ 			if (errstr)
+ 				errx(1, "rtable %s: %s", errstr, optarg);
++# else
++			errx(1, "no alternate routing table support available");
++# endif
+ 			break;
+ 		case 'v':
+ 			vflag = 1;
+@@ -320,7 +371,11 @@ main(int argc, char *argv[])
+ 			oflag = optarg;
+ 			break;
+ 		case 'S':
++# if defined(TCP_MD5SIG)
+ 			Sflag = 1;
++# else
++			errx(1, "no TCP MD5 signature support available");
++# endif
+ 			break;
+ 		case 'T':
+ 			errstr = NULL;
+@@ -345,35 +400,23 @@ main(int argc, char *argv[])
+ 	argc -= optind;
+ 	argv += optind;
+ 
++# if defined(RT_TABLEID_MAX)
+ 	if (rtableid >= 0)
+ 		if (setrtable(rtableid) == -1)
+ 			err(1, "setrtable");
+-
+-	if (family == AF_UNIX) {
+-		if (pledge("stdio rpath wpath cpath tmppath unix", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Fflag && Pflag) {
+-		if (pledge("stdio inet dns sendfd tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Fflag) { 
+-		if (pledge("stdio inet dns sendfd", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Pflag && usetls) {
+-		if (pledge("stdio rpath inet dns tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (Pflag) {
+-		if (pledge("stdio inet dns tty", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (usetls) {
+-		if (pledge("stdio rpath inet dns", NULL) == -1)
+-			err(1, "pledge");
+-	} else if (pledge("stdio inet dns", NULL) == -1)
+-		err(1, "pledge");
++# endif
+ 
+ 	/* Cruft to make sure options are clean, and used properly. */
+ 	if (argv[0] && !argv[1] && family == AF_UNIX) {
+ 		host = argv[0];
+ 		uport = NULL;
++	} else if (!argv[0] && lflag) {
++		if (sflag)
++			errx(1, "cannot use -s and -l");
++		if (pflag)
++			errx(1, "cannot use -p and -l");
++		if (zflag)
++			errx(1, "cannot use -z and -l");
+ 	} else if (argv[0] && !argv[1]) {
+ 		if (!lflag)
+ 			usage(1);
+@@ -385,12 +428,6 @@ main(int argc, char *argv[])
+ 	} else
+ 		usage(1);
+ 
+-	if (lflag && sflag)
+-		errx(1, "cannot use -s and -l");
+-	if (lflag && pflag)
+-		errx(1, "cannot use -p and -l");
+-	if (lflag && zflag)
+-		errx(1, "cannot use -z and -l");
+ 	if (!lflag && kflag)
+ 		errx(1, "must use -l with -k");
+ 	if (uflag && usetls)
+@@ -425,8 +462,8 @@ main(int argc, char *argv[])
+ 		} else {
+ 			strlcpy(unix_dg_tmp_socket_buf, "/tmp/nc.XXXXXXXXXX",
+ 			    UNIX_DG_TMP_SOCKET_SIZE);
+-			if (mktemp(unix_dg_tmp_socket_buf) == NULL)
+-				err(1, "mktemp");
++			if (mkstemp(unix_dg_tmp_socket_buf) == -1)
++				err(1, "mkstemp");
+ 			unix_dg_tmp_socket = unix_dg_tmp_socket_buf;
+ 		}
+ 	}
+@@ -901,8 +938,10 @@ remote_connect(const char *host, const c
+ 		if (sflag || pflag) {
+ 			struct addrinfo ahints, *ares;
+ 
++# if defined (SO_BINDANY)
+ 			/* try SO_BINDANY, but don't insist */
+ 			setsockopt(s, SOL_SOCKET, SO_BINDANY, &on, sizeof(on));
++# endif
+ 			memset(&ahints, 0, sizeof(struct addrinfo));
+ 			ahints.ai_family = res->ai_family;
+ 			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
+@@ -994,9 +1033,15 @@ local_listen(char *host, char *port, str
+ 		    res->ai_protocol)) < 0)
+ 			continue;
+ 
++		ret = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
++		if (ret == -1)
++			err(1, NULL);
++
++# if defined(SO_REUSEPORT)
+ 		ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &x, sizeof(x));
+ 		if (ret == -1)
+ 			err(1, NULL);
++# endif
+ 
+ 		set_common_sockopts(s, res->ai_family);
+ 
+@@ -1452,11 +1497,13 @@ set_common_sockopts(int s, int af)
+ {
+ 	int x = 1;
+ 
++# if defined(TCP_MD5SIG)
+ 	if (Sflag) {
+ 		if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG,
+ 			&x, sizeof(x)) == -1)
+ 			err(1, NULL);
+ 	}
++# endif
+ 	if (Dflag) {
+ 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
+ 			&x, sizeof(x)) == -1)
+@@ -1467,9 +1514,14 @@ set_common_sockopts(int s, int af)
+ 		    IP_TOS, &Tflag, sizeof(Tflag)) == -1)
+ 			err(1, "set IP ToS");
+ 
++#if defined(IPV6_TCLASS)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_TCLASS, &Tflag, sizeof(Tflag)) == -1)
+ 			err(1, "set IPv6 traffic class");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 traffic class (unavailable)");
++#endif
+ 	}
+ 	if (Iflag) {
+ 		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
+@@ -1487,19 +1539,34 @@ set_common_sockopts(int s, int af)
+ 		    IP_TTL, &ttl, sizeof(ttl)))
+ 			err(1, "set IP TTL");
+ 
++#if defined(IPV6_UNICAST_HOPS)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_UNICAST_HOPS, &ttl, sizeof(ttl)))
+ 			err(1, "set IPv6 unicast hops");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 unicast hops (unavailable)");
++#endif
+ 	}
+ 
+ 	if (minttl != -1) {
++#if defined(IP_MINTTL)
+ 		if (af == AF_INET && setsockopt(s, IPPROTO_IP,
+ 		    IP_MINTTL, &minttl, sizeof(minttl)))
+ 			err(1, "set IP min TTL");
++#else
++		if (af == AF_INET)
++			errx(1, "can't set IP min TTL (unavailable)");
++#endif
+ 
++#if defined(IPV6_MINHOPCOUNT)
+ 		else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
+ 		    IPV6_MINHOPCOUNT, &minttl, sizeof(minttl)))
+ 			err(1, "set IPv6 min hop count");
++#else
++		else if (af == AF_INET6)
++			errx(1, "can't set IPv6 min hop count (unavailable)");
++#endif
+ 	}
+ }
+ 
+@@ -1534,6 +1601,7 @@ process_tos_opt(char *s, int *val)
+ 		{ "cs7",		IPTOS_DSCP_CS7 },
+ 		{ "ef",			IPTOS_DSCP_EF },
+ 		{ "inetcontrol",	IPTOS_PREC_INTERNETCONTROL },
++		{ "lowcost",		IPTOS_LOWCOST },
+ 		{ "lowdelay",		IPTOS_LOWDELAY },
+ 		{ "netcontrol",		IPTOS_PREC_NETCONTROL },
+ 		{ "reliability",	IPTOS_RELIABILITY },
+@@ -1741,7 +1812,7 @@ help(void)
+ 	\t-Z		Peer certificate file\n\
+ 	\t-z		Zero-I/O mode [used for scanning]\n\
+ 	Port numbers can be individual or ranges: lo-hi [inclusive]\n");
+-	exit(1);
++	exit(0);
+ }
+ 
+ void
+--- a/socks.c
++++ b/socks.c
+@@ -219,11 +219,11 @@ socks_connect(const char *host, const ch
+ 		buf[2] = SOCKS_NOAUTH;
+ 		cnt = atomicio(vwrite, proxyfd, buf, 3);
+ 		if (cnt != 3)
+-			err(1, "write failed (%zu/3)", cnt);
++			err(1, "write failed (%zu/3)", (size_t)cnt);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 2);
+ 		if (cnt != 2)
+-			err(1, "read failed (%zu/3)", cnt);
++			err(1, "read failed (%zu/3)", (size_t)cnt);
+ 
+ 		if (buf[1] == SOCKS_NOMETHOD)
+ 			errx(1, "authentication method negotiation failed");
+@@ -272,11 +272,11 @@ socks_connect(const char *host, const ch
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ 		if (cnt != wlen)
+-			err(1, "write failed (%zu/%zu)", cnt, wlen);
++			err(1, "write failed (%zu/%zu)", (size_t)cnt, (size_t)wlen);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 4);
+ 		if (cnt != 4)
+-			err(1, "read failed (%zu/4)", cnt);
++			err(1, "read failed (%zu/4)", (size_t)cnt);
+ 		if (buf[1] != 0) {
+ 			errx(1, "connection failed, SOCKSv5 error: %s",
+ 			    socks5_strerror(buf[1]));
+@@ -285,12 +285,12 @@ socks_connect(const char *host, const ch
+ 		case SOCKS_IPV4:
+ 			cnt = atomicio(read, proxyfd, buf + 4, 6);
+ 			if (cnt != 6)
+-				err(1, "read failed (%zu/6)", cnt);
++				err(1, "read failed (%zu/6)", (size_t)cnt);
+ 			break;
+ 		case SOCKS_IPV6:
+ 			cnt = atomicio(read, proxyfd, buf + 4, 18);
+ 			if (cnt != 18)
+-				err(1, "read failed (%zu/18)", cnt);
++				err(1, "read failed (%zu/18)", (size_t)cnt);
+ 			break;
+ 		default:
+ 			errx(1, "connection failed, unsupported address type");
+@@ -310,11 +310,11 @@ socks_connect(const char *host, const ch
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, wlen);
+ 		if (cnt != wlen)
+-			err(1, "write failed (%zu/%zu)", cnt, wlen);
++			err(1, "write failed (%zu/%zu)", (size_t)cnt, (size_t)wlen);
+ 
+ 		cnt = atomicio(read, proxyfd, buf, 8);
+ 		if (cnt != 8)
+-			err(1, "read failed (%zu/8)", cnt);
++			err(1, "read failed (%zu/8)", (size_t)cnt);
+ 		if (buf[1] != 90) {
+ 			errx(1, "connection failed, SOCKSv4 error: %s",
+ 			    socks4_strerror(buf[1]));
+@@ -328,39 +328,39 @@ socks_connect(const char *host, const ch
+ 
+ 		/* Try to be sane about numeric IPv6 addresses */
+ 		if (strchr(host, ':') != NULL) {
+-			r = snprintf(buf, sizeof(buf),
++			r = snprintf((char*)buf, sizeof(buf),
+ 			    "CONNECT [%s]:%d HTTP/1.0\r\n",
+ 			    host, ntohs(serverport));
+ 		} else {
+-			r = snprintf(buf, sizeof(buf),
++			r = snprintf((char*)buf, sizeof(buf),
+ 			    "CONNECT %s:%d HTTP/1.0\r\n",
+ 			    host, ntohs(serverport));
+ 		}
+ 		if (r == -1 || (size_t)r >= sizeof(buf))
+ 			errx(1, "hostname too long");
+-		r = strlen(buf);
++		r = strlen((char*)buf);
+ 
+ 		cnt = atomicio(vwrite, proxyfd, buf, r);
+ 		if (cnt != r)
+-			err(1, "write failed (%zu/%d)", cnt, r);
++			err(1, "write failed (%zu/%d)", (size_t)cnt, (int)r);
+ 
+ 		if (authretry > 1) {
+ 			char resp[1024];
+ 
+ 			proxypass = getproxypass(proxyuser, proxyhost);
+-			r = snprintf(buf, sizeof(buf), "%s:%s",
++			r = snprintf((char*)buf, sizeof(buf), "%s:%s",
+ 			    proxyuser, proxypass);
+ 			if (r == -1 || (size_t)r >= sizeof(buf) ||
+-			    b64_ntop(buf, strlen(buf), resp,
++			    b64_ntop(buf, strlen((char*)buf), resp,
+ 			    sizeof(resp)) == -1)
+ 				errx(1, "Proxy username/password too long");
+-			r = snprintf(buf, sizeof(buf), "Proxy-Authorization: "
++			r = snprintf((char*)buf, sizeof(buf), "Proxy-Authorization: "
+ 			    "Basic %s\r\n", resp);
+ 			if (r == -1 || (size_t)r >= sizeof(buf))
+ 				errx(1, "Proxy auth response too long");
+-			r = strlen(buf);
++			r = strlen((char*)buf);
+ 			if ((cnt = atomicio(vwrite, proxyfd, buf, r)) != r)
+-				err(1, "write failed (%zu/%d)", cnt, r);
++				err(1, "write failed (%zu/%d)", (size_t)cnt, r);
+ 		}
+ 
+ 		/* Terminate headers */
+@@ -368,22 +368,22 @@ socks_connect(const char *host, const ch
+ 			err(1, "write failed (%zu/2)", cnt);
+ 
+ 		/* Read status reply */
+-		proxy_read_line(proxyfd, buf, sizeof(buf));
++		proxy_read_line(proxyfd, (char*)buf, sizeof(buf));
+ 		if (proxyuser != NULL &&
+-		    strncmp(buf, "HTTP/1.0 407 ", 12) == 0) {
++		    strncmp((char*)buf, "HTTP/1.0 407 ", 12) == 0) {
+ 			if (authretry > 1) {
+ 				fprintf(stderr, "Proxy authentication "
+ 				    "failed\n");
+ 			}
+ 			close(proxyfd);
+ 			goto again;
+-		} else if (strncmp(buf, "HTTP/1.0 200 ", 12) != 0 &&
+-		    strncmp(buf, "HTTP/1.1 200 ", 12) != 0)
++		} else if (strncmp((char*)buf, "HTTP/1.0 200 ", 12) != 0 &&
++		    strncmp((char*)buf, "HTTP/1.1 200 ", 12) != 0)
+ 			errx(1, "Proxy error: \"%s\"", buf);
+ 
+ 		/* Headers continue until we hit an empty line */
+ 		for (r = 0; r < HTTP_MAXHDRS; r++) {
+-			proxy_read_line(proxyfd, buf, sizeof(buf));
++			proxy_read_line(proxyfd, (char*)buf, sizeof(buf));
+ 			if (*buf == '\0')
+ 				break;
+ 		}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/CoreSymbolication/default.nix b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
new file mode 100644
index 000000000000..aa73c7f86c40
--- /dev/null
+++ b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
@@ -0,0 +1,19 @@
+{ fetchFromGitHub, stdenv }:
+
+# Reverse engineered CoreSymbolication to make dtrace buildable
+
+stdenv.mkDerivation rec {
+  name = "CoreSymbolication";
+
+  src = fetchFromGitHub {
+    repo = name;
+    owner = "matthewbauer";
+    rev = "671fcb66c82eac1827f3f53dc4cc4e9b1b94da0a";
+    sha256 = "0qpw46gwgjxiwqqjxksb8yghp2q8dwad6hzaf4zl82xpvk9n5ahj";
+  };
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp -r CoreSymbolication $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 5a58410ae926..7f6f0cdd0c48 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -210,6 +210,13 @@ in rec {
       ];
     });
 
