From b971f8de8e590e18151a709edf093ee735e090b6 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 13 Aug 2017 09:28:05 +0000
Subject: [PATCH 001/134] set-source-date-epoch-to-latest.sh: ignore generated
 files

set-source-date-epoch-to-latest.sh to ignore files newer than "$NIX_BUILD_TOP/.." (unlike "$NIX_BUILD_TOP" it is root-owned and cannot be touched by nixbld1).
---
 .../setup-hooks/set-source-date-epoch-to-latest.sh            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
index fe3458cd21e8..a2449b2704aa 100644
--- a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+++ b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
@@ -4,8 +4,8 @@ updateSourceDateEpoch() {
     # Get the last modification time of all regular files, sort them,
     # and get the most recent. Maybe we should use
     # https://github.com/0-wiz-0/findnewest here.
-    local -a res=($(find "$path" -type f -print0 | xargs -0 -r stat -c '%Y %n' | sort -n | tail -n1))
-    local time="${res[0]}"
+    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\n' | sort -n | tail -n1))
+    local time="${res[0]//\.[0-9]*/}" # remove the fraction part
     local newestFile="${res[1]}"
 
     # Update $SOURCE_DATE_EPOCH if the most recent file we found is newer.

From 4ebeb7d78296b26eede37495a2674494290d14f8 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Sun, 13 Aug 2017 14:03:05 +0000
Subject: [PATCH 002/134] use \0 instead of \n

---
 .../setup-hooks/set-source-date-epoch-to-latest.sh              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
index a2449b2704aa..6bf9a65b35af 100644
--- a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+++ b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
@@ -4,7 +4,7 @@ updateSourceDateEpoch() {
     # Get the last modification time of all regular files, sort them,
     # and get the most recent. Maybe we should use
     # https://github.com/0-wiz-0/findnewest here.
-    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\n' | sort -n | tail -n1))
+    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\0' | sort -n --zero-terminated | tail -n1 --zero-terminated))
     local time="${res[0]//\.[0-9]*/}" # remove the fraction part
     local newestFile="${res[1]}"
 

From 9dee19030ba5102e50098f6944d1455cf6f370f8 Mon Sep 17 00:00:00 2001
From: Parnell Springmeyer <parnell@awakenetworks.com>
Date: Fri, 18 Aug 2017 14:18:22 -0500
Subject: [PATCH 003/134] nghttp2: 1.20.0 -> 1.24.0

This change does three things:

1. Increases nghttp2's version from 1.20.0 to 1.24.0
2. Adds a `bin` output
3. Enables building of nghttp2's suite of applications
---
 pkgs/development/libraries/nghttp2/default.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 3033c4301afe..d534cd59bd83 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -17,15 +17,14 @@ let inherit (stdenv.lib) optional; in
 
 stdenv.mkDerivation rec {
   name = "nghttp2-${version}";
-  version = "1.20.0";
+  version = "1.24.0";
 
-  # Don't use fetchFromGitHub since this needs a bootstrap curl
   src = fetchurl {
     url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
-    sha256 = "fb29d0500b194f11680203aed21aafab241063ec1397cc51ab5cc0957341141b";
+    sha256 = "18ys6p39yvm9wjjzhhlw35c9m8f5gf4dk9jbshibj19q4js1pnv9";
   };
 
-  outputs = [ "out" "dev" "lib" ];
+  outputs = [ "bin" "out" "dev" "lib" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl libev zlib c-ares ]
@@ -36,12 +35,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = [ "--with-spdylay=no" "--disable-examples" "--disable-python-bindings" ]
+  configureFlags = [ "--with-spdylay=no" "--disable-examples" "--disable-python-bindings" "--enable-app" ]
     ++ optional enableAsioLib "--enable-asio-lib --with-boost-libdir=${boost}/lib";
 
   #doCheck = true;  # requires CUnit ; currently failing at test_util_localtime_date in util_test.cc
 
-
   meta = with stdenv.lib; {
     homepage = https://nghttp2.org/;
     description = "A C implementation of HTTP/2";

From 555900081dbe9ba821a23b6a6fd88e6d07941246 Mon Sep 17 00:00:00 2001
From: Casey Rodarmor <casey@rodarmor.com>
Date: Sat, 12 Aug 2017 22:13:04 -0700
Subject: [PATCH 004/134] ncurses: put tic binary in bin

---
 pkgs/development/libraries/ncurses/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index e2c3907e856a..35b6659ad7e3 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -115,6 +115,7 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/clear" "$out"
     moveToOutput "bin/reset" "$out"
     moveToOutput "bin/tabs" "$out"
+    moveToOutput "bin/tic" "$out"
     moveToOutput "bin/tput" "$out"
     moveToOutput "bin/tset" "$out"
   '';

From 92652b4d79cf09705c011dbf1c38bc871a4011c8 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Fri, 21 Jul 2017 20:29:18 +0200
Subject: [PATCH 005/134] darwin-CF: use @rpath for library id and add an rpath
 entry for CF based on NIX_COREFOUNDATION_RPATH

---
 pkgs/build-support/cc-wrapper/ld-wrapper.sh                  | 4 ++++
 pkgs/os-specific/darwin/apple-source-releases/CF/default.nix | 2 +-
 pkgs/stdenv/darwin/default.nix                               | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index a775b6da8237..38712665e432 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -145,6 +145,10 @@ if [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ]; then
             fi
         done
     done
+
+    if [ -n "${NIX_COREFOUNDATION_RPATH:-}" ]; then
+      extraAfter+=(-rpath $NIX_COREFOUNDATION_RPATH)
+    fi
 fi
 
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
index e44966aa84d6..5589d1592f46 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
@@ -18,7 +18,7 @@ appleDerivation {
       --replace "/usr/sbin/" "" \
       --replace "/bin/" "" \
       --replace "INSTALLNAME=/System" "INSTALLNAME=$out" \
-      --replace "install_name_tool -id /System" "install_name_tool -id $out" \
+      --replace "install_name_tool -id /System/Library/Frameworks" "install_name_tool -id @rpath" \
       --replace 'chown -RH -f root:wheel $(DSTBASE)/CoreFoundation.framework' "" \
       --replace 'chmod -RH' 'chmod -R'
 
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 61b7df195434..6739ce3f5c8f 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -300,6 +300,7 @@ in rec {
     targetPlatform = localSystem;
 
     preHook = commonPreHook + ''
+      export NIX_COREFOUNDATION_RPATH=${pkgs.darwin.CF}/Library/Frameworks
       export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
     '';
 

From cc1bfbd9a7f0fe7f7c4f0dec81990b5ce7d6cff3 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sat, 22 Jul 2017 13:31:48 +0200
Subject: [PATCH 006/134] darwin-frameworks: use the system CF when frameworks
 are used

This will get propagated down to other libraries loaded because
everything in nixpkgs references CF based on an rpath entry.
---
 pkgs/os-specific/darwin/apple-sdk/default.nix            | 2 +-
 .../os-specific/darwin/apple-sdk/framework-setup-hook.sh | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh

diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 73126ce1f5c1..957b610f3a25 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -134,7 +134,7 @@ let
     propagatedBuildInputs = deps;
 
     # don't use pure CF for dylibs that depend on frameworks
-    setupHook = ../../../build-support/setup-hooks/fix-darwin-frameworks.sh;
+    setupHook = ./framework-setup-hook.sh;
 
     # allows building the symlink tree
     __impureHostDeps = [ "/System/Library/Frameworks/${name}.framework" ];
diff --git a/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
new file mode 100644
index 000000000000..9d96a4adbaa1
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
@@ -0,0 +1,9 @@
+# This configures the stdenv to use /System/Library/Frameworks/CoreFoundation.framework
+# instead of the nix version by including the system frameworks path
+# as an rpath entry when creating binaries.
+
+useSystemCoreFoundationFramework () {
+  export NIX_COREFOUNDATION_RPATH=/System/Library/Frameworks
+}
+
+envHooks+=(useSystemCoreFoundationFramework)

From 5a28fd660a3f6eff6e6b53ecf787577ae271201a Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Mon, 28 Aug 2017 21:14:59 +0200
Subject: [PATCH 007/134] darwin-frameworks: move fixup setup-hook

---
 .../setup-hooks/fix-darwin-frameworks.sh      | 31 -----------------
 .../darwin/apple-sdk/framework-setup-hook.sh  | 33 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 --
 3 files changed, 33 insertions(+), 33 deletions(-)
 delete mode 100644 pkgs/build-support/setup-hooks/fix-darwin-frameworks.sh

diff --git a/pkgs/build-support/setup-hooks/fix-darwin-frameworks.sh b/pkgs/build-support/setup-hooks/fix-darwin-frameworks.sh
deleted file mode 100644
index cf8416c0838d..000000000000
--- a/pkgs/build-support/setup-hooks/fix-darwin-frameworks.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-# On macOS, frameworks are linked to the system CoreFoundation but
-# dynamic libraries built with nix use a pure version of CF this
-# causes segfaults for binaries that depend on it at runtime.  This
-# can be solved in two ways.
-# 1. Rewrite references to the pure CF using this setup hook, this
-# works for the simple case but this can still cause problems if other
-# dependencies (eg. python) use the pure CF.
-# 2. Create a wrapper for the binary that sets DYLD_FRAMEWORK_PATH to
-# /System/Library/Frameworks.  This will make everything load the
-# system's CoreFoundation framework while still keeping the
-# dependencies pure for other packages.
-
-fixupOutputHooks+=('fixDarwinFrameworksIn $prefix')
-
-fixDarwinFrameworks() {
-    local systemPrefix='/System/Library/Frameworks'
-
-    for fn in "$@"; do
-        if [ -L "$fn" ]; then continue; fi
-        echo "$fn: fixing dylib"
-
-        for framework in $(otool -L "$fn" | awk '/CoreFoundation\.framework/ {print $1}'); do
-          install_name_tool -change "$framework" "$systemPrefix/CoreFoundation.framework/Versions/A/CoreFoundation" "$fn" >&2
-        done
-    done
-}
-
-fixDarwinFrameworksIn() {
-    local dir="$1"
-    fixDarwinFrameworks $(find "$dir" -name "*.dylib")
-}
diff --git a/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
index 9d96a4adbaa1..04d8e878f4f7 100644
--- a/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
@@ -1,3 +1,36 @@
+# On macOS, frameworks are linked to the system CoreFoundation but
+# dynamic libraries built with nix use a pure version of CF this
+# causes segfaults for binaries that depend on it at runtime.  This
+# can be solved in two ways.
+# 1. Rewrite references to the pure CF using this setup hook, this
+# works for the simple case but this can still cause problems if other
+# dependencies (eg. python) use the pure CF.
+# 2. Create a wrapper for the binary that sets DYLD_FRAMEWORK_PATH to
+# /System/Library/Frameworks.  This will make everything load the
+# system's CoreFoundation framework while still keeping the
+# dependencies pure for other packages.
+
+fixupOutputHooks+=('fixDarwinFrameworksIn $prefix')
+
+fixDarwinFrameworks() {
+    local systemPrefix='/System/Library/Frameworks'
+
+    for fn in "$@"; do
+        if [ -L "$fn" ]; then continue; fi
+        echo "$fn: fixing dylib"
+
+        for framework in $(otool -L "$fn" | awk '/CoreFoundation\.framework/ {print $1}'); do
+          install_name_tool -change "$framework" "$systemPrefix/CoreFoundation.framework/Versions/A/CoreFoundation" "$fn" >&2
+        done
+    done
+}
+
+fixDarwinFrameworksIn() {
+    local dir="$1"
+    fixDarwinFrameworks $(find "$dir" -name "*.dylib")
+}
+
+
 # This configures the stdenv to use /System/Library/Frameworks/CoreFoundation.framework
 # instead of the nix version by including the system frameworks path
 # as an rpath entry when creating binaries.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e51bc545aec8..e44b670ac082 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -328,8 +328,6 @@ with pkgs;
 
   fixDarwinDylibNames = makeSetupHook { } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
 
-  fixDarwinFrameworks = makeSetupHook { } ../build-support/setup-hooks/fix-darwin-frameworks.sh;
-
   keepBuildTree = makeSetupHook { } ../build-support/setup-hooks/keep-build-tree.sh;
 
   enableGCOVInstrumentation = makeSetupHook { } ../build-support/setup-hooks/enable-coverage-instrumentation.sh;

From b64f149ea981b2e90b8230d15936283820729333 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 28 Aug 2017 23:27:04 +0200
Subject: [PATCH 008/134] gnome-disk-utility: fix missing schemas for
 gnome-disk-image-mounter

Continuation of #28053

gnome-disk-image-mounter from gnome-disk-utility was not wrapped, resulting in an
error due to the inability to find gsettings schemas.

This commit replaces the manual wrapping of gnome-disks binary with wrapGAppsHook
so that all binaries are wrapped correctly.
---
 .../3.24/core/gnome-disk-utility/default.nix       | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/desktops/gnome-3/3.24/core/gnome-disk-utility/default.nix b/pkgs/desktops/gnome-3/3.24/core/gnome-disk-utility/default.nix
index f22f4665c142..aef58567387b 100644
--- a/pkgs/desktops/gnome-3/3.24/core/gnome-disk-utility/default.nix
+++ b/pkgs/desktops/gnome-3/3.24/core/gnome-disk-utility/default.nix
@@ -1,6 +1,6 @@
 { stdenv, intltool, fetchurl, pkgconfig, udisks2, libsecret, libdvdread
-, bash, gtk3, glib, makeWrapper, cracklib, libnotify
-, itstool, gnome3, librsvg, gdk_pixbuf, libxml2, python
+, bash, gtk3, glib, wrapGAppsHook, cracklib, libnotify
+, itstool, gnome3, gdk_pixbuf, libxml2, python
 , libcanberra_gtk3, libxslt, libtool, docbook_xsl, libpwquality }:
 
 stdenv.mkDerivation rec {
@@ -16,14 +16,8 @@ stdenv.mkDerivation rec {
                   libxslt libtool libsecret libpwquality cracklib
                   libnotify libdvdread libcanberra_gtk3 docbook_xsl
                   gdk_pixbuf gnome3.defaultIconTheme
-                  librsvg udisks2 gnome3.gnome_settings_daemon
-                  gnome3.gsettings_desktop_schemas makeWrapper libxml2 ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/gnome-disks" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "${gnome3.gnome_themes_standard}/share:$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
+                  udisks2 gnome3.gnome_settings_daemon
+                  gnome3.gsettings_desktop_schemas wrapGAppsHook libxml2 ];
 
   meta = with stdenv.lib; {
     homepage = https://en.wikipedia.org/wiki/GNOME_Disks;

From 5b36d3993f26b341f87359c756b61115383877d6 Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Fri, 25 Aug 2017 13:13:04 +0200
Subject: [PATCH 009/134] highlight: 3.35 -> 3.39

---
 pkgs/tools/text/highlight/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/highlight/default.nix b/pkgs/tools/text/highlight/default.nix
index f452a98a4db6..71c5e352b949 100644
--- a/pkgs/tools/text/highlight/default.nix
+++ b/pkgs/tools/text/highlight/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "highlight-${version}";
-  version = "3.35";
+  version = "3.39";
 
   src = fetchurl {
     url = "http://www.andre-simon.de/zip/${name}.tar.bz2";
-    sha256 = "8a14b49f5e0c07daa9f40b4ce674baa00bb20061079473a5d386656f6d236d05";
+    sha256 = "0z8gs69sqlyis4kvl8wwdgzywi199k73kkvn1mf9pf60npvcxwj4";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ optional stdenv.isDarwin  gcc ;

From 936fee257d0b8ee06419ea038830c0041da4fc97 Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Fri, 25 Aug 2017 13:57:39 +0200
Subject: [PATCH 010/134] freeradius: 3.0.14 -> 3.0.15

---
 pkgs/servers/freeradius/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/freeradius/default.nix b/pkgs/servers/freeradius/default.nix
index ec6610b8245f..aca534f1d6fa 100644
--- a/pkgs/servers/freeradius/default.nix
+++ b/pkgs/servers/freeradius/default.nix
@@ -40,11 +40,11 @@ assert withCollectd -> collectd != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "freeradius-${version}";
-  version = "3.0.14";
+  version = "3.0.15";
 
   src = fetchurl {
     url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
-    sha256 = "02ar0xn4dfrs95cmd4c798k95rmnzzvcryyyl2vjv53ak16igmpw";
+    sha256 = "1qygf5if2xjzl7kfzwl428ydz5q1m0j5sx077n12v7znlgnwaagx";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    homepage = http://freeradius.org/;
+    homepage = https://freeradius.org/;
     description = "A modular, high performance free RADIUS suite";
     license = stdenv.lib.licenses.gpl2;
     maintainers = with maintainers; [ sheenobu ];

From 164eb72403f80eecb1987d3a0b3f37f94388724b Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Fri, 25 Aug 2017 14:42:40 +0200
Subject: [PATCH 011/134] nasm: 2.12.02 -> 2.13.01

---
 pkgs/development/compilers/nasm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index eb090e8b38ad..8b6c6d94c750 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -2,17 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "nasm-${version}";
-  version = "2.12.02";
+  version = "2.13.01";
 
   src = fetchurl {
     url = "http://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}.tar.bz2";
-    sha256 = "097318bjxvmffbjfd1k89parc04xf5jfxg2rr93581lccwf8kc00";
+    sha256 = "1ylqs4sqh0paia970v6hpdgq5icxns9zlg21qql232bz1apppy88";
   };
 
   meta = with stdenv.lib; {
     homepage = http://www.nasm.us/;
     description = "An 80x86 and x86-64 assembler designed for portability and modularity";
     platforms = platforms.unix;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub willibutz ];
   };
 }

From a72ba661acf54d1beb2b4e306acba7d6f45621c4 Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Fri, 25 Aug 2017 15:05:48 +0200
Subject: [PATCH 012/134] netcat-openbsd: 1.105 -> 1.130

---
 .../networking/netcat-openbsd/default.nix     | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/pkgs/tools/networking/netcat-openbsd/default.nix b/pkgs/tools/networking/netcat-openbsd/default.nix
index 2ac9c5cf6e97..7c22891ab7a3 100644
--- a/pkgs/tools/networking/netcat-openbsd/default.nix
+++ b/pkgs/tools/networking/netcat-openbsd/default.nix
@@ -1,17 +1,18 @@
 {stdenv, fetchurl, pkgconfig, libbsd}:
 
 stdenv.mkDerivation rec {
-  name = "netcat-openbsd-1.105";
-  version = "1.105";
+  version = "1.130";
+  deb-version = "${version}-3";
+  name = "netcat-openbsd-${version}";
 
   srcs = [
     (fetchurl {
-      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_1.105.orig.tar.gz";
-      sha256 = "07i1vcz8ycnfwsvz356rqmim8akfh8yhjzmhc5mqf5hmdkk3yra0";
+      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_${version}.orig.tar.gz";
+      sha256 = "0nqy14yvclgzs98gv0fwp6jlfpfy2kk367zka648jiqbbl30awpx";
     })
     (fetchurl {
-      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_1.105-7.debian.tar.gz";
-      sha256 = "0qxkhbwcifrps34s5mzzg79cmkvz3f96gphd3pl978pygwr5krzf";
+      url = "mirror://debian/pool/main/n/netcat-openbsd/netcat-openbsd_${deb-version}.debian.tar.xz";
+      sha256 = "0f9409vjm6v8a7m1zf5sr7wj6v5v8414i5vvxx1r45c11h69hh9a";
     })
   ];
 
@@ -26,10 +27,11 @@ stdenv.mkDerivation rec {
     install -Dm0644 nc.1 $out/share/man/man1/nc.1
   '';
 
-  meta = {
-    homepage = http://packages.debian.org/netcat-openbsd;
+  meta = with stdenv.lib; {
+    homepage = https://packages.debian.org/netcat-openbsd;
     description = "TCP/IP swiss army knife, OpenBSD variant";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ willibutz ];
   };
 
 }

From 95a4c03c7d17bff956313c3eb51df91262bec11f Mon Sep 17 00:00:00 2001
From: WilliButz <wbutz@cyberfnord.de>
Date: Fri, 25 Aug 2017 15:59:15 +0200
Subject: [PATCH 013/134] inkscape: 0.92.1 -> 0.92.2

---
 pkgs/applications/graphics/inkscape/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index a3a58bc87ee4..678ee79459be 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -10,11 +10,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "inkscape-0.92.1";
+  name = "inkscape-0.92.2";
 
   src = fetchurl {
-    url = "https://media.inkscape.org/dl/resources/file/${name}.tar_XlpI7qT.bz2";
-    sha256 = "01chr3vh728dkg7l7lilwgmh5nrp784khdhjgpqjbq9dh2zhax15";
+    url = "https://media.inkscape.org/dl/resources/file/${name}.tar.bz2";
+    sha256 = "1lyghk6yarcv9nwkh6k366p6hb7rfilqcvbyji09hki59khd0a56";
   };
 
   unpackPhase = ''
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     license = "GPL";
-    homepage = http://www.inkscape.org;
+    homepage = https://www.inkscape.org;
     description = "Vector graphics editor";
     platforms = platforms.all;
     longDescription = ''

From 8f713e881e6f96bc99072e6a863b4069e705bbd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Tue, 29 Aug 2017 22:06:07 +0200
Subject: [PATCH 014/134] wyrd: fixup by using older ncurses

---
 pkgs/top-level/ocaml-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 64656990d0e4..5bb79186d8c2 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -904,7 +904,9 @@ let
 
     # Apps / from all-packages
 
-    wyrd = callPackage ../tools/misc/wyrd { };
+    wyrd = callPackage ../tools/misc/wyrd {
+      ncurses = pkgs.ncurses5;
+    };
 
     haxe = callPackage ../development/compilers/haxe { };
 

From 822a8d01481e4cb2bab7e82a01637eceddaba5a2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 25 Aug 2017 01:14:43 -0400
Subject: [PATCH 015/134] cc-wrapper: Remove redundant hardening

GCC just passes `-z ...` flags to ld unaltered, and they are already
passed to LD anyways. On the other hand, `-pie` affects gcc behavior
too.
---
 pkgs/build-support/cc-wrapper/add-hardening.sh | 1 +
 pkgs/build-support/cc-wrapper/cc-wrapper.sh    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index aa8eb720486c..af98ea03e529 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -43,6 +43,7 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           hardeningCFlags+=('-fPIE')
           if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
             if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
+            hardeningCFlags+=('-pie')
             hardeningLDFlags+=('-pie')
           fi
           ;;
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 1c654ea47567..6099535600c7 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -138,7 +138,7 @@ if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_@infixSalt@_CFLAGS_LINK "${hardeningLDFlags[@]}")
+    extraAfter+=($NIX_@infixSalt@_CFLAGS_LINK)
 
     # Add the flags that should be passed to the linker (and prevent
     # `ld-wrapper' from adding NIX_@infixSalt@_LDFLAGS again).

From 97a48835b7d7124b3c218a6be7ca4536ac0360a8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 28 Aug 2017 14:56:08 -0400
Subject: [PATCH 016/134] mkDerivation, cc-wrapper: Check hardening flag
 validity in Nix

This becomes necessary if more wrappers besides cc-wrapper start
supporting hardening flags. Also good to make the warning into an
error.

Also ensure interface is being used right: Not as a string, not just in
bash.
---
 pkgs/build-support/cc-wrapper/add-hardening.sh      |  3 ++-
 pkgs/os-specific/linux/devmem2/default.nix          |  3 ++-
 .../os-specific/linux/firmware/fwupdate/default.nix |  2 +-
 pkgs/stdenv/generic/make-derivation.nix             | 13 +++++++++++++
 pkgs/tools/networking/envoy/default.nix             |  2 +-
 5 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index af98ea03e529..34358e04194a 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -68,7 +68,8 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           hardeningLDFlags+=('-z' 'now')
           ;;
         *)
-          echo "Hardening flag unknown: $flag" >&2
+          # Ignore unsupported. Checked in Nix that at least *some*
+          # tool supports each flag.
           ;;
       esac
     fi
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
index 4cee9678a9b6..969197c2dc9d 100644
--- a/pkgs/os-specific/linux/devmem2/default.nix
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "14f1k7v6i1yaxg4xcaaf5i4aqn0yabba857zjnbg9wiymy82qf7c";
   };
 
+  hardeningDisable = [ "format" ];  # fix compile error
+
   buildCommand = ''
-    export hardeningDisable=format  # fix compile error
     cc "$src" -o devmem2
     install -D devmem2 "$out/bin/devmem2"
   '';
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index 3fc7af916368..b1cbed109087 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -17,7 +17,7 @@ let version = "8"; in
       buildInputs = [ gnu-efi libsmbios popt pkgconfig gettext ];
       propagatedBuildInputs = [ efivar ];
       # TODO: Just apply the disable to the efi subdir
-      hardeningDisable = "all";
+      hardeningDisable = [ "all" ];
       patchPhase = ''
         sed -i 's|/usr/include/smbios_c/token.h|smbios_c/token.h|' \
           linux/libfwup.c
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 2fbaa76c6a43..b9d8b2d31175 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -41,7 +41,20 @@ rec {
     , __propagatedImpureHostDeps ? []
     , sandboxProfile ? ""
     , propagatedSandboxProfile ? ""
+
+    , hardeningEnable ? []
+    , hardeningDisable ? []
     , ... } @ attrs:
+
+    # TODO(@Ericson2314): Make this more modular, and not O(n^2).
+    let allHardeningFlags = [
+      "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro"
+      "bindnow"
+    ];
+    in assert lib.all
+      (flag: lib.elem flag allHardeningFlags)
+      (hardeningEnable ++ hardeningDisable);
+
     let
       dependencies = map lib.chooseDevOutputs [
         (map (drv: drv.nativeDrv or drv) nativeBuildInputs
diff --git a/pkgs/tools/networking/envoy/default.nix b/pkgs/tools/networking/envoy/default.nix
index 79a24ea1f8dd..f5362d173e7d 100644
--- a/pkgs/tools/networking/envoy/default.nix
+++ b/pkgs/tools/networking/envoy/default.nix
@@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./nixos.patch ];
 
-  hardeningDisable = "all";
+  hardeningDisable = [ "all" ];
   dontPatchELF = true;
   dontStrip = true;
 

From e82cb3dfa4de3e29ce52afd5576e9c50581e2b0f Mon Sep 17 00:00:00 2001
From: Matthew Robbetts <mrobbetts@gmail.com>
Date: Fri, 4 Aug 2017 14:15:20 -0700
Subject: [PATCH 017/134] openldap: Fix build with LibreSSL.

---
 pkgs/development/libraries/openldap/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 94a4db43fda6..06288ce9a6b8 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -8,6 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "091qvwk5dkcpp17ziabcnh3rg3m7qwzw2pihfcd1d5fdxgywzmnd";
   };
 
+  patches = [
+    (fetchurl {
+      url = "https://bz-attachments.freebsd.org/attachment.cgi?id=183223";
+      sha256 = "1fiy457hrxmydybjlvn8ypzlavz22cz31q2rga07n32dh4x759r3";
+    })
+  ];
+  patchFlags = [ "-p0" ];
+
   # TODO: separate "out" and "bin"
   outputs = [ "out" "dev" "man" "devdoc" ];
 

From 3e50f0ae0e07d645cd922c60e40770fc69af2e3a Mon Sep 17 00:00:00 2001
From: teh <tehunger@gmail.com>
Date: Wed, 30 Aug 2017 20:22:58 +0100
Subject: [PATCH 018/134] systemd: add patch to fix suspend.target

---
 pkgs/os-specific/linux/systemd/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c79343322d93..834418a177b6 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -73,6 +73,15 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "stackprotector" ];
 
+  patches = [
+    # TODO: Remove this patch when we have a systemd version
+    # with https://github.com/systemd/systemd/pull/6678
+    (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/58a78ae77063eddfcd23ea272bd2e0ddc9ea3ff7.patch";
+        sha256 = "1y09n176f0389qrfrs3fsxj4hly1y1xfnb52rhbgj34704adp5m1";
+    })
+  ];
+
   preConfigure =
     ''
       unset RANLIB

From 2cc7f1a7312bb6630086292e3905b8d647e0aa09 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Aug 2017 16:46:25 -0400
Subject: [PATCH 019/134] gettext: libiconv should be a buildInput

---
 pkgs/development/libraries/gettext/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index b96c4599994b..ee74836df81d 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -45,7 +45,9 @@ stdenv.mkDerivation rec {
     fi
   '';
 
-  nativeBuildInputs = [ xz xz.bin ] ++ stdenv.lib.optional (!stdenv.isLinux && !hostPlatform.isCygwin) libiconv; # HACK, see #10874 (and 14664)
+  nativeBuildInputs = [ xz xz.bin ];
+  # HACK, see #10874 (and 14664)
+  buildInputs = stdenv.lib.optional (!stdenv.isLinux && !hostPlatform.isCygwin) libiconv;
 
   enableParallelBuilding = true;
 

From c4f18901b425a9ffc8a4367666bc454a95bf1f4c Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Wed, 30 Aug 2017 22:44:42 +0200
Subject: [PATCH 020/134] darwin: move definition to separate file

---
 pkgs/top-level/all-packages.nix    | 49 ++-------------------------
 pkgs/top-level/darwin-packages.nix | 54 ++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 47 deletions(-)
 create mode 100644 pkgs/top-level/darwin-packages.nix

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a13b896db199..e1f96698e2a2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11837,53 +11837,8 @@ with pkgs;
 
   crda = callPackage ../os-specific/linux/crda { };
 
-  darwin = let
-    apple-source-releases = callPackage ../os-specific/darwin/apple-source-releases { };
-  in (apple-source-releases // rec {
-    cctools = callPackage ../os-specific/darwin/cctools/port.nix {
-      inherit libobjc;
-      stdenv = if stdenv.isDarwin then stdenv else libcxxStdenv;
-      inherit maloader;
-      xctoolchain = xcode.toolchain;
-    };
-
-    cf-private = callPackage ../os-specific/darwin/cf-private {
-      inherit (apple-source-releases) CF;
-      inherit osx_private_sdk;
-    };
-
-    maloader = callPackage ../os-specific/darwin/maloader {
-      inherit opencflite;
-    };
-
-    opencflite = callPackage ../os-specific/darwin/opencflite {};
-
-    swift-corefoundation = callPackage ../os-specific/darwin/swift-corefoundation {};
-
-    ios-cross = callPackage ../os-specific/darwin/ios-cross {
-      inherit (darwin) binutils;
-    };
-
-    xcode = callPackage ../os-specific/darwin/xcode {};
-
-    osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk {};
-
-    security_tool = (newScope (darwin.apple_sdk.frameworks // darwin)) ../os-specific/darwin/security-tool {
-      Security-framework = darwin.apple_sdk.frameworks.Security;
-    };
-
-    binutils = callPackage ../os-specific/darwin/binutils { inherit cctools; };
-
-    apple_sdk = callPackage ../os-specific/darwin/apple-sdk {};
-
-    libobjc = apple-source-releases.objc4;
-
-    stubs = callPackages ../os-specific/darwin/stubs {};
-
-    usr-include = callPackage ../os-specific/darwin/usr-include {};
-
-    DarwinTools = callPackage ../os-specific/darwin/DarwinTools {};
-  });
+  # Darwin package set
+  darwin = callPackages ./darwin-packages.nix { };
 
   devicemapper = lvm2;
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
new file mode 100644
index 000000000000..4fa86a3a1210
--- /dev/null
+++ b/pkgs/top-level/darwin-packages.nix
@@ -0,0 +1,54 @@
+{ pkgs, darwin, stdenv, callPackage, callPackages, newScope }:
+
+let
+  apple-source-releases = callPackage ../os-specific/darwin/apple-source-releases { };
+in
+
+(apple-source-releases // {
+
+  apple_sdk = callPackage ../os-specific/darwin/apple-sdk { };
+
+  binutils = callPackage ../os-specific/darwin/binutils {
+    inherit (darwin) cctools;
+  };
+
+  cctools = callPackage ../os-specific/darwin/cctools/port.nix {
+    inherit (darwin) libobjc maloader;
+    stdenv = if stdenv.isDarwin then stdenv else pkgs.libcxxStdenv;
+    xctoolchain = darwin.xcode.toolchain;
+  };
+
+  cf-private = callPackage ../os-specific/darwin/cf-private {
+    inherit (apple-source-releases) CF;
+    inherit (darwin) osx_private_sdk;
+  };
+
+  DarwinTools = callPackage ../os-specific/darwin/DarwinTools { };
+
+  maloader = callPackage ../os-specific/darwin/maloader {
+    inherit (darwin) opencflite;
+  };
+
+  ios-cross = callPackage ../os-specific/darwin/ios-cross {
+    inherit (darwin) binutils;
+  };
+
+  libobjc = apple-source-releases.objc4;
+
+  opencflite = callPackage ../os-specific/darwin/opencflite { };
+
+  osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { };
+
+  security_tool = (newScope (darwin.apple_sdk.frameworks // darwin)) ../os-specific/darwin/security-tool {
+    Security-framework = darwin.apple_sdk.frameworks.Security;
+  };
+
+  stubs = callPackages ../os-specific/darwin/stubs { };
+
+  swift-corefoundation = callPackage ../os-specific/darwin/swift-corefoundation { };
+
+  usr-include = callPackage ../os-specific/darwin/usr-include { };
+
+  xcode = callPackage ../os-specific/darwin/xcode { };
+
+})

From 3979f48f7fdd11af4946488449340f8d50bba079 Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Wed, 30 Aug 2017 22:48:33 +0200
Subject: [PATCH 021/134] darwin: add callPackage

---
 pkgs/top-level/darwin-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 4fa86a3a1210..32d540a8f967 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -6,6 +6,8 @@ in
 
 (apple-source-releases // {
 
+  callPackage = newScope (darwin.apple_sdk.frameworks // darwin);
+
   apple_sdk = callPackage ../os-specific/darwin/apple-sdk { };
 
   binutils = callPackage ../os-specific/darwin/binutils {
@@ -39,7 +41,7 @@ in
 
   osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { };
 
-  security_tool = (newScope (darwin.apple_sdk.frameworks // darwin)) ../os-specific/darwin/security-tool {
+  security_tool = darwin.callPackage ../os-specific/darwin/security-tool {
     Security-framework = darwin.apple_sdk.frameworks.Security;
   };
 

From 095af3e63b26e4984c95de7d8a495503e6bfa605 Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix+github@lancelotsix.com>
Date: Thu, 31 Aug 2017 16:38:02 +0200
Subject: [PATCH 022/134] libgcrypt: 1.8.0 -> 1.8.1

Fixes CVE-2017-0379

See http://lists.gnu.org/archive/html/info-gnu/2017-08/msg00014.html
for release announcement
---
 pkgs/development/libraries/libgcrypt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 732f3710563a..34a3ed65b124 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -4,11 +4,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libgcrypt-${version}";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${name}.tar.bz2";
-    sha256 = "06w97l88y2c29zf8p8cg0m4k2kiiyj6pqxdl0cxigi3wp2brdr13";
+    sha256 = "1cvqd9jk5qshbh48yh3ixw4zyr4n5k50r3475rrh20xfn7w7aa3s";
   };
 
   outputs = [ "out" "dev" "info" ];

From 3b6e7fe123ad8dec62e780bac6efe7754a3cbca4 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 12:37:48 -0400
Subject: [PATCH 023/134] darwin-stdenv: Don't use `nativeTools`

Now, we'll actually use the wrapped ld to link
---
 pkgs/stdenv/darwin/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 6739ce3f5c8f..9070f4b6dca9 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -79,15 +79,17 @@ in rec {
           inherit shell;
           inherit (last) stdenv;
 
-          nativeTools  = true;
-          nativePrefix = bootstrapTools;
+          nativeTools  = false;
           nativeLibc   = false;
           buildPackages = lib.optionalAttrs (last ? stdenv) {
             inherit (last) stdenv;
           };
           libc         = last.pkgs.darwin.Libsystem;
           isClang      = true;
-          cc           = { name = "clang-9.9.9"; outPath = bootstrapTools; };
+          cc           = { name = "clang-9.9.9";     outPath = bootstrapTools; };
+          binutils     = { name = "binutils-9.9.9";  outPath = bootstrapTools; };
+          coreutils    = { name = "coreutils-9.9.9"; outPath = bootstrapTools; };
+          gnugrep      = { name = "gnugrep-9.9.9";   outPath = bootstrapTools; };
         };
 
         preHook = stage0.stdenv.lib.optionalString (shell == "${bootstrapTools}/bin/bash") ''

From 46fd4bcb1469434163d8f873ee57f761009008e8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Aug 2017 15:38:33 -0400
Subject: [PATCH 024/134] cc-wrapper: Remove {START,EXEC}_HOOK

These are no longer used by anything
---
 pkgs/build-support/cc-wrapper/add-flags.sh        | 5 -----
 pkgs/build-support/cc-wrapper/cc-wrapper.sh       | 8 --------
 pkgs/build-support/cc-wrapper/gnat-wrapper.sh     | 8 --------
 pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh | 4 ----
 pkgs/build-support/cc-wrapper/ld-wrapper.sh       | 8 --------
 5 files changed, 33 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 4d28ba08d103..4f5946a887eb 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -5,11 +5,6 @@
 # wrapped binary just inherit the work of the forker's wrapper script.
 
 var_templates=(
-    NIX_CC_WRAPPER+START_HOOK
-    NIX_CC_WRAPPER+EXEC_HOOK
-    NIX_LD_WRAPPER+START_HOOK
-    NIX_LD_WRAPPER+EXEC_HOOK
-
     NIX+CFLAGS_COMPILE
     NIX+CFLAGS_LINK
     NIX+CXXSTDLIB_COMPILE
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 6099535600c7..aacaf196f313 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -15,10 +15,6 @@ if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-if [ -n "$NIX_CC_WRAPPER_@infixSalt@_START_HOOK" ]; then
-    source "$NIX_CC_WRAPPER_@infixSalt@_START_HOOK"
-fi
-
 source @out@/nix-support/utils.sh
 
 
@@ -175,10 +171,6 @@ if [ -n "${NIX_DEBUG:-}" ]; then
     printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
 fi
 
-if [ -n "$NIX_CC_WRAPPER_@infixSalt@_EXEC_HOOK" ]; then
-    source "$NIX_CC_WRAPPER_@infixSalt@_EXEC_HOOK"
-fi
-
 PATH="$path_backup"
 # Old bash workaround, see above.
 exec @prog@ \
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index 1a09f4841098..f0c922a3d5b4 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -17,10 +17,6 @@ if [ -z "${NIX_@infixSalt@_GNAT_WRAPPER_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_START_HOOK" ]; then
-    source "$NIX_@infixSalt@_GNAT_WRAPPER_START_HOOK"
-fi
-
 source @out@/nix-support/utils.sh
 
 
@@ -122,9 +118,5 @@ if [ -n "${NIX_DEBUG:-}" ]; then
     printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
-if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK" ]; then
-    source "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK"
-fi
-
 PATH="$path_backup"
 exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
index ee973d3270f9..2de748b5f31e 100644
--- a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
@@ -33,8 +33,4 @@ if [ -n "${NIX_DEBUG:-}" ]; then
     printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
-if [ -n "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK" ]; then
-    source "$NIX_@infixSalt@_GNAT_WRAPPER_EXEC_HOOK"
-fi
-
 exec @prog@ "${extraBefore[@]}" "$@" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 38712665e432..ce0b0143fb00 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -14,10 +14,6 @@ if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-if [ -n "$NIX_LD_WRAPPER_@infixSalt@_START_HOOK" ]; then
-    source "$NIX_LD_WRAPPER_@infixSalt@_START_HOOK"
-fi
-
 source @out@/nix-support/utils.sh
 
 
@@ -170,10 +166,6 @@ if [ -n "${NIX_DEBUG:-}" ]; then
     printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
 fi
 
-if [ -n "$NIX_LD_WRAPPER_@infixSalt@_EXEC_HOOK" ]; then
-    source "$NIX_LD_WRAPPER_@infixSalt@_EXEC_HOOK"
-fi
-
 PATH="$path_backup"
 # Old bash workaround, see above.
 exec @prog@ \

From 3d3a6e0fac471e479a0ab91f3088a327292e4dc7 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 13:54:32 -0400
Subject: [PATCH 025/134] cc-wrapper: Remove support for NIX_LDFLAGS_HARDEN

It has long been deprecated
---
 pkgs/build-support/cc-wrapper/add-flags.sh  | 1 -
 pkgs/build-support/cc-wrapper/ld-wrapper.sh | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 4f5946a887eb..39633fce69a8 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -14,7 +14,6 @@ var_templates=(
     NIX+LDFLAGS
     NIX+LDFLAGS_BEFORE
     NIX+LDFLAGS_AFTER
-    NIX+LDFLAGS_HARDEN
 
     NIX+SET_BUILD_ID
     NIX+DONT_SET_RPATH
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index ce0b0143fb00..a9cc1e3f9e6f 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -61,7 +61,7 @@ if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
     extraBefore+=($NIX_@infixSalt@_LDFLAGS_BEFORE)
 fi
 
-extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER $NIX_@infixSalt@_LDFLAGS_HARDEN)
+extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER)
 
 declare -a libDirs
 declare -A libs

From 8dbdc5dd514cd727eb20d5af4c4d303e39a5b49c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 18:07:29 -0400
Subject: [PATCH 026/134] darwin-stdenv: Hack around impurity with --disable
 configure flag

---
 pkgs/stdenv/darwin/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 9070f4b6dca9..f4801d674e8a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -269,7 +269,16 @@ in rec {
     extraPreHook = ''
       export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
     '';
-    overrides = persistent;
+    overrides = self: super: (persistent self super) // {
+      # Hack to make sure we don't link ncurses in bootstrap tools. The proper
+      # solution is to avoid passing -L/nix-store/...-bootstrap-tools/lib,
+      # quite a sledgehammer just to get the C runtime.
+      gettext = super.gettext.overrideAttrs (old: {
+         configureFlags = old.configureFlags ++ [
+           "--disable-curses"
+         ];
+      });
+    };
   };
 
   stdenvDarwin = prevStage: let

From d70006c6d95d581db203492514ea3fc82d61113b Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Fri, 1 Sep 2017 00:46:26 +0000
Subject: [PATCH 027/134] mkDerivation: fix hardening flags check

- allow "all" in hardeningDisable
- fix busybox flags
- print detailed error message

Discussed at https://github.com/NixOS/nixpkgs/pull/28555#issuecomment-326413032
---
 pkgs/os-specific/linux/busybox/default.nix |  2 +-
 pkgs/stdenv/generic/make-derivation.nix    | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ee897fc37813..6c9c43e4e5a9 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pv3vs2w4l2wnw5qb0rkbpvjjdd1fwjv87miavqq0r0ynqbfajwx";
   };
 
-  hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
+  hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
 
   patches = [ ./busybox-in-store.patch ];
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index b9d8b2d31175..c2f4f1c7b281 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -47,15 +47,14 @@ rec {
     , ... } @ attrs:
 
     # TODO(@Ericson2314): Make this more modular, and not O(n^2).
-    let allHardeningFlags = [
-      "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro"
-      "bindnow"
-    ];
-    in assert lib.all
-      (flag: lib.elem flag allHardeningFlags)
-      (hardeningEnable ++ hardeningDisable);
-
     let
+      supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
+      erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
+    in if builtins.length erroneousHardeningFlags != 0
+    then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
+      inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
+    })
+    else let
       dependencies = map lib.chooseDevOutputs [
         (map (drv: drv.nativeDrv or drv) nativeBuildInputs
            ++ lib.optional separateDebugInfo ../../build-support/setup-hooks/separate-debug-info.sh

From 94c0267fc1d2dc8db27d9c4ff07dcb4d3fb23df5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Aug 2017 14:57:20 -0400
Subject: [PATCH 028/134] cc-wrapper: Clean up dynamic linking with x86
 multilib

It's better layering to do everything in ld-wrapper.
---
 pkgs/build-support/cc-wrapper/cc-wrapper.sh |  4 ----
 pkgs/build-support/cc-wrapper/ld-wrapper.sh | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index aacaf196f313..e4ffe53e2613 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -57,10 +57,6 @@ while (( "$n" < "$nParams" )); do
         cppInclude=0
     elif [ "${p:0:1}" != - ]; then
         nonFlagArgs=1
-    elif [ "$p" = -m32 ]; then
-        if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_@infixSalt@_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
-        fi
     fi
     n+=1
 done
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index a9cc1e3f9e6f..a80f0a1e09b8 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -63,6 +63,21 @@ fi
 
 extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER)
 
+# Choose 32-bit dynamic linker if needed
+if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
+    prev=
+    for p in ${params+"${params[@]}"}; do
+        if [[ "$prev" = "-m" && "$p" = "elf_i386" ]]; then
+           extraAfter+=(
+               '-dynamic-linker'
+               "$(< @out@/nix-support/dynamic-linker-m32)"
+           )
+           break
+        fi
+        prev="$p"
+    done
+fi
+
 declare -a libDirs
 declare -A libs
 relocatable=

From 1f5807d760bd82aab510d8e75016f10ea886919e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 14:43:09 -0400
Subject: [PATCH 029/134] cc-wrapper: Pull variable mangler into utils.sh

In preparation for splitting out binutils-wrapper
---
 pkgs/build-support/cc-wrapper/add-flags.sh    | 11 +----------
 pkgs/build-support/cc-wrapper/cc-wrapper.sh   |  4 ++--
 pkgs/build-support/cc-wrapper/gnat-wrapper.sh |  4 ++--
 pkgs/build-support/cc-wrapper/ld-wrapper.sh   |  4 ++--
 pkgs/build-support/cc-wrapper/utils.sh        | 17 +++++++++++++++++
 5 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 39633fce69a8..5f7c071fb9cf 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -36,16 +36,7 @@ fi
 # We need to mangle names for hygiene, but also take parameters/overrides
 # from the environment.
 for var in "${var_templates[@]}"; do
-    outputVar="${var/+/_@infixSalt@_}"
-    export ${outputVar}+=''
-    # For each role we serve, we accumulate the input parameters into our own
-    # cc-wrapper-derivation-specific environment variables.
-    for infix in "${role_infixes[@]}"; do
-        inputVar="${var/+/${infix}}"
-        if [ -v "$inputVar" ]; then
-            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
-        fi
-    done
+    mangleVarList "$var" "${role_infixes[@]}"
 done
 
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index e4ffe53e2613..3a471c293ccf 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -11,12 +11,12 @@ if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
     PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
 fi
 
+source @out@/nix-support/utils.sh
+
 if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-source @out@/nix-support/utils.sh
-
 
 # Parse command line options and set several variables.
 # For instance, figure out if linker flags should be passed.
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index f0c922a3d5b4..63e5d99d5017 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -13,12 +13,12 @@ if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
+source @out@/nix-support/utils.sh
+
 if [ -z "${NIX_@infixSalt@_GNAT_WRAPPER_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-source @out@/nix-support/utils.sh
-
 
 # Figure out if linker flags should be passed.  GCC prints annoying
 # warnings when they are not needed.
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index a80f0a1e09b8..97e4e45decf1 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -10,12 +10,12 @@ if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
+source @out@/nix-support/utils.sh
+
 if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
-source @out@/nix-support/utils.sh
-
 
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
diff --git a/pkgs/build-support/cc-wrapper/utils.sh b/pkgs/build-support/cc-wrapper/utils.sh
index c84a094e26b0..3637d1241e88 100644
--- a/pkgs/build-support/cc-wrapper/utils.sh
+++ b/pkgs/build-support/cc-wrapper/utils.sh
@@ -1,3 +1,20 @@
+mangleVarList() {
+    declare var="$1"
+    shift
+    declare -a role_infixes=("$@")
+
+    outputVar="${var/+/_@infixSalt@_}"
+    export ${outputVar}+=''
+    # For each role we serve, we accumulate the input parameters into our own
+    # cc-wrapper-derivation-specific environment variables.
+    for infix in "${role_infixes[@]}"; do
+        inputVar="${var/+/${infix}}"
+        if [ -v "$inputVar" ]; then
+            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
+        fi
+    done
+}
+
 skip () {
     if [ -n "${NIX_DEBUG:-}" ]; then
         echo "skipping impure path $1" >&2

From fbb7d335db6cee4130314c15cac457e506db79a7 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 15:29:03 -0400
Subject: [PATCH 030/134] cc-wrapper: Use separate mangler for "bool" variables

This avoids any `NIX_FOOBAR=1 1` not triggering conditions.
---
 pkgs/build-support/cc-wrapper/add-flags.sh |  9 ++++++--
 pkgs/build-support/cc-wrapper/utils.sh     | 25 +++++++++++++++++-----
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 5f7c071fb9cf..978041fb4d87 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -4,7 +4,7 @@
 # that case, it is cheaper/better to not repeat this step and let the forked
 # wrapped binary just inherit the work of the forker's wrapper script.
 
-var_templates=(
+var_templates_list=(
     NIX+CFLAGS_COMPILE
     NIX+CFLAGS_LINK
     NIX+CXXSTDLIB_COMPILE
@@ -14,7 +14,9 @@ var_templates=(
     NIX+LDFLAGS
     NIX+LDFLAGS_BEFORE
     NIX+LDFLAGS_AFTER
+)
 
+var_templates_bool=(
     NIX+SET_BUILD_ID
     NIX+DONT_SET_RPATH
     NIX+ENFORCE_NO_NATIVE
@@ -35,9 +37,12 @@ fi
 
 # We need to mangle names for hygiene, but also take parameters/overrides
 # from the environment.
-for var in "${var_templates[@]}"; do
+for var in "${var_templates_list[@]}"; do
     mangleVarList "$var" "${role_infixes[@]}"
 done
+for var in "${var_templates_bool[@]}"; do
+    mangleVarBool "$var" "${role_infixes[@]}"
+done
 
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
 NIX_@infixSalt@_CFLAGS_COMPILE="-B@out@/bin/ $NIX_@infixSalt@_CFLAGS_COMPILE"
diff --git a/pkgs/build-support/cc-wrapper/utils.sh b/pkgs/build-support/cc-wrapper/utils.sh
index 3637d1241e88..a9ab2b23f24d 100644
--- a/pkgs/build-support/cc-wrapper/utils.sh
+++ b/pkgs/build-support/cc-wrapper/utils.sh
@@ -1,20 +1,35 @@
 mangleVarList() {
-    declare var="$1"
+    local var="$1"
     shift
-    declare -a role_infixes=("$@")
+    local -a role_infixes=("$@")
 
-    outputVar="${var/+/_@infixSalt@_}"
-    export ${outputVar}+=''
+    local outputVar="${var/+/_@infixSalt@_}"
+    declare -gx ${outputVar}+=''
     # For each role we serve, we accumulate the input parameters into our own
     # cc-wrapper-derivation-specific environment variables.
     for infix in "${role_infixes[@]}"; do
-        inputVar="${var/+/${infix}}"
+        local inputVar="${var/+/${infix}}"
         if [ -v "$inputVar" ]; then
             export ${outputVar}+="${!outputVar:+ }${!inputVar}"
         fi
     done
 }
 
+mangleVarBool() {
+    local var="$1"
+    shift
+    local -a role_infixes=("$@")
+
+    local outputVar="${var/+/_@infixSalt@_}"
+    declare -gxi ${outputVar}+=''
+    for infix in "${role_infixes[@]}"; do
+        local inputVar="${var/+/${infix}}"
+        if [ -v "$inputVar" ]; then
+            let "${outputVar} |= ${!inputVar}"
+        fi
+    done
+}
+
 skip () {
     if [ -n "${NIX_DEBUG:-}" ]; then
         echo "skipping impure path $1" >&2

From 40e9b2a7e6490eef782e5c34703a99e61fae7017 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 28 Aug 2017 14:56:08 -0400
Subject: [PATCH 031/134] binutils-wrapper: Init

Factor a binutils wrapper out of cc-wrapper. While only LD is wrapped,
the setup hook defines environment variables on behalf of other
utilites.
---
 .../binutils-wrapper/add-flags.sh             |  40 +++
 .../binutils-wrapper/add-hardening.sh         |  53 ++++
 .../binutils-wrapper/default.nix              | 288 ++++++++++++++++++
 .../ld-solaris-wrapper.sh                     |   0
 .../ld-wrapper.sh                             |   2 +-
 .../binutils-wrapper/setup-hook.sh            |  63 ++++
 pkgs/build-support/cc-wrapper/add-flags.sh    |  19 +-
 .../build-support/cc-wrapper/add-hardening.sh |  10 -
 pkgs/build-support/cc-wrapper/cc-wrapper.sh   |   6 +
 pkgs/build-support/cc-wrapper/default.nix     | 139 ++-------
 .../macos-sierra-reexport-hack.bash           | 106 -------
 pkgs/build-support/cc-wrapper/setup-hook.sh   |  23 --
 12 files changed, 482 insertions(+), 267 deletions(-)
 create mode 100644 pkgs/build-support/binutils-wrapper/add-flags.sh
 create mode 100644 pkgs/build-support/binutils-wrapper/add-hardening.sh
 create mode 100644 pkgs/build-support/binutils-wrapper/default.nix
 rename pkgs/build-support/{cc-wrapper => binutils-wrapper}/ld-solaris-wrapper.sh (100%)
 mode change 100755 => 100644
 rename pkgs/build-support/{cc-wrapper => binutils-wrapper}/ld-wrapper.sh (98%)
 create mode 100644 pkgs/build-support/binutils-wrapper/setup-hook.sh
 delete mode 100644 pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash

diff --git a/pkgs/build-support/binutils-wrapper/add-flags.sh b/pkgs/build-support/binutils-wrapper/add-flags.sh
new file mode 100644
index 000000000000..a69e2313af3b
--- /dev/null
+++ b/pkgs/build-support/binutils-wrapper/add-flags.sh
@@ -0,0 +1,40 @@
+# See cc-wrapper for comments.
+var_templates_list=(
+    NIX+IGNORE_LD_THROUGH_GCC
+    NIX+LDFLAGS
+    NIX+LDFLAGS_BEFORE
+    NIX+LDFLAGS_AFTER
+    NIX+LDFLAGS_HARDEN
+)
+var_templates_bool=(
+    NIX+SET_BUILD_ID
+    NIX+DONT_SET_RPATH
+)
+
+declare -a role_infixes=()
+if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then
+    role_infixes+=(_BUILD_)
+fi
+if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then
+    role_infixes+=(_)
+fi
+if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
+    role_infixes+=(_TARGET_)
+fi
+
+for var in "${var_templates_list[@]}"; do
+    mangleVarList "$var" "${role_infixes[@]}"
+done
+for var in "${var_templates_bool[@]}"; do
+    mangleVarBool "$var" "${role_infixes[@]}"
+done
+
+if [ -e @out@/nix-support/libc-ldflags ]; then
+    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
+fi
+
+if [ -e @out@/nix-support/libc-ldflags-before ]; then
+    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
+fi
+
+export NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET=1
diff --git a/pkgs/build-support/binutils-wrapper/add-hardening.sh b/pkgs/build-support/binutils-wrapper/add-hardening.sh
new file mode 100644
index 000000000000..6dabc2007bc9
--- /dev/null
+++ b/pkgs/build-support/binutils-wrapper/add-hardening.sh
@@ -0,0 +1,53 @@
+hardeningFlags=(relro bindnow)
+# Intentionally word-split in case 'hardeningEnable' is defined in
+# Nix. Also, our bootstrap tools version of bash is old enough that
+# undefined arrays trip `set -u`.
+if [[ -v hardeningEnable[@] ]]; then
+  hardeningFlags+=(${hardeningEnable[@]})
+fi
+hardeningLDFlags=()
+
+declare -A hardeningDisableMap
+
+# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
+for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
+do
+  hardeningDisableMap[$flag]=1
+done
+
+if [[ -n "${NIX_DEBUG:-}" ]]; then
+  printf 'HARDENING: disabled flags:' >&2
+  (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
+  echo >&2
+fi
+
+if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
+  if [[ -n "${NIX_DEBUG:-}" ]]; then
+    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
+  fi
+  for flag in "${hardeningFlags[@]}"
+  do
+    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
+      case $flag in
+        pie)
+          if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
+            if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
+            hardeningLDFlags+=('-pie')
+          fi
+          ;;
+        relro)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
+          hardeningLDFlags+=('-z' 'relro')
+          ;;
+        bindnow)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
+          hardeningLDFlags+=('-z' 'now')
+          ;;
+        *)
+          # Ignore unsupported. Checked in Nix that at least *some*
+          # tool supports each flag.
+          ;;
+      esac
+    fi
+  done
+fi
diff --git a/pkgs/build-support/binutils-wrapper/default.nix b/pkgs/build-support/binutils-wrapper/default.nix
new file mode 100644
index 000000000000..e885078c3de7
--- /dev/null
+++ b/pkgs/build-support/binutils-wrapper/default.nix
@@ -0,0 +1,288 @@
+# The Nixpkgs CC is not directly usable, since it doesn't know where
+# the C library and standard header files are. Therefore the compiler
+# produced by that package cannot be installed directly in a user
+# environment and used from the command line. So we use a wrapper
+# script that sets up the right environment variables so that the
+# compiler and the linker just "work".
+
+{ name ? "", stdenv, nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
+, binutils ? null, libc ? null
+, coreutils ? null, shell ? stdenv.shell, gnugrep ? null
+, extraPackages ? [], extraBuildCommands ? ""
+, buildPackages ? {}
+, useMacosReexportHack ? false
+}:
+
+with stdenv.lib;
+
+assert nativeTools -> nativePrefix != "";
+assert !nativeTools ->
+  binutils != null && coreutils != null && gnugrep != null;
+assert !(nativeLibc && noLibc);
+assert (noLibc || nativeLibc) == (libc == null);
+
+let
+  inherit (stdenv) hostPlatform targetPlatform;
+
+  # Prefix for binaries. Customarily ends with a dash separator.
+  #
+  # TODO(@Ericson2314) Make unconditional, or optional but always true by
+  # default.
+  prefix = stdenv.lib.optionalString (targetPlatform != hostPlatform)
+                                     (targetPlatform.config + "-");
+
+  binutilsVersion = (builtins.parseDrvName binutils.name).version;
+  binutilsName = (builtins.parseDrvName binutils.name).name;
+
+  libc_bin = if libc == null then null else getBin libc;
+  libc_dev = if libc == null then null else getDev libc;
+  libc_lib = if libc == null then null else getLib libc;
+  binutils_bin = if nativeTools then "" else getBin binutils;
+  # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
+  coreutils_bin = if nativeTools then "" else getBin coreutils;
+
+  dashlessTarget = stdenv.lib.replaceStrings ["-"] ["_"] targetPlatform.config;
+
+  # See description in cc-wrapper.
+  infixSalt = dashlessTarget;
+
+  # The dynamic linker has different names on different platforms. This is a
+  # shell glob that ought to match it.
+  dynamicLinker =
+    /**/ if libc == null then null
+    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
+    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
+    # ARM with a wildcard, which can be "" or "-armhf".
+    else if targetPlatform.isArm                      then "${libc_lib}/lib/ld-linux*.so.3"
+    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
+    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
+    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
+    else null;
+
+  expand-response-params =
+    if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
+    then import ../expand-response-params { inherit (buildPackages) stdenv; }
+    else "";
+
+in
+
+stdenv.mkDerivation {
+  name = prefix
+    + (if name != "" then name else "${binutilsName}-wrapper")
+    + (stdenv.lib.optionalString (binutils != null && binutilsVersion != "") "-${binutilsVersion}");
+
+  preferLocalBuild = true;
+
+  inherit binutils_bin shell libc_bin libc_dev libc_lib coreutils_bin;
+  gnugrep_bin = if nativeTools then "" else gnugrep;
+
+  binPrefix = prefix;
+  inherit infixSalt;
+
+  outputs = [ "out" "man" ];
+
+  passthru = {
+    inherit libc nativeTools nativeLibc nativePrefix prefix;
+
+    emacsBufferSetup = pkgs: ''
+      ; We should handle propagation here too
+      (mapc
+        (lambda (arg)
+          (when (file-directory-p (concat arg "/lib"))
+            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
+          (when (file-directory-p (concat arg "/lib64"))
+            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64"))))
+        '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
+    '';
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    src=$PWD
+  '';
+
+  installPhase =
+    ''
+      set -u
+
+      mkdir -p $out/bin $out/nix-support $man/nix-support
+
+      wrap() {
+        local dst="$1"
+        local wrapper="$2"
+        export prog="$3"
+        set +u
+        substituteAll "$wrapper" "$out/bin/$dst"
+        set -u
+        chmod +x "$out/bin/$dst"
+      }
+    ''
+
+    + (if nativeTools then ''
+      echo ${nativePrefix} > $out/nix-support/orig-binutils
+
+      ldPath="${nativePrefix}/bin"
+    '' else ''
+      echo $binutils_bin > $out/nix-support/orig-binutils
+
+      ldPath="${binutils_bin}/bin"
+    ''
+
+    + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
+      # Solaris needs an additional ld wrapper.
+      ldPath="${nativePrefix}/bin"
+      exec="$ldPath/${prefix}ld"
+      wrap ld-solaris ${./ld-solaris-wrapper.sh}
+    '')
+
+    + ''
+      # Create a symlink to as (the assembler).
+      if [ -e $ldPath/${prefix}as ]; then
+        ln -s $ldPath/${prefix}as $out/bin/${prefix}as
+      fi
+
+    '' + (if !useMacosReexportHack then ''
+      wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
+    '' else ''
+      ldInner="${prefix}ld-reexport-delegate"
+      wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
+      wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
+      unset ldInner
+    '') + ''
+
+      if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
+        wrap ${prefix}ld.gold ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
+      fi
+
+      if [ -e ${binutils_bin}/bin/ld.bfd ]; then
+        wrap ${prefix}ld.bfd ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
+      fi
+
+      set +u
+    '';
+
+  propagatedBuildInputs = extraPackages;
+
+  setupHook = ./setup-hook.sh;
+
+  postFixup =
+    ''
+      set -u
+    ''
+
+    + optionalString (libc != null) (''
+      ##
+      ## General libc support
+      ##
+
+      echo "-L${libc_lib}/lib" > $out/nix-support/libc-ldflags
+
+      echo "${libc_lib}" > $out/nix-support/orig-libc
+      echo "${libc_dev}" > $out/nix-support/orig-libc-dev
+
+      ##
+      ## Dynamic linker support
+      ##
+
+      if [[ -z ''${dynamicLinker+x} ]]; then
+        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
+        local dynamicLinker="${libc_lib}/lib/ld*.so.?"
+      fi
+
+      # Expand globs to fill array of options
+      dynamicLinker=($dynamicLinker)
+
+      case ''${#dynamicLinker[@]} in
+        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
+        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
+        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
+      esac
+
+      if [ -n "$dynamicLinker" ]; then
+        echo $dynamicLinker > $out/nix-support/dynamic-linker
+
+    '' + (if targetPlatform.isDarwin then ''
+        printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
+    '' else ''
+        if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
+          echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
+        fi
+
+        local ldflagsBefore=(-dynamic-linker "$dynamicLinker")
+    '') + ''
+      fi
+
+      # The dynamic linker is passed in `ldflagsBefore' to allow
+      # explicit overrides of the dynamic linker by callers to ld
+      # (the *last* value counts, so ours should come first).
+      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
+    '')
+
+    + optionalString (!nativeTools) ''
+
+      ##
+      ## User env support
+      ##
+
+      # Propagate the underling unwrapped binutils so that if you
+      # install the wrapper, you get tools like objdump, the manpages,
+      # etc. as well (same for any binaries of libc).
+      printWords ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
+    ''
+
+    + ''
+
+      ##
+      ## Hardening support
+      ##
+
+      # some linkers on some platforms don't support specific -z flags
+      export hardening_unsupported_flags=""
+      if [[ "$($ldPath/${prefix}ld -z now 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
+        hardening_unsupported_flags+=" bindnow"
+      fi
+      if [[ "$($ldPath/${prefix}ld -z relro 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
+        hardening_unsupported_flags+=" relro"
+      fi
+    ''
+
+    + optionalString hostPlatform.isCygwin ''
+      hardening_unsupported_flags+=" pic"
+    ''
+
+    + ''
+      set +u
+      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
+      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
+      substituteAll ${../cc-wrapper/utils.sh} $out/nix-support/utils.sh
+
+      ##
+      ## Extra custom steps
+      ##
+
+    ''
+    + extraBuildCommands;
+
+  inherit dynamicLinker expand-response-params;
+
+  # for substitution in utils.sh
+  expandResponseParams = "${expand-response-params}/bin/expand-response-params";
+
+  crossAttrs = {
+    shell = shell.crossDrv + shell.crossDrv.shellPath;
+  };
+
+  meta =
+    let binutils_ = if binutils != null then binutils else {}; in
+    (if binutils_ ? meta then removeAttrs binutils.meta ["priority"] else {}) //
+    { description =
+        stdenv.lib.attrByPath ["meta" "description"] "System binary utilities" binutils_
+        + " (wrapper script)";
+  } // optionalAttrs useMacosReexportHack {
+    platforms = stdenv.lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh b/pkgs/build-support/binutils-wrapper/ld-solaris-wrapper.sh
old mode 100755
new mode 100644
similarity index 100%
rename from pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
rename to pkgs/build-support/binutils-wrapper/ld-solaris-wrapper.sh
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/binutils-wrapper/ld-wrapper.sh
similarity index 98%
rename from pkgs/build-support/cc-wrapper/ld-wrapper.sh
rename to pkgs/build-support/binutils-wrapper/ld-wrapper.sh
index 97e4e45decf1..dd30c4d55ef7 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/binutils-wrapper/ld-wrapper.sh
@@ -12,7 +12,7 @@ fi
 
 source @out@/nix-support/utils.sh
 
-if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
diff --git a/pkgs/build-support/binutils-wrapper/setup-hook.sh b/pkgs/build-support/binutils-wrapper/setup-hook.sh
new file mode 100644
index 000000000000..3395ddd33919
--- /dev/null
+++ b/pkgs/build-support/binutils-wrapper/setup-hook.sh
@@ -0,0 +1,63 @@
+# Binutils Wrapper hygiene
+#
+# See comments in cc-wrapper's setup hook. This works exactly the same way.
+
+binutilsWrapper_addLDVars () {
+    case $depOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "binutils-wrapper: Error: Cannot be used with $depOffset-offset deps, " >2;
+            return 1 ;;
+    esac
+
+    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
+        export NIX_${role}LDFLAGS+=" -L$1/lib64"
+    fi
+
+    if [[ -d "$1/lib" ]]; then
+        export NIX_${role}LDFLAGS+=" -L$1/lib"
+    fi
+}
+
+if [ -n "${crossConfig:-}" ]; then
+    export NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_BUILD=1
+    role="BUILD_"
+else
+    export NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_HOST=1
+    role=""
+fi
+
+envHooks+=(binutilsWrapper_addLDVars)
+
+# shellcheck disable=SC2157
+if [ -n "@binutils_bin@" ]; then
+    addToSearchPath _PATH @binutils_bin@/bin
+fi
+
+# shellcheck disable=SC2157
+if [ -n "@libc_bin@" ]; then
+    addToSearchPath _PATH @libc_bin@/bin
+fi
+
+# shellcheck disable=SC2157
+if [ -n "@coreutils_bin@" ]; then
+    addToSearchPath _PATH @coreutils_bin@/bin
+fi
+
+# Export tool environment variables so various build systems use the right ones.
+
+export NIX_${role}BINUTILS=@out@
+
+for CMD in \
+    ar as nm objcopy ranlib strip strings size ld windres
+do
+    if
+        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
+    then
+        export "${role}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
+    fi
+done
+
+# No local scope in sourced file
+unset role
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 978041fb4d87..fb6e38302a5d 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -10,15 +10,8 @@ var_templates_list=(
     NIX+CXXSTDLIB_COMPILE
     NIX+CXXSTDLIB_LINK
     NIX+GNATFLAGS_COMPILE
-    NIX+IGNORE_LD_THROUGH_GCC
-    NIX+LDFLAGS
-    NIX+LDFLAGS_BEFORE
-    NIX+LDFLAGS_AFTER
 )
-
 var_templates_bool=(
-    NIX+SET_BUILD_ID
-    NIX+DONT_SET_RPATH
     NIX+ENFORCE_NO_NATIVE
 )
 
@@ -62,17 +55,13 @@ if [ -e @out@/nix-support/gnat-cflags ]; then
     NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
 fi
 
-if [ -e @out@/nix-support/libc-ldflags ]; then
-    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
-fi
-
 if [ -e @out@/nix-support/cc-ldflags ]; then
+    # We don't import this above, but just tack this on know. binutils-wrapper's
+    # add-flags will not clobber it.
+    #
+    # TODO(@Ericson2314): Consider `NIX_@infixSalt@_CFLAGS_LINK` instead
     NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi
 
-if [ -e @out@/nix-support/libc-ldflags-before ]; then
-    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
-fi
-
 # That way forked processes will not extend these environment variables again.
 export NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET=1
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 34358e04194a..3983e866ee1f 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -6,7 +6,6 @@ if [[ -v hardeningEnable[@] ]]; then
   hardeningFlags+=(${hardeningEnable[@]})
 fi
 hardeningCFlags=()
-hardeningLDFlags=()
 
 declare -A hardeningDisableMap
 
@@ -44,7 +43,6 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
             if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
             hardeningCFlags+=('-pie')
-            hardeningLDFlags+=('-pie')
           fi
           ;;
         pic)
@@ -59,14 +57,6 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling format >&2; fi
           hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
           ;;
-        relro)
-          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
-          hardeningLDFlags+=('-z' 'relro')
-          ;;
-        bindnow)
-          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
-          hardeningLDFlags+=('-z' 'now')
-          ;;
         *)
           # Ignore unsupported. Checked in Nix that at least *some*
           # tool supports each flag.
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 3a471c293ccf..524e53098476 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -13,6 +13,12 @@ fi
 
 source @out@/nix-support/utils.sh
 
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+    source @binutils@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
 if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 0114170b8ebc..c9820c27ea5e 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -11,7 +11,7 @@
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
 , useMacosReexportHack ? false
-}:
+} @ args:
 
 with stdenv.lib;
 
@@ -21,14 +21,23 @@ assert !nativeTools ->
 assert !(nativeLibc && noLibc);
 assert (noLibc || nativeLibc) == (libc == null);
 
-assert stdenv.targetPlatform != stdenv.hostPlatform -> runCommand != null;
-
 # For ghdl (the vhdl language provider to gcc) we need zlib in the wrapper.
 assert cc.langVhdl or false -> zlib != null;
 
 let
   inherit (stdenv) hostPlatform targetPlatform;
 
+  binutils = import ../binutils-wrapper {
+    inherit (args) binutils;
+    inherit # name
+      stdenv nativeTools noLibc nativeLibc nativePrefix
+      libc
+      coreutils shell gnugrep
+      extraPackages extraBuildCommands
+      buildPackages
+      useMacosReexportHack;
+  };
+
   # Prefix for binaries. Customarily ends with a dash separator.
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
@@ -43,7 +52,6 @@ let
   libc_dev = if libc == null then null else getDev libc;
   libc_lib = if libc == null then null else getLib libc;
   cc_solib = getLib cc;
-  binutils_bin = if nativeTools then "" else getBin binutils;
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
   coreutils_bin = if nativeTools then "" else getBin coreutils;
 
@@ -59,21 +67,6 @@ let
   # unstable implementation detail, however.
   infixSalt = dashlessTarget;
 
-  # The dynamic linker has different names on different platforms. This is a
-  # shell glob that ought to match it.
-  dynamicLinker =
-    /**/ if libc == null then null
-    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
-    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
-    # ARM with a wildcard, which can be "" or "-armhf".
-    else if targetPlatform.isArm                      then "${libc_lib}/lib/ld-linux*.so.3"
-    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
-    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
-    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
-    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
-    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
-    else null;
-
   expand-response-params =
     if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
     then import ../expand-response-params { inherit (buildPackages) stdenv; }
@@ -88,7 +81,7 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit cc shell libc_bin libc_dev libc_lib binutils_bin coreutils_bin;
+  inherit cc shell libc_bin libc_dev libc_lib binutils coreutils_bin;
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
   binPrefix = prefix;
@@ -102,13 +95,11 @@ stdenv.mkDerivation {
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
-      (mapc (lambda (arg)
-        (when (file-directory-p (concat arg "/include"))
-          (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include")))
-        (when (file-directory-p (concat arg "/lib"))
-          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
-        (when (file-directory-p (concat arg "/lib64"))
-          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64")))) '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
+      (mapc
+        (lambda (arg)
+          (when (file-directory-p (concat arg "/include"))
+            (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include"))))
+        '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
   };
 
@@ -138,45 +129,18 @@ stdenv.mkDerivation {
       echo ${if targetPlatform.isDarwin then cc else nativePrefix} > $out/nix-support/orig-cc
 
       ccPath="${if targetPlatform.isDarwin then cc else nativePrefix}/bin"
-      ldPath="${nativePrefix}/bin"
     '' else ''
       echo $cc > $out/nix-support/orig-cc
 
       ccPath="${cc}/bin"
-      ldPath="${binutils_bin}/bin"
-    ''
-
-    + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
-      # Solaris needs an additional ld wrapper.
-      ldPath="${nativePrefix}/bin"
-      exec="$ldPath/${prefix}ld"
-      wrap ld-solaris ${./ld-solaris-wrapper.sh}
     '')
 
     + ''
-      # Create a symlink to as (the assembler).  This is useful when a
-      # cc-wrapper is installed in a user environment, as it ensures that
-      # the right assembler is called.
-      if [ -e $ldPath/${prefix}as ]; then
-        ln -s $ldPath/${prefix}as $out/bin/${prefix}as
-      fi
-
-    '' + (if !useMacosReexportHack then ''
-      wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
-    '' else ''
-      ldInner="${prefix}ld-reexport-delegate"
-      wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
-      wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
-      unset ldInner
-    '') + ''
-
-      if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
-        wrap ${prefix}ld.gold ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
-      fi
-
-      if [ -e ${binutils_bin}/bin/ld.bfd ]; then
-        wrap ${prefix}ld.bfd ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
-      fi
+      # Create symlinks to everything in the binutils wrapper.
+      for bbin in $binutils/bin/*; do
+        mkdir -p "$out/bin"
+        ln -s "$bbin" "$out/bin/$(basename $bbin)"
+      done
 
       # We export environment variables pointing to the wrapped nonstandard
       # cmds, lest some lousy configure script use those to guess compiler
@@ -236,7 +200,7 @@ stdenv.mkDerivation {
       ln -s $ccPath/${prefix}ghdl $out/bin/${prefix}ghdl
     '';
 
-  propagatedBuildInputs = extraPackages;
+  propagatedBuildInputs = [ binutils ] ++ extraPackages;
 
   setupHook = ./setup-hook.sh;
 
@@ -245,7 +209,7 @@ stdenv.mkDerivation {
       set -u
     ''
 
-    + optionalString (libc != null) (''
+    + optionalString (libc != null) ''
       ##
       ## General libc support
       ##
@@ -263,48 +227,9 @@ stdenv.mkDerivation {
       # another -idirafter is necessary to add that directory again.
       echo "-B${libc_lib}/lib/ -idirafter ${libc_dev}/include -idirafter ${cc}/lib/gcc/*/*/include-fixed" > $out/nix-support/libc-cflags
 
-      echo "-L${libc_lib}/lib" > $out/nix-support/libc-ldflags
-
       echo "${libc_lib}" > $out/nix-support/orig-libc
       echo "${libc_dev}" > $out/nix-support/orig-libc-dev
-
-      ##
-      ## Dynamic linker support
-      ##
-
-      if [[ -z ''${dynamicLinker+x} ]]; then
-        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
-        local dynamicLinker="${libc_lib}/lib/ld*.so.?"
-      fi
-
-      # Expand globs to fill array of options
-      dynamicLinker=($dynamicLinker)
-
-      case ''${#dynamicLinker[@]} in
-        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
-        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
-        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
-      esac
-
-      if [ -n "$dynamicLinker" ]; then
-        echo $dynamicLinker > $out/nix-support/dynamic-linker
-
-    '' + (if targetPlatform.isDarwin then ''
-        printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
-    '' else ''
-        if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
-          echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
-        fi
-
-        local ldflagsBefore=(-dynamic-linker "$dynamicLinker")
-    '') + ''
-      fi
-
-      # The dynamic linker is passed in `ldflagsBefore' to allow
-      # explicit overrides of the dynamic linker by callers to gcc/ld
-      # (the *last* value counts, so ours should come first).
-      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
-    '')
+    ''
 
     + optionalString (!nativeTools) ''
 
@@ -345,7 +270,6 @@ stdenv.mkDerivation {
       # Propagate the wrapped cc so that if you install the wrapper,
       # you get tools like gcov, the manpages, etc. as well (including
       # for binutils and Glibc).
-      printWords ${cc} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
       printWords ${cc.man or ""}  > $man/nix-support/propagated-user-env-packages
     ''
 
@@ -355,14 +279,7 @@ stdenv.mkDerivation {
       ## Hardening support
       ##
 
-      # some linkers on some platforms don't support specific -z flags
       export hardening_unsupported_flags=""
-      if [[ "$($ldPath/${prefix}ld -z now 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
-        hardening_unsupported_flags+=" bindnow"
-      fi
-      if [[ "$($ldPath/${prefix}ld -z relro 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
-        hardening_unsupported_flags+=" relro"
-      fi
     ''
 
     + optionalString hostPlatform.isCygwin ''
@@ -381,7 +298,7 @@ stdenv.mkDerivation {
     ''
     + extraBuildCommands;
 
-  inherit dynamicLinker expand-response-params;
+  inherit expand-response-params;
 
   # for substitution in utils.sh
   expandResponseParams = "${expand-response-params}/bin/expand-response-params";
@@ -396,7 +313,5 @@ stdenv.mkDerivation {
     { description =
         stdenv.lib.attrByPath ["meta" "description"] "System C compiler" cc_
         + " (wrapper script)";
-  } // optionalAttrs useMacosReexportHack {
-    platforms = stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash b/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
deleted file mode 100644
index b7aa7ea5c092..000000000000
--- a/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
+++ /dev/null
@@ -1,106 +0,0 @@
-#! @shell@
-
-set -eu -o pipefail
-
-path_backup="$PATH"
-if [ -n "@coreutils_bin@" ]; then
-  PATH="@coreutils_bin@/bin"
-fi
-
-declare -r recurThreshold=300
-
-declare overflowCount=0
-for ((n=0; n < $#; ++n)); do
-    case "${!n}" in
-        -l*) let overflowCount+=1 ;;
-        -reexport-l*) let overflowCount+=1 ;;
-        *) ;;
-    esac
-done
-
-declare -a allArgs=()
-
-if (( "$overflowCount" <= "$recurThreshold" )); then
-    allArgs=("$@")
-else
-    declare -a childrenLookup=() childrenLink=()
-
-    while (( $# )); do
-        case "$1" in
-            -L/*)
-                childrenLookup+=("$1")
-                allArgs+=("$1")
-                ;;
-            -L)
-                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
-                exit 1
-                ;;
-            -l)
-                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
-                exit 1
-                ;;
-            -lazy_library | -lazy_framework | -lto_library)
-                # We aren't linking any "azy_library", "to_library", etc.
-                allArgs+=("$1")
-                ;;
-            -lazy-l | -weak-l)    allArgs+=("$1") ;;
-                # We can't so easily prevent header issues from these.
-            -lSystem)             allArgs+=("$1") ;;
-                # Special case as indirection seems like a bad idea for something
-                # so fundamental. Can be removed for simplicity.
-            -l?* | -reexport-l?*) childrenLink+=("$1") ;;
-            *)                    allArgs+=("$1") ;;
-        esac
-
-        shift
-    done
-
-    declare n=0
-    while (( $n < "${#childrenLink[@]}" )); do
-        if [[ "${childrenLink[n]}" = -l* ]]; then
-            childrenLink[n]="-reexport${childrenLink[n]}"
-        fi
-        let ++n
-    done
-    unset n
-
-    declare -r outputNameLibless=$(basename $( \
-        if [[ -z "${outputName:+isUndefined}" ]]; then
-            echo unnamed
-        elif [[ "${outputName:0:3}" = lib ]]; then
-            echo "${outputName:3}"
-        else
-            echo "${outputName}"
-        fi))
-    declare -ra children=("$outputNameLibless-reexport-delegate-0" \
-                          "$outputNameLibless-reexport-delegate-1")
-
-    mkdir -p "$out/lib"
-
-    PATH="$PATH:@out@/bin"
-
-    symbolBloatObject=$outputNameLibless-symbol-hack.o
-    if [[ ! -e $symbolBloatObject ]]; then
-        printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
-            | @binPrefix@as -- -o $symbolBloatObject
-    fi
-
-    # first half of libs
-    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
-      -o "$out/lib/lib${children[0]}.dylib" \
-      -install_name "$out/lib/lib${children[0]}.dylib" \
-      "${childrenLookup[@]}" "$symbolBloatObject" \
-      "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
-
-    # second half of libs
-    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
-      -o "$out/lib/lib${children[1]}.dylib" \
-      -install_name "$out/lib/lib${children[1]}.dylib" \
-      "${childrenLookup[@]}" "$symbolBloatObject" \
-      "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
-
-    allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
-fi
-
-PATH="$path_backup"
-exec @prog@ "${allArgs[@]}"
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index e43c1609edb1..9273f50c6670 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -74,14 +74,6 @@ ccWrapper_addCVars () {
         export NIX_${role}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
     fi
 
-    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
-        export NIX_${role}LDFLAGS+=" -L$1/lib64"
-    fi
-
-    if [[ -d "$1/lib" ]]; then
-        export NIX_${role}LDFLAGS+=" -L$1/lib"
-    fi
-
     if [[ -d "$1/Library/Frameworks" ]]; then
         export NIX_${role}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
     fi
@@ -116,11 +108,6 @@ if [ -n "@cc@" ]; then
     addToSearchPath _PATH @cc@/bin
 fi
 
-# shellcheck disable=SC2157
-if [ -n "@binutils_bin@" ]; then
-    addToSearchPath _PATH @binutils_bin@/bin
-fi
-
 # shellcheck disable=SC2157
 if [ -n "@libc_bin@" ]; then
     addToSearchPath _PATH @libc_bin@/bin
@@ -138,15 +125,5 @@ export NIX_${role}CC=@out@
 export ${role}CC=@named_cc@
 export ${role}CXX=@named_cxx@
 
-for CMD in \
-    ar as nm objcopy ranlib strip strings size ld windres
-do
-    if
-        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
-    then
-        export "${role}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
-    fi
-done
-
 # No local scope in sourced file
 unset role

From 3f30cffa559e105017a1f88a8f3667a11a416870 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 28 Aug 2017 16:07:06 -0400
Subject: [PATCH 032/134] misc pkgs: Use $NIX_BINUTILS for when needed