+    CoreMIDI = stdenv.lib.overrideDerivation super.CoreMIDI (drv: {
+      __propagatedImpureHostDeps = drv.__propagatedImpureHostDeps ++ [
+        "/System/Library/PrivateFrameworks/"
+      ];
+      setupHook = ./private-frameworks-setup-hook.sh;
+    });
+
     Security = stdenv.lib.overrideDerivation super.Security (drv: {
       setupHook = ./security-setup-hook.sh;
     });
diff --git a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
new file mode 100644
index 000000000000..fbd977f8552d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
@@ -0,0 +1,8 @@
+addPrivateFrameworks() {
+    flag="-F/System/Library/PrivateFrameworks"
+    if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+        NIX_CFLAGS_COMPILE+=" $flag"
+    fi
+}
+
+addEnvHooks "$hostOffset" addPrivateFrameworks
diff --git a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
new file mode 100644
index 000000000000..1cb85b1e9884
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, appleDerivation, xcbuild, gnumake, Security
+, libsecurity_utilities, libsecurity_cdsa_utilities }:
+
+appleDerivation {
+  buildInputs = [ xcbuild libsecurity_utilities libsecurity_cdsa_utilities ];
+
+  DSTROOT = "$out";
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  preBuild = ''
+    mkdir -p Security
+    cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
+  '';
+
+  patchPhase = ''
+    substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
+      --replace "/usr/bin/gnumake" "${gnumake}/bin/make"
+    substituteInPlace src/PCSC/PCSC.exp \
+      --replace _PCSCVersionString "" \
+      --replace _PCSCVersionNumber ""
+    substituteInPlace Makefile.installPhase \
+      --replace chown "# chown" \
+      --replace /usr/bin/ ""
+  '';
+
+  installPhase = ''
+    make -f Makefile.installPhase install
+    make -f Makefile-exec.installPhase install
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir -p $out/Library/Frameworks
+    cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
index a3d4099399b3..dcfb4aefe1f5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
@@ -27,14 +27,14 @@ appleDerivation {
                 | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
 
     for i in $targets; do
-      xcodebuild -target $i
+      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
     done
   '';
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install adv_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1 8; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 9e8b78e57d6c..b52ec3306dc4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -14,7 +14,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install basic_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index cca729016c25..3120d8ae3d10 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -7,6 +7,7 @@ let
   # now it's staying here.
   versions = {
     "osx-10.11.6" = {
+      SmartCardServices = "55111";
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
@@ -43,6 +44,9 @@ let
       file_cmds     = "264.1.1";
       shell_cmds    = "187";
       system_cmds   = "550.6";
+      diskdev_cmds   = "593";
+      top           = "108";
+      text_cmds     = "99";
     };
     "osx-10.11.5" = {
       Libc          = "1082.50.1"; # 10.11.6 still unreleased :/
@@ -53,6 +57,7 @@ let
       ICU           = "531.48";
       libdispatch   = "442.1.4";
       Security      = "57031.40.6";
+      security_systemkeychain = "55202";
 
       IOAudioFamily                        = "203.3";
       IOFireWireFamily                     = "458";
@@ -191,6 +196,8 @@ let
   adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
 
   packages = {
+    SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
+
     inherit (adv_cmds) ps locale;
     architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
     bootstrap_cmds  = applePackage "bootstrap_cmds"    "dev-tools-7.0"   "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
@@ -201,7 +208,8 @@ let
     configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
     copyfile        = applePackage "copyfile"          "osx-10.11.6"     "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "0pp5x8dgvzmg9vvg32hpy2brm17dpmbwrcr4prsmdmfvd4767wc0" {};
+    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dtrace-xcode    = applePackage "dtrace/xcode.nix"  "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
     dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
     ICU             = applePackage "ICU"               "osx-10.10.5"     "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
@@ -238,10 +246,15 @@ let
     adv_cmds        = applePackage "adv_cmds/xcode.nix" "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
+    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
     network_cmds    = applePackage "network_cmds"      "osx-10.11.6"     "0lhi9wz84qr1r2ab3fb4nvmdg9gxn817n5ldg7zw9gnf3wwn42kw" {};
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "1zfxbmasps529pnfdjvc13p7ws2cfx8pidkplypkswyff0nff4wp" {};
     shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
     system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "1h46j2c5v02pkv5d9fyv6cpgyg0lczvwicrx6r9s210cl03l77jl" {};
+    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "1f93m7dd0ghqb2hwh905mjhzblyfr7dwffw98xhgmv1mfdnigxg0" {};
+    top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
+
+    security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
 
     libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
     libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 67fbf83496ed..1f35e3008b3b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -11,7 +11,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install developer_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
new file mode 100644
index 000000000000..aba2472af602
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, appleDerivation, xcbuild, lib, hostPlatform, Libc, xnu, libutil-new }:
+
+appleDerivation {
+  buildInputs = [ xcbuild libutil-new ];
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  NIX_LDFLAGS = "-lutil";
+  patchPhase = ''
+    # ugly hacks for missing headers
+    # most are bsd related - probably should make this a drv
+    unpackFile ${Libc.src}
+    unpackFile ${xnu.src}
+    mkdir System sys machine i386
+    cp xnu-*/bsd/sys/disklabel.h sys
+    cp xnu-*/bsd/machine/disklabel.h machine
+    cp xnu-*/bsd/i386/disklabel.h i386
+    cp -r xnu-*/bsd/sys System
+    cp -r Libc-*/uuid System
+  '';
+  installPhase = ''
+    install -D Products/Release/libdisk.a $out/lib/libdisk.a
+    rm Products/Release/libdisk.a
+    for bin in Products/Release/*; do
+      install -D $bin $out/bin/$(basename $bin)
+    done
+  '';
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
new file mode 100644
index 000000000000..dd193f2c07dc
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
@@ -0,0 +1,45 @@
+{ appleDerivation, xcbuild, CoreSymbolication, xnu, bison, flex, darling, stdenv }:
+
+appleDerivation {
+  buildInputs = [ xcbuild CoreSymbolication xnu bison flex darling ];
+  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
+  NIX_LDFLAGS = "-L./Products/Release";
+  xcbuildFlags = "-target dtrace";
+
+  patchPhase = ''
+    substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
+    substituteInPlace libdtrace/dt_open.c \
+      --replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
+      --replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
+      --replace "/usr/bin/dtrace" $out/lib/dtrace
+  '';
+
+  # hack to handle xcbuild's broken lex handling
+  preBuild = ''
+    cd libdtrace
+    yacc -d dt_grammar.y
+    flex -l -d dt_lex.l
+    cd ..
+
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
+      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+  '';
+
+  # xcbuild doesn't support install
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r Products/Release/usr $out
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir $out/lib
+    cp Products/Release/*.dylib $out/lib
+
+    mkdir $out/bin
+    cp Products/Release/dtrace $out/bin
+
+    mkdir -p $out/lib/dtrace
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index 8346ca7a9a76..47a587966b44 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -19,7 +19,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install file_cmds-*/Build/Products/Release/* $out/bin
+    install Products/Release/* $out/bin
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
index 13b6156492bb..d9b3dfb74049 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
@@ -14,6 +14,8 @@ appleDerivation {
       -Wl,-reexport_library -Wl,$out/lib/libcharset.dylib
   '';
 
+  setup-hook = ../../../../development/libraries/libiconv/setup-hook.sh;
+
   meta = {
     platforms = stdenv.lib.platforms.darwin;
   };
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
index 083a8a85d17d..166b4e631c84 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
@@ -5,6 +5,7 @@ LIBRARY_NAME = security_apple_x509_tp
 security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
 security_apple_x509_tp_HEADER_FILES_DIR = lib
 
+security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
 security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
 
 include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
index c5ba9cc8d7ef..2a05855bd521 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -1,7 +1,33 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
+, Security, xnu, xar, antlr, libsecurityd, apple_sdk
+, dtrace-xcode, osx_private_sdk }:
 appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-  ];
-}
\ No newline at end of file
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
+                  Security xar antlr libsecurityd ];
+  NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
+  patchPhase = ''
+    substituteInPlace lib/policydb.cpp \
+      --replace "new MutableDictionary::MutableDictionary()" NULL
+    substituteInPlace lib/xpcengine.h \
+      --replace "#include <xpc/private.h>" ""
+    substituteInPlace lib/policyengine.cpp \
+      --replace "#include <OpenScriptingUtilPriv.h>" ""
+
+    rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
+  '';
+  preBuild = ''
+    mkdir -p include
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
+    mkdir -p include/CoreServices/
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
+
+    unpackFile ${Security.src}
+    mkdir -p include/securityd_client
+    cp Security-*/libsecurityd/lib/*.h include/securityd_client
+    mkdir -p include/xpc
+    cp ${apple_sdk.sdk}/include/xpc/*.h include/xpc
+
+    sed -i '1i #define bool int' lib/security_codesigning.d
+    dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
index bb55fd48d8b2..e811c4c11a82 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -4,9 +4,12 @@ appleDerivation {
     libauto
     libobjc
     IOKit
+  ];
+  propagatedBuildInputs = [
     sqlite
     apple_sdk.frameworks.PCSC
   ];
+  NIX_LDFLAGS = "-framework PCSC";
   patchPhase = ''
     substituteInPlace lib/errors.h --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
index 860a74f61f7f..7facea2b8936 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
@@ -4,22 +4,18 @@
 appleDerivation {
   buildInputs = [ xcbuild ];
 
-  dontUseXcbuild = true;
-
   prePatch = ''
     substituteInPlace tzlink.c \
       --replace '#include <xpc/xpc.h>' ""
   '';
 
-  buildPhase = ''
-    xcodebuild -target util
-  '';
+  xcbuildFlags = "-target util";
 
   installPhase = ''
     mkdir -p $out/lib $out/include
 
-    cp libutil-*/Build/Products/Release/*.dylib $out/lib
-    cp libutil-*/Build/Products/Release/*.h $out/include
+    cp Products/Release/*.dylib $out/lib
+    cp Products/Release/*.h $out/include
 
     # TODO: figure out how to get this to be right the first time around
     install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index dc7edface9a0..23777c941576 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -19,7 +19,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install network_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1 5; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
new file mode 100644
index 000000000000..1a0208ef3a08
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
@@ -0,0 +1,31 @@
+{ appleDerivation, xcbuild, Security
+, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
+, xnu, osx_private_sdk, pcsclite}:
+
+appleDerivation {
+  buildInputs = [ xcbuild Security libsecurity_utilities
+                  libsecurity_cdsa_utilities libsecurity_codesigning
+                  pcsclite ];
+
+  NIX_LDFLAGS = "-lpcsclite";
+
+  # can't build the whole thing
+  xcbuildFlags = "-target codesign";
+
+  preBuild = ''
+    mkdir -p include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
+
+    unpackFile ${xnu.src}
+    mkdir -p include/sys
+    cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Iinclude";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp Products/Release/codesign $out/bin/codesign
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index 4f527acc950c..8ce916feb38a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -29,7 +29,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/usr/bin
-    install shell_cmds-*/Build/Products/Release/* $out/usr/bin
+    install Products/Release/* $out/usr/bin
 
     export DSTROOT=$out
     export SRCROOT=$PWD
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 2247ef3ddd2f..1bbda6ab7add 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -1,37 +1,104 @@
-{ stdenv, appleDerivation, xcbuild }:
+{ stdenv, appleDerivation, xcbuild, lib, hostPlatform
+, Librpcsvc, apple_sdk, pam, CF, openbsm }:
 
 appleDerivation rec {
   # xcbuild fails with:
   # /nix/store/fc0rz62dh8vr648qi7hnqyik6zi5sqx8-xcbuild-wrapper/nix-support/setup-hook: line 1:  9083 Segmentation fault: 11  xcodebuild OTHER_CFLAGS="$NIX_CFLAGS_COMPILE" OTHER_CPLUSPLUSFLAGS="$NIX_CFLAGS_COMPILE" OTHER_LDFLAGS="$NIX_LDFLAGS" build
+  # see issue facebook/xcbuild#188
   # buildInputs = [ xcbuild ];
 
-  # # temporary install phase until xcodebuild has "install" support
-  # installPhase = ''
-  #   mkdir -p $out/bin/
-  #   install system_cmds-*/Build/Products/Release/* $out/bin/
-
-  #   for n in 1 5 8; do
-  #     mkdir -p $out/share/man/man$n
-  #     install */*.$n $out/share/man/man$n
-  #   done
-  # '';
-
-  # For now we just build sysctl because that's all I need... Please open a
-  # PR if you need any other utils before we fix the xcodebuild.
-  buildPhase = "cc sysctl.tproj/sysctl.c -o sysctl";
-
-  installPhase =
-    ''
-      mkdir -p $out/bin
-      install sysctl $out/bin
-      for n in 5 8; do
-        mkdir -p $out/share/man/man$n
-        install sysctl.tproj/*.$n $out/share/man/man$n
+  buildInputs = [ Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
+                  apple_sdk.frameworks.IOKit openbsm ];
+  # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
+  #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
+  #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
+  NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
+                         "-DDAEMON_GID=1"
+                         "-DDEFAULT_AT_QUEUE=\'a\'"
+                         "-DDEFAULT_BATCH_QUEUE=\'b\'"
+                         "-DPERM_PATH=\"/usr/lib/cron/\""
+                         "-DOPEN_DIRECTORY"
+                         "-DNO_DIRECT_RPC"
+                         "-DAPPLE_GETCONF_UNDERSCORE"
+                         "-DAPPLE_GETCONF_SPEC"
+                         "-DUSE_PAM"
+                         "-DUSE_BSM_AUDIT"
+                         "-D_PW_NAME_LEN=MAXLOGNAME"
+                         "-D_PW_YPTOKEN=\"__YP!\""
+                         "-DAHZV1=64 "
+                         "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
+                         "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+
+  patchPhase = ''
+    substituteInPlace login.tproj/login.c \
+      --replace bsm/audit_session.h bsm/audit.h
+    substituteInPlace login.tproj/login_audit.c \
+      --replace bsm/audit_session.h bsm/audit.h
+  '';
+
+  buildPhase = ''
+    for dir in *.tproj; do
+      name=$(basename $dir)
+      name=''${name%.tproj}
+
+      CFLAGS=""
+      case $name in
+           arch) CFLAGS="-framework CoreFoundation";;
+           atrun) CFLAGS="-Iat.tproj";;
+           chkpasswd)
+             CFLAGS="-framework OpenDirectory -framework CoreFoundation -lpam";;
+           getconf)
+               for f in getconf.tproj/*.gperf; do
+                   cfile=''${f%.gperf}.c
+                   LC_ALL=C awk -f getconf.tproj/fake-gperf.awk $f > $cfile
+               done
+           ;;
+           iostat) CFLAGS="-framework IOKit -framework CoreFoundation";;
+           login) CFLAGS="-lbsm -lpam";;
+           nvram) CFLAGS="-framework CoreFoundation -framework IOKit";;
+           sadc) CFLAGS="-framework IOKit -framework CoreFoundation";;
+           sar) CFLAGS="-Isadc.tproj";;
+      esac
+
+      echo "Building $name"
+
+      case $name in
+
+           # These are all broken currently.
+           arch) continue;;
+           chpass) continue;;
+           dirhelper) continue;;
+           dynamic_pager) continue;;
+           fs_usage) continue;;
+           latency) continue;;
+           pagesize) continue;;
+           passwd) continue;;
+           reboot) continue;;
+           sc_usage) continue;;
+           shutdown) continue;;
+           trace) continue;;
+
+           *) cc $dir/*.c -I''${dir} $CFLAGS -o $name ;;
+      esac
+    done
+  '';
+
+  installPhase = ''
+    for dir in *.tproj; do
+      name=$(basename $dir)
+      name=''${name%.tproj}
+      [ -x $name ] && install -D $name $out/bin/$name
+      for n in 1 2 3 4 5 6 7 8 9; do
+        for f in $dir/*.$n; do
+          install -D $f $out/share/man/man$n/$(basename $f)
+        done
       done
-    '';
+    done
+  '';
 
   meta = {
     platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ shlevy ];
+    maintainers = with stdenv.lib.maintainers; [ shlevy matthewbauer ];
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
new file mode 100644
index 000000000000..196276b0b273
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, appleDerivation, fetchurl, xcbuild, ncurses, bzip2, zlib, lzma }:
+
+appleDerivation {
+  buildInputs = [ xcbuild ncurses bzip2 zlib lzma ];
+
+  # patches to use ncursees
+  # disables md5
+  patchPhase = ''
+    substituteInPlace text_cmds.xcodeproj/project.pbxproj \
+		  --replace 'FC6C98FB149A94EB00DDCC47 /* libcurses.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libcurses.dylib; path = /usr/lib/libcurses.dylib; sourceTree = "<absolute>"; };' 'FC6C98FB149A94EB00DDCC47 /* libncurses.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libncurses.dylib; path = /usr/lib/libncurses.dylib; sourceTree = "<absolute>"; };' \
+      --replace 'FC7A7EB5149875E00086576A /* PBXTargetDependency */,' ""
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    for f in Products/Release/*; do
+      install -D $f $out/bin/$(basename $f)
+    done
+  '';
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
new file mode 100644
index 000000000000..4ddec2a30c90
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -0,0 +1,15 @@
+{xcbuild, appleDerivation, apple_sdk, ncurses, libutil-new, lib}:
+
+appleDerivation {
+  buildInputs = [ xcbuild apple_sdk.frameworks.IOKit ncurses libutil-new ];
+  NIX_LDFLAGS = "-lutil";
+  installPhase = ''
+    install -D Products/Release/libtop.a $out/lib/libtop.a
+    install -D Products/Release/libtop.h $out/include/libtop.h
+    install -D Products/Release/top $out/bin/top
+  '';
+  meta = {
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 1fff4915da3c..21d64979d7ea 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, binutils-raw, cctools
+{ stdenv, binutils-unwrapped, cctools
 , hostPlatform, targetPlatform
 }:
 
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same targetPrefix.
-assert binutils-raw.targetPrefix == cctools.targetPrefix;
+assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
 
 let
-  inherit (binutils-raw) targetPrefix;
+  inherit (binutils-unwrapped) targetPrefix;
   cmds = [
     "ar" "ranlib" "as" "dsymutil" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-raw.bintools.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
+    ln -s ${binutils-unwrapped.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
 
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
@@ -38,15 +38,15 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
-    ln -s ${binutils-raw.bintools.out}/share $out/share
+    ln -s ${binutils-unwrapped.out}/share $out/share
 
     ln -s ${cctools}/libexec $out/libexec
 
     mkdir -p "$info/nix-support" "$man/nix-support"
-    printWords ${binutils-raw.bintools.info} \
+    printWords ${binutils-unwrapped.info} \
       >> $info/nix-support/propagated-build-inputs
     # FIXME: cctools missing man pages
-    printWords ${binutils-raw.bintools.man} \
+    printWords ${binutils-unwrapped.man} \
       >> $man/nix-support/propagated-build-inputs
   '';
 
diff --git a/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch b/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch
new file mode 100644
index 000000000000..9aae2be1d033
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch
@@ -0,0 +1,98 @@
+diff --git a/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp b/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
+index 09c0e12..ac6b085 100644
+--- a/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
++++ b/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
+@@ -187,6 +187,7 @@ struct DynamicLibrary {
+ 	ld::File::ObjcConstraint _objcConstraint;
+ 	Options::Platform _platform;
+ 	std::vector<Token> _allowedClients;
++	std::vector<Token> _allowableClients;
+ 	std::vector<Token> _reexportedLibraries;
+ 	std::vector<Token> _symbols;
+ 	std::vector<Token> _classes;
+@@ -246,6 +247,14 @@ class TBDFile {
+ 		});
+ 	}
+ 
++	void parseAllowableClients(DynamicLibrary& lib) {
++		if ( !hasOptionalToken("allowable-clients") )
++			return;
++		parseFlowSequence([&](Token name) {
++			lib._allowableClients.emplace_back(name);
++		});
++	}
++
+ 	void parseReexportedDylibs(DynamicLibrary& lib) {
+ 		if ( !hasOptionalToken("re-exports") )
+ 			return;
+@@ -306,6 +315,21 @@ class TBDFile {
+ 		return false;
+ 	}
+ 
++	void skipUUIDs(DynamicLibrary& lib) {
++		expectToken("uuids");
++		while ( true ) {
++			auto token = next();
++			if ( token == "]" )
++				break;
++		}
++	}
++
++	void skipParentUmbrella(DynamicLibrary& lib) {
++		if (!hasOptionalToken("parent-umbrella"))
++			return;
++		next();
++	}
++
+ 	void parsePlatform(DynamicLibrary& lib) {
+ 		expectToken("platform");
+ 
+@@ -410,6 +434,7 @@ class TBDFile {
+ 			}
+ 
+ 			parseAllowedClients(lib);
++			parseAllowableClients(lib);
+ 			parseReexportedDylibs(lib);
+ 			parseSymbols(lib);
+ 			if ( !hasOptionalToken("-") )
+@@ -455,17 +480,21 @@ class TBDFile {
+ 			return result.front();
+ 	}
+ 
+-	void parseDocument(DynamicLibrary& lib, std::string &requestedArchName) {
++	void parseDocument(DynamicLibrary& lib, std::string &requestedArchName, bool isTbdV2) {
+ 		auto selectedArchName = parseAndSelectArchitecture(requestedArchName);
+ 		if (selectedArchName.empty())
+ 			throwf("invalid arch");
+ 
++		if(isTbdV2)
++			skipUUIDs(lib);
+ 		parsePlatform(lib);
+ 		parseInstallName(lib);
+ 		parseCurrentVersion(lib);
+ 		parseCompatibilityVersion(lib);
+ 		parseSwiftVersion(lib);
+ 		parseObjCConstraint(lib);
++		if(isTbdV2)
++			skipParentUmbrella(lib);
+ 		parseExportsBlock(lib, selectedArchName);
+ 	}
+ 
+@@ -476,7 +505,8 @@ public:
+ 		_tokenizer.reset();
+ 		DynamicLibrary lib;
+ 		expectToken("---");
+-		parseDocument(lib, requestedArchName);
++		auto isTbdV2 = hasOptionalToken("!tapi-tbd-v2");
++		parseDocument(lib, requestedArchName, isTbdV2);
+ 		expectToken("...");
+ 		return lib;
+ 	}
+@@ -486,6 +516,7 @@ public:
+ 		auto token = next();
+ 		if ( token != "---" )
+ 			return false;
++		hasOptionalToken("!tapi-tbd-v2");
+ 		return !parseAndSelectArchitecture(requestedArchName).empty();
+ 	}
+ 
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index bcca11d66b19..d8abdc2c6f84 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -1,10 +1,19 @@
-{ stdenv, fetchFromGitHub, makeWrapper, autoconf, automake, libtool_2
+{ stdenv, fetchFromGitHub, makeWrapper, autoconf, automake, libtool_2, autoreconfHook
 , llvm, libcxx, libcxxabi, clang, libuuid
 , libobjc ? null, maloader ? null, xctoolchain ? null
 , hostPlatform, targetPlatform
+, enableDumpNormalizedLibArgs ? false
 }:
 