Certain files are now only there instead of $NIX_CC (some are in both)
---
 .../audio/google-musicmanager/default.nix          |  2 +-
 .../google-play-music-desktop-player/default.nix   |  2 +-
 pkgs/applications/audio/renoise/default.nix        |  2 +-
 pkgs/applications/audio/spotify/default.nix        |  2 +-
 pkgs/applications/editors/atom/default.nix         |  4 ++--
 pkgs/applications/editors/brackets/default.nix     |  4 ++--
 pkgs/applications/editors/jetbrains/default.nix    |  2 +-
 pkgs/applications/editors/kodestudio/default.nix   | 14 +++++++-------
 pkgs/applications/editors/lighttable/default.nix   |  2 +-
 pkgs/applications/editors/sublime/default.nix      |  2 +-
 pkgs/applications/editors/sublime3/default.nix     |  2 +-
 pkgs/applications/editors/typora/default.nix       |  2 +-
 pkgs/applications/editors/vscode/default.nix       |  2 +-
 pkgs/applications/graphics/draftsight/default.nix  |  2 +-
 pkgs/applications/misc/adobe-reader/builder.sh     |  2 +-
 pkgs/applications/misc/googleearth/default.nix     |  2 +-
 pkgs/applications/misc/houdini/runtime.nix         |  2 +-
 pkgs/applications/misc/hyper/default.nix           |  2 +-
 pkgs/applications/misc/ipmiview/default.nix        |  4 ++--
 pkgs/applications/misc/kdbplus/default.nix         |  2 +-
 pkgs/applications/misc/kiwix/default.nix           |  2 +-
 pkgs/applications/misc/rescuetime/default.nix      |  2 +-
 pkgs/applications/misc/simplenote/default.nix      |  2 +-
 .../networking/bittorrentsync/generic.nix          |  2 +-
 .../networking/browsers/firefox-bin/default.nix    |  2 +-
 .../networking/browsers/google-chrome/default.nix  |  2 +-
 .../mozilla-plugins/flashplayer/default.nix        |  2 +-
 .../mozilla-plugins/flashplayer/standalone.nix     |  2 +-
 .../mozilla-plugins/google-talk-plugin/default.nix |  2 +-
 .../networking/browsers/opera/default.nix          |  2 +-
 .../browsers/tor-browser-bundle-bin/default.nix    |  2 +-
 .../networking/browsers/vivaldi/default.nix        |  2 +-
 .../networking/cluster/hadoop/default.nix          |  2 +-
 pkgs/applications/networking/dropbox/default.nix   |  2 +-
 .../instant-messengers/discord/default.nix         |  2 +-
 .../instant-messengers/franz/default.nix           |  2 +-
 .../instant-messengers/hipchat/default.nix         |  2 +-
 .../messenger-for-desktop/default.nix              |  2 +-
 .../instant-messengers/rambox/default.nix          |  2 +-
 .../instant-messengers/skypeforlinux/default.nix   |  2 +-
 .../instant-messengers/slack/default.nix           |  2 +-
 .../instant-messengers/teamspeak/client.nix        |  2 +-
 .../instant-messengers/teamspeak/server.nix        |  4 ++--
 .../instant-messengers/viber/default.nix           |  2 +-
 .../instant-messengers/zoom-us/default.nix         |  8 ++++----
 pkgs/applications/networking/insync/default.nix    |  2 +-
 .../mailreaders/nylas-mail-bin/default.nix         |  4 ++--
 .../mailreaders/thunderbird-bin/default.nix        |  2 +-
 .../networking/remote/anydesk/default.nix          |  2 +-
 .../networking/remote/citrix-receiver/default.nix  |  2 +-
 .../networking/resilio-sync/default.nix            |  2 +-
 pkgs/applications/office/marp/default.nix          |  2 +-
 pkgs/applications/office/moneyplex/default.nix     |  4 ++--
 pkgs/applications/office/wpsoffice/default.nix     |  2 +-
 .../science/electronics/eagle/default.nix          |  2 +-
 .../science/logic/saw-tools/default.nix            |  2 +-
 pkgs/applications/science/logic/tptp/default.nix   |  2 +-
 .../science/logic/verifast/default.nix             |  2 +-
 pkgs/applications/science/math/mathematica/10.nix  |  2 +-
 pkgs/applications/science/math/mathematica/9.nix   |  2 +-
 .../science/math/mathematica/default.nix           |  2 +-
 .../science/math/scilab-bin/default.nix            |  2 +-
 .../science/medicine/aliza/default.nix             |  4 ++--
 .../science/programming/fdr/default.nix            |  2 +-
 pkgs/applications/taxes/aangifte-2006/builder.sh   |  2 +-
 pkgs/applications/taxes/aangifte-2007/builder.sh   |  2 +-
 pkgs/applications/taxes/aangifte-2008/builder.sh   |  2 +-
 pkgs/applications/taxes/aangifte-2009/default.nix  |  2 +-
 pkgs/applications/taxes/aangifte-2010/default.nix  |  2 +-
 pkgs/applications/taxes/aangifte-2011/default.nix  |  2 +-
 pkgs/applications/taxes/aangifte-2012/default.nix  |  2 +-
 .../taxes/aangifte-2013-wa/default.nix             |  2 +-
 pkgs/applications/taxes/aangifte-2013/default.nix  |  2 +-
 .../taxes/aangifte-2014-wa/default.nix             |  2 +-
 pkgs/applications/taxes/aangifte-2014/default.nix  |  2 +-
 .../version-management/gitkraken/default.nix       |  2 +-
 pkgs/applications/video/makemkv/builder.sh         |  2 +-
 pkgs/desktops/maxx/default.nix                     |  2 +-
 pkgs/development/arduino/arduino-core/default.nix  |  6 +++---
 pkgs/development/compilers/cmucl/binary.nix        |  2 +-
 pkgs/development/compilers/crystal/default.nix     |  2 +-
 pkgs/development/compilers/cudatoolkit/default.nix |  2 +-
 pkgs/development/compilers/gcc/builder.sh          |  2 +-
 pkgs/development/compilers/ghc/6.10.2-binary.nix   |  2 +-
 pkgs/development/compilers/ghc/7.0.4-binary.nix    |  2 +-
 pkgs/development/compilers/ghc/7.4.2-binary.nix    |  2 +-
 pkgs/development/compilers/gnatboot/default.nix    |  2 +-
 pkgs/development/compilers/mentor/default.nix      |  2 +-
 pkgs/development/compilers/mozart/binary.nix       |  2 +-
 pkgs/development/compilers/opendylan/bin.nix       |  2 +-
 .../compilers/oraclejdk/dlj-bundle-builder.sh      |  4 ++--
 .../compilers/oraclejdk/jdk-linux-base.nix         |  2 +-
 pkgs/development/compilers/rust/binaryBuild.nix    |  8 ++++----
 pkgs/development/compilers/sbcl/bootstrap.nix      |  2 +-
 pkgs/development/compilers/tinycc/default.nix      |  2 +-
 pkgs/development/compilers/zulu/default.nix        |  2 +-
 pkgs/development/interpreters/dart/default.nix     |  2 +-
 pkgs/development/interpreters/rebol/default.nix    |  2 +-
 pkgs/development/libraries/libstdc++5/default.nix  |  5 ++++-
 .../libraries/oracle-instantclient/default.nix     |  2 +-
 pkgs/development/libraries/wtk/builder.sh          |  2 +-
 pkgs/development/misc/amdapp-sdk/default.nix       |  2 +-
 pkgs/development/mobile/flashtool/default.nix      |  2 +-
 pkgs/development/mobile/genymotion/default.nix     |  2 +-
 pkgs/development/tools/electron/default.nix        |  2 +-
 .../tools/misc/saleae-logic/default.nix            |  2 +-
 pkgs/development/tools/node-webkit/nw11.nix        |  4 ++--
 pkgs/development/tools/node-webkit/nw12.nix        |  4 ++--
 pkgs/development/tools/node-webkit/nw9.nix         |  4 ++--
 pkgs/development/tools/phantomjs/default.nix       |  2 +-
 pkgs/development/tools/sauce-connect/default.nix   |  2 +-
 pkgs/development/tools/thrust/default.nix          |  2 +-
 pkgs/development/tools/unity3d/default.nix         |  4 ++--
 pkgs/games/adom/default.nix                        |  2 +-
 pkgs/games/andyetitmoves/default.nix               |  2 +-
 pkgs/games/factorio/default.nix                    |  2 +-
 pkgs/games/oilrush/default.nix                     |  2 +-
 pkgs/games/openarena/default.nix                   |  2 +-
 pkgs/games/planetaryannihilation/default.nix       |  4 ++--
 pkgs/games/scrolls/default.nix                     |  2 +-
 pkgs/games/sdlmame/default.nix                     |  2 +-
 pkgs/games/terraria-server/default.nix             |  4 ++--
 pkgs/games/vessel/default.nix                      |  4 ++--
 pkgs/games/worldofgoo/default.nix                  |  2 +-
 pkgs/misc/cups/drivers/kyocera/default.nix         |  2 +-
 pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix   |  2 +-
 pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh  |  2 +-
 pkgs/misc/cups/drivers/samsung/4.01.17.nix         |  2 +-
 pkgs/misc/cups/drivers/samsung/default.nix         |  2 +-
 pkgs/misc/drivers/gutenprint/bin.nix               |  2 +-
 pkgs/misc/drivers/sundtek/default.nix              |  2 +-
 pkgs/misc/foldingathome/default.nix                |  2 +-
 pkgs/os-specific/linux/amdgpu-pro/default.nix      |  2 +-
 pkgs/os-specific/linux/dmtcp/default.nix           |  2 +-
 .../linux/firmware/raspberrypi/default.nix         |  2 +-
 .../linux/nvidia-x11/builder-legacy173.sh          |  2 +-
 pkgs/os-specific/linux/nvidia-x11/builder.sh       |  2 +-
 pkgs/os-specific/linux/prl-tools/default.nix       |  2 +-
 pkgs/servers/mattermost/default.nix                |  2 +-
 pkgs/servers/meteor/default.nix                    |  6 +++---
 .../monitoring/newrelic-sysmond/default.nix        |  2 +-
 pkgs/servers/sql/oracle-xe/default.nix             |  2 +-
 pkgs/tools/filesystems/yandex-disk/default.nix     |  2 +-
 pkgs/tools/misc/megacli/default.nix                |  2 +-
 pkgs/tools/misc/ocz-ssd-guru/default.nix           |  2 +-
 pkgs/tools/misc/sam-ba/default.nix                 |  2 +-
 pkgs/tools/misc/staruml/default.nix                |  2 +-
 pkgs/tools/misc/xflux/default.nix                  |  2 +-
 pkgs/tools/security/encryptr/default.nix           |  2 +-
 pkgs/tools/security/enpass/default.nix             |  2 +-
 pkgs/tools/security/fprot/default.nix              |  2 +-
 pkgs/tools/security/gorilla-bin/default.nix        |  2 +-
 pkgs/tools/security/keybase-gui/default.nix        |  2 +-
 pkgs/tools/text/xidel/default.nix                  |  2 +-
 pkgs/top-level/haxe-packages.nix                   |  2 +-
 155 files changed, 189 insertions(+), 186 deletions(-)

diff --git a/pkgs/applications/audio/google-musicmanager/default.nix b/pkgs/applications/audio/google-musicmanager/default.nix
index 72bec52b2663..27ce9eb3d133 100644
--- a/pkgs/applications/audio/google-musicmanager/default.nix
+++ b/pkgs/applications/audio/google-musicmanager/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "$out/opt/google/musicmanager:${stdenv.lib.makeLibraryPath [ readline ncurses stdenv.cc.libc.out qt48 stdenv.cc.cc libidn expat flac libvorbis ]}" opt/google/musicmanager/MusicManager
   '';
 
diff --git a/pkgs/applications/audio/google-play-music-desktop-player/default.nix b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
index 9d9af6311832..2f235966a399 100644
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
     cp -r ./usr/share $out
     cp -r ./usr/bin $out
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
              "$out/share/google-play-music-desktop-player/Google Play Music Desktop Player"
 
     wrapProgram $out/bin/google-play-music-desktop-player \
diff --git a/pkgs/applications/audio/renoise/default.nix b/pkgs/applications/audio/renoise/default.nix
index d02c551be8af..6b780cf0a756 100644
--- a/pkgs/applications/audio/renoise/default.nix
+++ b/pkgs/applications/audio/renoise/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     ln -s $out/renoise $out/bin/renoise
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
   '';
 
   meta = {
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index ad0f7ee14c5a..29019c14f85b 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation {
       rpath="$out/share/spotify:$libdir"
 
       patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath $rpath $out/share/spotify/spotify
 
       librarypath="${stdenv.lib.makeLibraryPath deps}:$libdir"
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index e44d919ece6b..ca421e97e4de 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -25,10 +25,10 @@ stdenv.mkDerivation rec {
 
     fixupPhase
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}:$out/share/atom" \
       $out/share/atom/atom
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}" \
       $out/share/atom/resources/app/apm/bin/node
 
diff --git a/pkgs/applications/editors/brackets/default.nix b/pkgs/applications/editors/brackets/default.nix
index 23cb16c0733f..2dd43f9ba3cf 100644
--- a/pkgs/applications/editors/brackets/default.nix
+++ b/pkgs/applications/editors/brackets/default.nix
@@ -36,11 +36,11 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${bracketsLibs}:$out/opt/brackets/lib" \
       $out/opt/brackets/Brackets
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${bracketsLibs}" \
       $out/opt/brackets/Brackets-node
 
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 95f3c0801d2a..5c042f2fe49e 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -35,7 +35,7 @@ let
           ln -s ${cmake} bin/cmake
 
           lldbLibPath=$out/clion-${version}/bin/lldb/lib
-          interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+          interp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
           ln -s ${ncurses.out}/lib/libncurses.so $lldbLibPath/libtinfo.so.5
 
           patchelf --set-interpreter $interp \
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index a0e941289099..ef07d7515aaf 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -50,31 +50,31 @@ in
     postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
       # Patch Binaries
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "$out:${atomEnv.libPath}" \
           $out/kodestudio
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsaLib}/lib:${mesa}/lib:${openssl.out}/lib" \
           $out/resources/app/extensions/krom/Krom/linux/Krom
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib" \
           $out/resources/app/extensions/kha/Kha/Kore/Tools/krafix/krafix-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib" \
           $out/resources/app/extensions/kha/Kha/Kore/Tools/kraffiti/kraffiti-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${stdenv.cc.cc.lib}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/kravur/kravur-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${zlib}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/haxe/haxe-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${libvorbis}/lib:${libogg}/lib:${flac.out}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/oggenc/oggenc-linux64
 
diff --git a/pkgs/applications/editors/lighttable/default.nix b/pkgs/applications/editors/lighttable/default.nix
index 74a83c1278af..d16d2d2cc649 100644
--- a/pkgs/applications/editors/lighttable/default.nix
+++ b/pkgs/applications/editors/lighttable/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     mv ./${name}-linux/* $out/share/LightTable
 
     patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath ${libPath}:${libPath}/lib64:$out/share/LightTable \
       $out/share/LightTable/LightTable
 
diff --git a/pkgs/applications/editors/sublime/default.nix b/pkgs/applications/editors/sublime/default.nix
index 9cf5bd97d0a3..57e00f7227da 100644
--- a/pkgs/applications/editors/sublime/default.nix
+++ b/pkgs/applications/editors/sublime/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
     echo ${libPath}
     patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
       $out/sublime/sublime_text
 
diff --git a/pkgs/applications/editors/sublime3/default.nix b/pkgs/applications/editors/sublime3/default.nix
index c295313621e3..aa19a2ca19af 100644
--- a/pkgs/applications/editors/sublime3/default.nix
+++ b/pkgs/applications/editors/sublime3/default.nix
@@ -50,7 +50,7 @@ in let
     buildPhase = ''
       for i in sublime_text plugin_host crash_reporter; do
         patchelf \
-          --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
           $i
       done
diff --git a/pkgs/applications/editors/typora/default.nix b/pkgs/applications/editors/typora/default.nix
index 0733bd796656..4be9b6dda20f 100644
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
      patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "$out/share/typora:${rpath}" "$out/share/typora/Typora"
 
     ln -s "$out/share/typora/Typora" "$out/bin/typora"
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index 5db2a1aaece4..94e28da28870 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -69,7 +69,7 @@ in
 
     postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
       patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "${rpath}" \
         $out/lib/vscode/code
     '';
diff --git a/pkgs/applications/graphics/draftsight/default.nix b/pkgs/applications/graphics/draftsight/default.nix
index 17334c5b366c..32cce492589d 100644
--- a/pkgs/applications/graphics/draftsight/default.nix
+++ b/pkgs/applications/graphics/draftsight/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     mkdir $out/bin
     for exe in DraftSight dsHttpApiController dsHttpApiService FxCrashRptApp HelpGuide; do
       echo "Patching $exe..."
-      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
                --set-rpath $libPath:\$ORIGIN/../Libraries \
                $out/draftsight/opt/dassault-systemes/DraftSight/Linux/$exe
       makeWrapper $out/draftsight/opt/dassault-systemes/DraftSight/Linux/$exe \
diff --git a/pkgs/applications/misc/adobe-reader/builder.sh b/pkgs/applications/misc/adobe-reader/builder.sh
index 41281385c990..75a2bdcf4b01 100644
--- a/pkgs/applications/misc/adobe-reader/builder.sh
+++ b/pkgs/applications/misc/adobe-reader/builder.sh
@@ -17,7 +17,7 @@ rm $p/Reader/intellinux/plug_ins/PPKLite.api
 # More pointless files.
 rm $p/bin/UNINSTALL
 
-patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
     --set-rpath $libPath \
     $p/Reader/intellinux/bin/acroread
 
diff --git a/pkgs/applications/misc/googleearth/default.nix b/pkgs/applications/misc/googleearth/default.nix
index df8cb71d6f9e..b343c1bf785e 100644
--- a/pkgs/applications/misc/googleearth/default.nix
+++ b/pkgs/applications/misc/googleearth/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     rm $out/bin/google-earth $out/opt/google/earth/free/google-earth
     ln -s $out/opt/google/earth/free/googleearth $out/bin/google-earth
 
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${fullPath}:\$ORIGIN" \
       $out/opt/google/earth/free/googleearth-bin
 
diff --git a/pkgs/applications/misc/houdini/runtime.nix b/pkgs/applications/misc/houdini/runtime.nix
index b3ce98895e6f..c2fe99744d17 100644
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     echo "export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"" >> $out/houdini/sbin/app_init.sh
   '';
   postFixup = ''
-    INTERPRETER="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
+    INTERPRETER="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
     for BIN in $(find $out/bin -type f -executable); do
       if patchelf $BIN 2>/dev/null ; then
         echo "Patching ELF $BIN"
diff --git a/pkgs/applications/misc/hyper/default.nix b/pkgs/applications/misc/hyper/default.nix
index 2202dd8c4c42..c3ef58060585 100644
--- a/pkgs/applications/misc/hyper/default.nix
+++ b/pkgs/applications/misc/hyper/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin"
     mv opt "$out/"
     ln -s "$out/opt/Hyper/hyper" "$out/bin/hyper"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${libPath}:\$ORIGIN" "$out/opt/Hyper/hyper"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "${libPath}:\$ORIGIN" "$out/opt/Hyper/hyper"
     mv usr/* "$out/"
   '';
   dontPatchELF = true;
diff --git a/pkgs/applications/misc/ipmiview/default.nix b/pkgs/applications/misc/ipmiview/default.nix
index f90784759941..dd43e703d350 100644
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
    buildPhase = with xorg; ''
      patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libX11 libXext libXrender libXtst libXi ]}" ./jre/lib/amd64/xawt/libmawt.so
      patchelf --set-rpath "${gcc.cc}/lib" ./libiKVM64.so
-     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libXcursor libX11 libXext libXrender libXtst libXi ]}" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/javaws
-     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
+     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libXcursor libX11 libXext libXrender libXtst libXi ]}" --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./jre/bin/javaws
+     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./jre/bin/java
    '';
 
    installPhase = ''
diff --git a/pkgs/applications/misc/kdbplus/default.nix b/pkgs/applications/misc/kdbplus/default.nix
index bf1b77534ce6..f3855f2bb925 100644
--- a/pkgs/applications/misc/kdbplus/default.nix
+++ b/pkgs/applications/misc/kdbplus/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/libexec
 
     patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} \
       ./q/l32/q
     mv ./q/l32/q $out/libexec/q
diff --git a/pkgs/applications/misc/kiwix/default.nix b/pkgs/applications/misc/kiwix/default.nix
index b0590fdc38f7..7bfc6b33c951 100644
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     cp -r src/dependencies/xulrunner $out/lib/kiwix
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/lib/kiwix/xulrunner/xulrunner
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/lib/kiwix/xulrunner/xulrunner
 
     rm $out/bin/kiwix
     makeWrapper $out/lib/kiwix/kiwix-launcher $out/bin/kiwix \
diff --git a/pkgs/applications/misc/rescuetime/default.nix b/pkgs/applications/misc/rescuetime/default.nix
index 03d058783b23..50f09ce1b5cf 100644
--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     cp usr/bin/rescuetime $out/bin
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/rescuetime
 
     wrapProgram $out/bin/rescuetime \
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index 7367c8207054..c84c25038d6c 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -47,7 +47,7 @@
 
     fixupPhase
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${libPath}:$out/share/simplenote" \
       $out/share/simplenote/simplenote
 
diff --git a/pkgs/applications/networking/bittorrentsync/generic.nix b/pkgs/applications/networking/bittorrentsync/generic.nix
index 3fa7fe180402..342385c4b001 100644
--- a/pkgs/applications/networking/bittorrentsync/generic.nix
+++ b/pkgs/applications/networking/bittorrentsync/generic.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     install -D btsync "$out/bin/btsync"
-    patchelf --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" --set-rpath ${libPath} "$out/bin/btsync"
+    patchelf --interpreter "$(< $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath ${libPath} "$out/bin/btsync"
   '';
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index f59cb402720d..8abcb0cfaac0 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -152,7 +152,7 @@ stdenv.mkDerivation {
         updater crashreporter webapprt-stub
       do
         if [ -e "$out/usr/lib/firefox-bin-${version}/$executable" ]; then
-          patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             "$out/usr/lib/firefox-bin-${version}/$executable"
         fi
       done
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 9a4d90701b28..ad79aef88a40 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
 
     for elf in $out/share/google/$appname/{chrome,chrome-sandbox,nacl_helper}; do
       patchelf --set-rpath $rpath $elf
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $elf
     done
   '';
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 0452e7486e6f..cc076fa02f07 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
       $out/lib${lib_suffix}/kde4/kcm_adobe_flash_player.so
 
     patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       --set-rpath "$rpath" \
       $out/bin/flash-player-properties
   '';
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 9a805eb55e4f..9c37979a359b 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     cp -pv flashplayer${lib.optionalString debug "debugger"} $out/bin
 
     patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       --set-rpath "$rpath" \
       $out/bin/flashplayer${lib.optionalString debug "debugger"}
   '';
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
index 461db272b12e..2e815f77780f 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
       cp -prd opt/google/talkplugin/{data,GoogleTalkPlugin,locale,remoting24x24.png,windowpicker.glade} $out/libexec/google/talkplugin/
 
       patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "${rpathProgram}:${stdenv.cc.cc.lib}/lib64" \
         $out/libexec/google/talkplugin/GoogleTalkPlugin
 
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 52a2ce9164c9..66eaf8ecfba3 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -114,7 +114,7 @@ in stdenv.mkDerivation {
     | while read f
       do
         patchelf \
-          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "$out/lib:${rpath}" \
           "$f"
       done
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 980c90a91ee7..494fec1b3ff2 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
   buildCommand = ''
     # For convenience ...
     TBB_IN_STORE=$out/share/tor-browser
-    interp=$(< $NIX_CC/nix-support/dynamic-linker)
+    interp=$(< $NIX_BINUTILS/nix-support/dynamic-linker)
 
     # Unpack & enter
     mkdir -p "$TBB_IN_STORE"
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index a1238cb5964f..7c6ad60116ca 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     echo "Patching Vivaldi binaries"
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${libPath}" \
       opt/vivaldi/vivaldi-bin
   '' + stdenv.lib.optionalString proprietaryCodecs ''
diff --git a/pkgs/applications/networking/cluster/hadoop/default.nix b/pkgs/applications/networking/cluster/hadoop/default.nix
index 9af4cf3f0ed6..dcbf609d08e7 100644
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
       sed -i $n -e "s|#!/usr/bin/env bash|#! ${bash}/bin/bash|"
     done
   '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" bin/container-executor;
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" bin/container-executor;
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index a76d6bc2fa47..975c5e4a87be 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -108,7 +108,7 @@ in mkDerivation {
   '';
 
   preFixup = ''
-    INTERP=$(cat $NIX_CC/nix-support/dynamic-linker)
+    INTERP=$(cat $NIX_BINUTILS/nix-support/dynamic-linker)
     RPATH="${ldpath}:$out/${appdir}"
     getType='s/ *Type: *\([A-Z]*\) (.*/\1/'
     find "$out/${appdir}" -type f -print | while read obj; do
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 853a6c96a7a4..701ba477bee5 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
         # Copying how adobe-reader does it,
         # see pkgs/applications/misc/adobe-reader/builder.sh
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
                  --set-rpath "$out/opt/discord:$libPath"                                   \
                  $out/opt/discord/Discord
 
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index a238009cd11b..f41805748e57 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" Franz
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" Franz
     patchelf --set-rpath "$out/opt/franz:${stdenv.lib.makeLibraryPath deps}" Franz
 
     mkdir -p $out/bin $out/opt/franz
diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index 326f95630707..ccbb10c743bb 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
     mv usr/share $out
 
     for file in $(find $d -type f); do
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $file || true
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $file || true
         patchelf --set-rpath ${rpath}:$out/libexec/hipchat/lib:\$ORIGIN $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix b/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
index 37a3746669b1..1db674f9ae13 100644
--- a/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
@@ -72,7 +72,7 @@ in stdenv.mkDerivation {
 
     # patch the binaries
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath ${rpath}:$out/libexec $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 7cb89f019e0e..b5ce53177a7f 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
   dontPatchELF = true;
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" rambox
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" rambox
     patchelf --set-rpath "$out/opt/rambox:${stdenv.lib.makeLibraryPath deps}" rambox
 
     mkdir -p $out/bin $out/opt/rambox
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index d476b9b35c49..f4ad5b74f602 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -78,7 +78,7 @@ in stdenv.mkDerivation {
 
   postFixup = ''
      patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "$out/share/skypeforlinux:${rpath}" "$out/share/skypeforlinux/skypeforlinux"
 
     ln -s "$out/share/skypeforlinux/skypeforlinux" "$out/bin/skypeforlinux"
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index f36f0956f654..1d1bc86d7ccc 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -68,7 +68,7 @@ in stdenv.mkDerivation {
     chmod -R g-w $out
 
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath ${rpath}:$out/lib/slack $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
index efafbd9050cd..7d1f3fa6791e 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       mv ts3client_linux_${arch} ts3client
       echo "patching ts3client..."
       patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath ${stdenv.lib.makeLibraryPath deps}:$(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         ts3client
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
index c86de07bc842..bfd2469c1cea 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
@@ -25,13 +25,13 @@ stdenv.mkDerivation {
     ''
       echo "patching ts3server"
       patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath $(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         ts3server
       cp tsdns/tsdnsserver tsdnsserver
       patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath $(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         tsdnsserver
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/applications/networking/instant-messengers/viber/default.nix
index 71d1bccc2b1d..afc977ad383b 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     chmod -R g-w $out
 
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath $libPath:$out/opt/viber/lib $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 91c77fc9d7ca..208d45ed3dd1 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -65,10 +65,10 @@ in stdenv.mkDerivation {
     mkdir -p $out/bin
     cp -ar * $packagePath
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/zoom
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/QtWebEngineProcess
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/qtdiag
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/zopen
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/zoom
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/QtWebEngineProcess
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/qtdiag
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/zopen
     # included from https://github.com/NixOS/nixpkgs/commit/fc218766333a05c9352b386e0cbb16e1ae84bf53
     # it works for me without it, but, well...
     paxmark m $packagePath/zoom
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/applications/networking/insync/default.nix
index 93efdb74c083..4a6bec5d1dab 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ makeWrapper ];
 
   postPatch = ''
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" client/insync-portable
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" client/insync-portable
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix b/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
index 4c768325fee9..2350b9f9465a 100644
--- a/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
 
     # Patch binaries
     binrp=$(patchelf --print-rpath $out/share/nylas-mail/nylas)
-    patchelf --interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) \
+    patchelf --interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") \
       --set-rpath $binrp:$out/lib:${stdenv.cc.cc.lib}/lib:${lib.makeLibraryPath propagatedBuildInputs } \
       $out/share/nylas-mail/nylas
 
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/share/nylas-mail/resources/apm/bin/apm \
       --set PATH "${coreutils}/bin"
-    patchelf --interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) \
+    patchelf --interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") \
       --set-rpath ${gcc-unwrapped.lib}/lib $out/share/nylas-mail/resources/apm/bin/node
   '';
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index 4f714cabf79b..8a4eb4991ad3 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -134,7 +134,7 @@ stdenv.mkDerivation {
       for executable in \
         thunderbird crashreporter thunderbird-bin plugin-container updater
       do
-        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           "$out/usr/lib/thunderbird-bin-${version}/$executable"
       done
 
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index a6858a7b5fdf..93cb7c82b619 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   postFixup = ''
     patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       --set-rpath "${libPath}" \
       $out/bin/anydesk
 
diff --git a/pkgs/applications/networking/remote/citrix-receiver/default.nix b/pkgs/applications/networking/remote/citrix-receiver/default.nix
index c656ff24df84..f6c7285e3b71 100644
--- a/pkgs/applications/networking/remote/citrix-receiver/default.nix
+++ b/pkgs/applications/networking/remote/citrix-receiver/default.nix
@@ -131,7 +131,7 @@ in stdenv.mkDerivation rec {
         echo "Patching ELF intrepreter and rpath for $f"
         chmod u+w "$f"
         patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           --set-rpath "$ICAInstDir:$libPath" "$f"
       done
 
diff --git a/pkgs/applications/networking/resilio-sync/default.nix b/pkgs/applications/networking/resilio-sync/default.nix
index 7622cb76ad2a..6df757626f84 100644
--- a/pkgs/applications/networking/resilio-sync/default.nix
+++ b/pkgs/applications/networking/resilio-sync/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     install -D rslsync "$out/bin/rslsync"
     patchelf \
-      --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(< $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} "$out/bin/rslsync"
   '';
 
diff --git a/pkgs/applications/office/marp/default.nix b/pkgs/applications/office/marp/default.nix
index 0e53d58a083b..124efb139464 100644
--- a/pkgs/applications/office/marp/default.nix
+++ b/pkgs/applications/office/marp/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}:$out/lib/marp" \
       $out/bin/Marp
   '';
diff --git a/pkgs/applications/office/moneyplex/default.nix b/pkgs/applications/office/moneyplex/default.nix
index 4530305ee12e..279a406327b3 100644
--- a/pkgs/applications/office/moneyplex/default.nix
+++ b/pkgs/applications/office/moneyplex/default.nix
@@ -78,9 +78,9 @@ stdenv.mkDerivation rec {
         ${coreutils}/bin/cp "\$MDIR/moneyplex" "\$MDIR/moneyplex.patched"
         ${coreutils}/bin/chmod 0755 "\$MDIR/moneyplex.patched"
     fi
-    if [ ! \`${patchelf}/bin/patchelf --print-interpreter \$MDIR/moneyplex.patched\` = $(cat $NIX_CC/nix-support/dynamic-linker) ] ||
+    if [ ! \`${patchelf}/bin/patchelf --print-interpreter \$MDIR/moneyplex.patched\` = $(cat $NIX_BINUTILS/nix-support/dynamic-linker) ] ||
        [ ! \`${patchelf}/bin/patchelf --print-rpath \$MDIR/moneyplex.patched\` = "${libPath}" ]; then
-        ${patchelf}/bin/patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "${libPath}" "\$MDIR/moneyplex.patched"
+        ${patchelf}/bin/patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "${libPath}" "\$MDIR/moneyplex.patched"
     fi
 
     exec \$MDIR/moneyplex.patched
diff --git a/pkgs/applications/office/wpsoffice/default.nix b/pkgs/applications/office/wpsoffice/default.nix
index 41dd8595c30d..85deae9ec02b 100644
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec{
     mkdir $out/bin
     for i in wps wpp et; do
       patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --force-rpath --set-rpath "$prefix/office6:$libPath" \
         $prefix/office6/$i
 
diff --git a/pkgs/applications/science/electronics/eagle/default.nix b/pkgs/applications/science/electronics/eagle/default.nix
index edc5845e9887..9ac4cc820398 100644
--- a/pkgs/applications/science/electronics/eagle/default.nix
+++ b/pkgs/applications/science/electronics/eagle/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     gcc -shared -fPIC -DEAGLE_PATH=\"$out/eagle-${version}\" ${./eagle_fixer.c} -o "$out"/lib/eagle_fixer.so -ldl
 
     # Make wrapper script
-    dynlinker="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    dynlinker="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
     mkdir -p "$out"/bin
     cat > "$out"/bin/eagle << EOF
     #!${stdenv.shell}
diff --git a/pkgs/applications/science/logic/saw-tools/default.nix b/pkgs/applications/science/logic/saw-tools/default.nix
index 949b34420b79..e2c3e1fdc00c 100644
--- a/pkgs/applications/science/logic/saw-tools/default.nix
+++ b/pkgs/applications/science/logic/saw-tools/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   fixupPhase = ''
     for x in bin/bcdump bin/extcore-info bin/jss bin/llvm-disasm bin/lss bin/saw; do
-      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "$out/lib:${libPath}" $out/$x;
     done
   '';
diff --git a/pkgs/applications/science/logic/tptp/default.nix b/pkgs/applications/science/logic/tptp/default.nix
index db7e0c0c9382..2ad991e00e39 100644
--- a/pkgs/applications/science/logic/tptp/default.nix
+++ b/pkgs/applications/science/logic/tptp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     substituteInPlace $sharedir/TPTP2X/tptp2X_install --replace /bin/mv mv
     tcsh $sharedir/TPTP2X/tptp2X_install -default
 
-    patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $sharedir/Scripts/tptp4X
+    patchelf --interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $sharedir/Scripts/tptp4X
 
     mkdir -p $out/bin
     ln -s $sharedir/TPTP2X/tptp2X $out/bin
diff --git a/pkgs/applications/science/logic/verifast/default.nix b/pkgs/applications/science/logic/verifast/default.nix
index ada586fc4e6d..3ee3f8b7decf 100644
--- a/pkgs/applications/science/logic/verifast/default.nix
+++ b/pkgs/applications/science/logic/verifast/default.nix
@@ -10,7 +10,7 @@ let
     ] + ":${stdenv.cc.cc.lib}/lib64";
 
   patchExe = x: ''
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} ${x}
   '';
 in
diff --git a/pkgs/applications/science/math/mathematica/10.nix b/pkgs/applications/science/math/mathematica/10.nix
index 6a49976c86b8..005c1c496094 100644
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ b/pkgs/applications/science/math/mathematica/10.nix
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
         echo "patching $f executable <<"
         patchelf --shrink-rpath "$f"
         patchelf \
-	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+	  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
           "$f" \
           && patchelf --shrink-rpath "$f" \
diff --git a/pkgs/applications/science/math/mathematica/9.nix b/pkgs/applications/science/math/mathematica/9.nix
index c4fd0c384c14..e190d8fde7f9 100644
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ b/pkgs/applications/science/math/mathematica/9.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
       elif [ "$type" == "EXEC" ]; then
         echo "patching $f executable <<"
         patchelf \
-            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath "${ldpath}" \
             "$f"
         patchelf --shrink-rpath "$f"
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 1e23cfea27fc..89701991e580 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
         echo "patching $f executable <<"
         patchelf --shrink-rpath "$f"
         patchelf \
-	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+	  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
           "$f" \
           && patchelf --shrink-rpath "$f" \
diff --git a/pkgs/applications/science/math/scilab-bin/default.nix b/pkgs/applications/science/math/scilab-bin/default.nix
index f6e255ee46e4..de6868698a70 100644
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     fullLibPath="$sci/lib/scilab:$sci/lib/thirdparty:$libPath"
     fullLibPath="$fullLibPath:$sci/lib/thirdparty/redist"
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
              --set-rpath "$fullLibPath" bin/scilab-bin
     find . -name '*.so' -type f | while read file; do
       patchelf --set-rpath "$fullLibPath" "$file" 2>/dev/null
diff --git a/pkgs/applications/science/medicine/aliza/default.nix b/pkgs/applications/science/medicine/aliza/default.nix
index b0471b80e2f1..74aefc26fc49 100644
--- a/pkgs/applications/science/medicine/aliza/default.nix
+++ b/pkgs/applications/science/medicine/aliza/default.nix
@@ -29,11 +29,11 @@ stdenv.mkDerivation {
     libs = stdenv.lib.makeLibraryPath [ qt4 zlib stdenv.cc.cc libSM libICE libX11 libXext libXt mesa ];
   in ''
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/aliza
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/aliza-vtkvol
 
     wrapProgram $out/bin/aliza \
diff --git a/pkgs/applications/science/programming/fdr/default.nix b/pkgs/applications/science/programming/fdr/default.nix
index 8ed8e0e73b00..ce48dd6fce7d 100644
--- a/pkgs/applications/science/programming/fdr/default.nix
+++ b/pkgs/applications/science/programming/fdr/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
     for b in fdr4 _fdr4 refines _refines cspmprofiler cspmexplorerprof
     do
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
         --set-rpath "$libPath:$out/lib" \
         "$out/bin/$b"
     done
diff --git a/pkgs/applications/taxes/aangifte-2006/builder.sh b/pkgs/applications/taxes/aangifte-2006/builder.sh
index 1b709b613bd4..aab55608ba5f 100644
--- a/pkgs/applications/taxes/aangifte-2006/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2006/builder.sh
@@ -3,7 +3,7 @@ source $stdenv/setup
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2007/builder.sh b/pkgs/applications/taxes/aangifte-2007/builder.sh
index 79e5b3097696..f35bf307fbe1 100644
--- a/pkgs/applications/taxes/aangifte-2007/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2007/builder.sh
@@ -5,7 +5,7 @@ echo $NIX_CC
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib:$libSM/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2008/builder.sh b/pkgs/applications/taxes/aangifte-2008/builder.sh
index 79e5b3097696..f35bf307fbe1 100644
--- a/pkgs/applications/taxes/aangifte-2008/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2008/builder.sh
@@ -5,7 +5,7 @@ echo $NIX_CC
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib:$libSM/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2009/default.nix b/pkgs/applications/taxes/aangifte-2009/default.nix
index c944fc3d68b3..bad9be357532 100644
--- a/pkgs/applications/taxes/aangifte-2009/default.nix
+++ b/pkgs/applications/taxes/aangifte-2009/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2010/default.nix b/pkgs/applications/taxes/aangifte-2010/default.nix
index b5a85415c376..fc2758adff26 100644
--- a/pkgs/applications/taxes/aangifte-2010/default.nix
+++ b/pkgs/applications/taxes/aangifte-2010/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2011/default.nix b/pkgs/applications/taxes/aangifte-2011/default.nix
index a38bc4254bbe..b45c99f67051 100644
--- a/pkgs/applications/taxes/aangifte-2011/default.nix
+++ b/pkgs/applications/taxes/aangifte-2011/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2012/default.nix b/pkgs/applications/taxes/aangifte-2012/default.nix
index 2e51ef9ed4cf..9fb42d7b9930 100644
--- a/pkgs/applications/taxes/aangifte-2012/default.nix
+++ b/pkgs/applications/taxes/aangifte-2012/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2013-wa/default.nix b/pkgs/applications/taxes/aangifte-2013-wa/default.nix
index 5ee0edb4b5e5..8b97233c8791 100644
--- a/pkgs/applications/taxes/aangifte-2013-wa/default.nix
+++ b/pkgs/applications/taxes/aangifte-2013-wa/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2013/default.nix b/pkgs/applications/taxes/aangifte-2013/default.nix
index 3cf85961a9bb..54cb86885908 100644
--- a/pkgs/applications/taxes/aangifte-2013/default.nix
+++ b/pkgs/applications/taxes/aangifte-2013/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2014-wa/default.nix b/pkgs/applications/taxes/aangifte-2014-wa/default.nix
index 78bb8214257f..6a0023d756cc 100644
--- a/pkgs/applications/taxes/aangifte-2014-wa/default.nix
+++ b/pkgs/applications/taxes/aangifte-2014-wa/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2014/default.nix b/pkgs/applications/taxes/aangifte-2014/default.nix
index 0151cca52b2c..697e0cd3561f 100644
--- a/pkgs/applications/taxes/aangifte-2014/default.nix
+++ b/pkgs/applications/taxes/aangifte-2014/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index c7f7a4b02e4d..0d410d230d4d 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
              --set-rpath "$libPath:$out/opt/gitkraken" "$out/opt/gitkraken/gitkraken"
     wrapProgram $out/opt/gitkraken/gitkraken \
       --prefix LD_PRELOAD : "${makeLibraryPath [ curl ]}/libcurl.so.4" \
diff --git a/pkgs/applications/video/makemkv/builder.sh b/pkgs/applications/video/makemkv/builder.sh
index 416d5c0f0b07..ee2dd392bb78 100644
--- a/pkgs/applications/video/makemkv/builder.sh
+++ b/pkgs/applications/video/makemkv/builder.sh
@@ -27,7 +27,7 @@ libPath="${libPath}:${out}/lib" # XXX: der. This should be in the nix file?
 
 for i in ${bin} ; do
   patchelf \
-    --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
     --set-rpath $libPath \
     ${i}
 done 
diff --git a/pkgs/desktops/maxx/default.nix b/pkgs/desktops/maxx/default.nix
index 339183f906ec..c264593ff6bd 100644
--- a/pkgs/desktops/maxx/default.nix
+++ b/pkgs/desktops/maxx/default.nix
@@ -59,7 +59,7 @@ in stdenv.mkDerivation {
 
     while IFS= read -r -d ''$'\0' i; do
       if isELF "$i"; then
-        bin=`patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$i"; echo $?`
+        bin=`patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$i"; echo $?`
         patchelf --set-rpath "${stdenv.lib.makeLibraryPath deps}" "$i"
         if [ "$bin" -eq 0 ]; then
           wrapProgram "$i" \
diff --git a/pkgs/development/arduino/arduino-core/default.nix b/pkgs/development/arduino/arduino-core/default.nix
index fdb9d1be6ad2..79f65c181141 100644
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
       cp ${teensyduino_src} ./TeensyduinoInstall.${teensy_architecture}
       chmod +w ./TeensyduinoInstall.${teensy_architecture}
       upx -d ./TeensyduinoInstall.${teensy_architecture}
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           --set-rpath "${teensy_libpath}" \
           ./TeensyduinoInstall.${teensy_architecture}
       chmod +x ./TeensyduinoInstall.${teensy_architecture}
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
         patchelf --set-rpath ${rpath}:$out/lib $file || true
     done
 
@@ -203,7 +203,7 @@ stdenv.mkDerivation rec {
     ${stdenv.lib.optionalString withTeensyduino ''
       # Patch the Teensy loader binary
       patchelf --debug \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           --set-rpath "${teensy_libpath}" \
           $out/share/arduino/hardware/tools/teensy
     ''}
diff --git a/pkgs/development/compilers/cmucl/binary.nix b/pkgs/development/compilers/cmucl/binary.nix
index 2833c5378c1d..4086e8d4dd60 100644
--- a/pkgs/development/compilers/cmucl/binary.nix
+++ b/pkgs/development/compilers/cmucl/binary.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out
     tar -C $out -xjf ${dist}
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/lisp
   '';
 
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index 62a504ef9668..b17363516fd4 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
         --suffix DYLD_LIBRARY_PATH : $libPath
   ''
   else ''
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       crystal-${version}-1/embedded/bin/crystal
     patchelf --set-rpath ${ stdenv.lib.makeLibraryPath [ stdenv.cc.cc ] } \
       crystal-${version}-1/embedded/bin/crystal
diff --git a/pkgs/development/compilers/cudatoolkit/default.nix b/pkgs/development/compilers/cudatoolkit/default.nix
index 0b219b804471..f65fd4711ae2 100644
--- a/pkgs/development/compilers/cudatoolkit/default.nix
+++ b/pkgs/development/compilers/cudatoolkit/default.nix
@@ -49,7 +49,7 @@ let
           echo "patching $i..."
           if [[ ! $i =~ \.so ]]; then
             patchelf \
-              --set-interpreter "''$(cat $NIX_CC/nix-support/dynamic-linker)" $i
+              --set-interpreter "''$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $i
           fi
           rpath2=$rpath:$lib/lib:$out/jre/lib/amd64/jli:$out/lib:$out/lib64:$out/nvvm/lib:$out/nvvm/lib64
           patchelf --set-rpath $rpath2 --force-rpath $i
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index ee56425f00b4..443f674cf1d8 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -25,7 +25,7 @@ if test "$noSysDirs" = "1"; then
         # Figure out what extra flags to pass to the gcc compilers
         # being generated to make sure that they use our glibc.
         extraFlags="$(cat $NIX_CC/nix-support/libc-cflags)"
-        extraLDFlags="$(cat $NIX_CC/nix-support/libc-ldflags) $(cat $NIX_CC/nix-support/libc-ldflags-before || true)"
+        extraLDFlags="$(cat $NIX_BINUTILS/nix-support/libc-ldflags) $(cat $NIX_BINUTILS/nix-support/libc-ldflags-before || true)"
 
         # Use *real* header files, otherwise a limits.h is generated
         # that does not include Glibc's limits.h (notably missing
diff --git a/pkgs/development/compilers/ghc/6.10.2-binary.nix b/pkgs/development/compilers/ghc/6.10.2-binary.nix
index 60749a29b58b..5d03573dbab4 100644
--- a/pkgs/development/compilers/ghc/6.10.2-binary.nix
+++ b/pkgs/development/compilers/ghc/6.10.2-binary.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     # find editline/gmp.
     (if stdenv.isLinux then ''
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "${lib.makeLibraryPath [ libedit ncurses5 gmp ]}" {} \;
       for prog in ld ar gcc strip ranlib; do
         find . -name "setup-config" -exec sed -i "s@/usr/bin/$prog@$(type -p $prog)@g" {} \;
diff --git a/pkgs/development/compilers/ghc/7.0.4-binary.nix b/pkgs/development/compilers/ghc/7.0.4-binary.nix
index 6140cde4a9ef..10aa63ed4e35 100644
--- a/pkgs/development/compilers/ghc/7.0.4-binary.nix
+++ b/pkgs/development/compilers/ghc/7.0.4-binary.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     # find editline/gmp.
     stdenv.lib.optionalString stdenv.isLinux ''
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "${stdenv.lib.makeLibraryPath [ ncurses5 gmp ]}" {} \;
       sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
       sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
diff --git a/pkgs/development/compilers/ghc/7.4.2-binary.nix b/pkgs/development/compilers/ghc/7.4.2-binary.nix
index 100bb87768b5..43775a343c11 100644
--- a/pkgs/development/compilers/ghc/7.4.2-binary.nix
+++ b/pkgs/development/compilers/ghc/7.4.2-binary.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
       mkdir -p "$out/lib"
       ln -sv "${ncurses5.out}/lib/libncurses.so" "$out/lib/libncurses${stdenv.lib.optionalString stdenv.is64bit "w"}.so.5"
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath "${stdenv.lib.makeLibraryPath [ "$out" gmp ]}" {} \;
 
       paxmark m ./ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
diff --git a/pkgs/development/compilers/gnatboot/default.nix b/pkgs/development/compilers/gnatboot/default.nix
index a209e392bc6f..1cb2d3904315 100644
--- a/pkgs/development/compilers/gnatboot/default.nix
+++ b/pkgs/development/compilers/gnatboot/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     cp -R * $out
     set +e
     for a in $out/bin/* ; do
-      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      patchelf --interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
         --set-rpath $(cat $NIX_CC/nix-support/orig-libc)/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib64:$(cat $NIX_CC/nix-support/orig-cc)/lib $a
     done
     set -e
diff --git a/pkgs/development/compilers/mentor/default.nix b/pkgs/development/compilers/mentor/default.nix
index 74905c6ffae4..2922cef7e7a1 100644
--- a/pkgs/development/compilers/mentor/default.nix
+++ b/pkgs/development/compilers/mentor/default.nix
@@ -18,7 +18,7 @@ let
         tar --strip-components=1 -xjf "$src" -C "$out"
 
         # Patch binaries
-        interpreter="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
+        interpreter="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
         for file in "$out"/bin/* "$out"/libexec/gcc/*/*/* "$out"/*/bin/*; do
             # Skip non-executable files
             case "$file" in
diff --git a/pkgs/development/compilers/mozart/binary.nix b/pkgs/development/compilers/mozart/binary.nix
index ebe562fcde32..4857af087570 100644
--- a/pkgs/development/compilers/mozart/binary.nix
+++ b/pkgs/development/compilers/mozart/binary.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     tar xvf $src -C $out --strip-components=1
 
     for exe in $out/bin/{ozemulator,ozwish} ; do
-      patchelf --set-interpreter $(< $NIX_CC/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(< $NIX_BINUTILS/nix-support/dynamic-linker) \
                --set-rpath $libPath \
                $exe
     done
diff --git a/pkgs/development/compilers/opendylan/bin.nix b/pkgs/development/compilers/opendylan/bin.nix
index 8382be7a2091..009f36f57f5d 100644
--- a/pkgs/development/compilers/opendylan/bin.nix
+++ b/pkgs/development/compilers/opendylan/bin.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     mkdir -p "$out"
     tar --strip-components=1 -xjf "$src" -C "$out"
 
-    interpreter="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
+    interpreter="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
     for a in "$out"/bin/*; do 
       patchelf --set-interpreter "$interpreter" "$a"
       patchelf --set-rpath "$out/lib:${boehmgc.out}/lib" "$a"
diff --git a/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh b/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
index 459bfce50988..2cee0adc7d03 100644
--- a/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
+++ b/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
@@ -5,7 +5,7 @@ unzip ${src} || true
 
 # set the dynamic linker of unpack200, necessary for construct script
 echo "patching unpack200"
-patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "" */bin/unpack200
+patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "" */bin/unpack200
 
 echo "constructing JDK and JRE installations"
 if test -z "$installjdk"; then
@@ -46,7 +46,7 @@ rpath=$rpath${rpath:+:}$jrePath/lib/$architecture/jli
 
 # set all the dynamic linkers
 find $out -type f -perm -0100 \
-    -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
     --set-rpath "$rpath" {} \;
 
 find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 2a00cf5f2d29..ca954f53ab1a 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -179,7 +179,7 @@ let result = stdenv.mkDerivation rec {
 
     # set all the dynamic linkers
     find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "$rpath" {} \;
 
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/compilers/rust/binaryBuild.nix b/pkgs/development/compilers/rust/binaryBuild.nix
index 37b06555bdbd..cd20fb4afdee 100644
--- a/pkgs/development/compilers/rust/binaryBuild.nix
+++ b/pkgs/development/compilers/rust/binaryBuild.nix
@@ -42,17 +42,17 @@ rec {
 
       ${optionalString (needsPatchelf && bootstrapping) ''
         patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           "$out/bin/rustdoc"
         patchelf \
           --set-rpath "${stdenv.lib.makeLibraryPath [ curl zlib ]}" \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}
 
       ${optionalString needsPatchelf ''
         patchelf \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           "$out/bin/rustc"
 
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
@@ -88,7 +88,7 @@ rec {
       ${optionalString needsPatchelf ''
         patchelf \
           --set-rpath "${stdenv.lib.makeLibraryPath [ curl zlib ]}" \
-          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}
 
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index 707f7966dd9b..1cddcd6bc5bd 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = stdenv.lib.optionalString (!stdenv.isArm && stdenv.isLinux) ''
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $out/share/sbcl/sbcl
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $out/share/sbcl/sbcl
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 7e083ffe67be..dd41e01ad5b0 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     echo ${version} > VERSION
 
     configureFlagsArray+=("--cc=cc")
-    configureFlagsArray+=("--elfinterp=$(< $NIX_CC/nix-support/dynamic-linker)")
+    configureFlagsArray+=("--elfinterp=$(< $NIX_BINUTILS/nix-support/dynamic-linker)")
     configureFlagsArray+=("--crtprefix=${getLib stdenv.cc.libc}/lib")
     configureFlagsArray+=("--sysincludepaths=${getDev stdenv.cc.libc}/include:{B}/include")
     configureFlagsArray+=("--libpaths=${getLib stdenv.cc.libc}/lib")
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index f7638757ff7a..72ee89dc3504 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
 
     # set all the dynamic linkers
     find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "$rpath" {} \;
 
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/interpreters/dart/default.nix b/pkgs/development/interpreters/dart/default.nix
index 3d19f7ba2911..bb800bb62a93 100644
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/interpreters/dart/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     mkdir -p $out
     cp -R * $out/
     echo $libPath
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
              --set-rpath $libPath \
              $out/bin/dart
   '';
diff --git a/pkgs/development/interpreters/rebol/default.nix b/pkgs/development/interpreters/rebol/default.nix
index 8a13c4efce61..5af1fd62256a 100644
--- a/pkgs/development/interpreters/rebol/default.nix
+++ b/pkgs/development/interpreters/rebol/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     cp ${r3} make/r3-make
     chmod 777 make/r3-make
-    patchelf  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./make/r3-make
+    patchelf  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./make/r3-make
     cd make
     perl -pi -e 's#-m32##g' makefile
     perl -pi -e 's#sudo .*#echo#g' makefile
diff --git a/pkgs/development/libraries/libstdc++5/default.nix b/pkgs/development/libraries/libstdc++5/default.nix
index abe0538b8a9c..4f4040ce5ed7 100644
--- a/pkgs/development/libraries/libstdc++5/default.nix
+++ b/pkgs/development/libraries/libstdc++5/default.nix
@@ -62,7 +62,10 @@ stdenv.mkDerivation rec {
     # being generated to make sure that they use our glibc.
     EXTRA_FLAGS="-I$NIX_FIXINC_DUMMY $(cat $NIX_CC/nix-support/libc-cflags) -O2"
 
-    extraLDFlags="-L$glibc_libdir -rpath $glibc_libdir $(cat $NIX_CC/nix-support/libc-ldflags) $(cat $NIX_CC/nix-support/libc-ldflags-before)"
+    extraLDFlags="-L$glibc_libdir -rpath $glibc_libdir"
+    extraLDFlags+=" $(cat $NIX_BINUTILS/nix-support/libc-ldflags)"
+    extraLDFlags+=" $(cat $NIX_BINUTILS/nix-support/libc-ldflags-before)"
+
     for i in $extraLDFlags; do
       EXTRA_FLAGS="$EXTRA_FLAGS -Wl,$i"
     done
diff --git a/pkgs/development/libraries/oracle-instantclient/default.nix b/pkgs/development/libraries/oracle-instantclient/default.nix
index d0085752623d..9119e4beb4f5 100644
--- a/pkgs/development/libraries/oracle-instantclient/default.nix
+++ b/pkgs/development/libraries/oracle-instantclient/default.nix
@@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
     done
 
     for exe in $out/bin/sqlplus; do
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
                --force-rpath --set-rpath "$out/lib:${libaio}/lib" \
                $exe
     done
diff --git a/pkgs/development/libraries/wtk/builder.sh b/pkgs/development/libraries/wtk/builder.sh
index 86f2719537cd..ed9c052cf09d 100644
--- a/pkgs/development/libraries/wtk/builder.sh
+++ b/pkgs/development/libraries/wtk/builder.sh
@@ -22,6 +22,6 @@ for i in $libraries; do
     rpath=$rpath${rpath:+:}$i/lib
 done
 find $out -type f -perm -0100 \
-    -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" {} \;
+    -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" {} \;
 find $out -type f -perm -0100 \
     -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/misc/amdapp-sdk/default.nix b/pkgs/development/misc/amdapp-sdk/default.nix
index fc2981f7f1f7..5486230541f1 100644
--- a/pkgs/development/misc/amdapp-sdk/default.nix
+++ b/pkgs/development/misc/amdapp-sdk/default.nix
@@ -87,7 +87,7 @@ in stdenv.mkDerivation rec {
     }
 
     # Create wrappers
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/clinfo
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/bin/clinfo
     patchelf --set-rpath ${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib $out/bin/clinfo
 
     # Fix modes
diff --git a/pkgs/development/mobile/flashtool/default.nix b/pkgs/development/mobile/flashtool/default.nix
index 0c1bb5d4d42d..f9cd6bc3c403 100644
--- a/pkgs/development/mobile/flashtool/default.nix
+++ b/pkgs/development/mobile/flashtool/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ln -s ${libusb1.out}/lib/libusb-1.0.so.0 ./x10flasher_lib/linux/lib32/libusbx-1.0.so
 
     chmod +x x10flasher_lib/unyaffs.linux.x86 x10flasher_lib/bin2elf x10flasher_lib/bin2sin
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" x10flasher_lib/unyaffs.linux.x86
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" x10flasher_lib/unyaffs.linux.x86
     ln -sf unyaffs.linux.x86 x10flasher_lib/unyaffs.linux
 
     ln -s swt32.jar x10flasher_lib/swtlin/swt.jar
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 745111171bb6..c957f4151a07 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   fixupPhase = ''
     patchInterpreter() {
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         "$out/libexec/genymotion/$1"
     }
 
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 74884e6f5a8a..7a4e326ee8a0 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -31,7 +31,7 @@ let
       fixupPhase
 
       patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
         --set-rpath "${atomEnv.libPath}:$out/lib/electron" \
         $out/lib/electron/electron
 
diff --git a/pkgs/development/tools/misc/saleae-logic/default.nix b/pkgs/development/tools/misc/saleae-logic/default.nix
index 86be86cb6d63..5a20a2ac1674 100644
--- a/pkgs/development/tools/misc/saleae-logic/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     cp -r * "$out"
 
     # Patch it
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/Logic"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/Logic"
     patchelf --set-rpath "${stdenv.cc.cc.lib}/lib:${stdenv.cc.cc.lib}/lib64:${libPath}:\$ORIGIN/Analyzers:\$ORIGIN" "$out/Logic"
 
     # Build the LD_PRELOAD library that makes Logic work from a read-only directory
diff --git a/pkgs/development/tools/node-webkit/nw11.nix b/pkgs/development/tools/node-webkit/nw11.nix
index 5028ac9580c5..373032686ae1 100644
--- a/pkgs/development/tools/node-webkit/nw11.nix
+++ b/pkgs/development/tools/node-webkit/nw11.nix
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/node-webkit
     cp -R * $out/share/node-webkit
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nw
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nw
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/node-webkit/libudev.so.0
 
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 8e2953839b71..5205d534ab82 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -36,8 +36,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/nwjs
     cp -R * $out/share/nwjs
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/nwjs/nw
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/nwjs/nwjc
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/nwjs/nw
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/nwjs/nwjc
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/nwjs/libudev.so.0
 
diff --git a/pkgs/development/tools/node-webkit/nw9.nix b/pkgs/development/tools/node-webkit/nw9.nix
index ba5d6c8e3343..803f55f81347 100644
--- a/pkgs/development/tools/node-webkit/nw9.nix
+++ b/pkgs/development/tools/node-webkit/nw9.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/node-webkit
     cp -R * $out/share/node-webkit
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nw
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nw
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/node-webkit/libudev.so.0
 
diff --git a/pkgs/development/tools/phantomjs/default.nix b/pkgs/development/tools/phantomjs/default.nix
index 8b6b655b6a56..9daa93ca3bb1 100644
--- a/pkgs/development/tools/phantomjs/default.nix
+++ b/pkgs/development/tools/phantomjs/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = lib.optionalString (!stdenv.isDarwin) ''
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${stdenv.lib.makeLibraryPath [ freetype fontconfig stdenv.cc.cc stdenv.cc.cc openssl ]}" \
       bin/phantomjs
   '';
diff --git a/pkgs/development/tools/sauce-connect/default.nix b/pkgs/development/tools/sauce-connect/default.nix
index 3caec9a75c15..4f06c3ad63db 100644
--- a/pkgs/development/tools/sauce-connect/default.nix
+++ b/pkgs/development/tools/sauce-connect/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = stdenv.lib.optionalString stdenv.isLinux ''
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "$out/lib:${makeLibraryPath [zlib]}" \
       bin/sc
   '';
diff --git a/pkgs/development/tools/thrust/default.nix b/pkgs/development/tools/thrust/default.nix
index 91a01edc23a6..a59c8153cafc 100644
--- a/pkgs/development/tools/thrust/default.nix
+++ b/pkgs/development/tools/thrust/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
     mkdir -p $out/libexec/thrust
     unzip -d $out/libexec/thrust/ $src
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/libexec/thrust/thrust_shell
     wrapProgram $out/libexec/thrust/thrust_shell \
       --prefix "LD_LIBRARY_PATH" : "${thrustEnv}/lib:${thrustEnv}/lib64"
diff --git a/pkgs/development/tools/unity3d/default.nix b/pkgs/development/tools/unity3d/default.nix
index c7ba985d0f75..e3d0f7f5845e 100644
--- a/pkgs/development/tools/unity3d/default.nix
+++ b/pkgs/development/tools/unity3d/default.nix
@@ -99,10 +99,10 @@ in stdenv.mkDerivation rec {
       if [[ "$ftype" =~ LSB\ .*dynamically\ linked ]]; then
         if [[ "$ftype" =~ 32-bit ]]; then
           rpath="${libPath32}"
-          intp="$(cat $NIX_CC/nix-support/dynamic-linker-m32)"
+          intp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker-m32)"
         else
           rpath="${libPath64}"
-          intp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+          intp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
         fi
 
         oldRpath="$(patchelf --print-rpath "$1")"
diff --git a/pkgs/games/adom/default.nix b/pkgs/games/adom/default.nix
index 016c965b6c0b..77157e962e1a 100644
--- a/pkgs/games/adom/default.nix
+++ b/pkgs/games/adom/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     done
 
     ${patchelf}/bin/patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "$out/lib:${lpath}" \
       $out/adom
 
diff --git a/pkgs/games/andyetitmoves/default.nix b/pkgs/games/andyetitmoves/default.nix
index 092f07737084..c9fa3a1d05e6 100644
--- a/pkgs/games/andyetitmoves/default.nix
+++ b/pkgs/games/andyetitmoves/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
     binName=${if commercialVersion then "AndYetItMoves" else "AndYetItMovesDemo"}
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
     cat > $out/bin/$binName << EOF
     #!/bin/sh
     cd $out/opt/andyetitmoves
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index fca28b17223f..46ffbe176384 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -72,7 +72,7 @@ let
       cp -a data $out/share/factorio
       cp -a bin/${arch.inTar}/factorio $out/bin/factorio
       patchelf \
-        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
         $out/bin/factorio
     '';
 
diff --git a/pkgs/games/oilrush/default.nix b/pkgs/games/oilrush/default.nix
index d637c1595954..b6c4e5f71f97 100644
--- a/pkgs/games/oilrush/default.nix
+++ b/pkgs/games/oilrush/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     cd bin
     for f in launcher_$arch libQtCoreUnigine_$arch.so.4 OilRush_$arch
     do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $f
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $f
     done
     patchelf --set-rpath ${stdenv.cc.cc.lib}/lib64:${makeLibraryPath [ stdenv.cc.cc libX11 libXext libXrender fontconfig freetype ]}\
              launcher_$arch
diff --git a/pkgs/games/openarena/default.nix b/pkgs/games/openarena/default.nix
index 1e396318bbbd..41feab11f2a3 100644
--- a/pkgs/games/openarena/default.nix
+++ b/pkgs/games/openarena/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   installPhase = let
     gameDir = "$out/openarena-$version";
-    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
+    interpreter = "$(< \"$NIX_BINUTILS/nix-support/dynamic-linker\")";
     libPath = stdenv.lib.makeLibraryPath [ SDL libogg libvorbis ];
   in ''
     mkdir -pv $out/bin
diff --git a/pkgs/games/planetaryannihilation/default.nix b/pkgs/games/planetaryannihilation/default.nix
index 451d4b71296a..1f3223a30543 100644
--- a/pkgs/games/planetaryannihilation/default.nix
+++ b/pkgs/games/planetaryannihilation/default.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation {
 
     ln -s ${systemd}/lib/libudev.so.1 $out/lib/libudev.so.0
 
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/PA"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome3.gconf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/PA"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome3.gconf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
 
     wrapProgram $out/PA --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib stdenv.glibc.out xorg.libX11 xorg.libXcursor gtk2 glib curl "$out" ]}:${stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64"
 
diff --git a/pkgs/games/scrolls/default.nix b/pkgs/games/scrolls/default.nix
index c2beeb13cadf..dd84c38b486b 100644
--- a/pkgs/games/scrolls/default.nix
+++ b/pkgs/games/scrolls/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     cp -r ../Scrolls_Data "$out/opt/Scrolls/"
     chmod +x "$out/opt/Scrolls/Scrolls"
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       --set-rpath "$libPath" "$out/opt/Scrolls/Scrolls"
 
     mkdir "$out/bin"
diff --git a/pkgs/games/sdlmame/default.nix b/pkgs/games/sdlmame/default.nix
index 947e52e1f13d..5064c8d9d343 100644
--- a/pkgs/games/sdlmame/default.nix
+++ b/pkgs/games/sdlmame/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${stdenv.lib.makeLibraryPath [ alsaLib qt48 SDL fontconfig freetype SDL_ttf xorg.libX11 xorg.libXinerama stdenv.cc.cc ]}" \
       share/sdlmame/sdlmame
 
diff --git a/pkgs/games/terraria-server/default.nix b/pkgs/games/terraria-server/default.nix
index 5fcb5063bbc8..15a5c2ec9070 100644
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@@ -21,8 +21,8 @@ stdenv.mkDerivation rec {
     # Fix "/lib64/ld-linux-x86-64.so.2" like references in ELF executables.
     find "$out" | while read filepath; do
       if file "$filepath" | grep -q "ELF.*executable"; then
-        echo "setting interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) in $filepath"
-        patchelf --set-interpreter "$(cat "$NIX_CC"/nix-support/dynamic-linker)" "$filepath"
+        echo "setting interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") in $filepath"
+        patchelf --set-interpreter "$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")" "$filepath"
         test $? -eq 0 || { echo "patchelf failed to process $filepath"; exit 1; }
       fi
     done
diff --git a/pkgs/games/vessel/default.nix b/pkgs/games/vessel/default.nix
index 34b9a606fb96..64f19ff7ab86 100644
--- a/pkgs/games/vessel/default.nix
+++ b/pkgs/games/vessel/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     echo @@@ 
 
     # if we call ld.so $(bin) we don't need to set the ELF interpreter, and save a patchelf step. 
-    LD_PRELOAD=./isatty.so $(cat $NIX_CC/nix-support/dynamic-linker) $src << IM_A_BOT
+    LD_PRELOAD=./isatty.so $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $src << IM_A_BOT
     n
     $out/libexec/strangeloop/vessel/
     IM_A_BOT
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     # props to Ethan Lee (the Vessel porter) for understanding
     # how $ORIGIN works in rpath. There is hope for humanity. 
     patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath $libPath:$out/libexec/strangeloop/vessel/x86/ \
       $out/libexec/strangeloop/vessel/x86/vessel.x86
 
diff --git a/pkgs/games/worldofgoo/default.nix b/pkgs/games/worldofgoo/default.nix
index ba887d91de19..d69a50f56e7d 100644
--- a/pkgs/games/worldofgoo/default.nix
+++ b/pkgs/games/worldofgoo/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/libexec/2dboy/WorldOfGoo/
     mkdir -p $out/bin
 
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath $libPath ./WorldOfGoo.bin64
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath $libPath ./WorldOfGoo.bin64
 
     cp -r * $out/libexec/2dboy/WorldOfGoo/
 
diff --git a/pkgs/misc/cups/drivers/kyocera/default.nix b/pkgs/misc/cups/drivers/kyocera/default.nix
index be9d4f837092..b75b903d06e4 100644
--- a/pkgs/misc/cups/drivers/kyocera/default.nix
+++ b/pkgs/misc/cups/drivers/kyocera/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     install -Dm755 English/rastertokpsl $out/lib/cups/filter/rastertokpsl
     patchelf \
       --set-rpath ${libPath} \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       $out/lib/cups/filter/rastertokpsl
 
     mkdir -p $out/share/cups/model/Kyocera
diff --git a/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix b/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
index b0a030469349..fba2bb88acb7 100644
--- a/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
+++ b/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
         coreutils ghostscript gnugrep gnused which
       ]}
 
-    interpreter=$(cat $NIX_CC/nix-support/dynamic-linker)
+    interpreter=$(cat $NIX_BINUTILS/nix-support/dynamic-linker)
     patchelf --set-interpreter "$interpreter" $dir/inf/braddprinter
     patchelf --set-interpreter "$interpreter" $dir/lpd/brprintconflsr3
     patchelf --set-interpreter "$interpreter" $dir/lpd/rawtobr3
diff --git a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
index f750df6e5063..0d68fc5b09c1 100644
--- a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
+++ b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
@@ -27,7 +27,7 @@ ln -s ppd model
 cd $out/lib/cups/filter
 for i in $(ls); do
     echo "Patching $i..."
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $i ||
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $i ||
       echo "Couldn't set interpreter!"
     patchelf --set-rpath $cups/lib:$gcc/lib:$glibc/lib $i  # This might not be necessary.
 done
diff --git a/pkgs/misc/cups/drivers/samsung/4.01.17.nix b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
index b30b4c4a2c18..22a0986e1fbb 100644
--- a/pkgs/misc/cups/drivers/samsung/4.01.17.nix
+++ b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
       echo "Patching $exe"
       patchelf \
         --set-rpath ${libPath} \
-        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
         $exe
     done
     unset GLOBIGNORE
diff --git a/pkgs/misc/cups/drivers/samsung/default.nix b/pkgs/misc/cups/drivers/samsung/default.nix
index 556c408012d2..e837807c89e6 100644
--- a/pkgs/misc/cups/drivers/samsung/default.nix
+++ b/pkgs/misc/cups/drivers/samsung/default.nix
@@ -69,7 +69,7 @@ in stdenv.mkDerivation rec {
 
   preFixup = ''
     for bin in "$out/bin/"*; do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$bin"
+      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$bin"
       patchelf --set-rpath "$out/lib:${stdenv.lib.getLib cups}/lib" "$bin"
     done
 
diff --git a/pkgs/misc/drivers/gutenprint/bin.nix b/pkgs/misc/drivers/gutenprint/bin.nix
index ac3e96e26589..768b9902c4b6 100644
--- a/pkgs/misc/drivers/gutenprint/bin.nix
+++ b/pkgs/misc/drivers/gutenprint/bin.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
         $out/cups/lib/backend/{canon,epson} \
         $out/sbin/cups-genppd.5.0 \
       ; do
-      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
           --set-rpath $libPath $p
     done
     
diff --git a/pkgs/misc/drivers/sundtek/default.nix b/pkgs/misc/drivers/sundtek/default.nix
index 4dc0f2591d82..1d7021137c0b 100644
--- a/pkgs/misc/drivers/sundtek/default.nix
+++ b/pkgs/misc/drivers/sundtek/default.nix
@@ -34,7 +34,7 @@ in
 
     postFixup = ''
       find $out -type f -exec \
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" {} \
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" {} \
         patchelf --set-rpath ${rpath} {} \;
     '';
 
diff --git a/pkgs/misc/foldingathome/default.nix b/pkgs/misc/foldingathome/default.nix
index aaa932c0a1c4..1b8bdc891b00 100644
--- a/pkgs/misc/foldingathome/default.nix
+++ b/pkgs/misc/foldingathome/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   installPhase = ''
     BINFILES="fah6 mpiexec";
     for a in $BINFILES; do 
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $a
+      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $a
     done
     mkdir -p $out/bin
     cp $BINFILES $out/bin
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index e7825a0ebd69..3d7bb74ce213 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -131,7 +131,7 @@ in stdenv.mkDerivation rec {
       "install -Dm444 usr/src/amdgpu-pro-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
   + ''
     mv $out/etc/vulkan $out/share
-    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    interpreter="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
     libPath="$out/lib:$out/lib/gbm:$depLibPath"
   '' + optionalString (!stdenv.is64bit) ''
     for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index e67e54f7b439..1fdff871b73f 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace configure \
       --replace '#define ELF_INTERPRETER "$interp"' \
-                "#define ELF_INTERPRETER \"$(cat $NIX_CC/nix-support/dynamic-linker)\""
+                "#define ELF_INTERPRETER \"$(cat $NIX_BINUTILS/nix-support/dynamic-linker)\""
   '';
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index bb714f60c2df..a029b582f38b 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
     for f in $out/bin/*; do
       if isELF "$f"; then
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f"
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$f"
         patchelf --set-rpath "$out/lib" "$f"
       fi
     done
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
index 5d47df9a87a7..a4704fd51dfa 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
@@ -81,7 +81,7 @@ installPhase() {
 
         for i in nvidia-settings nvidia-xconfig; do
 	    cp usr/bin/$i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+	    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
 	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
         done
     
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 99813d38236b..f41229ace86c 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -111,7 +111,7 @@ installPhase() {
         for i in nvidia-cuda-mps-control nvidia-cuda-mps-server nvidia-smi nvidia-debugdump; do
             if [ -e "$i" ]; then
                 install -Dm755 $i $bin/bin/$i
-                patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
                     --set-rpath $out/lib:$libPath $bin/bin/$i
             fi
         done
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 9ca48ccaf057..bc574bc0d799 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
 
         for i in $out/bin/* $out/sbin/*; do
           patchelf \
-            --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
             --set-rpath "$out/lib:$libPath" \
             $i
         done
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 4668ac240961..787c685e61e1 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/platform
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/bin/platform
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/meteor/default.nix b/pkgs/servers/meteor/default.nix
index 0b82f1deef62..36384da20478 100644
--- a/pkgs/servers/meteor/default.nix
+++ b/pkgs/servers/meteor/default.nix
@@ -39,21 +39,21 @@ stdenv.mkDerivation rec {
     patch -p1 < ${./main.patch}
     popd
     substituteInPlace $out/tools/cli/main.js \
-      --replace "@INTERPRETER@" "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --replace "@INTERPRETER@" "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --replace "@RPATH@" "${lib.makeLibraryPath [ stdenv.cc.cc zlib ]}" \
       --replace "@PATCHELF@" "${patchelf}/bin/patchelf"
 
     # Patch node.
     node=$devBundle/bin/node
     patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
       --set-rpath "$(patchelf --print-rpath $node):${stdenv.cc.cc.lib}/lib" \
       $node
 
     # Patch mongo.
     for p in $devBundle/mongodb/bin/mongo{,d}; do
       patchelf \
-        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
         --set-rpath "$(patchelf --print-rpath $p):${lib.makeLibraryPath [ stdenv.cc.cc zlib ]}" \
         $p
     done
diff --git a/pkgs/servers/monitoring/newrelic-sysmond/default.nix b/pkgs/servers/monitoring/newrelic-sysmond/default.nix
index e9a9fcff2b93..8ba554d1b771 100644
--- a/pkgs/servers/monitoring/newrelic-sysmond/default.nix
+++ b/pkgs/servers/monitoring/newrelic-sysmond/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     install -v -m755 daemon/nrsysmond.x64 $out/bin/nrsysmond
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/nrsysmond
   '';
 
diff --git a/pkgs/servers/sql/oracle-xe/default.nix b/pkgs/servers/sql/oracle-xe/default.nix
index e86406cd469c..f499743d7621 100644
--- a/pkgs/servers/sql/oracle-xe/default.nix
+++ b/pkgs/servers/sql/oracle-xe/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
       \( -name '*.sh' \
       -o -path "$basedir/bin/*" \
       \) -print -exec "${patchelf}/bin/patchelf" \
-           --interpreter "$(cat "$NIX_CC/nix-support/dynamic-linker")" \
+           --interpreter "$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")" \
            --set-rpath "${libs}:$out/libexec/oracle/lib" \
            --force-rpath '{}' \;
   '';
diff --git a/pkgs/tools/filesystems/yandex-disk/default.nix b/pkgs/tools/filesystems/yandex-disk/default.nix
index 77302f3d4a2b..72291ccb0061 100644
--- a/pkgs/tools/filesystems/yandex-disk/default.nix
+++ b/pkgs/tools/filesystems/yandex-disk/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
       $out/etc/bash_completion.d/yandex-disk-completion.bash
 
     ${patchelf}/bin/patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath "${zlib.out}/lib:${p.gcclib}" \
       $out/bin/yandex-disk
   '';
diff --git a/pkgs/tools/misc/megacli/default.nix b/pkgs/tools/misc/megacli/default.nix
index 5341c9840be8..cf15473e2403 100644
--- a/pkgs/tools/misc/megacli/default.nix
+++ b/pkgs/tools/misc/megacli/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     cd $out
     unzip ${src}
     rpmextract linux/MegaCli-8.07.07-1.noarch.rpm
-    ${patchelf}/bin/patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath ${libPath}:$out/opt/lsi/3rdpartylibs/x86_64:$out/opt/lsi/3rdpartylibs:${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib opt/MegaRAID/MegaCli/MegaCli64
+    ${patchelf}/bin/patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath ${libPath}:$out/opt/lsi/3rdpartylibs/x86_64:$out/opt/lsi/3rdpartylibs:${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib opt/MegaRAID/MegaCli/MegaCli64
     wrapProgram $out/opt/MegaRAID/MegaCli/MegaCli64 --set LD_LIBRARY_PATH $out/opt/lsi/3rdpartylibs/x86_64
     ln -s $out/opt/MegaRAID/MegaCli/MegaCli64 $out/bin/MegaCli64
     eval fixupPhase
diff --git a/pkgs/tools/misc/ocz-ssd-guru/default.nix b/pkgs/tools/misc/ocz-ssd-guru/default.nix
index 21786f3f15f5..9b98ac0137cd 100644
--- a/pkgs/tools/misc/ocz-ssd-guru/default.nix
+++ b/pkgs/tools/misc/ocz-ssd-guru/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     cp ${system}/SSDGuru $out/bin/
     rm -rf linux{32,64}
     patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       --set-rpath $libPath:$out \
       $out/bin/SSDGuru
 
diff --git a/pkgs/tools/misc/sam-ba/default.nix b/pkgs/tools/misc/sam-ba/default.nix
index 2d1db4eb64c7..68675958fd3e 100644
--- a/pkgs/tools/misc/sam-ba/default.nix
+++ b/pkgs/tools/misc/sam-ba/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin/" \
              "$out/opt/sam-ba/"
     cp -a . "$out/opt/sam-ba/"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/opt/sam-ba/sam-ba${maybe64}"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/opt/sam-ba/sam-ba${maybe64}"
     cat > "$out/bin/sam-ba" << EOF
     export LD_LIBRARY_PATH="${libPath}"
     exec "$out/opt/sam-ba/sam-ba${maybe64}"
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index e1d6604970e5..538f9d4a9455 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     mv opt/staruml $out/bin
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
       $out/bin/StarUML
 
     mkdir -p $out/lib
diff --git a/pkgs/tools/misc/xflux/default.nix b/pkgs/tools/misc/xflux/default.nix
index d0f358446952..b861c9b4d9da 100644
--- a/pkgs/tools/misc/xflux/default.nix
+++ b/pkgs/tools/misc/xflux/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     cp  xflux "$out/bin"
   '';
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "$libPath" "$out/bin/xflux"
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "$libPath" "$out/bin/xflux"
   '';
   meta = {
     description = "Adjusts your screen to emit warmer light at night";
diff --git a/pkgs/tools/security/encryptr/default.nix b/pkgs/tools/security/encryptr/default.nix
index 2cf07c63a84a..abea3eccf124 100644
--- a/pkgs/tools/security/encryptr/default.nix
+++ b/pkgs/tools/security/encryptr/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
     cp -v lib* $out/lib
     ln -sv ${systemd.lib}/lib/libudev.so.1 $out/lib/libudev.so.0
 
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
              --set-rpath $out/lib:${rpath} \
              $out/bin/encryptr
   '';
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 449a6911a150..5774de21c549 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -73,7 +73,7 @@ let
       	$out/share/applications/enpass.desktop
 
       for i in $out/bin/{Enpass,EnpassHelper/EnpassHelper}; do
-        patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $i
+        patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $i
       done
 
       # The helper's sha256 sum must match, hence the use of libredirect.
diff --git a/pkgs/tools/security/fprot/default.nix b/pkgs/tools/security/fprot/default.nix
index 14a4c985d502..0062758196f3 100644
--- a/pkgs/tools/security/fprot/default.nix
+++ b/pkgs/tools/security/fprot/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp f-prot.conf.default $out/opt/f-prot/f-prot.conf
     ln -s $out/opt/f-prot/fpupdate $out/bin/fpupdate
 
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/f-prot/fpupdate
+    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/opt/f-prot/fpupdate
 
     mkdir -p $out/share/man/
     mkdir -p $out/share/man/man1
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index cbd260455d8e..dc99d1953d56 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = let
-    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
+    interpreter = "$(< \"$NIX_BINUTILS/nix-support/dynamic-linker\")";
     libPath = stdenv.lib.makeLibraryPath [ libXft libX11 freetype fontconfig libXrender libXScrnSaver libXext ];
   in ''
     mkdir -p $out/opt/password-gorilla
diff --git a/pkgs/tools/security/keybase-gui/default.nix b/pkgs/tools/security/keybase-gui/default.nix
index a45a6ea2a04c..63bba05b6a09 100644
--- a/pkgs/tools/security/keybase-gui/default.nix
+++ b/pkgs/tools/security/keybase-gui/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/keybase-gui
   '';
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "${libPath}:\$ORIGIN" "$out/share/keybase/Keybase"
+    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "${libPath}:\$ORIGIN" "$out/share/keybase/Keybase"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/xidel/default.nix b/pkgs/tools/text/xidel/default.nix
index 91cecce61225..95b8e270689f 100644
--- a/pkgs/tools/text/xidel/default.nix
+++ b/pkgs/tools/text/xidel/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out/bin"
     cp -a usr/* "$out/"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/bin/xidel"
+    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/bin/xidel"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/top-level/haxe-packages.nix b/pkgs/top-level/haxe-packages.nix
index 5a85dc3433ba..a79f264848b8 100644
--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@@ -67,7 +67,7 @@ let
       postFixup = ''
         for f in $out/lib/haxe/${withCommas libname}/${withCommas version}/{,project/libs/nekoapi/}bin/Linux{,64}/*; do
           chmod +w "$f"
-          patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker)   "$f" || true
+          patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker)   "$f" || true
           patchelf --set-rpath ${ stdenv.lib.makeLibraryPath [ stdenv.cc.cc ] }  "$f" || true
         done
       '';

From dbf6d20d64af8572ae4a24850244befc475eea9e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 26 Aug 2017 11:43:30 -0400
Subject: [PATCH 033/134] binutils-wrapper: Import separately from cc-wrapper

---
 .../binutils-wrapper/default.nix              |  2 +-
 pkgs/build-support/cc-wrapper/default.nix     | 18 +-----
 pkgs/development/compilers/llvm/3.4/llvm.nix  |  2 +-
 pkgs/development/compilers/llvm/3.5/llvm.nix  |  2 +-
 pkgs/development/compilers/llvm/3.7/llvm.nix  |  2 +-
 pkgs/development/compilers/llvm/3.8/llvm.nix  |  2 +-
 pkgs/development/compilers/llvm/3.9/llvm.nix  |  2 +-
 pkgs/development/compilers/llvm/4/llvm.nix    |  2 +-
 pkgs/development/compilers/mono/llvm.nix      |  2 +-
 pkgs/stdenv/darwin/default.nix                | 55 ++++++++++++-------
 pkgs/stdenv/linux/default.nix                 | 35 ++++++++++--
 pkgs/top-level/all-packages.nix               | 22 ++++++--
 pkgs/top-level/darwin-packages.nix            |  4 +-
 13 files changed, 95 insertions(+), 55 deletions(-)

diff --git a/pkgs/build-support/binutils-wrapper/default.nix b/pkgs/build-support/binutils-wrapper/default.nix
index e885078c3de7..7e255cdb2eb1 100644
--- a/pkgs/build-support/binutils-wrapper/default.nix
+++ b/pkgs/build-support/binutils-wrapper/default.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "man" ];
 
   passthru = {
-    inherit libc nativeTools nativeLibc nativePrefix prefix;
+    inherit binutils libc nativeTools nativeLibc nativePrefix prefix;
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index c9820c27ea5e..30520290086c 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -6,18 +6,17 @@
 # compiler and the linker just "work".
 