 let
+
+  # We need to use an old version of cctools-port to support linking TBD files
+  # in the iOS SDK. Note that this only provides support for SDK versions up to
+  # 10.x. For 11.0 and higher we will need to upgrade to a newer cctools than the
+  # default version here, which can support the new TBD format via Apple's
+  # libtapi.
+  useOld = targetPlatform.isiOS;
+
   # The targetPrefix prepended to binary names to allow multiple binuntils on the
   # PATH to both be usable.
   targetPrefix = stdenv.lib.optionalString
@@ -12,26 +21,41 @@ let
     "${targetPlatform.config}-";
 in
 
-assert targetPlatform.isDarwin;
-
 # Non-Darwin alternatives
 assert (!hostPlatform.isDarwin) -> (maloader != null && xctoolchain != null);
 
+assert enableDumpNormalizedLibArgs -> (!useOld);
+
 let
   baseParams = rec {
     name = "${targetPrefix}cctools-port-${version}";
-    version = "895";
+    version = if useOld then "886" else "895";
 
-    src = fetchFromGitHub {
+    src = fetchFromGitHub (if enableDumpNormalizedLibArgs then {
+      owner  = "tpoechtrager";
+      repo   = "cctools-port";
+      # master with https://github.com/tpoechtrager/cctools-port/pull/34
+      rev    = "8395d4b2c3350356e2fb02f5e04f4f463c7388df";
+      sha256 = "10vbf1cfzx02q8chc77s84fp2kydjpx2y682mr6mrbb7sq5rwh8f";
+    } else if useOld then {
+      owner  = "tpoechtrager";
+      repo   = "cctools-port";
+      rev    = "02f0b8ecd87a3951653d838a321ae744815e21a5";
+      sha256 = "0bzyabzr5dvbxglr74d0kbrk2ij5x7s5qcamqi1v546q1had1wz1";
+    } else {
       owner  = "tpoechtrager";
       repo   = "cctools-port";
       rev    = "2e569d765440b8cd6414a695637617521aa2375b"; # From branch 895-ld64-274.2
       sha256 = "0l45mvyags56jfi24rawms8j2ihbc45mq7v13pkrrwppghqrdn52";
-    };
+    });
 
     outputs = [ "out" "dev" ];
 
-    nativeBuildInputs = [ autoconf automake libtool_2 ];
+    nativeBuildInputs = [
+      autoconf automake libtool_2
+    ] ++ stdenv.lib.optionals useOld [
+      autoreconfHook
+    ];
     buildInputs = [ libuuid ] ++
       # Only need llvm and clang if the stdenv isn't already clang-based (TODO: just make a stdenv.cc.isClang)
       stdenv.lib.optionals (!stdenv.isDarwin) [ llvm clang ] ++
@@ -39,9 +63,14 @@ let
 
     patches = [
       ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
+    ] ++ stdenv.lib.optionals useOld [
+      # See https://github.com/tpoechtrager/cctools-port/issues/24. Remove when that's fixed.
+      ./undo-unknown-triple.patch
+      ./ld-tbd-v2.patch
+      ./support-ios.patch
     ];
 
-    __propagatedImpureHostDeps = [
+    __propagatedImpureHostDeps = stdenv.lib.optionals (!useOld) [
       # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
       "/usr/lib/libobjc.A.dylib"
       "/usr/lib/libobjc.dylib"
@@ -81,12 +110,15 @@ let
       EOF
     '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
       sed -i -e 's|clang++|& -I${libcxx}/include/c++/v1|' cctools/autogen.sh
+    '' + stdenv.lib.optionalString useOld ''
+      cd cctools
     '';
 
     # TODO: this builds an ld without support for LLVM's LTO. We need to teach it, but that's rather
     # hairy to handle during bootstrap. Perhaps it could be optional?
-    preConfigure = ''
+    preConfigure = stdenv.lib.optionalString (!useOld) ''
       cd cctools
+    '' + ''
       sh autogen.sh
     '';
 
@@ -117,6 +149,7 @@ let
     };
 
     meta = {
+      broken = !targetPlatform.isDarwin; # Only supports darwin targets
       homepage = http://www.opensource.apple.com/source/cctools/;
       description = "MacOS Compiler Tools (cross-platform port)";
       license = stdenv.lib.licenses.apsl20;
diff --git a/pkgs/os-specific/darwin/cctools/support-ios.patch b/pkgs/os-specific/darwin/cctools/support-ios.patch
new file mode 100644
index 000000000000..f78c6b63ac80
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/support-ios.patch
@@ -0,0 +1,13 @@
+diff --git a/cctools/configure.ac b/cctools/configure.ac
+index 56e8f24..0b4b3ff 100644
+--- a/cctools/configure.ac
++++ b/cctools/configure.ac
+@@ -39,7 +39,7 @@ EXTRACXXFLAGS=""
+ WARNINGS=""
+ 
+ case $host_os in
+-  darwin* )
++  darwin* | ios*)
+     isdarwin=yes
+     AM_CONDITIONAL([ISDARWIN], [true])
+   ;;
diff --git a/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch b/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch
new file mode 100644
index 000000000000..7df9bdd16dab
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch
@@ -0,0 +1,17 @@
+diff --git a/cctools/as/driver.c b/cctools/as/driver.c
+index b06d085..c03397a 100644
+--- a/cctools/as/driver.c
++++ b/cctools/as/driver.c
+@@ -363,12 +363,6 @@ char **envp)
+ 	    /* Add -c or clang will run ld(1). */
+ 	    new_argv[j] = "-c";
+ 	    j++;
+-	    /* cctools-port start */
+-	    new_argv[j] = "-target";
+-	    j++;
+-	    new_argv[j] = "unknown-apple-darwin";
+-	    j++;
+-	    /* cctools-port end */
+ 	    new_argv[j] = NULL;
+ 	    if(execute(new_argv, verbose))
+ 		exit(0);
diff --git a/pkgs/os-specific/darwin/darling/default.nix b/pkgs/os-specific/darwin/darling/default.nix
new file mode 100644
index 000000000000..b9d806cded23
--- /dev/null
+++ b/pkgs/os-specific/darwin/darling/default.nix
@@ -0,0 +1,34 @@
+{stdenv, lib, fetchFromGitHub, cmake, bison, flex}:
+
+stdenv.mkDerivation rec {
+  pname = "darling";
+  name = pname;
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "darlinghq";
+    rev = "d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b";
+    sha256 = "1sdl0ysa3yfdvkq0x7vkdl64g7mcfy3qx70saf1d8rnhycbxjgjg";
+  };
+
+  # only packaging sandbox for now
+  buildPhase = ''
+    cc -c src/sandbox/sandbox.c -o src/sandbox/sandbox.o
+    cc -dynamiclib -flat_namespace src/sandbox/sandbox.o -o libsystem_sandbox.dylib
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp -rL src/sandbox/include/ $out/
+    cp libsystem_sandbox.dylib $out/lib/
+  '';
+
+  # buildInputs = [ cmake bison flex ];
+
+  meta = with lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    license = licenses.gpl3;
+    description = "Darwin/macOS emulation layer for Linux";
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/darwin/ios-cross/default.nix b/pkgs/os-specific/darwin/ios-cross/default.nix
deleted file mode 100644
index 175e9738ef9e..000000000000
--- a/pkgs/os-specific/darwin/ios-cross/default.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{ runCommand
-, lib
-, llvm
-, clang
-, binutils
-, stdenv
-, coreutils
-, gnugrep
-, buildPackages
-, hostPlatform
-, targetPlatform
-}:
-
-/* As of this writing, known-good prefix/arch/simulator triples:
- * aarch64-apple-darwin14 | arm64  | false
- * arm-apple-darwin10     | armv7  | false
- * i386-apple-darwin11    | i386   | true
- * x86_64-apple-darwin14  | x86_64 | true
- */
-
-# Apple uses somewhat non-standard names for this. We could fall back on
-# `targetPlatform.parsed.cpu.name`, but that would be a more standard one and
-# likely to fail. Better just to require something manual.
-assert targetPlatform ? arch;
-
-let
-
-  prefix = targetPlatform.config;
-  inherit (targetPlatform) arch;
-  simulator = targetPlatform.isiPhoneSimulator or false;
-
-  sdkType = if simulator then "Simulator" else "OS";
-
-  sdkVer = "10.2";
-
-  sdk = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${sdkVer}.sdk";
-
-in (import ../../../build-support/cc-wrapper {
-    inherit stdenv coreutils gnugrep runCommand buildPackages;
-    nativeTools = false;
-    nativeLibc = false;
-    inherit binutils;
-    libc = runCommand "empty-libc" {} "mkdir -p $out/{lib,include}";
-    inherit (clang) cc;
-    inherit hostPlatform targetPlatform;
-    extraBuildCommands = ''
-      if ! [ -d ${sdk} ]; then
-          echo "You must have ${sdkVer} of the iPhone${sdkType} sdk installed at ${sdk}" >&2
-          exit 1
-      fi
-      # ugh
-      tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
-      mv cc-cflags.tmp $out/nix-support/cc-cflags
-      echo "-target ${prefix} -arch ${arch} -idirafter ${sdk}/usr/include ${if simulator then "-mios-simulator-version-min=7.0" else "-miphoneos-version-min=7.0"}" >> $out/nix-support/cc-cflags
-
-      # Purposefully overwrite libc-ldflags-before, cctools ld doesn't know dynamic-linker and cc-wrapper doesn't do cross-compilation well enough to adjust
-      echo "-arch ${arch} -L${sdk}/usr/lib ${lib.optionalString simulator "-L${sdk}/usr/lib/system "}-i${if simulator then "os_simulator" else "phoneos"}_version_min 7.0.0" > $out/nix-support/libc-ldflags-before
-    '';
-  }) // {
-    inherit sdkType sdkVer sdk;
-  }
diff --git a/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix b/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix
new file mode 100644
index 000000000000..5b9f30b62c39
--- /dev/null
+++ b/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix
@@ -0,0 +1,68 @@
+{ lib, hostPlatform, targetPlatform
+, clang-unwrapped
+, binutils-unwrapped
+, runCommand
+, stdenv
+, wrapBintoolsWith
+, wrapCCWith
+, buildIosSdk, targetIosSdkPkgs
+}:
+
+let
+
+minSdkVersion = "9.0";
+
+iosPlatformArch = { parsed, ... }: {
+  "arm"     = "armv7";
+  "aarch64" = "arm64";
+  "x86_64"  = "x86_64";
+}.${parsed.cpu.name};
+
+in
+
+rec {
+  # TODO(kmicklas): Make a pure version of this for each supported SDK version.
+  sdk = rec {
+    name = "ios-sdk";
+    type = "derivation";
+    outPath = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${version}.sdk";
+
+    sdkType = if targetPlatform.isiPhoneSimulator then "Simulator" else "OS";
+    version = targetPlatform.sdkVer;
+  };
+
+  binutils = wrapBintoolsWith {
+    libc = targetIosSdkPkgs.libraries;
+    bintools = binutils-unwrapped;
+    extraBuildCommands = ''
+      echo "-arch ${iosPlatformArch targetPlatform}" >> $out/nix-support/libc-ldflags
+    '';
+  };
+
+  clang = (wrapCCWith {
+    cc = clang-unwrapped;
+    bintools = binutils;
+    libc = targetIosSdkPkgs.libraries;
+    extraBuildCommands = ''
+      tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
+      mv cc-cflags.tmp $out/nix-support/cc-cflags
+      echo "-target ${targetPlatform.config} -arch ${iosPlatformArch targetPlatform}" >> $out/nix-support/cc-cflags
+      echo "-isystem ${sdk}/usr/include -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++" >> $out/nix-support/cc-cflags
+      echo "${if targetPlatform.isiPhoneSimulator then "-mios-simulator-version-min" else "-miphoneos-version-min"}=${minSdkVersion}" >> $out/nix-support/cc-cflags
+    '';
+  }) // {
+    inherit sdk;
+  };
+
+  libraries = let sdk = buildIosSdk; in runCommand "libSystem-prebuilt" {
+    passthru = {
+      inherit sdk;
+    };
+  } ''
+    if ! [ -d ${sdk} ]; then
+        echo "You must have version ${sdk.version} of the iPhone${sdk.sdkType} sdk installed at ${sdk}" >&2
+        exit 1
+    fi
+    ln -s ${sdk}/usr $out
+  '';
+}
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
index 5f4306ec0c12..133266ec95aa 100644
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ b/pkgs/os-specific/darwin/maloader/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation {
     description = "Mach-O loader for Linux";
     homepage = https://github.com/shinh/maloader;
     license = stdenv.lib.licenses.bsd2;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/darwin/opencflite/default.nix b/pkgs/os-specific/darwin/opencflite/default.nix
index 09a346e4446d..960e0677da1e 100644
--- a/pkgs/os-specific/darwin/opencflite/default.nix
+++ b/pkgs/os-specific/darwin/opencflite/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0jgmzs0ycl930hmzcvx0ykryik56704yw62w394q1q3xw5kkjn9v";
   };
 
-  configureFlags = [ "--with-uuid=${libuuid}" ];
+  configureFlags = [ "--with-uuid=${libuuid.dev}" ];
   buildInputs = [ icu tzdata.dev ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/darwin/swift-corefoundation/default.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 969168fa54ba..969168fa54ba 100644
--- a/pkgs/os-specific/darwin/swift-corefoundation/default.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
diff --git a/pkgs/os-specific/darwin/swift-corelibs/default.nix b/pkgs/os-specific/darwin/swift-corelibs/default.nix
new file mode 100644
index 000000000000..fdc97304528d
--- /dev/null
+++ b/pkgs/os-specific/darwin/swift-corelibs/default.nix
@@ -0,0 +1,8 @@
+{callPackage, stdenv, darwin, xcbuild}:
+
+rec {
+  corefoundation = callPackage ./corefoundation.nix {};
+  libdispatch = callPackage ./libdispatch.nix {
+   inherit (darwin) apple_sdk_sierra xnu;
+  };
+}
diff --git a/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix b/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
new file mode 100644
index 000000000000..bd143b6071ba
--- /dev/null
+++ b/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
@@ -0,0 +1,12 @@
+{ stdenv, fetchFromGitHub, cmake, apple_sdk_sierra, xnu-new }:
+
+stdenv.mkDerivation rec {
+  name = "swift-corelibs-libdispatch";
+  src = fetchFromGitHub {
+    owner = "apple";
+    repo = name;
+    rev = "f83b5a498bad8e9ff8916183cf6e8ccf677c346b";
+    sha256 = "1czkyyc9llq2mnqfp19mzcfsxzas0y8zrk0gr5hg60acna6jkz2l";
+  };
+  buildInputs = [ cmake apple_sdk_sierra.sdk xnu-new ];
+}
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index c209cf6e3162..7a234b16c913 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "acpid-2.0.28";
+  name = "acpid-2.0.29";
 
   src = fetchurl {
     url = "mirror://sourceforge/acpid2/${name}.tar.xz";
-    sha256 = "043igasvp1l6nv5rzh4sksmymay2qn20anl4zm4zvwnkn1a3l34q";
+    sha256 = "1zq38al07z92r2md18zivrzgjqnn7m2wahdpgri6wijwjwkknl2q";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index 5b0d404faaf0..c2c612db5422 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.5";
+  name = "alsa-lib-1.1.6";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
      "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
     ];
-    sha256 = "1rhacnlj0grvfagjx5qzsnbhw7m7lyccghqs4jsv0dnsqv9qmxpl";
+    sha256 = "096pwrnhj36yndldvs2pj4r871zhcgisks0is78f1jkjn9sd4b2z";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix
index 0d02daebe1d7..5cd937a37928 100644
--- a/pkgs/os-specific/linux/alsa-oss/default.nix
+++ b/pkgs/os-specific/linux/alsa-oss/default.nix
@@ -1,14 +1,14 @@
 {stdenv, fetchurl, alsaLib, gettext, ncurses, libsamplerate}:
 
 stdenv.mkDerivation rec {
-  name = "alsa-oss-1.0.28";
+  name = "alsa-oss-1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/oss-lib/${name}.tar.bz2"
       "http://alsa.cybermirror.org/oss-lib/${name}.tar.bz2"
     ];
-    sha256 = "1mbabiywxjjlvdh257j3a0v4vvy69mwwnvc3xlq7pg50i2m2rris";
+    sha256 = "1sj512wyci5qv8cisps96xngh7y9r5mv18ybqnazy18zwr1zgly3";
   };
 
   buildInputs = [ alsaLib ncurses libsamplerate ];
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index dc11d21ff1cb..f57f84b293b5 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, lib, pkgconfig, alsaLib, libogg, libpulseaudio ? null, libjack2 ? null }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-plugins-1.1.5";
+  name = "alsa-plugins-1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2"
       "http://alsa.cybermirror.org/plugins/${name}.tar.bz2"
     ];
-    sha256 = "073zpgvj4pldmzqq97l40wngvbqnvrkc8yw153mgny9kypwaazbr";
+    sha256 = "04qcwkisbh0d6lnh0rw1k6n869fbs6zbfq6yvb41rymiwgmk27bg";
   };
 
   # ToDo: a52, etc.?
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
index d1cae06d7fff..67cae46164fc 100644
--- a/pkgs/os-specific/linux/alsa-tools/default.nix
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-tools-${version}";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2"
       "http://alsa.cybermirror.org/tools/${name}.tar.bz2"
     ];
-    sha256 = "0d6m5dm5yskfr6q42cv1ihp5lfgv4a67nj39gpp26ll3vrknag5w";
+    sha256 = "09rjb6hw1mn9y1jfdfj5djncgc2cr5wfps83k56rf6k4zg14v76n";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index a3c09c3de994..6828fbf6b1c9 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, elfutils, libGL
+{ stdenv, fetchurl, elfutils
 , xorg, patchelf, openssl, libdrm, libudev
 , libxcb, libxshmfence, epoxy, perl, zlib
 , fetchFromGitHub, ncurses
@@ -13,8 +13,6 @@ let
 
   kernelDir = if libsOnly then null else kernel.dev;
 
-  inherit (libGL) driverLink;
-
   bitness = if stdenv.is64bit then "64" else "32";
 
   libArch =
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 390bab849c28..7e14983a6d2b 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -6,11 +6,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "audit-2.8.2";
+  name = "audit-2.8.3";
 
   src = fetchurl {
     url = "http://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "1fmw8whraz1q3y3z5mgdpgsa3wz6r3zq0kgsgbc9xvmgfwmrpdb7";
+    sha256 = "06lacv9zjn0sf076dydwmvjhdmik3xzhdjvyrkq75917xv54ajbl";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 79e12dd0f437..859593e4b9aa 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, flex, bison, linuxHeaders, libtirpc, utillinux, nfs-utils, e2fsprogs
+{ stdenv, lib, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
 , libxml2, kerberos, kmod, openldap, sssd, cyrus_sasl, openssl }:
 
 let
@@ -17,10 +17,10 @@ in stdenv.mkDerivation {
     export sssldir="${sssd}/lib/sssd/modules"
     export HAVE_SSS_AUTOFS=1
 
-    export MOUNT=${utillinux}/bin/mount
+    export MOUNT=${mount}/bin/mount
     export MOUNT_NFS=${nfs-utils}/bin/mount.nfs
-    export UMOUNT=${utillinux}/bin/umount
-    export MODPROBE=${utillinux}/bin/modprobe
+    export UMOUNT=${umount}/bin/umount
+    export MODPROBE=${kmod}/bin/modprobe
     export E2FSCK=${e2fsprogs}/bin/fsck.ext2
     export E3FSCK=${e2fsprogs}/bin/fsck.ext3
     export E4FSCK=${e2fsprogs}/bin/fsck.ext4
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index ef1d51501e85..a1a2cff70a83 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2018.0";
+  ver = "2018.1";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1x7gy6agwk68s2cbhc4wfhvhdy2ccrq0vi7jzaj94pn8nqshi5ss";
+    sha256 = "0lxm0vb0w1gxyi5k553jgkpmhifc4cykzfybrsk8hvwilq6pv1r7";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/bluez/bluez5_28.nix b/pkgs/os-specific/linux/bluez/bluez5_28.nix
deleted file mode 100644
index 11aee0d88f2c..000000000000
--- a/pkgs/os-specific/linux/bluez/bluez5_28.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
-  pythonPackages, readline, libsndfile, udev, libical,
-  systemd, enableWiimote ? false }:
-
-assert stdenv.isLinux;
-
-let
-  inherit (pythonPackages) python;
-in stdenv.mkDerivation rec {
-  name = "bluez-5.28";
-   
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1a8qzh38wpq5c0rydpx9isf0jc6g14g2qs18j1rmi8a79f7v9fl5";
-  };
-
-  pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
-
-  buildInputs =
-    [ pkgconfig dbus glib alsaLib python pythonPackages.wrapPython
-      readline libsndfile udev libical
-      # Disables GStreamer; not clear what it gains us other than a
-      # zillion extra dependencies.
-      # gstreamer gst-plugins-base 
-    ];
-
-  preConfigure = ''
-      substituteInPlace tools/hid2hci.rules --replace /sbin/udevadm ${systemd}/bin/udevadm
-      substituteInPlace tools/hid2hci.rules --replace "hid2hci " "$out/lib/udev/hid2hci "
-    '';
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--enable-library"
-    "--enable-cups"
-    "--with-dbusconfdir=$(out)/etc"
-    "--with-dbussystembusdir=$(out)/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=$(out)/share/dbus-1/services"
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    "--with-systemduserunitdir=$(out)/etc/systemd/user"
-    "--with-udevdir=$(out)/lib/udev"
-    ] ++
-    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
-
-  # Work around `make install' trying to create /var/lib/bluetooth.
-  installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
-
-  makeFlags = "rulesdir=$(out)/lib/udev/rules.d";
-
-  # FIXME: Move these into a separate package to prevent Bluez from
-  # depending on Python etc.
-  postInstall = ''
-    mkdir $out/test
-    cp -a test $out
-    pushd $out/test
-    for a in \
-            simple-agent \
-            test-adapter \
-            test-device \
-            test-thermometer \
-            list-devices \
-            monitor-bluetooth \
-            ; do
-      ln -s ../test/$a $out/bin/bluez-$a
-    done
-    popd
-    wrapPythonProgramsIn $out/test "$out/test $pythonPath"
-
-    # for bluez4 compatibility for NixOS
-    mkdir $out/sbin
-    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
-    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = http://www.bluez.org/;
-    repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git;
-    description = "Bluetooth support for Linux";
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 62c3986569d0..d4595d73d942 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
   pythonPackages, readline, udev, libical,
-  systemd, enableWiimote ? false }:
+  systemd, enableWiimote ? false, enableMidi ? false }:
 