 { name ? "", stdenv, nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
-, cc ? null, libc ? null, binutils ? null, coreutils ? null, shell ? stdenv.shell
+, cc ? null, libc ? null, binutils, coreutils ? null, shell ? stdenv.shell
 , zlib ? null, extraPackages ? [], extraBuildCommands ? ""
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
-, useMacosReexportHack ? false
-} @ args:
+}:
 
 with stdenv.lib;
 
 assert nativeTools -> nativePrefix != "";
 assert !nativeTools ->
-  cc != null && binutils != null && coreutils != null && gnugrep != null;
+  cc != null && coreutils != null && gnugrep != null;
 assert !(nativeLibc && noLibc);
 assert (noLibc || nativeLibc) == (libc == null);
 
@@ -27,17 +26,6 @@ assert cc.langVhdl or false -> zlib != null;
 let
   inherit (stdenv) hostPlatform targetPlatform;
 
-  binutils = import ../binutils-wrapper {
-    inherit (args) binutils;
-    inherit # name
-      stdenv nativeTools noLibc nativeLibc nativePrefix
-      libc
-      coreutils shell gnugrep
-      extraPackages extraBuildCommands
-      buildPackages
-      useMacosReexportHack;
-  };
-
   # Prefix for binaries. Customarily ends with a dash separator.
   #
   # TODO(@Ericson2314) Make unconditional, or optional but always true by
diff --git a/pkgs/development/compilers/llvm/3.4/llvm.nix b/pkgs/development/compilers/llvm/3.4/llvm.nix
index 79b0c9ff898d..2080aa64149b 100644
--- a/pkgs/development/compilers/llvm/3.4/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.4/llvm.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_REQUIRES_RTTI=1"
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev or binutils}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev or binutils.binutils}/include"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
   ] ++ stdenv.lib.optional (!stdenv.isDarwin) "-DBUILD_SHARED_LIBS=ON";
 
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
index c5503da9b838..b88cd232415e 100644
--- a/pkgs/development/compilers/llvm/3.5/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries
     "-DBUILD_SHARED_LIBS=ON"
     ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DCMAKE_CXX_FLAGS=-stdlib=libc++"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index 81aaa7cd65c2..ce35a71272bb 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries
     "-DBUILD_SHARED_LIBS=ON"
     ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index a3f652d783be..ce366cb4973f 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 654e1ce0023b..98d5a0edffe6 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -106,7 +106,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
     ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 4978570334ea..c116164f5031 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -90,7 +90,7 @@ in stdenv.mkDerivation rec {
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
   ]
   ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
   ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/mono/llvm.nix b/pkgs/development/compilers/mono/llvm.nix
index 1036e43ea941..70eac4e83b3e 100644
--- a/pkgs/development/compilers/mono/llvm.nix
+++ b/pkgs/development/compilers/mono/llvm.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = with stdenv; [
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
   ] ++ stdenv.lib.optional (!isDarwin) "-DBUILD_SHARED_LIBS=ON";
 
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index f4801d674e8a..d71cda7f8a96 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -63,10 +63,40 @@ in rec {
                           extraBuildInputs,
                           allowedRequisites ? null}:
     let
+      buildPackages = lib.optionalAttrs (last ? stdenv) {
+        inherit (last) stdenv;
+      };
+
+      coreutils = { name = "coreutils-9.9.9"; outPath = bootstrapTools; };
+      gnugrep   = { name = "gnugrep-9.9.9";   outPath = bootstrapTools; };
+
+      binutils = import ../../build-support/binutils-wrapper {
+        inherit shell;
+        inherit (last) stdenv;
+
+        nativeTools  = false;
+        nativeLibc   = false;
+        inherit buildPackages coreutils gnugrep;
+        libc         = last.pkgs.darwin.Libsystem;
+        binutils     = { name = "binutils-9.9.9";  outPath = bootstrapTools; };
+      };
+
+      cc = if isNull last then "/dev/null" else import ../../build-support/cc-wrapper {
+        inherit shell;
+        inherit (last) stdenv;
+
+        nativeTools  = false;
+        nativeLibc   = false;
+        inherit buildPackages coreutils gnugrep binutils;
+        libc         = last.pkgs.darwin.Libsystem;
+        isClang      = true;
+        cc           = { name = "clang-9.9.9";     outPath = bootstrapTools; };
+      };
+
       thisStdenv = import ../generic {
         inherit config shell extraNativeBuildInputs extraBuildInputs;
         allowedRequisites = if allowedRequisites == null then null else allowedRequisites ++ [
-          thisStdenv.cc.expand-response-params
+          cc.expand-response-params cc.binutils
         ];
 
         name = "stdenv-darwin-boot-${toString step}";
@@ -75,24 +105,9 @@ in rec {
         hostPlatform = localSystem;
         targetPlatform = localSystem;
 
-        cc = if isNull last then "/dev/null" else import ../../build-support/cc-wrapper {
-          inherit shell;
-          inherit (last) stdenv;
+        inherit cc;
 
-          nativeTools  = false;
-          nativeLibc   = false;
-          buildPackages = lib.optionalAttrs (last ? stdenv) {
-            inherit (last) stdenv;
-          };
-          libc         = last.pkgs.darwin.Libsystem;
-          isClang      = true;
-          cc           = { name = "clang-9.9.9";     outPath = bootstrapTools; };
-          binutils     = { name = "binutils-9.9.9";  outPath = bootstrapTools; };
-          coreutils    = { name = "coreutils-9.9.9"; outPath = bootstrapTools; };
-          gnugrep      = { name = "gnugrep-9.9.9";   outPath = bootstrapTools; };
-        };
-
-        preHook = stage0.stdenv.lib.optionalString (shell == "${bootstrapTools}/bin/bash") ''
+        preHook = lib.optionalString (shell == "${bootstrapTools}/bin/bash") ''
           # Don't patch #!/interpreter because it leads to retained
           # dependencies on the bootstrapTools in the final stdenv.
           dontPatchShebangs=1
@@ -350,8 +365,8 @@ in rec {
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
       bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped patch pcre.out binutils-raw.out
-      binutils-raw.dev binutils gettext
+      gnugrep llvmPackages.clang-unwrapped patch pcre.out gettext
+      binutils-raw.binutils.out binutils-raw.binutils.dev binutils binutils.binutils
       cc.expand-response-params
     ]) ++ (with pkgs.darwin; [
       dyld Libsystem CF cctools ICU libiconv locale
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index fab1985b9765..08166c55a5a9 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -143,7 +143,16 @@ in
         '';
       };
       gcc-unwrapped = bootstrapTools;
-      binutils = bootstrapTools;
+      binutils = import ../../build-support/binutils-wrapper {
+        nativeTools = false;
+        nativeLibc = false;
+        buildPackages = { };
+        libc = self.glibc;
+        inherit (self) coreutils gnugrep;
+        binutils = bootstrapTools;
+        name = "bootstrap-binutils-wrapper";
+        stdenv = self.stdenv;
+      };
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
     };
@@ -165,7 +174,7 @@ in
 
     # Rebuild binutils to use from stage2 onwards.
     overrides = self: super: {
-      binutils = super.binutils.override { gold = false; };
+      binutils = super.binutils_nogold;
       inherit (prevStage)
         ccWrapperStdenv
         glibc gcc-unwrapped coreutils gnugrep;
@@ -188,9 +197,14 @@ in
     overrides = self: super: {
       inherit (prevStage)
         ccWrapperStdenv
-        binutils gcc-unwrapped coreutils gnugrep
+        gcc-unwrapped coreutils gnugrep
         perl paxctl gnum4 bison;
       # This also contains the full, dynamically linked, final Glibc.
+      binutils = prevStage.binutils.override {
+        # Rewrap the binutils with the new glibc, so both the next
+        # stage's wrappers use it.
+        libc = self.glibc;
+      };
     };
   })
 
@@ -235,6 +249,15 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison gmp perl glibc zlib linuxHeaders;
 
+      binutils = super.binutils.override {
+        # Don't use stdenv's shell but our own
+        shell = self.bash + "/bin/bash";
+        # Build expand-response-params with last stage like below
+        buildPackages = {
+          inherit (prevStage) stdenv;
+        };
+      };
+
       gcc = lib.makeOverridable (import ../../build-support/cc-wrapper) {
         nativeTools = false;
         nativeLibc = false;
@@ -299,8 +322,8 @@ in
       allowedRequisites = with prevStage; with lib;
         # Simple executable tools
         concatMap (p: [ (getBin p) (getLib p) ])
-          [ gzip bzip2 xz bash binutils coreutils diffutils findutils gawk
-            gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
+          [ gzip bzip2 xz bash binutils.binutils coreutils diffutils findutils
+            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
           ]
         # Library dependencies
         ++ map getLib (
@@ -310,7 +333,7 @@ in
         # More complicated cases
         ++ [
             glibc.out glibc.dev glibc.bin/*propagated from .dev*/ linuxHeaders
-            gcc gcc.cc gcc.cc.lib gcc.expand-response-params
+            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params
           ]
           ++ lib.optionals (system == "aarch64-linux")
             [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e1f96698e2a2..d0b295c0c2fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5223,7 +5223,9 @@ with pkgs;
 
   clang-sierraHack = clang.override {
     name = "clang-wrapper-with-reexport-hack";
-    useMacosReexportHack = true;
+    binutils = clang.binutils.override {
+      useMacosReexportHack = true;
+    };
   };
 
   clang_4  = llvmPackages_4.clang;
@@ -6115,6 +6117,7 @@ with pkgs;
   };
 
   ccWrapperFun = callPackage ../build-support/cc-wrapper;
+  binutilsWrapperFun = callPackage ../build-support/binutils-wrapper;
 
   wrapCC = wrapCCWith stdenv.cc.libc "";
   # legacy version, used for gnat bootstrapping
@@ -6140,6 +6143,15 @@ with pkgs;
       inherit cc binutils libc shell name;
     };
 
+  wrapBinutils = baseBinutils: binutilsWrapperFun {
+    nativeTools = stdenv.cc.nativeTools or false;
+    nativeLibc = stdenv.cc.nativeLibc or false;
+    nativePrefix = stdenv.cc.nativePrefix or "";
+    libc = stdenv.cc.libc;
+    binutils = baseBinutils;
+    extraBuildCommands = "";
+  };
+
   # prolog
   yap = callPackage ../development/compilers/yap { };
 
@@ -6690,13 +6702,15 @@ with pkgs;
     then darwin.binutils
     else binutils-raw;
 
-  binutils-raw = callPackage ../development/tools/misc/binutils {
+  binutils-raw = wrapBinutils (callPackage ../development/tools/misc/binutils {
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (targetPlatform != buildPlatform) || noSysDirs;
-  };
+  });
 
   binutils_nogold = lowPrio (binutils-raw.override {
-    gold = false;
+    binutils = binutils-raw.binutils.override {
+      gold = false;
+    };
   });
 
   bison2 = callPackage ../development/tools/parsing/bison/2.x.nix { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 32d540a8f967..a8c8f744d8a1 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -10,9 +10,9 @@ in
 
   apple_sdk = callPackage ../os-specific/darwin/apple-sdk { };
 
-  binutils = callPackage ../os-specific/darwin/binutils {
+  binutils = pkgs.wrapBinutils (callPackage ../os-specific/darwin/binutils {
     inherit (darwin) cctools;
-  };
+  });
 
   cctools = callPackage ../os-specific/darwin/cctools/port.nix {
     inherit (darwin) libobjc maloader;

From b64736a8e4eae4c3b5267c9f6a7e6d741c1165c2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 31 Aug 2017 23:07:41 -0400
Subject: [PATCH 034/134] darwin binutils: Unwrap GNU Binutils before splicing
 with cctools

---
 pkgs/os-specific/darwin/binutils/default.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 933e7558dbbf..690fd93fcf8a 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -2,12 +2,15 @@
 , hostPlatform, targetPlatform
 }:
 
+# despite the name, binutils-raw is in fact wrapped.
+let binutils-unwrapped = binutils-raw.binutils; in
+
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same prefix.
-assert binutils-raw.prefix == cctools.prefix;
+assert binutils-unwrapped.prefix == cctools.prefix;
 
 let
-  inherit (binutils-raw) prefix;
+  inherit (binutils-unwrapped) prefix;
   cmds = [
     "ar" "ranlib" "as" "dsymutil" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
@@ -20,7 +23,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-raw.out}/bin/${prefix}c++filt $out/bin/${prefix}c++filt
+    ln -s ${binutils-unwrapped.out}/bin/${prefix}c++filt $out/bin/${prefix}c++filt
 
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
@@ -37,7 +40,7 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
-    for i in ${binutils-raw.dev or binutils-raw.out}/include/*.h; do
+    for i in ${binutils-unwrapped.dev or binutils-unwrapped.out}/include/*.h; do
       ln -s "$i" "$out/include/$(basename $i)"
     done
 
@@ -46,8 +49,8 @@ stdenv.mkDerivation {
     done
 
     # FIXME: this will give us incorrect man pages for bits of cctools
-    ln -s ${binutils-raw.out}/share $out/share
-    ln -s ${binutils-raw.out}/lib $out/lib
+    ln -s ${binutils-unwrapped.out}/share $out/share
+    ln -s ${binutils-unwrapped.out}/lib $out/lib
 
     ln -s ${cctools}/libexec $out/libexec
   '';

From ce359d49fb409083416031d37e080f8d14ffb5e5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Aug 2017 13:14:14 -0400
Subject: [PATCH 035/134] gcc_multi: Fix so binutils wrapper also has
 glibc_multi

---
 pkgs/top-level/all-packages.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d0b295c0c2fb..eb0daba46ec0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1790,7 +1790,7 @@ with pkgs;
   emscripten = callPackage ../development/compilers/emscripten { };
 
   emscriptenfastcomp-unwrapped = callPackage ../development/compilers/emscripten-fastcomp { };
-  emscriptenfastcomp-wrapped = wrapCCWith stdenv.cc.libc ''
+  emscriptenfastcomp-wrapped = wrapCCWith stdenv.cc.libc stdenv.cc.binutils ''
     # hardening flags break WASM support
     cat > $out/nix-support/add-hardening.sh
   '' emscriptenfastcomp-unwrapped;
@@ -5311,8 +5311,12 @@ with pkgs;
         extraBuildCommands = ''
           echo "dontMoveLib64=1" >> $out/nix-support/setup-hook
         '';
-      in wrapCCWith glibc_multi extraBuildCommands (cc.cc.override {
-        stdenv = overrideCC stdenv (wrapCCWith glibc_multi "" cc.cc);
+        # Binutils with glibc multi
+        binutils = cc.binutils.override {
+          libc = glibc_multi;
+        };
+      in wrapCCWith glibc_multi binutils extraBuildCommands (cc.cc.override {
+        stdenv = overrideCC stdenv (wrapCCWith glibc_multi binutils "" cc.cc);
         profiledCompiler = false;
         enableMultilib = true;
       }))
@@ -6106,20 +6110,20 @@ with pkgs;
 
   wla-dx = callPackage ../development/compilers/wla-dx { };
 
-  wrapCCWith = libc: extraBuildCommands: baseCC: ccWrapperFun {
+  wrapCCWith = libc: binutils: extraBuildCommands: baseCC: ccWrapperFun {
     nativeTools = stdenv.cc.nativeTools or false;
     nativeLibc = stdenv.cc.nativeLibc or false;
     nativePrefix = stdenv.cc.nativePrefix or "";
     cc = baseCC;
     isGNU = baseCC.isGNU or false;
     isClang = baseCC.isClang or false;
-    inherit libc extraBuildCommands;
+    inherit libc binutils extraBuildCommands;
   };
 
   ccWrapperFun = callPackage ../build-support/cc-wrapper;
   binutilsWrapperFun = callPackage ../build-support/binutils-wrapper;
 
-  wrapCC = wrapCCWith stdenv.cc.libc "";
+  wrapCC = wrapCCWith stdenv.cc.libc stdenv.cc.binutils "";
   # legacy version, used for gnat bootstrapping
   wrapGCC-old = baseGCC: callPackage ../build-support/gcc-wrapper-old {
     nativeTools = stdenv.cc.nativeTools or false;

From b29891644221fd906f3e825a04a2daea5cd4b3d2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 30 Aug 2017 13:39:37 -0400
Subject: [PATCH 036/134] rpm: Fix to get raw binutils for headers

---
 pkgs/tools/package-management/rpm/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 78d815eb7c19..6a9c46671282 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -13,8 +13,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua pkgconfig autoreconfHook ];
 
-  # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
-  propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive binutils ];
+  # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as
+  # linkage requirements
+  #
+  # Binutils.binutils for headers
+  propagatedBuildInputs = [
+    popt elfutils nss db bzip2 libarchive binutils binutils.binutils
+  ];
 
   NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 

From e6353a82bfcbf0efd7c5fe9dd39b965a003a78e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maximilian=20G=C3=BCntner?= <code@sourcediver.org>
Date: Fri, 1 Sep 2017 21:00:31 +0200
Subject: [PATCH 037/134] samba: 4.6.4 -> 4.6.7

---
 pkgs/servers/samba/4.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index d7b1c8173dde..1e1cc369136c 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -19,11 +19,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "samba-${version}";
-  version = "4.6.4";
+  version = "4.6.7";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${name}.tar.gz";
-    sha256 = "0qcsinhcq3frlqp7bfav5mdc9xn1h4xy4l6vfpf8cmcfs4lp7ija";
+    sha256 = "1ynxndfk45zkkylz3jsrx42a7kmm42jddk5bdhihyf88vs9l7wly";
   };
 
   outputs = [ "out" "dev" "man" ];

From 44cc709e29a67c8c6d361157c05916fee235ec7a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 1 Sep 2017 15:33:59 -0400
Subject: [PATCH 038/134] doc: Document Binutils Wrapper

Shrunk the CC Wrapper documentation so as not to be repetative.
---
 doc/stdenv.xml | 60 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 42 insertions(+), 18 deletions(-)

diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index dac53bc2b800..5d6d9f595097 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -1,4 +1,3 @@
-
 <chapter xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xml:id="chap-stdenv">
@@ -1342,33 +1341,58 @@ someVar=$(stripHash $name)
 
 <variablelist>
 
+  <varlistentry>
+    <term>Binutils Wrapper</term>
+    <listitem>
+      <para>
+        Binutils Wrapper wraps the binary utilities for a bunch of miscellaneous purposes.
+        Specifically, GNU Binutils (for Linux, but a mix of cctools and GNU Binutils for Darwin), and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by Binutils Wrapper.
+        Packages typically depend on CC Wrapper, which in turn (at run time) depends on binutils-wrapper.
+      </para>
+      <para>
+        Binutils Wrapper was only just recently split off from CC Wrapper, so the division of labor is still being worked out.
+        For example, it shouldn't care about about the C standard library, but just take a derivation with the dynamic loader (which happens to be the glibc on linux).
+        Dependency finding however is a task both wrappers will continue to need to share, and probably the most important to understand.
+        It is currently accomplished by collecting directories of host-platform dependencies (i.e. <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>) in environment variables.
+        Binutils Wrapper's setup hook causes any <filename>lib</filename> and <filename>lib64</filename> subdirectories to <envar>NIX_LDFLAGS</envar>.
+        Sine CC Wrapper and Binutils Wrapper use the same strategy, most of the Binutils Wrapper code is sparsely commented and refers to CC Wrapper.
+        But CC Wrapper's code, by contrast, has quite lengthy comments.
+        Binutils Wrapper merely cites those, rather than repeating them, to avoid falling out of sync.
+      </para>
+      <para>
+        A final task of the setup hook is defining a number of standard environment variables to tell build systems which executables full-fill which purpose.
+        They are defined to just be the base name of the tools, under the assumption that Binutils Wrapper's binaries will be on the path.
+        Firstly, this helps poorly-written packages, e.g. ones that look for just <command>gcc</command> when <envar>CC</envar> isn't defined yet <command>clang</command> is to be used.
+        Secondly, this helps packages not get confused when cross-compiling, in which case multiple Binutils Wrappers may be simultaneous in use (targeting different platforms).
+        <envar>BUILD_</envar>- and <envar>TARGET_</envar>-prefixed versions of the normal environment variable are defined for the additional Binutils Wrappers, properly disambiguating them.
+      </para>
+      <para>
+        A problem with this final task is that Binutils Wrapper is honest and defines <envar>LD</envar> as <command>ld</command>.
+        Most packages, however, firstly use the C compiler for linking, secondly use <envar>LD</envar> anyways, defining it as the C compiler, and thirdly, only so define <envar>LD</envar> when it is undefined as a fallback.
+        This triple-threat means Binutils Wrapper will break those packages, as LD is already defined as the actually linker which the package won't override yet doesn't want to use.
+        The workaround is to define, just for the problematic package, <envar>LD</envar> as the C compiler.
+        A good way to do this would be <command>preConfigure = "LD=$CC"</command>.
+      </para>
+    </listitem>
+  </varlistentry>
+
   <varlistentry>
     <term>CC Wrapper</term>
     <listitem>
       <para>
         CC Wrapper wraps a C toolchain for a bunch of miscellaneous purposes.
-        Specifically, a C compiler (GCC or Clang), Binutils (or the CCTools + binutils mashup when targetting Darwin), and a C standard library (glibc or Darwin's libSystem) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by CC Wrapper.
-        Packages typically depend on only CC Wrapper, instead of those 3 inputs directly.
+        Specifically, a C compiler (GCC or Clang), Binutils (or the CCTools + binutils mashup when targetting Darwin), and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by Binutils Wrapper.
+        Packages typically depend on CC Wrapper, which in turn (at run time) depends on Binutils Wrapper.
       </para>
       <para>
-        Dependency finding is undoubtedly the main task of CC wrapper.
-        It is currently accomplished by collecting directories of host-platform dependencies (i.e. <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>) in environment variables.
-        CC wrapper's setup hook causes any <filename>include</filename> subdirectory of such a dependency to be added to <envar>NIX_CFLAGS_COMPILE</envar>, and any <filename>lib</filename> and <filename>lib64</filename> subdirectories to <envar>NIX_LDFLAGS</envar>.
+        Dependency finding is undoubtedly the main task of CC Wrapper.
+        This works just like Binutils Wrapper, except the any <filename>include</filename> subdirectory of any relevant dependency is added to <envar>NIX_CFLAGS_COMPILE</envar>.
         The setup hook itself contains some lengthy comments describing the exact convoluted mechanism by which this is accomplished.
       </para>
       <para>
-        A final task of the setup hook is defining a number of standard environment variables to tell build systems which executables full-fill which purpose.
-        They are defined to just be the base name of the tools, under the assumption that CC Wrapper's binaries will be on the path.
-        Firstly, this helps poorly-written packages, e.g. ones that look for just <command>gcc</command> when <envar>CC</envar> isn't defined yet <command>clang</command> is to be used.
-        Secondly, this helps packages not get confused when cross-compiling, in which case multiple CC wrappers may be simultaneous in use (targeting different platforms).
-        <envar>BUILD_</envar>- and <envar>TARGET_</envar>-prefixed versions of the normal environment variable are defined for the additional CC Wrappers, properly disambiguating them.
-      </para>
-      <para>
-        A problem with this final task is that CC Wrapper is honest and defines <envar>LD</envar> as <command>ld</command>.
-        Most packages, however, firstly use the C compiler for linking, secondly use <envar>LD</envar> anyways, defining it as the C compiler, and thirdly, only so define <envar>LD</envar> when it is undefined as a fallback.
-        This triple-threat means CC Wrapper will break those packages, as LD is already defined as the actually linker which the package won't override yet doesn't want to use.
-        The workaround is to define, just for the problematic package, <envar>LD</envar> as the C compiler.
-        A good way to do this would be <command>preConfigure = "LD=$CC"</command>.
+        CC Wrapper also like Binutils Wrapper defines standard environment variables with the names of the tools it wraps, for the same reasons described above.
+        Importantly, while it includes a <command>cc</command> symlink to the c compiler for portability, the <envar>CC</envar> will be defined using the compiler's "real name" (i.e. <command>gcc</command> or <command>clang</command>).
+        This helps lousy build systems that inspect on the name of the compiler rather than run it.
       </para>
     </listitem>
   </varlistentry>

From fc8fc63b67989b0516859f7388ff89a1abf97c48 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Sat, 2 Sep 2017 13:08:09 +0200
Subject: [PATCH 039/134] ruby_2_0_0: fix eval due to nested list

---
 pkgs/development/interpreters/ruby/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index f3d4ae4bb00e..60076455dae0 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -83,7 +83,7 @@ let
 
         enableParallelBuilding = true;
 
-        hardeningDisable = lib.optional isRuby20 [ "format" ];
+        hardeningDisable = lib.optional isRuby20 "format";
 
         patches =
           (import ./patchsets.nix {

From 91ede67a5aa5508b582cfecad154f6e037f9a306 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 13:09:14 +0200
Subject: [PATCH 040/134] systemd: use fetchurl for patch

because a hash corresponding to fetchurl was provided.
---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 834418a177b6..06e7204f45a2 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
+{ stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, gperf, libcap, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
 , kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   patches = [
     # TODO: Remove this patch when we have a systemd version
     # with https://github.com/systemd/systemd/pull/6678
-    (fetchpatch {
+    (fetchurl {
         url = "https://github.com/systemd/systemd/commit/58a78ae77063eddfcd23ea272bd2e0ddc9ea3ff7.patch";
         sha256 = "1y09n176f0389qrfrs3fsxj4hly1y1xfnb52rhbgj34704adp5m1";
     })

From f3400b5ca9298ae0bb6bab25219debcccac41567 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:22:13 +0100
Subject: [PATCH 041/134] python.pkgs.urrlib3: 1.20 -> 1.22

---
 .../python-modules/urllib3/default.nix        | 32 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 33 +------------------
 2 files changed, 33 insertions(+), 32 deletions(-)
 create mode 100644 pkgs/development/python-modules/urllib3/default.nix

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
new file mode 100644
index 000000000000..a23ae0f0b74e
--- /dev/null
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, coverage, tornado, mock, nose, psutil, pysocks }:
+
+buildPythonPackage rec {
+  pname = "urllib3";
+  version = "1.22";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0kyvc9zdlxr5r96bng5rhm9a6sfqidrbvvkz64s76qs5267dli6c";
+  };
+
+  NOSE_EXCLUDE = stdenv.lib.concatStringsSep "," [
+    "test_headers" "test_headerdict" "test_can_validate_ip_san" "test_delayed_body_read_timeout"
+    "test_timeout_errors_cause_retries" "test_select_multiple_interrupts_with_event"
+  ];
+
+  checkPhase = ''
+    nosetests -v --cover-min-percentage 1
+  '';
+
+  doCheck = false;
+
+  buildInputs = [ coverage tornado mock nose psutil pysocks ];
+
+  meta = with stdenv.lib; {
+    description = "A Python library for Dropbox's HTTP-based Core and Datastore APIs";
+    homepage = https://www.dropbox.com/developers/core/docs;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 97265230beb9..bcdcb07e5dc2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5347,38 +5347,7 @@ in {
     };
   };
 
-  urllib3 = let
-    disabled_tests = [
-      "test_headers" "test_headerdict" "test_can_validate_ip_san" "test_delayed_body_read_timeout"
-      "test_timeout_errors_cause_retries" "test_select_multiple_interrupts_with_event"
-    ];
-  in buildPythonPackage rec {
-    pname = "urllib3";
-    version = "1.20";
-    name = "${pname}-${version}";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "0bx76if7shzlyykmaj4fhjkir5bswc4fdx5r4q0lrn3q51p2pvwp";
-    };
-
-    NOSE_EXCLUDE=concatStringsSep "," disabled_tests;
-
-    checkPhase = ''
-      nosetests -v --cover-min-percentage 1
-    '';
-
-    doCheck = false;
-
-    buildInputs = with self; [ coverage tornado mock nose psutil pysocks ];
-
-    meta = {
-      description = "A Python library for Dropbox's HTTP-based Core and Datastore APIs";
-      homepage = https://www.dropbox.com/developers/core/docs;
-      license = licenses.mit;
-    };
-  };
-
+  urllib3 = callPackage ../development/python-modules/urllib3 {};
 
   dropbox = buildPythonPackage rec {
     name = "dropbox-${version}";

From b4dbd7fdb8ddb1d9dc00fc24bb616173ce6f801b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:26:52 +0100
Subject: [PATCH 042/134] python.pkgs.chardet: 2.3.0 -> 3.0.4

---
 .../python-modules/chardet/default.nix        | 22 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 16 +-------------
 2 files changed, 23 insertions(+), 15 deletions(-)
 create mode 100644 pkgs/development/python-modules/chardet/default.nix

diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
new file mode 100644
index 000000000000..7e50dca40660
--- /dev/null
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pytest, pytestrunner, hypothesis }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "chardet";
+  version = "3.0.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1bpalpia6r5x1kknbk11p1fzph56fmmnp405ds8icksd3knr5aw4";
+  };
+
+  buildInputs = [ pytest pytestrunner hypothesis ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/chardet/chardet;
+    description = "Universal encoding detector";
+    license = licenses.lgpl2;
+    maintainers = with maintainers; [ domenkozar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bcdcb07e5dc2..aa3d8d438a3d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8713,21 +8713,7 @@ in {
     };
   };
 
-  chardet = buildPythonPackage rec {
-    name = "chardet-2.3.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/c/chardet/${name}.tar.gz";
-      sha256 = "e53e38b3a4afe6d1132de62b7400a4ac363452dc5dfcf8d88e8e0cce663c68aa";
-    };
-
-    meta = {
-      homepage = https://github.com/chardet/chardet;
-      description = "Universal encoding detector";
-      license = licenses.lgpl2;
-      maintainers = with maintainers; [ domenkozar ];
-    };
-  };
+  chardet = callPackage ../development/python-modules/chardet { };
 
   django = self.django_1_11;
 

From 8bc620ddc2bbcf7794194f218d66b0e141d9d1a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:30:51 +0100
Subject: [PATCH 043/134] python.pkgs.flask-compress: 1.3.2 -> 1.4.0

---
 .../python-modules/flask-compress/default.nix | 20 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 18 +----------------
 2 files changed, 21 insertions(+), 17 deletions(-)
 create mode 100644 pkgs/development/python-modules/flask-compress/default.nix

diff --git a/pkgs/development/python-modules/flask-compress/default.nix b/pkgs/development/python-modules/flask-compress/default.nix
new file mode 100644
index 000000000000..c46fce2fe757
--- /dev/null
+++ b/pkgs/development/python-modules/flask-compress/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchPypi, buildPythonPackage, flask }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  version = "1.4.0";
+  pname = "Flask-Compress";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cxdbdiyxkspg7vkchfmaqr7c6q79gwvakna3fjcc6nivps971j6";
+  };
+
+  propagatedBuildInputs = [ flask ];
+
+  meta = with stdenv.lib; {
+    description = "Compress responses in your Flask app with gzip";
+    homepage = "https://libwilliam.github.io/flask-compress/";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index aa3d8d438a3d..a12a95b5132e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9635,23 +9635,7 @@ in {
     };
   };
 
-  flask-compress = buildPythonPackage rec {
-    name = "Flask-Compress-${version}";
-    version = "1.3.2";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/F/Flask-Compress/${name}.tar.gz";
-      sha256 = "4fbb53e7f6ce8b1458a2c3d7a528564912f2641ab2f9f43819fc96ed7f770734";
-    };
-
-    propagatedBuildInputs = with self; [ flask ];
-
-    meta = {
-      description = "Compress responses in your Flask app with gzip";
-      homepage = "https://libwilliam.github.io/flask-compress/";
-      license = licenses.mit;
-    };
-  };
+  flask-compress = callPackage ../development/python-modules/flask-compress { };
 
   flask-cors = buildPythonPackage rec {
     name = "Flask-Cors-${version}";

From 99ed36e590cb290e4092e0fec74d46081680f08f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:34:32 +0100
Subject: [PATCH 044/134] python.pkgs.flask-cors: 2.1.2 -> 3.0.2

---
 .../python-modules/flask-cors/default.nix     | 22 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 19 +---------------
 2 files changed, 23 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/development/python-modules/flask-cors/default.nix

diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
new file mode 100644
index 000000000000..4521374a0bb3
--- /dev/null
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchPypi, buildPythonPackage
+, nose, flask, six }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "Flask-Cors";
+  version = "3.0.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1mnsyyqn8akin2vz98b9fbv63hcvwmfkaapsglw5jizdkmaz628a";
+  };
+
+  buildInputs = [ nose ];
+  propagatedBuildInputs = [ flask six ];
+
+  meta = with stdenv.lib; {
+    description = "A Flask extension adding a decorator for CORS support";
+    homepage = https://github.com/corydolphin/flask-cors;
+    license = with licenses; [ mit ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a12a95b5132e..f07657796139 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9637,24 +9637,7 @@ in {
 
   flask-compress = callPackage ../development/python-modules/flask-compress { };
 
-  flask-cors = buildPythonPackage rec {
-    name = "Flask-Cors-${version}";
-    version = "2.1.2";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/F/Flask-Cors/${name}.tar.gz";
-      sha256 = "0fd618a4f88ykqx4x55viz47cm9rl214q1b45a0b4mz5vhxffqpj";
-    };
-
-    buildInputs = with self; [ nose ];
-    propagatedBuildInputs = with self; [ flask six ];
-
-    meta = {
-      description = "A Flask extension adding a decorator for CORS support";
-      homepage = https://github.com/corydolphin/flask-cors;
-      license = with licenses; [ mit ];
-    };
-  };
+  flask-cors = callPackage ../development/python-modules/flask-cors { };
 
   flask_elastic = callPackage ../development/python-modules/flask-elastic.nix { };
 

From bfabc3a78c909a6f6f0ea88dc2d34deba61c16d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:44:05 +0100
Subject: [PATCH 045/134] python.pkgs.flask-restful: 0.3.5 -> 0.3.6

---
 .../python-modules/flask-restful/default.nix  | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 24 +--------------
 2 files changed, 30 insertions(+), 23 deletions(-)
 create mode 100644 pkgs/development/python-modules/flask-restful/default.nix

diff --git a/pkgs/development/python-modules/flask-restful/default.nix b/pkgs/development/python-modules/flask-restful/default.nix
new file mode 100644
index 000000000000..c54c015af123
--- /dev/null
+++ b/pkgs/development/python-modules/flask-restful/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k
+, nose, mock, blinker
+, flask, six, pytz, aniso8601, pycrypto
+}:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "Flask-RESTful";
+  version = "0.3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "01rlvl2iq074ciyn4schmjip7cyplkwkysbb8f610zil06am35ap";
+  };
+
+# TypeError: Only byte strings can be passed to C code
+  patchPhase = if isPy3k then ''
+    rm tests/test_crypto.py tests/test_paging.py
+    '' else null;
+  buildInputs = [ nose mock blinker ];
+  propagatedBuildInputs = [ flask six pytz aniso8601 pycrypto ];
+  PYTHON_EGG_CACHE = "`pwd`/.egg-cache";
+
+  meta = with stdenv.lib; {
+    homepage = "http://flask-restful.readthedocs.io/";
+    description = "REST API building blocks for Flask";
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f07657796139..bed6a47c78dc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9671,29 +9671,7 @@ in {
 
   flask-pymongo = callPackage ../development/python-modules/Flask-PyMongo { };
 
-  flask-restful = buildPythonPackage rec {
-    name = "Flask-RESTful-${version}";
-    version = "0.3.5";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/F/Flask-RESTful/${name}.tar.gz";
-      sha256 = "cce4aeff959b571136b5af098bebe7d3deeca7eb1411c4e722ff2c5356ab4c42";
-    };
-
-    # TypeError: Only byte strings can be passed to C code
-    patchPhase = if isPy3k then ''
-      rm tests/test_crypto.py tests/test_paging.py
-    '' else null;
-    buildInputs = with self; [ nose mock blinker ];
-    propagatedBuildInputs = with self; [ flask six pytz aniso8601 pycrypto ];
-    PYTHON_EGG_CACHE = "`pwd`/.egg-cache";
-
-    meta = {
-      homepage = "http://flask-restful.readthedocs.io/";
-      description = "REST API building blocks for Flask";
-      license = licenses.bsd3;
-    };
-  };
+  flask-restful = callPackage ../development/python-modules/flask-restful { };
 
   flask-restplus = callPackage ../development/python-modules/flask-restplus/default.nix { };
   # Exactly 0.8.6 is required by flexget

From 4050ec5836fc55fc259f1e7c3fdc5e36b8081c1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:53:19 +0100
Subject: [PATCH 046/134] python.pkgs.flask-restplus_0_8: remove

---
 .../python-modules/flask-restplus/0.8.nix     | 42 -------------------
 pkgs/top-level/python-packages.nix            |  4 +-
 2 files changed, 1 insertion(+), 45 deletions(-)
 delete mode 100644 pkgs/development/python-modules/flask-restplus/0.8.nix

diff --git a/pkgs/development/python-modules/flask-restplus/0.8.nix b/pkgs/development/python-modules/flask-restplus/0.8.nix
deleted file mode 100644
index 2c415ec47e38..000000000000
--- a/pkgs/development/python-modules/flask-restplus/0.8.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, nose
-, blinker
-, tzlocal
-, mock
-, rednose
-, flask
-, six
-, jsonschema
-, pytz
-, aniso8601
-, flask-restful
-}:
-
-buildPythonPackage rec {
-  pname = "flask-restplus";
-  version = "0.8.6";
-  name = "${pname}-${version}";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "3bb76cc156b9a09da62396d82b29fa31e4f27cccf79528538fe7155cf2785593";
-  };
-
-  checkInputs = [ nose blinker tzlocal mock rednose ];
-  propagatedBuildInputs = [ flask six jsonschema pytz aniso8601 flask-restful ];
-
-  # RuntimeError: Working outside of application context.
-  doCheck = false;
-
-  checkPhase = ''
-    nosetests
-  '';
-
-  meta = {
-    homepage = https://github.com/noirbizarre/flask-restplus;
-    description = "Fast, easy and documented API development with Flask";
-    license = lib.licenses.mit;
-  };
-}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bed6a47c78dc..f8f5d00a0696 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9673,9 +9673,7 @@ in {
 
   flask-restful = callPackage ../development/python-modules/flask-restful { };
 
-  flask-restplus = callPackage ../development/python-modules/flask-restplus/default.nix { };
-  # Exactly 0.8.6 is required by flexget
-  flask-restplus_0_8 = callPackage ../development/python-modules/flask-restplus/0.8.nix { };
+  flask-restplus = callPackage ../development/python-modules/flask-restplus { };
 
   flask_script = buildPythonPackage rec {
     name = "Flask-Script-${version}";

From 7a73f298d9b19374f35bc781c70fb430bd5e323c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:54:05 +0100
Subject: [PATCH 047/134] python.pkgs.pytz: 2016.6.1 -> 2017.2

---
 pkgs/top-level/python-packages.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f8f5d00a0696..353fa9eec829 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18966,18 +18966,19 @@ in {
     };
   };
 
-
   pytz = buildPythonPackage rec {
-    name = "pytz-${version}";
-    version = "2016.6.1";
+    name = "${pname}-${version}";
+    pname = "pytz";
+    version = "2017.2";
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pytz/${name}.tar.gz";
-      sha256 = "6f57732f0f8849817e9853eb9d50d85d1ebb1404f702dbc44ee627c642a486ca";
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "12cmd3j46d2gcw08bspvp6s9icfcvx88zjz52n1bli9dyvl5dh7m";
+      extension = "zip";
     };
 
     checkPhase = ''
-      ${python.interpreter} -m unittest discover -s pytz/tests
+      python -m unittest discover -s pytz/tests
     '';
 
     meta = {
@@ -18987,7 +18988,6 @@ in {
     };
   };
 
-
   pyutil = buildPythonPackage (rec {
     name = "pyutil-2.0.0";
 

From ffb043b76939c274c798ff93b449e802a6180684 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:57:01 +0100
Subject: [PATCH 048/134] python.pkgs.requests: 2.13.0 -> 2.18.4

---
 .../python-modules/requests/default.nix       | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 20 +--------------
 2 files changed, 26 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/development/python-modules/requests/default.nix

diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
new file mode 100644
index 000000000000..b85bb54a4f15
--- /dev/null
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchPypi, buildPythonPackage
+, urllib3, idna, chardet, certifi
+, pytest }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "requests";
+  version = "2.18.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zi3v9nsmv9j27d0c0m1dvqyvaxz53g8m0aa1h3qanxs4irkwi4w";
+  };
+
+  nativeBuildInputs = [ pytest ];
+  propagatedBuildInputs = [ urllib3 idna chardet certifi ];
+  # sadly, tests require networking
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "An Apache2 licensed HTTP library, written in Python, for human beings";
+    homepage = http://docs.python-requests.org/en/latest/;
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 353fa9eec829..ccc01a4abf48 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19269,25 +19269,7 @@ in {
   requests2 = throw "requests2 has been deprecated. Use requests instead.";
 
   # use requests, not requests_2
-  requests = buildPythonPackage rec {
-    name = "requests-${version}";
-    version = "2.13.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/r/requests/${name}.tar.gz";
-      sha256 = "5722cd09762faa01276230270ff16af7acf7c5c45d623868d9ba116f15791ce8";
-    };
-
-    nativeBuildInputs = [ self.pytest ];
-    # sadly, tests require networking
-    doCheck = false;
-
-    meta = {
-      description = "An Apache2 licensed HTTP library, written in Python, for human beings";
-      homepage = http://docs.python-requests.org/en/latest/;
-      license = licenses.asl20;
-    };
-  };
+  requests = callPackage ../development/python-modules/requests { };
 
   requests_download = buildPythonPackage rec {
     pname = "requests_download";

From c9f387a55c7bbb8a67e86fa254f1684ce8972a16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 16:01:22 +0100
Subject: [PATCH 049/134] python.pkgs.tzlocal: 1.2.2 -> 1.4

---
 .../python-modules/tzlocal/default.nix        | 24 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 20 +---------------
 2 files changed, 25 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/development/python-modules/tzlocal/default.nix

diff --git a/pkgs/development/python-modules/tzlocal/default.nix b/pkgs/development/python-modules/tzlocal/default.nix
new file mode 100644
index 000000000000..2277cb7c4ca4
--- /dev/null
+++ b/pkgs/development/python-modules/tzlocal/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, tzlocal, pytz }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "tzlocal";
+  version = "1.4";
+
+  propagatedBuildInputs = [ pytz ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0n9hw4kqblyc0avzwi26rqmvyk9impb608rvy11qifmigy7r18h5";
+  };
+
+  # test fail (timezone test fail)
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Tzinfo object for the local timezone";
+    homepage = https://github.com/regebro/tzlocal;
+    license = licenses.cddl;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ccc01a4abf48..a949db1b263e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22973,25 +22973,7 @@ in {
 
   twisted = callPackage ../development/python-modules/twisted { };
 
-  tzlocal = buildPythonPackage rec {
-    name = "tzlocal-1.2.2";
-
-    propagatedBuildInputs = with self; [ pytz ];
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/t/tzlocal/${name}.tar.gz";
-      sha256 = "0paj7vlsb0np8b5sp4bv64wxv7qk2piyp7xg29pkhdjwsbls9fnb";
-    };
-
-     # test fail (timezone test fail)
-     doCheck = false;
-
-    meta = with pkgs.stdenv.lib; {
-      description = "Tzinfo object for the local timezone";
-      homepage = https://github.com/regebro/tzlocal;
-      license = licenses.cddl;
-    };
-  };
+  tzlocal = callPackage ../development/python-modules/tzlocal { };
 
   u-msgpack-python = callPackage ../development/python-modules/u-msgpack-python { };
 

From 50cc30da735c75885789de1728e43d54d318a07a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 16:05:56 +0100
Subject: [PATCH 050/134] python.pkgs.werkzeug: 0.11.10 -> 0.12

---
 .../python-modules/werkzeug/default.nix       | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 23 +----------------
 2 files changed, 26 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/development/python-modules/werkzeug/default.nix

diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
new file mode 100644
index 000000000000..5979d895a747
--- /dev/null
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, itsdangerous
+, pytest, requests, glibcLocales }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "Werkzeug";
+  version = "0.12.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "09mv4cya3lywkn4mi3qrqmjgwiw99kdk03dk912j8da6ny3pnflh";
+  };
+
+  LC_ALL = "en_US.UTF-8";
+
+  propagatedBuildInputs = [ itsdangerous ];
+  buildInputs = [ pytest requests glibcLocales ];
+
+  meta = with stdenv.lib; {
+    homepage = http://werkzeug.pocoo.org/;
+    description = "A WSGI utility library for Python";
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a949db1b263e..a4bd8e43b45b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -23648,28 +23648,7 @@ EOF
     };
   };
 
-
-  werkzeug = buildPythonPackage rec {
-    name = "Werkzeug-0.11.10";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/W/Werkzeug/${name}.tar.gz";
-      sha256 = "1vpf98k4jp4yhbv2jbyq8dj5fdasrd26rkq34pacs5n7mkxxlr6c";
-    };
-
-    LC_ALL = "en_US.UTF-8";
-
-    propagatedBuildInputs = with self; [ itsdangerous ];
-    buildInputs = with self; [ pytest requests pkgs.glibcLocales ];
-
-
-
-    meta = {
-      homepage = http://werkzeug.pocoo.org/;
-      description = "A WSGI utility library for Python";
-      license = licenses.bsd3;
-    };
-  };
+  werkzeug = callPackage ../development/python-modules/werkzeug { };
 
   wheel = callPackage ../development/python-modules/wheel { };
 

From 7ea007653751da650da6aa33e2293adad3573ac0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 16:06:31 +0100
Subject: [PATCH 051/134] python.pkgs.tempora: 1.4 -> 1.8

---
 pkgs/development/python-modules/tempora/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/tempora/default.nix b/pkgs/development/python-modules/tempora/default.nix
index 69006a319055..a8eba4cb3a0c 100644
--- a/pkgs/development/python-modules/tempora/default.nix
+++ b/pkgs/development/python-modules/tempora/default.nix
@@ -1,19 +1,20 @@
 { stdenv, buildPythonPackage, fetchPypi
-, setuptools_scm, six }:
+, setuptools_scm
+, six, pytz}:
 
 buildPythonPackage rec {
-  version = "1.4";
-  pname = "tempora";
   name = "${pname}-${version}";
+  pname = "tempora";
+  version = "1.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0ysvns22i5hzhl5ln4n86bq10j8xwvd09z8qw1zjr3s0fj3lynza";
+    sha256 = "1b29d19r8h5my9kzzywi9khn1qzvk3qzp08k0f4rrsa7qks930l4";
   };
 
   doCheck = false;
 
   buildInputs = [ setuptools_scm ];
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [ six pytz ];
 }

From c6539df7ab32a1650d3327452bb5e051cf3377fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:17:06 +0100
Subject: [PATCH 052/134] python.pkgs.dateutil: 2.6.0 -> 2.6.1

---
 pkgs/development/python-modules/dateutil/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/dateutil/default.nix b/pkgs/development/python-modules/dateutil/default.nix
index c814b82dad01..b980381edbb1 100644
--- a/pkgs/development/python-modules/dateutil/default.nix
+++ b/pkgs/development/python-modules/dateutil/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, buildPythonPackage, fetchurl, six }:
+{ stdenv, buildPythonPackage, fetchPypi, six }:
 buildPythonPackage rec {
-  pname = "dateutil";
   name = "${pname}-${version}";
-  version = "2.6.0";
+  pname = "python-dateutil";
+  version = "2.6.1";
 
-  src = fetchurl {
-    url = "mirror://pypi/p/python-dateutil/python-${name}.tar.gz";
-    sha256 = "1lhq0hxjc3cfha101q02ld5ijlpfyjn2w1yh7wvpiy367pgzi8k2";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1jkahssf0ir5ssxc3ydbp8cpv77limn8d4s77szb2nrgl2r3h749";
   };
 
   propagatedBuildInputs = [ six ];

From 69c4724dd4be7eea0f130c44114f8fe013fe0f55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:17:49 +0100
Subject: [PATCH 053/134] python.pkgs.backports_unittest-mock: init at 1.3

---
 .../backports_unittest-mock/default.nix       | 22 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/python-modules/backports_unittest-mock/default.nix

diff --git a/pkgs/development/python-modules/backports_unittest-mock/default.nix b/pkgs/development/python-modules/backports_unittest-mock/default.nix
new file mode 100644
index 000000000000..e64f51fe7ca1
--- /dev/null
+++ b/pkgs/development/python-modules/backports_unittest-mock/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi, setuptools_scm, mock }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "backports.unittest_mock";
+  version = "1.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0xdkx5wf5a2w2zd2pshk7z2cvbv6db64c1x6v9v1a18ja7bn9nf6";
+  };
+
+  propagatedBuildInputs = [ mock ];
+
+  buildInputs = [ setuptools_scm ];
+
+  meta = with stdenv.lib; {
+    description = "Provides a function install() which makes the mock module";
+    homepage = https://github.com/jaraco/backports.unittest_mock;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a4bd8e43b45b..543675127275 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1259,6 +1259,8 @@ in {
     };
   };
 
+  backports_unittest-mock = callPackage ../development/python-modules/backports_unittest-mock {};
+
   babelfish = buildPythonPackage rec {
     version = "0.5.5";
     name = "babelfish-${version}";

From 1041009a92d2bcdd2dfc752ebadd2dee033a78db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:18:33 +0100
Subject: [PATCH 054/134] python.pkgs.cheroot: init at 5.5.0

---
 .../python-modules/cheroot/default.nix        | 28 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/development/python-modules/cheroot/default.nix

diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
new file mode 100644
index 000000000000..c20cbabe0d61
--- /dev/null
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchPypi, buildPythonPackage
+, six
+, coverage, codecov, pytest, pytestcov, pytest-sugar, portend
+, backports_unittest-mock, setuptools_scm }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "cheroot";
+  version = "5.5.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1fhyk8lgs2blfx4zjvwsy6f0ynrs5fwnnr3qf07r6c4j3gwlkqsr";
+  };
+
+  propagatedBuildInputs = [ six ];
+  buildInputs = [ coverage codecov pytest pytestcov pytest-sugar portend backports_unittest-mock setuptools_scm ];
+
+  checkPhase = ''
+    py.test cheroot
+  '';
+
+  meta = with stdenv.lib; {
+    description = "High-performance, pure-Python HTTP";
+    homepage = https://github.com/cherrypy/cheroot;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 543675127275..896cc0aa676c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1659,6 +1659,8 @@ in {
 
   channels = callPackage ../development/python-modules/channels {};
 
+  cheroot = callPackage ../development/python-modules/cheroot {};
+
   circus = buildPythonPackage rec {
     name = "circus-0.11.1";
 

From dc6d287dcfa9154f3a06fbc40518c2740b39c104 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:20:01 +0100
Subject: [PATCH 055/134] python.pkgs.portend: init at 2.1.2

---
 .../python-modules/portend/default.nix        | 23 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/development/python-modules/portend/default.nix

diff --git a/pkgs/development/python-modules/portend/default.nix b/pkgs/development/python-modules/portend/default.nix
new file mode 100644
index 000000000000..9092185a40f2
--- /dev/null
+++ b/pkgs/development/python-modules/portend/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pytest, pytest-sugar, pytest-warnings, setuptools_scm
+, tempora }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "portend";
+  version = "2.1.2";
+
+  buildInputs = [ pytest pytest-sugar pytest-warnings setuptools_scm ];
+  propagatedBuildInputs = [ tempora ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0dx8b1rn64ymx5s4mdzlw5hz59qi167z7nny36dl75ghlldn41w4";
+  };
+
+  meta = with stdenv.lib; {
+    description = "Monitor TCP ports for bound or unbound states";
+    homepage = https://github.com/jaraco/portend;
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 896cc0aa676c..5d7063904ca3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16638,6 +16638,8 @@ in {
     };
   };
 
+  portend = callPackage ../development/python-modules/portend { };
+
   powerline = callPackage ../development/python-modules/powerline { };
 
   pox = buildPythonPackage rec {

From be7d6c4cfdf24020eb570783e819e9e80adbc8d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:27:33 +0100
Subject: [PATCH 056/134] python.pkgs.beautifulsoup: 4.5.3 -> 4.6.0

---
 .../python-modules/beautifulsoup4/default.nix | 24 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 21 +---------------
 2 files changed, 25 insertions(+), 20 deletions(-)
 create mode 100644 pkgs/development/python-modules/beautifulsoup4/default.nix

diff --git a/pkgs/development/python-modules/beautifulsoup4/default.nix b/pkgs/development/python-modules/beautifulsoup4/default.nix
new file mode 100644
index 000000000000..fd8bddee14b6
--- /dev/null
+++ b/pkgs/development/python-modules/beautifulsoup4/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchPypi, nose }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "beautifulsoup4";
+  version = "4.6.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "12cf0ygpz9srpfh9gx2f9ba0swa1rzypv3sm4r0hmjyw6b4nm2w0";
+  };
+
+  buildInputs = [ nose ];
+  checkPhase = ''
+    nosetests build
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://crummy.com/software/BeautifulSoup/bs4/;
+    description = "HTML and XML parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ domenkozar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5d7063904ca3..e3678e70e70a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1359,26 +1359,7 @@ in {
     };
   });
 
-  beautifulsoup4 = buildPythonPackage (rec {
-    name = "beautifulsoup4-4.5.3";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/b/beautifulsoup4/${name}.tar.gz";
-      sha256 = "0glaw1vyxnbp03fni7h5496n6iib0n5iim4gax1n0ngscs9s075j";
-    };
-
-    buildInputs = [ self.nose ];
-    checkPhase = ''
-      nosetests build/
-    '';
-
-    meta = {
-      homepage = http://crummy.com/software/BeautifulSoup/bs4/;
-      description = "HTML and XML parser";
-      license = licenses.mit;
-      maintainers = with maintainers; [ domenkozar ];
-    };
-  });
+  beautifulsoup4 = callPackage ../development/python-modules/beautifulsoup4 { };
 
   beaker = buildPythonPackage rec {
     name = "Beaker-${version}";

From ec33fe618186d572b4bc6db9714cd320207685e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:31:39 +0100
Subject: [PATCH 057/134] python.pkgs.cherrypy: 8.7.0 -> 11.0.0

---
 .../python-modules/cherrypy/default.nix       | 25 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 22 +---------------
 2 files changed, 26 insertions(+), 21 deletions(-)
 create mode 100644 pkgs/development/python-modules/cherrypy/default.nix

diff --git a/pkgs/development/python-modules/cherrypy/default.nix b/pkgs/development/python-modules/cherrypy/default.nix
new file mode 100644
index 000000000000..327a10f24910
--- /dev/null
+++ b/pkgs/development/python-modules/cherrypy/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k
+, pytest, setuptools_scm, pytestrunner
+, six, cheroot, portend }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "CherryPy";
+  version = "11.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1037pvhab4my791vfzikm649ny52fj7x2q87cnncmbnqin6ghwan";
+  };
+
+  # wsgiserver.ssl_pyopenssl is broken on py3k.
+  doCheck = !isPy3k;
+  buildInputs = [ pytest setuptools_scm pytestrunner ];
+  propagatedBuildInputs = [ six cheroot portend ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.cherrypy.org";
+    description = "A pythonic, object-oriented HTTP framework";
+    license = licenses.mit.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e3678e70e70a..79c089c5b5aa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2774,27 +2774,7 @@ in {
     };
   };
 
-
-  cherrypy = buildPythonPackage (rec {
-    name = "cherrypy-${version}";
-    version = "8.7.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/C/CherryPy/CherryPy-${version}.tar.gz";
-      sha256 = "cbf418bf46458a67eb841944f2d414c23bf59d090baf2a28704bd67243e6a79f";
-    };
-
-    # wsgiserver.ssl_pyopenssl is broken on py3k.
-    doCheck = !isPy3k;
-    buildInputs = with self; [ pytest setuptools_scm pytestrunner ];
-    propagatedBuildInputs = with self; [ six ];
-
-    meta = {
-      homepage = "http://www.cherrypy.org";
-      description = "A pythonic, object-oriented HTTP framework";
-    };
-  });
-
+  cherrypy = callPackage ../development/python-modules/cherrypy {};
 
   cjson = buildPythonPackage rec {
     name = "python-cjson-${version}";

From 1089ccedb7362efebbbbd5e9a76a72e54c03dbc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:32:28 +0100
Subject: [PATCH 058/134] python.pkgs.pytest-warnings: init at 0.3.0

---
 .../pytest-warnings/default.nix               | 20 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytest-warnings/default.nix

diff --git a/pkgs/development/python-modules/pytest-warnings/default.nix b/pkgs/development/python-modules/pytest-warnings/default.nix
new file mode 100644
index 000000000000..e6ebfcbb7167
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-warnings/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi, pytest }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pytest-warnings";
+  version = "0.3.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "18yxh153icmndaw8fkl1va0bk0mwzrbpaa6wxd29w3iwxym5zn2a";
+  };
+
+  propagatedBuildInputs = [ pytest ];
+
+  meta = with stdenv.lib; {
+    description = "Plugin to list Python warnings in pytest report";
+    homepage = github.com/fschulze/pytest-warnings;
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 79c089c5b5aa..836ff07afd50 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4232,6 +4232,8 @@ in {
     };
   };
 
+  pytest-warnings = callPackage ../development/python-modules/pytest-warnings { };
+
   pytestpep8 = buildPythonPackage rec {
     name = "pytest-pep8";
     src = pkgs.fetchurl {

From bde5cde9c65ed5e8eb2b0522acac4abca21ba46d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:32:58 +0100
Subject: [PATCH 059/134] python.pkgs.pytest-sugar: init at 0.9.0

---
 .../python-modules/pytest-sugar/default.nix   | 20 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytest-sugar/default.nix

diff --git a/pkgs/development/python-modules/pytest-sugar/default.nix b/pkgs/development/python-modules/pytest-sugar/default.nix
new file mode 100644
index 000000000000..81f5a2cbd4b4
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-sugar/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, buildPythonPackage, fetchPypi, termcolor, pytest }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pytest-sugar";
+  version = "0.9.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "11lni9kn0r1y896xg20qjv4yjcyr56h0hx9dprdgjnam4dqcl6lg";
+  };
+
+  propagatedBuildInputs = [ termcolor pytest ];
+
+  meta = with stdenv.lib; {
+    description = "A plugin that changes the default look and feel of py.test";
+    homepage = https://github.com/Frozenball/pytest-sugar;
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 836ff07afd50..ab90dfd5e012 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4444,6 +4444,8 @@ in {
     };
   };
 
+  pytest-sugar = callPackage ../development/python-modules/pytest-sugar { };
+
   tinycss = buildPythonPackage rec {
     name = "tinycss-${version}";
     version = "0.3";

From 32a158b43a1e38761f44d382d13b40a6f8172842 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:35:37 +0100
Subject: [PATCH 060/134] python.pkgs.flask: 0.12 -> 0.12.2

---
 .../python-modules/flask/default.nix          | 21 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 17 +--------------
 2 files changed, 22 insertions(+), 16 deletions(-)
 create mode 100644 pkgs/development/python-modules/flask/default.nix

diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
new file mode 100644
index 000000000000..b16dc08a5e16
--- /dev/null
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, itsdangerous, click, werkzeug, jinja2 }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  version = "0.12.2";
+  pname = "Flask";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1hfs2jr2m5lr51xd4gblb28rncd0xrpycz6c07cyqsbv4dhl9x29";
+  };
+
+  propagatedBuildInputs = [ itsdangerous click werkzeug jinja2 ];
+
+  meta = with stdenv.lib; {
+    homepage = http://flask.pocoo.org/;
+    description = "A microframework based on Werkzeug, Jinja 2, and good intentions";
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ab90dfd5e012..5da7d551e5c4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9551,22 +9551,7 @@ in {
     };
   };
 
-  flask = buildPythonPackage {
-    name = "flask-0.12";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/F/Flask/Flask-0.12.tar.gz";
-      sha256 = "12yasybryp33rdchsqgckf15zj4pjfam7ly5spmn2sijpv6h7s4k";
-    };
-
-    propagatedBuildInputs = with self; [ itsdangerous click werkzeug jinja2 ];
-
-    meta = {
-      homepage = http://flask.pocoo.org/;
-      description = "A microframework based on Werkzeug, Jinja 2, and good intentions";
-      license = licenses.bsd3;
-    };
-  };
+  flask = callPackage ../development/python-modules/flask { };
 
   flask_assets = buildPythonPackage rec {
     name = "Flask-Assets-${version}";

From 4e1b5e15fbc15d7d7ea05f7247428d0145e66dfd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:41:12 +0100
Subject: [PATCH 061/134] python.pkgs.jsonschema: 2.5.3 -> 2.6.0

---
 .../python-modules/jsonschema/default.nix     | 30 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 28 +----------------
 2 files changed, 31 insertions(+), 27 deletions(-)
 create mode 100644 pkgs/development/python-modules/jsonschema/default.nix

diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
new file mode 100644
index 000000000000..cd29d7b5d310
--- /dev/null
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, buildPythonPackage, fetchPypi, python
+, nose, mock, vcversioner, functools32 }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "jsonschema";
+  version = "2.6.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "00kf3zmpp9ya4sydffpifn0j0mzm342a2vzh82p6r0vh10cg7xbg";
+  };
+
+  buildInputs = [ nose mock vcversioner ];
+  propagatedBuildInputs = [ functools32 ];
+
+  patchPhase = ''
+    substituteInPlace jsonschema/tests/test_jsonschema_test_suite.py \
+      --replace "python" "${python}/bin/${python.executable}"
+  '';
+
+  checkPhase = "nosetests";
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/Julian/jsonschema;
+    description = "An implementation of JSON Schema validation for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ domenkozar ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5da7d551e5c4..8b951465c39d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9804,33 +9804,7 @@ in {
     };
   };
 
-  jsonschema = buildPythonPackage (rec {
-    version = "2.5.1";
-    name = "jsonschema-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/j/jsonschema/jsonschema-${version}.tar.gz";
-      sha256 = "0hddbqjm4jq63y8jf44nswina1crjs16l9snb6m3vvgyg31klrrn";
-    };
-
-    buildInputs = with self; [ nose mock vcversioner ];
-    propagatedBuildInputs = with self; [ functools32 ];
-
-    patchPhase = ''
-      substituteInPlace jsonschema/tests/test_jsonschema_test_suite.py --replace "python" "${python}/bin/${python.executable}"
-    '';
-
-    checkPhase = ''
-      nosetests
-    '';
-
-    meta = {
-      homepage = https://github.com/Julian/jsonschema;
-      description = "An implementation of JSON Schema validation for Python";
-      license = licenses.mit;
-      maintainers = with maintainers; [ domenkozar ];
-    };
-  });
+  jsonschema = callPackage ../development/python-modules/jsonschema { };
 
   vcversioner = buildPythonPackage rec {
     name = "vcversioner-${version}";

From d6e40f2c146472fb1a79acf001d6031145038456 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:46:56 +0100
Subject: [PATCH 062/134] python.pkgs.vcversioner: 2.14.0.0 -> 2.16.0.0

---
 .../python-modules/vcversioner/default.nix     | 18 ++++++++++++++++++
 pkgs/top-level/python-packages.nix             | 14 +-------------
 2 files changed, 19 insertions(+), 13 deletions(-)
 create mode 100644 pkgs/development/python-modules/vcversioner/default.nix

diff --git a/pkgs/development/python-modules/vcversioner/default.nix b/pkgs/development/python-modules/vcversioner/default.nix
new file mode 100644
index 000000000000..1b9819c035db
--- /dev/null
+++ b/pkgs/development/python-modules/vcversioner/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "vcversioner";
+  version = "2.16.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16z10sm78jd7ca3jbkgc3q5i8a8q7y1h21q1li21yy3rlhbhrrns";
+  };
+
+  meta = with stdenv.lib; {
+    description = "take version numbers from version control";
+    homepage = https://github.com/habnabit/vcversioner;
+    licenses = licenses.isc;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8b951465c39d..06f588d97c3e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9806,19 +9806,7 @@ in {
 
   jsonschema = callPackage ../development/python-modules/jsonschema { };
 
-  vcversioner = buildPythonPackage rec {
-    name = "vcversioner-${version}";
-    version = "2.14.0.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/v/vcversioner/vcversioner-${version}.tar.gz";
-      sha256 = "11ivq1bm7v0yb4nsfbv9m7g7lyjn112gbvpjnjz8nv1fx633dm5c";
-    };
-
-    meta = with stdenv.lib; {
-      homepage = "https://github.com/habnabit/vcversioner";
-    };
-  };
+  vcversioner = callPackage ../development/python-modules/vcversioner { };
 
   falcon = buildPythonPackage (rec {
     name = "falcon-1.0.0";

From 9788c3f42124ac1480638efc546f4a1ad3221ab1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 15:49:56 +0100
Subject: [PATCH 063/134] python.pkgs.jinja2: 2.9.5 -> 2.9.6

---
 .../python-modules/jinja2/default.nix         | 31 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 29 +----------------
 2 files changed, 32 insertions(+), 28 deletions(-)
 create mode 100644 pkgs/development/python-modules/jinja2/default.nix

diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
new file mode 100644
index 000000000000..ca286ae06aab
--- /dev/null
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, markupsafe }:
+
+buildPythonPackage rec {
+  pname = "Jinja2";
+  version = "2.9.6";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zzrkywhziqffrzks14kzixz7nd4yh2vc0fb04a68vfd2ai03anx";
+  };
+
+  propagatedBuildInputs = [ markupsafe ];
+
+  # No tests included
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = http://jinja.pocoo.org/;
+    description = "Stand-alone template engine";
+    license = licenses.bsd3;
+    longDescription = ''
+      Jinja2 is a template engine written in pure Python. It provides a
+      Django inspired non-XML syntax but supports inline expressions and
+      an optional sandboxed environment.
+      '';
+    platforms = platforms.all;
+    maintainers = with maintainers; [ pierron garbas sjourdois ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 06f588d97c3e..51459b014c09 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11248,34 +11248,7 @@ in {
     };
   };
 
-  jinja2 = buildPythonPackage rec {
-    pname = "Jinja2";
-    version = "2.9.5";
-    name = "${pname}-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/J/Jinja2/${name}.tar.gz";
-      sha256 = "702a24d992f856fa8d5a7a36db6128198d0c21e1da34448ca236c42e92384825";
-    };
-
-    propagatedBuildInputs = with self; [ markupsafe ];
-
-    # No tests included
-    doCheck = false;
-
-    meta = {
-      homepage = http://jinja.pocoo.org/;
-      description = "Stand-alone template engine";
-      license = licenses.bsd3;
-      longDescription = ''
-        Jinja2 is a template engine written in pure Python. It provides a
-        Django inspired non-XML syntax but supports inline expressions and
-        an optional sandboxed environment.
-      '';
-      platforms = platforms.all;
-      maintainers = with maintainers; [ pierron garbas sjourdois ];
-    };
-  };
+  jinja2 = callPackage ../development/python-modules/jinja2 { };
 
   jinja2_time = buildPythonPackage rec {
     version = "0.2.0";

From 6ba195897cd896a3afed78737af089c57ddd6673 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 16:20:43 +0100
Subject: [PATCH 064/134] guessit_2_0: init at 2.0.4

---
 .../python-modules/guessit/2.0.nix            | 32 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  3 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/development/python-modules/guessit/2.0.nix

diff --git a/pkgs/development/python-modules/guessit/2.0.nix b/pkgs/development/python-modules/guessit/2.0.nix
new file mode 100644
index 000000000000..960babd84e2b
--- /dev/null
+++ b/pkgs/development/python-modules/guessit/2.0.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestrunner
+, dateutil
+, babelfish
+, rebulk
+}:
+
+buildPythonPackage rec {
+  pname = "guessit";
+  version = "2.0.4";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cfcgb0px6i9jl8nwkx8j06j4y6p5975a9pfmd8lcacwr8gy4wjg";
+  };
+
+  # Tests require more packages.
+  doCheck = false;
+  buildInputs = [ pytestrunner ];
+  propagatedBuildInputs = [
+    dateutil babelfish rebulk
+  ];
+
+  meta = {
+    homepage = http://pypi.python.org/pypi/guessit;
+    license = lib.licenses.lgpl3;
+    description = "A library for guessing information from video files";
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 51459b014c09..c6798d63602a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10549,6 +10549,9 @@ in {
 
   guessit = callPackage ../development/python-modules/guessit { };
 
+  # used by flexget
+  guessit_2_0 = callPackage ../development/python-modules/guessit/2.0.nix { };
+
   rebulk = callPackage ../development/python-modules/rebulk { };
 
   gunicorn = callPackage ../development/python-modules/gunicorn.nix { };

From 76ba0c15cb5508ef99baffab42745afd8958f759 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 27 Aug 2017 13:45:38 +0100
Subject: [PATCH 065/134] flexget: 2.10.40 -> 2.10.82

---
 .../networking/flexget/default.nix            | 41 ++++++++++++-------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 814f6bb5548e..94446332629b 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -9,14 +9,14 @@
 with python.pkgs;
 
 buildPythonApplication rec {
-  version = "2.10.40";
+  version = "2.10.82";
   name = "FlexGet-${version}";
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     rev = version;
-    sha256 = "0hh21yv1lvdfi198snwjabfsdh04fnpjszpgg28wvg5pd1qq8lqv";
+    sha256 = "15508ihswfjbkzhf1f0qhn2ar1aiibz2ggp5d6r33icy8xwhpv09";
   };
 
   doCheck = true;
@@ -27,30 +27,41 @@ buildPythonApplication rec {
     sed -i '/def test_non_ascii/i\    import pytest\
         @pytest.mark.skip' flexget/tests/test_filesystem.py
 
-    substituteInPlace requirements.txt --replace "guessit<=2.0.4" "guessit"
+    substituteInPlace requirements.txt \
+      --replace "chardet==3.0.3" "chardet" \
+      --replace "rebulk==0.8.2" "rebulk" \
+      --replace "cherrypy==10.2.2" "cherrypy" \
+      --replace "portend==1.8" "portend" \
+      --replace "sqlalchemy==1.1.10" "sqlalchemy"
   '';
 
-  # Disable 3 failing tests caused by guessit upgrade
-  # https://github.com/Flexget/Flexget/issues/1804
   checkPhase = ''
     export HOME=.
-    py.test --disable-pytest-warnings -k "not test_date_options and not test_ep_as_quality and not testFromGroup"
+    py.test --disable-pytest-warnings -k "not test_quality_failures \
+                                          and not test_group_quality \
+                                          and not crash_report \
+                                          and not test_multi_episode \
+                                          and not test_double_episodes \
+                                          and not test_inject_force \
+                                          and not test_double_prefered \
+                                          and not test_double"
   '';
 
   buildInputs = [ pytest mock vcrpy pytest-catchlog boto3 ];
   propagatedBuildInputs = [
-    feedparser sqlalchemy pyyaml
+    feedparser sqlalchemy pyyaml chardet
     beautifulsoup4 html5lib PyRSS2Gen pynzb
-    rpyc jinja2 requests dateutil jsonschema
-    pathpy guessit APScheduler
+    rpyc jinja2 jsonschema requests dateutil jsonschema
+    pathpy guessit_2_0 APScheduler
     terminaltables colorclass
-    cherrypy flask flask-restful flask-restplus_0_8
+    cherrypy flask flask-restful flask-restplus
     flask-compress flask_login flask-cors
-    pyparsing safe future zxcvbn-python ]
-  ++ lib.optional (pythonOlder "3.4") pathlib
-  # enable deluge and transmission plugin support, if they're installed
-  ++ lib.optional (config.deluge or false) deluge
-  ++ lib.optional (transmission != null) transmissionrpc;
+    pyparsing safe future zxcvbn-python
+    werkzeug tempora cheroot rebulk portend
+  ] ++ lib.optional (pythonOlder "3.4") pathlib
+    # enable deluge and transmission plugin support, if they're installed
+    ++ lib.optional (config.deluge or false) deluge
+    ++ lib.optional (transmission != null) transmissionrpc;
 
   meta = {
     homepage = https://flexget.com/;

From c1dea51fa169cbe8b8f78ac43bc86bb5b3d88be7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 28 Aug 2017 11:00:26 +0100
Subject: [PATCH 066/134] pandas: fix dateutil tests

---
 pkgs/development/python-modules/pandas/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index ca3f20d7ca3e..7bab184bb2a0 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -76,8 +76,13 @@ in buildPythonPackage rec {
     chmod a+x pbcopy pbpaste
     export PATH=$(pwd):$PATH
   '' + ''
+    # since dateutil 0.6.0 the following fails: test_fallback_plural, test_ambiguous_flags, test_ambiguous_compat
+    # was supposed to be solved by https://github.com/dateutil/dateutil/issues/321, but is not the case
     py.test $out/${python.sitePackages}/pandas --skip-slow --skip-network \
-      ${if isDarwin then "-k 'not test_locale and not test_clipboard'" else ""}
+      -k "not test_fallback_plural and \
+          not test_ambiguous_flags and \
+          not test_ambiguous_compat \
+          ${optionalString isDarwin "and not test_locale and not test_clipboard"}"
     runHook postCheck
   '';
 

From 8d015553d5c5eca77b140b21608f34d07dff0496 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 28 Aug 2017 11:50:38 +0100
Subject: [PATCH 067/134] ansible_2_2/ansible_2_1: switch to overrideDerivation
 for jinja2

---
 pkgs/tools/admin/ansible/2.1.nix | 4 ++--
 pkgs/tools/admin/ansible/2.2.nix | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
index 5a20b5256076..d8400b66928a 100644
--- a/pkgs/tools/admin/ansible/2.1.nix
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -7,7 +7,7 @@
 with pythonPackages;
 
 let
-  jinja = jinja2.override rec {
+  jinja = jinja2.overrideDerivation (old: rec {
     pname = "Jinja2";
     version = "2.8.1";
     name = "${pname}-${version}";
@@ -15,7 +15,7 @@ let
       url = "mirror://pypi/J/Jinja2/${name}.tar.gz";
       sha256 = "35341f3a97b46327b3ef1eb624aadea87a535b8f50863036e085e7c426ac5891";
     };
-  };
+  });
 
 in buildPythonPackage rec {
   pname = "ansible";
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
index 528dbf0e97bc..3da3802e40ff 100644
--- a/pkgs/tools/admin/ansible/2.2.nix
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -9,7 +9,7 @@ with pythonPackages;
 let
   # Shouldn't be needed anymore in next version
   # https://github.com/NixOS/nixpkgs/pull/22345#commitcomment-20718521
-  jinja = (jinja2.override rec {
+  jinja = jinja2.overrideDerivation (old: rec {
     pname = "Jinja2";
     version = "2.8.1";
     name = "${pname}-${version}";

From f1796b8be0472e6e790a07a18e5b4c02907dffe4 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 30 Aug 2017 22:03:20 +0200
Subject: [PATCH 068/134] python.pkgs.service-identity: move expression

---
 .../service_identity/default.nix              | 35 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 22 +-----------
 2 files changed, 36 insertions(+), 21 deletions(-)
 create mode 100644 pkgs/development/python-modules/service_identity/default.nix

diff --git a/pkgs/development/python-modules/service_identity/default.nix b/pkgs/development/python-modules/service_identity/default.nix
new file mode 100644
index 000000000000..69f9d7bf3f5c
--- /dev/null
+++ b/pkgs/development/python-modules/service_identity/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, characteristic
+, pyasn1
+, pyasn1-modules
+, pyopenssl
+, idna
+, attrs
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "service_identity";
+  version = "16.0.0";
+  name = "${pname}-${version}";
+
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0dih7i7d36nbllcxgfkvbnaj1wlzhwfnpr4b97dz74czylif4c06";
+  };
+
+  propagatedBuildInputs = [
+    characteristic pyasn1 pyasn1-modules pyopenssl idna attrs
+  ];
+
+  checkInputs = [
+    pytest
+  ];
+
+  checkPhase = ''
+    py.test
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c6798d63602a..a165531365ca 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -25585,27 +25585,7 @@ EOF
 
   };
 
-  service-identity = buildPythonPackage rec {
-    name = "service-identity-${version}";
-    version = "16.0.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/service_identity/service_identity-${version}.tar.gz";
-      sha256 = "0dih7i7d36nbllcxgfkvbnaj1wlzhwfnpr4b97dz74czylif4c06";
-    };
-
-    propagatedBuildInputs = with self; [
-      characteristic pyasn1 pyasn1-modules pyopenssl idna attrs
-    ];
-
-    buildInputs = with self; [
-      pytest
-    ];
-
-    checkPhase = ''
-      py.test
-    '';
-  };
+  service-identity = callPackage ../development/python-modules/service_identity { };
 
   signedjson = buildPythonPackage rec {
     name = "signedjson-${version}";

From 8521ea97a76c1ce3c45c0e4040a0b14a4ee6d088 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 30 Aug 2017 22:05:30 +0200
Subject: [PATCH 069/134] python.pkgs.twisted: add the tls extras

With setuptools it is possible to define optional sets of packages.
Sometimes packages may require a dependency with such extras. In that
case we could now add e.g. twisted.extras.tls to the
propagatedBuildInputs.
---
 .../python-modules/twisted/default.nix           | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 66a6022802fb..8acbfc91a41b 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -1,5 +1,15 @@
-{ stdenv, buildPythonPackage, fetchurl, python,
-  zope_interface, incremental, automat, constantly, hyperlink
+{ stdenv
+, buildPythonPackage
+, fetchurl
+, python
+, zope_interface
+, incremental
+, automat
+, constantly
+, hyperlink
+, pyopenssl
+, service-identity
+, idna
 }:
 buildPythonPackage rec {
   pname = "Twisted";
@@ -13,6 +23,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink ];
 
+  passthru.extras.tls = [ pyopenssl service-identity idna ];
+
   # Patch t.p._inotify to point to libc. Without this,
   # twisted.python.runtime.platform.supportsINotify() == False
   patchPhase = stdenv.lib.optionalString stdenv.isLinux ''

From 93a13c19bc43e8cf83c6df9042d02a8edc585f95 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 30 Aug 2017 22:06:04 +0200
Subject: [PATCH 070/134] python.pkgs.sqlalchemy-migrate: disable tests

because they depend on oslo-config which is broken.
---
 .../python-modules/sqlalchemy-migrate/default.nix            | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
index 9cf1ba1b3d87..9b431f29acb8 100644
--- a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     sha256 = "0ld2bihp9kmf57ykgzrfgxs4j9kxlw79sgdj9sfn47snw3izb2p6";
   };
 
-  buildInputs = [ unittest2 scripttest pytz pylint tempest-lib mock testtools ];
+  checkInputs = [ unittest2 scripttest pytz pylint  mock testtools ];
   propagatedBuildInputs = [ pbr tempita decorator sqlalchemy six sqlparse ];
 
   checkPhase = ''
@@ -27,6 +27,9 @@ buildPythonPackage rec {
     ${python.interpreter} setup.py test
   '';
 
+  # Tests require tempest-lib which requires the broken oslo-config
+  doCheck = false;
+
   meta = with stdenv.lib; {
     homepage = http://code.google.com/p/sqlalchemy-migrate/;
     description = "Schema migration tools for SQLAlchemy";

From d447471ea12bcde1f9821067084201462a25c6d1 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 30 Aug 2017 22:06:49 +0200
Subject: [PATCH 071/134] python.pkgs.sphinx-testing: 0.7.1 -> 0.7.2

---
 .../python-modules/sphinx-testing/default.nix | 35 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 24 +------------
 2 files changed, 36 insertions(+), 23 deletions(-)
 create mode 100644 pkgs/development/python-modules/sphinx-testing/default.nix

diff --git a/pkgs/development/python-modules/sphinx-testing/default.nix b/pkgs/development/python-modules/sphinx-testing/default.nix
new file mode 100644
index 000000000000..2efb23c80864
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-testing/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, mock
+, sphinx
+, six
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-testing";
+  version = "0.7.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9d30f93007620e137b33edf19f52a7225eab853546b7e588ef09d1342e821e94";
+  };
+
+  checkInputs = [ mock ];
+  propagatedBuildInputs = [ sphinx six ];
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover -s tests
+  '';
+
+  # Test failures https://github.com/sphinx-doc/sphinx-testing/issues/5
+  doCheck = false;
+
+  meta = {
+    homepage = https://github.com/sphinx-doc/sphinx-testing;
+    license = lib.licenses.bsd2;
+    description = "Testing utility classes and functions for Sphinx extensions";
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a165531365ca..3ce254acb514 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -21545,29 +21545,7 @@ in {
     };
   });
 
-  sphinx-testing = buildPythonPackage rec {
-    name = "sphinx-testing-${version}";
-    version = "0.7.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/sphinx-testing/${name}.tar.gz";
-      sha256 = "0cd235ce939770ae5128eda01d8611fb1e36d8129399e98565f99fcbff3a8062";
-    };
-
-    buildInputs = with self; [ mock ];
-    propagatedBuildInputs = with self; [ sphinx six ];
-
-    checkPhase = ''
-      ${python.interpreter} -m unittest discover -s tests
-    '';
-
-    meta = {
-      homepage = https://github.com/sphinx-doc/sphinx-testing;
-      license = licenses.bsd2;
-      description = "Testing utility classes and functions for Sphinx extensions";
-    };
-
-  };
+  sphinx-testing = callPackage ../development/python-modules/sphinx-testing { };
 
   sphinxcontrib-blockdiag = buildPythonPackage (rec {
     name = "${pname}-${version}";

From 6b3755ed13a0e41f8f53eeff2dbfec4e802e77a7 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:11:44 +0200
Subject: [PATCH 072/134] python.pkgs.oslo-config: mark as broken

---
 pkgs/development/python-modules/oslo-config/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/oslo-config/default.nix b/pkgs/development/python-modules/oslo-config/default.nix
index 6323e72e2a5c..51b2f0df75dc 100644
--- a/pkgs/development/python-modules/oslo-config/default.nix
+++ b/pkgs/development/python-modules/oslo-config/default.nix
@@ -19,4 +19,7 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace requirements.txt --replace "argparse" ""
   '';
+
+  # Requires a bunch of new packages
+  meta.broken = true;
 }

From ef49ba9d1b7ccc4bb886901e6d4ea524d46863f7 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:13:37 +0200
Subject: [PATCH 073/134] python.pkgs.service-identity: init at 17.0.0

---
 .../python-modules/service_identity/default.nix            | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/service_identity/default.nix b/pkgs/development/python-modules/service_identity/default.nix
index 69f9d7bf3f5c..d27c4fe2975c 100644
--- a/pkgs/development/python-modules/service_identity/default.nix
+++ b/pkgs/development/python-modules/service_identity/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "service_identity";
-  version = "16.0.0";
+  version = "17.0.0";
   name = "${pname}-${version}";
 
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0dih7i7d36nbllcxgfkvbnaj1wlzhwfnpr4b97dz74czylif4c06";
+    sha256 = "4001fbb3da19e0df22c47a06d29681a398473af4aa9d745eca525b3b2c2302ab";
   };
 
   propagatedBuildInputs = [
@@ -32,4 +32,7 @@ buildPythonPackage rec {
   checkPhase = ''
     py.test
   '';
+
+  # Tests not included in archive
+  doCheck = false;
 }
\ No newline at end of file

From bef9aa432ce570f39468d792f5b62fc58b388dd1 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:15:36 +0200
Subject: [PATCH 074/134] python.pkgs.treq: disable tests

---
 .../development/python-modules/treq/default.nix | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index 5ee984941d07..6bd7355b34df 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchPypi, buildPythonPackage, service-identity, requests, six
-, mock, twisted, incremental, pep8 }:
+, mock, twisted, incremental, pep8, httpbin
+}:
 
 buildPythonPackage rec {
   name = "${pname}-${version}";
@@ -11,11 +12,20 @@ buildPythonPackage rec {
     sha256 = "ef72d2d5e0b24bdf29267b608fa33df0ac401743af8524438b073e1fb2b66f16";
   };
 
-  propagatedBuildInputs = [ twisted requests six incremental service-identity ];
+  propagatedBuildInputs = [
+    requests
+    six
+    incremental
+    service-identity
+    twisted
+    # twisted [tls] requirements (we should find a way to list "extras")
+    twisted.extras.tls
+  ];
 
   checkInputs = [
     pep8
     mock
+    httpbin
   ];
 
   postPatch = ''
@@ -35,6 +45,9 @@ buildPythonPackage rec {
     trial treq
   '';
 
+  # Failing tests https://github.com/twisted/treq/issues/208
+  doCheck = false;
+
   meta = with stdenv.lib; {
     homepage = http://github.com/twisted/treq;
     description = "A requests-like API built on top of twisted.web's Agent";

From ae6c8be79176870969c9da19f71178b8fa567952 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:32:25 +0200
Subject: [PATCH 075/134] python.pkgs.testtools: move expression

---
 .../python-modules/testtools/default.nix      | 38 +++++++++++++++++++
 .../testtools_support_unittest2.patch         |  0
 pkgs/top-level/python-packages.nix            | 23 +----------
 3 files changed, 39 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/development/python-modules/testtools/default.nix
 rename pkgs/development/python-modules/{ => testtools}/testtools_support_unittest2.patch (100%)

diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
new file mode 100644
index 000000000000..d1f3a5feeaaa
--- /dev/null
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pbr
+, python_mimeparse
+, extras
+, lxml
+, unittest2
+, traceback2
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "testtools";
+  version = "1.8.0";
+  name = "${pname}-${version}";
+
+  # Python 2 only judging from SyntaxError
+#   disabled = isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "15yxz8d70iy1b1x6gd7spvblq0mjxjardl4vnaqasxafzc069zca";
+  };
+
+  propagatedBuildInputs = [ pbr python_mimeparse extras lxml unittest2 ];
+  buildInputs = [ traceback2 ];
+  patches = [ ./testtools_support_unittest2.patch ];
+
+  # No tests in archive
+  doCheck = false;
+
+  meta = {
+    description = "A set of extensions to the Python standard library's unit testing framework";
+    homepage = http://pypi.python.org/pypi/testtools;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/testtools_support_unittest2.patch b/pkgs/development/python-modules/testtools/testtools_support_unittest2.patch
similarity index 100%
rename from pkgs/development/python-modules/testtools_support_unittest2.patch
rename to pkgs/development/python-modules/testtools/testtools_support_unittest2.patch
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3ce254acb514..f6d5ddf4c985 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22312,28 +22312,7 @@ in {
     };
   };
 
-  testtools = buildPythonPackage rec {
-    name = "testtools-${version}";
-    version = "1.8.0";
-
-    # Python 2 only judging from SyntaxError
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/t/testtools/${name}.tar.gz";
-      sha256 = "15yxz8d70iy1b1x6gd7spvblq0mjxjardl4vnaqasxafzc069zca";
-    };
-
-    propagatedBuildInputs = with self; [ pbr python_mimeparse extras lxml unittest2 ];
-    buildInputs = with self; [ traceback2 ];
-    patches = [ ../development/python-modules/testtools_support_unittest2.patch ];
-
-    meta = {
-      description = "A set of extensions to the Python standard library's unit testing framework";
-      homepage = http://pypi.python.org/pypi/testtools;
-      license = licenses.mit;
-    };
-  };
+  testtools = callPackage ../development/python-modules/testtools { };
 
   traitlets = buildPythonPackage rec {
     pname = "traitlets";

From f27468e675fd7c4bd09bdd76fe1612fde23ddf58 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:32:44 +0200
Subject: [PATCH 076/134] python.pkgs.cryptography: fix name

---
 pkgs/top-level/python-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f6d5ddf4c985..9d91544e59be 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3447,7 +3447,7 @@ in {
   cryptography = buildPythonPackage rec {
     # also bump cryptography_vectors
     pname = "cryptography";
-    name = "${pname}${version}";
+    name = "${pname}-${version}";
     version = "1.8.1";
 
     src = fetchPypi {

From ed75ce39a6ab83dfb37c6dca640a032ae2aae799 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:33:14 +0200
Subject: [PATCH 077/134] python.pkgs.doc8: init at 0.8.0

---
 .../python-modules/doc8/default.nix           | 32 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/python-modules/doc8/default.nix

diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
new file mode 100644
index 000000000000..cb91014d6ef2
--- /dev/null
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pbr
+, docutils
+, six
+, chardet
+, stevedore
+, restructuredtext_lint
+}:
+
+buildPythonPackage rec {
+  pname = "doc8";
+  version = "0.8.0";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "2df89f9c1a5abfb98ab55d0175fed633cae0cf45025b8b1e0ee5ea772be28543";
+  };
+
+  buildInputs = [ pbr ];
+  propagatedBuildInputs = [ docutils six chardet stevedore restructuredtext_lint ];
+
+  doCheck = false;
+
+  meta = {
+    description = "Style checker for Sphinx (or other) RST documentation";
+    homepage = "https://launchpad.net/doc8";
+    license = lib.licenses.asl20;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9d91544e59be..6fecd42f0a49 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15620,6 +15620,8 @@ in {
       testrepository subunit coverage oslotest ];
   };
 
+  doc8 = callPackage ../development/python-modules/doc8 { };
+
   wrapt = buildPythonPackage rec {
     name = "wrapt-${version}";
     version = "1.10.5";

From 5412ea35e4670a92b82b94b250649847c7ebed98 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:33:46 +0200
Subject: [PATCH 078/134] python.pkgs.restructuredtext_lint: init  at 1.1.1

---
 .../restructuredtext_lint/default.nix         | 34 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/python-modules/restructuredtext_lint/default.nix

diff --git a/pkgs/development/python-modules/restructuredtext_lint/default.nix b/pkgs/development/python-modules/restructuredtext_lint/default.nix
new file mode 100644
index 000000000000..1a863c629738
--- /dev/null
+++ b/pkgs/development/python-modules/restructuredtext_lint/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, docutils
+, nose
+, stdenv
+, flake8
+, pyyaml
+, testtools
+}:
+
+buildPythonPackage rec {
+  pname = "restructuredtext_lint";
+  version = "1.1.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "167e8adaa5bdc30531ee91760d6c216b306a8a3372aad34b1f72d8adcc5e011e";
+  };
+
+  checkInputs = [ nose flake8 pyyaml testtools ];
+  propagatedBuildInputs = [ docutils ];
+
+  checkPhase = ''
+     ${stdenv.shell} test.sh
+  '';
+
+  meta = {
+    description = "reStructuredText linter";
+    homepage = https://github.com/twolfson/restructuredtext-lint;
+    license = lib.licenses.unlicense;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6fecd42f0a49..d73f340b860a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19670,6 +19670,8 @@ in {
     };
   };
 
+  restructuredtext_lint = callPackage ../development/python-modules/restructuredtext_lint { };
+
   robomachine = buildPythonPackage rec {
     name = "robomachine-0.6";
 

From 0c4c819b4d5db24f4fe0a9e886d2345b12bb9721 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 10:36:42 +0200
Subject: [PATCH 079/134] python.pkgs.debtcollector: disable tests

because oslo is entirely broken.
---
 pkgs/top-level/python-packages.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d73f340b860a..99aa74348e53 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15616,8 +15616,11 @@ in {
       sed -i 's@python@${python.interpreter}@' .testr.conf
     '';
 
-    buildInputs = with self; [ pbr Babel six wrapt testtools testscenarios
-      testrepository subunit coverage oslotest ];
+    buildInputs = with self; [ pbr ];
+    propagatedBuildInputs = with self; [ wrapt Babel six doc8 ];
+    checkInputs = with self; [ pbr Babel six wrapt testtools testscenarios
+       testrepository subunit coverage oslotest ];
+    doCheck = false; # oslo is broken
   };
 
   doc8 = callPackage ../development/python-modules/doc8 { };

From 72cc6ba17fdd516b8d534f8597188dbf4c406174 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 11:37:27 +0200
Subject: [PATCH 080/134] ansible_2_1, ansible_2_2: use overridePythonAttrs

---
 pkgs/tools/admin/ansible/2.1.nix | 10 ++++------
 pkgs/tools/admin/ansible/2.2.nix |  9 ++++-----
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/pkgs/tools/admin/ansible/2.1.nix b/pkgs/tools/admin/ansible/2.1.nix
index d8400b66928a..6232e4ad95ba 100644
--- a/pkgs/tools/admin/ansible/2.1.nix
+++ b/pkgs/tools/admin/ansible/2.1.nix
@@ -7,16 +7,14 @@
 with pythonPackages;
 
 let
-  jinja = jinja2.overrideDerivation (old: rec {
-    pname = "Jinja2";
+  jinja = jinja2.overridePythonAttrs (old: rec {
     version = "2.8.1";
-    name = "${pname}-${version}";
-    src = fetchurl {
-      url = "mirror://pypi/J/Jinja2/${name}.tar.gz";
+    name = "${old.pname}-${version}";
+    src = old.src.override {
+      inherit version;
       sha256 = "35341f3a97b46327b3ef1eb624aadea87a535b8f50863036e085e7c426ac5891";
     };
   });
-
 in buildPythonPackage rec {
   pname = "ansible";
   version = "2.1.4.0";
diff --git a/pkgs/tools/admin/ansible/2.2.nix b/pkgs/tools/admin/ansible/2.2.nix
index 3da3802e40ff..02392d7ac89f 100644
--- a/pkgs/tools/admin/ansible/2.2.nix
+++ b/pkgs/tools/admin/ansible/2.2.nix
@@ -9,12 +9,11 @@ with pythonPackages;
 let
   # Shouldn't be needed anymore in next version
   # https://github.com/NixOS/nixpkgs/pull/22345#commitcomment-20718521
-  jinja = jinja2.overrideDerivation (old: rec {
-    pname = "Jinja2";
+  jinja = jinja2.overridePythonAttrs (old: rec {
     version = "2.8.1";
-    name = "${pname}-${version}";
-    src = fetchurl {
-      url = "mirror://pypi/J/Jinja2/${name}.tar.gz";
+    name = "${old.pname}-${version}";
+    src = old.src.override {
+      inherit version;
       sha256 = "35341f3a97b46327b3ef1eb624aadea87a535b8f50863036e085e7c426ac5891";
     };
   });

From 8e19e0327f914d04815676e40344729c7a0f56fe Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 12:16:48 +0200
Subject: [PATCH 081/134] Python: maintenance updates

---
 pkgs/development/python-modules/Cython/default.nix        | 4 ++--
 pkgs/development/python-modules/adal/default.nix          | 4 ++--
 pkgs/development/python-modules/dask/default.nix          | 4 ++--
 pkgs/development/python-modules/discordpy/default.nix     | 4 ++--
 pkgs/development/python-modules/flask-cors/default.nix    | 4 ++--
 pkgs/development/python-modules/flask-migrate/default.nix | 4 ++--
 pkgs/development/python-modules/h5py/default.nix          | 4 ++--
 pkgs/development/python-modules/keras/default.nix         | 4 ++--
 pkgs/development/python-modules/m2r/default.nix           | 4 ++--
 pkgs/development/python-modules/pycryptodome/default.nix  | 4 ++--
 pkgs/development/python-modules/pyroute2/default.nix      | 4 ++--
 pkgs/development/python-modules/pyshp/default.nix         | 4 ++--
 pkgs/development/python-modules/semver/default.nix        | 4 ++--
 pkgs/development/python-modules/sqlmap/default.nix        | 4 ++--
 pkgs/development/python-modules/tornado/default.nix       | 4 ++--
 pkgs/development/python-modules/zetup/default.nix         | 4 ++--
 pkgs/development/python-modules/zxcvbn-python/default.nix | 4 ++--
 17 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 3dd4b0acbafb..22f3579bae3f 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -14,11 +14,11 @@
 buildPythonPackage rec {
   pname = "Cython";
   name = "${pname}-${version}";
-  version = "0.26";
+  version = "0.26.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4c24e2c22ddaed624d35229dc5db25049e9e225c6f64f3364326836cad8f2c66";
+    sha256 = "c2e63c4794161135adafa8aa4a855d6068073f421c83ffacc39369497a189dd5";
   };
 