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.48";
+  name = "bluez-5.49";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
+    sha256 = "15ffsaz7l3fgdg03l7g1xx9jw7xgs6pc548zxqsxawsca5x1sc1k";
   };
 
   pythonPath = with pythonPackages;
@@ -40,8 +40,8 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-systemduserunitdir=$(out)/etc/systemd/user"
     "--with-udevdir=$(out)/lib/udev"
-    ] ++
-    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
+    ] ++ stdenv.lib.optional enableWiimote [ "--enable-wiimote" ]
+    ++ stdenv.lib.optional enableMidi [ "--enable-midi" ];
 
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index d4c4582ffb22..b844bf72d82a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -33,14 +33,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.28.1";
+  name = "busybox-1.28.3";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "0bk52cxxlya5hg9va87snr9caz9ppdrpdyjwrnbwamhi64y1vzlq";
+    sha256 = "0via6faqj9xcyi8r39r4n0wxlk8r2292yk0slzwrdri37w1j43dd";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index 1a879ba33304..1ef18f703d3f 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, file, findutils, binutils, glibc, procps, coreutils }:
+{ stdenv, fetchurl, file, findutils, binutils, glibc, procps, coreutils, sysctl }:
 
 stdenv.mkDerivation rec {
   name = "checksec-${version}";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/checksec --replace " readelf -" " ${binutils.out}/bin/readelf -"
     substituteInPlace $out/bin/checksec --replace "(readelf -" "(${binutils.out}/bin/readelf -"
     substituteInPlace $out/bin/checksec --replace "command_exists readelf" "command_exists ${binutils.out}/bin/readelf"
-    substituteInPlace $out/bin/checksec --replace "/sbin/sysctl -" "${procps}/sbin/sysctl -"
+    substituteInPlace $out/bin/checksec --replace "/sbin/sysctl -" "${sysctl}/bin/sysctl -"
     substituteInPlace $out/bin/checksec --replace "/usr/bin/id -" "${coreutils}/bin/id -"
   '';
 
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 67e4df3d6f9d..c57650e0806f 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "dbus-broker-${version}";
-  version = "11";
+  version = "13";
 
   src = fetchFromGitHub {
-    owner           = "bus1";
-    repo            = "dbus-broker";
-    rev             = "v${version}";
-    sha256          = "19sszb6ac7md494i996ixqmz9b3gim8rrv2nbrmlgjd59gk6hf7b";
+    owner  = "bus1";
+    repo   = "dbus-broker";
+    rev    = "v${version}";
+    sha256 = "1yjkxpnl54pky6ha3y8dsds57lnk10lmriyzpzy0ha2npng2614x";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index 56da5b0f16f4..0adeac7115df 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -6,13 +6,13 @@ assert lib.versionAtLeast kernel.version  "4.2" || lib.versionOlder kernel.versi
 
 stdenv.mkDerivation rec {
   name = "exfat-nofuse-${version}-${kernel.version}";
-  version = "2017-06-19";
+  version = "2018-04-16";
 
   src = fetchFromGitHub {
     owner = "dorimanx";
     repo = "exfat-nofuse";
-    rev = "de4c760bc9a05ead83bc3ec6eec6cf1fb106f523";
-    sha256 = "0v979d8sbcb70lakm4jal2ck3gspkdgq9108k127f7ph08vf8djm";
+    rev = "01c30ad52625a7261e1b0d874553b6ca7af25966";
+    sha256 = "0n1ibamf1yj8iqapc86lfscnky9p07ngsi4f2kpv3d5r2s6mzsh6";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
index 521b81cd690d..53895faa66cb 100644
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ b/pkgs/os-specific/linux/gogoclient/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, openssl, nettools, iproute, procps}:
+{stdenv, fetchurl, openssl, nettools, iproute, sysctl}:
 
 let baseName = "gogoclient";
     version  = "1.2";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       --replace "/sbin/ifconfig" "${nettools}/bin/ifconfig" \
       --replace "/sbin/route"    "${nettools}/bin/route" \
       --replace "/sbin/ip"       "${iproute}/sbin/ip" \
-      --replace "/sbin/sysctl"   "${procps}/sbin/sysctl"
+      --replace "/sbin/sysctl"   "${sysctl}/bin/sysctl"
     sed -i -e 's/^.*Exec \$route -A.*$/& metric 128/' $out/template/linux.sh
   '';
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 724242c588a1..15b3903ddd1a 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "hwdata-${version}";
-  version = "0.310";
+  version = "0.311";
 
   src = fetchurl {
-    url = "https://github.com/vcrhonek/hwdata/archive/v0.310.tar.gz";
-    sha256 = "08mhwwc9g9cpfyxrwwviflkdk2jnqs6hc95iv4r5d59hqrj5kida";
+    url = "https://github.com/vcrhonek/hwdata/archive/v0.311.tar.gz";
+    sha256 = "159av9wvl3biryxd5pgqcwz6wkdaa0ydmcysmzznx939mfv7w18z";
   };
 
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 269c59f5e6fe..7d412d7e15d0 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0mc3g4kj7h3jhwz2b2gdf41gp6bhqn7axh4mnyvhkdnpk5m63m28";
+    sha256 = "02pfalg319jpbjz273ph725br8dnkzpfvi98azi9yd6p1w128p0c";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 68692019ca96..d736caa535d4 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-6.36";
+  name = "ipset-6.38";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "03fk40v0rbiv2b9ciy3zk8yix163803xvpmdlyvrfzbcvj84l8i2";
+    sha256 = "0i72wcljl0nkpmzc20jcch3hpphrm0qp4v4j4ajamq0zlddn5vyf";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 3fc4f3b23774..d2eab02f6753 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -35,20 +35,21 @@ stdenv.mkDerivation rec {
   installPhase =
     ''
       mkdir -p $out/bin
-      cp -p ping tracepath clockdiff arping rdisc $out/bin/
+      cp -p ping tracepath clockdiff arping rdisc rarpd $out/bin/
       if [ -x ninfod/ninfod ]; then
         cp -p ninfod/ninfod $out/bin
       fi
 
       mkdir -p $out/share/man/man8
       cp -p \
-        doc/clockdiff.8 doc/arping.8 doc/ping.8 doc/rdisc.8 doc/tracepath.8 doc/ninfod.8 \
+        doc/clockdiff.8 doc/arping.8 doc/ping.8 doc/rdisc.8 doc/rarpd.8 doc/tracepath.8 doc/ninfod.8 \
         $out/share/man/man8
     '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/iputils/iputils;
     description = "A set of small useful utilities for Linux networking";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lheckemann ];
   };
 }
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index f4f870f16c3b..a1c577d2bb57 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -3,16 +3,17 @@
 let
   ell = fetchgit {
      url = https://git.kernel.org/pub/scm/libs/ell/ell.git;
-     rev = "8192131685be0f27d6f51b14b78ef93fa7f3c692";
-     sha256 = "1k74qz3w0l4zq8llrxc4p62xy0c0n33f260vy3d14wx5rhvf0544";
+     rev = "0.4";
+     sha256 = "0l203n1jnqa2mcifir8ydxhcvbiwlvk89ailm0lida83l9vdlwpv";
   };
 in stdenv.mkDerivation rec {
-  name = "iwd-unstable-2017-12-14";
+  name = "iwd-${version}";
+  version = "0.1";
 
   src = fetchgit {
     url = https://git.kernel.org/pub/scm/network/wireless/iwd.git;
-    rev = "cf3372235c4592ca7366b27548abc4e89a982414";
-    sha256 = "0dg28j919w1v8sqr6jdj12c233rsjzd2jzkcpag1hx2h3g35hnlz";
+    rev = version;
+    sha256 = "1f8c6xvcvqw8z78mskynd2fkghggcl7vfz8vxzvpx0fkqcprn5n0";
   };
 
   nativeBuildInputs = [
@@ -24,7 +25,7 @@ in stdenv.mkDerivation rec {
     readline
     python3Packages.python
   ];
-  
+
   pythonPath = [
     python3Packages.dbus-python
     python3Packages.pygobject3
@@ -33,7 +34,8 @@ in stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   configureFlags = [
-    "--with-dbusconfdir=$(out)/etc/"
+    "--with-dbus-datadir=$(out)/etc/"
+    "--disable-systemd-service"
   ];
 
   postUnpack = ''
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index d1e40371e370..bfade509fcac 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
       # We get a warning in armv5tel-linux and the fuloong2f, so we
       # disable -Werror in it.
-      ${stdenv.lib.optionalString (stdenv.isArm || stdenv.hostPlatform.isMips) ''
+      ${stdenv.lib.optionalString (stdenv.isAarch32 || stdenv.hostPlatform.isMips) ''
         sed -i s/-Werror// src/Makefile.am
       ''}
     '';
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2eb6b09b5994..4af5889fd1cd 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -115,7 +115,6 @@ with stdenv.lib;
   # Enable various subsystems.
   ACCESSIBILITY y # Accessibility support
   AUXDISPLAY y # Auxiliary Display support
-  DONGLE y # Serial dongle support
   HIPPI y
   MTD_COMPLEX_MAPPINGS y # needed for many devices
   SCSI_LOWLEVEL y # enable lots of SCSI devices
@@ -124,6 +123,9 @@ with stdenv.lib;
   SPI y # needed for many devices
   SPI_MASTER y
   WAN y
+  ${optionalString (versionOlder version "4.17") ''
+    DONGLE y # Serial dongle support
+  ''}
 
   # Networking options.
   NET y
@@ -134,6 +136,7 @@ with stdenv.lib;
   NETFILTER y
   NETFILTER_ADVANCED y
   CGROUP_BPF? y # Required by systemd per-cgroup firewalling
+  CGROUP_NET_PRIO y # Required by systemd
   IP_ROUTE_VERBOSE y
   IP_MROUTE_MULTIPLE_TABLES y
   IP_VS_PROTO_TCP y
@@ -352,7 +355,7 @@ with stdenv.lib;
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
-  ${optionalString (! stdenv.hostPlatform.isArm)
+  ${optionalString (! stdenv.hostPlatform.isAarch32)
     (if versionOlder version "3.14" then ''
         CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
       '' else ''
@@ -419,7 +422,9 @@ with stdenv.lib;
   ${optionalString (versionAtLeast version "4.3") ''
     IDLE_PAGE_TRACKING y
   ''}
-  IRDA_ULTRA y # Ultra (connectionless) protocol
+  ${optionalString (versionOlder version "4.17") ''
+    IRDA_ULTRA y # Ultra (connectionless) protocol
+  ''}
   JOYSTICK_IFORCE_232? y # I-Force Serial joysticks and wheels
   JOYSTICK_IFORCE_USB? y # I-Force USB joysticks and wheels
   JOYSTICK_XPAD_FF? y # X-Box gamepad rumble support
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 46486e0ff583..d9aef3a21930 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.33";
+  version = "4.14.37";
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c88p5vly63jsz62ff7971zl6vqzzbv5q519gi8z17ld66sf5063";
+    sha256 = "14lfj2vfxw36k8cbmzs280w4h81yz5xhlhq5550kww906vnyg5w1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.15.nix b/pkgs/os-specific/linux/kernel/linux-4.15.nix
deleted file mode 100644
index e58f44ea6a0b..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.15.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
-
-with stdenv.lib;
-
-buildLinux (args // rec {
-  version = "4.15.16";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00y5b00f90pq3il5jdzigx8k32i9ksrinavqa991xday5mcz5np7";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.16.nix b/pkgs/os-specific/linux/kernel/linux-4.16.nix
index eb219ce0e0ff..3da2cda30e22 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.16.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.16.1";
+  version = "4.16.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1hv00176njm4g9m1aj92lvhwqn75c46qwsglsmx95ivbr9qc58av";
+    sha256 = "0f1a8ggjb2jxc8n3hvypc81xbwylwkqi0mnynd9q316ay152zb1r";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index b59748541123..fe8633ed0da7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.127";
+  version = "4.4.129";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1gscsvijik24p0skhjnhqxlvzj3kfy5cmn3x9wn6ka687hwjb3qa";
+    sha256 = "0aviyky8f73l6jpi1d4by947rj78d5vckxkyf9aj73bavaxc8rd1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 86ddcf99dbe8..63fe3db3b577 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.93";
+  version = "4.9.96";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00srda6plvirmrr0bjgiksf00ssiigf5cqi4giy4mij5r6v8mxsq";
+    sha256 = "0zw7x86c8qa2kzkwlxlhqzsnddyp1ncw4ja660bqnzqrnmp5jvw2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
index 82b0b44bfc06..dfe58119da26 100644
--- a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
+++ b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.15.16";
+  version = "4.14.36";
   revision = "a";
-  sha256 = "0jxf01gf5rh6kwxcsv6mwlhq3wva2ps0ayrx40zwrdhkqy03w79x";
+  sha256 = "052ck8giy5nxy7871crhx6cdkgzzzpffdm8ilq1ys0rd3vldzl9b";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index f5e219bc74e3..1366a11b573c 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,15 +1,15 @@
 { stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.15.2018.03.22";
+  version = "4.15.2018.04.14";
   modDirVersion = "4.15.0";
   extraMeta.branch = "master";
   extraMeta.maintainers = [ stdenv.lib.maintainers.davidak stdenv.lib.maintainers.chiiruno ];
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "919a34d47a68f3e5f00a7ce5efb67748ec31bd62";
-    sha256 = "1j17my3046ry8zdcvf8h2vnij89wkwmv64w3g2pf9lksh2909djw";
+    rev = "3b7c824e9330a640312fce1b04537c684c1d602c";
+    sha256 = "1l5ib28qkhrxggn6zj9b2839543anbxk2ip75yizgzlv9vr5m4pk";
   };
 
   extraConfig = ''
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 5e8e861af258..6370f82235a7 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.16-rc7";
-  modDirVersion = "4.16.0-rc7";
-  extraMeta.branch = "4.16";
+  version = "4.17-rc2";
+  modDirVersion = "4.17.0-rc2";
+  extraMeta.branch = "4.17";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "13zpfjxd38202afjl6flc9brjw3sp4sfq3wls0v90k1i2b308qfi";
+    sha256 = "1z4kl25x8m498wicbzhx21kvksp63ab8l2s0nfxf7fwj7dd13cld";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index e163459d7f4f..cedb2dfc2230 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -73,4 +73,15 @@ rec {
     };
   };
 
+  # https://patchwork.kernel.org/patch/9626797/
+  # Should be included in 4.17, so this patch can be dropped when 4.16 becomes obsolete.
+  bcm2835_mmal_v4l2_camera_driver = rec {
+    name = "bcm2835_mmal_v4l2_camera_driver";
+    patch = fetchpatch {
+      name = name + ".patch";
+      url = https://patchwork.kernel.org/patch/9626797/raw/;
+      sha256 = "0iwb0yxsf95zv4qxkvlvhqfmzx0rk13g9clvxsharvwkb4w5lwa0";
+    };
+  };
+
 }
diff --git a/pkgs/os-specific/linux/kmod/aggregator.nix b/pkgs/os-specific/linux/kmod/aggregator.nix
index 9bd7c8480c1c..7d46a13f3562 100644
--- a/pkgs/os-specific/linux/kmod/aggregator.nix
+++ b/pkgs/os-specific/linux/kmod/aggregator.nix
@@ -9,6 +9,12 @@ buildEnv {
     ''
       source ${stdenv}/setup
 
+      if ! test -d "$out/lib/modules"; then
+        echo "No modules found."
+        # To support a kernel without modules
+        exit 0
+      fi
+
       kernelVersion=$(cd $out/lib/modules && ls -d *)
       if test "$(echo $kernelVersion | wc -w)" != 1; then
          echo "inconsistent kernel versions: $kernelVersion"
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index 2fb4fe93cc81..27ffaca61e71 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, pkgconfig }:
+{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, mesa_noglu, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "kmscube-2017-03-19";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ libdrm libX11 libGL ];
+  buildInputs = [ libdrm libX11 libGL mesa_noglu ];
 
   meta = with stdenv.lib; {
     description = "Example OpenGL app using KMS/GBM";
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 8dc906b29936..59d5db52ac68 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, pcre, pkgconfig, libsepol
 , enablePython ? true, swig ? null, python ? null
+, musl-fts
 }:
 
 assert enablePython -> swig != null && python != null;
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libsepol pcre ]
-             ++ optionals enablePython [ swig python ];
+             ++ optionals enablePython [ swig python ]
+             ++ optional stdenv.hostPlatform.isMusl musl-fts;
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index 30c2b05b8e1e..4ebc1c00f7af 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "156";
+  version = "157";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "0mv4sxcysl3m9wqybg6b363mawr9amzhc9v53775p4p2a47z774r";
+    sha256 = "1965axyfizv2jg412a4wrrghgswwvvgymk7mbwaraw3xl9p21wgv";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 4d1c2cad2e33..3d515f7b762f 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -17,6 +17,16 @@ let
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
+  # iconv tool, implemented by musl author.
+  # Original: http://git.etalabs.net/cgit/noxcuse/plain/src/iconv.c?id=02d288d89683e99fd18fe9f54d4e731a6c474a4f
+  # We use copy from Alpine which fixes error messages, see:
+  # https://git.alpinelinux.org/cgit/aports/commit/main/musl/iconv.c?id=a3d97e95f766c9c378194ee49361b375f093b26f
+  iconv_c = fetchurl {
+    name = "iconv.c";
+    url = "https://git.alpinelinux.org/cgit/aports/plain/main/musl/iconv.c?id=a3d97e95f766c9c378194ee49361b375f093b26f";
+    sha256 = "1mzxnc2ncq8lw9x6n7p00fvfklc9p3wfv28m68j0dfz5l8q2k6pp";
+  };
+
 in
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
@@ -41,6 +51,13 @@ stdenv.mkDerivation rec {
       --replace -fno-asynchronous-unwind-tables ""
   '';
 
+  patches = [
+    # Minor touchup to build system making dynamic linker symlink relative
+    (fetchurl {
+      url = https://raw.githubusercontent.com/openwrt/openwrt/87606e25afac6776d1bbc67ed284434ec5a832b4/toolchain/musl/patches/300-relative.patch;
+      sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
+    })
+  ];
   preConfigure = ''
     configureFlagsArray+=("--syslibdir=$out/lib")
   '';
@@ -58,6 +75,8 @@ stdenv.mkDerivation rec {
   dontDisableStatic = true;
   separateDebugInfo = true;
 
+  NIX_DONT_SET_RPATH = true;
+
   postInstall = ''
     # Not sure why, but link in all but scsi directory as that's what uclibc/glibc do.
     # Apparently glibc provides scsi itself?
@@ -68,7 +87,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
 
     # Create 'ldd' symlink, builtin
-    ln -s $out/lib/libc.so $out/bin/ldd
+    ln -rs $out/lib/libc.so $out/bin/ldd
 
     # (impure) cc wrapper around musl for interactive usuage
     for i in musl-gcc musl-clang ld.musl-clang; do
@@ -77,6 +96,14 @@ stdenv.mkDerivation rec {
     moveToOutput lib/musl-gcc.specs $dev
     substituteInPlace $dev/bin/musl-gcc \
       --replace $out/lib/musl-gcc.specs $dev/lib/musl-gcc.specs
+
+    # provide 'iconv' utility, using just-built headers, libc/ldso
+    $CC ${iconv_c} -o $out/bin/iconv \
+      -I$dev/include \
+      -L$out/lib -Wl,-rpath=$out/lib \
+      -lc \
+      -B $out/lib \
+      -Wl,-dynamic-linker=$(ls $out/lib/ld-*)
   '' + lib.optionalString useBSDCompatHeaders ''
     install -D ${queue_h} $dev/include/sys/queue.h
     install -D ${cdefs_h} $dev/include/sys/cdefs.h
diff --git a/pkgs/os-specific/linux/musl/fts-setup-hook.sh b/pkgs/os-specific/linux/musl/fts-setup-hook.sh
new file mode 100644
index 000000000000..3962dcb19a20
--- /dev/null
+++ b/pkgs/os-specific/linux/musl/fts-setup-hook.sh
@@ -0,0 +1,17 @@
+ftsLdflags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lfts"
+}
+
+addEnvHooks "$hostOffset" ftsLdflags
+
diff --git a/pkgs/os-specific/linux/musl/fts.nix b/pkgs/os-specific/linux/musl/fts.nix
index 083541e5e935..0f16e8cc79bf 100644
--- a/pkgs/os-specific/linux/musl/fts.nix
+++ b/pkgs/os-specific/linux/musl/fts.nix
@@ -11,4 +11,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  setupHook = ./fts-setup-hook.sh;
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index 740067af5580..e2ef51da3803 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -1,6 +1,6 @@
 nvidia_x11: sha256:
 
-{ stdenv, lib, fetchurl, pkgconfig, m4, jansson, gtk2, dbus, gtk3, libXv, libXrandr, libvdpau, libXext
+{ stdenv, lib, fetchurl, pkgconfig, m4, jansson, gtk2, dbus, gtk3, libXv, libXrandr, libXext, libXxf86vm, libvdpau
 , librsvg, wrapGAppsHook
 , withGtk2 ? false, withGtk3 ? true
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig m4 ];
 
-  buildInputs = [ jansson libXv libXrandr libvdpau nvidia_x11 gtk2 dbus libXv ]
+  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
              ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
 
   makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
diff --git a/pkgs/os-specific/linux/pam_u2f/default.nix b/pkgs/os-specific/linux/pam_u2f/default.nix
index f58dadfd10ce..0f0b6ebb37a6 100644
--- a/pkgs/os-specific/linux/pam_u2f/default.nix
+++ b/pkgs/os-specific/linux/pam_u2f/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "pam_u2f-${version}";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src     = fetchurl {
     url = "https://developers.yubico.com/pam-u2f/Releases/${name}.tar.gz";
-    sha256 = "189j0wgx6fs146vfp88djqpl1flpfb3962l1a2marlp6d12jwm3i";
+    sha256 = "0bbwy9k3002anhkv67zwck3dry7blqnnp291dc4qsjrca0blw217";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index d2f6371225fb..a7cac46ae6a0 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -34,4 +34,3 @@ stdenv.mkDerivation rec {
     inherit (libsepol.meta) homepage platforms maintainers;
   };
 }
-
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 7679262a9899..5ec708dd69fd 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
+{ stdenv, fetchurl, fetchpatch, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
 
 stdenv.mkDerivation rec {
   name = "powertop-${version}";
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
+  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl (
+    fetchpatch {
+      name = "strerror_r.patch";
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/powertop/strerror_r.patch?id=3b9214d436f1611f297b01f72469d66bfe729d6e";
+      sha256 = "1kzddhcrb0n2iah4lhgxwwy4mkhq09ch25jjngyq6pdj6pmfkpfw";
+    }
+  );
+
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
     substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index cc5e3dd5190c..316f0ad1a28d 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,15 +1,38 @@
-{ lib, stdenv, fetchurl, ncurses }:
+{ lib, stdenv, fetchFromGitLab, fetchpatch, ncurses, libtool, gettext, autoconf, automake, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "procps-${version}";
-  version = "3.3.12";
+  version = "3.3.13";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "1m57w6jmry84njd5sgk5afycbglql0al80grx027kwqqcfw5mmkf";
+  src = fetchFromGitLab {
+    owner ="procps-ng";
+    repo = "procps";
+    rev = "v${version}";
+    sha256 = "0r3h9adhqi5fi62lx65z839fww35lfh2isnknhkaw71xndjpzr0q";
   };
 
   buildInputs = [ ncurses ];
+  nativeBuildInputs = [ libtool gettext autoconf automake pkgconfig ];
+
+  # https://gitlab.com/procps-ng/procps/issues/88
+  # Patches needed for musl and glibc 2.28
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/uploads/f91ff094be1e4638aeffb67bdbb751ba/numa.h.diff";
+      sha256 = "16r537d2wfrvbv6dg9vyfck8n31xa58903mnssw1s4kb5ap83yd5";
+      extraPrefix = "";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/uploads/6a7bdea4d82ba781451316fda74192ae/libio_detection.diff";
+      sha256 = "0qp0j60kiycjsv213ih10imjirmxz8zja3rk9fq5lr5xf7k2lr3p";
+    })
+  ];
+
+  # autoreconfHook doesn't quite get, what procps-ng buildprocss does
+  # with po/Makefile.in.in and stuff.
+  preConfigure = ''
+    ./autogen.sh
+  '';
 
   makeFlags = "usrbin_execdir=$(out)/bin";
 