   # With Python 2.x on i686-linux or 32-bit ARM this test fails because the
diff --git a/pkgs/development/python-modules/adal/default.nix b/pkgs/development/python-modules/adal/default.nix
index 4673e5461d3a..a1fb96673957 100644
--- a/pkgs/development/python-modules/adal/default.nix
+++ b/pkgs/development/python-modules/adal/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "adal";
-  version = "0.4.6";
+  version = "0.4.7";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7c5bbf4d8a17d535e6e857b28a41cedddc2767fc57424c15d484fa779bb97325";
+    sha256 = "114046ac85d0054791c21b00922f26286822bc6f2ba3716db42e7e57f762ef20";
   };
 
   propagatedBuildInputs =  [ requests pyjwt dateutil ];
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 32d925f36485..b1d39e493b7a 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "0.15.1";
+  version = "0.15.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f62f19ab5958b13d0ee733db18218c28a9d452a3554446a3dfb5ac3d4a5f7e34";
+    sha256 = "abe6758540fdbc260f14ee71cebc3ab88682e24ff147afa89375b7006f57d3ed";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/discordpy/default.nix b/pkgs/development/python-modules/discordpy/default.nix
index eebcd802dd61..03b04aacebf0 100644
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@@ -11,13 +11,13 @@
 
 let
   pname = "discord.py";
-  version = "0.16.10";
+  version = "0.16.11";
 in buildPythonPackage rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${name}.tar.gz";
-    sha256 = "cb0b9ad5f5edf2d5afd5f5ce07381a0a089eb036004938126a5582fc8fa0cc88";
+    sha256 = "eb3c6faa7d4570cce05533d0742bbcb768629e2b3ba9e1cc79c05833db91ac4d";
   };
 
   propagatedBuildInputs = [ asyncio aiohttp websockets pynacl ];
diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 4521374a0bb3..acd9430316b4 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -4,11 +4,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "Flask-Cors";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1mnsyyqn8akin2vz98b9fbv63hcvwmfkaapsglw5jizdkmaz628a";
+    sha256 = "62ebc5ad80dc21ca0ea9f57466c2c74e24a62274af890b391790c260eb7b754b";
   };
 
   buildInputs = [ nose ];
diff --git a/pkgs/development/python-modules/flask-migrate/default.nix b/pkgs/development/python-modules/flask-migrate/default.nix
index dc94be8f6005..1a4bd11a1fa3 100644
--- a/pkgs/development/python-modules/flask-migrate/default.nix
+++ b/pkgs/development/python-modules/flask-migrate/default.nix
@@ -5,12 +5,12 @@ with stdenv.lib;
 
 buildPythonPackage rec {
   pname = "Flask-Migrate";
-  version = "2.1.0";
+  version = "2.1.1";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "716d5b68eec53821f80b3fbcb0fd60baed0cb0e320abb30289e83217668cef7f";
+    sha256 = "b709ca8642559c3c5a81a33ab10839fa052177accd5ba821047a99db635255ed";
   };
 
   checkInputs = optional isPy3k glibcLocales;
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index 0bc8b969f5ae..9b2821380b98 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -11,13 +11,13 @@ let
   mpiSupport = hdf5.mpiSupport;
 
 in buildPythonPackage rec {
-  version = "2.7.0";
+  version = "2.7.1";
   pname = "h5py";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/h/h5py/${name}.tar.gz";
-    sha256 = "79254312df2e6154c4928f5e3b22f7a2847b6e5ffb05ddc33e37b16e76d36310";
+    sha256 = "180a688311e826ff6ae6d3bda9b5c292b90b28787525ddfcb10a29d5ddcae2cc";
   };
 
   configure_flags = "--hdf5=${hdf5}" + optionalString mpiSupport " --mpi";
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 51c15ad68135..1379d93c6dd5 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "Keras";
-  version = "2.0.7";
+  version = "2.0.8";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a6c72ee2b94be1ffefe7e77b69582b9827211f0c356b2189459711844d3634c0";
+    sha256 = "899dc6aaed366f20100b9f80cf1093ea5b43eecc74afd1dc63a4e48dfa776ab9";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/m2r/default.nix b/pkgs/development/python-modules/m2r/default.nix
index 39498919708b..066a9856e500 100644
--- a/pkgs/development/python-modules/m2r/default.nix
+++ b/pkgs/development/python-modules/m2r/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   pname = "m2r";
   name = "${pname}-${version}";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cfb5b8a37defdd594eb46a794b87d9b4ca1902b0e8e309c9f2623f7275c261d6";
+    sha256 = "7e69fe9b2752926c33399709e354da3bcca60043c7bf5e727b7126ec3a5db7db";
   };
 
   propagatedBuildInputs = [ mistune docutils ];
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 148225787614..9751eaf7ce79 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, python, buildPythonPackage, gmp }:
 
 buildPythonPackage rec {
-  version = "3.4.6";
+  version = "3.4.7";
   pname = "pycryptodome";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/p/pycryptodome/${name}.tar.gz";
-    sha256 = "df1be662060cf3abdcf2086ebb401f750744106425ddebf74c57feab410e4923";
+    sha256 = "18d8dfe31bf0cb53d58694903e526be68f3cf48e6e3c6dfbbc1e7042b1693af7";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index 8465c205295c..7a59690e5b04 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.4.19";
+  version = "0.4.21";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/p/pyroute2/${name}.tar.gz";
-    sha256 = "122a1e34702287b805742a6edd8fe8483608238bd1602df2d5e3274bd8e8030a";
+    sha256 = "7afad28ee0a0f3e7c34adaa9f953d00560ed9910203e93f107833b6e8d151171";
   };
 
   # requires root priviledges
diff --git a/pkgs/development/python-modules/pyshp/default.nix b/pkgs/development/python-modules/pyshp/default.nix
index 4629331e52d5..ea38c096ee1b 100644
--- a/pkgs/development/python-modules/pyshp/default.nix
+++ b/pkgs/development/python-modules/pyshp/default.nix
@@ -2,13 +2,13 @@
 , setuptools }:
 
 buildPythonPackage rec {
-  version = "1.2.3";
+  version = "1.2.12";
   pname = "pyshp";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e18cc19659dadc5ddaa891eb780a6958094da0cf105a1efe0f67e75b4fa1cdf9";
+    sha256 = "8dcd65e0aa2aa2951527ddb7339ea6e69023543d8a20a73fc51e2829b9ed6179";
   };
 
   buildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/semver/default.nix b/pkgs/development/python-modules/semver/default.nix
index 2d592962558c..f2f3069fbf9f 100644
--- a/pkgs/development/python-modules/semver/default.nix
+++ b/pkgs/development/python-modules/semver/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "semver";
-  version = "2.7.7";
+  version = "2.7.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "20ffbb50248a6141bb9eba907db0e47ee4a239ddb55fe0ada8696fc241495a9d";
+    sha256 = "a6212f5c552452e306502ac8476bbca48af62db29c4528fdd91d319d0a44b07b";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index a440abb51498..b976524ba698 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.1.8";
+  version = "1.1.9";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f8f88fc7fe0ba81a7558902f87df31c052e27404caa26a160174747afcaebe49";
+    sha256 = "3387ba58383f4e8131f109b40e2b001dec436f38cd9b9b78d38871b8608fdd9e";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index 11078eb85623..bc39745945d9 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "4.5.1";
+  version = "4.5.2";
   name = "${pname}-${version}";
 
   propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
@@ -23,6 +23,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db0904a28253cfe53e7dedc765c71596f3c53bb8a866ae50123320ec1a7b73fd";
+    sha256 = "1fb8e494cd46c674d86fac5885a3ff87b0e283937a47d74eb3c02a48c9e89ad0";
   };
 }
diff --git a/pkgs/development/python-modules/zetup/default.nix b/pkgs/development/python-modules/zetup/default.nix
index 66a4718fe9e7..a682a6e4e928 100644
--- a/pkgs/development/python-modules/zetup/default.nix
+++ b/pkgs/development/python-modules/zetup/default.nix
@@ -5,11 +5,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "zetup";
-  version = "0.2.34";
+  version = "0.2.42";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0k4lm51b5qjy7yxy3n5z8vc5hlvjcsfsvwjgqzkr0pisysar1kpf";
+    sha256 = "6c9e25249f3014ed2162398772ccf1a5e8a4e9e66c74e3c7f6683945a6a3d84c";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/zxcvbn-python/default.nix b/pkgs/development/python-modules/zxcvbn-python/default.nix
index 66a0f8d77aab..49ff6e505f41 100644
--- a/pkgs/development/python-modules/zxcvbn-python/default.nix
+++ b/pkgs/development/python-modules/zxcvbn-python/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "zxcvbn-python";
-  version = "4.4.15";
+  version = "4.4.16";
 
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ef982a382518d217d353a42093aa8bb8608a50bc2df559c08885bba166782cd0";
+    sha256 = "63cc481bfb8950c43d4a87926be22cf8c4bb281ef7f818a8ef2d30b55a97c3e0";
   };
 
   # No tests in archive

From 1862315bae7c91ca9bfb2b25cdade34c27ea1956 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 12:20:28 +0200
Subject: [PATCH 082/134] python.pkgs.cryptography-vectors: fix name

---
 pkgs/top-level/python-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 99aa74348e53..3e5df0dddd77 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3490,8 +3490,8 @@ in {
   cryptography_vectors = buildPythonPackage rec {
       # also bump cryptography
     pname = "cryptography_vectors";
-    name = "${pname}${version}";
-    version = "1.8.1";
+    version = self.cryptography.version;
+    name = "${pname}-${version}";
 
     src = fetchPypi {
       inherit pname version;

From 19d789607ec3b7742bcb24f2d38c277245ca08d2 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 12:26:01 +0200
Subject: [PATCH 083/134] python.pkgs.cryptography: 1.8.1 -> 2.0.3

---
 pkgs/top-level/python-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3e5df0dddd77..aeadcfa755dd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3448,11 +3448,11 @@ in {
     # also bump cryptography_vectors
     pname = "cryptography";
     name = "${pname}-${version}";
-    version = "1.8.1";
+    version = "2.0.3";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "323524312bb467565ebca7e50c8ae5e9674e544951d28a2904a50012a8828190";
+      sha256 = "d04bb2425086c3fe86f7bc48915290b13e798497839fbb18ab7f6dffcf98cc3a";
     };
 
     buildInputs = [ pkgs.openssl self.cryptography_vectors ]
@@ -3495,7 +3495,7 @@ in {
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "2fd61facea08800ca98ac923f6d02f48a7ae6648025b29cdeb51987c1532add6";
+      sha256 = "beb831aa73663a224f4d7520483ed02da544533bb03b26ec07a5f9a0dd0941e1";
     };
 
     # No tests included

From bea4c214132385b48687a739d777ee8aa0d3960e Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 12:30:30 +0200
Subject: [PATCH 084/134] python.pkgs.optfunc: remove dead code

---
 pkgs/top-level/python-packages.nix | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index aeadcfa755dd..51264c800e66 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14284,28 +14284,6 @@ in {
     };
   };
 
-  # optfunc = buildPythonPackage ( rec {
-  #   name = "optfunc-git";
-  #
-  #   src = pkgs.fetchgit {
-  #     url = "https://github.com/simonw/optfunc.git";
-  #     rev = "e3fa034a545ed94ac5a039cf5b170c7d0ee21b7b";
-  #   };
-  #
-  #   installCommand = ''
-  #     dest=$(toPythonPath $out)/optfunc
-  #     mkdir -p $dest
-  #     cp * $dest/
-  #   '';
-  #
-  #   doCheck = false;
-  #
-  #   meta = {
-  #     description = "A new experimental interface to optparse which works by introspecting a function definition";
-  #     homepage = "http://simonwillison.net/2009/May/28/optfunc/";
-  #   };
-  # });
-
   ordereddict = buildPythonPackage rec {
     name = "ordereddict-${version}";
     version = "1.1";

From 2eaecf762da81cda57b6d68aced454a680252c62 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 12:37:16 +0200
Subject: [PATCH 085/134] python.pkgs.openpyxl: 2.3.5 -> 2.4.8

---
 .../python-modules/openpyxl/default.nix       | 33 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 25 +-------------
 2 files changed, 34 insertions(+), 24 deletions(-)
 create mode 100644 pkgs/development/python-modules/openpyxl/default.nix

diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
new file mode 100644
index 000000000000..a214af5eab7f
--- /dev/null
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+, jdcal
+, et_xmlfile
+, lxml
+}:
+
+buildPythonPackage rec {
+  pname = "openpyxl";
+  version = "2.4.8";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "ee7551efb70648fa8ee569c2b6a6dbbeff390cc94b321da5d508a573b90a4f17";
+  };
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ jdcal et_xmlfile lxml ];
+
+  # Tests are not included in archive.
+  # https://bitbucket.org/openpyxl/openpyxl/issues/610
+  doCheck = false;
+
+  meta = {
+    description = "A Python library to read/write Excel 2007 xlsx/xlsm files";
+    homepage = https://openpyxl.readthedocs.org;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lihop sjourdois ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 51264c800e66..74f5c715f8ba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14259,30 +14259,7 @@ in {
     doCheck = false;
   };
 
-  openpyxl = buildPythonPackage rec {
-    version = "2.3.5";
-    name = "openpyxl-${version}";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/o/openpyxl/${name}.tar.gz";
-      sha256 = "0qj7d8l1qc6cjwk1ps01dyh53b3p2k2k7hwmj98y2257jj5mf1s3";
-    };
-
-    buildInputs = with self; [ pytest ];
-    propagatedBuildInputs = with self; [ jdcal et_xmlfile lxml ];
-
-    # Tests are not included in archive.
-    # https://bitbucket.org/openpyxl/openpyxl/issues/610
-    doCheck = false;
-
-    meta = {
-      description = "A Python library to read/write Excel 2007 xlsx/xlsm files";
-      homepage = https://openpyxl.readthedocs.org;
-      license = licenses.mit;
-      maintainers = with maintainers; [ lihop sjourdois ];
-      platforms = platforms.all;
-    };
-  };
+  openpyxl = callPackage ../development/python-modules/openpyxl { };
 
   ordereddict = buildPythonPackage rec {
     name = "ordereddict-${version}";

From 2f91d7fd361f3b5db7ad4df930a8bbea29f05f21 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 13:40:16 +0200
Subject: [PATCH 086/134] python.pkgs.discordpy: disable tests

---
 pkgs/development/python-modules/discordpy/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/discordpy/default.nix b/pkgs/development/python-modules/discordpy/default.nix
index 03b04aacebf0..c9ae73b1661d 100644
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@@ -31,6 +31,9 @@ in buildPythonPackage rec {
 
   disabled = pythonOlder "3.5";
 
+  # No tests in archive
+  doCheck = false;
+
   meta = {
     description = "A python wrapper for the Discord API";
     homepage    = "https://discordpy.rtfd.org/";

From 8fca4f3fdf864df7e41125a3d090c9ffa08a2e76 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 13:40:26 +0200
Subject: [PATCH 087/134] python.pkgs.multidict: fix tests

---
 pkgs/development/python-modules/multidict/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index fc0bdf906275..4141b69f0cdc 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , pytest
 , isPy3k
+, psutil
 }:
 
 let
@@ -16,7 +17,7 @@ in buildPythonPackage rec {
     sha256 = "875f80a046e7799b40df4b015b8fc5dae91697936872a8d7362c909a02ec6d12";
   };
 
-  buildInputs = [ pytest ];
+  checkInputs = [ pytest psutil ];
 
   checkPhase = ''
     py.test

From 146fdc88cb092ca7c78f961f07cf1524b06c00d5 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 13:40:49 +0200
Subject: [PATCH 088/134] python.pkgs.aiohttp: 1.3.5 -> 2.2.5

---
 .../python-modules/aiohttp/default.nix        | 36 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 33 +----------------
 2 files changed, 37 insertions(+), 32 deletions(-)
 create mode 100644 pkgs/development/python-modules/aiohttp/default.nix

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
new file mode 100644
index 000000000000..72b28d01ceab
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, chardet
+, multidict
+, async-timeout
+, yarl
+, pytest
+, gunicorn
+, pytest-raisesregexp
+}:
+
+buildPythonPackage rec {
+  pname = "aiohttp";
+  version = "2.2.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "af5bfdd164256118a0a306b3f7046e63207d1f8cba73a67dcc0bd858dcfcd3bc";
+  };
+
+  disabled = pythonOlder "3.4";
+
+  doCheck = false; # Too many tests fail.
+
+  checkInputs = [ pytest gunicorn pytest-raisesregexp ];
+  propagatedBuildInputs = [ async-timeout chardet multidict yarl ];
+
+  meta = {
+    description = "Http client/server for asyncio";
+    license = with lib.licenses; [ asl20 ];
+    homepage = https://github.com/KeepSafe/aiohttp/;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 74f5c715f8ba..b592a4f2871f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -311,38 +311,7 @@ in {
 
   aiofiles = callPackage ../development/python-modules/aiofiles { };
 
-  aiohttp =
-  let yarl_0_9_8 = self.yarl.overrideAttrs (old: rec {
-    pname = "yarl";
-    version = "0.9.8";
-    name = "${pname}-${version}";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${name}.tar.gz";
-      sha256 = "1v2dsmr7bqp0yx51pwhbxyvzza8m2f88prsnbd926mi6ah38p0d7";
-    };
-  });
-  in buildPythonPackage rec {
-    name = "aiohttp-${version}";
-    version = "1.3.5";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/a/aiohttp/${name}.tar.gz";
-      sha256 = "0hpqdiaifgyfqmxkyzwypwvrnvz5rqzgzylzhihfidc5ldfs856d";
-    };
-
-    disabled = pythonOlder "3.4";
-
-    doCheck = false; # Too many tests fail.
-
-    buildInputs = with self; [ pytest gunicorn pytest-raisesregexp ];
-    propagatedBuildInputs = with self; [ async-timeout chardet multidict yarl_0_9_8 ];
-
-    meta = {
-      description = "Http client/server for asyncio";
-      license = with licenses; [ asl20 ];
-      homepage = https://github.com/KeepSafe/aiohttp/;
-    };
-  };
+  aiohttp = callPackage ../development/python-modules/aiohttp { };
 
   aiohttp-cors = buildPythonPackage rec {
     name = "${pname}-${version}";

From 2c762cd68e4b6ada0a2a2488ba78ad8394a5c2b0 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 2 Sep 2017 13:55:46 +0200
Subject: [PATCH 089/134] python.pkgs.flit: 0.10.0 -> 0.11.4

---
 .../python-modules/flit/default.nix           | 50 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 23 +--------
 2 files changed, 51 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/development/python-modules/flit/default.nix

diff --git a/pkgs/development/python-modules/flit/default.nix b/pkgs/development/python-modules/flit/default.nix
new file mode 100644
index 000000000000..2154feeebb7c
--- /dev/null
+++ b/pkgs/development/python-modules/flit/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, fetchurl
+, isPy3k
+, docutils
+, requests
+, requests_download
+, zipfile36
+, pythonOlder
+, pytest
+, testpath
+, responses
+}:
+
+# Flit is actually an application to build universal wheels.
+# It requires Python 3 and should eventually be moved outside of
+# python-packages.nix. When it will be used to build wheels,
+# care should be taken that there is no mingling of PYTHONPATH.
+
+buildPythonPackage rec {
+  pname = "flit";
+  version = "0.11.4";
+  name = "${pname}-${version}";
+
+#   format = "wheel";
+
+  src = fetchPypi {
+    inherit pname version;
+#     url = https://files.pythonhosted.org/packages/24/98/50a090112a04d9e29155c31a222637668b0a4dd778fefcd3132adc50e877/flit-0.10-py3-none-any.whl;
+    sha256 = "8ba7603cc3bf4149d81811d40fe331abc45ff37a207c63f5f712a0fdb69297bb";
+  };
+
+  disabled = !isPy3k;
+  propagatedBuildInputs = [ docutils requests requests_download ] ++ lib.optional (pythonOlder "3.6") zipfile36;
+
+  checkInputs = [ pytest testpath responses ];
+
+  # Disable test that needs some ini file.
+  checkPhase = ''
+    py.test -k "not test_invalid_classifier"
+  '';
+
+  meta = {
+    description = "A simple packaging tool for simple packages";
+    homepage = https://github.com/takluyver/flit;
+    license = lib.licenses.bsd3;
+    maintainer = lib.maintainers.fridh;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b592a4f2871f..b4ef9a8ce113 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5766,28 +5766,7 @@ in {
     propagatedBuildInputs = with self; [ rpkg offtrac urlgrabber fedora_cert ];
   });
 
-  flit = buildPythonPackage rec {
-    pname = "flit";
-    version = "0.10";
-    name = "${pname}-${version}";
-
-    format = "wheel";
-
-    src = pkgs.fetchurl {
-      url = https://files.pythonhosted.org/packages/24/98/50a090112a04d9e29155c31a222637668b0a4dd778fefcd3132adc50e877/flit-0.10-py3-none-any.whl;
-      sha256 = "4566b2e1807abeb1fd7bfaa9b444447556f1720518edfb134b56a6a1272b0428";
-    };
-
-    disabled = !isPy3k;
-    propagatedBuildInputs = with self; [ docutils requests requests_download zipfile36];
-
-    meta = {
-      description = "A simple packaging tool for simple packages";
-      homepage = https://github.com/takluyver/flit;
-      license = licenses.bsd3;
-      maintainer = maintainers.fridh;
-    };
-  };
+  flit = callPackage ../development/python-modules/flit { };
 
   Flootty = buildPythonPackage rec {
     name = "Flootty-3.2.0";

From 1c45fd01aaaf09fd3f17fff4a91488b2f177e167 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sat, 2 Sep 2017 11:11:19 -0400
Subject: [PATCH 090/134] coreutils: 8.27 -> 8.28

---
 pkgs/tools/misc/coreutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 48bcf143bb6f..142859e7f55c 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -14,11 +14,11 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "coreutils-8.27";
+  name = "coreutils-8.28";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/${name}.tar.xz";
-    sha256 = "0sv547572iq8ayy8klir4hnngnx92a9nsazmf1wgzfc7xr4x74c8";
+    sha256 = "0r8c1bgm68kl70j1lgd0rv12iykw6143k4m9a56xip9rc2hv25qi";
   };
 
   # FIXME needs gcc 4.9 in bootstrap tools

From 51cf42ad0d3ccb55af182f1f0ee5eb5094ea5995 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 16:49:43 +0200
Subject: [PATCH 091/134] glibc: 2.25 -> 2.25-49

Various fixes within, e.g. mutexes deadlocking sometimes.
https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;h=f7057710f14d6c
---
 .../libraries/glibc/2.25-49.patch.gz          | Bin 0 -> 89721 bytes
 .../CVE-2017-1000366-rtld-LD_AUDIT.patch      | 209 ------------------
 ...VE-2017-1000366-rtld-LD_LIBRARY_PATH.patch |  33 ---
 .../CVE-2017-1000366-rtld-LD_PRELOAD.patch    | 115 ----------
 pkgs/development/libraries/glibc/common.nix   |  22 +-
 .../libraries/glibc/fix-i686-memchr.patch     |  23 --
 .../glibc/i686-fix-vectorized-strcspn.patch   |  42 ----
 7 files changed, 11 insertions(+), 433 deletions(-)
 create mode 100644 pkgs/development/libraries/glibc/2.25-49.patch.gz
 delete mode 100644 pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch
 delete mode 100644 pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
 delete mode 100644 pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch
 delete mode 100644 pkgs/development/libraries/glibc/fix-i686-memchr.patch
 delete mode 100644 pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch

diff --git a/pkgs/development/libraries/glibc/2.25-49.patch.gz b/pkgs/development/libraries/glibc/2.25-49.patch.gz
new file mode 100644
index 0000000000000000000000000000000000000000..6796347e3795f2c45c400cbb3789ff86f36ebf92
GIT binary patch
literal 89721
zcmV)VK(D_aiwFP!000021DsfCbKA%f{cP0!h>q>5kRn0hBtiNp(Gs<*3Zu9z*-o<A
zLI#5Yi4_QNap=g_{`b5Y5EMa4w%7VVf`jQ}x?lJ76VFzwxFpweEo1Brx$Ozt34@^_
zjFB}o_|W0*&=$6ccx1b_Hm%BKmQUy+4#TA=mh?WmW4X9uIlV46Yez*^<y_ogeURmg
zx7rCS#e|41mld6gfW~BwCYCpG9kL8_L_Nba3{ArhI*o5>A<8mN7gSa$3lc%sEU836
zSxP~?&_x=?ETzu7f71)gG>vgr3966Fr68V#g362vQPz^QW<?=FVvRx{%YNCXn`O+G
z_!KE|R+JD@O5(J%Ex+8ew}`LdLkR;nc?Rc{>H*PNT9kr?eX0tf#9KxNX|=)wbZ&Ol
zHaQfQ(rzHAV3A1fY7bz#<-_3qXdS*3d45Ohm|x*AQJ$@ERFyoB2i&ueyAd}m%VZ%N
zx@^RTmK7n3<G>N#m^p#b)wD2<BGUB*q}bu{lBEkV&lVKiKWlLsid%|I#}HyT3dLZ+
zJ<kFzjEE8PG;|zI*Y#a_t=H?dbQ~R#ZuV{JnSIlyqa&>+^Q;?|Zg}(<cD?|fp4NNz
z^ETPP;MW0(BsvTeeG_WEyjzQ6u%u2Cd(M(1VEoE2yAzsnF4iUFTA3kM5X%?UN~8$$
zL#4%lQ^)rk8K6nZNp)eU0>718!C1x*;c&{Nkld=))}@c6@hb>jvMWLR_94CNLFZ)d
zUw%BFzMIed<LP|<ZhHJT|MdK1c07lMd3+^q;zD4jM%!q*e>R!`6I{L)c@bx+4B3a-
zd^Ww9!NP@*B|y)MQhNEkjg|A+=L@7*er*sUxao$W7!A$Az_wh@_{bAZ8zE|Y4G#4v
zapCrd)N}i$1zf<UP&I`jqbSP}*!7((eV(D}O1M~{1l}it6(|(B>BsYrbWBMc<P60S
zR13<*I?Ky~u46{8mu0!093Hk$eTZ%Ui<5*M;`~)1_5XJP75uNLGiCnyI?uw2m(MAR
zMH0g14_fb29VD^_mOC&d4rP0ZGGz8f>VQ@WApsAHEV)Ke-o)h+`r-mh%IArcBKo<8
zE?sV*MM0ijq54}LM(h2c(XLIIs{_^2BEiZEhDw1Rv0^;W$oDTUPmcZ1)ALJze)i6v
z{qxfD{eImS&My9Ocs4tx%Ma}&K2bKo6E8N2X1Et3BXGwy5<Oz*CWd83?L<GJpicc0
zFC`c(v+q$4pF`Ot=mmu$ic>+`Lb&|b``Ly6laF_C%99Gc{dG|SchO)e(X6!L7hPv@
zNS%X6IskRlyMyj4P1mT|FVLAa`d#+cU0ePc0%}`*<(*?otUA(1{A?tv6d96o04egp
zm#DadqRdg&uQd9jUFKNPdf(z>yE#Z_QRjyTs1RP|ad}6HxE6^jl5K~Q7aqVC3Lb|*
z)y<Nr3J$XxiAZ039fuW5b}yzv>6l*n7qjD!A7(&c%JNugJ2>2n&lk`m`(yBMt-*{J
zx^_5ZHkyNQEXIZ-!?3@E87cc1T;#gSg{vBe{8HI?(3<Z<7>9^pjLWvpJKnAP^f2hu
zJgNaAj&Q|Rx&F4!B)xe<=O5?udbmJ6qX1KtOp;kShN#F9X@oP)N=gOFUv?5T7WC=Y
zs;Kp=#l}#b7WAgZ8>tO{%`73~Uwa~b-g9A*A+<b^KD5%Zcl`u=3!8)lV>29u!@wL4
z2B9++4zo<|wG*-@SZ8Bzu`XJxKbBQ1zf>yfO+J8i<yR>luW<9lNm!R&R~BzXKTSW)
zn!3Kw2-i#*bAU9F1&@IT(exkOoz!W@F%=|~h03a?KXO?<cJ(&JF9X`udfzOySB|wf
z+J$~UAJ)U=8#>s!c+i!L>sK<Z`@5P=^%nhYJs7@{xqbZH+w*R)DOY{Q<)uh}c|*nq
z7Te(08{!n8=s-**%Cc3W)E5@MD`xji`RVxtgHp;?z&)xG{i93&c_P2`;sw=v)o_Kq
zO<tejPaR0gO8d{6zh?FEl-JtYKJQBPzAW`vo_9U@{h=E~yPhimY!;gQxAylQ?C&&D
zQf1!VVxbiR+7H)GoOZVTfp(y6c!1%!!XA2~@tB7e+HV*{UVzKNu|znwgeQW)=9uZX
zB<?iHa>;Ezi+F`@_By&z4@bEOag_|9c89ycb;;c<Pm(voojAh><gKXEe9bW;t6YE(
z=`1Qmu1C3$QxXFQ!z^ADa_r(sT2|p&^<!%0d(-{pp7BhjY{PK^J{pag$=tv;Y}d4H
z!*T-46jo&0;|N!bIgSF;<TY11{xs9!+)#HMYdqQdb&{!O4aZ2;4BK}^N!QL8rfL1s
z?GsD6933%ihOC4@0bpkckR0A*Z(j<w?kl;V!mU%v9rY<C<y1$&;u35l5E%JnD8fOT
zv8u6-%Mo`auMKd*yh<@<gpg&*04fmE<^sQq3iJ`mfQChm)?VN28D&8s^6Pq-j#Ipi
zn_%N!nQk}=#jAB9B;R1FjVLl&^G)y>454MsM3ba|E9nY`v)X04$ttvS&Pu+SaOLO?
zKW;>ld>cy*0Yecw%y1mx3eyOq!1G)ljlHqSE!Xte$YRde{4*@|o|$4a4M(2IY}ffN
zmTI<Gsx_kh;&{9|cFCy(ujGR@+72bId;m*Q!d;AkX`RZ5?g1-7@bkg0g1>_^Msb4D
zmjEd?)Uzx~9jbJMIaB*Ptrf)-(<@>NCjaLknGzoq8Hw9<67#rB?piilvJ*NNHzZBA
zNv8KbBy*Rte}zfjv&X@}6`Z?6*B+T)XOgBNCqjIV<mI+U*XTRQn!@lmlC^pxa=z^@
zAKU#7twlwZ)=bUfdyVEH*=t2<9|OVu$|iOOH^tDjoG8Lv$0CneUS#f7z`kT1#{E?p
z(XowK_S7eS;`KtLdKUaz;MT$~%n5Ni$kgL9tIEwIzkgh_yZ{K~%_MHioHfEPJ3Gp{
z_{qX>ox?C{IM0eg@3(hg?8wl{@`8GAHhw6wCkp}UBy4ZPd?i*pkCtkrI(DPMfpmTI
z-gZrCbX$u~YT1P-S9fqXm+*)q@f&qsc9!fKM0P3fG=1~Wh;IK*6x|w_HCK^eDv<9!
zp3P7E<M;1R=hGiA<dI%>>hSB$A`bkrgQKsb+iuJ11naVcW-2oBHRh=+JRWXJdrz=F
z-}gybUl;4O#CBT8SMBXstP?tE!C?FHArc;~jQ;}w0RR8&Ty0YuITHSy{0h~6pzOsq
zegPXU8>+m9B(5Vs8K*X>%GK1o!qnL_z8Q~+FUx<wr@J+;jDhUlep^!Du|{f1EvftI
zM^Xyr)q0$!SI41qV%io~2>e6OabahyQPr|ME?Zh3g>()>`#plx@__^*r3^N<Fdx8W
z_A<W3q?>%ad2d{Po_{!-sm31CTKtB3qp=%fdL*?^>8~NtJtDrFs|#a#t@id*;Vr{Q
zyqsPevvYu(*^C6eLO4QDkj+iQwi1uR1xjI*i9j~7*D9uH42uyBbsYnvMKG1ycQ&4n
zxeaMCJ3)PkA+9BI=^+Rq%59&z`Ws@K`YI(trWm>`gTjD>*5T}W0swwFrw&M=2UbQ&
zRNY9IJzinBD=%IL+Iy)bZ2{;()@CyM!9;L9yW97U>><y91IOJQ1PN?%Y22&AY4E$P
zE`fz%pTPpr0350jpOQQ>{w09hAh^W-qS@h~e-f^?k$-!KU~SSAAkC=YCiK?iNY%R#
z0FYr?OHBh?N-^ETUBoAB?OKH%Lq4HJFT@gcgmq*OSb9OFxOuUz<&D~g3GYS#)cBY%
zK0vHXfYl6~1K2_m18w@=mJ$V$t{JjM%eYwi1p(ejy>|mQG8gJPu>d!?_=OJ}ONbjS
zrquWj&ez&<$z5H3qg<cNKMUAoZnBrwsAaYkG~Y1S)Qd<VfJL?@n!Xh@mC@W!=_Bv9
zld{2g;fjE?$#DK2AdMh72G~m$Efz#b|F`M<!_}v`8ee`<zl~=z%<M037*xO;Dy(La
zMTpxcv|&b(8LYSH0gL!}KAU_%nengFi|PCeb>!W2etCX#quyQ3fY`6cv-x!L>0&%n
z*PmwBS2yPX@+n=8UWjh%w4Q04=H(Kx3ZjR#=`Z3`4_`3m@f`zt@?#i#+x0iRLq`1j
z4-V^scEdE7s_6F(Svf>pEtpB+x>ADv{{Fsm8zjumFGNy&a4HlS8kuvwfxGtcdjQ;V
zcUpXr+UA<%cw<*m<77pf1P9D-?082}cDyoecgOp0WJuj=eMx}%<8b2Z{fzPe{6O^1
zah+zs_P<mAwJgJO;VfMv3PT}l3a@}i+{i$e?}<#y8YS5@`*>wxJOd2Z!v8lSwssOE
z6m3#@6(mawfrMxhVsj@zXu?3T7{70YdHk*kNYz22;h9Sx@!wlDerHTC&*!buTPog(
z`2$(*)?om%HoY95oz0AktE+1wR+_rV19wSFC+f#@P)2J|HB$L-c9VY^XYXg@kLq{%
zGP$@q|9n1asjjF+sc#lcxN3M#tK`zS9q?p(XdC92|6do=wt+9rv>@eLxPh^z9^(Nm
zC}vB=18GrCAz7ZTWlsd9Macmy!dRB1^bIWu#dO@eVmkEVf>qMtfaM}2$;Jmxmqnmv
z5&IycOiCk>+Hu0lka{@B<YIb$Iafc^?8ocO&j5_BHKW{+_V!w;pZ8~t=#{oG)pvT)
zRS(o5R3Y`w&u``ikj3=f7vuc%bS^<FF^$YYSM$hg?cC_Gr3Tr2srzXFVy>dlCI%Fb
z1}%#g%l=D>)pUBmodyJ}mV5gMoa`%BtKnb;N8wg_m@Yt#bh`NZP&QVnso>bci7@Oy
z4yPGEcQUZOlY!eE+HS8uI2@d~hdpQD4Ev*#?y%dl2R-~dw5|UGKQ|cuqubrd&rO$5
z>4u3Q*$w)1c8w1E91Eca@?dvB01JwoH67MJ8vUzCTfueeZUMc!L`X$`2%u-iE7xAf
zsV{v(vd~6zNtNI{2=A4-5|7CSj@=jSv%$)e49|@3$fGND=Et@f0n$<xED2^3E0FeM
z6!|15457t_YbL~^YiCO84wbk8^$si5d?|xvdtJ-vd!vEn438|=w1&OGF`g{*XgG34
zqvO%>V0e6d{38rj&RTUkN4>6X9`^0N^#>TN{;<qo9se+cB|}W)5PRI5eu|(sB&7_L
zgP@l<eIcJHRBnsoD=<{WJX#)p+detBz+BM51HC}goQ9o55eCbkfohUy!>E1NQk9al
z>yYL2W4Jhvc0nEqaTn$aZnBi!^P_lOPQid1snw`RSck?krrfASXEB&+HT3L)2F_f2
zK}1;I@k|$XiC{}#m(*pK4tl(l3k<@*qD?nU=oX!G(aE||tt{WI8CmA7TVf51WmTo*
z4l)tN%XDI+QbF;!ic;eReBz=gM~IX36h~(lYpTZ?(IhdX5c&~wfFc2kuH*!c_*$%Q
z$k5pr=9boZB|rks=9X5N*qKW(tHw0daHOgB9t~q9UqPcg$Frj7O1_+XeK8STq+E%J
zeui?*Y1U519XZ3{@OU_U!Qq`=kBP0G@LGQ@#j5@!#mW>d8?~%_DJIW0@7(}C(9T^1
zp9mD(M*X76_bgvqHknrWdrCs|x}%f6=^cBW&d?k=1O=)}FP9VTm(%1hM5}j5hap-$
zJ`9msXyPmdnbY6+)vK?XZ}NkoAa|f$Lb|Y#A%ZhQ8s>ZSE@pc)G$f8zX;GB$SDQoO
z_|XCitmB%rLjG#r()X+q{S;y7zP@hjW>QLwDAa{fU7-(HH1#hs^G{RCOukXqWea@e
z>4yML3CP>WT=@^>%4l6u4hLuS$M8MT0<Fnl9h&^$68&J9R1v33JSLsg{Onz@6c#yE
z9~J<fdpa@eW-g9*!iypTzn4Gu`7u`tedCVAg~#?PjQww-FiOpWl)P+7OWc+_bW4t1
zkvjiCv64?`%v(yy_ASZEW8DiJz#7{Y!y%%XWJ{9Dr%*t7Nnq=fe)~l<K{R=(TB6@I
z((ZH)W(f>O?JCTjX}Wgul$UaZcF!{pdq?Krq?RMBN-dCsy?)LPhRapLCz;c%g0{7t
ziT`E-|7HUJW&(eJ2`t19r{$M)!au5Va|<6)TU@2{){Y<6q&;F1X_aQY-tJH(Gh{|;
z$X@U7h+HaM;8Q{Yp_0W~4w89vV94e}b$l~|1Whi8Ec<wMc{RVfoK9M5PfB#Ol%_r+
zR%ZFioQTS5+`LJ1NM*X3&~wbKYV76tgn4NaW6~|~D273if#CrtEmY&Dcl@dM1xvEx
zEyDPv9E|iZ5nbnN@KZCZz1)Y+dSk?{O%zww0G;+kiJ-1XLWw_<x$o+t5A-3k1_5qu
zy{B(e5>hih*`P4(0|P%+M0WV-Y~~5&j2Eppx#>|Kn!?<0GcX?d+~<DzxLjp&yxvbs
zX5z||Dcyamlq1^fJ5dDqRS!(dKGaO;XXbD*Bz`(>Pu2buH&>a2>rL8+bToE{*NA>M
z%>oZD4wh~P(0zfnWfBXXxn-rU-3TMGWOD?x<Lls2H!eZ1m*%(pCJ=l;62$&(KqLX(
zAR?0uBM9f=A;ux&>9Te*_BIotO0%vqlZ4-Q1<{nIFfBKF@r!C?qMCUgy~On3)=YsK
zT?A$jiav^(kmeGp9PDf<zu8yyD~4Jc=v6_9`knr$8X7(!O)OfWHJKXuZWblQ1r}UM
z!`gMyOV&vm*@Mb*1wF4M$+N$o+l~jVHwIGZEkalIelk(KQyw$e;u9zolG6l=UB03v
z2u{z0;8sh{`X<NZD5$hteQegr)sN;kXe!en%dmIV@4xdS%yn@J6tlf}7CdPLAgCoe
zF4zH@5Kpgtro8^dqOV$-tWkQ=i^Hk4k&P^GSp#%K<Ky_V?zBF)U$gAgX}$tXD-IV}
z9{N?<QYe2{VYs;GO4ARW)7Y_;PIpM4mz6Hb6qhmAres&;s{NFeNmmH!)@o{IdsRHs
z#Xm8W%_ePiN9vKDOO|72pXyr{6q^?4Szlu>ehq;a?uBpX{WLKV`a)LGP^5lBhPazA
z?{>Qg4FYX(ciNMO%ywQ!?ux<=TG|nX9u%`BE3#BeXv(jet5oy}|5WVb3(RA&2ft(k
zRcoeRU>9{iQrE>}wUn{qvInYBY)g5bq_rbgp`|r5V5$3D;}@1CNxMbpq^0!kp(b>%
z>=9UXscE!+JUTiVxz5Q+r_;Ck!$IF3S!NBHRw-Qw;45$V#zdEn0`JoYG{#rb(i>@)
z=X1Ioc0RitUl<=$kNAi}01~aFzQ>`36^0zJsAmEWfa8NS=wPm6O*;*bxtWICJJXgm
zWA=WgzX;OgF#3+4(v>w5+F}eNw^sz;%5A8sQ&8qw2gk;p?>H{qg<{Yz-;7m6*OMA`
z4W<)(f|t)yFOY36(ux!Ml`nkf#E7OwpcfsVa?G$Ru;K&od?tdgTgfXH$8t~`%G-C$
zXVAI-#bVphx5YV`u5SSatcY`<O+h}kkH|gRa(N1D+ffqmjv>*_A#FzbOmL-Cze0y2
zQ=`MPjPHru1+$O>_rpi+W6H&%Jx+#ij=rC|1ATWg_9ADLmWZo3c!zY0L-<sb&mqey
zq~M(Hj=|=b8vXLVDEW1Loxmhufr3=G?4veYOm3jPTPF2WYY#IQu31LfwYqLK`PM-S
z+vCLNJH_cqxr`)WIjeAyvw)BE!45&1nWG3+5*MyQl_JB#t|Qxtmh}>+s7$;bk(DyP
z!hi;o*&T-^P#gW6y2-CiWZVR!T$(<bCMhZanLbf8LVDN8yg&j{pUN{M+Xcr|-T1c4
zjFp+ihP%;MnN6S+ib>P9kez*_+d32TThr3H8)4+lwf+wd=)48r(kXQ-YbV7?gmBFb
zB6u3s7qn76M~S@5<opi+0RR8&T+2@DKn&gU6#<qMsk|g43QK-~svCr=s!dR(HlUJ9
zu;AaBV|zT$v}x(GtIKUNkJ!oB=N!*mc)TiDD*H}GNGCzhSrggTY9s3W`D5j{X}qg=
zF|rsP>w1tY2g&QU#8-l0dp0$26(*kZR_ikIi~59xP&Xp!VmMTy={9}Q$Nz=!J3jU4
z)|8*SH`(?6$^9YH`+p?(8Rz-lVanlSYC1)dyZUOn5kYbBLi(mH%Bo3<Bnpxkx}Yw5
zqnZ%?B`9RT9c}_v*>=Y68ykwrleTr+pcyoU#*}cDi?1@cLd|^wZ#FB2qikHpLTn*7
zT*E#DOCX#db*yGfmLiDR7GdR=rD89NZDZM62dZt4g_exNb)^V(J|r@zqnYz2cQQ*g
z_ZT>ysv^2@z2eV7&p+Xa%^4^bGwd`n0l5<8Ns|U73pjPB3cn`oubeDURq`Xp{qz)D
z)9oC++z?FEC<Lbbr|CtgMf}E@_%4)4^7-v(_-M5sj_l_{p|`%Q%Xdz_@Rst`wOnSy
z%FAiSgX3TOJ;ADP8$&@m@7hY*iouk!B-R{Xuty_iei}qL79V7Bj>3-$fIJ3UX38m8
z3=5|$s0)AXs`r+&{_V}}-Sp<JUGI&0_BG%8d#m{lOUn^XkLvGH{XMF`2U34CgiR-{
z*OD*W)ZTQ52%`b)J;3uUC*SksdTIGnJ;jX>_ooRe*ta1?%gp13D=q(aa>4(OO?RPy
zH-4e}#+DlFn*>)y00?+z!VcpA0^<2ZH+2$}jjxZz6<sltq=HcsL}CKcHLA<+#>qiu
zLB4+QNLeoPp45PQTr+JRcsfBej;9k)wCQF78t2K5<8z(35-2?S*wjWe68gJMB*8^b
z3NjNPk(*@ZsgKk{US^JBaa6De`IVf^<DN_-o&(sztf}?A2l`dLb<4&e@k|%w#s7J1
zN7UB1;cgA@mUf}L*m)4JdTXM9l9B{ox|PT`i;z<T{{R30|NjCn6a@eP0RR8oU0ZMJ
zMi71uzhW!pNTJjemXhGmBehb0L7(~-8888bgQ<<vlScjTop1Ky+nPAW%}M%10(+U6
zz0K^*d~0QT&#5aoQD{Z|9mbJCwt`iQ=wVib`0%8G%10E~Ce|8aDK`yU@!!0X7&$a?
znyGb__62`M=6p~&q>CV-38HicKKl4nwVFdYpR3Ufc~+S|$TgW>-^_gN`K!0mivymw
zNpxCKQO9-U*pQ+*7XLW1g=*bdWDt&<mfxES;OK@pa#XA;>P4b6uc+x6O|+GOTLcnm
zMsFd5**lfNSf^UOP6o1-46eJ7fp&})mL#s(^2tfdi0UtoWR<dy5O?(lb9I0{UvCFF
z^VqIhY+YCEY$xH4NFAbMO*;?i1l*R7=fU9ACNg)NvMu>7x<P*xq}lHB46t2o^JbFB
zW>Oixvj`${ZX$(ihudS`%+ZmRLIbwivqZA2j9{gKC4y2sSpAl$(w=!bEs3{O-?gRY
z7LPmrVvMa(%2Ktn`F&l_{-}eVv&qx2YbC4Mx9i&Pu<O$ktaRhofKKCo_xPypfY4kx
z!D(9A_p0ywtBOX)>%#8e`Pj_dE^sE(dRCl6bSG=0H656)-<*Ihmue@3_+1fFSP9uF
z09&xm)qd7O@ckLzEM^PZr2<G?e!3KZrm9#orJOdFtx?J=dc#Sjbo81^Mk~vBA5g#F
zmz9l@D3lB!jmg_cL$;QNY$FXw;c83UI~eU(#Zgo_jXSBjA2-&{8%$8Fuu3!;P9S{H
zgf%`UhxGFISN%F;@8y8b`5Uq{?t-Q7-j*jjp`RTDwj8?A`xvfz*2IrwIS;h)*nG$e
z)!MRGrz$BQ`y$)~kJ~7IX*Hs7jS%|gI!3y9tCX6c)PH@4AWsf#6J{ojn2{fYnFb>x
zwT}LOVdkd~z>FdD9Zj=VFhH&FT{BGA;qWG$uB1Pm2BS0ZT@l`l5Bbp%UQ4L0t?^#V
zpeG8l-2vutCNQk0Ya<D46DN<$-k|(V8K|WvI3gn7ew^;TMY`P`m85c@vvM*85|Er+
zs|PZyxD8^AMOghbBsOowr{UK!Bx_GxTwbZ>4{>xK2VcD9msMYQOL6(L@FH>f%bWoW
zF0XJDr@=Ag=KF@yfde2`%e4)*Y)<-Zs%tUcsv&)$J}`MVK^(5i!`B{uHiMiU4gvag
z9WJClI|qJN0SjwfVG}V^%tUwy<9)dE^qWCtm$=i9E_f}|zaqV3H@*gwyZgE|Pk7+j
z5fCr~+V)^(&~KGrvyhO$6i0_d0B8lDpL;NY1zxl1c>>us+s6Pl4q(q8!oyJ<fb*|F
z!Z<Skp20@tjGyqJi<+E>gd0eaSbzr}7}mao1~eB>2Syeo;t>{~<f0x_+zYp%q5Knk
zNAn^|?>8EN@Ah`NyE7e|XQTKDmm+Rak4;%#p*OQ1B%V7W@lAM*7BON;|15B4-h<&J
zy&b1q<WUWwdE0MQmxzvAuf%#a*AJBxgY`aJc;3H)t@UJTlT-{)M^uWWDu+m$t-=W@
z2~zUE@kx^K+g!UR{KY^1@!RkE8`_i;Cb1k>2E85~hbyju=ncHY_b@kt*wc|hvw9PP
z8#%wYAfaWUi5%Mv--IqjM^Ctd7~Ngbu4Eey_D?Cl+(8W@a>yXQ@H$xofipeufUsoO
zR!qm}NQ=nGi4+8H+*g8pRv$LFp9oG(ujmC)6i^j7F36NowBlyK%i>o%3=1f`ewln*
zWzPQm@W}Z9{Kf_Gy-+F8{Fsr3tE%xv+jNuK1_O@A!^Ly3+=xHZFn+SZKH30_45FqH
ziFqCAUjP6A|Nrb=O>f&c5It*ug?h=xu;q1Px5(DbVRs#L4P=`I+Mq{+mgTNde?hXE
z1Zn>J^38B4l2RNeryhDTY>N~*8qN%<d2f)JkK{*CZWBPS(6&83zE$~`!q!TXAdx!2
z+?==E!uPaNJ3XKdLp~gBj~NL(GhO(wNIY`B)hn+oQ^QksHN!sXSvFTlJary)`;jbN
zFB@i`nzhmSb%Pq2QAfLPuF^@jtX9%C7?{`8n~6KBS5JZTbq@zIf`1zSb1}NQ{!|^U
z`5O87VMBP-r|&xCNAkdn)G;O%l|*mY@K<U7V<miFs(fbI>ZYn%o+imTRUQq%lM->1
zEXY+qTsprH1kQ5J$Dl*Sbw|>Lz7u|`N=ErBgIrMm^mXS{JMe!0tTT91Be3@}oSvp~
z|9J6X6bPMsyp~J+H|m{fOAMybg^oN>?0^Xxw27vbi#%<F)pY%DVpc^Bt1TMm4p%?R
z3h0G)_PHWWTpj?(0eD|Q(^1@M-g;Y1T@!e!@h!nVD@+t=6LN%aJ&_gVG(qy}3fwG6
zS4PI2-fqQuo0QqayPJ##C~Y=y0T`=&FJBOrnX~^WvCZ(J;#c_UC1EH``{U2Z$SulM
zCRB<h?JC`sgl{AxncZe7WyZoGbX)SsXcrt<{KFTlyC_J%<0@Y0s&uRGH_7$)uF5BP
zt%{zJlRZ)8?!V#Q%Q?xv=-!az&P~#Pu|2F6@Nb~2Hs7hyeAXonYcpsBKk~c5Ql7{E
zUR_>}KhVz<O&F6RAoDCwEF4p-YJL|lH=AuY&>f*tEA_@{lgtoY3d5x_k6VdiO>>SC
z>7~kWXuXmc>mUa7ta#wh+R;7H?FHx{iwg_vt!Jmn;+urPD?eI5?V&|(Gen~oS-&U_
zL)q{ppy@dnWgRZ%j~jfcwxC)~nOo-8gmU+8&jd&^V?0|5X7<gQ3OH8g7Ck=%E}7-8
zJG@o9%5--D6Id=Y9VDm<(JLwD5)LVI8yi)P*Swm6eCWVzaFNPQy!f(4Hn<Iuq+x)f
zd|Kq8u<P<WOniTFo-P&mCE1YGovOt$b|R9OxF!;@__acdOh=tsw+V85d<3@lla4n_
zs?c(8HoN`TZ`fO&opnxn^>QyxJVXngin2Vv5Q>TSi377CXlb9v^<CSr>FToi^3q-}
zDd7#x46hGyKrk8Sz4>e!RJ%QV?BCMis~~VsA`^_<{BD1a?_%HYx8m>L?F|}RXcY>Z
z939yv&2xMgh7qlnOt!W-ljsEj1+{`dkI1>AX5SrrE}e8ziNC^6pyvS!qI#N9Jj9KO
zjR3U*`8%%w8YYqrC$iR{KvX+0IboHAh)v<1^Y~({^-Si7la9r@%!aN(s&%%f3=kIp
zieFUi=Yff92ffZ|kIVQHQD#&8i5YOk2BM0g^;nzO=d0_>(VxgU|3Rjg)CWJn(5hi2
zat(!>gzTeOB;Ms}U6|6Yiy8K(DGoS*SJ2;~0i(_OR}@e+@!1^aoFX&Yx5D=;>Pttj
za)Qv{;z>|Cm|kV8bhWk9Tdb$$+{R;idC*s>m4W}ca;=aGdULWfx-s<q988)hRrmyO
za>sM6hBwVK_0>h2{E?<O<ufQv_HqX6&M_>ZP0G36f8msDc}K(?d{h^)J97j%9$7)+
zFLuwzx<AWX(DE=V)q~Tfa6mc)__?=<5>JUd|3idG!9}Aa$pgX#iWGPlp1QtuWOGf{
zppK&zYeF84G0W*U9K9LKLIBzb_||g$RX?A#zioLY<iqatXi$5rby>FbdPyz&*P-al
zftt?L@BMl2?2w9GRrfALvo~-dn!MRDSK1xYjO)Xy`8-RT>Q(#%Z2kmn{to~E|Nk1@
zuu0d8yRh%zq}g>|a9PM4AeIxl2;Tw*9`P<tF3Kz@0mdV2*BbbGX2?xDP$STG;+H^`
z#DivU5PJq8*P3%_L(8goP<sie2zrGE^wx981z@nvgm^Z7qR-uc?y?4zfW?XMiWuqI
ztVFb1vl0=bwBRGefK^<yVJym!0;u`{pZK5w_YLSEDWvuU=%Pm*1p^%CSYW?=D-m>6
z705N3NT&yafSaSI4|s>Ep@N1I%x)_M)m$Y_c%2HaKZ8MiOZ4&{RMS9KgTasZfi_Km
z9y5rA4+(<+W}u=3EWB9<9z_Hd%%Jm);YamAruD#AeWf5>7lvXf;)GMM8Ds_^o*={;
zf&c&j0RR8&UE5CEKoEWJS6E0yfkH%q&`T7g3Q&a*B~41(hf0wX8)`L)li04H{rS$B
zy{{AERH)*Cmq@Yqewm#a&z@szVqRyyLbnWqL6S2ZZpdqGK#DPAwWV;DlEgmgTnEGZ
zA!s~s``K$%&PS#6R6&lj!b<93l1AFsH3qyF3AVYq1nL)JhEU(gA{F!|xh>`j$*VM!
zMK+3K($AWEUeK-f`mS+5_c4h3^n9*Mg?HZRbgw>N^+|R(AMqSgKT){E0Q^7vev+Bb
ztW#_F7cWAmkrr#8^IV3T{#ni9=Vn_-=x1%BN=@=8{+zh5CG|p=w{w}G?hlT<2?Py_
zUZ{6dA;kMQ<>8mo4@C4uP-mLEV4>ufNbFYVDyy|(mk97VDE*W*$ysAk+AMV-ohW!!
zgM6(nFJdQ3_B6i0#}}^MZYWq80T7tw$w<ZDQ^T?pls@-jHybuYp?ac$DX{c_G&d^}
zn%R2?oLV$rY>~BS55aio&SV9cBtee|!&8qERf<TaY09w%99NK)BuntH+%5AgR>)k_
zT{i%&qNmzBUpnvHA#hH;RZNZLUNh)lRLo<aLG<YoI;va7j~bD=kj1NPWIC@aGfziH
z;p>~jL9-I`v|EK`%N`sYIJPW;A~XysLl)k6+>6hq>$B<lY`Q)P)0HNk_VeT0v$kma
zCyUpzVJld?njL4k5zMlQgEwh9lW>&$4h85PQ&Tw48iASxCFMcP#x7f_fNPZMu;u(6
zxPPUV(;sIV)m7^DB9!pOOPo2T^q`KQ#BIdQ>_}4^E#3(ljfO|mV`bXLr+uWeVa-vn
zZbw~|Sex!1hX%`ZS(3r(B&K6q9*GOLOSz2w(UMA061BX?Gw(q$UO8aeC%@*H>3nMq
zn{N5)v7z2nNK}k%NY--)(piZgR#8RGS}w$-4_WpI<^5>lO-*_cc3MmfSXA$<OBz`J
z<m#H#);7~)>mpd=3g@(^>CB)O4u7Pi-Xqe3BzBaJE$xeJKN4`4RKlD6!+ohFQNca&
z@YUO+=Am8mC1B7|z70rj6-HY1=_xWg?TKk+Q(qMHb1o5~7vzTaX=m+83Z(ch$piU;
zj036WKY`ng;^+`lB}4d`0#R1~@_qN>tV=CwHo12iu)0UahCH+p(loJ}M`lHg2orn!
zLntRpy=qC+T65|x2ORworO?Se4LOKF8I!+;w7_Qo&*u>&L;lOjw@#M~75*3n*{U`L
z)%}U(M~1Wrt@TuGS);v8wGRrU5VMw*3j31>1SSs|hY~$hM$uv8QG*AxtmNL9(!rC{
zs||2}z6<;g>0xSbMyR;GSp@SLaQ%nv%~A1vvf=6HIs;DH8G=7}0CtaMF75V^Q5U86
zj*EgnVXM`tKYUs4wXziEU(2U6j>j2XDm8vVw!z(S&-fVl;g;<K@<HnC?$t4`x1_@0
z<6m9R<WAro9}k!;(lfgi)J)AL^^!UI3jhHB|GZt@PuoBY|5qX;q;{kTq_JsK@UV}!
z38v9KA%tifP((>e($Z{G|M#7J_MLsXw1tQ5fu+gia-X)({@J$w+)O3O9ZbU*{&)sp
zezj*K5zrq)itWXiFEsb?Z?cXoEG0B%@fi?6Ho7>I?fI)4cj(p%Xm8xQX%%|L$Iq<?
z%O~@I`j#BH&dFly_{7?Y1kH)HK1ZjL`><nZWk0k0qFPqFPAwS(OjY|+Ka8~V!1NE3
z9PBdr9kunr@2x`UgVJw?s$IX!V8Ne8qZz1rJ0c!*4{G=EUJTML@`|3I{{ES6FoDxu
zOO^g3FA!$UWXd`UoF;}^?ZwGa8+Wjd25BdU5=N^TrZow)X;wj$D{DH@<!NaSEJhFm
zkgxguSZ|8-=#mjE7@27mKU<PLF6tl$BZpzG9cYZM3-a*E2A^0t8Eb=bJZMMn3=%>H
zi6Dmx(e6V*hq>gk!3S=`|I@ky!v{aGCpvtL%jF_u_+fZOF-C1}K2(Dzb?~Hmqylqr
z0D!;r+i~@VZms$2*HTiv@$J5v->r)7w#FjL$eN<DRQQwm&7tcNP~De_RHh2uYm@@e
zvWQm3aN=R)lg>QRQpTI{>oTitwq3l*ej#3?0l<9e@g5D%n>iMfZ?9wBYmmVmHFx95
z^yt_Iz){xG4!+P5%@zyFKt@c$aEJyZvj(yXV2k&saTy>_g9fF^<~|7)FS&Fc>)#w7
zHTU2bC(<hB_iEs<lui(<=Cj2~s_Y@JL3b7%{#_Fu&^amPvr!s~xG5m6hO##N__C0F
zX)zfjG?d8)RB}ZHu4@1v+lv?!t=-f^t<mBu48AfSI-`vylY9!Nk=g9GXa)GxTCa?Z
zd0AJ8Wn>t2wqf<c$2GBD+k`h1<r(yLvst-<RfnD@PdPvy>tqFOB}ZBCp9`Gz%6ZNy
znuJ4iZ<ar1^j1Ig6=bhiPh!#V!!8wghul8RP3%~{f##Yr6<iNhT^0Jp9z=5<Bj&dA
zp>%Z<&a7EgB@6_mr=SG!URO-yZ>a?!29>S5AT!l}IMgy`VRK-?uq>b%bXi6jGUj5<
z2R?5(qgA$>f%)R{0s*usFN@twZ1we#qvUCO+wHJj&C)q>($!r0#e@!~+eGn*Rp`W8
zg<fNHvtt#B1cC#h7#iFeoKLJ1k{KiTZ&~CGd(5*pWltNi^*VzP*BGDK2K|eMo<^Hp
zSuCp3neD!Ozxp;py!quXGok(*0`>Jn<MWU55nYE|GApZ!#g;%|fStA}tWUwM-QB()
z2y%fJVhg%)7|91wBG%JaDOM7akqtdHtR%aIk{}ZZiMc;~vxM^+K5IQ^Jd=f%;IS+3
zOJMTP3=|7MiGjm2<kmV2o1IxaSnCq@)Er9632T-lJ!c~<m{gWyL!ZrfmPN)H;<BQ~
zKmr68gAZ8`08z(uS>d2!-on{T?UHvrk1vM#=_w>KAdW*xWk7iXECv`0S0p{PMK&oW
z#5FOvpw0OlJwMXqa12rerfOa*Ng=mkcT~9kE5`m1NCEvuvwJlB0p^=m&j|A{I}8xu
zhtxKYVTo|KP6iavI7V$$6#`d;1}04e1H#nOo17&dMZRjEf2yPK@q1Bvi+%;jg&0cE
zLw`O^zFHvyEk`6P;3<rq=0_fSXb<Zv57!_q!b|2c8i*2rqg0U4L2p>IY;n`Z_N-d#
zOu1OG7bD7nMlDpFZG6RPZX!yV*oz(U+I_5Y(N|0Yy0xqS00030|D0V*4uUWcy$TzR
zEI^G56C*3a35W+Ef(cOsqePEyr=6)&Xf3+rlQMK39s1@seYG*X^fJ}$(YEJcb|On?
z|Dhj<5e;=<EL5L~M_(&-Fl(BstP6~D#5@a`I$TzeGg9-2J4q55eITJ}=3PLn>@V&{
zAHl*WDnuT}8%ym=Om39a3!f!YrIBdwr?!u3JU)V$TO)LC!biqljq2VzVXfj<Tv06l
z!u1<kVG)I0dVWaLEYGpR8b_|vs!sI}T+1bT>HSFMkBkhv9#T<-?9~aSuu>-iR;zd$
z44Z2kkb)cbiFbGl3~e_<+p$;|a2pXakkQitza_WLb2G7r{0QP&_{%(60llN`JoCEr
zn)~e=E5$FR(w_t)hS|9rKT;k~R@YK5^U4(H&V0(&g2_Wu@hns&6uVOB?_iCLM*^Z*
z6fu_d4FCZD|H5_R9smFU|NrcrT}#6-6o&sw83+yp+jTk%DhN*SQajm&jG?X<Lt$lC
zdf|UJZ`!oU$w^yRH>UP-U79vu&G~rFiQa<xGH?e#$|yz>Lb#B;#cEl7WNWh!(Mze_
zETC@PvWS^$?xvKfIajH$N!2(CL8{%gN;_M&(9T*YRGc!!n+<KP%Ax+yPi^jcuF(lM
z0}R{V%5+><^{p=CBz9UVTSn$jFK&2;?E>~SVs8VtEK44Fu9V%=+Z%M>_!`O_iXvXx
zo8nqLxtcu0<#mMD+OC<;EkKq^-Dd#H;;*J~<>EPthT)SRCQabVvU&}y9Qp$@NRUJT
zDp;=rD?6~V11meQ^1p(W+I4J5b1^sP7E-9fR`OuGzsqCRmeu>HzBK8#Z{nW6fa}~X
ztho_s8JvuQk&Rl0r)SX*pq9#*?7{%^d+*0E_s8SA{RTDn6O(KMLN;L^JK%Arz@xFx
zh~GW#J$iJ{X+=t^EBccws$xFdX6rFa&zU;=72qU{{HxMDsq!;Q`i$|BR(3MQ4_}vQ
znk;M!sT~%sQI@n(Y}@52w-v2|Vw=K5CyUQ%dRkh$<}tanLf1W}CVP-BJO|<G9rMFS
zUdD9fxSp%!d(`|%DpA6~pOIRN^(zgG=IWI`J5rvrRq=1H8Lgb7kk79mgyOVLgpwsh
zT;xe#=Xpd2z7}hZ_sI^~L8g6X`OAcq2^>#C{Dc)+>RK=Ilr{V(cJHN3K$-;)vvoY;
z>|B3_vF9fi$^XPw@+LlEi31=&Ys7|;g^?f1!^uLls_z|?;oYjKU+i7$bKAHP|7=bF
z2u!2Y(nX|6O4P%1&cu!{Zl<!GaonbDF5}??l-N+BPn2vY)BNw<U4SGgQa1g#w0F}F
zi6xN$!NqSE3+!v1{AJ%InW&-cYg5-}i6$OK(_zQ&k1kG5-@iRN*&o+!T^Z0`91IzB
z>-JY{iY+N$#NHl@R8Qa{k5;fj6_={s=H({k&cCgR9hDR7$%gOe+x|OnTffs^JX1z@
zbHBh}3JFr4(n0+GUhBU{kMvu%Jz1WIbaPJ{arG9FzKXMS)xoPH)?pY(XOpg3L{@bH
zg;Z;=r)=kA5z2LD4MaU#e{S@vv~4lQ)@q)F6D%Tthg9vg?4N5*Zn>HAe%@^hUN=A~
zwu^#cf(Cad2R^{b;fY)x)<k?ZX;oLN>=bf4uaM<iY1fy{YM$}_QAn$YxO+|CLuT$V
zllJ)e+Bj8v<?Pt0#CR>UtB_;af=^bU4AB7vy*KD8{=$*x;?f)`&LHJMco5Jon@%W_
zTaG9;Onwlpl4)`3l|4O~JJ2s0EA6ByW^#Wo(HOswbdaujQf4N)qynD$d($}dD9J_c
zL<(J#-lw>HRe5?PS)v;17R19<=%~d;s4h0u^0}YO35^~HoDLij67nS5Rn?Frr9+>)
z7W9W(D<9W(vyHg6T={>{)qgqYO5t5}B9PL6c9-f|Tvetq`1dQP7pn}-k;BThX0nfC
z;fr-Q2_>vSW{q26;%$eSdMYt8$%A`pEXEL0Y{U7qBr4FBnL$vbypl)AN^YwK*>D}K
z-~sf7oi5Dm#JS802`#U=Fd@!F4|#PW0vmvFE=(z8WERQ5mvOq$F79aWbkfK4`492R
zug<V!=T(O5C9<MelUrn->iHpO>cB~`iX6zoom^t80WWuX?PY6_;;C2mI&GDdk9Ov=
zJdhsCy<6)JcQ@4-UUyEiYI`}A9ke!NB^HIq5Ng6cTR7{gIJ7Ug>{j^!J`MdcNC-NP
zQaZxlf~&JlPT}hZI!LLs`==p%w+7*@vb*HN9VIQZG-DO+lJY63KjIx;k+$L$x$pbJ
zRX2$oDiJUC!*a$Y$)tBKiVyPWO%y~Z>CZ{nrTQoeB7v<`)Cs>}M^>k4iQItK(zoF9
zQkczhA)2%|Ic?gR)8^V6mmM{;8*=AN#!5P+>Kj$$mRTrXQmKp*V$_Vk@;1nPn2WL=
zcs=EFl0Xy!SMBrvYqL@+iqhzb9)3_w1;{Q>C7+D?eDX*JAxi_2HC8GF)^sVZ$1rAr
zVGgsnN`YoM`vmHgbk)%A-T`d$p}@BE(Y=9<T)S3x5hOp>DV25U(oK%^=1@0{H6UBs
zvp)e|&HLgNS`O@7zjzY38Tz24<vj>&>yGFT7HYj3bD!CEaB;s#7Zft{6n+6Lp>;?7
zZQVP$2%~w?eu!wI@U^6nRk>7cDUGMv1RnxhHH2<~(cM}^u1OTdU@>gUGS<>xS11+*
zvi$%OPigS2azJ<BGRMiIV}aK8U9~`4Ve<YXY!c-QKKI+V#1Cb7>=ekd!BzM+tXBv9
zRN}n|kqXSGWnU7^%5lZh%~cx7mT!=LBe3im_lITIxCbn)4nE^M!qU>a|1+q>u{;=*
zUEQbwO2x&Y?s;9Ukc8j#QQf96h3}Wbr|c?LBV$c@0ym_nxg{NmVnwW-T?D(#Qva-H
zOCf`KF+ED2nWvnL<i3eWzGZ5LdZxEI>C0M#NgiEN8B+3e;UscWFAkx{v(tYlLoC>w
z4CSC0Pv&OfJe<M)1*t^mW_aedz&HaC%WH9j&#1BoXEIv?v+Nq7Dh<HsEL^hwh#Ssu
z;CVgI9vHmq4lHxn9a(|b<%3?=wO!wb-G$ZIUoEFG$jLWRya=5+`@msX3-)7hO&?w@
zxDPs*4&A<N98!*UJY!t3V`l-Hv1RO<=B_mm5hE`Qkm?O8v2_@GE42HPM|Tk3Fiqo_
zR-bE_t3ksuYab8($)3S3&a^*KlZIH{rhI`1<sp_XmU&skD_MTuacw{7y8VI8M}5xi
z;lSa2XXsfTH;kUwcTLwBwHw8No!6A!U>r}Fn}3$kH@0bbPS5fzSJ#J*6O4kPW&3G_
z4hG>U?PVBF{vG3P%uW~MZY+bsZjcO`(bWu#ty8p`qyUXAl@Kqse!!X}D<|5)9TKKU
zSn`{YwO-4h{!o;Qql60~ZuQ%{8L^>tiOf26dF*`VA}s*>m|pqBTI0hv<Nc%eS`@l^
z5<^e#ImQERwcJ%0`C2lC3)+-Nut$T7SdgK)-iB@$$;tExww=3d9De54A#B0%)hZt5
ziASCB8E8ymc*&Q<=a<RO&9Hyb@9jh}EK--zQl|)k7CdPt+Q35)9_Z_pW~lJ6)XEk}
zle3GzQ|pVP@#(?E;r@BCYs_%617EIofM~0mov=IX-}xXa0k1xa(Sx9A&8I-`Q>Xr8
z!ln9{{qeg$@2@>5gju}8Zgy}=DfFs>#-evTcGEsY9qnsJ0HMJIJ}u1}*2E`prNpOU
z*@I6-&U$+Sf^s|to{*m;S9RTP;G34|TDr~$1JAYm9=D2Im9`K(m3||R>h(K);3@cH
zQhiM&<OyUtg8wzWB_kUzl^ajvM?}n3lI0)~Tmqs|7Uqlt2GSNocoI4)0}<ng3+^q`
zSYjth_zd`GK~@ufL(<ky<BY?kk@<5hITdMyo*OT=OKi6-7r?_XAy>l4`TB+7MdV)`
zo#bu|Se`l<w;a3wf*yqlCrr|!^O+6D_d|RfY$srq05Pz{BJT^IQzauMpNkj=P+$c_
zJNs#Tc1jd;^7<yeMrAiAQS3r*aS)I*KaH|=bb8+Iur!lKoKQetLgm&oUqx7guu2LH
z8OAtSI5QT-j?k_tq>JU$xCC``8eh-1CD|xV7h-lhyCSSkLdGD0&`OH**`8p0+U0Va
zwSJfbv1JeM629_d?OenRL<yigN*Ppd%P6@-r7kSQ=*|?!!bTt76fvwwMpyYFkvtkW
zrtR9Wn(Dgg4NcoLyY8rnWTlY+v+@I#U>*{l@sEjBFIdi`Sn0UgnmWleS$+X}$t&$f
zdXKhPM*ilz&{7{D0H3k9fxuWUuM&c=F93*)<BPgo+E=P_8br=SRN2AiMX65o!{Tf(
z`}t^<5?TmHc`T3pzy<7tbmv)&IW`apVZeW3t!69biFW4;$5^AaXTjU$QVQc=@SOlg
z&(IfS=1`UqQkcY+h+m-@Ai&vYAY?%?<u||)0>A*A0z1L-1pN?05h||Y&uLbiW{Y-0
z)TxFYbudVX>iuAFiHJuOQ8DO@g8eL0_%_XyO{K6V7K+gpA?zHn2!#c0cd0364Ctl=
zz6DZCqJ}<8=<$&`>T$d01-d>649<h0G3uA0C)(u56W<Yd_Hft%rA+*RA7Jf%d-4}O
zZZl01NfVnNoQa9&iD@`B;YP8ZWk_Q`Q%&I}kQ(${?Lcd`UcK3cR?lGq_nx<Ly<yq`
zkTh9oK>5qyre2$73uT8kb1pR`Y}$whf_0c?d=FYQammCC58+L_+)J~CzqK_PU5kBa
z^k8K%RP>grVf;*0aW}P)n$Del(8$L?JT#%R-41-|G+PVUTTKaI?Y4Na{FlALW#VTZ
z$ja?~lotkj(I@ediw)ABU{?kll`MT2g!tqvmPo+_MaTH<fxL|*2i${Sw8?x0AKQrJ
zBTR`Re@71$P#!by6y&%W014S3TO5J^NTkD$36BE3Q5+8PFlQGR*yY8{3Fi&1N+ihu
zXA(%2@~EM05E@$Pak<FQq!@h0-YqzhQdl0uf{J`d!-6e^?x@)-k#|Wo!}sG!99?me
zI;Y3SrzfD&&D=Oj(gT=lE~HIrx`=!jNGb)wye2yRj@@A9JG@m$gyJBa2-o2+Y3(vn
zZ~)&|bdU{07ef$SY??+7+1SLKWJAHnxFd?^DW~Py_byxmAtow!COe?%T&|XyypAh2
zfHVx|NMTt^830<itBu9VIV{cWC2PLYF>%2*Y(C%p_59+^>DlrAd8^a_7Iz9R(YDG0
zrYuPS@vx++-&LkVMtn#w*scZ#Bab4J-Y_rEuE4YyUlo8sn9}4KBh#*!_3}?9HTpM0
z>S=SP1+4jFMjN<7Yo3;*KNQ6K$xk2NgH*;psZbyI{XTGXzo+XXHyC=RF|yW#I^8bh
zIejD$SfmnLLXa1;ow}=uSn4H){WSVr1jV4LMs?{wS^%NZCw9J)Dx$l9)o_mac-?S9
zOayx=c_ZvanaDRm`#w!9la#C>oHI%y%20BVF+a66qsf@s(_SHKuU@AVtYqBen9|zg
zxnU5^*CO<vd;nyI)sJFhT;o8Y!T!)-f6J0HST+dK!gN&Zo!p8a)5IJ-(;m2%?b)!2
z=?#1Ka9{>@ajGgBi;1haKr+3H(+K~YCeEW&mA3u^00960va(h14EDFMFtyY*gtGvw
zU0rX2Fcf`uzrtiow#1JpAmX0poDXK37&Eg+0~Hpt4HrKW_wRQAUqGP0&uu|r#X$6>
zV!3UBp7!2zo8B79m6=>w$yJANEHzH`wLfSKhU2$s|7AFvx|3n`*&R8J=`0cM4J(y{
z{9w}Uwm5BbYH(_DYNd_In6Mm8+jTyk?Qt}InvdQ0glK)>g^SyMr|iDC5)!$G`XW8S
zJErzkwn1<1lmMnGOlN3_DyNw&_F7=lpu4Hg*Ev;uU9ReW!?vkm$M<^8rfK#Z5qf?r
z!(nx$W&i8$@Hp;vcp%e{<hC(kh4C1GQo@@lK6%-kbS~(i3$})Dy!a)9Xen3^fuM4X
z(#<!Ix+po&=Ujf9p|%gpZSbubY_$t8+Y6A|bNK9m$zIiRsO-a!L_<thDJPUUik?zN
z`U54B>7YR+{6l^jX@yoHymmKi2PWy2b_jp3MdTrk)-tuKfI}rp0Nq9lh6<<jSDBah
zGQ>{}{nr2I)w()}0mv&+L@*%H<wsONl)Cq1r48kaJ95QkbMjlcMws-STF+Qv=K&$=
z3oiR`7YQ}4VQWem!hXyy<5Q!9J$(4Vf?2A&L--|d-C(r_x8`_%8w7*pT7<X8OdQ<;
z%{%sS3E4JAiC0Be@T<$mpU<gVBBK}%HQrFagm64(3Zvs#y^g(THl4t;Ow)8MyBG>J
zm7WHnrU0v0K+w)bV8(l!1HTheDeUFTrGS?eD~!5-^<T?XB<z4u&&zHNvd!ee8eOh5
zx}pxSptSdO<Q)pPYGX6bk6$M46gI^E00030|IA%ka~n4jex`oKlv8#niyUF@0kf(^
z(Xm#d$SRU4KkRPJVlHZ8iezzU$xh|RZ+8QjgQO`+-iPQ#BnQCYXmo#lppj1J7*STp
zB#LN8A;o6*G;Jldtv3C5=VOh)ELZT{^*mr|!U|oM<hf&QC#S8=v<YZy5hNM1l7u^%
z)|zW!2iMwBa)WJsz3c|xS}*!6#<lUDzZV&8>!S8!hOv_f;aV|I;?VXzD+_GFk}wd$
z^8<?~mg6$UvdWM7%lvL;oC`o0#_4PVT`~TViigY;^yQ~G12{IzR<$$pH_#R?vlw#)
z*lgff15bG~`^?kc%)7-x42;X-b9J!^zzAjSAiNd<daa$9IJtm`0EbOWim1jw5==;n
z>J6UyuTri{i!_=*KvP@JbwB~?WcW_$w!kcF)AZP;kQqc+Du3EQ_HDIVl!N1Ac{MvG
zuA?kwpcVdEOsB9z0F6ZO%}gf6k41Vy%{2Q8i-U5gq=ajLg8;?c*9p|3bQ+O$36J9}
zE6JvF(+$Vh=h0|<IvgLUqs1Wq0O>U@5J5P$K3CeRA`{Txi!>w8gn>v7YF{FmQAP%o
znU8f_$|Zh&jqg1BHM+PtS7%-n?t^t<pDmvmlj1=I2$terdJiPBrquo_bP%&K!a&+%
zH0#MZHAtlZRM<!<CsugZJ-R<A*$(s{PtUX$gQ}%wn#G_~(|X8Ig5x}cI_BbT@#Es-
z<Ya=g@<uF^yAxdQHvsxiKy!8b93vO*7blh*2EM~>=Dk^p#}l@fqufhvCR{Esd^q>A
zJP@f!xRZJS5<Q;#aS#h;G4DB!^4d9WnrWD&cIKv>y}(f(w*2IlXKdNAxMk&bog|6Q
z%O`#1wW}2;>^PnF?_n{J=I)GclPu6JE{PEx)HRusyBskT?8W&qZ4!mL*=Y+wRG!mk
zc=l`0sr2k`6^@&Oh`;_!dsiKv1aS=NyJ-et5OXj0)-}_wx6zh~o6pH(#mL-*|16Aa
zFtTYLsUjHQgZfc~j<rP<;)gsRiY$z`Q+ZYz)xzr3G}-n+aH#EjIy`$9U7tp`*W-(u
z@x_pMT?FeKfn26os_kVl2C7x`bFo4l6(cayKM+$lDFFG!1Xu!PFhC~qDCF78b!M~{
zZ_{j}o6P4Q3-U`GVJw<H|J?0%<*9sK0Mo4y<H4x319@eel!i^yIx!q=GHJ_JvyvQV
zHIw~sMTq1lm3gn*ZT>*@idEUVHbIvro~?A-@5^RAIcQvMmsx0!I&zsO9Sx$qH@Y4D
zhgKs@y(S(qodu_PkoEP_!TW+$$yXiB*x7jvePKO#^zYfLx|O=ceuoau0wRhPc9_l|
zDHk5?Mzs@FyHNa92TcXj&h_~F^~Hm?SX{k^N>0<q&Tz9_7s?$%VVlXqRJL3_c3zi@
z9_!+R!$xoW8{^L?X$z7O9$-_(6;V=>Qt76wBt*j@iIm?_hBtI)QH_~FJ~3koB9G#E
zmJ_mVRs%Mg14a_~SS%vUYt|mE21zUoIb%-Z2RTpd+ynOS1a@d8ZtNva910%#R_^*0
zNcs)0&AD8DL8l}Jdp(Fn0qko6eVETBv(@lu^l3)1UKVf|Z(!L2+tTnT(C|ni>j6O-
zouZNCCZQx)<wdgi5+!#ZiS~6&MyV5#s9Sb!ug;EduP$m4_W=<kiAcJoMpjePjP6R`
zw54WzC(!?br=Qw4pGXWb*Y9b(q$iPqI!LT+#v8p=$5?SJs~$C`fCCx*(I|@NfuJU|
z+H{$Z-klCF5SSohtjgmpITRV5D|91^^$fbisHhvnNh*u`0y7`fmINwA{Zrj*;FL<7
zf^b?}+pUXRRn&hQAy|!RFh@qWH7_7S&-6glAP(Be(W;q%i81%WEP0$co|ng|#RDhx
zGn;$9#X>iBGLgk@oM$}sEKfWKv(z}nG!vVPfC&-U{};@%&m<ph3vGMuydHJdXS0Dt
zo`s$ekGupu?NaL7qltGuR*RAYH?n<}`I%|v+_G(Md4a!Esc$#4RjF?mp{3*GH07k$
z1Dt54Eryzyin#vq6^Oik`DL~epUt~hFjf8UiX46MIOQ01E5B%3M|l7$O65RbDIc%|
z5R|uDZc}q)O4eVM7QL!89_z!jt}Bce`9!WT6<#Cjs4*Ea#(b*O?GcVJ%JHBR8NjF0
z%HCf|13M5gOSxx-f$OJv>~YuzvG8~*vOM9Tl_nO;obV;m0F`Bm{AC7n2W~L%d@T)J
zEe$}GEIvmi-uzmL1R!dO7g2K*zN>?O?VuU_i|7ZR_A#|Zk>i1SKv|hBbH8MCY*I4d
z7|#!@Y*Mm$z@7^g8+)LW`KcEdf0EdR*{&olXq9xpa#k5FWLXKGpfHL9%J^O>j{V7U
z{#f?Y`6DLufL()L61;_u(#?F*cVsq-!f;`Gp;kW!&>-hVNCktC9HrZr@5S*n809dN
zcHw^f1(pXCPGbzv4%g-$zLcvl++gQBcx##_P98gs<N5#(I1d62q+zEC^B4zW$Q)S0
zlv~f?tu;S2O;9qO5QDIt7w}f{gx1Uz2y1WV+N7afLAXSUg_#)tiXtShDEbd2N4dG6
zFl2;fP(PAb5jUawC>I5^M`DXm_G$)DVPz;b`Oo3|52NV({f8Uci>+UOzcoO)B!?U{
zKw`g?WI$0Tn(ruv(bfGrg#EHCR~t-zFPYxr?=KWLdpQfL`HY_|q8$UN$XViLIZ9&g
z3y}a~P4{yQR88%62UNw#2>^73ZUFcfO7^dGyV33GhnwhPID9|s0O8=I0dq&*u9pA<
zmsDXQ5ty@l*3%?WeL$vyUodK^#1DwhDfG-hCN0_4bL#f!UaTG+s@c^8B+93IarD(*
zJYB!h6XQFI>@mJ=N{p&ATV|wP8sDg5T2TaVZnehp(4+2pFCy&5p`m{VwY>EJ>SxpS
zhJU{$8^Vb4HIaBiQ$blXbP_j@$8th34PsyO`!=W7mW0h07=Qg$!Gn6cH)eLP(I9PX
zcAw_u=o{yyo_M1|5;=3cBup6qbKA>A?kC&{0y}qDC~^TPBFP*p%j-i#qp5fh#?Jx}
z%lrYjlo`v9Kb7LX{4|@ij}cui3j!041sd$Y<pbN(=ZI_#Ch}FO4DS?<NB6>DJOeQ;
zc!*}G3QUB&0Vb|MOdF2fk12lOp;*pm6hB1jV|00SeG$FCyu?&xKVOYUC%!9n!YBeh
zcs0B@8_Oj<kT+`H$Fy{^ax{Ji6K_oD7Lrv~N*p2cW}X3;O0#4tR5ty+v>%v9?pq*+
zy)<!y1XP|(1b$$#)a6+q+|Y?V=7{(?61tYkrWtyvpC`V>zg_!*#adhDudZ`bM&r`Z
z`IY%GtQx8tYVk+}FQ#}}vN82)p7r<WX8f)t6!(P*4I?bUgeSuD>X1B8PO{8O;HwCq
z4$tEhsmoPZS2G69w6G5^3D`qPvR}wv|L+vCXFMxp?`YpK9)05&Wql;Wr?|<}VT785
z<LaX#pO_~(>^e8&rYT~}^ZbCZHHURoMFk4#uTp1qq|)k0XY}QG)Op+36|`s2q1r=c
zf>*Dj#j9KyZ^_c$lQvc~%y!=%cI6{zgL17wk+mNV4|_5kR<c<TNZ9n@4+pBq=Bxh)
z00960yd7y*8%Of9_!YBG_6348%&D0nPF^q;UN(SPFqn0opWd8E&PXCUIK0{azIAlZ
zsSy&pS${AvU42(qSJ#OuI_MgTmG5`jq7r_DN*(C7rBrLcdddpztY;c*Rv&4AB&k1a
z?N*w>lfO|@Kj57zxfXdPVtshArO^}+i(%!THLw(Ie+3Nwp52CyWgA8el-aj@({nY?
zH{8UsbVrXJJu<s~7arPyoxiI;rhYUW4X4WARd`sA6?_kz`0&f?6#jqs^7HKo9`fZo
z@zS3w2X|8iu*TRoy?xD-SE6l-EAf!R>0}Q`;X0M+4CqiwH8rW(@8-&BAK3e|gZ}Bk
zjk3-3&@|nh{BnXrL9wRhPj{0%`V@&Wc=}r$wZic{J=7e{j!iqTB6tE?x)<rX<HIX6
z>V{pzF?COs&M~O<r<!6Q+l7Jb;5+*vMjxD+&@AM)w2Z+|l}`^&PB7d>HibFIM?!CV
ztc;cmV>Dwdm<);xHB|p$IwA3i$ReNR(oySz&|kB~`CJi@vc<w4|4@Pc95QW0tOMp1
zC|iHzKN2M=OtMKZ3asX2N~EXM0t$*Z(aL7`x~iIn9su#tJ^clDyjQs6Ex2Hn9C=Ha
zy9{;3HUEtwmW^GQU$j^yY3HgXDzE|@FeF8802z{sfpBTaWW-zgBG%k;UEA?YPqS6k
ziZ!R(HQhj~8U~kZN~7TNS5m%t8XEQQil6W)bE4ss%kfMRWBY95%Su%eRFMI67GA!v
zko#MO^ad=`qTB+VR&6OoIYupL)%GVVE2mQt@%HImM}wufvx_nQP`3U1&QGJoJbr|F
zl6FRk;YEQ4=hLv@8V{4u(;Xm|z;;-`b44*6Twqnbm&hbP!oepE6}%qIecRhN>l&((
zOp?tdMX==&#)G975h7zJVF4a1Y9y}M=I17@6zPVTe=F66$HeqWD7LV_!T`u+or0nw
zqLYElE$OFbO0*y$Fe<kswW4$;lYr9ivY;~_P2d#)%b+BFL2Zn#I^6!j`7yf`2{SF6
ztqeQ?=Sl~3x{dQFuGB0)b8zI?Q#!dFhENCZ7wkPIE$8AcC7~-;N2w>R1Z*yap2cxL
z_~~y__&RE{rzV-P!bsB;t`|%Zs+Q%w#ks;k4`<4+`e)M2@dI1x?qt@Le2_zw(n_%^
zMVI|Z-c+O5AJ1~5p@#_%SlK3%p9PSVF&bFK>`G2?o8w2m-)OE8hR!>iD40kJE)h`!
z_JO&C8BUpzr!bYH#T3QGZL;pgL@}B1Z*dZG7Yc%D93<H`ZLxbcr<-A0{V}-#B=Bs&
z$y$5vFT*#i9sH7hL0?yQPdDT@5?9Z7NN*N%b~`&k*_fEg3?mQxhA~L)W;FG?yKqOj
z1^m3j&C|Qs(l!=gRcZ$_f0vuczzqw)cM2<T63@SbE1!eeU|bi4SS&spB?L5S%p41p
z<K)aU%eM@D5P5lr(2`3*d*=m;+ldA-QcWk5QDFeMWkN3t%m^#z<HsSVuAY!b#MGY+
zU~_wz4b?{-D`GUgafD}oJf19W2RI%;>f2jkoFI(i_P1(Tk-mpzx&QUE@}u%E<<%aX
z(!F%{ibES=i04uYh@1j!Q|O~=1^GWV*_P3Lvf1IOkk(}dz24r0EY9)Z;O9<PHB}9N
zgY&X?N%ZJY92j*lAEoO>TG12DGD26gT+@#9!~u@ijkRt96xs}Z)An`O0EkV*5jlIJ
zs)6bFnr#Js{6Aq;Hq{p(IbTa(fWk8R{gH(K>?}h2LqaoXq=>}96JvHkP_Zd1B^Z>9
zmHLy!@wo_IRpDNC6T|ic`_B`{!>*G(nJy(H*}77kranAi6^hryFH}BRXgSkn28Zms
z$k~aO8~78SElH5T0MQ|G%CgryLsqs;m?sPVz)<osKbA1#LZdBPH)LE^X|w8MdM$s3
zfmai_RQdLhL5qt~MP%2-J4pn|U_l3(mK~3o6tiv0tSu}($on>P-jF>KRb}(pMV7CP
z=_SX^dNuQt_?5gL#O+!fleo1bltsUZXXt1}f=xLtGCblbJ&+xwAI=xVX5cL^7=}mz
zW{z@m4&o;=qQi$=7QirH+Fe*%)1YvEhQ;JcEPpOr#&G&4$M4Qi3cj6HZ7c6iF5YiP
zX`cpzGH9;Pd&BGcBO1J*RiU7md83s3L`XbN56=7N7suBJA9~6k3jTF)_Wtajr|+*W
z#or_nZzBnzNMMpH^)xeZ9JrhVAZ>AM*tQYE5pWFC^b*t5JUuo;C$KWE^lvIW<xdvM
z>%o^)1=^C%mc8LW02fC}a(sz3Fr<%ew}U2A$0Kxy!&}WC!<Bi55-I5`&vvNN-ckq)
z`~LkS;A|h?1{pzf3;gN(v2yv_Q;H7!96qi6Tr<KtA2AI2r%IU$o%E54tK7poj6!d7
zU^$s-fD9T_|B0g*7oXGc@*uaozdnven$n@4PF|nnpP6((#MI%wo2pbBeiBem>o>f-
z%2pNZs{s322V?fCzFB_yfFaA-@=q9^Bhxz{Oo^kQg(Ashb(I@>!;A{yLZ&oq%M9++
zSbbpy^H^O2>2irL4dT$z%yOz6o?oGV3+2UmLP4uQ7&dm0>4@1`lWg4CU16hHHEg?h
z-|tsY<zX;M8yCL5rE6`~{{>Z6pejFcI5zvFdMKMkPuXd1w9Sjs4iNFt-2^#5QtK}{
z-*B*Z$_y(Tbn%Ly3b9_PXu~8PB=X;~E@rd1e;+@pn~Zj_?r4t+Xoe;k&-MSTicPl@
zHx6tqjD5$Cbl(cYIE=fo=D9|YSVlKO>aT6W)8>4vs=AirC4ujT)=P|Fj51T}DA`p5
zcg<vc`(?OL)5XvD2u|zDHQW8X%+_!NJlSn+j2*kJm3#8+cm}J-v&sHf`0Y&<gZLg;
zW#w31$KV-&%uge7k}z>1G<wmku&evN?XI+RtTwdN*0BmiE{qPD@WT&}?OkL@9HH5`
z?j3FqcYs#{I{D2v!@OY0y0)6xg{{ttdboA1)vU(yeuaZbYsoj+Z^2Zvf<>>OY(dtU
zOS*>fHkOI;)XPQJSsAQd{`=|sYZ0W-Zd(|n&}`eh;!=r(Ah6K)qse{r`=Y)T>#n%K
z?%Xfs#Y^72bn9dN;5j_ZbfAWl_*&O<ETD-|U|6Bv^}`LYey|SK3w@~p4@wW?;&>c@
zwP}suYH59={PXlw2o~9k9vJKenO(NdF=ySyb+7;C>}~&|_wEwj6TPG38z}nnbrtPF
zb0jjz0VL^P9)Id#sNk-J);P7#dY49lrof+IBpI{N7H$Cmo{ta(U!U^7DD5;=7bAx9
zRKf5n^FCDSGuR&r{teZ%zHalkowoAVsjj0*aX7kzDy15-u+yU0Su1&(+`Z*%JVhxW
zY8_42!ajkoOQ?}?JVY^MVIpHO-Qq-e61$~N8(2SBluw0iTW8NYtuN`yJ=<-4xn1!l
zqGdjRh7nx48iw7?Rs$RP^df|do5ogIu@`RB?uOe`RHw6n#no5{Yk?7v2>us>BT6S<
z*MX@8dgwV}n8c0|1DB<Ro*e}6%66>4?sl~xv`sH}-9Cs0@rZ@|pZsy0roQsp&%UW&
z`P<Ja1_`a`fbhvpYI7aElr(o=Gvt%oEa`waDsBi5qA^>elY7q8zf)3JKawh8AQ?*C
zHXBsjr1>!<0=1z>4)PbI-WXDJ8nmN5es|e>cdej_J{pIkRFH#Zvj0%l^#D&W8VHZM
zd+|5CyGUNkZw97)9TKTw_&#-+=MK$luQ2NJ9EE>C){$0d<dE3q4zkNAn75KRHqAuc
zL<60%y{c+?T|?8fz;a%|0y`xR81``)Iy{RH>~pjEiWE7>HJI-b_gIzF)_R92*S<+_
z7%vQ6Sh2uXRmV&mKQ{G{ZcE3u#q!nb@-o)HlS0`cb+RMkOJNb_rvCO{95b-bF$4cy
zuH3;CBg%B7bf$^&Eq;lHQ~rfYM!#i$!!Kx?Mho{{I2cVL#c`ahY!3(tyzhUY#*%5h
zvF{XJF%%Py>DI2;knJo@Nn?8=Q)ok*BE~+ANp7;H{O#&oIX?TK{Nw8QgYuzwaf;hU
zp$&Bm;3qr4v#W~&qgr4vcderp<gTlWNStsfk*4WeJmnM@FvcuLKuX|_PKF$oOn?9l
zK+Rt#{yhWfte$FT<y2XUi-Uc2kfzG}U({DP=yY<+Oe=LSNiaM*5_0!QV%@bZ-!uYU
z_q@<DOh=1-V9g9Ij)P=F0Vf*nBDFQ}HM6gonUzvmz)9ic@xn^tY5#1}zy8#_cz<<%
z-n+o%Ik>)o%NBp1DgHh5k(v8&=mlBKQtALMB$-Q|&651_lX4To85Z$%CsWpH%4p$3
zR<fgVkHF3c!vZKJS;K~z_d<yn>_?o+Kx#!RDr#rxG?3!U#!1vq!mTzLA1$k}C8SbI
z=Z+1qO_R99rLLOHCt3L^JL9Rrcht}>o8B`no_pclqLaivJ1~W4WdeL5eC*4QoD87U
z!bUr(uG{&b1V|h$j)NOLKZ0?b#SiK#px#9(>%a=g!?)`~zWKN=<n>82BoX=Qbk>Aj
zHLEJ@s(DpmSIw*nyJ~L0ajr3|9BS2ka;Q}^$)Q%wA%|Kr`sbvCI&h?6V0ls8ja(!0
z&|@wPBHQ=1(6&9pvNa=!+>H$JbGArTqtNm~#|_-@B{@c{5|4yA9M+K%zU<)dwl+NO
zD?1ucQjvzET`Q`fO0B$tB(?Gideq7*hymr#9MmNc^)WtkD3?Ig$N9_w1c=6CS1PNI
zuJMSK%IYI(JWd6c`K8=CyDV<btv89Ss>mIzC=`cN4;|g|Etm+rU-U=|V#C$#MsZcO
zk(#Kg3P8u#^pJhTAIv^hk6ac-r}Xjr(y64y%4|KgN88yKAINs$mocjSXUd6BfmqSV
ziQ~0j4%7R13Y`DElqp3dnd*oZid}Vn62JY**oe-~{bj`9Ge$}I<3|!YH3I!m8+f>1
z`H<{$^iYHHWEh4e-Yzd(r`EHR0etQs`LlWdYD^LN;;4Tz@uSZ)uHu9m0C7%v@<(<X
zEK<eAc=$V8a!S^01xuLcuv@_x=7}TGq8GT;{!#DX!_`IavX6h9!<|-`bUSMYqY<@U
zxVgKP#aO<(yYlwM3}-Su$mL~Ep@e7@-dDMcVfp4y96EZbWG<bQSiIvzxp~+7@a7uL
z0w+_z>)zoF$xxfy0PN08fYw6kt6AJMmd|UFn8B*UFW>l{ooGpzBrcE`BaU5P^G#b@
zlf(?3BQgBy?^3`n_@CYBGi5{J-ZNUQZC!c&TCsPQmIJ;VNf5o;2=n$I62{rdbraRA
zUBDRKMws4(glTT)@U4V#8)4pj6fmaN2y=Y`Fbe|GiI4)W-W*<N$`P+3<(?1}u{7-)
zDJahtW`{|Y$)w5>@e9zbDxQvo{n}C@)$e0w(=s*VER(tFsC4_oesLNIJmJT0`^RT*
zdpCWj37ocX!wRsMOKa>l);K@fv<B?+hBaW<H>?3Tuwf0rh_%<McX4{T!CqW^INbpH
z==5MIw9a^DTZCs_>wk)8f~Nxvi-X7dccuhQMSwI^w!5V4{HVDM5TUUQw!E<nHn*`1
zwsFZgdBf`8X=m!6X$#`;F%PHKjU3O_+@zcMNms)Z5Wa&M>>PLydcJGuUBj`%@V}Fq
zS^K)ZTxy1S7IAw-5FrfWL7`2nHbj}Tn%7-z|Hq3(vF-O}bBen<X5=9^g)Cf=>}ljb
zl^j%Zt1&>RU{bIhL#x<$ig|7nxa$`gYk9@td2kji^Qv}{g>0JyG)n4cfH4M#Y!Mle
z?*mHj?&2w>ngK2=YYT;cC@I4!Wo|R5${7F~O#TyMgoS7SdVJbESM*SN!JO;inoC4@
zWJN2PwJgC9?Vt!PM@fjv3*b+AHe`9Zfq7WA*?)#y??2RCZExE)5dQ3cp<-)c&xu1(
z@9hRONn5l-f(|K$b)N)@q8b&6E!aty7TA9uk4I9HE!$F}6=@K_u|iTu9*;*J@19c=
zWk>hAoAuC6wzhM`W?OA~t@}|^zTMcfiFX5Vg3!j12H*lG{yG0g;pQ3iSMaW`x1@Tm
zp#a4QY>o;*NZs@#pn<$&fOi^g+^1_Yb*gL@g9Y))J;w>EHt5t31|YOFOi*9$N#hO_
zqX*LnToujYU-zUB;wJ0lsqZ_f+h>e)S?V}0b2Fd15hRWB9NP&vqk)r=Q2c49jvvsh
z7bc=HK+a}K##06^@Zt9}M%GucAxx89R;=BY$qwt3G0g2>o!THD`>aXRQID0V!^^g;
zKhsfnk~^$5U7Fao!t^0!_iECm_O>;o4;9<jiw-rntP+j)SC-W-VzmMM)>)7Sw4+wG
z)7dOa@+=VR7Ujd*Q7QE#&W`+aA7UZwY~{0tvhp4Fv-0gOXO;`SZ83Ry%}yPxceQQ$
zj^(j#GwW?!wC-zMw7MA=ku2$d*2|8GB<`|dVu>b?ABX*NK+|JoZWP+yB~h08K^6{c
zdUP<h(*W((%xCo>$3wX`qeYXJl3NV2;Nz^!fTTw?;EAqhubBp0=Yl4VQf(uY2ANhP
zp~}pPiR$e@_q}P~+3dcOD{bTXMSlkm%J%Bp$HW?}F&L@ctxb3ItQx=F1WBw-SYav{
z#ItuNrxWYhGwaE_52BVeo<lTys%)%Lh)F0^I=LZDta~~0P-Z-M{O>p9a*U-HE<jX2
ziQ{9jlAWKNy}pQJoVPpCyf-(h>HaeMA~g>k&K({?vaXy40db;Wx8HwDTkYW9o8{!f
zgGov#CPjt>sDC&2)k4W!@nmGSzI=JT8b4hYB{;=j9Dj_@{t!jp9)E~sk`XnQ*0?q?
zppDP-ZzBqR(_2ecM*;9H7sc(owP9sj74rZzuWVbDZP2NLH|C4@3;1wL7w&bs`|xoq
zJbP<7#ZS+TsN+(S+p}31I6<C9f#>z&=T5-(_Oh6L2IU@sCk<n3=NB<xvzxCaAJv~8
zST7+h3?w22(5P4gqKU$1?~h-_G6fLi7dt+SFW$!&uReZ9mI7+~plnr#va~}Xy%!*W
zz`-0MPW~YSltLk}q&q`ZWBa+O3U08{aI$fXtdEpD75)fPDhVB&pPl5iDrhouQI94W
zgCNu(3`mv{y6%DBvB7S<t%)j?dp{a&imEx_H)T~nezd}>2^^NYWfyH)*41ecvCt(M
z3B-9i4O5!ZkVI~Gu9jW(X}M3KYD-Ifl*%7PotA^^)3U2V-N=06M>L3h%0r=1Ngy~%
znH%N(SlU@o%dR@LY*(t~W7n$X|DsmWw3qHLV~~_QA)LA3<7^gXj$_*)%fs$G#kTgd
z6U)i?9ve96+I1mSmPjRBXL|S=A}fI%zueLIRvWoCWVfpLycZK`4<^#Qg{VRK*GV`{
zIkVjIByoZ?^@S4UBovHfS>B6}okg=MD<u<8x#7m5t8K%3xvGTV@o~1RbZWl~#!@%W
zg2eZNl;kOM!-%jb%v~?^GcQbR$IF=)Izt7FO3+ZDQ{Csb|J-&q0!9HSyzoO`-rQd<
zD=<cuTp={iVh(7^KT#p}bkZ6unoC?|Ox*Yhk{U{|APG;HezmBR!ATk6#|uEfRH+YT
zGi~ovxJ#?s^k$hL;Im4D1cs3!<B<DKqHc|)6CZ>L$?TlmvMG^<<Qs*DEJ61VRJOTq
z98iKJ;#V@aY#-jRlIG)^HCkl6lnk;02<98`St#b_?FtR4%7=iotP1VDakECf4%eFV
zPZH}0z&DStRtwC=Am&ruSH()ie=yOo#-v{+g+^sd;2ssMbk_Lv%>=zLG`1BusF)sE
zpHr@L1Dce4ri*I;r2t%CNbn>?@K-^(3L{nC*E*0{i!ulrTOuvGE%X*yDHtt$mrUFR
z)HHe~bAqjIHDnx939c}FPzRyuL9!46?evWqKDc-g6H1M4bIj!X06<NlM9F|eT@kZ}
zDyS%~W-SaeOhuE15IplCIRQp}Yd4(q_LF+nj49UP%OE^e@UkSNQ$(|%UG(@!My8_d
z!7Wy{kbuP#3=hy^XQ|{$z`?rk=$|<k<U@L2F_;K^x9wWLa6<nGNM18eTrLk+D^9Ch
z)XU{W<|Jvf(<-c6Bdwhz<(xAwcl|skj-O^xmir`4N#t`%9NT3~Z2rSOq1e@R{%n>o
zJK~V_^T8>(yhHMUSZoDmDfpzW`ya^J>8OpL^=sGuT%3;Dd3TR%*t&N^bI;P&@3i%?
zcGU1`7)E&>ik+qJI<`+d7OY>WwpCXfkhXuxBRi2B4)~}d#N%u5;M2x({83D?#^k^%
z#IH4l+bi`!CKU>}LeDg8J5>6mRb2uzrA{@`yz;ra=|ikwm4~~|X^Fy%AkTP73hj&w
z>o<$O5Hx|u`U`71EhgBIAO}h#{3N1=<U-#7lBGtQ98ZMk)7qu0>2Fo@$b#M!2kIC4
zeHWcfRM3N{uoO$$;yT9Fag1Z4(lCn;@%7*Kt?T|tnszU%!whWV2NBB|na#Ls=MHs~
zV2d4Sf1Ay1?Edn2A11K};6uhaosHRYv0AZ22r@WA;r)-qQTp@4>sV|nFOL5@e|>)X
z_QGs(uR;IBp#3NSF$pDW18hC)D-Ugd{FG;RuyYh2)#?j3b!v*C_Pvtet&H&!lQ8QU
z1q!Ir_obk%&@t!w2e3MDSEXmK(5km93BNAylrl?@c-eI864Z#9$l09`4xkLNi9C5Z
zNL{?XS|1EZ@H~1d>ge8#R%t38B=SK54;D-FJ%eRRDE86Mwr?tkU5pqpoNw{`_UcL>
z4RD|e9H_z|xafVh<EDP@+RSz{66M^d0rL}|Qa21q7Wm?!7m=U_%<}tU#mh_U{43zg
z{Q6mbdkNT&n78yl00030|0=3PUFeK-Aitrxm9dePi5ct?69eS7HKcF?hNdp$bWvSU
zD={B5wGC`JCW68osRD(yx-ye;fvTYm67Ygy@G@f1Nes~A_90hKgAzkdC8R`gcXoze
zLXrtSEgO1XKL7v#|Nq=w>u=jO5dWP06<P}vb{yM!%c{FzS!{RN+9XIE1VdK{l1w#5
z{hDMq%YyvxyE{@ZOSbH!pIWq)EZy;OJdsE8c)#1#OrU?l$3Ei0Z6Y3X9E$&S6-h&w
zs4PHsqj?yhLx9g>a8Yg%y0fIH+<K$8@8US!Ts-$~$S73zbkfG9@1{Fh+_`OmU(udM
zUu0P^Z3@qQ+^U#G<g+_Uyp8c4mtxeM2Tg)!j{{NiXg+C0xjMV(z(QeW6T}U{g~sPH
ziX(s~CU;s068>roUmKTo66_|Hb|UFkArdBjd7>?A!3vRVlEe~j=*!o$*wT(f&_tK;
zCc!d9t;IvVG5|ubShY7RVD0SuZ0KNcqs!sdwe#WP;&RQE^M*hqxCnW$2uJ|s8jF6-
zy&2LPUR*i1S10J&;sk?%qmt)eI*p3EDZ)NkGK^g)!tTbPwn^-H?BHTU9y3Q=S)u;L
zl2?~R+kBk9gj(PGSbY#MP3|x~@B=kaEz|E<!AO@4!!`}m_FUY+kX_Z@$CEWRaWROw
zjNsr#hrKlTW(=yG>F~Dnc*W!O&rz$!!4AsQIC!}VH4gSwobp_?^+V#7N|M;p&!0|Y
zV&l_vVxybX_9pOlr;T^QWnJ?$)i6QPY(wp+uIBoiH`prDEc#S!rzb_V(BHAaFSveB
zuH-(Oq1sH))=q-Hy+6N^PT{2&y5U0?-EBZO&@VAFG{MMpe}A7KNKAN2QTsS{Zc3tj
z7FD7K<vT+3p(AO+W*AYFAa6(W1M%l??&|os_B&&-%iLlIcDQLY>Upx1HS<V9E&en{
zoQ*e-H{5mCNuKgtPig**eQI++*tuzS`0q@8;s=uWTpuX}-r4!k8UA(Im%eo+$H8rs
zdEhuw4FQzupXARl*>FGAFptk&=}B63(`2^G1?dh}Emu^Yrx#a0O#~}a2ZB}WTQ^_M
zr%b_dhIKavgSaNgE^fD>OA!LG6r!i#s@LY1fPe*Hj)rzLX_*+jX)#ArIZ)ed8S%{t
z++b?xV!xkUDZ%2MxFPKuNwvX;i<6-Q7A?Oyl)}udQWs@Jfs!z%|8}!w&k1@8tkY2G
zX5J_5i%l!lrjQT(r3d}<dN<LIq8>m)iLxCY)}=So5KQL~QLVD<yYec?tQ5H$<=j}2
zLS6^k=#{ecg$#Hb3UQ+Zgq-T#R8GVGbyiL#nU~WkrG#|+T*G#!|9`M{Z>ukBdBMMP
z+Y|kst)K90Zhw+lMiHv@KqR`0CZwby6m^FpQU7?lpubQT^gVS!e}*pTJLy7RC-T~{
zgKp@%>qbJFgoW*lRHoTFnESHqv%v5?kI9Ct1qw_D<iONj8w@TbS$!Bx<~YPiw`@E`
zD8S&JZhj5f2xh*;GuD5sW|A!_+FMn5t7}C>@p<?aF{h^lyE6Z>!bvv8*}FXJNnj4M
zkROYV7jrw=)79HzhmBOvSDDLf(>9<69lK-5Of#6Fsez{Gx}vJ1j_mF;$w?<Rt=34_
z-5`)%&3w)zN6xM3!<=VbuH}Nwp4scHo!Of$mXkJ$lS5^ZTOa<cC*sXWlZV;`{#4jv
z%PAqkWm?+EBiuMzwv7=$$?^ae+yHQ=i~zTy93uEW)3)M?spm}FDzL;;{BUSGm^N6d
zrfQ>VEOCWGJ}6?@@HxogyJBif-vc*%H%x5~zl|Cson)IE)rAO0gwy9Qv)^J?11eFu
z%aqb9dm8Vrc;?7bmB5EDOZU8v#Z*mG%4c<1?)>~M`-X@5qED@XS2Kg=O7+a|ub>DM
zcPff9GxnW(=6<CODnjBSHV&@J#gg51X}%U~>F2%vZ#VC8SmIb}3%I~kVEFr0|D@-<
z?+-urKT0+6^Sb|Ga3n3q1lcX137Uuz5MWZ=&Ew+gPt1lVlRV=48?R|4nd>PH^oW44
zwWg18g~geT#qtir+)9TLn*?b&v0z<}dQWSXq$NqQ<60mOFTV8iFH}>kNA{Q=XszRj
zJe>K=FCK7nxLCiinQ&Kd;&o3*l3*9Hd)Q3XKvc3zQLu~i(>{p@ig*r|$>~*BL<pj(
z5C${bDjh=6<?+?Iu(sE~(297dtV9e~yfcto|DV+uH!V<!qPT;lO`Il|5xm3QmV%Us
zW-(z7C!=GNkI5h&*s7<<s$s);W^1;o8=k^^iy4NjD~c-{u5bC4nFbcVhB@NhJi3Dp
zZB9XT-HG%r5)WI;<Y6f$It=JIs4Il0CU@RyR_v>z$D{hG7$|(`EBQ`ixQb)4e+29E
z0sc)lMb%JjTUFPiY9JCGq|hEmb451|#aSv2kD)E%6PDz3(~zy+2`;A5-C#?GioH*U
z#p=xi%%ca!0M5ke)>`)#;3<yWW!}grdn|fI*&lhbZMo<Nr>K?>BbcYHo%$$c=iOrI
zt4*E-CdG{`Q;bT@NURdka%h!&pZ3b8j7?OP@~#b&SSkuFfbM6hV4!afF+jup;CcZ0
zEgnKbdYsK+;9wDq-HQ=!fTnNoXS7ixHrFcOkelg*&M+2OhUc0FjHEI%^*}XUurD|1
z%$D>DO0<QRv`W_1BgB8<S9m0vVFor1_b!m$O(#w7?wDKZuio9rJ+*g?7rl4<>Zc71
z(;R)jlKvq_Kd7YtmZjH>l)hO`ALZyfmFY)$2D6$WCn3#B85-ZGMEUgXO8Wou40<I)
z80Hw1l;M8>00960f-Fri01r_?X_S-#ZMQ-UNwnj_E|r5@2DelhP(~N4OmPNIO~u7P
zDQ%K<0RR91|Np#Q%W~T`6kX>pP-l}?QYw<-L$<3K+EG)@*lx#hJCl_MBtc6x^%#nh
zYp=4&GGEb6mKi(!pG?1`_u?Vb5;%k{PZtrb2nV>21CZdw1uB23#?U3b$my^rO=Qb-
zX1I!_K|0WK-kMg_2S3q8r71>pnqO2~YLwG)rQWodjz@6|Cx+Rgb!k>?Vpz<uTxM9z
zuv`w7c!^6h_7D0eZ^NSj|IS~cyDm?}foo9dh_k^#Yrcp=K;1i~<bww$Z|H5PH(7;+
z^aiQW|1s+Nwouo{T@Lx2cbX?G#~Bek0Pi1%N8x+;cih{9JN6aLld5YIH<A{)DcJWd
zr^gL)1*X~CKM3E!=kegAw>Nlu^6P0|7V4-%U^RUyP-SH^0;3CjzofkqXLoeC2G;KX
z+<T!1X#Am*&eh_Dz;k%6E-G5*QeO@gdRQ;7XwTCl>Khb}4BEnxUFX>x2|^@FkHl0D
z+twot4R=p_;qJ+#wp}3hx37PH`{&cYA3njH7XBurLEt-HZm#~6d<dmnn>Fe>olY}H
zUqh{CLO>~+kPJS*eiRxP%EX1Si933PDOI|HDo(retW*K62%jb9WbqYQwquJTiy2ow
z3$CC)K5MCRpd4M#6s=Z)7GKX3@)9Kya&7QrCM%tp+BVbz3`yd&T|CwiSYo%Ew)1>6
zxmE-DwW%IzAiv&%A-QBoZpM%=+zDTF+&Gld<h9($b=o*>E#7Plc_>zi8>^=R^|)MB
z!)<Apyw$1qMv9l!s+Vciv$c3L^===CRZ?#$D_t5=#&NX(L(0GePM~ozP}g2d&e^nx
z`UV?vj`&2lnm<bT&{SSek1&<je=1x~UnSbqn}HT!*qSnq=`9K7$2!2{h8uVg7voKq
znGHC1rG9y*y(jfm$1>=d`mX8dYcT7ZcT%*CzImezd}D0kjvi5O;?*Mh*pCz2f(MzH
zMhQ(4c%}(DY2<aI*tPIASZcM~cJib!_VHA{@$M2U*mbO3+uw*|AO6vA@mGq_Oxy9i
zT{5`969mc88{AmyG(3HO{#$tV3xClWo}ItzAO3#Y|H;Br;$YT4UIn;4yHg5qucKo+
z5r@J@Ok`3PQ<5`&AI1o3!Nz3HFd>A;2<J^)VHOWn-Xktd1ys7ohzfPlY*bvYFLNK$
zONRLwg#9(krX!KIv6w_tJa#)FJQ{|XpnT^%zUw1z4T|K9#>3UofmOO1E>rd_t4)KH
zF*~M?mj=vEY#OmRb>fJ2Q|d<nqyFPI++9WOU%$416hRb3k+W?C-)jLi9v#8wo^HHY
zXAXbK&9d~zyvP!a<;!yf&)H<Tq&e;uT1_ng%h(p<vF7tRix>IBCBMe24azxm!Fmqe
zW{CYhtj?E!`&|~efoBk67pXb!wjuWaBXUl*j+~3wJNh0^Zl)<y-3c#Oa}nMkv?wTa
zh+O2gV3rA<1ufH+hm6k1t99OdUmKJ!kt!;EQ7ibN5*D+r3thubW5=PMwZ0d12_&3Y
z`VSsw?N|XOo$)JwvAafI@`_CsV}7_N`2jy?;wUYiU~SprEGpdl6Z6Kzvgz`Gc7IG3
z4~nvJJf2~dOUyrMlAUsQ*l9wAJR*xn(MZU5y57Nm{SN>D|Np#QQBT`I41ONJB2To?
ziX}}_8dXd}8xKgprm=@f3`I%qiZZ$+Y7%J`?7z>SeQ8n}rd5;115{V{a=EiVJJkM+
zpTk3Ik2$4n*3+i%msu}kA+m$b6nBn$Ki>$&gpiN(wk7QJ)OI5`2>d8=lV}ppoaxN*
zqR5Ms?Q1eA&j~#B&wgt%f#0&d9lu3KSLVnN`VLh`nH@P7PGTo?`Ske$v@&8f=HL6}
zUt#xD*)fXPW`PrH6{wjTcv>%<!1c*F`z~p0>`e4*AM9@N`s8F0Yfr_KWO4eRv3nbu
z#j}Ms=hqhm#n+c##+Dg^w#X1_LOA1{Yco`thsc=<nU4V(2w_>LO1RB8UYSLu2YI+u
zVL?!rN9tvr2RUEVUeWM-bmmCGSlgs}F{X52e~;Vjz&^XEJusxj4W#izDp^eZz}^o-
z0%kFz->we;sne_~s#RDakwkJnn9Ag#j#esUv^+pE3#n`<KskI>aNIY?QA5&++G&EG
zE1f-%x-V1GWBFd1bKDqtO;AOcOt@CTVvxY0)+CW8;PoKL9&@HY!GD#a2p0ClwLN{v
z!wet^I3!Hzv&sBng}Off+Tk7DQMIm+P%{5PcH;XG<J)X5!YbN(kyd%TLj4!%$U64K
zYp=qa$@CMZ1Is25w8s|h>ZVW<MNb4D*yWZ;B*`=MvEjWGKTMiyPQgU79k61>X9Uwf
zifSz<#-AmF$}=e<CYxBBZI=8lE6(%f!RQr}BzR+TTZ(5_)-n015w}H`oFy)84C`!3
z_DE|O_8sn#DSv<JbSE^C8}vxDio==i4Zet(;hUPUS&Ctq4WxWb3)uibHBYt0SdM~u
zGMOdm-5IO{FNVd@yxX@BWADy-l;!!k;n*1#V{7nsAoVzHLe}VwDXU-5Vzim`7yg*>
z;{w8iZ}wo0Ztzmvaz&vL^F-7*4_fwz+m8){vpEoxl*SUYqh%%kdK6~oQ_mlJ`~{qm
z-Z~$FNPGst(<+VY3Y@;nRX*pd-{cu6k8tN{#vP1=j)fj-s<tr@8X=)*nT}`$oKV~A
zqoGDN#4J6RVzo#3((#`Z38Vy2{Oveb=-_$kfvldwJ+mniJfuczOHKF@RYFTdk8qW?
zILQ`vljKXRl+6c`F>V`zdXWp=4bPx|k`D5N+n^+iEyyT!mNXVbyTv1_Y1D*%uM~Ec
zNnU7P(+STqycDvB7?po(7~ZPRGA_TTgHHKTa1$6bHY?@Kq&D1D3Dcyk^@?km2=gk5
zh|QzP5p0*W23Il--%<W7Cn_6ax=uCcF{-nYxwUX22csQN`NDQv-55722COFUSx^*8
zOUA3lz`IjhS+feR2*cZ36VqsCa(N%`EMSp$I|z9Xu8Ps7?5nks9;CP}eggmi|NjE^
z%weW0K+`oO73hPL0N(tbTwIU`&b>+sR!Ug1y@CO#u?u3_fb{~yTLbK9@D-)i;1)6D
zuw1CPjzR&X6tD)%K|BcLgZ9Be^EqcN+6@5^MFvPpko^ZM!C<E(LC#14C(ja;K43~J
zxGqjDLh*3{XyqqpcOJ6eP(qYbTe|?sPLMp#q8{OQM2rK?PsvB5C}=PM00030|EyhW
zPuoZo{ha;^?@BF6^H5$531};!K9MLOLKm%6DRN?G8!3>;aSD;jfA2l_&NH@CD0~XS
zGoJC>xsP*Z=8m2&Kn6y`%@Dgr(7cIlVAU8A>^FT8sNhY{)DQFNRr&mTlvHS1(N7JC
zf&Y26pco}sekaYSsja@fHWpwAGPl*ao(~rnXBP)Lm|u+974E%U?SU|YuN)gYK?aV^
zE1yVCrZk-nf|sj9t)q=^H-FdU8issN=Nek=5Gq^SWuIsP3Ew@<0MZMdVE<5^O(5SK
z@nG|ZYIzoLxAhZ1tM;I?QQ`4mC63n1&>L`UD|U-6oo&XS&qtSJV@^MfPS37z@d^c?
zybamP<UEOg#P;TC{*E-Ep{8C8mvL+&tJyWOh=o)XDb&0^D$`Yl=_^a^N>F|!wv~;I
z6DQP5m_tjL0Hv1difghxG_{Z_f&zh2e7D4WE&r7pBi91XIa8vj1cuE<C5*$>{KIPt
zHFvo~YwOxPc(rpJiswX(&p0d`{zdM?_s1VUk{KdI1y4jG!cTtDqj&GVei@x!lEtQW
zN4TS)7NBOu(g%~?AnJzAX|LZ5+udn2jyvtney<z8X?FVUFzU3s&2B3mJO_QyK4`Tc
zM;{!0eNWM30eOI|f<k30ipb^)GF7QYvUwO;+;5Hh?df>X>rJQQXwdDv=}h+roiJ+c
zw_3ePui5XDx<`-7X<<o*Mx(bsiJM{Ajs7U7MfbS~2OAlW#9u1nK-*O21#F>;vk&<i
z0^sMFD0>9&>hly^51Hk!ZC4rH#CK^Pbzzwa<kHA*PoZcQy?CVSMTEWJ{07Y%(wq39
zCOHZ`xL3y#<-^!(R)rW&jves7Nat8BZ8!Mm+{u$DqDPP|mSAZ#I=#VuoBlD5A4j&d
z+JjmPbCiAue5dh4(QuFp_T((oZm`EBi&k+H48V25LQt76>s2Zcj75?KH&&$d1UW+G
zy>1UPQa{v;#AY&Qt|q^KwqE@$W;Z7r<-DWGDivfUrtEjXRZd#DUBalcozE1eXVer%
z&+WJdlgBB}JS`+EM0Peype&J+eQJn~Jk?W32Vq(`o10<qUb{*;sVqeWocTsXL4PuL
z1FvhM@q%HeKxnSQZ$s!)IlW6<XFAoVpvb@em@U>68l~!p7d3!(l<<|GHnQ;LP|Y1x
z{Z8AB;UwV{UgPz2s`6||M<irp4vLpd1J3r9V2-GkGecwtAOrcVwgd9r>$!Jq(tdHS
zGB$eL)0q;nPfsyWsODMXpumO)ui27ostW60Z?{B3aa*2l=+Z_E5?U$fVy7XLFj=hs
zry*P*J7i|wFh!M}h8e;p`(dnZ5Bo5RD)T?iQdHY``Xf)8nfeF@p2ZS%BHh=84QZGu
zXxTt^N33BQxKO=Rgwu1Ipiotyd+9g0U20ndtG-+<IB68`l&S><4O)E9fZ5jAM*0fs
zmJHNagRGKYC7RCxo`6azlm%~VV0>x24WB3|J&`3S70rJ`8>n$D5HMkjy@NeHp4Dn@
zDW|6jD)Q&jXS4UL>5-VFPOo<H5P7mR?=X)Jb)#q0WP<geT5y|$OM;u&q9LP`Nd9To
zDpb-vxObHTA(d8WB_uKR7*fwKIJ$8!=G1DTH5&Qqhmww6wxvo;%)<89$=JfvTkX;P
zRiCe{k>!t4vCe*tOXD6qXTyosF=!e0UY^)^pyKI&#vX3hHNEi!q$^Mvk(8l@^2f^w
z)=jotH%5V6>mpaDd)tGO>1?Jmy2HCW%RH4n%KrK2U)*JPa(w#X{b=~#@ZHhL$?%1o
z>&8h(A=INaYa~Fb)=ZP$(wxDxbd1TKX!xF5Fqy|;;)QuWf5SLXvhRU`(aA8?8UJPn
zCt0hlPQQg%7W<N?Vtc;Fb7a#}>nDfsJU5eAHk51@YeLhJ@Er&}WiQoQnJrbP@$KfD
zK=V&0Ks5-R8TdEmqjbI+5oF<W`G5@=V&|WHK>tOcjl*p$`BA-q6HQ{^2-q*c4BhBh
zwq8WPIcj9tHxetBvN&23)?}7$BvAN=48dBa;e%hO=k?E@!LIV!<L_Vrk3Dw_vWz4N
z5>5quj@HT^Hc(@leDV&#dtt#0wB;&z4Yokgnh96xImIOy4ClLaxFGBZ=lpAm<p*Q0
zRIy6lCB?U~Fg+^KE2oY1=71az4sXK^%0h-TEkOU;EU~i89Hyb_C#QEclSQSv==0&*
z&Y-WZV}5QeDDh>v0H|>yJnnprOFiS&GM>z^x+?xdC1#Mtb+!k%-2nBGnU+%lCxH%%
zw0ONqTed3}xl>v#JDT(q(PArT!<?5C32>C#Aj}Veo!HZnqxRHN-a0I24^Ndh^}r@U
z>1UjETC4;cf$(k=r9be0nHJ))PZzg}0tTUn!H!~T@fs`YLV#_sAgPk9{{jF2|NpdI
z-A~&v5PvRzMZ{jHXuHJCN7HT67z}M1Oh};ZX^QgULPy#lk_z##|9$sir%9SnK!ul*
z#EI?m`F!^M?oR2=S7!<-Hx@p{^tN?Cn%$2v5j`_bPJ_#<qpR-#bU=&0#{pE1S$cJv
zd!DU8ft=H1&@nvl?d=ltYw-IdGdQQkN~Hr)JweD<sz$z7&blOBWOs5Ig!k7uUf}Ns
zI@47bqnRGJv|OrMo~j*o<q2B&v}oWls4_zq{pDAfxVB*83hxbx3k3tVSWHV$7_J_K
zPYlTF3~aX##dmGg8DiuwO~3&HB2j`9uft#SrfwSn?FddJ5h~N`5uozmfGODDc;lb4
zQQ0ns-f_kjQ*-AwsvgvLofTPyq}T{haCJ+D#6v9jQ!VffC{Q<MgtVP&E)5M~UR}bM
zk82UG4lNOzu>>V8mgS5HQw-Jeh^?X5iib>fJ69d8h;Ppt6Z3h#^G4+2p)BI)ZY|IF
zNQG|EYJ-wXDJ~5Sq(xo$RMkJ)%5KVTts~UWLUa+M%w=vEUr-35bzr`xJN7!sFb8u{
z25SMuF`es8U&m6y5rAwP*GFLsmkHcF@HG@mBQx(+O>D+qx7`c=<9&M7>ZPYm!|?SA
zqnFacy6s+vTP@pn{W8WCLRIM~j<Oq7^by7!^DG~5_-Yi{>`%bAS?=@9TF6BP`Z)R`
zEG24oz=|jpD*P;L%VZ$1Z`R5E6cD(Mk=3)<=!E;y5%T`Pa5N;BDYiMXB^KBHQyy?^
zDzX*KuB#xsx+xl>>`m7$C!Xid#*<l`2-k}(;YFb%BO!zov1{3}<y)R@hv7Qt(mY9S
zWPW2@WRI|P+yZ-j%+<Zm_2dNg%xGwY6Q*H0Q^%iLo4zLsREC<?J;OiGPJ(a0kB=^b
z^P|fjbx7IT;p6}lM!gf3F#Uc#$yWXKR@?mowAC;z^uY{lv~~J3_WV%RpfVsaCpODq
znMN@89I=yXrk^%jM;0M9#TPQvrhZ@nbbeVC3E=`@M_i!Ngov$>a$m9B%~ok*WcpkL
znVGXLfYu7rZ7CmcB?lc8;Y2x}nZr&uT&2aJ(QDFP2$Rnrh8lE|vPf#j7-0Dd<>(1V
zRx}9Nk2%-|N(|HRBy-Bq*D^i~D4_2U+F&m8u5eW}V$E<>&vh87S6lnY#vsVND>)a%
zVVlSAR|sRkIz~4f)~Qy*sHKesEU(b6A@>(sOBs(;K)osDrFiNqT%2N3c4kT7n$E*p
zIpf_xt<K@spTGK@t=$?{6lS_Tj$8yf$ENV@$s|k?;knXr9nTC+Z(@$4*^8W#*0$x*
zXyVK)xUhZaHFoB4Eq8+H8Er!638_=@P9h$Ai7QfrvkrT${8Wut`dlv3t#}RZ9QL|6
zMt}9?e6kzE@OD%F7JsY%yj@#w+AtJ;9={^0_5dr1k~kNqQXVL)T2wAmFPbKGik!r0
zkqDsCcK!MD@o^H;gs!w(c>!W$WBd4A>~qdn#aJ1JA9I_~#4(*$#9I*=Z$;i2Z)HNf
z)z?+>AO!<(H^64pb<|^Y!NpR2iI|HYlK>SXtAK9bC=ow45KQ}jfnW_Mf|ADL+Sh{r
zSS;qT8*ssYlEh&`i*aMG=}1uita2qNA0c4{6iF+fNL-)0!f;t<Pd(ULOR)X<J=fDk
zvRDa1dbwB^Dy;!vM=#bggc|U=hBUCiKY`Ksm+I@q!|i-2yYA>so*>l3$zVL54Wr@N
z$?!Z1?c)1nBIpZpf?l4@1igih8F-z;_qLz`<^*cSH6jkpr%b&%+OtmX)kagj!N^a?
zqvK(8bv+#%k54W`X{i}Xx0fhvp?y?)nCEOQ(~WNKR*Mt|vxj#|<&k0-0r6~RTihpm
zh7-EPkyZq}?;lQRmf?gGw!vKqs@axzBm0$t@DrxYn#J>lut<wIirq1W)e1l~p!p9X
z40p7M_Rs0~Vg_f5cfZA-jB+s$Ko*HWX50&1H<C6#U=>$Jj%EGqO9Qcw6tAd9GZj)~
zW!E&;vms*R*2e|o;0ei?OMS;MI2Y1~3O159*SPWXYPB0ha@|ox!P^!pCMF`Ur)^fZ
zSymnY64v2XZ0Y5r);*|gnuFdh7lHERtu86h4MzOCo8^`tebsGwAzD2((G5z)LE+&8
zj)w%><57a)-2)2u8jxUdZyrl)itiRJZYw2sOKA~r><fA!KJ^5Ha5<yQVYVBzr~Gbf
zrJnk`t%j6Im_-rKd|+TO9Wq7tjd@UD@!&+<)QY3o_0_lQtE$%XN<XH9$!HjTKN*}i
zD;;8`YTkFYvmIW%v(oHhbUK>8Tt_)IH_M9y3zjB6H@z%&EWwSL#kp%|G>Lsm6P7u|
zBgBn^jJ(NN7*Hmqv#_I?^vJS~?549YK$fCHozD^HY;+lordk&mW)Clnq@IHr|0O!2
z@{y@*GrUw&LrMeJPn=XRA%~`(u$?m7x53-jO#(_S+viyj5MfJo0W%fy1Ly0xN=^ZC
zM*m{0R1BV;FINDciXZY^sIqys1^|MPP`}qN@R;UsgSp(ylMNhzb<}kUxIE)QSb=XY
z4{rM!c-+JGMND|vJ0w3&xjH(-R2%BFL$tk89&W(VWfL+|sX%`$S29Jf#I|{qEy=ko
zJUadW00960q+RQ8+DH)peEb#ukV<gDj=>M?rtOtWp+!oY2#BgkCn0;i1XnKH#c^}F
zzy4-scm2Y=+J0$^_q}7!{N_2EjWpZn=l(|3V!uVzN^~fP>sFgU*jqSxE0gUqd!mFA
zM@51Ari1m_d?yO5LC^IA(_8x7@xwl2Jr7=gxFW}5r-0=GAOq^L9NUcopZh-nmc6P^
zwtbRM_P$cQ@|bmys|2-gQ~BW{+4u=t#mgrgqoHu$&w%?<TsMLHqiZ3THgup0ajB&e
z5hAz8d%lTvH#qBC<}$QA>-ajz<q;28K`yrzSKY^}CinZij2_8O*ldB-l1u-M1FMgP
z9M&w!;01kCDoL_%?dECTQ8;z=1uSBu_fG}wPM&KIBi>I&2TrbNC@*d>a7_%S;C&2!
zu;Dd!BD;6|#gzs;d~c=3bZvNPmbkRTCscIaaT%u$A<j5Y(cv%s0e9^lx4CBrcE4}C
zuH!_O8AKto2ae0#L9b`$Y*Uq{f3y0Q7*Cr`k~Wo5n6ENmn2F|Urv2KsUYo9}qA*bW
z5|*jEHhe>p_+hQA=m7mO@e=tMfJnH&8l!pcD5V!JQaLgD^da^^i#167I2LJa3Ks(y
zQaNpG4UODE7Fk9mxKvFStSo%NI>4z05Rq&F@cG1=!M5SQE>@x{Fh4Ms*SQR{hyOsd
z1|nK*o)_>xgFVE5#L-*FGhMgni*W(*IwMz!XH>2zj+*mh;Y2{;+lb{91C~w*dH$<M
zPQ^E9)5AX}a^s~FDe<)G87xw?0-z6JBtr&8e3&>td?wOgNe(Fu3WB3oSgnR-C@U9-
z8ZAIUQKG}ohP1Mwm7=zUma0*cHm;3yWNI(Usz)2dAV!4{sXvW`5|5Hmw1<sMK!6TB
zoAMU6m*2Fkkh4I#dAy(>8`=-ai)r5p*DM<Dwnd}%vKDGu@j!<&lQy7Ks%gtBt62>I
z9_T@;lk<nZ!a^&Lsu#(Do8=NPUTUN--;Mq2P*)|Rp5lZb=ujV@_<57jqSmjno7rw#
zNAvomCSBEy5#K<{3?;<u!;?omWw>6gJ)bN--+Z{c9xZOh<Jo8~6xFp8hDPFP(WtV|
zL$ac2^|;gXneQ+Y1jP`(wl*6u$LIaf4qcGs8H)h2oFXe0@*xNx*3u37e#Cw%fX^)n
zizqK1D=ZQSQw#w(0>FfCab_ghd;H!e+d1Ks)#X>I|NOVpXue_2CQ5H;wuinOTJNUn
z-77du%gqxVreHXweRNwk^w=jEdVU!n?5d|-A%<|*6ICmF*>^nOiWty8^L&uy`i|@E
ztd(6EVXHEB<tb^k2Be#n&T{dR|D(0f+G!R7H|cbNtpOCh8eb1T&U8fC=Wn&MHt_AU
zHjIGm>a6{K-07aRfq7D3hxV%b3L3&Mz^8N~tDM9;o$g=4<15GKsOi<W-v*pV-n}O1
z2mjeRKenY-<!>$0)lu6Rof<H#)oUrQFI^<@$scYaPnN>*x(-&t!N1@KnO{n!nc6xm
zmS&xn-t@wj7Kx<XIzOV(*6Xci-bYmGZQs6h^`y0yp8=t7msBJxRpoyS!*V>^Gacq}
zBC(5z|F~FZXrOB%seE)iH?xZ_gI!11vB_5nedu&y3rj)X3m&+TzC<7|Nh_o4aV-az
zp@e6Ztw*G@xyp+%wXZrt+#aJ{akg1LksV-+VHQ#=GFdaxi{xn9cM%h~UESS~nMUUI
z2iS|Om#LiPlAK0S(}I@8R3;EY?F;Pd0!`=W__Be^dchwt=c+JVpr3GBp8Oh(>W|t-
zs*0Crw^^9PjJoIb=wZe9Yq}D$I`-VP<x7pn=r=<H{K)f2_SB4WObP&P0~ml^JW?)+
z&ALNAk;1dPIPu-*QEWSp|6F0_A*F^Q=NqAiT4ssJs0OXIuao(wo4dI-{Bo~-9Zsji
zFZ26Ll4j9qnvj9C@FX$Xu7k(NVEy!>f;c~qrdOY!4~YNQlleVvWIUOF8O>(e_-3jN
zwcFuzKDoNP9!|B}yXo!CY=o&XI9Dew&bH~)^Akra(|0sJM;s%>QgsgZaOVJZ&^w8o
z8A0IYF&fwdsu6bLwNi=&X_~K{?<ImGkih}DaS=892Jsibujl9I9DXHYr1avQj4I00
z!p%Mnr=t(__I*XXC1c7E)!j}BoOQKG;xUSptw9>}3=3tfUqtiMI)U7?H6a0o3?$eQ
z747R#gG}YryF9oq8XL1>(FM9!(!x6#u=+viU@FU#(5H;L<SP~wu?;kFDQJ%Wix3Kj
zdik3ph(k}#@~|CvR{7ylEG}wXL#=IP7v+VaGJ+Pjg}Y$zRSal!y+9>$dr=4NwbjWJ
zxj~0oiCs&$6-l<*L2kRqZYCycol^nv-&^NRAhiAQe*gdg|NjCuq8wdZg5n*6+=F3z
zbwPU|N))t!6ykPKmyj^X9uM5xl7Q-?4Pt>!s#4fppopy%h+9B4VM}14(^aM5!!8g3
zjc^h$XFK}Btc2}PMfL)C(<hpG9gyoGQ>mJe&2i8}5W%78mk&+5nc%78O4xc4P~R7R
zP#Nx+#Xp#b)&j;^Z^CBNOcG5kQ;ZTVjZA<|J)^WFQ?q1)L_@qyJ-7+@>SeT9G)w3#
z8W|;#0+A(=0=OiCB>D)jTjE`OK)X=lJ%BQ>422;B+O`NE=POA8cCSDs0p#St5MZu_
z&S^l`02HMb6r~m;4{U(8xgZ}52(6af{X>veHJgLFgT@AsMjZeE0RR8&UEOcmFc5z>
ze?`<4sf>Uc2p{2L8ZD@*R8a(-wrQH8e9}}v(}Y&t{`%ed?0iGn_SzRD;ya)1oX@|r
zeHXL^*vce`g)1k29Viz-7g-IOGX)cHme496cL6CT=>s;n*gb5(AvGxizVhoVLBb=!
zobT$I-P3v<?HDjul9B;+<U-3AC|8;ErLEl<TH;Fs-fH3R6%D}EbT(a#@2+oW!b_9e
z4kQbs;Kf_u0h*M}OXYDj1%q*L81v3)xqJEYV~5aiyF=gZ+FtLNAuPzq4xlDc@e-HM
zR<ham)-K&U8h%H^?`Zh{&~U{$5;s)o(-Y}|-=E|j=WHUD(G>Pds1R>-RvtWTmE8FN
z&L9z9!8?RVyOI&F*J6^E6zbt=z)tSS$LT2nsZ<($&#RONE@cNG8Kmj#Zt=Z@g=<Z=
zd3;e=-H%5A^@Pb*mHJ}x&AgdYG23U_n-pZvUH-Fr6od`r91Bhux=J93x1b7`k!O!^
zHX#$-ssh!yuh_hYt;aN9G^DsWh*UvQDAv6TTAy}-Nqav(CA{+qp5M%2y*7b3w$@MV
zR0saZdL<E0j7wJWNkbNVkhxQUV4WdQl_Ao2f`*c5^M0JRv}~&$L?2+xS#cM$+y}tC
zwWc<r-rR2UXIH9X<<A&p@{RC0zJFr%$PTd$eqcgpO~<!PQfTE&>o-J+e1gO(LPntn
zF#O9oAO8B{Vor_8))aXwuz%>qASW`xM8LlGkz*-2KqFa&k|#1QqzuUsK895-M=^1T
zgDeMSI-69ea0<rA1iS^oviooLfkJsbwma<U#-QgS#&U-Ek$2th9mMOoZNNRyAt4YS
zR^eG<IrKt+JDDyo(K%y`N#G=Lli&qKh*phSLJYIhyuAG~yW7iQik&wM-c}WuktUyi
znL1!{T~FAN6~IG8;q7Fe<tqa1{)d`~o_oQ?$*yE-OCUKgr{bH%xwW4~%8^$G2967;
z&+hw1$FPT;bK7toqvP7X)%SgUXzO0z)4JXC>mJMB7I=_Otjw&{FIZ>9-}V;%ezu}b
z^_{y8_<7xtJ{X-Rv4NVrL-1ofj-2~G1{uIgNp3t?tE+31het-M7hGS^;!>81=aAn{
zOONcn;^GV*xr}QgAJ_IM=ZnMBJ`kpN@gf-ol?u;?h_hdx62T8i{wCV4<$FfxORq5_
zGNoiEFAXK|qy6?@9Q*wN00960tX*4A+b|S<=3iLt9y(D{JFXKaPb<(Nrb?Yyr%6Lq
z<lKO%rBwrrhyD2ZI5xQ!(y<o=*#3Mu$?-YycaDprKFgvcCOl=d9?x(vMa)(ACRGKr
zS3*^im=H<?;8L$ebPIVNZ_(gtF*}DG3s;MPKz7TVsPQ6|{3KrDw8|`B+0qHs0f&;P
z)1f44*LJOQ312NX#JzFIMG~bUw=4%ct{^cNxLxD5!c=u$YZWCsFTY#f(^t#GnyE)S
zkoNP=H=N%*BLi%!J@j>Pg?f01`nX&cf{_qbs*gq{pQ@2WQF<ab;@$S>nGRbErK&PL
z*+X;<)%yNwLu}vFUYg3sC8V;{kBSPfpp{!J&B(1;0Fm>7+T7(9_v<lx@at29HxPWU
z<o;<}DFX{b_eLShv*}m=CascHwnBaNXYlRv=QNnjFHldlHo6ceaU$Xf$JBF#a0v}L
zmd^vj0%OKSB$#xQshb=~qsn#Q3fb^}`<VOVCXZ^OzQDk?_@pw=D9XXcsHfuQJ;zyA
z<DgBGoE{_nlSX3%3yC6WQ9nRJ5XIc7R2XW8@Po?usN%Pb?#pA5;qsGpxJq_~0|UX#
z5KCtQbSoUHDywrpjSA*Niss6Pyvwpjm3mS|(Lt7l!sM474k6RRjSiSrKR$r35GO0C
z2eKbXMF&Y8{|DXdk}c{<<$O)-Y}wOH5Js@)mp*+^fgQ|M5l8dWFVnMyblT=;lNmzi
z)6bLdGx&}}9oR?63kK(P41&91*al<FSOcTuI5LglFt?7u()u_qX7f`C(!ltX2V2>e
zZ844K66Q4UcsD%KhDYVQUSI2u<Fgxhntg60tWRe2w+s1(!61gJsd{>0jyk7_to9r3
zUIK31t`svqNlk8m|L|ZzWOZe-ULw`Uo0A>CA`DW;i#p=93j@0iJlqX$k1*=|IHQ{i
z#@6~Si$>CUN}jh6P7FiS?4BSf4sHT87~F4imGrSlGoN#|p!>a1^iY~LO5dV!Q7+Be
zln896RB%i@hhdwCVH(9_9($NMl!vb89zx?PY&hvFrI<4s)7XCR#c%G3+%pd1W`PXA
zuKTx@KR#-%cmBWXDwj;U11!!e?dUxg=U)H-0RR8oUF%jGNs|6;o+8J6?14oRb*~b5
z+)ZQLW)21h@TI4_x27&xpzT6Zt0cfP+vm)K?7rMQ$wowGR%Mk`LIR)pu|CJBRLXl~
zMn+^td{HAyy{mEkyNb)#Pkk>j65H?fc*G+=fyLSI$f)NNB&xro`;|UI*KOm6OBYRq
zMF|QxtPoH`-=FPY3Nxt=lZz%asz=M-lHlX=<`=n-@}@89_dg|4lJxeJp*Mh%d)gOk
zPrpcBvA7m#L&S9wGJ(7}e^7R)$qfqRylm<6*;aL8IX@6rn4uJB<mi_C-qc2VS!zrD
zt)-^RxBVQ?qpz-U50KWu#cYf&xHNQVIef>}ML7Wtlpr%8EZy-uZ_=pHyH`A}dxiSj
zXmBa7rjgD2e%5!Az)0NGa6xqK_xn8XO}`&SsqJPyBydZ4^>UUEM(llbH5{?O%mzr)
z_ZSQr`uui~Uys<UDW<sj4s_nxeeZV2r@cYkQ0d=J25f&kVO9XkYS(dhT}z3xwi0K@
zBaj;r9RV>4^3heC<1C}MKJFLaFvKu0G+CCJJxVNe>SC6wz=r%PBC)oZ#Y4RL%n1>P
z0BcGsa`+bI6vD9F9z<FZK}M{Ke5Q5}tEvjrc+e+A^h3JT7+hV8D<ia}7cIt<eychT
zp!3K{1@A=(71FGX4MuYE2xd@0VS%81<*_(a3?FfXYg4W~4J*tJj5sy26r<B-K|csA
z(@%NdH88AbmYG468A)u#+D<3Lm}orCzlhG#rPnmM?ue1!+>-Wz7{ripY=`2k<m~j*
z;W>ua^L2zENGe(;Y1mN@o+IKCsc$)N2meu|oj2Z=*~O>7lZ|IPMM&+$eJT`>6=(}`
zd%Yk@YM_WV9|+H#^hJrwI|hkRxQ}QAOh<RaT3JMNMNR@~s#9zwVIqMYB=aKAv;zld
zW@e6QMo}DFo@c?U$cs3Jc;{;cbtwgiUM~g}5wub6rB4+moGz@`hgrZ<9-xEoAdU4S
zq(@M8``J_Jx&7=xDr&;YD$<l5TGsPgTo9M`HC`#1qP5SHI5iD7>h<i1+X0BAc8gKW
z(&FkzPfL^H46$93WAMY9i&r@t;!W~DHbj`DbTo@`u}c!7G+Dl7XyZ(9%If<yIq8?*
zI_y3tkzT%;Z~<rxBknmN5bS<W59QW`9=s=@iJozcxDXXG<9UR@X>Sk1H%A}8|M9Pf
z=cf`#hm5AW?>_u+7=GM8{^|JbFB<Hk`q_l?*bb{|%c8h|e%&in$$Jcrou_dg(tbcc
zY%}p@HXNhN&?ab%FR^<s?{o3%;pfZq{e#Q!)9Lw}3t*O;*O27?S|~KoW~d!Xy=O0(
zaqq(t*Z=LQMn=UA+Z3&Ret(~1r(WC}ofr2e{I`A{J}2V20RfkKM#nPf{IHEO5>l}W
zuXcKI^qCPDa)v%~bbX(4vGCO9g^0N%@gZ!d#xbRggtz^C!pj|2*^x=WQk}46WViOQ
z>DCY)^bTyX&8}%!HtXsWBgy}s=a_#B-ka9e97sg7h=rLI5o-UAkGBMnjf5o-72scJ
zMJ;+F-ip$MRYd^_=Zcb;D|6v>v*m(DXHL=(7ZW63ptnwW23O;Aoq865C0Ix<Te8r4
z^Z-ez9B45?a&5N|3lpeWP9uGdIMUiM*5)$y{q<|+TD7p3nEF4Vsx9_P1PFmrTdD8|
z30DIZb-ND`7#mZPNCA?Fcs_`=hLBXG?cfRtanHCz*nv&pDMX?!Jd`X#)<7#&{KURR
z?!$Hk-%^4%x14@tax1d!%r|W(a$M7h4UZ>&VD!1`*}m_`afPe7Kb!D;02|exqX}%h
zuOj*VJ9@CK9_+GpzuW!U6|*U*oxAG<>dwqi0(K=T3o}u)9+U<t1i~_%povN`oyGOz
z;)m1YY@_2c?a~Ypy+l|TaaJslX31~^OF(0joe50a(M|9AH4`2m<upD<Iig_zMx{u7
z3O81?q=w0PS<0>`CrkdM$zejs0ZQ&RrORmwYST{D6%;wDZ`DbH-v8-{YJEt;vtrxf
zmT!8Q$pa_065DZM(k6iyBzBtkz8kx4;H>5KS4nlfUX;X692l<cKSILuH32UG1&lSP
zTH9Qc*MCnLw^FeB8j_`s{D6{WUF=%W%y`k;61T@pog@u17lt>$qrD*IO+<$Uxup!X
z;1>b;M9yS#(8bBYrwKCP<HM65F5iJ(ik*gKCDy_aL1O7zkAjX&+4mpbzCAqemBFM9
zCRai+OGJ!8STbD`l`jlKP{m%Ai*I8aLrLokc2gMcicn!4Ep*e>^m<FicMA~=5V6~V
zE}MrZrx!n7XyG||<QcB#C8lpWK?bs?Z`=Je>!-Hm8@7`MpnUpXWImFW(P06wGKU%V
zuHo<6{e_S_mFpn}>XbH9oXzra(F6+^p*I_?PZj9)U;q3cgs5S7PB-jgo`3!Ge{m3_
zA=`idhMkT<K}O3++Yi{m*@u-F%A9i~iqMsVButQ-E~?d3pWf(n9W#Jx?e}_UVB_^;
zr=LBY4>;@cfv0r0<O6FlAbA@66bAGF#K^KPECl;lmO&CMi32OOIk&xD&+^?gj(N}o
zG+ndcHt3P1nUM4%76ko;uep$jcA2xm-b&lcUG_XmM#XhF8>7_o9A>#nWp1!R_1qn3
z*|)1N?nYIvjU>}cE(Sv=5nIwX476tu9~hvs%97=yXi855?d_m^t<~&rbhT%#6~V@~
z_FQYl(M@zEB3~;z@8=0DXVX~NWnppFH_7-yd@gLQv$(a6-da~{t*f`z(^~5_#_amb
zcr;zmCf^YTA>#Aj+a?&UdW%YP2sceY=79|~%RJX`Egk@`^82pYcdR~lEGP9cD-G5(
zhq#yxX-gn$2*=sAjaF0{v<JhxAK>&DiYAnZzu{;sBQKCHwEyw5Yg%vB;bY*N+PU)S
z5PxU#ib(>geg5I_^81gl8y<W{LEqeB=+nh6e*Kc;Mj{bBN0XwXodI5@@fM+@!$!TR
zQPJ%^HjEO#nca*j@LOp)L3nC}&Z}VOmy}WNMx<G)f2JGs4fbl=c)cso6KBOWe2}Sb
zTY3}Ho6Yn|dwL7fTg~)odwLtv+cG^GRO7w5frk}*NhJYf3S_2xVD|BCYtk6oFFPR1
zN3-M3i-~Ebt+_bnazw82Xv`k!MTY6!M*8*+L`VhGYou?dLPS*XMS7I+#3(t-dl9)v
z3)%M=a{U*FG^PiF6MMC2^1xgRZ~6UeD)4Za)+b;JQ&N+BFjP`bhYkpcw7cd!C$r|K
zPIN4!b*8)eOurpX#xQCxzTDgx9sFz3-=H<K1DT!q%ob&{>2JR^vpzkw%noI9Mg2x=
z?gVKqmynj*qkO)|ZMNn1^qHmQ4n&ieH{8=FjF#DyV`e_kbT7jEs`7DiGv>eH@gr4V
z{cX*TtH_?OzTeRs(OSEYG_%XvQPj~}-&(ETM_TL4B%*cV264+efw}j(wKOE3Bd5+S
z9=XlNV?Jq3j(v7~t@4}kZ(nDX(mJe`WkHytf?KjFA#&c#l563)gaJauX~_^1Ugh!?
z8;zy&NkKc@h8Ww?B;C1{1m2;M?y=T=R=Pkb#LaTs6?c!c_2Nw$v_gKVp`GOz#GWEZ
zBC7%A3q9+8oAF^nSCDeY6+PsWTRv&W-zxX@g@{l)$#~W+gEN5=L9wFXWvE_)E^)!9
zwGv`Tg3@&eg2u{n#%lM1sg-25pBRx9*}j`(R+e(FpP5k>Cy4{nlWTiHmN;wSik2E8
zBACQh+ILL*F+n)`b!~Ay8zZ7a1I=jV(cgad$T8QIOlMss^C{YGn?p^r%kh#QCH?wQ
zmikWOSO_O=m@pe$FKNd*Y8Eo*P}58xaJ*f*8=_B&G&@I%(h<4#@;_?SA`ATg{!_I=
z&L%wLlkj8|3X;?#&t0lhcEs_WPNHEkpsjz*hfzNL(jgO?h1?JrLr+}-VVtN;3FpNO
z?QaUEWc2njV8+z$HJ(rm-j%GUbO^pou_rOJCR4Tcw=AF*UQ{3c?rZt<6HT0@>jg^$
zzW7Wh){>;<jT>Id)a%4>pzsE$`1((<hoxKk{SC10@a^IL<%jdbi*Wz^;9YoD&)-o)
z0=1)Mln6KQ@+Ety5)6Tgvu!pk1o8@oD+L*UPqTD#V>|2nL6T&Bi`$87nYQJDPHLpS
zk=n6gyZzYZSyHN^e;!>A*_-GV>e+|=a4=-A(uf|u(-1!EG0adY4VY!_TK!$iR7$C%
zl+x?*I1&a;r8^+H3eCm}ive$8fp^x#?8Y8uIIS3xSo}^^gfy9;FTgwBV}Kat@+v}d
zT%57lxK>zs*Ola>IOb#@HL<*P4kW8>rPnjP*hF+TH-7pS6TlY3^DEBY@H{8CpOhZH
zySlmWrM$Mm&>(GpwGrBWaCr2+WjzZK+6x!%5Oa-<TYoAqEjY|zKT7dvG2>}$roP>>
zJIobP-y7zB7V!?zWOZA7-~|Sb#YQ!2aX8^4jAt3T*K}wd-bOjyBPd^UHLy6U<sf66
z5cFy;^TSgy#`|IkAG0lQWIu5bTG76wKsS~0268wWb_t6KW76Fc2C!IQ%K8A+NvK1+
zr<Dt^<Qa4)48#-$6wl!aqfW5RT7s>YqM>_B%W%sw+(l(<-eRy;;9cxnX0lxxAu=0j
zj!<`%5$ehj>MG-p+ffbzd(JmSAWV#6FOR;31*42h{2U<&p1m+S?8S?T75qH>c`8gp
z{650q_<eCGyb5uj?TVn!(iXB%RqV3oljm#`hGDCt9z8w12zE~)u4p}poQ!~C1igiw
z@!wRRsw07PL{!Fp{SiSQ@E)fq$&2LP+}qotz#eJ~$O6lc&4ed52QAHlZ<e10Ssy)C
zoyhYHo@IgKJT5eZx~4KsW_r7Zwd=Zb_f!$Z&;l_QG(vPE0pSL=6f~NW9bkkpOsE}b
zO+~leXnBE&vD4~$)3JV8NrebvEAedZa4Sm9EHynd3qb93cxoG-<z%Q?#I7H&qe4_X
z9hgkwCjGu?H8GghH!TdhFmS8KCeQ~06$vr2JL02v&3+2QA5K0TgdvI#e+a{i%k!gy
z%W(hX;wTJ%VVff176Jvd6GIpg;}ebPB8rf6Lm2LZ(0YCuzWs1=fEW*3_4prQh@Qej
zOdp2zz2d=5P1`AGQ+ps<UKJs)*W)m|Q_vMMZ-r=i4nbczPmGrLZ-{@#o*e&9M$m()
z^W+8j|1*|eb1}uuH!3uvm4OQC+J4gOd4XXj8IR3|uX8h}n0L*$bOT6{J-6|rFE*aT
z6O2-HaC{;6@NZeU(mtLZy$KKYFD}`pu_c{&WvX3tm7s#djL`1BL3*K+@!O;0!!X3B
z<D(P#)Lgl+J1NK#0%k?ez6r=1qa>LD6;M+Hk>l|5*|~D|=eVnqsiVY;6#fK%=cB9w
zF(Sv*>11$qMP^N3<|bOfFz8tY*i_>gRE+Y%DR?r%GrzJy(vJ~?^$rrWCr4+H$)G^<
zg{uh9(ik}w3~1`B2my4ard(9YT~$U%5OyRn?wJFgrxNsE7J#t|pmEa5P!vLohb*nd
zXh?*v(#J*ElTdcVXZoUc>TgOLE<v(Qq}7&k%NB~}=0Bd5?(A5?ridjb#~8j+9$_rm
zsSljUt7Zmip?U??FO2P>w83x2(=X7l=Fd1G7UX%#MB7u{`&}x@zstF&(32(T&a*K5
zaB+ycnPAiu(RAB1OYy9}N)Gz>GFWsmxEbWpq@sbqDuo<KZEO@y%rPCx2t=ua0}`p}
zJVM;?pk?n3D!stX4`Ah%^MnwgOB%wsDm%XrRP%gR;D1`Lv<sh|AD$ong>70L=55ge
zZN7H4K#r{p`sRiUMgdY^UjA6V!Bz1<4t*jl%CA;B&ca$3E-v33gdY#jFDM;~5OeQd
z|B0FXe%~;UDf_Z!h~X}!P|Go+%nV#RNG+FxaOhY;;(3v41c8(JNn-n%VF&J`4<at2
zsgOi11WZ9m)S5eqz!NGNOpcAG1V3Fe10XMIe@l)aOmFEC#Be;#cYt{mJF;jrxgmgi
z2`eFAhsemnse+hn3)V0j4(?Gez1<<JKT(G)0t-D77-Y?3`C^Bv-4Q31As%C))q3x`
z;Q)Ll;acB+xIFwE9-SOr9_=3={q^vC3y*Pc(Mv!Ow<X^>iWe709}nkC2v5%19gkK1
z!}IggbD`!vu7LeF`)8MrumAkh@hQ|@@AztYKAj(3VlAg9)gY`}{lO{luT?5P7b4y$
zPX#>&5;13uNu#2Omh<rq#l(Hg#1nHDB-|)XqJjdLJ+-iu!&Du8`5Hyx=zNWGgm2Z?
zDCsV$w`g^Jv(hm^-;9jRbkfv+Oej3dsq32-Tfkadc&mQ4XnOU_tEcfiy`)t+9bJJf
z;cuXmuEEu`)NAlEE!R36Ov|=9-_l#SoLkMOT$4v>1uW%E+t1qg(SrnS<wC1Yg(bXa
zy&@KHob?K5@|pE=&vTdc@;7;kcCfPYVUq4NfQL!#C-H47ym@Hemac?t^G(x?tjzB9
zT)%HPe(c-Uk~8|&@)jJ}x26^0TD*>pr#$%S=-A%mtSQ|QK#Ghc*!OHA%&>5<X?90>
zrA?^tBvSjVa*Q$=NsqG<u|ODID~0)fJd&>K<JknCd+gol4g<w@#HmtQ7->lGLS?xf
zM67Lj3Vl?CX`_3AK|wxkR0{bJi9sn!q+>*@mGC{N<Y$O(49k;_PCymv0mr4EPtGon
zsT7s*PF_P$O!*ESS;0?VDg{X(1lE~;hl(imc;PNvYZq}5@`x19Pv~kdQb(X;kH#?e
zQ_-Ef5r%|PSJo>I5ds@4jUQT3s~VI>iI2;NEQPwpco>047hHx1r)YODFcSnh7UMD(
zXAxE$8dK*~R6a_66$c3709CI~>W+;WNZuxb`Wxi**i|l%qCRA{wN^I<SWKTmQBs|(
zf~FdNx6{Ru6HP0pSw|w3-ODLJgInguqff+ql^27iI-=1VQYKz9^vb~%uRQQp1zOMq
z^?>gpc1Rc^=Ioa8ZpEXhNtFCrNE{Y9OUiSW`l{J2TVpV7O38CuoXhRaEVG&mvet(F
z;UX;7Y${9}I)>#%F*hLE+?TzsUFV}7J>~cEClzhrMtiqpn$Y;%RY2S{$>k!POv?t#
zIie<22Aiv#DA9CQ(6rE+T|Z!`-vQDe(d_AH8s%ZZf7@Ft+g<c4pN$`p56|4SY>h!2
z;-(2qZ1Jz9OraGZk3nhLG=x}UJCO*fiGvy4h?7rr`tFu4-+UqOr8S4A_v8mImK>cX
z;_0_$jMMD4!UL~7qE{Ul>e9C231q$mWjt#P0U5Z=y+vQ^GV|}UG+X&6|GxK?+j?aR
zFwd{oURB~;n;RLg!U@lcpR8Y2;Z2JRz!?AqwES#_xJOW;#VPKv0qtd@$XHPEvS*-O
zMf8Qhl0s2^NC2IuZ^Igwx)izUL}-pZ^>S~qAh?P=ugPSqB;QC$dQID6Y^0vk_drlg
zqh7Bv9Bv4TD^-N@VilG{D8_-qwlVOA9)voijqp_?`)e{!5CLnBPC%tP**^|1e>^+9
z2;YV8&d&BjE%x~01n4DJMM8<DqnklO1rwYZ@NPn>!tfIY!wjr|T_?Hb3&aQH6v&Z;
z&<EQJun#`j=)!A^T}T27hCi-{E}~7WDKZqJ8$27Iph!#dO$?#~nnw?N*s?a>2b&lL
zEx_s4W1kR0rrzeVg?CV%5~vgw80<88n%s%z>sc_tuQ2XBXV*L*W4vP#$dPbTMP#rE
z??Se2aTkphCKTNOLJ8D_>4?cl#Y)^Uy)JqdGr58{y0onk&lOFm1i6Y4PZeltl$PRu
zeGs5uu=slHl&-}lSJ9AU1(a0zL~aU*_qJ&K?xF%@46JRVTiir+`%N~FZ5swrqtp}b
zxPTBrIJ&d~w1B-!MifC9<boi#X~)-P84?bg&A}4dg|{Pd|3&3@Dve>ITgi)}Jt!y&
z<v|QAX$cr84kdY%s09`+UIEgm5Da;j?wFxeM2RE89{c)<vviOS|A=EXoGPjwzd88S
zDb*ah?h~QI3o&=`=7+#@agO2D{YIDYjS$^yAYsPY4Zp#LHqWF+B;(>`At#8mC`kq>