@@ -22,10 +45,11 @@ stdenv.mkDerivation rec {
       "ac_cv_func_realloc_0_nonnull=yes" ];
 
   meta = {
-    homepage = https://sourceforge.net/projects/procps-ng/;
+    homepage = https://gitlab.com/procps-ng/procps;
     description = "Utilities that give information about processes using the /proc filesystem";
     priority = 10; # less than coreutils, which also provides "kill" and "uptime"
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux ++ lib.platforms.cygwin;
+    maintainers = [ lib.maintainers.typetetris ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 4fd716ab8db8..868dcc9a58ea 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation rec {
       url = "http://git.0pointer.net/rtkit.git/patch/?id=88d4082ef6caf6b071d749dca1c50e7edde914cc";
       sha256 = "0hp1blbi359qz8fmr6nj4w9yc0jf3dd176f8pn25wdj38n13qkix";
     })
+
+    # Fix format string errors due to -Werror=format-security
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/r/rtkit/0.11-6/debian/patches/0006-fix-format-strings.patch";
+      sha256 = "09mr89lh16jvz6cqw00zmh0xk919bjfhjkvna1czwmafwy9p7kgp";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index ca15571d1ede..3a76450a8308 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -60,8 +60,10 @@ stdenv.mkDerivation rec {
     configureFlags="$configureFlags --with-xml-catalog=$PWD/xmlcatalog ";
   '';
 
-  configureFlags = " --enable-man "
-    + stdenv.lib.optionalString (hostPlatform.libc != "glibc") " --disable-nscd ";
+  configureFlags = [
+    "--enable-man"
+    "--with-group-name-max-length=32"
+  ] ++ stdenv.lib.optional (hostPlatform.libc != "glibc") "--disable-nscd";
 
   preBuild = stdenv.lib.optionalString (hostPlatform.libc == "glibc")
     ''
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index 46abb6ccc662..32761970d81c 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -5,7 +5,7 @@ let
     baseName="sinit";
     version="1.0";
     name="${baseName}-${version}";
-    url="http://git.suckless.org/sinit/";
+    url="https://git.suckless.org/sinit/";
     sha256="0cf8yylgrrj1wxm5v6jdlbnxpx97m38yxrc9nmv1l8hldjqsj9pc";
     rev = "refs/tags/v${version}";
   };
@@ -32,6 +32,6 @@ stdenv.mkDerivation {
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
     homepage = https://tools.suckless.org/sinit;
-    downloadPage = "http://git.suckless.org/sinit";
+    downloadPage = "https://git.suckless.org/sinit";
   };
 }
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 2550e6d28f6c..7c37d18c8684 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -78,5 +78,6 @@ in
       version = "2018-01-24";
       rev = "23602fdb39e1254c669707ec9d2d0e6bcdbf1771";
       sha256 = "09py2dwj77f6s2qcnkwdslg5nxb3hq2bq39zpxpm6msqyifhl69h";
+      patches = [ ./install_prefix.patch ];
     };
 }
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index d8e95ff74c43..db9f05f5f4d8 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-11.7.2";
+  name = "sysstat-11.7.3";
 
   src = fetchurl {
     url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "169yh9d0ags9xrn5g0k42wd1c895117zbzs257cjxqnb2vk0a38v";
+    sha256 = "1sk6rhdqr8xsm456fkhkcmbnqgkymqqs3jkapcf8mrnsx36gz94f";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 7b3590e5c195..615e4f867c4d 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -19,14 +19,16 @@ let
   pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
 
 in stdenv.mkDerivation rec {
-  version = "237";
+  version = "238";
   name = "systemd-${version}";
 
+  # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
+  # Also fresh patches should be cherry-picked from that tree to our current one.
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "98067cc806ae0d2759cdd2334f230cd8548e5317";
-    sha256 = "077svfs2xy3g30s62q69wcv5pb9vfhzh8i7lhfri73vvhwbpzd5q";
+    rev = "02042d012c4d6c0a2854d8436dd6636d4327774f";
+    sha256 = "0iv6fygzac0z6dagbmw1nf8dx7rrr6d9cxp0fr304rn3ir58g5f0";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -77,7 +79,7 @@ in stdenv.mkDerivation rec {
     "-Dsystem-gid-max=499"
     # "-Dtime-epoch=1"
 
-    (if stdenv.isArm || !hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
+    (if stdenv.isAarch32 || stdenv.isAarch64 || !hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
     "-Defi-ldsdir=${toString gnu-efi}/lib"
@@ -181,13 +183,6 @@ in stdenv.mkDerivation rec {
 
     rm -rf $out/etc/systemd/system
 
-    # Install SysV compatibility commands.
-    mkdir -p $out/sbin
-    ln -s $out/lib/systemd/systemd $out/sbin/telinit
-    for i in init halt poweroff runlevel reboot shutdown; do
-      ln -s $out/bin/systemctl $out/sbin/$i
-    done
-
     # Fix reference to /bin/false in the D-Bus services.
     for i in $out/share/dbus-1/system-services/*.service; do
       substituteInPlace $i --replace /bin/false ${coreutils}/bin/false
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
new file mode 100644
index 000000000000..01c84a1d1faa
--- /dev/null
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, kernel, ncurses }:
+
+stdenv.mkDerivation {
+  name = "tmon-${kernel.version}";
+
+  inherit (kernel) src;
+
+  buildInputs = [ ncurses ];
+
+  configurePhase = ''
+    cd tools/thermal/tmon
+  '';
+
+  makeFlags = kernel.makeFlags ++ [ "INSTALL_ROOT=\"$(out)\"" "BINDIR=bin" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Monitoring and Testing Tool for Linux kernel thermal subsystem";
+    homepage = https://www.kernel.org/;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
index c4d2bf04d7a0..180aabc94cc6 100644
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ b/pkgs/os-specific/linux/uclibc/default.nix
@@ -43,7 +43,7 @@ let
     UCLIBC_SUSV4_LEGACY y
     UCLIBC_HAS_THREADS_NATIVE y
     KERNEL_HEADERS "${linuxHeaders}/include"
-  '' + stdenv.lib.optionalString (stdenv.isArm && cross == null) ''
+  '' + stdenv.lib.optionalString (stdenv.isAarch32 && cross == null) ''
     CONFIG_ARM_EABI y
     ARCH_WANTS_BIG_ENDIAN n
     ARCH_BIG_ENDIAN n
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 725b1cd25643..1c8e429c9455 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "udisks-2.1.6";
+  name = "udisks-2.1.8";
 
   src = fetchurl {
     url = "http://udisks.freedesktop.org/releases/${name}.tar.bz2";
-    sha256 = "0spl155k0g2l2hvqf8xyjv08i68gfyhzpjva6cwlzxx0bz4gbify";
+    sha256 = "1nkxhnqh39c9pzvm4zfj50rgv6apqawdx09bv3sfaxrah4a6jhfs";
   };
 
   outputs = [ "out" "man" "dev" ];
@@ -27,7 +27,11 @@ stdenv.mkDerivation rec {
         --replace "/bin/sh" "${stdenv.shell}" \
         --replace "/sbin/mdadm" "${mdadm}/bin/mdadm" \
         --replace " sed " " ${gnused}/bin/sed "
-    '';
+  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+      substituteInPlace udisks/udisksclient.c \
+        --replace 'defined( __GNUC_PREREQ)' 1 \
+        --replace '__GNUC_PREREQ(4,6)' 1
+  '';
 
   nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection ];
 
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 0650bfd36f34..b88646424be5 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20180304";
+  version = "0.0.20180413";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "11vp6aiqxrnwqlaslxy13cpmw2l2pdm9nhs021rv4zx61lpnbcgg";
+    sha256 = "0lbjx62ihc8prqfhvmi0v1xq1q3ayzj5rfy2p5149nr9qx3z37j1";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 2ebb2b1890d5..b5937dff3752 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -3,11 +3,11 @@
 , ncurses, pkgconfig, randrproto, xorgserver, xproto, udev, libXinerama, pixman }:
 
 stdenv.mkDerivation rec {
-  name = "xf86-input-wacom-0.35.0";
+  name = "xf86-input-wacom-0.36.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxwacom/${name}.tar.bz2";
-    sha256 = "0za44snc0zirq65a4lxsmg7blp1bynj6j835hm459x8yx1qhmxjm";
+    sha256 = "1xi39hl8ddgj9m7m2k2ll2r3wh0k0aq45fvrsv43651bhz9cbrza";
   };
 
   buildInputs = [ inputproto libX11 libXext libXi libXrandr libXrender
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 50ceea19877c..bdc43a092f7f 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -4,6 +4,8 @@
 
 # Userspace dependencies
 , zlib, libuuid, python, attr, openssl
+, libtirpc
+, nfs-utils
 
 # Kernel dependencies
 , kernel ? null, spl ? null, splUnstable ? null, splLegacyCrypto ? null
@@ -42,6 +44,9 @@ let
 
       postPatch = optionalString buildKernel ''
         patchShebangs scripts
+      '' + optionalString stdenv.hostPlatform.isMusl ''
+        substituteInPlace config/user-libtirpc.m4 \
+          --replace /usr/include/tirpc ${libtirpc}/include/tirpc
       '';
 
       nativeBuildInputs = [ autoreconfHook nukeReferences ]
@@ -49,7 +54,8 @@ let
       buildInputs =
            optionals buildKernel [ spl ]
         ++ optionals buildUser [ zlib libuuid python attr ]
-        ++ optionals (buildUser && (isUnstable || isLegacyCrypto)) [ openssl ];
+        ++ optionals (buildUser && (isUnstable || isLegacyCrypto)) [ openssl ]
+        ++ optional stdenv.hostPlatform.isMusl [ libtirpc ];
 
       # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
       NIX_CFLAGS_LINK = "-lgcc_s";
@@ -61,6 +67,7 @@ let
         substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "mount -t zfs"            "${utillinux}/bin/mount -t zfs"
         substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${utillinux}/bin/umount"
         substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/mount"              "${utillinux}/bin/mount"
+        substituteInPlace ./lib/libshare/nfs.c        --replace "/usr/sbin/exportfs"      "${nfs-utils}/bin/exportfs"
         substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/ztest"         "$out/sbin/ztest"
         substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/zdb"           "$out/sbin/zdb"
         substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
@@ -77,6 +84,7 @@ let
         done
 
         ./autogen.sh
+        configureFlagsArray+=("--libexecdir=$out/libexec")
       '';
 
       configureFlags = [
@@ -86,6 +94,7 @@ let
         "--with-udevdir=$(out)/lib/udev"
         "--with-systemdunitdir=$(out)/etc/systemd/system"
         "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+        "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
         "--with-mounthelperdir=$(out)/bin"
         "--sysconfdir=/etc"
         "--localstatedir=/var"
@@ -144,7 +153,7 @@ in {
   # to be adapted
   zfsStable = common {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = null;
+    incompatibleKernelVersion = "4.16";
 
     # this package should point to the latest release.
     version = "0.7.8";