zSFj2jIF~>K#d}3aHp2azp|L0k6p63^7FPV#<PxFEhxh_9AjCx^bncu(3t~a>X<cW-
zA-tihQSyTq-Hn(mf@U+yx-`riT`W(|;9*r!Jry%)IFE+K6t6k%q#J_ZKcQSvA(R2z
zf(RrZ-h#vyCBJo)0+gWWh?Mw0zOF5&VHgPh=M+}IKuRpiIS_X+twEI%rE-H%Zr`2R
z^&=_pUB#8XvyX{4v+|?_2OxnThp+pRF{4R6i${d_MX=MvAw;U77(s0-XnB#l)K4wy
z)OxGvJ=&w$d|~2jX%-GXF|=gtxG{dp8jxdTp~^kyb&Q+;gxkgwU}JgiE1cHW=epr9
zPso4^D(Zn|Xcg&Tqrw>g%bGy+vie%UuAOg$0DEeLfx-oRbIWcwQ443ziJh)E<==f(
z{yUEm+HeOYoIP*cALC^e^6TAo3@6Ge2vN~mR0S(}SFeaHIET?S8Y!_a<?f>kp};OA
zpK|}Pv1vDKDUo+?U>R#~xP<#M@IG;u;wE!i-A73264NtJh7j$B-L8=#U-A2kcklBO
zixF%+C5S4@!eklGgty=@mUJP><LHkiYmUr1lbwsKaOkIS(DP?YfsTSO_tLQVt%SPB
zAvSTxv0(^{U&fY={tvf27b-XbkOY>!Nlj<;4gdiE|Lk3RZyGre|2zE@mMW!CmWD@~
z$I*+95@^v8KtP&{bkb^pML{J%SqO)seE0K=pZjJZk)kSX)i%3+jK{P7jXmQTx)ej|
zCApZm*)wKxry?UM!PN3jVYI3&hKN9qo5_Z6_mpab^UT9-;+md%uoe*XDeH1m$g*AS
z@_tVKB)O971+9?1V0!B(wvo`v1eD-9uL+6#RLOvXls5Vq-P2)2wx{w5MVG_9H7x>(
zA;U}2NwJ*)_@S75YZ*-=EYV{hg;f8m;8~Y@+9vedFj%k#wzl{V6dW?dgF0~95G|ob
z<ZPycJ1XzA9Y-y-bWw*@h{A~lSPWN32=n*A${Z8$i!r%x8%Z6yhoBJ%A>~S}@>4og
zOyG<V@g+=Pq`W+oyiY#jVnx{%PDDv#V#LtJaM*HS^(j(lY-915QYpw^%DDhMG6lm@
zNJp9n){?$C?jZ;tn+LonBVQb_fP41D`j5)yRSUD@Q7)C>^Tzuy_jIcXlC!>>eQ+2S
zFi&9qi#2k1=ml*F*qlsrZCgKK;;^R_U+5`F71GG^gU168RX6sB1xKHf28}xOqI|Fl
zzOSF)Y?f4$eToJ@m1G}0dHJKc62W^)!Y!VVa>Z~B6O~1g@ya?og_3i2;J}{2++gig
zy5#ETNt+ignGtDNqwS7y8(LXVMx;5(pB8d?h&_6iJIS3E217d}z)4JlZWBjLVZ5P$
zDO~B_EWnc5Z3Y-cE`0APmceC*fH$bn!A=je;kn<1m|-tidQ^<8y|gHPq64W)vwBuA
ziUpE6D;jx>*I`dr_q1Q>|0S;jn5Ns9`@Q_53f@dVz-5ZBH=*WUf&%eKf9DL>AJuBN
zU2k>`UV=QqZ)jO`F1*jO%2#hYb8&FjZc0@P&Gr^Fc?pQIJa0pR*2GREL|U=8AwV|p
z`nv}L_+=B8B6=SIeDwDAvZ5CychS`BFLaR-m#p)o^BpnSQ5~z9mbr|hW;o-YVf`oa
z6xN#|<xAcVQ`4S#pLo_Y31&Tj!hgk)c^s+9Wg?SACZ3bDIEl$@FEP85rQ;f&JQs6D
z;WPL#pF$961%JZ-S(eYdW6Gm7%&sv~BAza3>aTJ`_6m#7RVZ{V3P43(yV|Iu$1g^-
z)%ncY3E;@Ke>h(P7dtQT%c1nlTBH1}Yx0D>y3cfCzo+Nm2I`nfNB0z`N=l7(6+{Z{
zUaW8eNpSCAnqO~wRkPK(q|-%r5#U1K>ouz2=3Xy1S-BS(auV7NBK7$sLW9Js;lAL^
zB^{3%jz%a)dLofvFN!l{$4^EsF$t&0^PRaC7To(?)BVKx8Ds?ir!}{yg}-qfVe1oB
z%g-^wpP?z|Pb_&#7MG+-j8_z#8+ozQcfJ)chddx_+C_h6tCk*fl%M=BT2uR%V>154
z7{d1^aOyH$%?XSD>WIxrK7W!oj=^m<Upz62?50Vx_noA~fv5dzMF%c_L{A6&FWqhX
z9~R(pi|ek6m<iYctF0zKY!ik?F<QTc(enmOi)cmc`48hg=YZPbri#VE4x(>F?jGi1
z#jP%VJOzbNka}f2u!ZdN%N1sa6{W$_$B%x8%m)b%V&P5>9NtQYF7#39>BI?{S>f2j
zCOWB5dBw^7UHF-Xr+y~OT`Qg~)&RP0Rx;a;;s*}Z%TP3NS&p-Uh`avQ9BFR~9=lIt
z@s)^H2z|w4)HGlDNZkopcZG+fesv`Kez%QLpxT^s=~CJE0V=~wZjZL2>4kSmJJIlr
zo29M#7l9ajQtH!0!-~WsDN0?uI_#6bC~bIOEp{u3Os?D{CTmBP$3KVR>cJi-sXn*;
zEsr*R_2OKHtdr6C==1QnSWN0N6xw5u@6d5h`3|8zG~X=H#+|C9Ng<az$2;bv26y_q
zv(XZ=`I6d<$~~TE8*rV4Ig9eNW)rkh&NXjcDoUh68sq-LT5MQZs&;X&G&EmVti@#J
zkk*IG+0>?B@@0Sz{sQ!6eh{=Gc={Vi(kGr!rsr)OZ4yAK!znG1&1^*m))a5^JHnBD
zjL3KdzBm|9mP)|}9>UkmfPHB%?j3yq4M-TfAm7mJHX-d*e=;6$pY(w}bua_q9G*IN
z>H>He+e*Y9GmEt5j$Zhb7d`Se4UpRuRXjG}pfbY<Q)%>Am{<_9Mt7<S<A)mdP?*~9
zW^-;?)-1Ct#~!UF%)1>NCT{Az@2%?|DK~G)O}W!4H+#1wR0|;GJ?Ko#jro2)8G{`d
zZiG*l;7fr`Tvh41PwSMw*6H5w76wwQ_nOsim(*GvQYP(kr&q6BH_9E-zV5VJ-6}Y?
z+qU31<82VvCC9-&k8v-D;LJX81Rrkcobzy%=r**l2ln^@T^%4?PQqzLuR>{na|<&@
zn4_wuK^&VYPhTMU^&dw^>-Ab(Jfq(xHsu^$C`&X~j_b`z<NC6CX?ClPnzrEjo=a;*
z*w=lb9p`!rGsi#Q<F@yCfVZG}>D*1meddd?#CMQ{B5Rt#1gT90SKvRwzv*{bybcgy
zStThfh<?jF;!#*1rl42Vp^Lvv1+8b&<P8|1Z5brwxfYaA{t}5ei)I01HxZ@=czf37
z)B6f&GFYq+L#9yWh0?0UFlx1yLnk1XYufB`Z_!BE+6OP?9koPgDQm@H<?*>S%AK9|
z`^S4>rRwhuDc_Lt4Jm&oq?F(G>%d7)&I_U>@8KCRlDFhRNb&SF;UlLh932JQV|W#V
zjBZ)l2N&7Z>qMZ)s>C7UV9+lP?cC{Tv=<`s&fehg4G!Pn@OOek_F=ycECgDDfzaT2
zsP%VnpHaNW%Z-6(xgADgNPIUy8bmd`16D$d9-zcWuL&iApm2!9*@)s(3^;0%wGT3i
zup)`DQB;aU$3lNpELfxSJ<nEUcmD$b0RR8&oJk6RFbqYn;#P5^;>y!##S3_UkoKnz
zvCb8$WG4wG>BsVnm<k_-kHW`4@zHMWFbIiiUThYTz(cQyK#YK742gj#X`6zi_`XaB
zBwRd0PgsZ}vM!Mjw;XXWQ!4LNR<_T+n^H0t1<OJxC=?V5ev^XO*kLfxOk{6#iTt;>
z#9VkGqfWbO5fT0d9(6PZM`JpHMwcdfPOXJ7v%=D-ZhGyCDXdGhiusn(SufgeI=9G9
z#YG9luY3qRuEDMHw3r)mkFlBNlRcz&k^uk!|Np#QYj5MW68-G_3N}CsJF;CpZ7aFS
zh1)DPi<>w>>}|JL1cGEqj<J5h4`c&u``hn4NIm?D9UI*b*+im7<jjyWB*k;ELYp%Z
zGV?a)+$c9`?PlSrBfV*zH<F&rkU=R=Lfd2OfgLq!vD38-r>6UcUblQ#ue-Jthc&~s
z8&0=wherZTx2<!hz5<wz>>da(fZz|amfsRc_Bh*umA-@zJoM+!L=Z`cudV21F9_rW
z_PAPg3>P$}N2awO1Tr4Bk*8wcg@7zpF^|`@Nz2gH5K8>faFWG4aFREJxn`@r45FI7
zcY^Rm8&cpj?X6aWz|<XZNyJV8bELWK8j#kUd^8Sbxrk3~5<WE_Er|QQg#>A!WCE#h
z_!*`VOfxKvvetZZ{B~Zf?U5I2vh=|@t#(*Ws~wutYRAcGx9DTvoK`zLr`3*<(`xU?
zX;}{k=d{|6Iqe0W4@**7ZO4>WqaM{xhipFKfy5_77Y&a8ibxmoyXoYhO}o`>d7TgK
zP8+`?Zhv^hL-)<UZtt7dLPx1faCzBYeU-$n&@`MN2;<nYEYoT@b{spA<y&>5W;?F$
z$EInyu^AsFcG>5adk)j)b+N0r@TXarxBf_yN6jOT>7fX*hkxx&kxptcSsT`91Xs^e
zdF0W|3qt}ld=;H?!ILC7j8YYH!u&8qC|HIroA|v*1k`D#eZ~??Fj{kU+C6Tjv9eli
zbal(nEz>aG5jPu$#?1qjrWM|&Ds43YuL;^>DQM^PySC=R+RKV#+&9gJADE6^ts+Bt
zWOc3D5&`Vm$JqdDZ=o$}4GRpR;eUK&c*%i_xhaRrBXBzorXBFJymU*PolU|?85&<G
zOs3<x#I_+OVIg{B#FE789<k9~;DNOPo=|Ofn!o?g`}lbOXWRSyK&USWdP8NA^sQJV
zB+|2zn1rGNKPp#bMZ^z*Sp&W;dkKo9w?(!h$bQVCz!N;~!IwfwFBXdn$gC&0rzu~R
z$iZjT!Q5ZOKj<%b*&7;&+M0+3N83eguDWlEmgmV>E;SJSDPrz42El^>c!g&!F!GJ@
z@)UhJ3h8;K*=6WRh~v12i|(#i)z(T&kC1878mY#vMAA$pACZJob0xRSB7LeNGM9Js
z4tZi-js3P?)5CgX={`(b%&=>Qao2<ZP;<h1U3Xycj}6}r+@p;B&bjWMo6g#?ANw}V
zD5GBuw_!D&Hc&g|%Iw4R!r(d2L&&9z?VG#X-<mL%wHbVoj7QKpdkoy^U|p?3oV0A+
z4cywlKX9*V<xPf)9d*GY^P#cyonb-jv7L}<Pq1rAMMmn{u?~R%p^I(T3H_+y$K5@E
zpfVD7K!VDYMh~#+NR&rE2?|Q(bvJk3=N6t1D;Q=0PaiXEC?u6V%8ZKB@t9%BN_-w%
z5Q#G19E@L-hF?|sB8JEkI~hbvC-2z$LjSH~cZ7fRHuVs)DJaNRTigW-n>U|?l88b<
z|Bg(ZvMwFu(jbV;1=MJ?ARtx9vWfWfIa;Mw$byU`rX1)9%6jvQbcw|`tVZ389XGIJ
z+jQ-k@9K_T(@njhH)`F;u<Mp-Mn@W|Z0Fo;Y#gd^BW2?l#W%ODw1k674AG0o-NS*$
zNkF#?I`<?>a!KVqSw1o>I~b3@Ehe5c5iupvx}&lg1eX3>(U@Sif%M-a1|-eX&qWL@
z3i|j4#!<|I%QTx+kuVCC)f%UKS56$fS5*NAfRqC}nsulB$sA^8=|I4M`g6f;#-rK$
zjJ)Y+TdlgT0do^GP8UA*7<nPjK6vPr#$H)?+TFy+&U~n0wZak1sTB@3qFP&93e!gl
zNMg%sS*q_~!wnU;tso3s!_>`cHLlx!(ACZEHgcm>z?y}!^d>`c5QUpY{}V&-(Ek>B
zG3rkgKMdkOi%rm9N%SXWk@>SXfuv26?es?j99A=T&sKO2{K1R=I`g<F!dCEWC?O_{
zkD{DLpf`9!e<IG{N9jbU4GqXx=>_fAA;_P-4&gE0EVxv26otuf?LBlJVd{V=w)k;C
zJpOv!@!Eggb(+6DF~PzHf&0r!_GCEGheqrprt_GJ$*M2a3*Dlrz+5o9L;Ck18f|M#
zgquo2LYRK}@<lW!%z-U2<QZ1Ne?^ytt``bi6iX%qa)Bv)9r;7KMJf~%_blovoLEFR
zCnSn2GV+wboP9<*W)^K)N0m~Dm7I`2s?~(~1sa2DD@qMklBtv6))1dB!#+mSA^IB;
zBV)C5HC1)w*QdDB&;IN=AwZ#-r9Y`$rM9?fwr`$rHiE#sk~}!kBi2lMhz4~8RePZ6
zQTTncZAo6K^wp3a$L!Z?A~%)1T|!ctOEZMI#-&LJw@DI4M-sVbZG$P59aC%N6#_Po
zW&}7-b4c7_0A@g$zt$w5>qxG!_6IO3j0xqKz}eB3vuDH+c|r7+|1!5NRw{^k{SlG4
z%T-dbYIH`nW<+E}aZye{1v9nH5YpsSz2eX%!ESNEtE0+SmRtm%UgI|~xBOKsSsOa=
zhgRpQaus@uQ8h$pdfpQy-$&W_j<bXfJMEBP^`{az!N=Rj`y#|ZHB&Fan~f3!>Wa$B
zT^26;Apznb?!Dp$W`E#W#c)h1F$~%BXgEt2tM8f*UbA)IQan)XLx@-pm3oztjrlCZ
zr)H&Q<F^VU#oWO3T~HdAyk8KnT#9*-NZqu?j0_7CD3I*4aK+H26qGsbYoxJNO6f}y
z0NE2k|6v8c<pFaTiH)UZo421nw!F^|VylMBVx0;#*@0FRxKUdI%lb45^H4CPX`u3d
ziE2&?;$@E>gm6jeEwO|72}yjgn8<m65SiG8fNDdGSw$Q?%7WLVgu-wW50Cd94>2^v
z5B{CNGs;Od;WGaE@c8MECS1=v33(raVe{0>qTMXbvT9}9A^a>DhlVgafdK>3HD)qk
z8ut?+vbhq(0R*Sg@&OyaV9++CdZL(P2|7b5Fe(z|5?+AU!Td~`#GegC@f4jgn)VCD
zpN&%4D*vpXigR&#IX#8RAC*Ru@>Beigux%mq_U=o%)c=!OXJ~*Sj{%`0am4;lIt!L
zO7RZ%=k!uZC4>}8^Q}bBE{n4sm^KZazY}aUb}anZqVEr=SEW>I7)*-rxO&+oSWSJ#
z@Z(2bk+RHx1k46%nL<Am*A@E(5w@kz%iOwoef@}UWNHe3Hm~4Q{kY#Hq^y@Qk#u8E
zq>?J*O|x(5`m`BDMRrfaF?ft1NDwp|;-|-Q_fgQUR2Ze1Ke(L;{O-5;)bCOVvU0I^
zLu)Ns4m4%-&H1nD`Zov#7v(G=`BA7bRM~XdM$f->qa{i_G0gXv6OlpC-=b?GiCCR)
zBm)Jd(wEB}sw6fj;U9|=2CVT<8+#`TEv-{j-fKZfre+CS2n`ksX3Aiq5Q@+g!KeOk
zGUoANCY64Rxc<x~LL@NYU7&)nPoEZ~@-gJh)vhIROGw|z`Wy*JcgzS7ZQN&+H_6LE
znIvv_2e|L)hlvrfU#`<6Rso{M#U}Tn=ahTt3iuGa-A4W5Bc*MQ_<sNZ0RR82T}yA`
zFc3cbUsy$36(wO~=Rv{^0b3zaK&3tO6ortWu2Mii)$YGvkL^H`IwcfNRW+YKKbRTY
z<532lc`sdEF%DiL18SYZ=ggNW+tE{50_1Rp-X6{INZ#R3OekG^VDoNE&8EJkRO}Rv
z$D?!}e77AwGFaPvBGlqP&<$Uh_Z6fY9k!NqzqyfPUat2Y2@U!$<L<+-musB6%E7@a
zvxpn%Fi-xBvfu&W*#F>B&CfXW6Ot?zh{yZpdWu^Hp=`>g2v_~iVmr6DyaRUd77Z7!
zXOf7-q9MBnf4pK-hrN_HE;KA`6P$%|7Uf3E)FX@ZwW&jh7n#J0e2;o_(@WZmWFEP8
z=ujGZahQ1Rg=JnP(&u&v=~%8Z(#H-$aC!mjiQ+Vsb&qPKQz?TSLTCswh;&S6gXjLF
z+2MWl{&WweYVxFTQ)orWYrwXWAWFhODs%3X$i=cP#(jR4gBmvQwgpl30-tmu_<-+;
zIx=`V?6Fo$*w=DW!3NHSr};30iwks6$3i5M2sP!UyTJT5ujzXE9+x7R(`Wc9@ck?x
zY}#4Rs%amQv{2Jrjj?KA>>3!S2FCpcGnpPHS6sNm!op)AI|o-Zq^G&9(-8YK#5oPA
zo@XsR=b=1a1!CAMFGqnbOTfwNUuj5?&?0%V5y>mdaeY<G+Mfiy?r8MY!s?h+f$Efr
z)ibLC<##4l!>sCu%a0-QR?D)9AGa+M+CK=FQ}0@-nHTy;4PC=4YUm2SP(!DGDh++_
z_ww?h2gpmTN{L-5aVjP57s(mED+i}lJXV#!t`ay^g7R1|_dgm^dmYy48NP<0FY_=O
zx{_bf(1qS4d$-A+E`R=-g|G0MRsZF`>@((P!Lt;+IHZ1?y6vRZ^5*S?&Z+4;XXF5s
zX=@|`l$-G6F{(44s=*)eFo_1^r^gqz<Uyk$&!WMK{h*CTuv&|zO;JD#qyB{3N}~~O
zmpfkapgVgAM#J$Sm<^^JvfF>W;it#Jy^dY`?$>V9RKTQ8mXy|TZ6#$+e<ic2z!?G;
zF8;pn_IX;)sv0L|qtmfbIZC6@vt<GnRdQ{K&j1#!$0otmYm>t%VHmDPGoEKmd{Mbi
zfytcH9jsduRq^!K*)>FG*R3@C$Lj*_a6=H6nt&SlY^Nqz^G%)bC&<y=W*Y~qD2P|g
zN>OD`<26tCfY3qa1eJYo@bhZ1mfl57@C%6Dq~Abq_@e7D$#XQrP^$(H-HGae+f5cz
zjz5{BP>&R@^9D7=7?>h#{sRC2|Nrb=>vP*ilK)KC{ShebxgwQF81IKRNv&hc8*Mp~
zN>Y-$?541I3?xPr$puK;x~u!&uOBmbkdO$-O15e@`XG{nnV!Ksdb)dhe*JJ8BwN?4
z?hY!%>Vd91K7G4mg?7BgpublgbrNI1st&3sde6rM1})ej9OJMj$M_dv0(c`E4?0$8
zty(X6!HlbL*mz(I^LCpxoSgpo{c$9b!q2-0GQC?)lkt~dkLQ{(ehJgl7{f|0#X4I=
z56wIh=DmQ>TTIWz;C>Z@__yN@ljq?MFd=r*Q674@C&1ENqj-iA7@iTXi>jxZ0iu+k
zZs1#ikaR-^&jnr$>CR}5>M|P7c+0~{>_NK<m?Ajsw_a}4n$5Dn_8V?zvx2R6+-{Rq
zx5-p(a&eg&1KPv|cD4z!Sx%2O*>#&N)g}k4a0axA3+!x@gOCe7+T_%2vQ?XGtRfiD
zCN8kEO_0s>dbG){+vKP=Sx|**4QLY=*x4q?W?DVk<kf9*Rhvw#V#pll0z2CT*@Et6
z{7oU<VD9Ktj*qNrALjP*lsatpGM;SZgH^0bXv9{U%Xds``oR~hc$Bxrf3_>Ks)|gm
zsJSMoB6oL1ZjXxWsv=8P<ZM*r?5@b^QIS(sWXp<zjf(8u71=#1a;u6QuBf>rs3L23
zMOKfBys9EsR<t=8%-t24+Z)zr&$<p0L+4WmiJ>#4gT&A|&_QD8=ys48I&Ktc3{4^@
zm(j^-6Z7E!AIMOPAaM=0jPx~$RJM>T$TGu01F^2BMw+>y2=n2#kRe78Y5j0QG<zJv
zM@YsGzGD?5&lHUlTjH*=zfo+|oW{KgrBYv_N=?xo$<D{JKPGAqNq5r3sq!fcVO_GW
zMTx)r@7uNDPi;&^w8w==GgR~&WoT<TVPB%SEX5sqqH&ew)>}tVfwuRuaQ4VM0X-<v
z*&;y)#{xEZm>xHaSyr-Sc^4Pxi_)Y)J%x>g_ZaOpPhwv3E5F=p)bqFb9!D+@*+ONZ
zZNY3^S&@d&{iYH;Mp?J4EL7M~nA0nCWoYOI{WR18I%iKK)ex1pk9OKmIqj#L_Eb&#
zX{J4_Q$37R!);R?x~FZy!~xyYHhp>RZBzGrOsA_<rLnZZqbx-{pi7BvYnYl;F$Zaw
zk1CjK&sO&Nju+n0FIg?@p<O<vTy7JQGHDeSk_5~OoPb+71|>KZ%N2$GMCL$ZD{$9x
zaVOA3f$r4I9~fdsE$8U;?D*p1^sI8t@C+w4%+w3x#P-}YOYJ00OfNS?>L-Eg;SEyP
zOOt1E&9H(a+v;@9h$0vzw4)%ffgB5VqkFo4MnzD+M4Nm4yFR`!h8(=shpmV|C_>Y)
z6A}C~A#pzEy$^R^;~C)L@+>E~+H;)X4iKrD9hLOYtENNlWU(LG0Uk3sL1tJYG=d?b
zRg-2P@v51hrjvtn>5xAlfvm{w5hpJ=HuvT0f<!O1%Hj|4bjBAAj?tzzUwo8anWJPj
z`u61Q+vC&dFW-N6eg&fM@zp*W-dNftRyZA@`!%W(#MGuEL;j*LzxsQ+qkdFzn$*h!
zC(H9JhYs^yVTOK?<#84pVFLUIxQw5BZel+Zr*XU^yZdH3EA?`AqVphbo4C*632GEw
z*PT3=<6Lj7yzA!5tLpCX8fmp-2urHjkgmH<>^M#urolf0ZR9yRMjd-^bVnaf)sN?C
z&&l)pGn(rGjOKcq(RjIQ<(BD$nXX%z?^<DEiy@5WdLW~@-eNSaM~sF(8jR+;$!L(x
z97_)bW+Nc#j3$9o+0iW!NNU}8!p}pmdQN&2B}&m*X;KR3Vw8Lsy(~a>Dy#!35{_z-
z5Y(rN-Ne4(XK9#ZR-BjyXud+EiJv%DW}0~{a?|l+Be9>0-MHbAYizNb*I5QL<^+^p
z5ah_)bU04|HE=F?Qqxz2W&pCdmu}I04mR~97s2If@&VTDEz_f~Pxdx^Y$ewe2LLiv
zY!O&w;&?uMvz~(MVH&?GkL)|ppT}$m_+9N9)Xx({8+3Lv<-Qwh_x>>idPI#v(kq)X
zve{l@8<rV{y6$*Fc%g4)_5cR0$o1gODl0h{Ipa_}g#RYNI96<#=MQt_^J3B9$Y_fJ
z4(e2<n1?Md8|DWnVlaVG(@@gl=<;#P`q62{Xdo9!^Tm9+y4MJew?0s1Y4kVSX6vn0
z*S#S29oQgz@tbb5wt;A4_(A5l?tS*x7}sYRM0m1ZGPq`akw+<Qr9LR0K*f5JzB%P6
z=BeZQb{cpIIsavTmRtFdQEX7`F@}xYID&k&2>#P%QH>unPsZ_5NC4F(_w;5u!)xgu
z$6C42rmHVXt&DSq+adcZmy<?TrK0g5;X;(Qq>VAM=t(^_?BP?xerU;K;yOV|OggFn
z`QJ|Ou61o)53Mw@3?~n=-%{_kJY1&mUmDFj_3j53>61s|c{uF{p{-MSQCmsNfdQI$
z=7ni&`*v<vdFsVs?&rexLo@Re!-z8@51&U`_K!@EmcuP+8UL`qkI=&kH1U)3H<9Nc
z>Mla<(Vl*JU;dy$I$c69+p_e@Tr-6m*iLFA8l<+rcOmjP#k+^^aV)jzGL4qS^n-RI
z;!G5K2e70Ru-~d86EBy=0`D5qE!mQ;#c#FcBYfetiPtZ`MQr3-QOw0md;QJHi~25=
zyz+={K|pGo4p2`CtT<Z;cAbV-ugbqUJAHTZ=jiptn{T5ZU!Pu4>GRhYm&ef$#}}6;
zXQv7lfh*roF6fS{$dmzfLNj^-L&N4|v=wV?C};O2Je{K(kKg>nsGJq0{Uk1@DS=fa
z_wZVGix1c>gbB?+`h*fJkWS3r=xCT`;*fK*M>07C<w1u&)I&#5BPr2D33p+TN>Hf*
zx^4%VnH!lal3^-=T^Vu@n;OCE>;}4__z=&upJEK(5`#(*SBd)naN?h42rjbVMRK@X
zl<t1x!zXJa+H+|m{keYq3cL7iowF|#dKLf&a}6tuAB95SRa+An-BiHnXRtXF-&rE~
zOj$C1R*r!K6;e9!7sUvE2TA`OB>i`g^j;w8f2d>X+?Tiz^_#B=KHwd^QWV{a`)F0=
ztwMqD9y&5U88z&!mHWT~g2Z%V-*;UX;Uq<xrcNyKBnv~&^g*kNpGkhPL4<L(<d-*i
zwVb?@8MX>`OQ1{KQ`={#YuB_6x-lmCVP6E?I4;r~&*|dQRV!Mg)Xn$CY1}XCyCv@V
z5oR7_q9ZWC<!q(HDvr^-4)TCtIvPj-$e9Kls#g0i?Zv4`VqxV^*o#>fKYY@L$QaE}
z-MgFP_t;L}Yt#-$yT@v$xX@#SHe`pVyn7EZqFZkHmCbRr2~O8@FL8t|L>&D3<~Y+e
z&>qJh4eei<<68O~vS7B@w2n9?BZ*~BQ$P*5MD8tPWZ#foqATG!Ej_183es<F#45S=
zGA^zS>6Zp+R!|+*CNsh4zUahgVKM=~;~8!gonBNFEkkLIKMJ*zppGKlGssQ4gL_o2
zE9z#ghHtqj8ZOm{v?Yd`_ga&B*SNGYtBdnl7MO|S<4Hi4gu-$XBQyrgi#E|7v!h*r
zOtxqrlE5>wX_D&Y;)sN`7xhnx!q!L-cZ3PlNCM@PGEJ(Kh?#!<8zXvxI{C}pvYC2v
z7UhgSjcc*-1agDso8HCcZMCl&p@sXZ=fV>5ZP!jbH*-8w7`}@;YMR@g$b2JxrhV0Q
zj;w9u7I}P&<}iewD+pL<7Uk1VcmoS19(<;NXDH8OUPH*O&Cv9XU5L)L5tDfJHsnuz
zv|P1q6GAy^H+0~}C^ti0PXhxOK;i}B2^(Yh8T+E#-DH1tfg(Stmk617t8bpH&OUkf
z-T^?|dbi}!$I3S8dbS-Vd5+i|rst;UO1A@yxJ9NLlDL%xhc>W)g&e|v(o?mLZa-o-
zo~o14)v(@nEOU(84uL+=ff<j(dY&SV6=TpJ66e1`HI(r57y*wIB`gwef#Bf)Bg7*I
z0U%ih#zo8tG#+#`P}w--A3^AS6!C3EVvJau>OP``Zbf?&lR)6tbj60J&61@=5d+P9
zjhFGJ2xYCHD`U#bM55^WZZXIB2E{6h>c*ojFU~Tqy1a?eJS9GfbWQML#9KZt3P~iU
zs3BY#K`umS2VgCd(F8v#PL#=pF}!Rl7$9Q1A&A=m8tlEQdnT3E1X%oS+30#M{rAZv
zE+^PkBKtxr!@4vXJoJjnx`@7{Oa)b2>P}cKh*Mll(_0MS`c^Da4nh1{R&0|g{Tx@h
z(|FD#WDn2LVhXw)gK060=#=p4@_0Q{sJfLjqoyO%U`e8E%$mlmnwIP!SoP+~9HfYh
z=h=;zNgAY+ZoIi{EX^t@tyDUh4D?cQA|!z|*X*d-D%G`oG?^;!zG^B$Nv5H=BpF|(
zpM=8YgB5o-O~zl1@RS6EFf*qEZ-pBu56rkq2`t%!&7*^Zwg_i6QbH*{61z8iWD2Hb
zjZOOzt^ig4Md}k|UaOWMPYT7VVcve2F4krHsz$>DN4emPn%>N~Wtd0IJ1!olC0%_?
zy3(Uc*YuYxlP(~KrE-)=zXowS{;!j(#?SMMvp2`5Z?SvwDf*zJJX6~U{48+;C-og+
zB}tl_N$k49v$D_$Q#1Bqzl~kduo1kQEs813?;izpV4;1Pf21#ef<+3;og#2oa?I7u
zT6?`LH0XHK#;`cHj5Tp+SW1rJA;8@*TLU{detUYU0>Lr-FLaa%xwYhe1?yF6m9}U8
zTnjNY7ZE{N%q3v-YMrPxQfTpYj9Md}6kb=x_(>8Yh9ZUPxGftJ(LPM-0yxcbO6LS5
z&&$pdrW0GfZ`o;T$ENFKo}b&f<q6*mGb2ciBo5=uat{UwG_??;>o5Y2mphJUJwc$c
zoQ6c>OrXy<$Etg<8oE05>fz}96knD`B3a`}P{%;9x-BhLuehtxFEGM270rPIA5<E4
zCem44G#qs}`>XHbTS4~ReTsqx1y<#1!Vf1Rn^PtG8)@VuGrwg9H<|I1F?>@|N1HWZ
zTkdZEv8LGYRpVBRB~f|kEeS4tM4LDA_P@F&-P|>dpSOrNNTbTY^eGW)K<97nu?GDq
z?sp%Bv^#T^xT8>(P5SuKDrPVC?#1!t+4~<NY;^R^_wU{vUqqKDKOH0T6Uh%8W}`U-
zZ>jG^i|}SIr>)bI%?3m`I9Rzv=#;5glAzJsmA5m&#}b4Q5!HT4cwT~KQGH7~-<T^*
zs|u+*RaG6u_m^=2Rj6J+{)7O+a%8boaVMj<ste3KXw+JaJ6S|BK;1f9M#vly?}-gi
z=fz?P++!vA66&iR<yPr3N@r8xESnx&Pd<lgs243xa(etD%G~%N`G>IlJabYf_jEnB
z9NSIPG}wr&NZFZn&{yOdv@813qlN{PzhC1V{z9DuAUHSh<kcR`3^7BGvHy6X{ZO4p
zSgvlOJbVd4VS#>13V$ml?o=KjXJM-i_FbDL&v5ZEuZ}ZFSWS@`fB*LUVU9zm57lXG
z7cYmow#W&XS}}DPf;N_JvcBe!E=qt>#``Hk@FHNdIARp%zgmXn`af&sdR{DHg`~6j
z3MUB3Y}LWE!1)E+7D^Kf3W6Z!@<;)zBLhck0Jk`1vX!LlGH#Y;Hu@gux(IT|_tPxc
z@X*{U%7eU>ETeD*6oredEU*{_UM9l6M0T;HMWG;mF@>yAXfJ`!<yZy`so-}xU_un#
zmDl4Jikbv@j~44fu8`%!6e-%{R($$$k=`PD8mxB@=}+fN40Y0MF7vl(I$HpL-LDDD
zh9--}jBG~)%Z5P|8m+5&<90!OJ~zgj?+6o;pTU=zm{Z(HX~`fg>Jk#MiNybJrl2#;
zk&D1gRh$@=p@T;<+{O2ah<4?g(+eLc@GB6ag0QlfNzU0>F1`~}xhK8Ykr#7KMF|Wu
zz1f)=`1(A1G*{v|yxWpN?lDrhSv^K6n@6NCN3%E)v+~ir%cvA-xmqC7_`#+zV^j1<
zHdB<tT$b9t$nxCOb;C3QFLS+c;{ax}Brm?rRJ!$zw#`FF-V@;H$A@2Oe?vwicjM>=
z)<F)v!OC3g5vY_fJ;cguCFA~0E+~+CsBOwlTUntzYV2F-rN9FiOlE1)a#&w-xv~Gb
zzes*r=ARC*2(V8x@H}?{Ti#Lqs2U5sTtF(T>=WJ{CsK2Vk?17#nPghs^ZB%@J{?Tz
zu!|H9#Pc*tj^6VS`v*oOe5Qu+^chU6Yf-kP^`tYo0&p-A*ER#;>be^nNn#p~lXNc6
zcJbC4Z9k%eh>%VqLKUjAI*Nz>$0-I|D+U#BJcx^B{0ez2?06fGAb*x%+N4fXTk_Y<
zbN+_}{uZ@zl}#60X?Qz)Gx5HBh4Kg{lV7G|<4fU(P5!r!Y=U@pnJ%G^zS4|8qP1dA
z-;=R7N1$_@e}83q`&ZG~`4vb6urt%S+<%`R^TAt{<GYj7ecl<zn(--zzk@peoA<9T
zFQEdI_F9@gyEL#7=%Y~ZLrnp(DIBuQCk=8S@UP>Uv_{TLDBV`NO0*tL3kr=;NAN+^
zIuujLe9MLJU>m+uN?9S6Ga2e^#W-e|%I!{X#Y)>phrZWbat?ARl?Ihj={+()5K4;q
zbk$Jw4#*v4B>i$8Q0rJqmgco`g(hYWcY_l8)thrBkb^)<H{Hp(u)7%?T<a#5VNSUq
zg<JxuYo5jp|DTqe&epFw7St3)-31qip(7_7lE-nZS|YiwY5P}P4lU41V3s2UU668j
z%t6<}-KsKNH;3oGiXnxqQpQoKLO^@VHM~{KfzYJKQWe4%BZ+|aCJGoqoC8@^oV!FS
z+y~Mg`M>lS<87N>w31IFj-IC?S@Vq6zSPKJg}oyh8DUDp1I|uR1C26YKQzYObRNiD
z)9x(Ab#W%O6t(?E9$tg+{QvlRkzDBne{gm|ixXvK3;?cOyg7S&%*M?IN1)q`sLm<B
zG~x~H{cVn&{|5j7|NrbAYf~FX@^knVW2#IfArwh~AeNzu82Lh#9~{P)T-nr?9!pRH
zD+LJ~2kXCIzvj8Ki?Dt7;VL8+Xm=hxJv}}BnrYxNyIb|mdzlR1G>T@>;Z$wlFeuwp
zUP{Es08d6N+Bc%RhQDXv(Z|ktXM1-O_Kcm@c4yRVrNhEKqj1M?_lq4?qjz%qMVwoY
zV1R`ze7OyQ?!kCH)lQxlDP>{9TiS5Z;dH=zx!~fk_tRUvHbjoa^J&$s9XW=PGg-xU
zgYPIe&gA^E4~p{|5@zz8=&}hkQ>APvI`tUlLZNya`|N<h3TU!Q-oEK^ozMCke0kG*
zR<)_zp@loGS!I+Q&5)0%XRwtJlr3aR=S<GBx_(e?B5SIR7jw>vd8*6(CH7C(Gz-c}
zBqZ#__$?v;suBq4!ab@}wEnvqeTZmeE*c#sxjpEk({u=3U8Pr2dLeh5l1ks&X+3yG
zkt2B%_urmjn%eS-Z5y-!OUNk05&R~78!G3g`YR@SnQ6XflH2)7E}deYkTx`$b;UQY
zD8U|Q)NRw++}*9WI!n)_r5c&cr6%&LCXvB@=mM>FWxv8jzD}D++003*I+-+?ESbBK
zDU%GhMqDH^kv$j$!YN`v618GerkuBPekZ$YP@rT({%(10V4HL>vY_pd(8}d4i7bk?
zyTC6nD12p-qnr<0JHt-%$3|nPb3RDh=dFIHXzL4_2sgmsHQ#uJdp~@(>8fSlW|7M-
ziMVQ5+B@tWpY)y`oc0bAO?OAHdZ!(ofHKW)uF$}7$C=e65>QYHf?dvsBi?nsD2WWn
zB>!Jyn72;kX1xJN#~(T@_TOBom#1%4rPbaQn{yRk+|1-u(Dh(ENA1<LF`HthLKK4M
zH(8cmQiK42b-@Yfj+l<g`ptTVu^R*Z4(FyFVDd-LULLFGt^}=KQ8a`42_*2t=X8z~
zl*}2XHm$Qr&cTPK6*i2cc^WkoEsf7mMH=2*<8dw}Rs<9r4z$<~g&m~mN>Pmos1SYD
zR3Ku2cktpH;(cBWddlP~Gbtb0;Y;ciCl8cc`m!O$<hrT}XA{&NtBQ%c*XO241wtH~
zW)RnC7({hrb~Bizu*5Rk#>~kkT*Qs`h=j=du%J|aK!E6l0!9RCu)eAZ9TPMZmJYdD
z-{S1ps+Tu5uZM@g9HX<c>C#zTM(`wLmexrkV>)_u+B<o5@FMv+7h78760|Em_iEYW
zN9V1b(O|f_wcU&!KPqhAId8PxGzX4O)0z16@On2|YB7zq;DAwQ<L^^Of1fh?`;<}a
zlu>$polOD-)R->UBP#8BOr>4FN2Qgt+dojqSiw6l;2>H;eiyvOiW?)`=dTM&+)9wh
z#lCRzLyVedM>nsTKDlQ+Hg01YIGBOs+({f^uKg$4e<_o!F(8qNogNj0O;8jA=B?Iy
z%0D=ZD-!W1&hHA)OmF5Uh=O*v-%{rR1$g83LlbWvQ<ws;MH-7EfaoATS~tY8g%YV-
zY9{3q%VIOczzvL^a;&V8j$o0enFNMjFd0(MoJxLTvf*k8O7*YMn@8-8&Mg??CX=U#
z5+L^t=w3t4naltgQ!H@Qqhram<+7g-6HH;M^F5!B(Ns8792)8gA{Ii<@g-sdyqcl#
zcs=F;k)YV8$Vk2iUkB?+%6ECMA5$9)Dkg}>ONmFwm=jEN^7<E588^~K9dl=={c|VY
zmTEA9@rWG50t>rph>+5-OO#V`1>E!&=!|}YjB+e#R9?P4?fnWH{?X~t!3z*yPP(RQ
zjEq&SW)bGSNr)n#w#BD3!)lgan4Ghkl63@5aqtarD>?#0a|yU$&^#(;@Fs)bL3FDV
z=?f8!DW?dMF7GAzS`506H#cwa%DT6#Dqa9WLFAIE4d=HJaZI8Y96nGFm_Sun#jQVe
zc-BN!*60f-?_OVz<5bDbx04JAg9QnWo}R0At=8URY;fRptJ$Fce%LjV?P>4LDc+25
z^!(o>frdS(r=anur%zRTtIB{xkO>ras}I)@4l0pCb)pSeu9aHkZB^A`M8jQrX`Oj?
z_hO~hhH3>|)g@;71W@^`5UAoB9(*CA(}gOrCM0|Jou23hO(`}BrAIeYRiOvfx-Ecn
z3<c=7eM~O+Jq1Lwv5$Ytn?(_V-_fAYpb9?gMhJ$FC;23!mju?uy+jt^zd+YL|Ku=v
z<Gb?l#Z&97EiA&j8|srNocXILj`fvwZ&#}1Cv)jF;1Fwqam>IjX#h`)Nhc1IILh`)
zaQ#3ebBhj^4~-3ql<sg>bkK&X_R2cNB>7;9X=F*{2<PR6u&0W+MFF4J>p0Hk6^XLJ
z)RE5zem&(ryTGEx;R-2Th=OiLH5(W}ysqHejeTB8kyrZJg21B3%t1=H6B_m+uQjfk
z%T4yeJyTDXfa8<bKlOkV4_+R>=&4m)${Qdq4$?+?+sE5oR<VjV&tJQ-6qFy_j4x3)
ztPQ-<rTfqDvOk*@ZAkgG#?0=Km`S@VREfQ9bv~RnR?+@*KEBmvSQ1l7zJqNYz&L$&
zZ2Zw?1Ij^|(Cs+a#5IlN%wc;NOo{Qd^ayRYfQ)Q-1$>wLuPd(wlq0UuEg-L}Y~~JW
z)HDk{0&-JBb3Qohdtq}fA+ljOYz{_CmS!pe0;{?s37<%0q4AQA5<5^C6%8sFOrGMr
z@dT|w@3yb5529V3toS6XCnR{L@CJrjvFmOM%Gw-YTIH*$VJl8=L2^cA{hzN6UiO}-
z$FujD#=Nb^Y|+I~grJB3aSYEuCap&FAw%Bmw&2e_b=Q~=5xWM{YisHeZKm+WY@%KR
zbmXiusB;_DXc^EJ62c*hq*zu~j9w_bKFl;xO8|+%zl>PFM-3tYwQ4|tnd=@lQTTmA
z6SVhuq~l!33lHBBpS~<<1ce4j&Y-~7ohNQ(XI1vHA==;a+d2!)C=Oo1jx`1*WfBrI
z8O$2ec@MAj5)0-KSm_uQxQ`P#YXg##j?ck%SqkrqxM7xeh~rs0H0TBDoF)BCCLWYL
z=&llwvA<YJAG2irL}TgBqAMyZ1`<86R5Q1BPGw059GV&0Nx1VED?)Ob96a$S>Mqm)
zkhyNQ$?-J021qXEAgHTK^S0S%OQ`xRLQprX8lrA8O*2`kh16LGc5rV)NarkIKr3qq
zn3c^bD*FB=DB9Qp6INLGU+Gw8H-<j=xetT1H6U2;TAj1JiUr)DdE0JcBw4eCpCkMj
z?80Z^{}Dw^39an!t5&COzwFB2i~rl{F<;Cd?sP4zMEiD%G1IDccyM~aCK-Z~boYb9
z!xJ=}0*vSuAxkNTa1AjT1%frAgS5Co0^daT^XBJ+!`Hu%WSJtTLAIhkUXSPVG+R!w
z7^TSLbb@s)QIVsoCJ*acE++OUvW;Hj@+@R9TZSY(?f5FaqHWo<y!swiF>HM;*@wF^
z1X7Ew&hkyRo6u|v{*B%P8AJ11WzB;$ibsY`^Un{CUeNa1f?dYhtTm1(fa39AH>->o
zPlkye;t;+i^^4VUTA>o2v3UmCe0#gYpWMT`SE7AZ{H}H8DptPoXjtXK5v=bakBbRx
zC)wPn^!j_PMAr4>+-QM~{R<+z<Z?WlziXZqR>+lYotanzcc39L=X$6sdIS>aZ}W=>
z;sDzryRt@tc~I+**{68kzZzeDGE1aPaWm@FN4n{t(jS}A2LdJqSd2IJ`{RV$$Dx~^
zqC7v|bC!NgjO`=bt8)!THWFHg2hS;Z;7Q0o@A5lB{=|{0O~;vI8uDIMl?)S~bo0$=
z_|b$DO!OKwyRknTXY{BsOPJ+v<=Olqe30K*{egDAY^0r%p?1E_SUWP<j*Pa|`NH9b
z3{d}gjBuQN=wFU47Zh52JOVc8k!R^niNws~@`&9)!b6Tys@1*p4~Dwa{RsLZ5RiKT
z#`!153t^%-P@5)aHYRHd@ol*yz7}cH30=@X9#7Ka(9pUAH-qk@jYseUTgkj!ouein
z#W)*d!<QqB3;L>$mU^@gTuvraviJ{CZoy<SEM|NpPw-4}YAk}m4HEKY1+o-ic#(L}
z!pHCwbdYY|7RsbL@-21db^wYnA@#FAn0!cM7Q7GCmT$vLw2D+IW~gy-)Loz~!RWnQ
zx2ah*4NWY{df@8wXMePj>Gw2Bqy;)aZ`9jI^p#-?yEZm6y(A*KD3U@1<Zowx@J@$-
z7F`i_x|-LY6-o~Cswx1r?hIYX+Ze^n5VY~Z4%{L*L=%_&425rZLC5RzdOv(kBxIIm
zfIP0`VvTJT-x6mOBEuauZyz_eZXbv>s+vQWUfFMu|MX|7Y$foa5$$Ca?oBO8fn}Fg
z*^<&rqkKuS*#hIYLTQS7rC@|_AwI^z55?288V6%ENq`Yo3S~4S%3X}nX$}gpYB=(i
z-s~3LSRD}mn4alyHX6f0;I`6Y-sT88%5D?3%{A%`71VK&j7;qr%_S<VxoVd$oW;eM
zQcPN~QKprCO0+U){q3ta$GvA?(!7A?wEytRo$41Tb!D=QFT@xRiQBoMF|tR~dHku+
z6Msqg%x2wr!e06C!Dxb8xBEEDSIu&DGrzL)=CVH%&sC%xN5aU$aGeI^QX#l0un5+X
z9hkz?<-X2OPdtW7wBU{15hg{1S*74idb!$-RU}{w>e0KBYCOiW%3LDeL{<uORt9ud
z26a{fc6LA9Sp;w*$S5((ba7BNkuq;RlWEnF9O=eia|+Cc$Gkp9Hxr1Df8gC<%&yQm
zQD^xP?^~lFe~BHWP;jwS$$dqV`N1TbDZ6(>qHjP@J*S&wegzJK;pt9TaBL3)Hg1VX
z+p3s^$(Swa!hP!X%vX6qF_a9Q(|nrlm-9qm30ypnXN)p;ypR97$;$@8nwwxQL2FRT
z$1P)PLFh#_*myQt-Li#RvP`+Yi(MC^=v=C!vAHh8@=afnjUl?GZ6|UW$~WmFD;!Fu
z$FhcWQ&-=nyP`2=GN^CaS)NJU%R?OV1e1>V(TUKe({$tp+gKo7?Un0|Ci6t<DstSy
z|FAU#t${FOJoRoHB$+!ch%|?OM(vz+UVE*$F4?Hb1wH0+teQn&!hp(5o+__&Fp%%x
zH@^=|6bS2tjxXiWUd=lSJR;^&IjKK_COy6-$f3yMkter!_sUS=*Tdo1Z$f~g`w)>7
z%>_EPSKWo+Hq2osA$Yb#kt?N0O5O)8B+5C{3@Kjt=Q<)#JiI^m4i0-Ks&;|zEBaei
zislvmY(BY|smjG@WB<<)$44Q_w5p{=`&q6is(F8mr*x9ZIbLH(HyFUw1>XeRU5pAE
z)9!c2e~ctE%90tBqqv636gSCHnbNVZb&e@UZ7|ZJYFdVeNT+IlPg`55!d4u%6BH@P
z%T3=-WaO;S&gQTNMRqtr51CK^TkHSl!)XJy@!yvI?KEKCb)5hn6D;kT9Jj>Pk0%Ub
z5u?)Y6x|<I(Tf#epU0M&bsYrEq89h-1Ozvf?u{Y7Kd3V_G*88VzN{4>DndzpUhQ%<
zM^r@zeop5Sip08Qg|YV;i(@ro$iwguYiEiEhv=eprywIbFkpaYkADw73E^4r?l0c<
z<sD!9eRxH!`HF4BXyV~h>Ll{4W9A0q5>bZ4EfC`o;rG)$SEIzZ#JtiMNaHSuD0OdQ
zEWx&B%1cz(Zaug{`=J#!>0{{%o$Vd^Sh_;1_2ZBHxqKBo{Af&Q%T{SUuu5lpdvn{b
zv+$Q8#qC2Yya?U6SwkT3R*d98CHl)#;4MHO^0jIr_)HaEPNtH4wbeZPuV0lz0J$Fi
zZ7adI`@Ns~tdpwsZzSGbKjJ&PeJ)VRU9QTvcVi^!`S`a`63qJn8#a1GA7-)Pz%d`i
zLa)J)5g|LCX#Y##KJyT*f4n2#pXofky>6fzc44N(pg-14FfrvF@l6K7a6%^TsveP8
z%oq^<L>GrQ)zH~`+n<?@00T@*<WE-$Ei2&xpXGg<?gP7r`7OF-%6oJv6lIYL5N_aC
z)Z1xjCH4G;O%rQfdWLVfA7rA4oD;;8%F*X0e|0nMZ{qC-jYem%xxKx0-WrCPkE8V^
z=|uD$UFz80rCS}_yL?k(?z-X?J^2(U_U`4uuZJjLo^@B03WKzRXG@+QM3X<?2&6-|
zj$S=~Z4X=NBXA?<ls$`iGyq_^ttO0Mvr}((cnDVHQO>o>k-L~x4L|EEvC~jd<B&0Q
zNqEZ&Uiic7h@Sxaq<giD>T@w76eMp5s-%zSWasu!52zTVwZJaBO6S5!Sf^fAt&`KV
z?NsAzbH09f)xSjHR8Yl66g8h<@(Y;$Cuk#MSs9kB3DDV~5g7XxNc|vXqW)0PV>X%*
z*Kr;I+z2BEh)vNfb20MOTn(!eZ*26ohSBgIq1wg^@c!X^yvBpXCIFh6ctXb5h=xwq
z*?f-{v-X`)A|F}H$g<GLZG8`dMfVqjC7XQ(ER^E_BQzcaj_xvwnri`P|H1PFnhqsX
z#q=T%!p^k?$G5*eh&~+}tgjRWE+7w(lRTDcoreg7Y?cTD-)^-W5{8se7kCLCk06zg
zjw9gGCg!!xck1qJ);Ed$F3qmYiX$$Y=<r=<VX_^@4#+L2N5o^4^9>sNZo!6>cZ<te
z!Dwk6rY=kYLt!dwT#t3XW{6>uv+g0f+*ugRzmAyVKmiUh@T`)8x+Jl;izFa>(&hmy
zic+q@OjTO{0RRC1|D;`QZ`(Ey{#^eGbs10_jy=8jMM|0uspA9&Jg110ZonD{6fHSk
z9XplmCH?o~-H{UY;yB3)q_!!NB2VNUkK#Q~qtU23oiB!)3-Q70_2xLAjHWG4O<UoD
zbk~o|RiV{Wz=VDb+W@<ANjQqC`te{xWs6{eLhw&=6=THNp|@SuCyvSb2v6r1O_Z7W
z(GN(*A#8)fdz6p3VWU-|tsV<=Vo@<ER%;OKJ$fP9UA3+4bacmY#h8Xop~Kwmk8|ye
z+wk0U-TAV~s&-ca5$8%q4dF(HA*(Fk2j{|jikA?>wqrHkd`GBC-LU$om7E*uzIwOQ
zsg$0R%EyRl8S-NgoTs?`+~CxTDuk7+OmV1cnbkq0tkqgfQz38eK$c!a9mq=EX+j!9
z<=J(+pgenyBbTnv@n960KgeZW2mjEiVp&$k`6^eFG_PEIoha*)Ue*i2+Z*j?mPw1S
zD+N~n01>n)vf7Z5)h~&i)B|8;s-K4O)+IPWy1o-Nihi~}k%wLOpC#*@iL`SPHQLxk
z4nn&Y!r71K4c(v?Wu^bjS>B@5AO>U`hpkVQ;?qP3<2g4mc1kgmr15{HnN>()_0^I?
z@1KzIUJvhXhZm;6?fT4%tf<dIS9o|G&+T`uZqM8A;oUvs;SsEzjk84jkD!b&dwl=%
z@M1La&xV8X6u{|(IUQ**7c2m1A|kOu^x@5d0_n=&U^_fJ{m3UNq!d^Ntz22ts7ty+
zsjzxQL#x1z@z@Q$B!CmR)GE>Ve-|^+bQPtnV|gISi5_;Cf}_+3{Y^QY0MY#1mK7ZN
z6?%OA9Z(zry7u`{X@VMbaM|bNeC}NZvI7+Qppz@Iyz0V4l)4H(eyQt?a$7$zaSK&O
zB&g76^oVn>H6)}AoWhU@CMmJ3%@}idzvBgw<uYd$uqcW;+=@)gH6zREayILSvp12k
z{UM$lkjmN?1S?tHqfWm>#zu>rBV$Ta0u5`DB5uKWW}9^^mObQiNZK&3Z{NO%KP~9G
zt~ay0q3EC2=`h!eX0v|4Sr9ov55Sp&pcnP|YxvVL&a`%W7WQ3p#$1QLg(<z0V}uoA
zdNqF<3Ih17NRGeJ2XJT6H^~V`yDY+pz*Za#xdyK12F)grOWmaKMDYrsl9bdHblM|}
zaU~hV!VSK|l86Y_*6&=VRs+aFz}lk>E#7P%>c8i7^ZMX?e0ni$<#V=yd21ltFoeZh
zK}#(Q(f@XonU~94tZs_s#%JTv=i<E%jdHT6E=T*eTm;Ex#;M6^p9^i~{IKH69Is@A
zXF9>|D@gMcN0%ba+e6Zo5pxL>#e&c?ZJYJ?lXTgr>};v*-a=&sL{^sVdbh^;;>k#U
z-UsWYq0}%Ao@fKFWi~Ra<MwWiQ<N35jjkZicgzSdev1_t2ZmsxUq)x7z%c-ns~UQC
z=hnDcB`gXh8b5wK!b@fj0B48^3dFYn;<a3`MADzbzQkR~9*p|n>k#o8TS7pl)9ayQ
z@Hfpb`Am&_#$y7W5M4>ix(QkgP*GyFwM9HL&}AhGvm!lEary+s6!}0c?ue%tm{!zo
zdm*=i(6v}$%~32#&$gJFUuSgTIjcSKb{n&it*j}O(|1QFhEgmr4r8I37b_uxG+lnQ
zgh*oW<MCImMYKaA7jCi3tlD?XUu(W7TS1i+Gzm0I>%`S|3D|12<{}Dz81-N40EyV*
zPfwB+#>autIQ$vHYoi?+2#ybmNq@pYht!&tx&!hoNi$T{GuP{xueQ5tnip!Kb44hZ
z)^;VAi(<YtPxgqRiBPPSBP=xyK`}*+u%2sLJPHHLgjKD{y)HL<PUQ$oOXfycnu<P3
z7YW0}2(t-Zd^kB%i&*5d4uP*aNfrSdc9Q@&^4TZr6sa@CFJ?f)2q!$y<dZ@G+`L3_
zK@b1>awQhJmjE#ebcg_1418_GDXkZHL=a;Y_ktUJ(!_}`;fI+#xIxS%lJuHl%jTSa
zNQ~B>T5YtpZXLib!+XW4?fb$&4tyU%rn0o@_0?!_?VnDjBj2wzu}F56KP<Ni{K1vH
zK<c7FapN8R`zGD0x^C1zf>Hlu=owW$<9CW)ubaghjH7g}V#tqCKY;RwBK3SU9{N6f
z8;>UP+v#*Vyt?+!ZzhB5(d7g-PY#T5`PzOPdwM6|JnM-nRdgk7#@EZynLjw4US}Qq
zMoe`M47sM~N~X!&$UC4Td+LM|;XAK6p;aR{IF2L4Zv?W%{{R30|NrbAX;T|V_OtmF
z6NybpMk6!21;JZ{ki@l)p#WF*$YyFzp*1>6Gg?EA|Gw|)nVwPW0Q_z72N#;|eto@u
zNB29>c$^#y!=*~pDtB3|zM`2H1(Qt|<IxB+|4u;;jY4mVuUZ*aO}yk&?w#oJ?G3U7
zSPxsC_&GTckls)mkOb9)#kd;>l$i$u_ly%%{KSj!w+Oh>I3YN~oH&KLNYv%*@CmU!
zf1GlX&4i^q0U&A&2VM~%bU<))vKj~r)=9;yl)DRRPO-7H5ZBx0wJLEY`Wy(xW9Lzx
zLk48Gc@*Zb4OeZ%RI&`oZaBFHo31sATW!^TSEp}HtG`+f9Llu~HA4X7@qmBFh}zL)
zo<6|%%f*QMc^eaxSdnOR>b_F6YgBHh<#nUp@G$U=QMuQG*P?Rw2YOKMgheex0xwJ9
zlzxsP(i1pl5VIn4XzrJ&+%HkNU!roaMCDfEn+jBodx+-=<P5--MVPBTykQc?Srh=J
z^o$dl+Z0=+LVJCrRxmv}VX3;yla`<|MRzf_n@v$@o6Tfw1O!{MB_11u<{xYI%*Bu_
zd}`{w4DX)n4Yn;;US1azpiGVt@(6lGm6(FUFgOk}{6H@)=AkH6ku5e&MBay~1;x*!
zIxx86{pxh)(tv4j`~wC{_Qd3Zd8~hD^A-8^HP^ZWiBkpmQ;a|3kaS@P;HaUNq(sG2
zRS!vG7)8}p<FB%Y#3nw>n7NG$*6}HD4?NS>H@rwUZ;L=s-@SQ0n6GvLlZ7h3$v2I)
zMM6PsNFuPQDCUC8g?+*9T|i}Rcl1xIdsHla*{SV2Wwe}C=TxRID@bmc@=~ZyE`6)(
ziz00bJF#2K=h^+OyT&uhE2Bq=Lj%yNJBO`7tGlB(G+GgdoZ-{NA&Yqi-HGN5`$a^0
z5s_X*q@6^h6(!|u_L4Sid56(q&~y6TAPfd!rx&*3UKIOXC+M~OaNzjyVAzkI_mVcS
zoX$~uaMW$Byrf+}OoQ9SY>HMHip1d~>cV6GhXGw^VJ7eakU4ukW8TWMSdvjMtH~J<
z5a9Usezw5e#CvRZOZ8(fMtar@<HNA$2Z7)1_+h^jhP`1giu_(Ta{RXM2h>I~Cv*Su
zn$#>kyd}Y6JWrE1__m9^+baJ`LXYz6OLrx|EkLh+5Ow=z^1G=AodQ$(OF)gU-uUAw
z)P~}Ns&%%AC^$P%L-aT26dMZEhE;7+<Hr->>SJhd^^1_;>a!?t^_c{?`i1Ck^$U^T
z>a(eD^-B=n>QiWM^$U>R>Qg9hbsOPTJA~FDbRP3(0CkwClkCw9q#f@Q;NLP$#vGs;
z0c1xlr(QKal9-!EuJ;u{_>e?!fB;qQ9_oZk0w$ohdwM)1kumv%az7wapuou*igK7k
z<eckhS8GQU9_OBh{{GB8egFRCEc@`oyBqiH;=}jvemK$Skt)1Vh3<!o>wjF|od0xk
zSZI2A`osCv33jl=WR0jgWbrLh>+RPq>zi-RFTR)JBWwTA`ke^WA56tTKBi(0HwI|#
zh|G*CK8o=BRm+|NO|_0md*_-2Z0{f*V@(7E6yl_^?@)RI3d&H~m(LXyV$agM730fe
z5#?WFmQ(@y3O`1P7vyJkIftVec@t%Y0K0*SB`rG8{Otr7>IkT@Fu1I#@G41oM9)D5
zO01J%(rUarm)o2Kt#%k4dS2j1p4aydhfeQs=(oH5UdNBZVcY5SyPnevxwD_6B7Ul?
z>m2{s(>ud!ILF^f8Cq>2S|S{n8~Qp?qM|o2C|Wf)^%kQjO-?E~3t7*sXcv&~C8?TA
zWxs|z_HH%;ZaeYrZ8F(Dap2b+w59angbl8a{_-Pi9WQAG3N5;^-Y*QIUf~&E6HSw7
zhq5!|8ix5xDaIm_o<)SC!VGO{tH{#}M-&COGp)BjEL7l=#;>xKjRyB5h~zR~Eh4xe
zH<1f24~PvX5-WO|M$<H7P6nc|ob%HT2I0xjOpr!omVIs5GS4F%S9Wg9D_hwwY(YiN
z7|c0uMdD9ozleC1Uz^Qx<I)!7u&hee`ZkJ@zI*fe-2>Wc;Gn5`1D){H!w4<nQ3Yv2
zvH4<R*^9W;gVg&|-vC*bd<Sp}sP-=t#3Rg}aEGBs{*XAn_}XsW;R6c#tis9W9wmw(
zo?sj;aT~e93GN~f1RS|+Q*)=0yi(MO{d=c*b_|^BEgqQS3<`Z#txGmB#vZZWtpY35
zia#N#qU6Z`^6cME?SCHH!+*biLn)lA*=a>m@#+=M9aqi{ya2@*+a8amunqQdIw3@~
z7YZy^mqpgT5CB*qJ4MNd&S5;hKT$&|W57|VDP4)8h@pKyR(YOZ%aFf^ZOBFooa*yh
zu-4o1*znOk|HK5jxb~y5+9S)JSe2cX5dA<Qemz<VIgrZ5x$GURKd`U}l@c~924yx0
z)@*XhpOh(}2bx58=tZblz~AlI8w7#b5V&NOv+|itP047Yt&Aqn>Wr(|na$0KMbCM&
z*~Fzo#6NXIdHMiChZ`f&jUQY}UmGo$jw^uocxa`rME~?7SdPdge+<2@3un>AZC(97
z#~pQHZ^U|kTe(XpTdJiXYeR|fHp`Xd(X@%2`MOYv*_DdVp@LJct3sBvzla-Z19j)l
zpwa4VS?3a<TS{GOE|O3crZSia7irTTCz$3Cv&a<JZ+$q{V%c))64n-gCb#%3k^2`E
z3Na5t<RY@E7;6QHbc`r&)aqvmcY@rWOYzc}K=DroE!o2P(>><6oXe!;M@JPYuXO$i
zDs(7+1{}<d8|gTAPx&WQt=V*n7CKxKF6S*Ni1k`Arq9U!UVM_>?}7T>whsD$1cNQR
ze~)4EGZ+&!Hu@1wL{i{EOg;g5Qe_iwu0E?=;8KE|L6ynyC{5USu0}nd-QB4_#aa#h
z;@lASVKI9!6;UE0!*?J8sPF~1lmdKB4Kjr!U!GqI8Ov1pXz49NDc9Tkl)Y!&xKycO
zXsYP5M@3{THbiqo=dib(@D($vsX;Dg{xV57)gb4uVmT&!FHL&!856XrQ5#AYA!Tqg
zmVI8VFO$q~rZRmC*ObEeK~4(Y>AW<BWIRIKqVm@{5Ebcf<$E>~vP5?rTKRUTL1%%@
z2jz`TRvfdu{&a4uaE^TZlT6vLb?SUjC|b)P^g2Q!DFG9O3s~vFKnM3MW!VXI&_+j~
zl&ww0rjzE@>NYwsw=OzM!H50Y%>U0kzOSzbZMT|$Zb#O}8p$n=;1%dDVjV_3*Z0)o
z?Hw3<TA3#(;x&{%W>Z_LOM?0=8fi0`p{@9eVXIMESzYUbACswg*E`crJMiM6A4DDV
zo$017v`f>Tqn@qKxF%lM%t3sWgvMICmshEmSE-j*sV%QkF`!y(U4Oj1ytuk?&rUCI
zK3<)>*B`&Vyt+7pRdRpKQ;Tk{WlUV3NjPE>r1G|`rR~KK@|uJMyM1gfiNx=neB<aA
zK~GTsjy(0Ov(xwQzdb$s8<2tb7uPWQy5#WAxeDH^$$&C@C0b0TFpb=ZiIk>B7IKkp
z6u4)xNre_o@nT2KkP_5%okNr$(UwKiw(YF6ZQHhO+qP}nth8<0HY=^p?%zG^wchXz
zVipnioVzz2+66Mqw%F#P!%1AYgx|d}kwEkPR9u-c!xT{~NrKw5kh>)P5SfPPBw$(f
zjlF1t5jQ$J^Hst(SRcw`ulYn{K(Flvo)k`?Rb9%5u}(Y0Dt6+bw6^!<Xcb482L7yP
zA-U87tgPtY6&7bYrhHvi@^BnD%MWh7M+k~$mv$_V9|+dQ?nrtpX4%0;a(Mm(5bf=p
z!oxSnvd^SY^ew3C{6+hb>(jPD3(G))6bR8t5FxSt>-xF#5PcV{jSTW(lvPy_1&udj
zo!#sm?=CcIF)50vqgut)Nu;qt68^oD{D?X7y<(kD@9&((gRIx^DQj|@EnT2t+TOYM
z$Qut2--r>&Sz6w$?4Pet4${kTE<<2F^s7KPEv6leM|88+0}j9qT!hwymg2wBjsVDg
z<Rnn4(-!JA9m1m(iOJ##`fTyW+Bi+gVbF>wSFcfy$k19jv8y+(AJe7yU<Hd<u3EWo
zqLMAt5)Kb3g{<uE_#!_^WFq~j-TINXJl}ezslL`cPkH|QozG=K^-&!5syAGgtwyd9
zgmxM44Np=WF*B6mGSf{FpBm^tH&k#}2ltm*ieBM#1f5t>Ns$YDXBLTpsz(Vco?&fH
zcRzbS9;dC=TPHb#EvD>QVhIURHQP3t&^z8lLX2n~L`t4z(&A-0<%jh911~9HHeUE_
zpZT}pw@LwB3*M1?^$b3$#kUGWP2B#YEPq_u03~gb43nyn<XZQv)iE(`0^$dz>2*nV
z@LB0w<<rEgbkZ*=Da}EA4@ux!`#ffV&TKHrSe?^~c5jUQs6UDX(lyZQc!%+{<dQNa
zw^e&Iwjz%mOqv8H6Cp=F88ae+k3z^mVs&MR6QdKITf>h)vu~THujo6yDC>o<s~&8g
zf&{3pID~rFah$^hsNlL?txcmmFNv&{q>kE4M`u}Vm{NwzMmoi_V~gacwLD@Pb6U>d
zLbeBENp~hyY#C;3(aE_Y_ktur#}eFW<&6)qomjU`FR$FJJsAw2n)_?UH-Ur&j{~Cg
zWe(e(=F-)rdBqh3DDDTTW15>;0Xt;rb?fD+8k!^}u@1}7577=?yonzlON7JSjgq)Y
zESMYI;i?Uq2m$)kkW-a8{;^A^a!7j8QkOm(m#icj&154-dZc#IXuMsU#88*i#Idbz
zh^eEuh`KC*A43cuA{J7|A}IZuE{z!bV|gBIscke?@LOj4!6~VEv#9r!Y0*(GJ+5L(
zn@DiMB?R2`GrGrT)lpzuH*K6DzMvlUUi?!D(LSlBmVy)9wX*+|uEZ(Nnz*hc?(8@`
z9@p0LqayUyb8nun6(5MR63W%<TP6WpE5zw3&`ibI$jyh&pNN{shVbM%m6Hmzn7{Ad
z8?uUsksGRr<V0Mwb)nUt=CfDNUz8N;W8xlZXAQr6PF0F1$VXER{6%o5Hf}Nb8skyL
z#g3{)X7o`q1A7RK-o``MwrjM4<46S2>oQwjVw)zx{~*<}IOD*So%g`vIUf%e8b%M8
z9_VvFaG1V%X8acP<J7L8)=I#3F>yLx+mu%saj~}k`6CG&F||C@l0VD>sL`aG0eeR&
zJ7&v}BwXg$B`~gJw6_ed$9~U2u@Af*P2N22rlZr-$fhXX&<GJeV*a*QZGSmcnOGju
z>Y3%b=xHNt-l4Mrn6Rot4QbDFkv4Gnu$;J4bB`yWRkxAJLC;4%1h&>x8G42(7Xgqf
z_GQbOqg#ay=1_L+69KVzt!e~;Bo=k-g>f%hSGxJP6ze73gG+KXrLkVnttWKh*g3nH
zssw&K>)2g2FkP+X**ejX#5HT^x(L7;d<4i)#4Gu)ZCqftqCR+-^G3m<r{t2*cqWO!
zA<Yu*x@vwZD9h0aEgd{p(zaby5@`J_hse#rD93dHSFDsk8ikM(h%`*rYjAnm|AO9h
zbmR`%QG9Oe#s~tiN^3Ibz$U20sq-@|%>d>Lb*68iN|>uV=3JBg(Oif8^mgI7T(5#t
zRX>;?=}RmQ*x8<+T6}Ie$d^F96Bv8IdH}{2QC9~llS>ivWdNse9ovbucLx&p?9$~d
zn7}N6C%G&85|ylTTx2NpBPQ~{JOQU{yt;8U7t=@F##yjKY}4DR$I2k;Lh^iT%Bg<-
z^)V~tkCV6fDk9oWm%VViqa@Em06W|7<>2LHYd_D{f|Z3B_FkSWN{hRg<0<+CJTEmn
zzg6VF>q{_jtDttSwJX>1{A$~$2*wvsPUm{DyxRv4q2c+tKXy)(7fhh-(2**Owk?9Y
zQ}i$w#{&mnx!a|*LlUf0Tg!lKFMS8(1>bBlkd7FfC~LVQLux*>K`)lyX&K?m+N5G-
z03H#Bq0>me)eah0q(mAJK1-RSuy*!7U(+s=;?l(QuylV84j#PSeQ7iqFNwA2I=iC#
z?;e!tgu9e<AOR}>Kt-m2{R=>{E<8<nNetz@YrUKqMWKaJKHih7Hl{5E?~;!Y{ysng
z7+p8t(O!&-ozc(=d=RFOR7?#65=IHAg8W<W2Ma?N38UO-Vo81EdVT5I;uGJGR-jQE
zv~BB7XH6p5!0}$VgLkn)_3{_$@6323G#`CP^9S$2a_t9iw2#yF_@(4;tL`9^bUJJt
zMI0S*koQeZ27U$%*tH;ZPAnlCH9?)aLAZx_06~mBu3M+iGBPMtH9@UL_DCXu=m392
z;kd68!xxBq@hPop|J<(d?K$kLX!fhFEUnEm45ms($ptJy<0<>!H?9&BI(7<O(+6&v
zVPOd?TRsOoTL+9d-5%#_=%^Va$TdJuUzY$21O;h15RKDEkjD|3uWJP|Ad-UVtG`j~
zBJN@RBr5QZ`xhggavv0_C;*GncSK$CnRYz4bi$t6#2VH2t7TkOO`Y13jNNCQ@}ApQ
z2j8*KxniyzeYE!=uyw{&19|;8{UrExaVL{^3qOWtlB5_;%keMy&kG%JACQ1}bq-Qn
zQ9q<#s<|{0{40MnCo}_ERRtE<Fd>tRR+HYn0>;sK+j7+%@_p9zGq6+EQ?JxTGbTp2
zqo5nN(Qi&8?knxhOyTHbG7EorAeEsP)r=O4jZ-Mb@v+IrOPmcG#Gq_mYq_UG;p%04
znorgwYPALY%=_xFxkKap$UA6ML_5d|G8o+7A)cQ=;0ER0QCr%v#G@t+e4kc>5Nc(9
zLU)BrIo*+}6`|^e7OEy*hb~k)9L7T|u(rc-hk9@iDiHSZB9P1x-R2*J5~zyRlksu6
zkWc$+Q%&@OBk7`D(Ic<Pfii>kYC#TLS4>POy1#sEQxI1nz1`(gm?Qe1qL$UVmz>3y
z=+cGSTAAK8TvVN6TCs-gCc>uMQ1j>d?#{?{lM(Rs?Q7Xp%bTCw9Xje1BoKthQ2i$Q
zqu_8hjB784^#SiBQoIFCqIWOa6D<`{`Vq2C7*w?$)&n}v^9}49O4s~=dm2}ATu=1w
zrR99p70&S|8O<7nx=yAZ!0{~?^PIUgc<1f}DfK~&eM?4qzmslqZ7}}5XEyey6Trbs
z4^CP71{r7Vxn2Jf{C11WV@C{2L6Od!;oA6H=$t7BQbHN}-k343000Gtkw}G9)&hf4
zs`118Pb!uy@*MDeRk#MpJ8${YwXM>7W&>AXT9E|w;&6Qa9QaIWOJs?b+<;jX7_Em<
z!~QVpd8lCj0M=)AFPtT#2S<Zm$P9<>bE7|h4-hc<CTkfS5w4k2?Ch}k&Xc01R=pb`
zeiA86kK}CIaq1h4v=$sso!vX93Oj@+8a4{U(21*`ASw`;95~Mq2%iCS*})cgy_4$E
z*&;(oF|c!aJ3nMG8OPR87!$3v*jlU^bGAmyAIG{YJ2eKmfuwyrx~(}m%v@S;_=jD^
z92%S4I@zE!Yr4sIpcAvoaof18hNq`;wYpF#(wzy5z=weC?aJtAhyGTo`sPDg^b=t%
zL*XeX5?U2>HaGedo(NL#9o)z_lnb>10I3m&r$CVHB#R%>B#4t}G^@&z2o8$Ir@Z6w
z&b94iEr@r4E{b<)F76x}0o)O0K3|>s+*<QmQ360=fiztRNC!RZ<TW`w$o!+c314d}
zZ(+ZApfAl4d`wSAPqF4WS=KP+Lb{FBifcYv)5gVI(}q$KdwT-YMvw=FJzg%Kwq3OU
z(-I-Yh<AyiNKRo_I=eRY%r^RQ#tUc;0xl1jU>V!;jA1s`F*>#65N;VIBl0>ps-XAk
z<6By;mqR(-LY>l<V)oNOSXsY+$SV(wh|6p1uiCCi45Bbvyrj7XokV{lnxk69bg|RQ
z#b$sxDCk?W7~rrrf1aPMR)%PapaHHG2m*fZmWLggZaPT3AIAY11PN{89kP%Y8iy2L
zHHC2ZMYKVeD*UoGPjC;BPPcGG=UN~1y{fbjcCw!_tDhgI8AVn~1tJjupK6cztDa^X
zCsZIpC@+$mA@Tdk(G#v2vlJl6*QWx}V6exU5&_`z1E3>&)A8qe0~83GNKr85*-nfx
z>uYPBe1*N}2*Djo+zPLJFFIvx1wl_0_JRO~OL}=j4HA^L<-mp`@rA%W8lJyPB9C4D
z2#}&ioh2P);U+c3DWb=#eUlW1KR$pmYAGV8Bp2fzSXBjN3mX>Ck2A+!Bhr~QeB@)_
zN=m^cCThXqh7@5t-n;lp5<HR5>}7&e%F)*gH{p>i&7ukyGYL;IV%O<UxqmFon7Y2d
zX2&5bvUT~>^oZv9$4SkUQEP6?Si$%v4&@Y|V&*^j_mz&#ug4qVn+niEWniI_g1(gD
z-Qt&52H;}85L^i*-o${Q+$^3Y|MTJP_WXv!MHq6U)nm=<+nK$a+nJ63S1cPF>DF*e
z2J-}yq@BndMd7pGITSi2|G|cQOoltTz8OW=P%viN)No+Lc@CT(1{U(#rSsvc8B8-x
z{6%#49Mar&K(mxyEiCcs#S$4*4ig7rRM%&dgfg>RzS-izXC@Z|W9n8CkZ8{+kw4R)
zA!0=dKsy2mktAK=r*_&;22d?q@2m7v)zQ=w{4{LAb6LPYztrj;)I9)J7QW>jr%cJ3
zGsody59w!EK1l7%lGyiTmLuDFf-u|DPGIN7EyzuJ=E;oCDYk89+tH^)2l}@5vDDa;
zDy%2l1BZom)R|N*Z`-IMd-IyTz9PQALB2G~`Kk8AJgT6MqS;B-Cami-(^)@P0G=qK
zZ|jJ;VW*yPP)`3%K4B&VGpR($$E{XiG8#|wnZfp1L2SPH8iaZEGSBhoewxC7pvxo9
znJ5l0?5p#-9|*HU2+(gzAqPA}sr8TV*445^m7{YI978$E0|8W@DlKl<V+H>z+9M*@
z3R|nD+meo*>(i4Ha2H-4EgEiClutjTXUye`Af|Ev480OxB9Z+AS@~Z=*2{AV7QVXq
z&wLMkd_Yf5zEBR^F57Qu0O&fU5+I<3cWUOcm<I$o?L-caSa2FgxffA=hAdA&I6oqU
zqOC1Y1Vs;0))G6kgSY?6C|Z)Kq1pZDjLqHlE?Mk|^*X;Ukk@l~E$0H2VId$?#jSjW
ztm}wgikefK)flp};NIMqXqFVavO-ZG-B>$&O#;b{9I@Or@g2u9*@2n)Ju2YB1gJUY
z6gZP|XdfdgSy&z$FiT3rHOcV8jjN!|C;NwS`NE6z<+3rLI2)F6rq+qYYq=NUBZfPj
zC=(SQd<7_01%Yk@fAfua;cYtGndI0x((I7=-St`G+U-|F;*B&hopQbvR+Nyoxgmex
zUJ6G+<mSqkz$$g7)7aqEH)^v{KBHq5<z4GZ$4OpsL2-eaucfA9v2-Zm>FMbF@0eY)
zG=NCZi$z2_-osb#hO8JmCdJ%>S-i;B)Wv`;K?Vs{n#mp9d>s4D7m_rCA|V3F^H05N
z#3@&4q?e&rfRuklz4t}MHn#4v5VTUnL5nY%+Nr_$55O0Bv~N1l^Yv6%evgse9af+e
z&h`A|UVUbUNwnmYz0R_-5eWd9I$YxsX)8Pf1xvHP^hv4f9CIh-b1U7h&Q;GG+yPig
zoXaeR(C)nz?qg>QtAZ7B3+sH9O`!;!Z?TGZrNL#z3<+fh%aD07$Ex;bXvErFdkbj3
zU#8UMFz-UT>ZmEj5da}~ltqL_?NLuP8|B1EuzFF2#&>h=u{72#=rrclUYsZn?<GOK
zQ~PBuH$NtJVqffJe7bu|l@4#R2Ji}M<KPO8e=9cC7*hXRkvpmb7Gw&>T|iKhXz+l!
zc)Mvr^F_~%Jh-|w&e;t4p`{;`{EN%KyB#;iNWuuVDcL%G7F2CAOYIYOS`PoB#<tRP
z2Pm=9Hk2I!w==m~1#<FiC}79-oSiS_OO>(qyGV4uu0ypnuihN4Sh4l=8db_bnF_Kp
zR&ytCU}9p^E{aNTRd{oU20VcBFE<|frSXZ4dIH9$Vw>6+zbl<>yA65-zg;~828D))
zf;&w0Wl0Dd+y&9923ap5e*H+*mDIi^$?YHB-5fq-u3{bhO>pv8?}*tjACBFxoA~<-
zC*z-?!*`Q8_yLj5^;~o&YFx3W0wCNxBJDWnG*C8Y+ps-b=vF9#@!rg&x|5?SjyDje
z2M^u{v)mD?W^9GfkxkozeVn^_FT^+)=vkn9N+9=ONLOCBl0CW|Ih7bppBrhJ37~?w
zCnn$#sE&$2&J;zC{)2s#2za~nP~D#ZKkuqhfHm?ROZ>ePH4w+-0w6ReXHu;54b`Qx
z3-d6aj<vnv69wkQkRVDt&V*w6g>zVdag(J>WIjK#9#yas=nhkmq28%ZIfbb*BFrUq
zgwO&fn8cyr34cgCj5Ga;Xg3om41a)LOtW?`ecdgF81Fwft4Dd5dHtfn`x9O$Vm}<n
z2J|bq4}uUpIrkdli9sgv=S-2=28jNO%l5$~L(?L!X1-re(D4`u5*Y;i=b^h)*4TI{
z3W6yjBrUC1tbb$k7Ef5^v=rY5Dr9^dtYF9zr$_ph{`y%s4}6r*U1-Z?gVxUsO>5SQ
z-kRe~XHYO(K)Dn1s3*%p&r4BN50<w;eO#*i1xI~(kJ4|kgiXEtghA(%`-^#A2Hx4Y
z3<kmaElJv!G3a6F1Kx`SzoL1w-r&HQ-D$<ZB}&tyaZ}qZZY{bH0tx&w0!1S^=$jip
zv}B7vzbEqU%uuYrl;+skVKsDl4KoQ^KdQv~{p#TAGLCnjSErUV?(S$C0A<`X?ci>|
zA#b#JKWskX<%^dqHy_|vHq#v~J=T#D(jMC=rhX}Y;D({`MHy=8SH*wmn8K}MF;}sL
ziKQXhxT*;{&uJYN1Ex2GCct$D2Ul!k;?bVMAr;0R2;8SQsFp4{L6idNa&V6NhzoIk
zhHGG_LBQ)W&Vh!k8Q{d}>fN*|09AQ&aL@e*9W{PK;3S`+_6Q4Ru4n-XBqTPsa!JH&
z`lr)+`4DSTJH0W`z^!iT@I3?TA0pC3xuoY&su%c<VnhmZk5}I@2)$;Ro|S9;I|*q|
zPdSd$DI{e!%7JgRTO#U9!46|ggxzE%^sc4ILjox~ExilsdUhjA%7?1b8Vpc~EMX}v
zsV9lI9;3Zd@X^wcB8Z5NszhK*u^@6LCPyO(V8Yq%!lr_z0DKcr4$X+P;I)HlH6zX}
zZP?=Z>jyXw-ZCSWEbX79eRQ?Wqe#A?Sg}0X(%oRN&~PFwSIe9^)jl#R2&N*>d{^@H
z;E^eIKX`$k9uP#*K;2!($iyyLLz8@}hd0KQzP?8iBYEZg0MXV6<m!Pg$z(n7xsEs0
zav1&+c+8$cg@ID$@#i=eTmZ3LjMLq&X`_=)W;LrGr=x*mv7<-aAnM+|9`8EuK9+ZJ
zUY)x=PF2Q%VWK}QR_-G~{#L?wYBf-OWy<z(4w*&ErW|3ytYeToZM<i|xIeSoNEs(K
zQEa3PBBipH3tur}U<IUGC>`qq$OBKn#sG|$mf@K(Z_4Ao2>`6<e*!DF+`bX_K&e$c
z4Q%dVx9jLTz+=Nu!jAUU5YqB>6}h0ODa+A42}faJp;~7Muo_?yl`?|ptWT;z*3AE^
zSq1dE%}ria&T1{)y)FF>B(3feBOP38^P8X=p9N4w$Y(Brq?q!bmKA0R4@ZfvMEFl_
zL`TDJQxw6s)(=!6KUN!eS>VDx3&oa-z(d}M94@ku9wHM7x1fV)J|tl6hlh)4@|fC9
zV!knx-T#R|@xcChCucq9ZDe8K$%l)r<`V!xj!+RPz8~d4V9H+}9dd{?!WGS3ly)6)
z&V(ZY#NrV&9K1=gn3lz~agrxb1C`R^p*E46iAO-o^Y0eXl59Gy+=;z-fJFl`oV||C
z-;ZMK6H&stBQ)))0Gwf}>tLvk7&;A^7S7D&u5?<g%5tdlCw7W|K|7a?=v5<8BzO%k
z*2>lqYXTa{31JIva_PZ)Yp{bu-T9P7n<WKaQO#VkDQ9jq<{Md_27U|X&EP?<XHQ_=
zj_)}mHS&Xt<PBWU5O>w57f_v;_8OXoThxD>tn5JxF<CjtlTUVwQ7xgqo+xz{?B$RH
zA>p>Zb7~j_!6OX_FcY6ZWv?BNtC;|igq))y?ud7`wmGuw@vIee-^1O=yc4Dt@bS4W
z@}Pg*P(rVz9~^4`3d+Oqja8?soBA}20nnmrga62-Smwd1Te0n3<~^I#z-XK*ikS>S
z3NO|yFBFbQ5pidePB%r;2T8mCnghBbp`-UgX-T*PZDLtMX&Qh?-ssn4MWXT|X3rIP
zA-EoG&2>%XR}1(cOK6_c^waeu%DS5^ZERsH0J7G5$jf2xB`A%FXpfrW*Dy?c4wvTq
zu>_nxY7GV+#;b>=6=F`~XlqNh;WUgF!wTqeDdx&&pfXt4cknZ=F2f9TYR^hKe`Wyf
z^$eN!KHV%oeS8^aq7iW)<Bt*{X_xLyFv$e()*-qV%Z9l-GG;@Z>5<oYMzV9$yI0>w
zLOnGe7H(8mj&`#%=ZBxSubUuF7*#P>R^<vkjhz(gyqSU0w~5yxAy#-{h}3N({|KsM
zw13%7UjO3?6M&eMc|Ru%jj;pJ7XuZX7^3=kmLEhQ(F^w^$P-_xcYM_oDN}qB+jqSu
zuB-zca4EmDlLO7M(zBzD#^%kE!{I^uz`Ie7jZ6n4T!-<sVA9O7X53+^p7Q83B%EzU
zJJ9ZV9Sqj$z2Pj`+@kg&sGnIr7vj)x&Ge~TKL_>q!SbM)&64)I*1b0#PhTUG5cMA&
zr_CPP|I3q~h7~JY;E?=ie^~x0WNhAg<<P*Iee8+|+e#cZC3uixsyt9o!n$bgS`}x_
zkb*ej3vP(5%*8m+zf)a3Iy@gNiVXcbS~XzI|FJFcss2|uQpX|66TybGx_*?2hr{G2
z{l%_<OOk|=5;vR`CSrP-4<@6*wP9<uaP?C5MNerWW>q=}W65)z=8{@ieSYSQq!sIb
zq&~N47Pax8Gb*4fQ#!Ak+W0145hYTed{Sp9-y15vjFF!q3vV7hDZjvAn*rKHDxxgp
zqq?FYnNA?~5Y&`)Or&0?R1I8V?%Ownw5h&<5~b!q|FS<iJCTh1(n<^aI;Ah0WrcbV
zV5^4s3A?xWx)@h-3Fje~B%THp5~7~y;Q>@;)21xaUUbbo@~Y8A&oX6Axm&O1C!ucD
zr~%Z-{P}oo&aPO9K8W_@Bd_e;TdGgXqC{#zV$o1-+^0Yt2Gf0^+WfUq0T6~oWjq~#
zV9yIO;dpcQU3Z@qWiSr$ICFNj1s)XKD`vObi;T1P(z$AOxR2iv#(7-yEm^fA{m~SN
zNA^#CFr!Iqn{pv=Bci5I%YbZ|u#OHAr%1Qd#14I}C`a-kyta#+6oyy<7KjSs(sDL;
zg4AcukxYl}f|V;ql+0PHrtkW>R+9WSG0Laq6oovYm0q4g``tT9Yd)bB&AN6l6Qz$}
z<-(5zw-tBX#5)r|hF;wKv<Ho`Z;TH=mTo7`uZqL=Ll}OJ68@W#|8=1q&89KdC)<T8
znUnOxN2MH~84PM0$c=oSK+2iL^{6Kb+N9xIlAE+hCg@b*sWZ67Rg+*$d3-4p%eJli
z^=bGVkTroCoBqT$_7qgDa9UF>Y-73s!SJOookXS0Sq50W9sh2b#h0l&keNEVoDdqt
z_jHo{v)th_37ZZpp0A$QO=dq;@@t5vd^)owxy~|qsGYBmpMDG8nyX?bz>rE^iD@*4
z>R)95+nGohmRqZF-VPjPfF5|PGq6Ck<CfK{D=}^JHXWivfW)psTeJ*FC?g#3hs`u^
z3C;TK@0h^u*J}5j{S6g$u^~@>K<X^SAuE|gDVQdhjG$7c6q0Hp!5X5YPpF`>?bn-e
zKe?exS3G~d1h2wNvfg4g`n-l0XLjP@%lME7O$oT|FoqVDF-W34VDAkz@d%;3yYKGo
z!o*(E%c}<qj_#*I(ZHog9P=HK5N%BgWCtacoExG8@PWxwvV74<n$761n0D+qily<%
zT(#O5iOPSib2GVMhGohj*#saei2)DD9Dq-4sT#>0gmZx0g&F{kHjUFwTJ^6Uw-!fl
z>s_^e)fh~{$7wz{^4JHA*!ifyQKxG9w+E1L`j!;y<*{m&b=m$Mic-dEDUJGhjJoFO
z;#K>Nx0$!W#QkrzUx#*U3^lO0nQ@izP}+2w2a;}2Pcu+O7?+idMF%XU1HMMYh)jTE
zf@5O02H_#1<{$Tpsl&7A+oDN7%!Z5D1BOwq#WTE@k!rHN9QwdB0b4Zp=qiE#z_X~i
z$GMumB`^yfQJxsv^1M~uf~`G?BA4(&WV3vDk;AJwr+wxqfP1(12YAXEgF<VS7mo&R
zf=4pWn%$Da(oH9$*Dzm`Vsg9Jpa4o)m5sPGZIx=bH7_I{1HMSy`j=I5fx})HdB^g+
z;^_L6VMy&_N<!YmeK&;InftP6lnUp;Gvg!>Zlp~_Al3DD0ktc=igzS1mT6FGB|`J<
z^Kiz9--(_jOF!P+-vzV=aXiP8Hw3e7f%3CQJE$K6AplDG#XPEX2>dioKGGtON=yT#
z{9rK|12(a6b2J$Pk2q5WQ~sW-yZ~kV#EGM_bJt(1k$F3*a6GVbUNbZ&;1nTm$jI9#
zbwC9ssGd^wRh<G4vGxP$EKB5W(8VTmb;{G^U>5`x#kqmmVZj?$Vlo5Ka1Plm0Q}bZ
zFfik$BRg-Qq2rIPvFC9t3plt(!PLkZzsH=hnqaJ>bnII!3-q7$+6W6J-DTA?>esav
zYA4!-_VKY(b2s$c46bM+K})<zAVl=-6zu8NbNmUWrL)EGPV3pLmYVPvZ|>RZ2}#WU
zodU#lAuO3Ibx-GE#?;4o->#~c!|K7w%)|Oes}1yU%PFr-)Y0G?gR3XIbE})EWXR|u
z{fxgZY7iB<#RJOH&8LDa9Gtd+j*L0M$m|}T0+(yhnMp-N%ffYbRAld5$gxedaRP3>
z6HV_$TvuMG#8P0(i*jb@U;U%^$IEvpx3+g}1VYy8dW8F1wO^n(MGL`oq(GQvS+;xT
zw0n&AqNXx!^3dG%g|xE5pHJ7RjgL5y#Jq`nC!LJB`w)JT!kZGdp=m{z^D2J!vM5Xa
zG?VzlG@kU#1Yq@Cwx8?}8s`Rzl!Fb8W5gp9L<7LGSi$StU^cP#L#`O2lj2Tb*&8{}
zfhQG=Nh^WFC|Z1~z7jm0U=RyZb1R4(i$oU9+GLei8T>WM6vtG3`Q6EGU|f`n4DZZ~
zwSRF(47SVPC5hXV7*;vk_$5h+viYo>yFzy%KQ*WMazk?Rmwi`v_<(O*rvPGMRxJ<X
zTaO&mnT({O-6&*?_RonJy}1^eDDpL$G@Y?OoD^#Kh|xW`f0RWKL-In1{OwJYb?1r3
zBa<5F3*4B(KHw!7;lI+u_y&v-A?g>_Z2PMmAytaDNYlQyl#`W2y>o%9L+@P`=o9BE
zkm#3k&I|H`akgE36klRZuj^HVRA!(9JJ4~^qiq36t+JsdGg|Xz?tiR59CU6+_Dwk{
zIOkP-r&!GObW6xi)Am*e%92MEf6>UfBvKEU#P;2oCtm);Ujg<p==G&ylkIpOq8ns1
z<L1$ayr3XbZ95~zEjj}efl}R&#@2>Jd%{Ci8*e&5elqmOQ2}Q~%Azn8o^^f6xYY~!
zC+jG=XK$ZES);=Csi>++5*>o)ZhDmUm$Ze>JE=6KrJ&UnYt&z)v9QC9|JI)F{>|R6
zzb%iG6@mPF{sWoFk$k3i0DEok?c`cv0&P}%*3qk_cLkC)Py+e9OwC=hWbWC*`N_=R
zP0^y24wkJM*soFzq}jm*|0Sy_!&WomWZtsXoN0RC<%BQ{P$~dqC|AE1Z49wP1L9f)
z7jDzRyr3;%@{#~20oaQY4BqQ&RzoW~d{S*&X!s9QCit^=3dj|L7|Cb;0KEbCAtD*@
zD+9-cCIT`KeBJHe!5YTLj|Ya8N4hYZP7x?VNwydrVi$X$O1Lc3J5jnAyON5N@~5~;
znu-qPB;T5a==&;)I<PI=n;F9rL6l^~go^5}Pf<%Rle{rwVCFKCdN;VLME%BXhuq-}
z@8QjN@5xP1Ha>@yPU<09s>bnd@?tQk)`C3@F}FCYfvETr$?0A)T~5AcAMn<b5HpQ`
zGuGO_Gp^7E++B0BxoSj5B!5Zq7qCV8?1{>ajk@5g^T5E6Kbsj|=J}xTCqwQj&=!@E
zB~uVij!8jk>Wqwu>0evbj{PjriluGULU0pQ-p6wvpfAR}|3c$lnby9XeRz4X;Y9P~
z-iZ&iUp^VmAmPjLK3+ZCogAL`fl?8px2AIQvh)6d!|ju0@qu+vAqKfbUlEBOeJ}|_
zM;K$nPfLNnMqB`q?Lg?E7+2m+Sz%$g_m@KEWH4iwbh#msRZ2iuy0f2*g>Y9#HabNl
z$K4oCTt}OEGa*Adb&tWTZbH!bC-2+f`G_pjc!r<s*C+>2%R(`ETWI%hvM;Yu))uK3
zQ`+KHxQ0`FmGde+r7(z`&d#WbMssAvx<W{Nm^#}m)|_>R0S*TaLnVQ`X#E_Gja@Kn
z?;fAm;0iwnAm32EEBD?$|86p5y*_39UA*<WJ#~&BFalL%7koQDR+#?|nY^F8{z%(=
z>FxTB9gqcnV+V9(YHcee0`lavU=VpEmLbE>{Lo}8iOhT(&-`Dkt=o>P+w<{FB-pF+
zjq8c4*~^KksoANAsCMkpdFN8kjURzKHyGY}HkRZdaaA=Tb)BO}+_?~&hHohA=s2QJ
zM_7>_O8oRJKO@YYfD18y<(#czqPW(sXN|Ex0e}pQCEXEI1<m1L<PlT!2l1>Xn=q*~
zL6HmoCma>gaT5V4CWGV%&cva}FDjTdz%3Tmw6;a=&=diXIiBJTP}&ib0Bqw(9L3@t
ze5ny#Ey)AY3TD3HsElbY2`=o=-hroho4{tl$&=gVFEu|)G$a*bS%{d;GwF8aed6o=
zAURS>{K0jM)b?yaS~ffe%<z{py$23P3>?x1Ty8n%7mGS&#qvBr7j6lyQK<lCpnXz>
zkRi#IDL8<kVgN<C_g?5p9mND>EApBgZ8KG<w!Ww$X+#1moOL?MpGslK>R-O~;y6s;
zu;V9>yTJHyE6_bcaS3ApcDqj9*XhN&l9cOuLTB1EoKDKMcx4slMd%llPHXDA!WHYi
z!0^J*Xjjpv89!LklSp=|4+k-!DnI8)jfEr?0WQz0Vpc-GAi`5L9%0<bnUz$x`;a#^
zkv}2f!ZV*#$Z`U2CO5w9M1!9e8P}vsN*7JPQ^iAUnXqZyQ~>c^AODL{B;##k0IDMo
z*fxG>?{U0Mme!{Acz$TSYTt!-Tpy&ksm`W%;}{|u+ywfG=?0;xDo(F8tX7`^>IY!1
zTx+6D7b|(hQg}rLsk9u6uOUt=rP-mO<M6n#dP<Zx1m)UHhfgtLdvQ70Q{142P>T?%
zxsUfuNW~Ls5QUc|U#MIxZ>fMFRmeg!2cR)15D`YYw$j~rtBfHK3o%~Ud9^An73rvr
zHI3Ar@t|z4{hC7JOQv~$i7+G*rABt>@$p66J8^V<;*?ETu<?RM%`e>>>Y@2K<o>i(
z0c)vP5NAF;Tl=V6I&EwSLY^xez=A6{u_{8~4RyCH46lHxruW=f>k=E+K5rj>c7bL~
z75tafs8p5y-S!JjbJVhmCUr<;^f(wcb|yR1^|2pfC<fThcxc6cp%B`=;l<XKZRw6^
zIC}fn0pj++)>XWhTo|KgS+&yEe__+(fR8;jf&qI9c3hQpg(mI8hb<qX%57*VZZ3iW
zW#;$P<TjV#-;lnQnJ7_S*UDvF8z&Y@QT5^L>MbVANZpjD)E-Wi%XWAEzW49??Y<1&
z9hDnbiZ0#CtTHvEd(DZO6;=nOIr=0F^{)o`{PnHzTAQ79CoT)au=8S^{$jxcqCJ<l
z@Fzm^MAsITceEpLc<;L(o%65$3k7otk1Ye_fTZ`O5w<u<uG!ZE7xnao3H66n8LPdn
zaVql}bxkFlr!Fj+Y2`Qrn)h_MsV&v{yn~xV%Ar4^a_?X|_=9YF4NBAZ$h5*u9`K32
zlo*{z+-r0&T*vol-E`EX9wBZT>Ow@>V|w?O))$>L&obf}qmJJ{-G;_;u-#(GtW6lR
z_U~T&<uY6~hKlN3<(}WWO02+-E8lt~;9<YFY8(`5%fKAEeE{f1s%L(C&DYkOt&8H-
z(GzI${BZx{ka){k@pa3pA~JxGrB)~(Ucv!S<wY?YZNJ2sVW33R-vZ`m#jhAA8$Z_%
zPZ^$&|En5PkXXBY%C@kp;0RNV2Hl0P0S|2g_6!p~pLe*C-F%0?f^K|s&T;)ZDaX*u
z%B$?`8b!)3?-TUDS%L#D7<AUpLwyJy&&3$NGhjDK#s*OW4$?&k?M6<{v?jmjXu9Ng
z-uHXASx3fhfF9<Hiu^C`pN9>>Dsir>w#nk_4q4=6SuQ{%!OPh^TrwG;5~IHOLVio@
z(?OAz=|{|c7&H6Jq=tCBI+;L>)nQ|>ZDb1L=C(5MghH`x#MbZG@*qJ`9o(}phC53-
z9^deoZR~;H<w#hCkeYFe#*JpKk39U#e-e9oaZ$+cIflNn45;nYvSx-98Stwr^>zz5
z_#cmGv^Z%U^%;QBo=+)F2W0Ogd`q?gQ!)5gABN9?9map^u5CLtJ|Mu&j>Zp$!(%FM
z;+J)Fmvl-lWk0}H&F0f>D$ySsPm9$>&8@J*&WA>pT%kvh(s_C0FdNuYN}PxaYLzGE
zL3hl%t_Thtx<5|1CkY{e!aqlLGQLuuk9bg*>8nIR=Oe-gE!r<R=ge|#Roo^c-!WS_
zE@f+=oc*Z@9W9%q2{;jO!{JoYC-|&l!|`kn#ff#at2vUqeJRm>qHbvx!f<HbyxH2#
zdKKa6U95@VTsbr&0K?WvfF@>|Lp5lqm=>LsE+zoRU>s4vn5JMQl?SOs>6;YrD(MX)
zcEF$K*Z$>hY8;~PLVnxEy{SCA_b@yI&9aC_c}x@E3H9PzdeMu)u~?v;L7&ig=OZ@>
zBIM#u*`G<JLH%DwFBA8hU-2aAA(mVPv<fr;lTchYgz0*gdsa6Gl4w2G`-6yoetPm6
z;v4{2=u4>aP!o+|#&th8jgET}*Q7|b2q8rTyDfwbD0Ws?=ww&;9Hn&D0vI{OK~_XX
zKu?ZCleOJ&Oj1|#t=85iG>>hVUFmyfl{a)D-yhpIl}8*>lXCE*%&P}0pnx~+%a=-E
zj5DW<YlJ2)8~Wf_P{rW1Knyz)AC&jUhP`{r&p8s_r_D-#aO+f`1%x>)ZI#jGD&ef;
z1J=oz9pYUbb@iN7qV~!f1ob$7;;kE3@6f<cO>AS~VW601!;?wcPKs>fagwX!?Y*rr
zxvo8>wV!L=Gj)by!KM2{@-3J6s^mmrbr*BVn!|&tjPlf8JyZBJW63*zpgTC%S=-lH
zE7+kRo~|o8e8pq_BC<7oV2822wL<bPSX+~oY1&V*{U4KrLps($e7D{6%DA+{R-0hy
z7s<IIJn&ZQTP`GhGV1c-3^(OS&b$xHIzFw8MvXe&qbOxW`Fr~qcVu4@F|^)0+fyWh
z_7yFw;N|z)Zk?&%2noQVyw#r{fXL|ooypc<WUb%g00282c?4CXx;wh1JbT^LT{;6|
zIC_PpYGCcygI4kU<EA}9kq~WUN0;lzK#~zN0P?d~bH3&jX{bRnIVV=+jjW7J7~ZTs
zMUAo^rO~9GHdfnX-#fp9@N)Bc2B1#1;Mi;@^j`V1Kk1uV`sT^ic;XtNMTvwpQUw&8
zL_V45kjp)-1%-gs;w)zu?^7fn{fF1KeE;X?RuZleX)VU$)VGOPAqeY6mzLHwG4JN}
zMFD%rzZhdRd!BbOLaZPMVYTg+ttrmEBrs`|M%xgGHpi;TD>G<_M(9{zo6{PTIk=0B
z(KXP<XVlEA6xHS=ph*f|eF}aGtCgLSYN|!qb-N6jKubfRsV4Ta-xZbF%qe^$ksD$o
zu(Y<=D_x?t8+L37vsM_LNgJ2JK)+{4#Uw?nM1`eJN*t_hD7Vm!?15i_A`t{P*+o=~
z2%+A^4us!&BhiZvQUveU7Or^+zdA4QDuDG5d$T^It{U0-kH)GCf=m?RHe!7^lOFv)
z&M?KWWIf9tkS%*fGI{r>r_Gl<zUuUlm-77#!aCb-6{S5wCdJ)@lS&p}lg^edSnq~o
zN>39DgtBpS>Vwv^VHIciuD*t!wI`_lQVPy(Q#MnOtd{|L93~J0%ZY@7>q;;E=l`L;
z2DTv|h~|ITKS2;q@NWw&qqv(PltwHlQn7K7HifeeqfMDlIa0CA&v6eAEvzLTsG?8B
z_N&<k=&){_Vh8x}iccA}ivoA0l?nqk`kB_Fipr}IYe#k>L#RNV17DD1l%Ej0ffRI5
z(5CZ;U6uS<G#7^&cb+;JUl^L}8(X4ZUkg7tfHasUpf1Rd#il7f(-rT(dB^D!g!-R%
zL!b!nKODHR{;=}N?EccACD?%ls2lI_K?7Q_PBgcE(A5&neBcemXwHGyVRA_+hB+JI
zW{Up&KSrs#Cl+8MBN1RD5huy1y7E+DdgGvu=^5kpRDY$*)oc-UF#79wi3=9Xxayn2
z<Dq-#wbbr32Ku+=CW5v<L1hN!p3xFJ6J}zC+uxu|2!hT-+4}uUFj7M?LL2U!_$A3{
z)}R=n&6(BVSumUQo9d-O{u5s1NX2E*Blyp*>mfd&JT*wVi+M>dr)XA$QC`<nBIqxQ
z>dd2dR&D3$#f@SJO%eZkpO2)FI9koXLg6=I@Ma^l*)X}SP>4#wS>>myT{D(zg+v{<
z%!UHL2IVeS|AASR6E4;|L_k~GJHq1GZx3D)BJN{e5IU{jmXVXuS1%7t;K5X(IedUL
zZ6_n8Ra-Eo>(e-rg}3~%p^I^;S~cD7gQUtWQ#;WpYNDp}<7t$j`bbSu)v(h9NPgb)
z5;FuDi7#VHvWT;IG^JUc0-C11#)Zv%d)($LJ*3^_!9!0|5y&jaJysWpuTFEOmRBW}
zMNf##O#>5~>~mmdue5C}M`ffxpv&-YI;+xDC^_?BP-^&=(K1E9o<|xrotehN&fy5C
zOX^dKT;T4zv-ZMl&%KU|mZNZb01%OxeqA7F1}+#-z#{ZaH5M+q_-&UD5A-x3z9#3u
z1Slrc4v}cC>srULE!R$Fa|0<T1@Q;<!GS=DwNrx>D!@WeQ}ZGL<vk`5%116p7e*W-
zvB8CkfwPVOKX>7P-Zlm*RuEMTJ}{gE*(GU4<*pqV$|Z9+Axdh&Lcl_<$*FZr95g0F
z7V3dhVN!w|qK^j-*5Nv#B+|F@qEk>4GLMDW!V80Im2M%1s>gVtZBwzb$QVO&dCn@>
zrJ;o!)L92HtTJ<H6s4@-L90Bo?=o2V5NP64v<}MSDJCMP07+!kSnn?1Gu?ZRt8@IB
zr2{5gS?tFhd)5z;TBi;3yqm=E=za#Y2@eyFuDq8X(o#0p$+On|71ofLRPnd2Vs&N_
zUMH|`+<BdDnhn)(@5QwA9{(bMR5m+!vLr6Z$AM=ex_T+V_OU@k^26x<e5E`uoHMEf
zJ9hC~dif3tF>nHImtOFc>xX)_Ml~9Gu?l)$(5*6<G=c9v@MMiNj|UlVW`h4d&t*Qm
z(6Zarq-F}QGW@+i&36)?Jt6CGhxRlerV|W_YGqnk*$&wU*V`r%53wf-xb6y=+`QWw
zYHX15Cj3M@pr}v}tnV!HII}Q6qcwH9kAIhze|h01`@|#ew9uFtHKpRf*TrVs?B?cl
z+1;UO=a*wAY;Ti8--%Ut$wANHm-gmzq3(n-I$wJ#%isr}W!{tfjBn9x&u)2Vjl*o#
zjP{Nl7U!id)EoSNe^6%YTq<p{BmB(h6=3q>P>?)v!TCs2%yFHNo4Dh!tr{>k(tyKD
zWN*j@{CqzXz9A+KY)@;~jBPAyYSy@hboa^x(|wcLAn!+=&O%&}j2s>|72VI@@1K+U
zd;z#ZB!e<vJiLE?ZVsp9e&6G>e_gKjcwGMNmX*oT{a|z^=6dpuOB{3`B$pYG!TiG7
zNNLggZEcE}%{C0tYHO>N=|~q;HK%^uUN$97QX$~j3h)dl*R?M{N3NU_cu?++@axsS
z?NobemOB#vY3u9%^8Wl7*Wl>_Q^u;1+M9o+YXp&T%0$QN!bFd%9dZE`@m^+|2g7RM
zT3@$Z_{##NzoRkol5)B6-s#hHd}sP}0ndviyY|GHIHPp$I|f4M-L%QPl|DDFZ-lSd
ziuf;gyur>f)?bG+V+wI1gfYb)1F(@80d_E{Xd7J6u@GhgLzF+fuqf-2`CK!VQ%%Z7
z2XhVA%j^ol+^>KV0+qh~3zxi1RDDS_@y%TRDTd2)`pfv6saMUAHHi}?5hQg?F0+hc
zEuZy}EpF+7MGwQ(REaE)P)%8G*6&@jVF$)+@~sYZkIYI7Ej-VRsUA!BXkvaWO=3@k
z^1fTVwC9wg;5rV71LkW8E{srkObdMS0*>ci2-39)W!IN$;?$B8_138J6=bqbv5AYL
zMmZ31VYG%g-7J{-3(Co{J{tmD8`^L8;dvWTEVeV%NJFc6u>o)kU9VB>-yvZK(E1HQ
z=H)3L;tYqN=O$(dkEQI-micF4WYOd(&jR>~a6jP)io0;%TdIamE)$vVy7o|IIf<@G
z1jqieKBIrSVQYCVh`DRZu%o3vtfZ*+0{InRDrTFJ9FgL3kfM_>Ui~dfZ_^CTO}vF&
zzK{V5TvGVp6+csQd@^1MKm8)Zm5eZhtiY8RT7B_QR64CE{C(vi*DqggDZJ4jxeqn3
z7l-+<8Mr|PP|66<(6I4W-Su=;#t3Uf1(CQU8Au*WEbni8Mk+xMl^hAAx1NA4;$T<R
zxrj4xCbMM08?c>EdznM3F!;-&_lp1rhAyK{sOUUUVP)<rV(xt_9wNPC+z@qDP<dae
zhrb}MeK;t~{&PU2gv=5$h9l@l?L(;y#Kh=73bZMA3sieyQB$5%I`{f<>NmuCzC!cq
zNqiDz`TkthrPjOwX<mDE9Th}UfHGCB7t3OfRd;pD-umW^5S4T9UULbs$eHsjzRqCx
z#S|mFGHbD}$Ix81-t9Rixr|gqtkXp|!+e1wXaR{gTo3Qt{>nHV1(W={&c&pzec<!X
zUotc2f0JH-37fNd^O=Xct3A-XKRkrQs7O5NaAZ#paO|M8it9=B4Z?B?Sw`dm%UWXD
z%5gGOl*gPW`v@M49wIVp-xEUlND=6Jj+_NkKrL`A)e?vGjcYoKwVi1Lo~Bb^N}qUu
zq8*tv81#6*8Z^lVX>_#*)pa&_8D+#=kR&)GIoR)H3tDPKSLx#bi3c|z7ak&cgyY1<
zH)a^iIP9pw_y-4+#NAg69DWW1CTJfuklB1<qD&)M?mRhC(Y^@8LZuKns&m&(wX=1a
z5gLQ7v00ukHIlbP*gyTRu@n^RpN&_4@eVmQ7~5gM@i;(m4Dbj2dNFPyV7KytA~s_;
zU&r9*;?SBE9H7xo)YV7DQg{B){Cj5)a?sSWS0akQP!xzl7&k@@M;sC0Souf8)4Mt&
z&VZ}IE-hPxf6P`(1Uzlt{uFof`qGl0{LS%utlqDET-*}bD(v@3q_A|HE;>(_wDaX3
zop821^fnGyVfvv5Ymi~J$7MPpR|^fMu9xB>JWDe=J^Y{=Aol^)fE?NNi>b+0-5LS9
zld7*Zj=w3g*0Ftv?^1`E)-}HCN7&-`e(hcTrr??l#Z@bYs}>wK==tA_XnI_qzlApD
z7rc)i)#|L&94_NEQo1@1R+U~)L&Ea*()}!;b+&4in16!;ji72N+)MYe1ofeW^zXIZ
zST(NB(*CxXa`^6P8BpVLU<B(T1PhsrUNT!DXQdX}SPGsIrT6--j%q)@zh=S&MH?I^
zW7ar=)B(en3=tDPOCVUHpg+UJpl-$}lC+C5kDYI6Au+KM>yxcz(c3_pB)sz%dkGqh
zrs>nuSIM249g!V3fm+u*R*tMJnZnSt8jqIwpM%YYS4wc($k(T~0Rjub;(2sYkMT3m
ztY?I8w~8bnf&lNX6DJMEDGUV3s_40y<@>y!IAqo$qnaU<V6esLFuP98m6a0WYkJko
zy9UkY>cD&YJ^DHOZI1ZWr2NP==rK1!aw3w`!em&xY#71YY+5M!HNSe^4;b%xJhxhr
zU$cB2cw-N^Jvr~;MjI$_%*|YQs^7mJfKY&ZOVkwd&7(w<MJlK$Spb~;sNK%KN$|>9
zdW?Ijcd>q~!cK0C7CZ4Nrm+}^q#!#86}y!TK@h41_g$7`Bl1&+m*bs_XD&epsfl#t
z(LzTWw?H+5m@X0j{;x>(R-d_RgXVf}chjkczMw}gWA*2*#O2G_hTfH0ywvJGlDnwU
zVDW&itMllVpw`_w#n3i;nzXD{bO%2rfv*&wgeCPUZ)`9qHA>B*ZO?_b%X(N11Ch;|
zCznERI-lIjT2*xk7W2%T8GXj87&ZxFWyXp!;-tleD|rV*`u#8HPRj~g48`}k7Xf7o
zYEqOo;7>T%!U$oBj5bo(k&T7~u}9`|?c9|lV*d}%DOcKh6bTurFGH*AOg2Z_t+wgB
zM|Gcjb%d20YFps<K~=Xa)6ogFOj>*1%tE##4A3pfI?Rj_)%*6SpY6{l*VpUK?ke5R
z?w$GFy?yy&=>b5ClsW+x1@sg2NHAWclbAUf@8aKmMBY6{kD{V%0&Kl_#dBla59&)9
z`!^!El_DFv28zleL^$DO*PAgsM|ANK5mhPEugOKi+m1@1;midoUiKkG6^*H==sRut
zSnEjW>`?H1ev5tKu#uUjQQ0VoBEuc?2qM<(ABX9&G@<jBrMEW<o`cot$y%b`$OfJy
z^ReE%@8tFzpJ5Ur+bs@6{{vTI5LtsItVZs9!99y~-^@p6^FRE2Pgr&62=XEz-6({P
zb-^G09?v0Tz3n0FLfz`|C*r=rk%Id+8tts6LKMM0B(IGjn-3riL;a!Ac49063G^so
z46W!C)u6aO+lmdinR^9rqJI)Bu0DwM&oVkuHJ(>O2z!$d3`8t2Q+jZQod5!+I<Bwg
zo4iRIAd_0}^AqMyE9A3Hu%}jTGRCXm-PrOL;BW189d8+P@oPn@u`$_4XkAVJYUpy|
zA(SI8shO0!`@2csO9L^eioX4FH;p<{nUD5t!(`c$(Xz0;X(x1~N<_h0m6I8o&;J~V
zx(8p(q~w(ZOvt6#F4-nJF>FqrT1b|r>O5^Y5I-bEux9AbnBqJ2-}wI{P`1U5Ct<FD
zkE7o$I0t`D$k1jMywrkDs1izcTpbWrYt^*;AXNc*VQ4BTiI++;lrA<aR3qwN!4qJq
z)=Kh2Ng><ZIkdmBGW^z&jg~HChvO?m2}PUTe6UA_#!tQ+_$G3}`iFt30OpEI@zLTe
zIcV0K3d~<E1p3YdsTy$+Pmtyn{v#FB`b0>}3Won*0ZJUT<G*F^Ooxr@66wPGEiN;D
zKSai*t5W+oX|DHlF>{czNWahLUvKZyH!nVoY`aM3fiba(x`VR^!+VDjcmVMy<KITt
z<6j3CPp-$KXFrMJO8x=Gpo;(d5$M8j|9B9F@yz|4Q#On5U2nKzH#4(8Y4x3~D=Ru!
z&KPJxqlJ}9P9jeX{HH?x)@S|R{FPF8UGCf#g=z2e!HQp&i(otjr+`Fqkn6!7lX;y7
zr%K0M{zr-x5&^<bu`KCiBcw38T4}YOzL#EI47+^=;B)W@hB&}dbP*!G^T-v3!+k@8
z<pT8N(*45=C@3WsJ6}Fnsv|LB?kPZb-hs@8c0|LZdoH3H_605|i}=+#on;VDVQu0D
zQ)xlHypQKn6r03oT}znJOdk0|S;z&at7i9UHYc;1k}8I#^gA46!J$;r%yJss2Bm2u
zk}(_8flt%Jg^NPw*H~#ScY6tS`DHYTXOYhVLY$|_G2@&y>tvoW!30r>9<F_m1&3MK
zjJApT{2uy*hIYxtOhkQc^%bsxo}$3kmz3uyDJh}YjrrQkxXer1wNE2kqPqkqo|P1a
zikeGMr3CLJ-ev42EOy+qzKCNh{SYyZ-m5T`QyHR)$q8R<ss{(`TjGBJ4M-c!MZ{gx
z5jy=SmT}$~9Lt$QLuALs*0;nMv|EbPJ3sCact#C^nWCyWI7g3aIXvyLX22^qvZ@bQ
zRwhv__R9i!A+oXcg1<MBCscy$o?;pg5#@j5AjxDBs{?&?RABvh`KD*tD6CFlWc~6_
zWl5QsI=<NrDWF^vr+;wwt|lwUk8}YCOHa8m;T6A3aM|r5#hcdP29I?Sz5xIL|NpFA
zO>f&q5Iyr>uou??r6O(v<lqE>+c>QcjSq3o0WHz7kcbpWDTd+tzjxkz>@Fo*qL#WD
zGIzN<A8%*g%t~wUhZwvC?DW}iRHsRf1L-u;0eJ3y#1?DeB^s)4?=%Y1X__P8IdnD*
z%y~OQkents0*pgDN5F8J<`@7jVjYg&=28Qpdy)*sZJOc;pe=G4g4m(C4S;KP=6+bM
zV7rai`j0Nm)_*zN)^>Hr8_{_DlBc9j5M1xHX(XA@f4dSUlyc8@J~CoT2r2k+mZbUq
z@MUpY8JpR0Lc|+6*|Ux?^*l*`(OrX&rPI{svJXZ6-NYc@akV#F)UU!ip;e4wCO!6>
zI&VF9`!DJm*2HOQeoM#FqL^t{agP<q&UVV0A_SRsGp&UX`R(u0%bTlzFF#y=xfv<>
z_v92Er6V`^5Is#G&)!O!*cXxQ7n6Imx3Xx2*HkEpA==_)9ImQRmfPww6Oa-BfhR91
zt=21dX7V9d*2Op6_u!^c+`8H*0db(i(UnpI=mBEHc#vuecf$!*Gp^5yY0XVJJQ^Td
zt{1mL*L(Ues1MkIU?9$YsWeo+J53wy8mU`@zV*Z>qEBJ#i|M@KEeflb@NIy+TotG+
z<CF-CevkyZ7Uxn0cLg3!auS4#h<A#+JM;@_^@6!W4&&~n&CjtEm2d~VSM1L<F49ON
znQ$ALXTYl`{O$#5V@`_v@u=_g>%+E6XuSHtJ(Dy>nuX-ZqOdGr;5e`E58JANfCw}A
z?@`D|_{2yC8kKonykXf4k;Y}iqYca^h&3`BA7f~K?{UWF-yLCaJUGhQcw~Q5(^Wos
zh?Y!uR+Yc5oSiMe-sa`w3Qc%SxTZhnQm(R+ISUPT)^O*Ew@l9NxW*L(wOVHP1uMU6
zL)yM)P<N!D0vV?#^;n-Gc}@@&y?whW6a0-UNB>-Xycx;ilPJ~ffd0HCp_}Uu*Xf@*
zy|TKyYc2lSIqnx#dYIZ2<&-NPi#cC7=Ar@DPgW%1QVqeq2{)+Byr+`sw+edV?C{(B
ze2E(sx1<F(TCFOuAjt%g2|S=pICqw3H&Uk|Y-mRN*TrXTT%=Sg*s9K}!3gi{t8Mkv
z4AH8f$j{7}cF@jatCNFB3B({tOyGB9i>T|higWCWj6v*IB(%0Dj3RLb7q)6v!E#<s
zta9e_TrI-lQYd9Qc|GTHH_5pnHx49W-WC<md$ZaV5c#M2ME0Fd-7?wt9VTme6)qjC
z`flm7@8=R{AC3$5O|=I?gALn62mZV_GGsfV(-t_m2m9lL4%vnX6I2I0(3$@1B1w0w
zf8$CJiK1RFL2#YQFCM3g4a!4R^~}>;QiD~LfH_VvP}rN(%ZtA+u0D;%SX=$r4qgU9
z5_T2`M;I9kMHu@s4B5u^AyL*k*&@M61P}{EP6!8r5XS8Upv~Yi4ujZkcj6B}(T`O~
zp1S?uy?ODokEdIZW1lMOqz;_yx0C2$<3Dgmw1C(tl=MvwZtTPX7ArcicP4NHI<A|M
zC25(n>g@}&!>}tim?mT=TdcB8vq{vQHn#kcUw>HTXB9d#emUfGpt7fN%?mCpWCT2O
zSv@FGxj~R`aH;NvFA(MdTdqVovwlXoiU9p2EOe398PoH)U&@g@7-XF?Z<_U@=%9oB
zJRyTU?y5lW&AD>k+!wRo^aiEqx>^RaFf5@}o81}?9Gcg*!5#(5eUr*wG)HGb=A&eF
ziY(c7h%B+=JA}V@f5?)-zK|vR{UF%f!L9%~?sEec)le5;g$*%(o?xKq^BjZBUS@d7
z<g=u0?ye!G)&I(O30|L#&t9e3o7b<#zyHzMcoSUd+ue8*nfC?_LFkHI*J)Gc%jUjX
zN%<$}GhQzzt7?K8VVdie+GPc9(I4V)cPVRft<(Cqq=ZT`=V+vsHXn!@+zf>69+Xn`
z{z?7^00960w4A|D!Y~xZ&;A!ZZeb&GkQj|Io(vZ+YCMuDBXD3E2O%W>@%DSKuWL&;
zVc>btu4~`d*Y@|7sCGWE)a@=la6u4U9y^W++F|C6ldaB?$d6alp-{-NkS>t)22$j|
ziMp_ukU)A17|r9~Xp6|uzg@1qko;CZcWqFuGdc$DB(r~%eXGi<zzX3VeMx{^MWIAK
zm}!8vn!2MWVU48Lw~+(TfXr}1xc1wt6RHgzOD$wPaL95RTdQKeW^Pd!DtfAm;Lm><
zo+bt@wjc3u2GjW#_5vnkUdgK1P3r}gJ)DGML`;cOz3%{7Z@@d#Z3fPS)ykr`IB}#E
zhqG`BBN23DRnm16vC19wZ8!=8v)Xl9;GJM2kGX@&AP`5;;ye$KZe3kxqw!b^7rCLv
zrz)3TPa;a%YEA<>++&u5e$ca!tWiw7Soa67S}f!JY>vFmJ%hZySXN!=qqlZw`M>(3
zfY%D93Ao7yvQdhA0-QoJ>1dRmU|vf@ti@ywvrj1mX;HH_qum8pwj>AY%`=ZuyEuUH
zRUz>4nsa6`iL?+_1#qv)bmVfQCKrs0A@wuYAjucC%!vbkqKfSlINa$Og)~21Nb~av
zY2IH*^WH+5pG!z{VS>d!w5g795ZM_L3CAkdw;kF@IftF87iHA|dSHtaOVUR;v(#pp
zp4o%9KukH26q1tJ#=ctH`h_w?Q;M32_P9AfQj|bsEEm`=HJN8Ugrdx5<Ort9m`;Op
z%HpMb{{R8~l}XFspYzinJo0pA^JPkKe^yhH=UXaNvK*GfY;TY7?P2mVd3sF$hdN|r
zylcL+ujdZ{Xwl(gpsn`_T#OC?{h)vE6JvCG*E5pVyWf8S00960>|Mc595D<%=P#z0
z(p8p9oKX)*rRs^IJ@i;<i<T4YA{M$rh<<w$JC2=9l8Lvp2#F)hcqZc{_OtWsIW*5S
z>93N$)JXch3~{NMg?#0dCFH+^1B90%E4>kwCZ>n!N-slE`WN&hNEYS~hvsa!8sCjJ
z-udG6%jtp+zs}AjFQsv}sJxy#*60U!5eXe0Mjkj(WK*s{YHiErsm>D!CVzIEk`H!F
zkHA+p(ity*LNB(B@HCVMnTrA|;vMiALWW4)EjGvKdx%7HfSeQ-T@E)ZsG&r#Of;Gc
zIAmJhg*2u2@PV)+&RipR1ppkmG)zCmoHWZ2aBvG1Zx88g_kdp_6^smCA@m@);N(F)
z8woqM%`ptPUM)i>IhGXg<H9{;?W-GzkQ_+TQNJujivGwyErNDk#6nr<%<IE%&i-u2
z_d(r+^2<9Y{DhMCdtU>$+TnSJF=_cqT!JQFf5JcJWtx1S=}-mgZt?oyeC3LaTSh^b
zSp{lGdmnfUIH${Cl1kZ(uP0}pzkNSl1gcEfAz_Pf?JO^bpe%C2yUU&`)Hn*RAjRLz
zwEB+1OPIt?8e>YQ_VAA<q0cJ8hv^a-w`H?i^NPZx#`VerX5d61QuU3{#I}}oEZh&s
zR|Ick%7+@eu$ZqpaKlM*7s$zQ*q)k{`Y1NtYkrA3yy^E>FbotnkclAcuvxPdcAFIR
zd}At^7uDL{U543s8k43nwj&k2Cm~RwcSf|{aP01ecH^uWX4yw6gfVF`N(=I$$a(%H
z8E-OQN{G|+dp|q2JQdGpr{`sM%-otCQ&5YJIdOmF)=JKAkT$36_^4LLzuOg7%H!3w
zcgLeDp@GV{CfqV~&e6MM5YxG18<~-Pt{AS@xM38~x?t=>rE$L?!LAqn)VSS5zQg5O
zTr`Qh9m<HW<#C4zcb9qFexA12vO+{`o&+@#*}6rZ1D!0{j{0oM>h@qeYRD@XcFa^x
zsLBaN98<D56<))rp>5>t5|2af0l%5BVC(8(*xb4)@J*TG<)Vo29#TPZ9r!bvj6WcJ
z5U<hHCj0q4@x^-~A>)-IU}BbuS#Gh9jBMn^DKD10=VfD*5UGzi$XB{pX!ucWHzY57
zKm7h6m+!2aQJRIX5424;;x+s{!z5N4B6J)i)Ttr1A;FiOpbb7fG1c-TP0AC@JDO);
zEgfN{vrRI_!j_E+m8h~kK$>M9TCpujaonu5G0q$!fV8Gb6lGwv7s@0vqCl7dSfX4X
zxFk#&p49;?OL#J2aH`L9aM@oHfZ0=D<k>Zd97S|!+~P-66i6H-a;@2x*22>21mVM5
z&BA}LS?DVq=ucXT+JOENf;Q9lsZrF}9g+EEx?eQrCCic6v((}B$77E&DAPwiwgRuJ
z!4C;^$3Oi@*y>VGwzrDxQ$1QN__oAKD^M{QH3cFLc2k9hZ7EJIBVo8yhl0`es}Qi2
zy>vU#FUSz`wd(w!?JB1Wz_bl|!$n%a`^ea+hD)tBk!VMG#2(U}hj&Lg;+ue@VrU&u
zv~OGyjlzg3NVHOn<f%sb8ZRx_Ow5)JZ<44Ia>gg_gF3A-`y$SWnx3ze3nn3at>>+j
z>kj|`0RR8(UF~z)$Ql1!PydK*I+w8n#*z>S;=9b?gj{F|_F&wM+qv-wN!YrApa`6J
zlHA|keO`9862g!)>2x}m4>4NpKHB$v_IdmL54dve?N_y*%3n!|_VTWJJj=(&{0qO%
zuZq1!c3Fy+x?mZuR^Q2Q=}(5=(zo}#$?R66FZI0Hv)ju2bn-qq-@(g8oh@5@H!5g`
zidaJX?tyY6=Y3E^!1A|$?vCDe--<(iyzKU0SLIb9M7&?qNn{h2B#+>vFhcUF2MNPE
zA!MII9brgd{jXMY{V4LCacj~*NRpE<x<5(eD46IY1<GLkZB;GA-Xi=90Qwt6D7;6o
zBm*6Qqi&z%VsLMZx%lO<;b@lsEug?F$~yM}66IGo+A=^9rX~(~A0l@x#m`Y9cj2kH
zSdV2>GQ@ClnOHz7xD6?*+-=P`RbDQ#4*(fTI5k^YA67CXa*XjOCp)xaDGvZB3Q?^e
z#MED9r628&tl6PDW$xrr!roCU3IsRC0A_L-lIsL){qK6CH<Bq5ox!zu*BK5wgVFUV
za^`RXg0co_0jhWm;Zgi0#2a})mKxZT?(pRsS*CN=>-R?2(2&=?(V%;IDPErsMMqq8
zhNIrgtA1xFF0O_b=a=1DW>_y<LH+P(ufudh2Q0t<j;E>Whif_J>0K7B1U%B>dvq8G
z<W$=^tmY8x0E1U|Qe1K`&o8bevs&x-&M>$P(otCPd*Q@aOlVTMJ16r3Tq!~U7Sa|O
z0DPqcN4~NHM?OP9EtF1Hg+%mo%O}x>xEq<CP(j}zmn83n@BIXY0vHvO`A_-ikf1<r
zC*d0SG7L+erfbPzz}&u_`%~;w!bHKb1@^kcL&9g|AHHmG#8Fv>BIolgXC7JE+Vk?z
z%0muCzCypR)%&@ME-5EEAuO>qw+;j<7cxe%zw?(NtoSOL-=Y*pUcBcD@DZHbq8YUz
znl5yOavx?cGM&Q42)4Uq_rHqd9+>(Ma+~}?O=R{zJWt?e0pj(hoab;2Uj$7T5Y_Gg
zO_!K@SSN5S<O(y4X(Bhkg}(~!*oh1c^_j3}5zP;+=1n=#-`e#YQRE=0T@-Q@t|$n)
zNk~u7TfT6KEa8LVwTFYs`}Z;{T!4@SfFt|hGZ<hrL=bsEgv@b#E8w7%cNt*h<3!J%
zcpOg&x&&&Uh!&E;Z~ZHptxx`WKNGiWIJ}5==Q#&4!KblLg+;iWFL0QCv#lR^g(`4j
zI>0YQ9TzPp{<SxFwabJL@&mMp+{iXuqY$V_zead-nBYGFLy#2%AlGLHmDPkWU7rCM
zp5$LXLKB($E*JFyF)gg)fc2RX<}#4~(WkP+_mn7SOr8T<%a;p4)INf*YXKldz-LM}
zah>mtr_a1aLzMQp&W~mkGS_At{cW(^PYWUQw}ELF^TAh+kLmfd{`PXOZ!2W)ul@G2
z@a@k<%k`auhCnUYxfSZw7lxN25;fFlgR6dDzQP_iCQl4T7UBE`a0(g0nx~Fx25!m!
z;Q9Rv4m-?*<kZZR167AVT#N09?oSnXyV!}`{**x4VKp6<(^WJnPMRjoenKQ0S;;*g
z@JgcWYR}+Y`jup57VFGqm!P-ps&F=lv7iMGa@f0O5MAU}?s3cr!3hE2(yMT8(35St
zAFn3>B@|*HIvA6xxapk_&R(<FSo^Xhxb{RMepGwQsi;&EUa2r7$uBaC?ubDC4|d^1
zb2X_dgy$n+uFgb#gi*g?Yfk0WO)^bW{{e>sf7Mp^ats1o>-p4#k|{OulX*IgA{Zsi
zL5-qu-EuvG8BBhJs!!i3!GpqcU?xEK+#WrmJL1>5-1iTugVZ;&dlW5zP38pV|8cmC
z;T96S(1_RLpy3Bm)0;%?mQ(i{UZd_rmgChY&A<-AN$6Y6hFh<T!#A=*;`oIUW1l!R
zr*Sg#Q;hF0KPgE*+6j|wLhLGl>`QrE{$)KCPFvpKo?Fgyt4?>MW6M<l*)zDX6F&BG
zJ_d~nrWlZra6vvpm~788VX~WzmTgU}Xks;@R?v>>_4>s2eAkU+KC3mhoAtnV+AV<4
zMh-ehA6O_j<@vOrGc*)uf2Z#}XY4AJU!f;H_=%EdvZ|F&l|&u_F}e>*;(BmcXbw}Z
zOvq3$kg~v=fVr84lO&0b35UsH;}Jzzb`&v@DO_M4R6Kza!3OFgl+c5cXmVw@JlQ%`
zrJOtGI09Z~jsYe7l=}i{P2y!rV#Mrb0ezGJAIYpAEFGi!u!D{a;O-G|$9UnsWrSgK
z5L8$AnSRYIEvG-IClluAsv>T-npNT%`Og%bs_Sj*gXClVWpD>C{N?Q4yPNI@Al_&@
zmhbva#~s@fHyqb(E3^aGZMVH~)3qYUcbkoR)c6tr@eDM)R<rA_-I%oH9Q_&q@n#-C
zy#4(E#BnkFvIz-}i|7Uw#i+5(fr1xa9z7RVI7ua$`81UE6vf$5+xCTR#P@&<$BZ5T
zh6BVoj4NWgf+)w25%U@_W~aD#<di~i^5OZ})#a!vUUmDO>zl!4_hnTK&#wlr<T4o?
zA@n%rgENac5ojHW=VzrApk1ecTmCp4J4nK~N($io3t-~K{-Z2*qMvKT^IC1<Sq;yV
zTduta`nikf=k9-se*S+BB2G~0u)@U9Je+3omaN+P&5*{$9}mRew9w9Jd^z-Z1~*=-
zIj+_8yk<)d-`7Bo^8`^d<Z<Y6;E@R>8-6+Z7vW^f3#`AMQi?8u{YYi-r<47xXFuKS
zXCwRB%v15QH?8bv+bHU1zdc{Wikr(nPjL|&HCx1v`A|0>T=St(Bw~Jd5jV{TFZYnk
z*D8`}KZ+!t+lI&6-|-X)gLdG%f$KGEHP?0IG3o_%>k$m`9E}nH@!Wen1KVEJw&gJh
zf8Bf#m%`bQMR4I0Nj#g8n$8H#GRiY`$_7ct2cghS$QxLau{QvqkHC_I(K|uPJ(4@e
zCl29tgRI?6rg6;SGnS&!^3nKH&hv{9P7C%Na!bi<I>65yG)bAi7q-z*=}^cTW#20A
zS&vl`?sgoyBGcMwvw`xen>F7QM$lXRC^EyP()P%_(44L9$moduT9Y>h+g0~J7;WVM
zXiDeFS)U40)t<i_bcZ*udZs-zwS3oVGTEl_jtso6e0Lm;y|EPrwOSaqT0!7OL3`)A
zG6`*6TxKR*VGWm782rT*wk7|z^;P|Sef_?^{;TWD<o8V_uu4;_$hQ4SIQAP+t!A|*
zk<+lFXk4<2a%BsOWt~opOx0-sBU5#4xRi-9m6h03M2UlAQbGgQivmr&59=F=h9+Rv
zh>)|C2`wj*=pJQCs~n4s3?deyLC4p8r(bJ`@8b1`^{}co@;?7SLIwa31OK#S65pbX
zV4ziB1ad%t21|bytq?yK{mW%tRMZ*`IE8h(o$JMK%6bq-mx7PNtX4KdC>e?T;Eulu
z@`x}>gJnEMSP2AFRxxKN3lhjj@sdL@kyBtIM%Ncz`6QGsL_TV@$6K6tuez^0SN)O9
z1kQgG7${Yku7~nj6{my(fy+^+-v|6(CZLOFw@QOVmMCnv7;F}!3ux}EkRZx)4~&ch
z$fL8!rB=}1sBN2+H!vrU|6KA7ok;YKdG2<NK>-RGa##*9js`W=JAYL?#L<+HqIu?~
zGcflBxl+;EcQH@V+!t(SRXj1KSR8QJl2WrfQQ(Wp%T&#iaISnX3v*7}C`v+IocY`^
zv?9X0Dfb9Up%t`Xk;sx(BVy!%L<tPkK!&fptPC}ncy=I^9!xw#Js3D^vBm<7-VafK
zk2gB``c%COk`+c0DoVxi0`*a3(r~LP3?Vp9F7f%aOrXA_sL`jNPbnlUO1YKR4XPx5
z<PHKsH!7t#x)tn_jb_!Zi;Cxv=xU?gnMtcw1lUuKo~ME)nd19ZYRc}lW^a|M7Jzn1
zeEK9fDN$)~0&O8w67ZJvP!ygIXZ)p1U*Lc**GaYuf(R9CQq5fo=Z(2lv7Vd^D$$6N
za~d1fDAOmPgoGhv#4Ju?xkQBhHa<f-Bw9#gv;hSZaWbO~=b1IVf{!kl?D@$EYBf<%
ztMRzCEV!k&+g00vVJl{0NbV1y&$5s5QDI>~a@&kjmGOo6@Tp(r?K2ldRO@vYYdI?q
zpOlpakzo`*$woh`g3>19h7a3echEWOcW*9w2jY=R$>V7?59U*<mfFrQhQ0Hf-r!Al
z*wd91yIBw=@!Mn?)SG>6-CB-g`%OD^+K=116{s8bZl1Ds(;5`gwan1~3k=u5@}OMt
zLdu7t@xbPRIXEA_?ew!OrH7(EIya9!%PeZ1Z2HuxJBA+YiOGaLIrulQzvT)?t_1+v
C_JCdh

literal 0
HcmV?d00001

diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch
deleted file mode 100644
index 68e2798181fb..000000000000
--- a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch
+++ /dev/null
@@ -1,209 +0,0 @@
-From ba67ba3275d47e0080f0e5f09d9f5102c000c97e Mon Sep 17 00:00:00 2001
-Message-Id: <ba67ba3275d47e0080f0e5f09d9f5102c000c97e.1495998948.git.fweimer@redhat.com>
-In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
-References: <cover.1495998948.git.fweimer@redhat.com>
-From: Florian Weimer <fweimer@redhat.com>
-Date: Sun, 28 May 2017 20:44:52 +0200
-Subject: [PATCH 3/3] rtld: Reject overly long LD_AUDIT path elements
-To: libc-alpha@sourceware.org
-
-Also only process the last LD_AUDIT entry.
----
- elf/rtld.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 95 insertions(+), 15 deletions(-)
-
-diff --git a/elf/rtld.c b/elf/rtld.c
-index 30f0cae..89d8573 100644
---- a/elf/rtld.c
-+++ b/elf/rtld.c
-@@ -116,13 +116,95 @@ dso_name_valid_for_suid (const char *p)
-   return *p != '\0';
- }
- 
--/* List of auditing DSOs.  */
-+/* LD_AUDIT variable contents.  Must be processed before the
-+   audit_list below.  */
-+const char *audit_list_string;
-+
-+/* Cyclic list of auditing DSOs.  audit_list->next is the first
-+   element.  */
- static struct audit_list
- {
-   const char *name;
-   struct audit_list *next;
- } *audit_list;
- 
-+/* Iterator for audit_list_string followed by audit_list.  */
-+struct audit_list_iter
-+{
-+  /* Tail of audit_list_string still needing processing, or NULL.  */
-+  const char *audit_list_tail;
-+
-+  /* The list element returned in the previous iteration.  NULL before
-+     the first element.  */
-+  struct audit_list *previous;
-+
-+  /* Scratch buffer for returning a name which is part of
-+     audit_list_string.  */
-+#ifdef PATH_MAX
-+  char fname[PATH_MAX];
-+#else
-+  char fname[4096];
-+#endif
-+};
-+
-+/* Initialize an audit list iterator.  */
-+static void
-+audit_list_iter_init (struct audit_list_iter *iter)
-+{
-+  iter->audit_list_tail = audit_list_string;
-+  iter->previous = NULL;
-+}
-+
-+/* Iterate through both audit_list_string and audit_list.  */
-+static const char *
-+audit_list_iter_next (struct audit_list_iter *iter)
-+{
-+  if (iter->audit_list_tail != NULL)
-+    {
-+      /* First iterate over audit_list_string.  */
-+      while (*iter->audit_list_tail != '\0')
-+	{
-+	  /* Split audit list at colon.  */
-+	  size_t len = strcspn (iter->audit_list_tail, ":");
-+	  if (len > 0 && len < sizeof(iter->fname))
-+	    {
-+	      memcpy (iter->fname, iter->audit_list_tail, len);
-+	      iter->fname[len] = '\0';
-+	    }
-+	  else
-+	    /* Do not return this name to the caller.  */
-+	    iter->fname[0] = '\0';
-+
-+	  /* Skip over the substring and the following delimiter.  */
-+	  iter->audit_list_tail += len;
-+	  if (*iter->audit_list_tail == ':')
-+	    ++iter->audit_list_tail;
-+
-+	  /* If the name is valid, return it.  */
-+	  if (dso_name_valid_for_suid (iter->fname))
-+	    return iter->fname;
-+	  /* Otherwise, wrap around and try the next name.  */
-+	}
-+      /* Fall through to the procesing of audit_list.  */
-+    }
-+
-+  if (iter->previous == NULL)
-+    {
-+      if (audit_list == NULL)
-+	/* No pre-parsed audit list.  */
-+	return NULL;
-+      /* Start of audit list.  The first list element is at
-+	 audit_list->next (cyclic list).  */
-+      iter->previous = audit_list->next;
-+      return iter->previous->name;
-+    }
-+  if (iter->previous == audit_list)
-+    /* Cyclic list wrap-around.  */
-+    return NULL;
-+  iter->previous = iter->previous->next;
-+  return iter->previous->name;
-+}
-+
- #ifndef HAVE_INLINED_SYSCALLS
- /* Set nonzero during loading and initialization of executable and
-    libraries, cleared before the executable's entry point runs.  This
-@@ -1290,11 +1368,13 @@ of this helper program; chances are you did not intend to run this program.\n\
-     GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid ();
- 
-   /* If we have auditing DSOs to load, do it now.  */
--  if (__glibc_unlikely (audit_list != NULL))
-+  bool need_security_init = true;
-+  if (__glibc_unlikely (audit_list != NULL)
-+      || __glibc_unlikely (audit_list_string != NULL))
-     {
--      /* Iterate over all entries in the list.  The order is important.  */
-       struct audit_ifaces *last_audit = NULL;
--      struct audit_list *al = audit_list->next;
-+      struct audit_list_iter al_iter;
-+      audit_list_iter_init (&al_iter);
- 
-       /* Since we start using the auditing DSOs right away we need to
- 	 initialize the data structures now.  */
-@@ -1305,9 +1385,14 @@ of this helper program; chances are you did not intend to run this program.\n\
- 	 use different values (especially the pointer guard) and will
- 	 fail later on.  */
-       security_init ();
-+      need_security_init = false;
- 
--      do
-+      while (true)
- 	{
-+	  const char *name = audit_list_iter_next (&al_iter);
-+	  if (name == NULL)
-+	    break;
-+
- 	  int tls_idx = GL(dl_tls_max_dtv_idx);
- 
- 	  /* Now it is time to determine the layout of the static TLS
-@@ -1316,7 +1401,7 @@ of this helper program; chances are you did not intend to run this program.\n\
- 	     no DF_STATIC_TLS bit is set.  The reason is that we know
- 	     glibc will use the static model.  */
- 	  struct dlmopen_args dlmargs;
--	  dlmargs.fname = al->name;
-+	  dlmargs.fname = name;
- 	  dlmargs.map = NULL;
- 
- 	  const char *objname;
-@@ -1329,7 +1414,7 @@ of this helper program; chances are you did not intend to run this program.\n\
- 	    not_loaded:
- 	      _dl_error_printf ("\
- ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
--				al->name, err_str);
-+				name, err_str);
- 	      if (malloced)
- 		free ((char *) err_str);
- 	    }
-@@ -1433,10 +1518,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
- 		  goto not_loaded;
- 		}
- 	    }
--
--	  al = al->next;
- 	}
--      while (al != audit_list->next);
- 
-       /* If we have any auditing modules, announce that we already
- 	 have two objects loaded.  */
-@@ -1700,7 +1782,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
-   if (tcbp == NULL)
-     tcbp = init_tls ();
- 
--  if (__glibc_likely (audit_list == NULL))
-+  if (__glibc_likely (need_security_init))
-     /* Initialize security features.  But only if we have not done it
-        earlier.  */
-     security_init ();
-@@ -2331,9 +2413,7 @@ process_dl_audit (char *str)
-   char *p;
- 
-   while ((p = (strsep) (&str, ":")) != NULL)
--    if (p[0] != '\0'
--	&& (__builtin_expect (! __libc_enable_secure, 1)
--	    || strchr (p, '/') == NULL))
-+    if (dso_name_valid_for_suid (p))
-       {
- 	/* This is using the local malloc, not the system malloc.  The
- 	   memory can never be freed.  */
-@@ -2397,7 +2477,7 @@ process_envvars (enum mode *modep)
- 	      break;
- 	    }
- 	  if (memcmp (envline, "AUDIT", 5) == 0)
--	    process_dl_audit (&envline[6]);
-+	    audit_list_string = &envline[6];
- 	  break;
- 
- 	case 7:
--- 
-2.9.4
-
diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
deleted file mode 100644
index 88b1925fa126..000000000000
--- a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 4d009d39ac9ede0369e268554a181b428f177a80 Mon Sep 17 00:00:00 2001
-Message-Id: <4d009d39ac9ede0369e268554a181b428f177a80.1495998948.git.fweimer@redhat.com>
-In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
-References: <cover.1495998948.git.fweimer@redhat.com>
-From: Florian Weimer <fweimer@redhat.com>
-Date: Sun, 28 May 2017 20:37:40 +0200
-Subject: [PATCH 1/3] rtld: Completely ignore LD_LIBRARY_PATH for AT_SECURE=1
- programs
-To: libc-alpha@sourceware.org
-
-LD_LIBRARY_PATH can only be used to reorder system search paths, which
-is not useful functionality.
----
- elf/rtld.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/elf/rtld.c b/elf/rtld.c
-index 319ef06..824b6cf 100644
---- a/elf/rtld.c
-+++ b/elf/rtld.c
-@@ -2419,7 +2419,8 @@ process_envvars (enum mode *modep)
- 
- 	case 12:
- 	  /* The library search path.  */
--	  if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
-+	  if (!__libc_enable_secure
-+	      && memcmp (envline, "LIBRARY_PATH", 12) == 0)
- 	    {
- 	      library_path = &envline[13];
- 	      break;
--- 
-2.9.4
-
diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch
deleted file mode 100644
index 76be2a3308f6..000000000000
--- a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 65ff0b7a085b85271ec8fde99f542281b495e3bc Mon Sep 17 00:00:00 2001
-Message-Id: <65ff0b7a085b85271ec8fde99f542281b495e3bc.1495998948.git.fweimer@redhat.com>
-In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
-References: <cover.1495998948.git.fweimer@redhat.com>
-From: Florian Weimer <fweimer@redhat.com>
-Date: Sun, 28 May 2017 20:57:40 +0200
-Subject: [PATCH 2/3] rtld: Reject overly long LD_PRELOAD path elements
-To: libc-alpha@sourceware.org
-
----
- elf/rtld.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++---------------
- 1 file changed, 53 insertions(+), 16 deletions(-)
-
-diff --git a/elf/rtld.c b/elf/rtld.c
-index 824b6cf..30f0cae 100644
---- a/elf/rtld.c
-+++ b/elf/rtld.c
-@@ -99,6 +99,22 @@ uintptr_t __pointer_chk_guard_local
- strong_alias (__pointer_chk_guard_local, __pointer_chk_guard)
- #endif
- 
-+/* Check that AT_SECURE=0, or that the passed name does not contain
-+   directories and is not overly long.  Reject empty names
-+   unconditionally.  */
-+static bool
-+dso_name_valid_for_suid (const char *p)
-+{
-+  if (__glibc_unlikely (__libc_enable_secure))
-+    {
-+      /* Ignore pathnames with directories for AT_SECURE=1
-+	 programs, and also skip overlong names.  */
-+      size_t len = strlen (p);
-+      if (len >= NAME_MAX || memchr (p, '/', len) != NULL)
-+	return false;
-+    }
-+  return *p != '\0';
-+}
- 
- /* List of auditing DSOs.  */
- static struct audit_list
-@@ -716,6 +732,46 @@ static const char *preloadlist attribute_relro;
- /* Nonzero if information about versions has to be printed.  */
- static int version_info attribute_relro;
- 
-+/* The LD_PRELOAD environment variable gives list of libraries
-+   separated by white space or colons that are loaded before the
-+   executable's dependencies and prepended to the global scope list.
-+   (If the binary is running setuid all elements containing a '/' are
-+   ignored since it is insecure.)  Return the number of preloads
-+   performed.  */
-+unsigned int
-+handle_ld_preload (const char *preloadlist, struct link_map *main_map)
-+{
-+  unsigned int npreloads = 0;
-+  const char *p = preloadlist;
-+#ifdef PATH_MAX
-+  char fname[PATH_MAX];
-+#else
-+  char fname[4096];
-+#endif
-+
-+  while (*p != '\0')
-+    {
-+      /* Split preload list at space/colon.  */
-+      size_t len = strcspn (p, " :");
-+      if (len > 0 && len < sizeof(fname))
-+	{
-+	  memcpy (fname, p, len);
-+	  fname[len] = '\0';
-+	}
-+      else
-+	fname[0] = '\0';
-+
-+      /* Skip over the substring and the following delimiter.  */
-+      p += len;
-+      if (*p == ' ' || *p == ':')
-+	++p;
-+
-+      if (dso_name_valid_for_suid (fname))
-+	npreloads += do_preload (fname, main_map, "LD_PRELOAD");
-+    }
-+  return npreloads;
-+}
-+
- static void
- dl_main (const ElfW(Phdr) *phdr,
- 	 ElfW(Word) phnum,
-@@ -1462,23 +1514,8 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
- 
-   if (__glibc_unlikely (preloadlist != NULL))
-     {
--      /* The LD_PRELOAD environment variable gives list of libraries
--	 separated by white space or colons that are loaded before the
--	 executable's dependencies and prepended to the global scope
--	 list.  If the binary is running setuid all elements
--	 containing a '/' are ignored since it is insecure.  */
--      char *list = strdupa (preloadlist);
--      char *p;
--
-       HP_TIMING_NOW (start);
--
--      /* Prevent optimizing strsep.  Speed is not important here.  */
--      while ((p = (strsep) (&list, " :")) != NULL)
--	if (p[0] != '\0'
--	    && (__builtin_expect (! __libc_enable_secure, 1)
--		|| strchr (p, '/') == NULL))
--	  npreloads += do_preload (p, main_map, "LD_PRELOAD");
--
-+      npreloads += handle_ld_preload (preloadlist, main_map);
-       HP_TIMING_NOW (stop);
-       HP_TIMING_DIFF (diff, start, stop);
-       HP_TIMING_ACCUM_NT (load_time, diff);
--- 
-2.9.4
-
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 1b53acf12b17..af85de0cf1ef 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -19,6 +19,7 @@
 let
   inherit (buildPackages) linuxHeaders;
   version = "2.25";
+  patchSuffix = "-49";
   sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
@@ -38,7 +39,15 @@ stdenv.mkDerivation ({
   enableParallelBuilding = true;
 
   patches =
-    [ /* Have rpcgen(1) look for cpp(1) in $PATH.  */
+    [
+      /*  No tarballs for stable upstream branch, only https://sourceware.org/git/?p=glibc.git
+          $ git co release/2.25/master; git describe
+          glibc-2.25-49-gbc5ace67fe
+          $ git show --reverse glibc-2.25..release/2.25/master | gzip -n -9 --rsyncable - > 2.25-49.patch.gz
+      */
+      ./2.25-49.patch.gz
+
+      /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
 
       /* Allow NixOS and Nix to handle the locale-archive. */
@@ -59,15 +68,6 @@ stdenv.mkDerivation ({
          "/bin:/usr/bin", which is inappropriate on NixOS machines. This
          patch extends the search path by "/run/current-system/sw/bin". */
       ./fix_path_attribute_in_getconf.patch
-
-      /* Stack Clash */
-      ./CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
-      ./CVE-2017-1000366-rtld-LD_PRELOAD.patch
-      ./CVE-2017-1000366-rtld-LD_AUDIT.patch
-    ]
-    ++ lib.optionals stdenv.isi686 [
-      ./fix-i686-memchr.patch
-      ./i686-fix-vectorized-strcspn.patch
     ]
     ++ lib.optional stdenv.isx86_64 ./fix-x64-abi.patch;
 
@@ -145,7 +145,7 @@ stdenv.mkDerivation ({
 // (removeAttrs args [ "withLinuxHeaders" "withGd" ]) //
 
 {
-  name = name + "-${version}" +
+  name = name + "-${version}${patchSuffix}" +
     lib.optionalString (cross != null) "-${cross.config}";
 
   src = fetchurl {
diff --git a/pkgs/development/libraries/glibc/fix-i686-memchr.patch b/pkgs/development/libraries/glibc/fix-i686-memchr.patch
deleted file mode 100644
index 32564de9f3ae..000000000000
--- a/pkgs/development/libraries/glibc/fix-i686-memchr.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Fix i686 memchr overflow calculation (BZ#21182)
-
-https://sourceware.org/git/?p=glibc.git;a=commit;h=3abeeec5f46ff03
-diff --git a/sysdeps/i386/i686/multiarch/memchr-sse2.S b/sysdeps/i386/i686/multiarch/memchr-sse2.S
-index 910679c..e41f324 100644
---- a/sysdeps/i386/i686/multiarch/memchr-sse2.S
-+++ b/sysdeps/i386/i686/multiarch/memchr-sse2.S
-@@ -117,7 +117,6 @@ L(crosscache):
- 
- # ifndef USE_AS_RAWMEMCHR
- 	jnz	L(match_case2_prolog1)
--	lea	-16(%edx), %edx
-         /* Calculate the last acceptable address and check for possible
-            addition overflow by using satured math:
-            edx = ecx + edx
-@@ -125,6 +124,7 @@ L(crosscache):
- 	add	%ecx, %edx
- 	sbb	%eax, %eax
- 	or	%eax, %edx
-+	sub	$16, %edx
- 	jbe	L(return_null)
- 	lea	16(%edi), %edi
- # else
diff --git a/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch b/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch
deleted file mode 100644
index ba4ec7c60cb6..000000000000
--- a/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From adc7e06fb412a2a1ee52f8cb788caf436335b9f3 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Wed, 14 Jun 2017 08:11:22 +0200
-Subject: [PATCH] i686: Add missing IS_IN (libc) guards to vectorized strcspn
-
-Since commit d957c4d3fa48d685ff2726c605c988127ef99395 (i386: Compile
-rtld-*.os with -mno-sse -mno-mmx -mfpmath=387), vector intrinsics can
-no longer be used in ld.so, even if the compiled code never makes it
-into the final ld.so link.  This commit adds the missing IS_IN (libc)
-guard to the SSE 4.2 strcspn implementation, so that it can be used from
-ld.so in the future.
-
-(cherry picked from commit 69052a3a95da37169a08f9e59b2cc1808312753c)
----
- ChangeLog                               | 5 +++++
- sysdeps/i386/i686/multiarch/strcspn-c.c | 6 ++++--
- sysdeps/i386/i686/multiarch/varshift.c  | 4 +++-
- 3 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/sysdeps/i386/i686/multiarch/strcspn-c.c b/sysdeps/i386/i686/multiarch/strcspn-c.c
-index 6d61e19..ec230fb 100644
---- a/sysdeps/i386/i686/multiarch/strcspn-c.c
-+++ b/sysdeps/i386/i686/multiarch/strcspn-c.c
-@@ -1,2 +1,4 @@
--#define __strcspn_sse2 __strcspn_ia32
--#include <sysdeps/x86_64/multiarch/strcspn-c.c>
-+#if IS_IN (libc)
-+# define __strcspn_sse2 __strcspn_ia32
-+# include <sysdeps/x86_64/multiarch/strcspn-c.c>
-+#endif
-diff --git a/sysdeps/i386/i686/multiarch/varshift.c b/sysdeps/i386/i686/multiarch/varshift.c
-index 7760b96..6742a35 100644
---- a/sysdeps/i386/i686/multiarch/varshift.c
-+++ b/sysdeps/i386/i686/multiarch/varshift.c
-@@ -1 +1,3 @@
--#include <sysdeps/x86_64/multiarch/varshift.c>
-+#if IS_IN (libc)
-+# include <sysdeps/x86_64/multiarch/varshift.c>
-+#endif
--- 
-2.9.3
-

From 0f91a1dbd7e62723d0082ead91c27473cb1bc2d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 16:59:15 +0200
Subject: [PATCH 092/134] glibc: remove patch with blowfish support

---
 pkgs/development/libraries/glibc/common.nix   |   5 -
 .../glibc/glibc-crypt-blowfish.patch          | 795 ------------------
 2 files changed, 800 deletions(-)
 delete mode 100644 pkgs/development/libraries/glibc/glibc-crypt-blowfish.patch

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index af85de0cf1ef..3cc74b083c53 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -59,11 +59,6 @@ stdenv.mkDerivation ({
       /* Don't use /etc/ld.so.preload, but /etc/ld-nix.so.preload.  */
       ./dont-use-system-ld-so-preload.patch
 
-      /* Add blowfish password hashing support.  This is needed for
-         compatibility with old NixOS installations (since NixOS used
-         to default to blowfish). */
-      ./glibc-crypt-blowfish.patch
-
       /* The command "getconf CS_PATH" returns the default search path
          "/bin:/usr/bin", which is inappropriate on NixOS machines. This
          patch extends the search path by "/run/current-system/sw/bin". */
diff --git a/pkgs/development/libraries/glibc/glibc-crypt-blowfish.patch b/pkgs/development/libraries/glibc/glibc-crypt-blowfish.patch
deleted file mode 100644
index a0a8acdab63d..000000000000
--- a/pkgs/development/libraries/glibc/glibc-crypt-blowfish.patch
+++ /dev/null
@@ -1,795 +0,0 @@
-From http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/glibc/glibc-crypt-blowfish.patch?revision=1.7&view=markup
-
-diff -ru -N glibc-2.17-orig/crypt/crypt_blowfish.c glibc-2.17/crypt/crypt_blowfish.c
---- glibc-2.17-orig/crypt/crypt_blowfish.c	1970-01-01 01:00:00.000000000 +0100
-+++ glibc-2.17/crypt/crypt_blowfish.c	2013-01-22 23:30:12.340353965 +0100
-@@ -0,0 +1,743 @@
-+/*
-+ * This code comes from John the Ripper password cracker, with reentrant
-+ * and crypt(3) interfaces added, but optimizations specific to password
-+ * cracking removed.
-+ *
-+ * Written by Solar Designer <solar at openwall.com> in 1998-2002 and
-+ * placed in the public domain.
-+ *
-+ * There's absolutely no warranty.
-+ *
-+ * It is my intent that you should be able to use this on your system,
-+ * as a part of a software package, or anywhere else to improve security,
-+ * ensure compatibility, or for any other purpose. I would appreciate
-+ * it if you give credit where it is due and keep your modifications in
-+ * the public domain as well, but I don't require that in order to let
-+ * you place this code and any modifications you make under a license
-+ * of your choice.
-+ *
-+ * This implementation is compatible with OpenBSD bcrypt.c (version 2a)
-+ * by Niels Provos <provos at citi.umich.edu>, and uses some of his
-+ * ideas. The password hashing algorithm was designed by David Mazieres
-+ * <dm at lcs.mit.edu>.
-+ *
-+ * There's a paper on the algorithm that explains its design decisions:
-+ *
-+ *	http://www.usenix.org/events/usenix99/provos.html
-+ *
-+ * Some of the tricks in BF_ROUND might be inspired by Eric Young's
-+ * Blowfish library (I can't be sure if I would think of something if I
-+ * hadn't seen his code).
-+ */
-+
-+#include <string.h>
-+
-+#include <errno.h>
-+#ifndef __set_errno
-+#define __set_errno(val) errno = (val)
-+#endif
-+
-+#undef __CONST
-+#ifdef __GNUC__
-+#define __CONST __const
-+#else
-+#define __CONST
-+#endif
-+
-+#ifdef __i386__
-+#define BF_ASM				0 /* original OW patch has 1 */
-+#define BF_SCALE			1
-+#elif defined(__alpha__) || defined(__hppa__) || defined(__x86_64__)
-+#define BF_ASM				0
-+#define BF_SCALE			1
-+#else
-+#define BF_ASM				0
-+#define BF_SCALE			0
-+#endif
-+
-+typedef unsigned int BF_word;
-+
-+/* Number of Blowfish rounds, this is also hardcoded into a few places */
-+#define BF_N				16
-+
-+typedef BF_word BF_key[BF_N + 2];
-+
-+typedef struct {
-+	BF_word S[4][0x100];
-+	BF_key P;
-+} BF_ctx;
-+
-+/*
-+ * Magic IV for 64 Blowfish encryptions that we do at the end.
-+ * The string is "OrpheanBeholderScryDoubt" on big-endian.
-+ */
-+static BF_word BF_magic_w[6] = {
-+	0x4F727068, 0x65616E42, 0x65686F6C,
-+	0x64657253, 0x63727944, 0x6F756274
-+};
-+
-+/*
-+ * P-box and S-box tables initialized with digits of Pi.
-+ */
-+static BF_ctx BF_init_state = {
-+	{
-+		{
-+			0xd1310ba6, 0x98dfb5ac, 0x2ffd72db, 0xd01adfb7,
-+			0xb8e1afed, 0x6a267e96, 0xba7c9045, 0xf12c7f99,
-+			0x24a19947, 0xb3916cf7, 0x0801f2e2, 0x858efc16,
-+			0x636920d8, 0x71574e69, 0xa458fea3, 0xf4933d7e,
-+			0x0d95748f, 0x728eb658, 0x718bcd58, 0x82154aee,
-+			0x7b54a41d, 0xc25a59b5, 0x9c30d539, 0x2af26013,
-+			0xc5d1b023, 0x286085f0, 0xca417918, 0xb8db38ef,
-+			0x8e79dcb0, 0x603a180e, 0x6c9e0e8b, 0xb01e8a3e,
-+			0xd71577c1, 0xbd314b27, 0x78af2fda, 0x55605c60,
-+			0xe65525f3, 0xaa55ab94, 0x57489862, 0x63e81440,
-+			0x55ca396a, 0x2aab10b6, 0xb4cc5c34, 0x1141e8ce,
-+			0xa15486af, 0x7c72e993, 0xb3ee1411, 0x636fbc2a,
-+			0x2ba9c55d, 0x741831f6, 0xce5c3e16, 0x9b87931e,
-+			0xafd6ba33, 0x6c24cf5c, 0x7a325381, 0x28958677,
-+			0x3b8f4898, 0x6b4bb9af, 0xc4bfe81b, 0x66282193,
-+			0x61d809cc, 0xfb21a991, 0x487cac60, 0x5dec8032,
-+			0xef845d5d, 0xe98575b1, 0xdc262302, 0xeb651b88,
-+			0x23893e81, 0xd396acc5, 0x0f6d6ff3, 0x83f44239,
-+			0x2e0b4482, 0xa4842004, 0x69c8f04a, 0x9e1f9b5e,
-+			0x21c66842, 0xf6e96c9a, 0x670c9c61, 0xabd388f0,
-+			0x6a51a0d2, 0xd8542f68, 0x960fa728, 0xab5133a3,
-+			0x6eef0b6c, 0x137a3be4, 0xba3bf050, 0x7efb2a98,
-+			0xa1f1651d, 0x39af0176, 0x66ca593e, 0x82430e88,
-+			0x8cee8619, 0x456f9fb4, 0x7d84a5c3, 0x3b8b5ebe,
-+			0xe06f75d8, 0x85c12073, 0x401a449f, 0x56c16aa6,
-+			0x4ed3aa62, 0x363f7706, 0x1bfedf72, 0x429b023d,
-+			0x37d0d724, 0xd00a1248, 0xdb0fead3, 0x49f1c09b,
-+			0x075372c9, 0x80991b7b, 0x25d479d8, 0xf6e8def7,
-+			0xe3fe501a, 0xb6794c3b, 0x976ce0bd, 0x04c006ba,
-+			0xc1a94fb6, 0x409f60c4, 0x5e5c9ec2, 0x196a2463,
-+			0x68fb6faf, 0x3e6c53b5, 0x1339b2eb, 0x3b52ec6f,
-+			0x6dfc511f, 0x9b30952c, 0xcc814544, 0xaf5ebd09,
-+			0xbee3d004, 0xde334afd, 0x660f2807, 0x192e4bb3,
-+			0xc0cba857, 0x45c8740f, 0xd20b5f39, 0xb9d3fbdb,
-+			0x5579c0bd, 0x1a60320a, 0xd6a100c6, 0x402c7279,
-+			0x679f25fe, 0xfb1fa3cc, 0x8ea5e9f8, 0xdb3222f8,
-+			0x3c7516df, 0xfd616b15, 0x2f501ec8, 0xad0552ab,
-+			0x323db5fa, 0xfd238760, 0x53317b48, 0x3e00df82,
-+			0x9e5c57bb, 0xca6f8ca0, 0x1a87562e, 0xdf1769db,
-+			0xd542a8f6, 0x287effc3, 0xac6732c6, 0x8c4f5573,
-+			0x695b27b0, 0xbbca58c8, 0xe1ffa35d, 0xb8f011a0,
-+			0x10fa3d98, 0xfd2183b8, 0x4afcb56c, 0x2dd1d35b,
-+			0x9a53e479, 0xb6f84565, 0xd28e49bc, 0x4bfb9790,
-+			0xe1ddf2da, 0xa4cb7e33, 0x62fb1341, 0xcee4c6e8,
-+			0xef20cada, 0x36774c01, 0xd07e9efe, 0x2bf11fb4,
-+			0x95dbda4d, 0xae909198, 0xeaad8e71, 0x6b93d5a0,
-+			0xd08ed1d0, 0xafc725e0, 0x8e3c5b2f, 0x8e7594b7,
-+			0x8ff6e2fb, 0xf2122b64, 0x8888b812, 0x900df01c,
-+			0x4fad5ea0, 0x688fc31c, 0xd1cff191, 0xb3a8c1ad,
-+			0x2f2f2218, 0xbe0e1777, 0xea752dfe, 0x8b021fa1,
-+			0xe5a0cc0f, 0xb56f74e8, 0x18acf3d6, 0xce89e299,
-+			0xb4a84fe0, 0xfd13e0b7, 0x7cc43b81, 0xd2ada8d9,
-+			0x165fa266, 0x80957705, 0x93cc7314, 0x211a1477,
-+			0xe6ad2065, 0x77b5fa86, 0xc75442f5, 0xfb9d35cf,
-+			0xebcdaf0c, 0x7b3e89a0, 0xd6411bd3, 0xae1e7e49,
-+			0x00250e2d, 0x2071b35e, 0x226800bb, 0x57b8e0af,
-+			0x2464369b, 0xf009b91e, 0x5563911d, 0x59dfa6aa,
-+			0x78c14389, 0xd95a537f, 0x207d5ba2, 0x02e5b9c5,
-+			0x83260376, 0x6295cfa9, 0x11c81968, 0x4e734a41,
-+			0xb3472dca, 0x7b14a94a, 0x1b510052, 0x9a532915,
-+			0xd60f573f, 0xbc9bc6e4, 0x2b60a476, 0x81e67400,
-+			0x08ba6fb5, 0x571be91f, 0xf296ec6b, 0x2a0dd915,
-+			0xb6636521, 0xe7b9f9b6, 0xff34052e, 0xc5855664,
-+			0x53b02d5d, 0xa99f8fa1, 0x08ba4799, 0x6e85076a
-+		}, {
-+			0x4b7a70e9, 0xb5b32944, 0xdb75092e, 0xc4192623,
-+			0xad6ea6b0, 0x49a7df7d, 0x9cee60b8, 0x8fedb266,
-+			0xecaa8c71, 0x699a17ff, 0x5664526c, 0xc2b19ee1,
-+			0x193602a5, 0x75094c29, 0xa0591340, 0xe4183a3e,
-+			0x3f54989a, 0x5b429d65, 0x6b8fe4d6, 0x99f73fd6,
-+			0xa1d29c07, 0xefe830f5, 0x4d2d38e6, 0xf0255dc1,
-+			0x4cdd2086, 0x8470eb26, 0x6382e9c6, 0x021ecc5e,
-+			0x09686b3f, 0x3ebaefc9, 0x3c971814, 0x6b6a70a1,
-+			0x687f3584, 0x52a0e286, 0xb79c5305, 0xaa500737,
-+			0x3e07841c, 0x7fdeae5c, 0x8e7d44ec, 0x5716f2b8,
-+			0xb03ada37, 0xf0500c0d, 0xf01c1f04, 0x0200b3ff,
-+			0xae0cf51a, 0x3cb574b2, 0x25837a58, 0xdc0921bd,
-+			0xd19113f9, 0x7ca92ff6, 0x94324773, 0x22f54701,
-+			0x3ae5e581, 0x37c2dadc, 0xc8b57634, 0x9af3dda7,
-+			0xa9446146, 0x0fd0030e, 0xecc8c73e, 0xa4751e41,
-+			0xe238cd99, 0x3bea0e2f, 0x3280bba1, 0x183eb331,
-+			0x4e548b38, 0x4f6db908, 0x6f420d03, 0xf60a04bf,
-+			0x2cb81290, 0x24977c79, 0x5679b072, 0xbcaf89af,
-+			0xde9a771f, 0xd9930810, 0xb38bae12, 0xdccf3f2e,
-+			0x5512721f, 0x2e6b7124, 0x501adde6, 0x9f84cd87,
-+			0x7a584718, 0x7408da17, 0xbc9f9abc, 0xe94b7d8c,
-+			0xec7aec3a, 0xdb851dfa, 0x63094366, 0xc464c3d2,
-+			0xef1c1847, 0x3215d908, 0xdd433b37, 0x24c2ba16,
-+			0x12a14d43, 0x2a65c451, 0x50940002, 0x133ae4dd,
-+			0x71dff89e, 0x10314e55, 0x81ac77d6, 0x5f11199b,
-+			0x043556f1, 0xd7a3c76b, 0x3c11183b, 0x5924a509,
-+			0xf28fe6ed, 0x97f1fbfa, 0x9ebabf2c, 0x1e153c6e,
-+			0x86e34570, 0xeae96fb1, 0x860e5e0a, 0x5a3e2ab3,
-+			0x771fe71c, 0x4e3d06fa, 0x2965dcb9, 0x99e71d0f,
-+			0x803e89d6, 0x5266c825, 0x2e4cc978, 0x9c10b36a,
-+			0xc6150eba, 0x94e2ea78, 0xa5fc3c53, 0x1e0a2df4,
-+			0xf2f74ea7, 0x361d2b3d, 0x1939260f, 0x19c27960,
-+			0x5223a708, 0xf71312b6, 0xebadfe6e, 0xeac31f66,
-+			0xe3bc4595, 0xa67bc883, 0xb17f37d1, 0x018cff28,
-+			0xc332ddef, 0xbe6c5aa5, 0x65582185, 0x68ab9802,
-+			0xeecea50f, 0xdb2f953b, 0x2aef7dad, 0x5b6e2f84,
-+			0x1521b628, 0x29076170, 0xecdd4775, 0x619f1510,
-+			0x13cca830, 0xeb61bd96, 0x0334fe1e, 0xaa0363cf,
-+			0xb5735c90, 0x4c70a239, 0xd59e9e0b, 0xcbaade14,
-+			0xeecc86bc, 0x60622ca7, 0x9cab5cab, 0xb2f3846e,
-+			0x648b1eaf, 0x19bdf0ca, 0xa02369b9, 0x655abb50,
-+			0x40685a32, 0x3c2ab4b3, 0x319ee9d5, 0xc021b8f7,
-+			0x9b540b19, 0x875fa099, 0x95f7997e, 0x623d7da8,
-+			0xf837889a, 0x97e32d77, 0x11ed935f, 0x16681281,
-+			0x0e358829, 0xc7e61fd6, 0x96dedfa1, 0x7858ba99,
-+			0x57f584a5, 0x1b227263, 0x9b83c3ff, 0x1ac24696,
-+			0xcdb30aeb, 0x532e3054, 0x8fd948e4, 0x6dbc3128,
-+			0x58ebf2ef, 0x34c6ffea, 0xfe28ed61, 0xee7c3c73,
-+			0x5d4a14d9, 0xe864b7e3, 0x42105d14, 0x203e13e0,
-+			0x45eee2b6, 0xa3aaabea, 0xdb6c4f15, 0xfacb4fd0,
-+			0xc742f442, 0xef6abbb5, 0x654f3b1d, 0x41cd2105,
-+			0xd81e799e, 0x86854dc7, 0xe44b476a, 0x3d816250,
-+			0xcf62a1f2, 0x5b8d2646, 0xfc8883a0, 0xc1c7b6a3,
-+			0x7f1524c3, 0x69cb7492, 0x47848a0b, 0x5692b285,
-+			0x095bbf00, 0xad19489d, 0x1462b174, 0x23820e00,
-+			0x58428d2a, 0x0c55f5ea, 0x1dadf43e, 0x233f7061,
-+			0x3372f092, 0x8d937e41, 0xd65fecf1, 0x6c223bdb,
-+			0x7cde3759, 0xcbee7460, 0x4085f2a7, 0xce77326e,
-+			0xa6078084, 0x19f8509e, 0xe8efd855, 0x61d99735,
-+			0xa969a7aa, 0xc50c06c2, 0x5a04abfc, 0x800bcadc,
-+			0x9e447a2e, 0xc3453484, 0xfdd56705, 0x0e1e9ec9,
-+			0xdb73dbd3, 0x105588cd, 0x675fda79, 0xe3674340,
-+			0xc5c43465, 0x713e38d8, 0x3d28f89e, 0xf16dff20,
-+			0x153e21e7, 0x8fb03d4a, 0xe6e39f2b, 0xdb83adf7
-+		}, {
-+			0xe93d5a68, 0x948140f7, 0xf64c261c, 0x94692934,
-+			0x411520f7, 0x7602d4f7, 0xbcf46b2e, 0xd4a20068,
-+			0xd4082471, 0x3320f46a, 0x43b7d4b7, 0x500061af,
-+			0x1e39f62e, 0x97244546, 0x14214f74, 0xbf8b8840,
-+			0x4d95fc1d, 0x96b591af, 0x70f4ddd3, 0x66a02f45,
-+			0xbfbc09ec, 0x03bd9785, 0x7fac6dd0, 0x31cb8504,
-+			0x96eb27b3, 0x55fd3941, 0xda2547e6, 0xabca0a9a,
-+			0x28507825, 0x530429f4, 0x0a2c86da, 0xe9b66dfb,
-+			0x68dc1462, 0xd7486900, 0x680ec0a4, 0x27a18dee,
-+			0x4f3ffea2, 0xe887ad8c, 0xb58ce006, 0x7af4d6b6,
-+			0xaace1e7c, 0xd3375fec, 0xce78a399, 0x406b2a42,
-+			0x20fe9e35, 0xd9f385b9, 0xee39d7ab, 0x3b124e8b,
-+			0x1dc9faf7, 0x4b6d1856, 0x26a36631, 0xeae397b2,
-+			0x3a6efa74, 0xdd5b4332, 0x6841e7f7, 0xca7820fb,
-+			0xfb0af54e, 0xd8feb397, 0x454056ac, 0xba489527,
-+			0x55533a3a, 0x20838d87, 0xfe6ba9b7, 0xd096954b,
-+			0x55a867bc, 0xa1159a58, 0xcca92963, 0x99e1db33,
-+			0xa62a4a56, 0x3f3125f9, 0x5ef47e1c, 0x9029317c,
-+			0xfdf8e802, 0x04272f70, 0x80bb155c, 0x05282ce3,
-+			0x95c11548, 0xe4c66d22, 0x48c1133f, 0xc70f86dc,
-+			0x07f9c9ee, 0x41041f0f, 0x404779a4, 0x5d886e17,
-+			0x325f51eb, 0xd59bc0d1, 0xf2bcc18f, 0x41113564,
-+			0x257b7834, 0x602a9c60, 0xdff8e8a3, 0x1f636c1b,
-+			0x0e12b4c2, 0x02e1329e, 0xaf664fd1, 0xcad18115,
-+			0x6b2395e0, 0x333e92e1, 0x3b240b62, 0xeebeb922,
-+			0x85b2a20e, 0xe6ba0d99, 0xde720c8c, 0x2da2f728,
-+			0xd0127845, 0x95b794fd, 0x647d0862, 0xe7ccf5f0,
-+			0x5449a36f, 0x877d48fa, 0xc39dfd27, 0xf33e8d1e,
-+			0x0a476341, 0x992eff74, 0x3a6f6eab, 0xf4f8fd37,
-+			0xa812dc60, 0xa1ebddf8, 0x991be14c, 0xdb6e6b0d,
-+			0xc67b5510, 0x6d672c37, 0x2765d43b, 0xdcd0e804,
-+			0xf1290dc7, 0xcc00ffa3, 0xb5390f92, 0x690fed0b,
-+			0x667b9ffb, 0xcedb7d9c, 0xa091cf0b, 0xd9155ea3,
-+			0xbb132f88, 0x515bad24, 0x7b9479bf, 0x763bd6eb,
-+			0x37392eb3, 0xcc115979, 0x8026e297, 0xf42e312d,
-+			0x6842ada7, 0xc66a2b3b, 0x12754ccc, 0x782ef11c,
-+			0x6a124237, 0xb79251e7, 0x06a1bbe6, 0x4bfb6350,
-+			0x1a6b1018, 0x11caedfa, 0x3d25bdd8, 0xe2e1c3c9,
-+			0x44421659, 0x0a121386, 0xd90cec6e, 0xd5abea2a,
-+			0x64af674e, 0xda86a85f, 0xbebfe988, 0x64e4c3fe,
-+			0x9dbc8057, 0xf0f7c086, 0x60787bf8, 0x6003604d,
-+			0xd1fd8346, 0xf6381fb0, 0x7745ae04, 0xd736fccc,
-+			0x83426b33, 0xf01eab71, 0xb0804187, 0x3c005e5f,
-+			0x77a057be, 0xbde8ae24, 0x55464299, 0xbf582e61,
-+			0x4e58f48f, 0xf2ddfda2, 0xf474ef38, 0x8789bdc2,
-+			0x5366f9c3, 0xc8b38e74, 0xb475f255, 0x46fcd9b9,
-+			0x7aeb2661, 0x8b1ddf84, 0x846a0e79, 0x915f95e2,
-+			0x466e598e, 0x20b45770, 0x8cd55591, 0xc902de4c,
-+			0xb90bace1, 0xbb8205d0, 0x11a86248, 0x7574a99e,
-+			0xb77f19b6, 0xe0a9dc09, 0x662d09a1, 0xc4324633,
-+			0xe85a1f02, 0x09f0be8c, 0x4a99a025, 0x1d6efe10,
-+			0x1ab93d1d, 0x0ba5a4df, 0xa186f20f, 0x2868f169,
-+			0xdcb7da83, 0x573906fe, 0xa1e2ce9b, 0x4fcd7f52,
-+			0x50115e01, 0xa70683fa, 0xa002b5c4, 0x0de6d027,
-+			0x9af88c27, 0x773f8641, 0xc3604c06, 0x61a806b5,
-+			0xf0177a28, 0xc0f586e0, 0x006058aa, 0x30dc7d62,
-+			0x11e69ed7, 0x2338ea63, 0x53c2dd94, 0xc2c21634,
-+			0xbbcbee56, 0x90bcb6de, 0xebfc7da1, 0xce591d76,
-+			0x6f05e409, 0x4b7c0188, 0x39720a3d, 0x7c927c24,
-+			0x86e3725f, 0x724d9db9, 0x1ac15bb4, 0xd39eb8fc,
-+			0xed545578, 0x08fca5b5, 0xd83d7cd3, 0x4dad0fc4,
-+			0x1e50ef5e, 0xb161e6f8, 0xa28514d9, 0x6c51133c,
-+			0x6fd5c7e7, 0x56e14ec4, 0x362abfce, 0xddc6c837,
-+			0xd79a3234, 0x92638212, 0x670efa8e, 0x406000e0
-+		}, {
-+			0x3a39ce37, 0xd3faf5cf, 0xabc27737, 0x5ac52d1b,
-+			0x5cb0679e, 0x4fa33742, 0xd3822740, 0x99bc9bbe,
-+			0xd5118e9d, 0xbf0f7315, 0xd62d1c7e, 0xc700c47b,
-+			0xb78c1b6b, 0x21a19045, 0xb26eb1be, 0x6a366eb4,
-+			0x5748ab2f, 0xbc946e79, 0xc6a376d2, 0x6549c2c8,
-+			0x530ff8ee, 0x468dde7d, 0xd5730a1d, 0x4cd04dc6,
-+			0x2939bbdb, 0xa9ba4650, 0xac9526e8, 0xbe5ee304,
-+			0xa1fad5f0, 0x6a2d519a, 0x63ef8ce2, 0x9a86ee22,
-+			0xc089c2b8, 0x43242ef6, 0xa51e03aa, 0x9cf2d0a4,
-+			0x83c061ba, 0x9be96a4d, 0x8fe51550, 0xba645bd6,
-+			0x2826a2f9, 0xa73a3ae1, 0x4ba99586, 0xef5562e9,
-+			0xc72fefd3, 0xf752f7da, 0x3f046f69, 0x77fa0a59,
-+			0x80e4a915, 0x87b08601, 0x9b09e6ad, 0x3b3ee593,
-+			0xe990fd5a, 0x9e34d797, 0x2cf0b7d9, 0x022b8b51,
-+			0x96d5ac3a, 0x017da67d, 0xd1cf3ed6, 0x7c7d2d28,
-+			0x1f9f25cf, 0xadf2b89b, 0x5ad6b472, 0x5a88f54c,
-+			0xe029ac71, 0xe019a5e6, 0x47b0acfd, 0xed93fa9b,
-+			0xe8d3c48d, 0x283b57cc, 0xf8d56629, 0x79132e28,
-+			0x785f0191, 0xed756055, 0xf7960e44, 0xe3d35e8c,
-+			0x15056dd4, 0x88f46dba, 0x03a16125, 0x0564f0bd,
-+			0xc3eb9e15, 0x3c9057a2, 0x97271aec, 0xa93a072a,
-+			0x1b3f6d9b, 0x1e6321f5, 0xf59c66fb, 0x26dcf319,
-+			0x7533d928, 0xb155fdf5, 0x03563482, 0x8aba3cbb,
-+			0x28517711, 0xc20ad9f8, 0xabcc5167, 0xccad925f,
-+			0x4de81751, 0x3830dc8e, 0x379d5862, 0x9320f991,
-+			0xea7a90c2, 0xfb3e7bce, 0x5121ce64, 0x774fbe32,
-+			0xa8b6e37e, 0xc3293d46, 0x48de5369, 0x6413e680,
-+			0xa2ae0810, 0xdd6db224, 0x69852dfd, 0x09072166,
-+			0xb39a460a, 0x6445c0dd, 0x586cdecf, 0x1c20c8ae,
-+			0x5bbef7dd, 0x1b588d40, 0xccd2017f, 0x6bb4e3bb,
-+			0xdda26a7e, 0x3a59ff45, 0x3e350a44, 0xbcb4cdd5,
-+			0x72eacea8, 0xfa6484bb, 0x8d6612ae, 0xbf3c6f47,
-+			0xd29be463, 0x542f5d9e, 0xaec2771b, 0xf64e6370,
-+			0x740e0d8d, 0xe75b1357, 0xf8721671, 0xaf537d5d,
-+			0x4040cb08, 0x4eb4e2cc, 0x34d2466a, 0x0115af84,
-+			0xe1b00428, 0x95983a1d, 0x06b89fb4, 0xce6ea048,
-+			0x6f3f3b82, 0x3520ab82, 0x011a1d4b, 0x277227f8,
-+			0x611560b1, 0xe7933fdc, 0xbb3a792b, 0x344525bd,
-+			0xa08839e1, 0x51ce794b, 0x2f32c9b7, 0xa01fbac9,
-+			0xe01cc87e, 0xbcc7d1f6, 0xcf0111c3, 0xa1e8aac7,
-+			0x1a908749, 0xd44fbd9a, 0xd0dadecb, 0xd50ada38,
-+			0x0339c32a, 0xc6913667, 0x8df9317c, 0xe0b12b4f,
-+			0xf79e59b7, 0x43f5bb3a, 0xf2d519ff, 0x27d9459c,
-+			0xbf97222c, 0x15e6fc2a, 0x0f91fc71, 0x9b941525,
-+			0xfae59361, 0xceb69ceb, 0xc2a86459, 0x12baa8d1,
-+			0xb6c1075e, 0xe3056a0c, 0x10d25065, 0xcb03a442,
-+			0xe0ec6e0e, 0x1698db3b, 0x4c98a0be, 0x3278e964,
-+			0x9f1f9532, 0xe0d392df, 0xd3a0342b, 0x8971f21e,
-+			0x1b0a7441, 0x4ba3348c, 0xc5be7120, 0xc37632d8,
-+			0xdf359f8d, 0x9b992f2e, 0xe60b6f47, 0x0fe3f11d,
-+			0xe54cda54, 0x1edad891, 0xce6279cf, 0xcd3e7e6f,
-+			0x1618b166, 0xfd2c1d05, 0x848fd2c5, 0xf6fb2299,
-+			0xf523f357, 0xa6327623, 0x93a83531, 0x56cccd02,
-+			0xacf08162, 0x5a75ebb5, 0x6e163697, 0x88d273cc,
-+			0xde966292, 0x81b949d0, 0x4c50901b, 0x71c65614,
-+			0xe6c6c7bd, 0x327a140a, 0x45e1d006, 0xc3f27b9a,
-+			0xc9aa53fd, 0x62a80f00, 0xbb25bfe2, 0x35bdd2f6,
-+			0x71126905, 0xb2040222, 0xb6cbcf7c, 0xcd769c2b,
-+			0x53113ec0, 0x1640e3d3, 0x38abbd60, 0x2547adf0,
-+			0xba38209c, 0xf746ce76, 0x77afa1c5, 0x20756060,
-+			0x85cbfe4e, 0x8ae88dd8, 0x7aaaf9b0, 0x4cf9aa7e,
-+			0x1948c25c, 0x02fb8a8c, 0x01c36ae4, 0xd6ebe1f9,
-+			0x90d4f869, 0xa65cdea0, 0x3f09252d, 0xc208e69f,
-+			0xb74e6132, 0xce77e25b, 0x578fdfe3, 0x3ac372e6
-+		}
-+	}, {
-+		0x243f6a88, 0x85a308d3, 0x13198a2e, 0x03707344,
-+		0xa4093822, 0x299f31d0, 0x082efa98, 0xec4e6c89,
-+		0x452821e6, 0x38d01377, 0xbe5466cf, 0x34e90c6c,
-+		0xc0ac29b7, 0xc97c50dd, 0x3f84d5b5, 0xb5470917,
-+		0x9216d5d9, 0x8979fb1b
-+	}
-+};
-+
-+static unsigned char BF_itoa64[64 + 1] =
-+	"./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-+
-+static unsigned char BF_atoi64[0x60] = {
-+	64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 0, 1,
-+	54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 64, 64, 64, 64, 64,
-+	64, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
-+	17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 64, 64, 64, 64, 64,
-+	64, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42,
-+	43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 64, 64, 64, 64, 64
-+};
-+
-+/*
-+ * This may be optimized out if built with function inlining and no BF_ASM.
-+ */
-+static void clean(void *data, int size)
-+{
-+#if BF_ASM
-+	extern void _BF_clean(void *data);
-+#endif
-+	memset(data, 0, size);
-+#if BF_ASM
-+	_BF_clean(data);
-+#endif
-+}
-+
-+#define BF_safe_atoi64(dst, src) \
-+{ \
-+	tmp = (unsigned char)(src); \
-+	if ((unsigned int)(tmp -= 0x20) >= 0x60) return -1; \
-+	tmp = BF_atoi64[tmp]; \
-+	if (tmp > 63) return -1; \
-+	(dst) = tmp; \
-+}
-+
-+static int BF_decode(BF_word *dst, __CONST char *src, int size)
-+{
-+	unsigned char *dptr = (unsigned char *)dst;
-+	unsigned char *end = dptr + size;
-+	unsigned char *sptr = (unsigned char *)src;
-+	unsigned int tmp, c1, c2, c3, c4;
-+
-+	do {
-+		BF_safe_atoi64(c1, *sptr++);
-+		BF_safe_atoi64(c2, *sptr++);
-+		*dptr++ = (c1 << 2) | ((c2 & 0x30) >> 4);
-+		if (dptr >= end) break;
-+
-+		BF_safe_atoi64(c3, *sptr++);
-+		*dptr++ = ((c2 & 0x0F) << 4) | ((c3 & 0x3C) >> 2);
-+		if (dptr >= end) break;
-+
-+		BF_safe_atoi64(c4, *sptr++);
-+		*dptr++ = ((c3 & 0x03) << 6) | c4;
-+	} while (dptr < end);
-+
-+	return 0;
-+}
-+
-+static void BF_encode(char *dst, __CONST BF_word *src, int size)
-+{
-+	unsigned char *sptr = (unsigned char *)src;
-+	unsigned char *end = sptr + size;
-+	unsigned char *dptr = (unsigned char *)dst;
-+	unsigned int c1, c2;
-+
-+	do {
-+		c1 = *sptr++;
-+		*dptr++ = BF_itoa64[c1 >> 2];
-+		c1 = (c1 & 0x03) << 4;
-+		if (sptr >= end) {
-+			*dptr++ = BF_itoa64[c1];
-+			break;
-+		}
-+
-+		c2 = *sptr++;
-+		c1 |= c2 >> 4;
-+		*dptr++ = BF_itoa64[c1];
-+		c1 = (c2 & 0x0f) << 2;
-+		if (sptr >= end) {
-+			*dptr++ = BF_itoa64[c1];
-+			break;
-+		}
-+
-+		c2 = *sptr++;
-+		c1 |= c2 >> 6;
-+		*dptr++ = BF_itoa64[c1];
-+		*dptr++ = BF_itoa64[c2 & 0x3f];
-+	} while (sptr < end);
-+}
-+
-+static void BF_swap(BF_word *x, int count)
-+{
-+	static int endianness_check = 1;
-+	char *is_little_endian = (char *)&endianness_check;
-+	BF_word tmp;
-+
-+	if (*is_little_endian)
-+	do {
-+		tmp = *x;
-+		tmp = (tmp << 16) | (tmp >> 16);
-+		*x++ = ((tmp & 0x00FF00FF) << 8) | ((tmp >> 8) & 0x00FF00FF);
-+	} while (--count);
-+}
-+
-+#if BF_SCALE
-+/* Architectures which can shift addresses left by 2 bits with no extra cost */
-+#define BF_ROUND(L, R, N) \
-+	tmp1 = L & 0xFF; \
-+	tmp2 = L >> 8; \
-+	tmp2 &= 0xFF; \
-+	tmp3 = L >> 16; \
-+	tmp3 &= 0xFF; \
-+	tmp4 = L >> 24; \
-+	tmp1 = data.ctx.S[3][tmp1]; \
-+	tmp2 = data.ctx.S[2][tmp2]; \
-+	tmp3 = data.ctx.S[1][tmp3]; \
-+	tmp3 += data.ctx.S[0][tmp4]; \
-+	tmp3 ^= tmp2; \
-+	R ^= data.ctx.P[N + 1]; \
-+	tmp3 += tmp1; \
-+	R ^= tmp3;
-+#else
-+/* Architectures with no complicated addressing modes supported */
-+#define BF_INDEX(S, i) \
-+	(*((BF_word *)(((unsigned char *)S) + (i))))
-+#define BF_ROUND(L, R, N) \
-+	tmp1 = L & 0xFF; \
-+	tmp1 <<= 2; \
-+	tmp2 = L >> 6; \
-+	tmp2 &= 0x3FC; \
-+	tmp3 = L >> 14; \
-+	tmp3 &= 0x3FC; \
-+	tmp4 = L >> 22; \
-+	tmp4 &= 0x3FC; \
-+	tmp1 = BF_INDEX(data.ctx.S[3], tmp1); \
-+	tmp2 = BF_INDEX(data.ctx.S[2], tmp2); \
-+	tmp3 = BF_INDEX(data.ctx.S[1], tmp3); \
-+	tmp3 += BF_INDEX(data.ctx.S[0], tmp4); \
-+	tmp3 ^= tmp2; \
-+	R ^= data.ctx.P[N + 1]; \
-+	tmp3 += tmp1; \
-+	R ^= tmp3;
-+#endif
-+
-+/*
-+ * Encrypt one block, BF_N is hardcoded here.
-+ */
-+#define BF_ENCRYPT \
-+	L ^= data.ctx.P[0]; \
-+	BF_ROUND(L, R, 0); \
-+	BF_ROUND(R, L, 1); \
-+	BF_ROUND(L, R, 2); \
-+	BF_ROUND(R, L, 3); \
-+	BF_ROUND(L, R, 4); \
-+	BF_ROUND(R, L, 5); \
-+	BF_ROUND(L, R, 6); \
-+	BF_ROUND(R, L, 7); \
-+	BF_ROUND(L, R, 8); \
-+	BF_ROUND(R, L, 9); \
-+	BF_ROUND(L, R, 10); \
-+	BF_ROUND(R, L, 11); \
-+	BF_ROUND(L, R, 12); \
-+	BF_ROUND(R, L, 13); \
-+	BF_ROUND(L, R, 14); \
-+	BF_ROUND(R, L, 15); \
-+	tmp4 = R; \
-+	R = L; \
-+	L = tmp4 ^ data.ctx.P[BF_N + 1];
-+
-+#if BF_ASM
-+#define BF_body() \
-+	_BF_body_r(&data.ctx);
-+#else
-+#define BF_body() \
-+	L = R = 0; \
-+	ptr = data.ctx.P; \
-+	do { \
-+		ptr += 2; \
-+		BF_ENCRYPT; \
-+		*(ptr - 2) = L; \
-+		*(ptr - 1) = R; \
-+	} while (ptr < &data.ctx.P[BF_N + 2]); \
-+\
-+	ptr = data.ctx.S[0]; \
-+	do { \
-+		ptr += 2; \
-+		BF_ENCRYPT; \
-+		*(ptr - 2) = L; \
-+		*(ptr - 1) = R; \
-+	} while (ptr < &data.ctx.S[3][0xFF]);
-+#endif
-+
-+static void BF_set_key(__CONST char *key, BF_key expanded, BF_key initial)
-+{
-+	__CONST char *ptr = key;
-+	int i, j;
-+	BF_word tmp;
-+
-+	for (i = 0; i < BF_N + 2; i++) {
-+		tmp = 0;
-+		for (j = 0; j < 4; j++) {
-+			tmp <<= 8;
-+			tmp |= (unsigned char)*ptr;
-+
-+			if (!*ptr) ptr = key; else ptr++;
-+		}
-+
-+		expanded[i] = tmp;
-+		initial[i] = BF_init_state.P[i] ^ tmp;
-+	}
-+}
-+
-+char *_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
-+	char *output, int size)
-+{
-+#if BF_ASM
-+	extern void _BF_body_r(BF_ctx *ctx);
-+#endif
-+	struct {
-+		BF_ctx ctx;
-+		BF_key expanded_key;
-+		union {
-+			BF_word salt[4];
-+			BF_word output[6];
-+		} binary;
-+	} data;
-+	BF_word L, R;
-+	BF_word tmp1, tmp2, tmp3, tmp4;
-+	BF_word *ptr;
-+	BF_word count;
-+	int i;
-+
-+	if (size < 7 + 22 + 31 + 1) {
-+		__set_errno(ERANGE);
-+		return NULL;
-+	}
-+
-+	if (setting[0] != '$' ||
-+	    setting[1] != '2' ||
-+	    setting[2] != 'a' ||
-+	    setting[3] != '$' ||
-+	    setting[4] < '0' || setting[4] > '3' ||
-+	    setting[5] < '0' || setting[5] > '9' ||
-+	    setting[6] != '$') {
-+		__set_errno(EINVAL);
-+		return NULL;
-+	}
-+
-+	count = (BF_word)1 << ((setting[4] - '0') * 10 + (setting[5] - '0'));
-+	if (count < 16 || BF_decode(data.binary.salt, &setting[7], 16)) {
-+		clean(data.binary.salt, sizeof(data.binary.salt));
-+		__set_errno(EINVAL);
-+		return NULL;
-+	}
-+	BF_swap(data.binary.salt, 4);
-+
-+	BF_set_key(key, data.expanded_key, data.ctx.P);
-+
-+	memcpy(data.ctx.S, BF_init_state.S, sizeof(data.ctx.S));
-+
-+	L = R = 0;
-+	for (i = 0; i < BF_N + 2; i += 2) {
-+		L ^= data.binary.salt[i & 2];
-+		R ^= data.binary.salt[(i & 2) + 1];
-+		BF_ENCRYPT;
-+		data.ctx.P[i] = L;
-+		data.ctx.P[i + 1] = R;
-+	}
-+
-+	ptr = data.ctx.S[0];
-+	do {
-+		ptr += 4;
-+		L ^= data.binary.salt[(BF_N + 2) & 3];
-+		R ^= data.binary.salt[(BF_N + 3) & 3];
-+		BF_ENCRYPT;
-+		*(ptr - 4) = L;
-+		*(ptr - 3) = R;
-+
-+		L ^= data.binary.salt[(BF_N + 4) & 3];
-+		R ^= data.binary.salt[(BF_N + 5) & 3];
-+		BF_ENCRYPT;
-+		*(ptr - 2) = L;
-+		*(ptr - 1) = R;
-+	} while (ptr < &data.ctx.S[3][0xFF]);
-+
-+	do {
-+		data.ctx.P[0] ^= data.expanded_key[0];
-+		data.ctx.P[1] ^= data.expanded_key[1];
-+		data.ctx.P[2] ^= data.expanded_key[2];
-+		data.ctx.P[3] ^= data.expanded_key[3];
-+		data.ctx.P[4] ^= data.expanded_key[4];
-+		data.ctx.P[5] ^= data.expanded_key[5];
-+		data.ctx.P[6] ^= data.expanded_key[6];
-+		data.ctx.P[7] ^= data.expanded_key[7];
-+		data.ctx.P[8] ^= data.expanded_key[8];
-+		data.ctx.P[9] ^= data.expanded_key[9];
-+		data.ctx.P[10] ^= data.expanded_key[10];
-+		data.ctx.P[11] ^= data.expanded_key[11];
-+		data.ctx.P[12] ^= data.expanded_key[12];
-+		data.ctx.P[13] ^= data.expanded_key[13];
-+		data.ctx.P[14] ^= data.expanded_key[14];
-+		data.ctx.P[15] ^= data.expanded_key[15];
-+		data.ctx.P[16] ^= data.expanded_key[16];
-+		data.ctx.P[17] ^= data.expanded_key[17];
-+
-+		BF_body();
-+
-+		tmp1 = data.binary.salt[0];
-+		tmp2 = data.binary.salt[1];
-+		tmp3 = data.binary.salt[2];
-+		tmp4 = data.binary.salt[3];
-+		data.ctx.P[0] ^= tmp1;
-+		data.ctx.P[1] ^= tmp2;
-+		data.ctx.P[2] ^= tmp3;
-+		data.ctx.P[3] ^= tmp4;
-+		data.ctx.P[4] ^= tmp1;
-+		data.ctx.P[5] ^= tmp2;
-+		data.ctx.P[6] ^= tmp3;
-+		data.ctx.P[7] ^= tmp4;
-+		data.ctx.P[8] ^= tmp1;
-+		data.ctx.P[9] ^= tmp2;
-+		data.ctx.P[10] ^= tmp3;
-+		data.ctx.P[11] ^= tmp4;
-+		data.ctx.P[12] ^= tmp1;
-+		data.ctx.P[13] ^= tmp2;
-+		data.ctx.P[14] ^= tmp3;
-+		data.ctx.P[15] ^= tmp4;
-+		data.ctx.P[16] ^= tmp1;
-+		data.ctx.P[17] ^= tmp2;
-+
-+		BF_body();
-+	} while (--count);
-+
-+	for (i = 0; i < 6; i += 2) {
-+		L = BF_magic_w[i];
-+		R = BF_magic_w[i + 1];
-+
-+		count = 64;
-+		do {
-+			BF_ENCRYPT;
-+		} while (--count);
-+
-+		data.binary.output[i] = L;
-+		data.binary.output[i + 1] = R;
-+	}
-+
-+	memcpy(output, setting, 7 + 22 - 1);
-+	output[7 + 22 - 1] = BF_itoa64[(int)
-+		BF_atoi64[(int)setting[7 + 22 - 1] - 0x20] & 0x30];
-+
-+/* This has to be bug-compatible with the original implementation, so
-+ * only encode 23 of the 24 bytes. :-) */
-+	BF_swap(data.binary.output, 6);
-+	BF_encode(&output[7 + 22], data.binary.output, 23);
-+	output[7 + 22 + 31] = '\0';
-+
-+/* Overwrite the most obvious sensitive data we have on the stack. Note
-+ * that this does not guarantee there's no sensitive data left on the
-+ * stack and/or in registers; I'm not aware of portable code that does. */
-+	clean(&data, sizeof(data));
-+
-+	return output;
-+}
-+
-+char *_crypt_gensalt_blowfish_rn(unsigned long count,
-+	__CONST char *input, int size, char *output, int output_size)
-+{
-+	if (size < 16 || output_size < 7 + 22 + 1 ||
-+	    (count && (count < 4 || count > 31))) {
-+		if (output_size > 0) output[0] = '\0';
-+		__set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
-+		return NULL;
-+	}
-+
-+	if (!count) count = 5;
-+
-+	output[0] = '$';
-+	output[1] = '2';
-+	output[2] = 'a';
-+	output[3] = '$';
-+	output[4] = '0' + count / 10;
-+	output[5] = '0' + count % 10;
-+	output[6] = '$';
-+
-+	BF_encode(&output[7], (BF_word *)input, 16);
-+	output[7 + 22] = '\0';
-+
-+	return output;
-+}
-diff -ru -N glibc-2.17-orig/crypt/crypt-entry.c glibc-2.17/crypt/crypt-entry.c
---- glibc-2.17-orig/crypt/crypt-entry.c	2012-12-25 04:02:13.000000000 +0100
-+++ glibc-2.17/crypt/crypt-entry.c	2013-01-22 23:30:12.342353955 +0100
-@@ -61,6 +61,8 @@
- extern char *__sha512_crypt_r (const char *key, const char *salt,
- 			       char *buffer, int buflen);
- extern char *__sha512_crypt (const char *key, const char *salt);
-+extern char *_crypt_blowfish_rn (const char *key, const char *setting,
-+				char *output, int size);
- 
- /* Define our magic string to mark salt for MD5 encryption
-    replacement.  This is meant to be the same as for other MD5 based
-@@ -73,6 +75,9 @@
- /* Magic string for SHA512 encryption.  */
- static const char sha512_salt_prefix[] = "$6$";
- 
-+/* Magic string for Blowfish encryption.  */
-+static const char blowfish_salt_prefix[] = "$2a$";
-+
- /* For use by the old, non-reentrant routines (crypt/encrypt/setkey)  */
- extern struct crypt_data _ufc_foobar;
- 
-@@ -113,6 +118,11 @@
-   if (strncmp (sha512_salt_prefix, salt, sizeof (sha512_salt_prefix) - 1) == 0)
-     return __sha512_crypt_r (key, salt, (char *) data,
- 			     sizeof (struct crypt_data));
-+
-+  /* Try to find out whether we have to use Blowfish encryption replacement.  */
-+  if (strncmp (blowfish_salt_prefix, salt, sizeof (blowfish_salt_prefix) - 1) == 0)
-+    return _crypt_blowfish_rn (key, salt, (char *) data,
-+			     sizeof (struct crypt_data));
- #endif
- 
-   /*
-diff -ru -N glibc-2.17-orig/crypt/Makefile glibc-2.17/crypt/Makefile
---- glibc-2.17-orig/crypt/Makefile	2012-12-25 04:02:13.000000000 +0100
-+++ glibc-2.17/crypt/Makefile	2013-01-22 23:30:12.341353960 +0100
-@@ -26,7 +26,7 @@
- extra-libs-others := $(extra-libs)
- 
- libcrypt-routines := crypt-entry md5-crypt sha256-crypt sha512-crypt crypt \
--		     crypt_util
-+		     crypt_util crypt_blowfish
- 
- tests := cert md5c-test sha256c-test sha512c-test badsalttest
- 

From bdfc989bba48aaa44ab03f26a9e6046bfe6ebc3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 17:19:53 +0200
Subject: [PATCH 093/134] glibc: remove a fixup; not needed since glibc-2.22

---
 pkgs/development/libraries/glibc/common.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 3cc74b083c53..5cb627ed8957 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -85,12 +85,6 @@ stdenv.mkDerivation ({
     + ''
       cat ${./glibc-remove-datetime-from-nscd.patch} \
         | sed "s,@out@,$out," | patch -p1
-    ''
-    # CVE-2014-8121, see https://bugzilla.redhat.com/show_bug.cgi?id=1165192
-    + ''
-      substituteInPlace ./nss/nss_files/files-XXX.c \
-        --replace 'status = internal_setent (stayopen);' \
-                  'status = internal_setent (1);'
     '';
 
   configureFlags =

From 5c66a4e2210bd5f3f11af808fe61f31f3e3bfbf2 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sat, 2 Sep 2017 13:18:47 -0400
Subject: [PATCH 094/134] gnutls: 3.5.14 -> 3.5.15

---
 pkgs/development/libraries/gnutls/3.5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gnutls/3.5.nix b/pkgs/development/libraries/gnutls/3.5.nix
index 62ff25475694..55c917f212e9 100644
--- a/pkgs/development/libraries/gnutls/3.5.nix
+++ b/pkgs/development/libraries/gnutls/3.5.nix
@@ -1,11 +1,11 @@
 { callPackage, fetchurl, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.5.14";
+  version = "3.5.15";
 
   src = fetchurl {
     url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
-    sha256 = "1nhv0mf3apz65ljh335l8xds7wpn08ywljkrvws08apljbn2v8aa";
+    sha256 = "1mgsxkbs44csw07ngwbqns2y2s03m975lk1sl5ay87wbic882q04";
   };
 
   # Skip two tests introduced in 3.5.11.  Probable reasons of failure:

From 6d2d7d5f46f1429ea1470bea08bb5e5c8c2af55a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 20:01:54 +0200
Subject: [PATCH 095/134] mesa: maintenance 17.1.7 -> 17.1.8

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 54e5626868a0..bdce7ce3dbe7 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.1.7";
+  version = "17.1.8";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "1xg5v61nvabjk3rx48cwmnwv6zpqdcnkxl8bz82284mifjl75x39";
+    sha256 = "75ed2eaeae26ddd536150f294386468ae2e1a7717948c41cd14b7875be5269db";
   };
 
   prePatch = "patchShebangs .";

From daa12ab7b9b081d6e8c3bf7fe399355a9cde2a81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 20:50:38 +0200
Subject: [PATCH 096/134] pango: maintenance 1.40.9 -> 1.40.11

---
 pkgs/development/libraries/pango/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index ecb0dd841fc8..88a8ed1df4f3 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -6,14 +6,14 @@ with stdenv.lib;
 
 let
   ver_maj = "1.40";
-  ver_min = "9";
+  ver_min = "11";
 in
 stdenv.mkDerivation rec {
   name = "pango-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
-    sha256 = "9faea6535312fe4436b93047cf7a04af544eb52a079179bd3a33821aacce7e16";
+    sha256 = "5b11140590e632739e4151cae06b8116160d59e22bf36a3ccd5df76d1cf0383e";
   };
 
   patches = [

From 3980abe191d4b9f8d4d60b101f67f3658f380a56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 2 Sep 2017 20:51:16 +0200
Subject: [PATCH 097/134] gkt3: maintenance 3.22.18 -> 3.22.19

---
 pkgs/development/libraries/gtk+/3.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 1071af614480..bc5b6a363398 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "18";
+  ver_min = "19";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "b64b1c2ec20adf128ac08ee704d1f4e7b0a8d3df097d51f62edb271c7bb1bf69";
+    sha256 = "9883d3ca5244f9b3168ce660e87d52900e141d0f7147dea0640bdd6fe8e5166c";
   };
 
   outputs = [ "out" "dev" ];

From 447240b19f1fc5ee5d33950560002b9661a3d10e Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Fri, 1 Sep 2017 09:58:19 +0000
Subject: [PATCH 098/134] mkDerivation: explain "all" in hardeningDisable

https://github.com/NixOS/nixpkgs/pull/28806#discussion_r136516276
---
 pkgs/stdenv/generic/make-derivation.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index c2f4f1c7b281..23a77719fa0a 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -49,6 +49,7 @@ rec {
     # TODO(@Ericson2314): Make this more modular, and not O(n^2).
     let
       supportedHardeningFlags = [ "fortify" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
+      # hardeningDisable additionally supports "all".
       erroneousHardeningFlags = lib.subtractLists supportedHardeningFlags (hardeningEnable ++ lib.remove "all" hardeningDisable);
     in if builtins.length erroneousHardeningFlags != 0
     then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {

From a09d9e7cd425fb589105363f59388b2cf66c3c86 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Thu, 31 Aug 2017 14:20:51 +0000
Subject: [PATCH 099/134] stdenv-setup: fix substituteAll with set -eu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Environment variable filter in substituteAll was not precise and produced
undefined and invalid variable names.  Vladimír Čunát tried to fix that in [1],
but `env -0` did not work during Darwin bootstrap, so [2] reverted this change
and replaced an error due to invalid variables with a warning.  Recently in #28057
John Ericson added `set -u` to `setup.sh` and undefined variables made the setup
fail during e.g. `nix-build -A gnat` with `setup: line 519: !varName: unbound
variable`.

[1] https://github.com/NixOS/nixpkgs/commit/62fc8859c10dd18b005b9bcaa0b429103d7661d9
[2] https://github.com/NixOS/nixpkgs/commit/81df0354290389128077e00edfd2368eeeea0c24
---
 pkgs/stdenv/generic/setup.sh | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index d3fff57507c6..ff482241570c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -473,14 +473,14 @@ substitute() {
     shift 2
 
     if [ ! -f "$input" ]; then
-      echo "${FUNCNAME[0]}(): ERROR: file '$input' does not exist" >&2
+      echo "substitute(): ERROR: file '$input' does not exist" >&2
       return 1
     fi
 
     local content
     # read returns non-0 on EOF, so we want read to fail
     if IFS='' read -r -N 0 content < "$input"; then
-        echo "${FUNCNAME[0]}(): ERROR: File \"$input\" has null bytes, won't process" >&2
+        echo "substitute(): ERROR: File \"$input\" has null bytes, won't process" >&2
         return 1
     fi
 
@@ -497,10 +497,8 @@ substitute() {
                 shift 2
                 # check if the used nix attribute name is a valid bash name
                 if ! [[ "$varName" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-                    echo "${FUNCNAME[0]}(): WARNING: substitution variables should be valid bash names," >&2
-                    echo "  \"$varName\" isn't and therefore was skipped; it might be caused" >&2
-                    echo "  by multi-line phases in variables - see #14907 for details." >&2
-                    continue
+                    echo "substitute(): ERROR: substitution variables must be valid Bash names, \"$varName\" isn't." >&2
+                    return 1
                 fi
                 pattern="@$varName@"
                 replacement="${!varName}"
@@ -513,7 +511,7 @@ substitute() {
                 ;;
 
             *)
-                echo "${FUNCNAME[0]}(): ERROR: Invalid command line argument: $1" >&2
+                echo "substitute(): ERROR: Invalid command line argument: $1" >&2
                 return 1
                 ;;
         esac
@@ -532,17 +530,24 @@ substituteInPlace() {
     substitute "$fileName" "$fileName" "$@"
 }
 
+# List the names of the environment variables that are valid Bash names.
+listVars() {
+    # "export" prints "declare -x name=value", quoted for eval.
+    declare() {
+        echo "${2%%=*}"
+    }
+    eval "$(export)"
+    unset declare
+}
 
-# Substitute all environment variables that do not start with an upper-case
-# character or underscore. Note: other names that aren't bash-valid
-# will cause an error during `substitute --subst-var`.
+# Substitute all environment variables that start with a lowercase character and
+# are valid Bash names.
 substituteAll() {
     local input="$1"
     local output="$2"
     local -a args=()
 
-    # Select all environment variables that start with a lowercase character.
-    for varName in $(env | sed -e $'s/^\([a-z][^= \t]*\)=.*/\\1/; t \n d'); do
+    for varName in $(listVars | grep '^[a-z]'); do
         if [ "${NIX_DEBUG:-}" = "1" ]; then
             echo "@${varName}@ -> '${!varName}'"
         fi

From f4044c1ccc2361b3c127e4a9a84023a386512575 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Thu, 31 Aug 2017 18:26:38 +0000
Subject: [PATCH 100/134] stdenv-setup: list environment variables with awk

---
 pkgs/stdenv/generic/setup.sh | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ff482241570c..61877701b716 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -530,15 +530,6 @@ substituteInPlace() {
     substitute "$fileName" "$fileName" "$@"
 }
 
-# List the names of the environment variables that are valid Bash names.
-listVars() {
-    # "export" prints "declare -x name=value", quoted for eval.
-    declare() {
-        echo "${2%%=*}"
-    }
-    eval "$(export)"
-    unset declare
-}
 
 # Substitute all environment variables that start with a lowercase character and
 # are valid Bash names.
@@ -547,9 +538,9 @@ substituteAll() {
     local output="$2"
     local -a args=()
 
-    for varName in $(listVars | grep '^[a-z]'); do
+    for varName in $(awk 'BEGIN { for (v in ENVIRON) if (v ~ /^[a-z][a-zA-Z0-9_]*$/) print v }'); do
         if [ "${NIX_DEBUG:-}" = "1" ]; then
-            echo "@${varName}@ -> '${!varName}'"
+            printf "@%s@ -> %q\n" "${varName}" "${!varName}"
         fi
         args+=("--subst-var" "$varName")
     done

From 61733ed6ccde3427016720f2e0cd191d3d95152c Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Sat, 2 Sep 2017 17:38:35 +0200
Subject: [PATCH 101/134] systemd: use fetchpatch for patch with the correct
 hash

the fetchurl failed on hydra sometimes
---
 pkgs/os-specific/linux/systemd/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 06e7204f45a2..fdd5ada19cba 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, gperf, libcap, kmod
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
 , kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
@@ -76,9 +76,9 @@ stdenv.mkDerivation rec {
   patches = [
     # TODO: Remove this patch when we have a systemd version
     # with https://github.com/systemd/systemd/pull/6678
-    (fetchurl {
+    (fetchpatch {
         url = "https://github.com/systemd/systemd/commit/58a78ae77063eddfcd23ea272bd2e0ddc9ea3ff7.patch";
-        sha256 = "1y09n176f0389qrfrs3fsxj4hly1y1xfnb52rhbgj34704adp5m1";
+        sha256 = "0g3pvqigs69mciw6lj3zg12dmxnhwxndwxdjg78af52xrp0djfg8";
     })
   ];
 

From 241ced7dab776537c041afead5b8f33e229bbce5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sun, 3 Sep 2017 11:39:16 -0400
Subject: [PATCH 102/134] nixos/hardware/raid/hpsa: Use NIX_BINUTILS

NIX_CC no longer includes nix-support/dynamic-linker
---
 nixos/modules/hardware/raid/hpsa.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/hardware/raid/hpsa.nix b/nixos/modules/hardware/raid/hpsa.nix
index 1b4b1fa1954f..55c66336a550 100644
--- a/nixos/modules/hardware/raid/hpsa.nix
+++ b/nixos/modules/hardware/raid/hpsa.nix
@@ -24,7 +24,7 @@ let
 
       for file in $out/bin/*; do
         chmod +w $file
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
                  --set-rpath ${lib.makeLibraryPath [ pkgs.stdenv.cc.cc ]} \
                  $file
       done

From fd2c1fe610cdf463f21cdabe9a6280277ba34525 Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Sun, 3 Sep 2017 15:57:24 +0300
Subject: [PATCH 103/134] pythonPackages.GeoIP: init at 1.3.2

---
 .../python-modules/GeoIP/default.nix          | 30 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/python-modules/GeoIP/default.nix

diff --git a/pkgs/development/python-modules/GeoIP/default.nix b/pkgs/development/python-modules/GeoIP/default.nix
new file mode 100644
index 000000000000..6c4453774ced
--- /dev/null
+++ b/pkgs/development/python-modules/GeoIP/default.nix
@@ -0,0 +1,30 @@
+{lib, buildPythonPackage, fetchPypi, isPy3k, incremental, ipaddress, twisted
+, automat, zope_interface, idna, pyopenssl, service-identity, pytest, mock, lsof
+, geoip, nose}:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "GeoIP";
+  version = "1.3.2";
+
+  checkInputs = [ nose ];
+  propagatedBuildInputs = [
+    geoip
+  ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1rphxf3vrn8wywjgr397f49s0s22m83lpwcq45lm0h2p45mdm458";
+  };
+
+  # Tests cannot be run because they require data that isn't included in the
+  # release tarball.
+  checkPhase = "true";
+
+  meta = {
+    description = "MaxMind GeoIP Legacy Database - Python API";
+    homepage = http://www.maxmind.com/;
+    maintainers = with lib.maintainers; [ jluttine ];
+    license = lib.licenses.lgpl21Plus;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b4ef9a8ce113..de79d5dc5020 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5974,6 +5974,8 @@ in {
     };
   };
 
+  GeoIP = callPackage ../development/python-modules/GeoIP { };
+
   gmpy = buildPythonPackage rec {
     name = "gmpy-1.17";
     disabled = isPyPy;

From 81d2549e8b49fdf3f6e826dc96ad602d822b2714 Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Sun, 3 Sep 2017 15:58:31 +0300
Subject: [PATCH 104/134] pythonPackages.txtorcon: init at 0.19.3

---
 .../python-modules/txtorcon/default.nix       | 39 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 41 insertions(+)
 create mode 100644 pkgs/development/python-modules/txtorcon/default.nix

diff --git a/pkgs/development/python-modules/txtorcon/default.nix b/pkgs/development/python-modules/txtorcon/default.nix
new file mode 100644
index 000000000000..60947bc769c7
--- /dev/null
+++ b/pkgs/development/python-modules/txtorcon/default.nix
@@ -0,0 +1,39 @@
+{lib, buildPythonPackage, fetchPypi, isPy3k, incremental, ipaddress, twisted
+, automat, zope_interface, idna, pyopenssl, service-identity, pytest, mock, lsof
+, GeoIP}:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "txtorcon";
+  version = "0.19.3";
+
+  checkInputs = [ pytest mock lsof GeoIP ];
+  propagatedBuildInputs = [
+    incremental twisted automat zope_interface
+    # extra dependencies required by twisted[tls]
+    idna pyopenssl service-identity
+  ] ++ lib.optionals (!isPy3k) [ ipaddress ];
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1za4qag4g2lbw695v4ssxqc2aspdyknnbn2diylwg8q9g5k9cczp";
+  };
+
+  # ipaddress isn't required for Python 3 although it's in requirements.txt.
+  # Because ipaddress doesn't install on Python 3, remove the requirement so the
+  # installation of this package doesn't fail on Python 3.
+  postPatch = "" + lib.optionalString isPy3k ''
+    substituteInPlace requirements.txt --replace "ipaddress>=1.0.16" ""
+  '';
+
+  checkPhase = ''
+    pytest .
+  '';
+
+  meta = {
+    description = "Twisted-based Tor controller client, with state-tracking and configuration abstractions";
+    homepage = https://github.com/meejah/txtorcon;
+    maintainers = with lib.maintainers; [ jluttine ];
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index de79d5dc5020..1ba770ac0315 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22736,6 +22736,8 @@ in {
 
   twisted = callPackage ../development/python-modules/twisted { };
 
+  txtorcon = callPackage ../development/python-modules/txtorcon { };
+
   tzlocal = callPackage ../development/python-modules/tzlocal { };
 
   u-msgpack-python = callPackage ../development/python-modules/u-msgpack-python { };

From 145fa7ac1f355e4d8f71ccd7e7ef4a059519f70a Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Sun, 3 Sep 2017 20:54:32 +0300
Subject: [PATCH 105/134] pythonPackages.attrs: 16.2.0 -> 17.2.0

---
 .../python-modules/attrs/default.nix          | 28 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 24 +---------------
 2 files changed, 29 insertions(+), 23 deletions(-)
 create mode 100644 pkgs/development/python-modules/attrs/default.nix

diff --git a/pkgs/development/python-modules/attrs/default.nix b/pkgs/development/python-modules/attrs/default.nix
new file mode 100644
index 000000000000..e58bf3846dc9
--- /dev/null
+++ b/pkgs/development/python-modules/attrs/default.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, buildPythonPackage, fetchPypi, pytest, hypothesis, zope_interface
+, pympler, coverage, six, clang }:
+
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "attrs";
+  version = "17.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "04gx08ikpk26wnq22f7l42gapcvk8iz1512r927k6sadz6cinkax";
+  };
+
+  # macOS needs clang for testing
+  buildInputs = [
+    pytest hypothesis zope_interface pympler coverage six
+  ] ++ lib.optionals (stdenv.isDarwin) [ clang ];
+
+  checkPhase = ''
+    py.test
+  '';
+
+  meta = with lib; {
+    description = "Python attributes without boilerplate";
+    homepage = https://github.com/hynek/attrs;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1ba770ac0315..a23c668d07e7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -647,29 +647,7 @@ in {
     };
   });
 
-  attrs = buildPythonPackage (rec {
-    name = "attrs-${version}";
-    version = "16.2.0";
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/a/attrs/${name}.tar.gz";
-      sha256 = "136f2ec0f94ec77ff2990830feee965d608cab1e8922370e3abdded383d52001";
-    };
-
-    # macOS needs clang for testing
-    buildInputs = with self; [ pytest hypothesis zope_interface
-    pympler coverage ]
-     ++ optionals (stdenv.isDarwin) [ pkgs.clang ];
-
-    checkPhase = ''
-      py.test
-    '';
-
-    meta = {
-      description = "Python attributes without boilerplate";
-      homepage = https://github.com/hynek/attrs;
-      license = licenses.mit;
-    };
-   });
+  attrs = callPackage ../development/python-modules/attrs { };
 
   audioread = callPackage ../development/python-modules/audioread { };
 

From 196fbee1bbf21cb01096adc9d34e1f42e1095bfd Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Sun, 3 Sep 2017 17:14:11 +0300
Subject: [PATCH 106/134] pythonPackages.magic-wormhole: fix inputs and patch

---
 .../development/python-modules/magic-wormhole/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 7fedf4d48bbd..cc1e663209ec 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -17,6 +17,7 @@
 , humanize
 , pyopenssl
 , service-identity
+, txtorcon
 }:
 
 buildPythonPackage rec {
@@ -31,14 +32,11 @@ buildPythonPackage rec {
 
   checkInputs = [ mock ];
   buildInputs = [ nettools glibcLocales ];
-  propagatedBuildInputs = [ autobahn cffi click hkdf pynacl spake2 tqdm ipaddress humanize pyopenssl service-identity ];
+  propagatedBuildInputs = [ autobahn cffi click hkdf pynacl spake2 tqdm ipaddress humanize pyopenssl service-identity txtorcon ];
 
   postPatch = ''
     sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
-    sed -i -e "s|if (os.path.dirname(os.path.abspath(wormhole))|if not os.path.abspath(wormhole).startswith('/nix/store') and (os.path.dirname(os.path.abspath(wormhole))|" src/wormhole/test/test_scripts.py
-    # XXX: disable one test due to warning:
-    # setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
-    sed -i -e "s|def test_text_subprocess|def skip_test_text_subprocess|" src/wormhole/test/test_scripts.py
+    sed -i -e "s|if (os.path.dirname(os.path.abspath(wormhole))|if not os.path.abspath(wormhole).startswith('/nix/store') and (os.path.dirname(os.path.abspath(wormhole))|" src/wormhole/test/test_cli.py
   '' + lib.optionalString (pythonAtLeast "3.3") ''
     sed -i -e 's|"ipaddress",||' setup.py
   '';

From 3601a97e3c8948b67aef6386b20d6949976b69f0 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 4 Sep 2017 11:20:30 -0400
Subject: [PATCH 107/134] binutils-wrapper: Accidentally deleted macOS Sierra
 reexport hack

Did this when spliting off binutils-wrapper from cc-wrapper in
40e9b2a7e6490eef782e5c34703a99e61fae7017: I deleted the file instead of
moving it.
---
 .../macos-sierra-reexport-hack.bash           | 106 ++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash

diff --git a/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash b/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash
new file mode 100644
index 000000000000..b7aa7ea5c092
--- /dev/null
+++ b/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash
@@ -0,0 +1,106 @@
+#! @shell@
+
+set -eu -o pipefail
+
+path_backup="$PATH"
+if [ -n "@coreutils_bin@" ]; then
+  PATH="@coreutils_bin@/bin"
+fi
+
+declare -r recurThreshold=300
+
+declare overflowCount=0
+for ((n=0; n < $#; ++n)); do
+    case "${!n}" in
+        -l*) let overflowCount+=1 ;;
+        -reexport-l*) let overflowCount+=1 ;;
+        *) ;;
+    esac
+done
+
+declare -a allArgs=()
+
+if (( "$overflowCount" <= "$recurThreshold" )); then
+    allArgs=("$@")
+else
+    declare -a childrenLookup=() childrenLink=()
+
+    while (( $# )); do
+        case "$1" in
+            -L/*)
+                childrenLookup+=("$1")
+                allArgs+=("$1")
+                ;;
+            -L)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -l)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -lazy_library | -lazy_framework | -lto_library)
+                # We aren't linking any "azy_library", "to_library", etc.
+                allArgs+=("$1")
+                ;;
+            -lazy-l | -weak-l)    allArgs+=("$1") ;;
+                # We can't so easily prevent header issues from these.
+            -lSystem)             allArgs+=("$1") ;;
+                # Special case as indirection seems like a bad idea for something
+                # so fundamental. Can be removed for simplicity.
+            -l?* | -reexport-l?*) childrenLink+=("$1") ;;
+            *)                    allArgs+=("$1") ;;
+        esac
+
+        shift
+    done
+
+    declare n=0
+    while (( $n < "${#childrenLink[@]}" )); do
+        if [[ "${childrenLink[n]}" = -l* ]]; then
+            childrenLink[n]="-reexport${childrenLink[n]}"
+        fi
+        let ++n
+    done
+    unset n
+
+    declare -r outputNameLibless=$(basename $( \
+        if [[ -z "${outputName:+isUndefined}" ]]; then
+            echo unnamed
+        elif [[ "${outputName:0:3}" = lib ]]; then
+            echo "${outputName:3}"
+        else
+            echo "${outputName}"
+        fi))
+    declare -ra children=("$outputNameLibless-reexport-delegate-0" \
+                          "$outputNameLibless-reexport-delegate-1")
+
+    mkdir -p "$out/lib"
+
+    PATH="$PATH:@out@/bin"
+
+    symbolBloatObject=$outputNameLibless-symbol-hack.o
+    if [[ ! -e $symbolBloatObject ]]; then
+        printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
+            | @binPrefix@as -- -o $symbolBloatObject
+    fi
+
+    # first half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[0]}.dylib" \
+      -install_name "$out/lib/lib${children[0]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
+
+    # second half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[1]}.dylib" \
+      -install_name "$out/lib/lib${children[1]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
+
+    allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
+fi
+
+PATH="$path_backup"
+exec @prog@ "${allArgs[@]}"

From 9a1b7cf2ae7b06b378f8117fa9b6c63bab6cbc1e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 4 Sep 2017 11:25:31 -0400
Subject: [PATCH 108/134] top-level, linux stdenv make boootstrap tools: Fix
 eval

Now the NixOS tarball job succeeds again
---
 pkgs/stdenv/linux/make-bootstrap-tools-cross.nix | 4 ++--
 pkgs/stdenv/linux/make-bootstrap-tools.nix       | 4 ++--
 pkgs/top-level/all-packages.nix                  | 6 +++++-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
index 90c9d2cef67f..95d5a210ec5e 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
@@ -177,9 +177,9 @@ rec {
 
         # Copy binutils.
         for i in as ld ar ranlib nm strip readelf objdump; do
-          cp ${binutils.out}/bin/$i $out/bin
+          cp ${binutils.binutils.out}/bin/$i $out/bin
         done
-        cp -d ${binutils.lib}/lib/lib*.so* $out/lib
+        cp -d ${binutils.binutils.lib}/lib/lib*.so* $out/lib
 
         chmod -R u+w $out
 
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index c8cddf248ab9..702fef4c75bc 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -126,9 +126,9 @@ rec {
 
         # Copy binutils.
         for i in as ld ar ranlib nm strip readelf objdump; do
-          cp ${binutils.out}/bin/$i $out/bin
+          cp ${binutils.binutils.out}/bin/$i $out/bin
         done
-        cp -d ${binutils.lib}/lib/lib*.so* $out/lib
+        cp -d ${binutils.binutils.lib}/lib/lib*.so* $out/lib
 
         chmod -R u+w $out
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 044c3c92bcee..a4acc2741bad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11910,7 +11910,11 @@ with pkgs;
   crda = callPackage ../os-specific/linux/crda { };
 
   # Darwin package set
-  darwin = callPackages ./darwin-packages.nix { };
+  #
+  # Even though this is a set of packages not single package, use `callPackage`
+  # not `callPackages` so the per-package callPackages don't have their
+  # `.override` clobbered. C.F. `llvmPackages` which does the same.
+  darwin = callPackage ./darwin-packages.nix { };
 
   devicemapper = lvm2;
 

From 550c5c9b3f2f8119227b8acf2e7b42dfd155e5c6 Mon Sep 17 00:00:00 2001
From: Dan Peebles <pumpkin@me.com>
Date: Mon, 4 Sep 2017 12:04:07 -0400
Subject: [PATCH 109/134] coreutils: fix on Darwin

This patch doesn't apply because it's already applied upstream
---
 pkgs/tools/misc/coreutils/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 142859e7f55c..3960fd155c77 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -24,8 +24,7 @@ stdenv.mkDerivation rec {
   # FIXME needs gcc 4.9 in bootstrap tools
   hardeningDisable = [ "stackprotector" ];
 
-  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
-    ++ optional hostPlatform.isDarwin stdenv.secure-format-patch;
+  patches = optional hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
   # The test tends to fail on btrfs and maybe other unusual filesystems.
   postPatch = optionalString (!hostPlatform.isDarwin) ''

From 6a089581f89f9da656e63f234d1a099838f4898f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 4 Sep 2017 15:49:17 -0400
Subject: [PATCH 110/134] gcc-4.5: Fix typo

---
 pkgs/development/compilers/gcc/4.5/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/4.5/default.nix b/pkgs/development/compilers/gcc/4.5/default.nix
index dc62d1fbd529..bec2aab017ea 100644
--- a/pkgs/development/compilers/gcc/4.5/default.nix
+++ b/pkgs/development/compilers/gcc/4.5/default.nix
@@ -65,7 +65,7 @@ let version = "4.5.4";
 
     /* Cross-gcc settings */
     gccArch = stdenv.lib.attrByPath [ "gcc" "arch" ] null targetPlatform;
-    gccCpu = stdenv.lib.attrByPath [ "gcc" "cpu" ] null targetPlatformt;
+    gccCpu = stdenv.lib.attrByPath [ "gcc" "cpu" ] null targetPlatform;
     gccAbi = stdenv.lib.attrByPath [ "gcc" "abi" ] null targetPlatform;
     withArch = if gccArch != null then " --with-arch=${gccArch}" else "";
     withCpu = if gccCpu != null then " --with-cpu=${gccCpu}" else "";

From 596d87c13edfb6ded1ac7507e31aab874d53c6dc Mon Sep 17 00:00:00 2001
From: Jaakko Luttinen <jaakko.luttinen@iki.fi>
Date: Sun, 3 Sep 2017 15:42:05 +0300
Subject: [PATCH 111/134] pythonPackages.pytest-flake8: fix strict mode

---
 .../python-modules/pytest-flake8/default.nix         | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pytest-flake8/default.nix b/pkgs/development/python-modules/pytest-flake8/default.nix
index 93883283627e..b39737ea7019 100644
--- a/pkgs/development/python-modules/pytest-flake8/default.nix
+++ b/pkgs/development/python-modules/pytest-flake8/default.nix
@@ -1,4 +1,4 @@
-{lib, buildPythonPackage, fetchPypi, pytest, flake8}:
+{lib, buildPythonPackage, fetchPypi, fetchpatch, pytest, flake8}:
 
 buildPythonPackage rec {
   name = "${pname}-${version}";
@@ -16,6 +16,16 @@ buildPythonPackage rec {
     sha256 = "1za5i09gz127yraigmcl443w6149714l279rmlfxg1bl2kdsc45a";
   };
 
+  patches = [
+    # Fix pytest strict mode (pull request #24)
+    # https://github.com/tholo/pytest-flake8/pull/24
+    (fetchpatch {
+      name = "fix-compatibility-with-pytest-strict-mode.patch";
+      url = "https://github.com/tholo/pytest-flake8/commit/434e1b07b4b77bfe1ddb9b2b54470c6c3815bb1a.patch";
+      sha256 = "0idwgkwwysx2cibnykd81yxrgqzkpf42j99jmpnanqzi99qnc3wx";
+    })
+  ];
+
   checkPhase = ''
     pytest --ignore=nix_run_setup.py .
   '';

From 5db60dbe1d856316aee04303756c048784d786e3 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:16:11 +0200
Subject: [PATCH 112/134] flexget: unpin some dependencies

---
 pkgs/applications/networking/flexget/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 94446332629b..9e5e90996bcb 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -32,7 +32,10 @@ buildPythonApplication rec {
       --replace "rebulk==0.8.2" "rebulk" \
       --replace "cherrypy==10.2.2" "cherrypy" \
       --replace "portend==1.8" "portend" \
-      --replace "sqlalchemy==1.1.10" "sqlalchemy"
+      --replace "sqlalchemy==1.1.10" "sqlalchemy" \
+      --replace "zxcvbn-python==4.4.15" "zxcvbn-python" \
+      --replace "flask-cors==3.0.2" "flask-cors" \
+      --replace "certifi==2017.4.17" "certifi"
   '';
 
   checkPhase = ''

From e9215bda452984b6caadd74a14763d583f401b6b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:31:45 +0200
Subject: [PATCH 113/134] python.pkgs.bkcharts: init at 0.2

---
 .../python-modules/bkcharts/default.nix       | 29 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/development/python-modules/bkcharts/default.nix

diff --git a/pkgs/development/python-modules/bkcharts/default.nix b/pkgs/development/python-modules/bkcharts/default.nix
new file mode 100644
index 000000000000..dee19b45f449
--- /dev/null
+++ b/pkgs/development/python-modules/bkcharts/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, numpy
+, pandas
+}:
+
+
+buildPythonPackage rec {
+  pname = "bkcharts";
+  version = "0.2";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit version pname;
+    sha256 = "a5eaa8e78853dcecaa46345812e4fabe9cd3b96330ebf0809f640a4a0556d72e";
+  };
+
+  propagatedBuildInputs = [ numpy pandas ];
+
+  # Circular test dependency on bokeh
+  doCheck = false;
+
+  meta = {
+    description = "High level chart types built on top of Bokeh";
+    homepage = http://github.com/bokeh/bkcharts;
+    license = lib.licenses.bsd3;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a23c668d07e7..22a1b8e35314 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2109,6 +2109,7 @@ in {
   bokeh = buildPythonPackage rec {
     name = "bokeh-${version}";
     version = "0.12.3";
+  bkcharts = callPackage ../development/python-modules/bkcharts { };
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/b/bokeh/${name}.tar.gz";

From 54e502272886f23434306f0aeec60d1802b694be Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:32:04 +0200
Subject: [PATCH 114/134] python.pkgs.bokeh: 0.12.3 -> 0.12.7

---
 .../python-modules/bokeh/default.nix          | 82 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 48 +----------
 2 files changed, 83 insertions(+), 47 deletions(-)
 create mode 100644 pkgs/development/python-modules/bokeh/default.nix

diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
new file mode 100644
index 000000000000..43c176a09ec6
--- /dev/null
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -0,0 +1,82 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPyPy
+, mock
+, pytest
+, flask
+, jinja2
+, markupsafe
+, werkzeug
+, itsdangerous
+, dateutil
+, requests
+, six
+, pygments
+, pystache
+, markdown
+, pyyaml
+, pyzmq
+, tornado
+, colorama
+, isPy3k
+, futures
+, websocket_client
+, numpy
+, pandas
+, greenlet
+, python
+, bkcharts
+, pillow
+, selenium
+}:
+
+buildPythonPackage rec {
+  pname = "bokeh";
+  name = "${pname}${version}";
+  version = "0.12.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "2c42c95bf1a418c758dbff8446b4f5e5fc72ac10ea5da4e6b5010067396d0880";
+  };
+
+  disabled = isPyPy;
+
+  # Some test that uses tornado fails
+#   doCheck = false;
+
+  checkInputs = [ mock pytest pillow selenium ];
+
+  propagatedBuildInputs = [
+    flask
+    jinja2
+    markupsafe
+    werkzeug
+    itsdangerous
+    dateutil
+    requests
+    six
+    pygments
+    pystache
+    markdown
+    pyyaml
+    pyzmq
+    tornado
+    colorama
+    bkcharts
+  ]
+  ++ lib.optionals ( !isPy3k ) [ futures ]
+  ++ lib.optionals ( !isPy3k && !isPyPy ) [ websocket_client ]
+  ++ lib.optionals ( !isPyPy ) [ numpy pandas greenlet ];
+
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover -s bokeh/tests
+  '';
+
+  meta = {
+    description = "Statistical and novel interactive HTML plots for Python";
+    homepage = "http://github.com/bokeh/bokeh";
+    license = lib.licenses.bsd3;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 22a1b8e35314..759a9ed22501 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2106,55 +2106,9 @@ in {
     };
   };
 
-  bokeh = buildPythonPackage rec {
-    name = "bokeh-${version}";
-    version = "0.12.3";
   bkcharts = callPackage ../development/python-modules/bkcharts { };
 
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/b/bokeh/${name}.tar.gz";
-      sha256 = "e138941b62f59bc48bc5b8d249e90c03fed31c1d5abe47ab2ce9e4c83202f73c";
-    };
-
-    disabled = isPyPy;
-
-    # Some test that uses tornado fails
-    doCheck = false;
-
-    buildInputs = with self; [ mock pytest ];
-
-    propagatedBuildInputs = with self; [
-      flask
-      jinja2
-      markupsafe
-      werkzeug
-      itsdangerous
-      dateutil
-      requests
-      six
-      pygments
-      pystache
-      markdown
-      pyyaml
-      pyzmq
-      tornado
-      colorama
-      ]
-      ++ optionals ( !isPy3k ) [ futures ]
-      ++ optionals ( isPy26 ) [ argparse ]
-      ++ optionals ( !isPy3k && !isPyPy ) [ websocket_client ]
-      ++ optionals ( !isPyPy ) [ numpy pandas greenlet ];
-
-    checkPhase = ''
-      ${python.interpreter} -m unittest discover -s bokeh/tests
-    '';
-
-    meta = {
-      description = "Statistical and novel interactive HTML plots for Python";
-      homepage = "http://github.com/bokeh/bokeh";
-      license = licenses.bsd3;
-    };
-  };
+  bokeh = callPackage ../development/python-modules/bokeh { };
 
   boto = buildPythonPackage rec {
     name = "boto-${version}";

From 413b54bcef65a31bc2dda01b3e084682fad78c4a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:45:55 +0200
Subject: [PATCH 115/134] python.pkgs.prompt_toolkit: 1.0.14 -> 1.0.15

---
 .../python-modules/prompt_toolkit/default.nix | 40 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 37 +++--------------
 2 files changed, 45 insertions(+), 32 deletions(-)
 create mode 100644 pkgs/development/python-modules/prompt_toolkit/default.nix

diff --git a/pkgs/development/python-modules/prompt_toolkit/default.nix b/pkgs/development/python-modules/prompt_toolkit/default.nix
new file mode 100644
index 000000000000..9704f1b92c96
--- /dev/null
+++ b/pkgs/development/python-modules/prompt_toolkit/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytest
+, docopt
+, six
+, wcwidth
+, pygments
+}:
+
+buildPythonPackage rec {
+  pname = "prompt_toolkit";
+  name = "${pname}-${version}";
+  version = "1.0.15";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "858588f1983ca497f1cf4ffde01d978a3ea02b01c8a26a8bbc5cd2e66d816917";
+  };
+  checkPhase = ''
+    rm prompt_toolkit/win32_types.py
+    py.test -k 'not test_pathcompleter_can_expanduser'
+  '';
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ docopt six wcwidth pygments ];
+
+  meta = {
+    description = "Python library for building powerful interactive command lines";
+    longDescription = ''
+      prompt_toolkit could be a replacement for readline, but it can be
+      much more than that. It is cross-platform, everything that you build
+      with it should run fine on both Unix and Windows systems. Also ships
+      with a nice interactive Python shell (called ptpython) built on top.
+    '';
+    homepage = https://github.com/jonathanslenders/python-prompt-toolkit;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nckx ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 759a9ed22501..dca008eee604 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16457,41 +16457,14 @@ in {
   };
 
 
-  prompt_toolkit = buildPythonPackage rec {
-    name = "prompt_toolkit-${version}";
-    version = "1.0.14";
+  prompt_toolkit = callPackage ../development/python-modules/prompt_toolkit { };
 
-    src = pkgs.fetchurl {
-      sha256 = "cc66413b1b4b17021675d9f2d15d57e640b06ddfd99bb724c73484126d22622f";
-      url = "mirror://pypi/p/prompt_toolkit/${name}.tar.gz";
-    };
-    checkPhase = ''
-      rm prompt_toolkit/win32_types.py
-      py.test -k 'not test_pathcompleter_can_expanduser'
-    '';
-
-    buildInputs = with self; [ pytest ];
-    propagatedBuildInputs = with self; [ docopt six wcwidth pygments ];
-
-    meta = {
-      description = "Python library for building powerful interactive command lines";
-      longDescription = ''
-        prompt_toolkit could be a replacement for readline, but it can be
-        much more than that. It is cross-platform, everything that you build
-        with it should run fine on both Unix and Windows systems. Also ships
-        with a nice interactive Python shell (called ptpython) built on top.
-      '';
-      homepage = https://github.com/jonathanslenders/python-prompt-toolkit;
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ nckx ];
-    };
-  };
-  prompt_toolkit_52 = self.prompt_toolkit.override(self: rec {
-    name = "prompt_toolkit-${version}";
+  prompt_toolkit_52 = self.prompt_toolkit.overridePythonAttrs(oldAttrs: rec {
+    name = "${oldAttrs.pname}-${version}";
     version = "0.52";
-    src = pkgs.fetchurl {
+    src = oldAttrs.src.override {
+      inherit version;
       sha256 = "00h9ldqmb33nhg2kpks7paldf3n3023ipp124alwp96yz16s7f1m";
-      url = "mirror://pypi/p/prompt_toolkit/${name}.tar.gz";
     };
 
     # No tests included in archive

From 3771bf74a8da875e241d8aca071f79222cf3317f Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:46:30 +0200
Subject: [PATCH 116/134] python.pkgs: fix various missing lib/stdenv

---
 pkgs/development/python-modules/cherrypy/default.nix        | 2 +-
 pkgs/development/python-modules/portend/default.nix         | 2 +-
 pkgs/development/python-modules/pytest-sugar/default.nix    | 2 +-
 pkgs/development/python-modules/pytest-warnings/default.nix | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/cherrypy/default.nix b/pkgs/development/python-modules/cherrypy/default.nix
index 327a10f24910..cffffde8e3d1 100644
--- a/pkgs/development/python-modules/cherrypy/default.nix
+++ b/pkgs/development/python-modules/cherrypy/default.nix
@@ -20,6 +20,6 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     homepage = "http://www.cherrypy.org";
     description = "A pythonic, object-oriented HTTP framework";
-    license = licenses.mit.bsd3;
+    license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/portend/default.nix b/pkgs/development/python-modules/portend/default.nix
index 9092185a40f2..cb418678a996 100644
--- a/pkgs/development/python-modules/portend/default.nix
+++ b/pkgs/development/python-modules/portend/default.nix
@@ -18,6 +18,6 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "Monitor TCP ports for bound or unbound states";
     homepage = https://github.com/jaraco/portend;
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-sugar/default.nix b/pkgs/development/python-modules/pytest-sugar/default.nix
index 81f5a2cbd4b4..2965d169599a 100644
--- a/pkgs/development/python-modules/pytest-sugar/default.nix
+++ b/pkgs/development/python-modules/pytest-sugar/default.nix
@@ -15,6 +15,6 @@ buildPythonPackage rec {
   meta = with stdenv.lib; {
     description = "A plugin that changes the default look and feel of py.test";
     homepage = https://github.com/Frozenball/pytest-sugar;
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-warnings/default.nix b/pkgs/development/python-modules/pytest-warnings/default.nix
index e6ebfcbb7167..6b835abcafe5 100644
--- a/pkgs/development/python-modules/pytest-warnings/default.nix
+++ b/pkgs/development/python-modules/pytest-warnings/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pytest }:
 
 buildPythonPackage rec {
   name = "${pname}-${version}";
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pytest ];
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "Plugin to list Python warnings in pytest report";
     homepage = github.com/fschulze/pytest-warnings;
     license = lib.licenses.mit;

From 66b6c043579ca8f6bf528830f2f754dd4d4ed96b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:51:44 +0200
Subject: [PATCH 117/134] python.pkgs.contextlib2: 0.5.3 -> 0.5.5

---
 .../python-modules/contextlib2/default.nix    | 21 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 10 +--------
 2 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 pkgs/development/python-modules/contextlib2/default.nix

diff --git a/pkgs/development/python-modules/contextlib2/default.nix b/pkgs/development/python-modules/contextlib2/default.nix
new file mode 100644
index 000000000000..cadaa8914b21
--- /dev/null
+++ b/pkgs/development/python-modules/contextlib2/default.nix
@@ -0,0 +1,21 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "contextlib2";
+  version = "0.5.5";
+  name = "${pname}-${version}";
+
+  src = fetchPypi rec {
+    inherit pname version;
+    sha256 = "509f9419ee91cdd00ba34443217d5ca51f5a364a404e1dce9e8979cea969ca48";
+  };
+
+  meta = {
+    description = "Backports and enhancements for the contextlib module";
+    homepage = http://contextlib2.readthedocs.org/;
+    license = lib.licenses.psfl;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dca008eee604..19199c13626b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3178,15 +3178,7 @@ in {
   };
 
 
-  contextlib2 = buildPythonPackage rec {
-    name = "contextlib2-${version}";
-    version = "0.5.3";
-
-    src = pkgs.fetchurl rec {
-      url = "mirror://pypi/c/contextlib2/${name}.tar.gz";
-      sha256 = "01k2921labkbn28kw60jmqzvr4nxzfnx4vcsyjb3rir177qh1r9h";
-    };
-  };
+  contextlib2 = callPackage ../development/python-modules/contextlib2 { };
 
   cookiecutter = buildPythonPackage rec {
     version = "1.4.0";

From 5d057a2d7f28e1c37c111c0d90ee32a1a9a9de7d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 09:56:36 +0200
Subject: [PATCH 118/134] python.pkgs.coverage: 4.0.1 -> 4.4.1

---
 .../python-modules/coverage/default.nix       | 27 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 19 +------------
 2 files changed, 28 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/development/python-modules/coverage/default.nix

diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
new file mode 100644
index 000000000000..137cef06b9e2
--- /dev/null
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+, mock
+}:
+
+buildPythonPackage rec {
+  pname = "coverage";
+  version = "4.4.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "7a9c44400ee0f3b4546066e0710e1250fd75831adc02ab99dda176ad8726f424";
+  };
+
+  # No tests in archive
+  doCheck = false;
+  checkInputs = [ mock ];
+
+  meta = {
+    description = "Code coverage measurement for python";
+    homepage = http://nedbatchelder.com/code/coverage/;
+    license = lib.licenses.bsd3;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19199c13626b..f611902a9fc7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3223,24 +3223,7 @@ in {
 
   coveralls = callPackage ../development/python-modules/coveralls { };
 
-  coverage = buildPythonPackage rec {
-    name = "coverage-4.0.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/c/coverage/${name}.tar.gz";
-      sha256 = "0nrd817pzjw1haaz6gambgwf4jdjnh9kyxkgj6l8qgl6hdxga45w";
-    };
-
-    # TypeError: __call__() takes 1 positional argument but 2 were given
-    doCheck = !isPy3k;
-    buildInputs = with self; [ mock ];
-
-    meta = {
-      description = "Code coverage measurement for python";
-      homepage = http://nedbatchelder.com/code/coverage/;
-      license = licenses.bsd3;
-    };
-  };
+  coverage = callPackage ../development/python-modules/coverage { };
 
   covCore = buildPythonPackage rec {
     name = "cov-core-1.15.0";

From a2fb79f86504c7d84b61aa18e79ea3b7fba4a9d9 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 10:04:11 +0200
Subject: [PATCH 119/134] python.pkgs.dill: 0.2.6 -> 0.2.7.1

---
 .../python-modules/dill/default.nix           | 32 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 19 +----------
 2 files changed, 33 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/development/python-modules/dill/default.nix

diff --git a/pkgs/development/python-modules/dill/default.nix b/pkgs/development/python-modules/dill/default.nix
new file mode 100644
index 000000000000..79c87772ffe7
--- /dev/null
+++ b/pkgs/development/python-modules/dill/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "dill";
+  version = "0.2.7.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "97fd758f5fe742d42b11ec8318ecfcff8776bccacbfcec05dfd6276f5d450f73";
+  };
+
+  # Messy test suite. Even when running the tests like tox does, it fails
+  doCheck = false;
+  checkPhase = ''
+    for test in tests/*.py; do
+      ${python.interpreter} $test
+    done
+  '';
+  # Following error without setting checkPhase
+  # TypeError: don't know how to make test from: {'byref': False, 'recurse': False, 'protocol': 3, 'fmode': 0}
+
+  meta = {
+    description = "Serialize all of python (almost)";
+    homepage = http://www.cacr.caltech.edu/~mmckerns/dill.htm;
+    license = lib.licenses.bsd3;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f611902a9fc7..f14cf82dc683 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4946,24 +4946,7 @@ in {
   };
 
 
-  dill = buildPythonPackage rec {
-    name = "dill-${version}";
-    version = "0.2.6";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/dill/${name}.zip";
-      sha256 = "6c1ccca68be483fa8c66e85a89ffc850206c26373aa77a97b83d8d0994e7f1fd";
-    };
-
-    # TypeError: don't know how to make test from: {'byref': False, 'recurse': False, 'protocol': 3, 'fmode': 0}
-    doCheck = false;
-
-    meta = {
-      description = "Serialize all of python (almost)";
-      homepage = http://www.cacr.caltech.edu/~mmckerns/dill.htm;
-      license = licenses.bsd3;
-    };
-  };
+  dill = callPackage ../development/python-modules/dill { };
 
   discogs_client = buildPythonPackage rec {
     name = "discogs-client-2.0.2";

From 63e13345ae808814c3307f32d9812df57419e38b Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 10:08:04 +0200
Subject: [PATCH 120/134] python.pkgs.entrypoints: 0.2.2 -> 0.2.3

---
 .../python-modules/entrypoints/default.nix    | 31 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            | 14 +--------
 2 files changed, 32 insertions(+), 13 deletions(-)
 create mode 100644 pkgs/development/python-modules/entrypoints/default.nix

diff --git a/pkgs/development/python-modules/entrypoints/default.nix b/pkgs/development/python-modules/entrypoints/default.nix
new file mode 100644
index 000000000000..d812fd55a887
--- /dev/null
+++ b/pkgs/development/python-modules/entrypoints/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, configparser
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "entrypoints";
+  version = "0.2.3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "d2d587dde06f99545fb13a383d2cd336a8ff1f359c5839ce3a64c917d10c029f";
+  };
+
+  checkInputs = [ pytest];
+
+  propagatedBuildInputs = [ configparser ];
+
+  checkPhase = ''
+    py.test tests
+  '';
+
+  meta = {
+    description = "Discover and load entry points from installed packages";
+    homepage = https://github.com/takluyver/entrypoints;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f14cf82dc683..17560e316c63 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5330,19 +5330,7 @@ in {
     };
   });
 
-  entrypoints = buildPythonPackage rec {
-    pname = "entrypoints";
-    version = "0.2.2";
-    name = "${pname}-${version}";
-    format = "wheel";
-
-    src = fetchPypi {
-      inherit pname version format;
-      sha256 = "0a0685962ee5ac303f470acbb659f0f97aef5b9deb6b85d059691c706ef6e45e";
-    };
-
-    propagatedBuildInputs = with self; [ configparser ];
-  };
+  entrypoints = callPackage ../development/python-modules/entrypoints { };
 
   enzyme = callPackage ../development/python-modules/enzyme {};
 

From b85dbed153ea7fce7e37cffd9ebda61d39f4e9dc Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Tue, 5 Sep 2017 10:28:56 +0200
Subject: [PATCH 121/134] python.pkgs.pytimeparse: 1.1.6 -> 1.1.7

---
 pkgs/development/python-modules/pytimeparse/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytimeparse/default.nix b/pkgs/development/python-modules/pytimeparse/default.nix
index ce5ff0586649..374263c2b70e 100644
--- a/pkgs/development/python-modules/pytimeparse/default.nix
+++ b/pkgs/development/python-modules/pytimeparse/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
     pname = "pytimeparse";
-    version = "1.1.6";
+    version = "1.1.7";
     name = "${pname}-${version}";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0imbb68i5n5fm704gv47if1blpxd4f8g16qmp5ar07cavgh2mibl";
+      sha256 = "51b641bcd435e0cb6b9701ed79cf7ee97fa6bf2dbb5d41baa16e5486e5d9b17a";
     };
 
     propagatedBuildInputs = [ nose ];

From 252b36a28db1dd9036cfcbfbaa64b63e6ea5655a Mon Sep 17 00:00:00 2001
From: John Ericson <Ericson2314@Yahoo.com>
Date: Mon, 14 Aug 2017 16:39:03 -0400
Subject: [PATCH 122/134] misc pkgs: Recategorize some dependencies

---
 pkgs/development/libraries/glew/1.10.nix                     | 5 ++---
 pkgs/development/libraries/glew/default.nix                  | 4 ++--
 .../libraries/kde-frameworks/extra-cmake-modules/default.nix | 2 +-
 pkgs/development/pure-modules/glpk/default.nix               | 4 ++--
 pkgs/development/tools/misc/autoconf/2.13.nix                | 3 ++-
 pkgs/development/tools/misc/help2man/default.nix             | 3 ++-
 pkgs/development/tools/misc/libtool/libtool2.nix             | 2 +-
 pkgs/development/tools/parsing/flex/2.5.35.nix               | 2 +-
 pkgs/development/tools/parsing/flex/2.6.1.nix                | 2 +-
 pkgs/development/tools/parsing/flex/default.nix              | 2 +-
 pkgs/servers/x11/xorg/xwayland.nix                           | 2 +-
 pkgs/tools/admin/tigervnc/default.nix                        | 2 +-
 pkgs/tools/misc/kdecoration-viewer/default.nix               | 3 ++-
 13 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index 159bf47e130a..3f8119d36d65 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "01zki46dr5khzlyywr3cg615bcal32dazfazkf360s1znqh17i4r";
   };
 
-  nativeBuildInputs = [ x11 libXmu libXi ];
-  propagatedNativeBuildInputs = [ mesa_glu ]; # GL/glew.h includes GL/glu.h
-  buildInputs = [] ++ optionals stdenv.isDarwin [ AGL ];
+  buildInputs = [ x11 libXmu libXi ] ++ optionals stdenv.isDarwin [ AGL ];
+  propagatedBuildInputs = [ mesa_glu ]; # GL/glew.h includes GL/glu.h
 
   patchPhase = ''
     sed -i 's|lib64|lib|' config/Makefile.linux
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index 814e4496b77d..57bb4cb631d4 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "out" "dev" "doc" ];
 
-  nativeBuildInputs = [ xlibsWrapper libXmu libXi ];
-  propagatedNativeBuildInputs = [ mesa_glu ]; # GL/glew.h includes GL/glu.h
+  buildInputs = [ xlibsWrapper libXmu libXi ];
+  propagatedBuildInputs = [ mesa_glu ]; # GL/glew.h includes GL/glu.h
 
   patchPhase = ''
     sed -i 's|lib64|lib|' config/Makefile.linux
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
index 86be0398e06f..654eb94b51ac 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/default.nix
@@ -7,7 +7,7 @@ mkDerivation {
 
   outputs = [ "out" ];  # this package has no runtime components
 
-  propagatedNativeBuildInputs = [ cmake pkgconfig ];
+  propagatedBuildInputs = [ cmake pkgconfig ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/development/pure-modules/glpk/default.nix b/pkgs/development/pure-modules/glpk/default.nix
index 452cf51e6347..4927ac445f44 100644
--- a/pkgs/development/pure-modules/glpk/default.nix
+++ b/pkgs/development/pure-modules/glpk/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   glpkWithExtras = lib.overrideDerivation glpk (attrs: {
-    propagatedNativeBuildInputs = [ gmp libtool libmysql libiodbc ];
+    propagatedBuildInputs = [ gmp libtool libmysql libiodbc ];
 
     CPPFLAGS = "-I${gmp.dev}/include";
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
                        "--with-gmp=yes" ];
   });
 
-  buildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure glpkWithExtras ];
   makeFlags = "libdir=$(out)/lib prefix=$(out)/";
   setupHook = ../generic-setup-hook.sh;
diff --git a/pkgs/development/tools/misc/autoconf/2.13.nix b/pkgs/development/tools/misc/autoconf/2.13.nix
index 0b32f02f2583..d47483376261 100644
--- a/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "07krzl4czczdsgzrrw9fiqx35xcf32naf751khg821g5pqv12qgh";
   };
 
-  buildInputs = [m4 perl lzma];
+  nativebuildInputs = [ lzma ];
+  buildInputs = [ m4 perl ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 5e2edce56f0d..ada2dd1a89a1 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lvp4306f5nq08f3snffs5pp1zwv8l35z6f5g0dds51zs6bzdv6l";
   };
 
-  buildInputs = [ makeWrapper perl gettext LocaleGettext ];
+  nativeBuildInputs = [ makeWrapper gettext LocaleGettext ];
+  buildInputs = [ perl LocaleGettext ];
 
   doCheck = false;                                # target `check' is missing
 
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index f25fbcd00d84..bf134c459d97 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" ];
 
-  propagatedNativeBuildInputs = [ m4 ];
   nativeBuildInputs = [ perl help2man ];
+  propagatedBuildInputs = [ m4 ];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
diff --git a/pkgs/development/tools/parsing/flex/2.5.35.nix b/pkgs/development/tools/parsing/flex/2.5.35.nix
index f3357de867ea..4f78b0c71c16 100644
--- a/pkgs/development/tools/parsing/flex/2.5.35.nix
+++ b/pkgs/development/tools/parsing/flex/2.5.35.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ flex bison texinfo help2man autoreconfHook ];
 
-  propagatedNativeBuildInputs = [ m4 ];
+  propagatedBuildInputs = [ m4 ];
 
   crossAttrs = {
     preConfigure = ''
diff --git a/pkgs/development/tools/parsing/flex/2.6.1.nix b/pkgs/development/tools/parsing/flex/2.6.1.nix
index 7ee2e27e60ad..f27fac9bcb5d 100644
--- a/pkgs/development/tools/parsing/flex/2.6.1.nix
+++ b/pkgs/development/tools/parsing/flex/2.6.1.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison ];
 
-  propagatedNativeBuildInputs = [ m4 ];
+  propagatedBuildInputs = [ m4 ];
 
   postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
     sed -i Makefile -e 's/-no-undefined//;'
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index addf3b6197a3..92fba47b756f 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison ];
 
-  propagatedNativeBuildInputs = [ m4 ];
+  propagatedBuildInputs = [ m4 ];
 
   postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
     sed -i Makefile -e 's/-no-undefined//;'
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index 513e4ceee623..28463dc6163c 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -6,7 +6,7 @@ with stdenv.lib;
 overrideDerivation xorgserver (oldAttrs: {
 
   name = "xwayland-${xorgserver.version}";
-  propagatedNativeBuildInputs = oldAttrs.propagatedNativeBuildInputs
+  propagatedBuildInputs = oldAttrs.propagatedBuildInputs
     ++ [wayland wayland-protocols epoxy libxslt makeWrapper libunwind];
   configureFlags = [
     "--disable-docs"
diff --git a/pkgs/tools/admin/tigervnc/default.nix b/pkgs/tools/admin/tigervnc/default.nix
index 3df01dccced8..33731688cac3 100644
--- a/pkgs/tools/admin/tigervnc/default.nix
+++ b/pkgs/tools/admin/tigervnc/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake zlib gettext libtool ] ++ xorg.xorgserver.nativeBuildInputs;
 
-  propagatedNativeBuildInputs = xorg.xorgserver.propagatedNativeBuildInputs;
+  propagatedBuildInputs = xorg.xorgserver.propagatedBuildInputs;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/misc/kdecoration-viewer/default.nix b/pkgs/tools/misc/kdecoration-viewer/default.nix
index 33ccf28cb0da..62783bb30dff 100644
--- a/pkgs/tools/misc/kdecoration-viewer/default.nix
+++ b/pkgs/tools/misc/kdecoration-viewer/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1cc4xxv72a82p1w9r76090xba7g069r41bi4zx32k4gz3vyl1am6";
   };
 
-  buildInputs = [ cmake extra-cmake-modules qtquickcontrols kconfigwidgets kdeclarative kdecoration ];
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+  buildInputs = [ qtquickcontrols kconfigwidgets kdeclarative kdecoration ];
 
   meta = with stdenv.lib; {
     description = "Allows to preview a KDecoration plugin";

From 9626ffbf14981b7ab618ef85a8ef6ee917d13df4 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 5 Sep 2017 11:34:53 -0400
Subject: [PATCH 123/134] myEnv: stdenv doesn't mangle dependencies like that
 anymore

---
 pkgs/misc/my-env/default.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/misc/my-env/default.nix b/pkgs/misc/my-env/default.nix
index 13102877d7e7..aec79f1c5cf5 100644
--- a/pkgs/misc/my-env/default.nix
+++ b/pkgs/misc/my-env/default.nix
@@ -62,11 +62,7 @@
     , cleanupCmds ? "", shell ? "${pkgs.bashInteractive}/bin/bash --norc"}:
 
 mkDerivation {
-  # The setup.sh script from stdenv will expect the native build inputs in
-  # the nativeBuildInputs environment variable.
-  nativeBuildInputs = [ ] ++ buildInputs;
-  # Trick to bypass the stdenv usual change of propagatedBuildInputs => propagatedNativeBuildInputs
-  propagatedBuildInputs2 = propagatedBuildInputs;
+  inherit buildInputs propagatedBuildInputs;
 
   name = "env-${name}";
   phases = [ "buildPhase" "fixupPhase" ];
@@ -89,8 +85,8 @@ mkDerivation {
         "$setupNew" > "$s"
     cat >> "$out/dev-envs/''${name/env-/}" << EOF
       defaultNativeBuildInputs="$defaultNativeBuildInputs"
-      nativeBuildInputs="$nativeBuildInputs"
-      propagatedBuildInputs="$propagatedBuildInputs2"
+      buildInputs="$buildInputs"
+      propagatedBuildInputs="$propagatedBuildInputs"
       # the setup-new script wants to write some data to a temp file.. so just let it do that and tidy up afterwards
       tmp="\$("${pkgs.coreutils}/bin/mktemp" -d)"
       NIX_BUILD_TOP="\$tmp"

From fea02e30f1cce6a853c0b4724d503caee811f96f Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Tue, 5 Sep 2017 20:12:47 +0200
Subject: [PATCH 124/134] ncurses: 6.0-20170729 -> 6.0-20170902

Fixes issues with xterm terminfo.
---
 pkgs/development/libraries/ncurses/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 35b6659ad7e3..b8c7ff2f07d2 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -11,7 +11,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = if abiVersion == "5" then "5.9" else "6.0-20170729";
+  version = if abiVersion == "5" then "5.9" else "6.0-20170902";
   name = "ncurses-${version}";
 
   src = fetchurl (if abiVersion == "5" then {
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   } else {
     url = "ftp://ftp.invisible-island.net/ncurses/current/${name}.tgz";
-    sha256 = "1cfdpl2gnj8szw28jmzrw47va0yqn16g03ywyzz3bjmaqxxmmwga";
+    sha256 = "1cks4gsz4148jw6wpqia4w5jx7cfxr29g2kmpvp0ssmvwczh8dr4";
   });
 
   patches = [ ./clang.patch ] ++ lib.optional (abiVersion == "5" && stdenv.cc.isGNU) ./gcc-5.patch;

From f3ac052f24cc07126f05654c18be31b4ed0e452d Mon Sep 17 00:00:00 2001
From: Bernd Amend <bernd.amend@gmail.com>
Date: Sun, 3 Sep 2017 23:59:58 +0200
Subject: [PATCH 125/134] cmake: 3.8.2 -> 3.9.1

---
 .../tools/build-managers/cmake/default.nix    | 10 +--
 .../cmake/search-path-3.2.patch               | 77 -------------------
 .../cmake/search-path-3.9.patch               | 62 +++++++++++++++
 3 files changed, 67 insertions(+), 82 deletions(-)
 delete mode 100644 pkgs/development/tools/build-managers/cmake/search-path-3.2.patch
 create mode 100644 pkgs/development/tools/build-managers/cmake/search-path-3.9.patch

diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 13c404374b0c..2668489e58b2 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -12,8 +12,8 @@ with stdenv.lib;
 
 let
   os = stdenv.lib.optionalString;
-  majorVersion = "3.8";
-  minorVersion = "2";
+  majorVersion = "3.9";
+  minorVersion = "1";
   version = "${majorVersion}.${minorVersion}";
 in
 
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.8/cmake-3.8.2-SHA-256.txt
-    sha256 = "da3072794eb4c09f2d782fcee043847b99bb4cf8d4573978d9b2024214d6e92d";
+    # from https://cmake.org/files/v3.9/cmake-3.9.1-SHA-256.txt
+    sha256 = "d768ee83d217f91bb597b3ca2ac663da7a8603c97e1f1a5184bc01e0ad2b12bb";
   };
 
   prePatch = optionalString (!useSharedLibraries) ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   '';
 
   # Don't search in non-Nix locations such as /usr, but do search in our libc.
-  patches = [ ./search-path-3.2.patch ]
+  patches = [ ./search-path-3.9.patch ]
     ++ optional stdenv.isCygwin ./3.2.2-cygwin.patch;
 
   outputs = [ "out" ];
diff --git a/pkgs/development/tools/build-managers/cmake/search-path-3.2.patch b/pkgs/development/tools/build-managers/cmake/search-path-3.2.patch
deleted file mode 100644
index 623a7208a868..000000000000
--- a/pkgs/development/tools/build-managers/cmake/search-path-3.2.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-diff -ru3 cmake-3.4.3/Modules/Platform/UnixPaths.cmake cmake-3.4.3-new/Modules/Platform/UnixPaths.cmake
---- cmake-3.4.3/Modules/Platform/UnixPaths.cmake	2016-01-25 19:57:19.000000000 +0300
-+++ cmake-3.4.3-new/Modules/Platform/UnixPaths.cmake	2016-04-14 00:20:08.963492213 +0300
-@@ -32,9 +32,6 @@
- # List common installation prefixes.  These will be used for all
- # search types.
- list(APPEND CMAKE_SYSTEM_PREFIX_PATH
--  # Standard
--  /usr/local /usr /
--
-   # CMake install location
-   "${_CMAKE_INSTALL_DIR}"
-   )
-@@ -53,44 +50,25 @@
- 
- # List common include file locations not under the common prefixes.
- list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
--  # Windows API on Cygwin
--  /usr/include/w32api
--
--  # X11
--  /usr/X11R6/include /usr/include/X11
--
--  # Other
--  /usr/pkg/include
--  /opt/csw/include /opt/include
--  /usr/openwin/include
-+  @libc_dev@/include
-   )
--
- list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
--  # Windows API on Cygwin
--  /usr/lib/w32api
--
--  # X11
--  /usr/X11R6/lib /usr/lib/X11
--
--  # Other
--  /usr/pkg/lib
--  /opt/csw/lib /opt/lib
--  /usr/openwin/lib
-+  @libc_lib@/lib
-   )
- 
- list(APPEND CMAKE_SYSTEM_PROGRAM_PATH
--  /usr/pkg/bin
-+  @libc_bin@/bin
-   )
- 
- list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
--  /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
-+  @libc_lib@/lib
-   )
- 
- list(APPEND CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES
--  /usr/include
-+  @libc_dev@/include
-   )
- list(APPEND CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES
--  /usr/include
-+  @libc_dev@/include
-   )
- 
- # Enable use of lib64 search path variants by default.
-diff -ur cmake-3.7.2-orig/Modules/Platform/WindowsPaths.cmake cmake-3.7.2/Modules/Platform/WindowsPaths.cmake
---- cmake-3.7.2-orig/Modules/Platform/WindowsPaths.cmake	2017-04-26 09:08:39.095674666 -0700
-+++ cmake-3.7.2/Modules/Platform/WindowsPaths.cmake	2017-04-28 22:32:10.379015998 -0700
-@@ -66,7 +66,7 @@
- 
- if(CMAKE_CROSSCOMPILING AND NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows")
-   # MinGW (useful when cross compiling from linux with CMAKE_FIND_ROOT_PATH set)
--  list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
-+  # list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
- endif()
- 
- list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
-diff -ur cmake-3.7.2-orig/Source/cmFindPackageCommand.cxx cmake-3.7.2/Source/cmFindPackageCommand.cxx
diff --git a/pkgs/development/tools/build-managers/cmake/search-path-3.9.patch b/pkgs/development/tools/build-managers/cmake/search-path-3.9.patch
new file mode 100644
index 000000000000..6213138402b1
--- /dev/null
+++ b/pkgs/development/tools/build-managers/cmake/search-path-3.9.patch
@@ -0,0 +1,62 @@
+diff -ur cmake-3.9.1/Modules/Platform/UnixPaths.cmake cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake
+--- cmake-3.9.1/Modules/Platform/UnixPaths.cmake	2017-08-10 13:36:32.000000000 +0000
++++ cmake-3.9.1-mod/Modules/Platform/UnixPaths.cmake	2017-09-03 01:24:31.901473539 +0000
+@@ -22,9 +22,6 @@
+ # List common installation prefixes.  These will be used for all
+ # search types.
+ list(APPEND CMAKE_SYSTEM_PREFIX_PATH
+-  # Standard
+-  /usr/local /usr /
+-
+   # CMake install location
+   "${_CMAKE_INSTALL_DIR}"
+   )
+@@ -43,31 +40,26 @@
+ 
+ # Non "standard" but common install prefixes
+ list(APPEND CMAKE_SYSTEM_PREFIX_PATH
+-  /usr/X11R6
+-  /usr/pkg
+-  /opt
+   )
+ 
+ # List common include file locations not under the common prefixes.
+ list(APPEND CMAKE_SYSTEM_INCLUDE_PATH
+-  # X11
+-  /usr/include/X11
++  @libc_dev@/include
+   )
+ 
+ list(APPEND CMAKE_SYSTEM_LIBRARY_PATH
+-  # X11
+-  /usr/lib/X11
++  @libc_lib@/lib
+   )
+ 
+ list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES
+-  /lib /lib32 /lib64 /usr/lib /usr/lib32 /usr/lib64
++  @libc_lib@/lib
+   )
+ 
+ list(APPEND CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES
+-  /usr/include
++  @libc_dev@/include
+   )
+ list(APPEND CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES
+-  /usr/include
++  @libc_dev@/include
+   )
+ 
+ # Enable use of lib32 and lib64 search path variants by default.
+diff -ur cmake-3.9.1/Modules/Platform/WindowsPaths.cmake cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake
+--- cmake-3.9.1/Modules/Platform/WindowsPaths.cmake	2017-08-10 13:36:32.000000000 +0000
++++ cmake-3.9.1-mod/Modules/Platform/WindowsPaths.cmake	2017-09-03 01:19:32.808355986 +0000
+@@ -66,7 +66,7 @@
+ 
+ if(CMAKE_CROSSCOMPILING AND NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows")
+   # MinGW (useful when cross compiling from linux with CMAKE_FIND_ROOT_PATH set)
+-  list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
++  # list(APPEND CMAKE_SYSTEM_PREFIX_PATH /)
+ endif()
+ 
+ list(APPEND CMAKE_SYSTEM_INCLUDE_PATH

From b49b9da3ce990d4420145dc1a4dd43fd8fa71ee0 Mon Sep 17 00:00:00 2001
From: Bernd Amend <bernd.amend@gmail.com>
Date: Mon, 4 Sep 2017 00:54:34 +0200
Subject: [PATCH 126/134] cmake: add withQt5 option and make it the default

---
 .../tools/build-managers/cmake/default.nix            | 11 ++++++++---
 pkgs/top-level/all-packages.nix                       |  5 +++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 2668489e58b2..a912b04d217f 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -6,8 +6,12 @@
 , useSharedLibraries ? (!isBootstrap && !stdenv.isCygwin)
 , useNcurses ? false, ncurses
 , useQt4 ? false, qt4
+, withQt5 ? false, qtbase
 }:
 
+assert withQt5 -> useQt4 == false;
+assert useQt4 -> withQt5 == false;
+
 with stdenv.lib;
 
 let
@@ -18,7 +22,7 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "cmake-${os isBootstrap "boot-"}${os useNcurses "cursesUI-"}${os useQt4 "qt4UI-"}${version}";
+  name = "cmake-${os isBootstrap "boot-"}${os useNcurses "cursesUI-"}${os withQt5 "qt5UI-"}${os useQt4 "qt4UI-"}${version}";
 
   inherit majorVersion;
 
@@ -46,7 +50,8 @@ stdenv.mkDerivation rec {
     [ setupHook pkgconfig ]
     ++ optionals useSharedLibraries [ bzip2 curl expat libarchive xz zlib libuv rhash ]
     ++ optional useNcurses ncurses
-    ++ optional useQt4 qt4;
+    ++ optional useQt4 qt4
+    ++ optional withQt5 qtbase;
 
   propagatedBuildInputs = optional stdenv.isDarwin ps;
 
@@ -63,7 +68,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--docdir=share/doc/${name}" ]
     ++ (if useSharedLibraries then [ "--no-system-jsoncpp" "--system-libs" ] else [ "--no-system-libs" ]) # FIXME: cleanup
-    ++ optional useQt4 "--qt-gui"
+    ++ optional (useQt4 || withQt5) "--qt-gui"
     ++ optionals (!useNcurses) [ "--" "-DBUILD_CursesDialog=OFF" ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9c0671ef80ab..cb5e45afbcb7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6882,13 +6882,14 @@ with pkgs;
     inherit (darwin) ps;
   };
 
-  cmake = callPackage ../development/tools/build-managers/cmake {
+  cmake = libsForQt5.callPackage ../development/tools/build-managers/cmake {
     inherit (darwin) ps;
   };
 
   cmakeCurses = cmake.override { useNcurses = true; };
 
-  cmakeWithGui = cmakeCurses.override { useQt4 = true; };
+  cmakeWithGui = cmakeCurses.override { withQt5 = true; };
+  cmakeWithQt4Gui = cmakeCurses.override { useQt4 = true; };
 
   # Does not actually depend on Qt 5
   inherit (kdeFrameworks) extra-cmake-modules kapidox kdoctools;

From eb326c9cb7e76d66672641175c9163445a47aedd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 6 Sep 2017 14:12:51 -0400
Subject: [PATCH 127/134] macos-sierra-shared: Fix, after binutils-wrapper
 broke it

cctool's as needs to be told use to use gnu as, or else we'd need a
dependency cycle between cctools and clang for this case.

In general, this is not a problem because clang uses its own integrated
assembler where possible, and gnu as otherwise.
---
 .../binutils-wrapper/macos-sierra-reexport-hack.bash          | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash b/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash
index b7aa7ea5c092..c3077e869e75 100644
--- a/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash
+++ b/pkgs/build-support/binutils-wrapper/macos-sierra-reexport-hack.bash
@@ -81,8 +81,10 @@ else
 
     symbolBloatObject=$outputNameLibless-symbol-hack.o
     if [[ ! -e $symbolBloatObject ]]; then
+        # `-Q` means use GNU Assembler rather than Clang, avoiding an awkward
+        # dependency cycle.
         printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
-            | @binPrefix@as -- -o $symbolBloatObject
+            | @binPrefix@as -Q -- -o $symbolBloatObject
     fi
 
     # first half of libs

From 9d89fe932c911f2bb07ba77d8cbabd583d8a37d0 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 6 Sep 2017 22:01:48 -0400
Subject: [PATCH 128/134] tests: Fix hibernate

(cherry picked from commit 024b501907eafbd89624e465ff21afbc96e9fec6)
---
 nixos/tests/hibernate.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/hibernate.nix b/nixos/tests/hibernate.nix
index db58a2f5c857..a95235887e89 100644
--- a/nixos/tests/hibernate.nix
+++ b/nixos/tests/hibernate.nix
@@ -37,7 +37,7 @@ import ./make-test.nix (pkgs: {
       $machine->waitForShutdown;
       $machine->start;
       $probe->waitForUnit("network.target");
-      $probe->waitUntilSucceeds("echo test | nc machine 4444");
+      $probe->waitUntilSucceeds("echo test | nc machine 4444 -q 0");
     '';
 
 })

From ec8d41f08c95cff79ccb28132146226f4f75c6fe Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 7 Sep 2017 12:22:33 +0200
Subject: [PATCH 129/134] Revert "Merge pull request #28557 from
 obsidiansystems/binutils-wrapper"

This reverts commit 0a944b345e89ca0096974d168f49e1c6830c3fc2, reversing
changes made to 61733ed6ccde3427016720f2e0cd191d3d95152c.

I dislike these massive stdenv changes with unclear motivation,
especially when they involve gratuitous mass renames like NIX_CC ->
NIX_BINUTILS. The previous such rename (NIX_GCC -> NIX_CC) caused
months of pain, so let's not do that again.
---
 doc/stdenv.xml                                |  60 ++--
 .../audio/google-musicmanager/default.nix     |   2 +-
 .../default.nix                               |   2 +-
 pkgs/applications/audio/renoise/default.nix   |   2 +-
 pkgs/applications/audio/spotify/default.nix   |   2 +-
 pkgs/applications/editors/atom/default.nix    |   4 +-
 .../applications/editors/brackets/default.nix |   4 +-
 .../editors/jetbrains/default.nix             |   2 +-
 .../editors/kodestudio/default.nix            |  14 +-
 .../editors/lighttable/default.nix            |   2 +-
 pkgs/applications/editors/sublime/default.nix |   2 +-
 .../applications/editors/sublime3/default.nix |   2 +-
 pkgs/applications/editors/typora/default.nix  |   2 +-
 pkgs/applications/editors/vscode/default.nix  |   2 +-
 .../graphics/draftsight/default.nix           |   2 +-
 .../applications/misc/adobe-reader/builder.sh |   2 +-
 .../applications/misc/googleearth/default.nix |   2 +-
 pkgs/applications/misc/houdini/runtime.nix    |   2 +-
 pkgs/applications/misc/hyper/default.nix      |   2 +-
 pkgs/applications/misc/ipmiview/default.nix   |   4 +-
 pkgs/applications/misc/kdbplus/default.nix    |   2 +-
 pkgs/applications/misc/kiwix/default.nix      |   2 +-
 pkgs/applications/misc/rescuetime/default.nix |   2 +-
 pkgs/applications/misc/simplenote/default.nix |   2 +-
 .../networking/bittorrentsync/generic.nix     |   2 +-
 .../browsers/firefox-bin/default.nix          |   2 +-
 .../browsers/google-chrome/default.nix        |   2 +-
 .../mozilla-plugins/flashplayer/default.nix   |   2 +-
 .../flashplayer/standalone.nix                |   2 +-
 .../google-talk-plugin/default.nix            |   2 +-
 .../networking/browsers/opera/default.nix     |   2 +-
 .../tor-browser-bundle-bin/default.nix        |   2 +-
 .../networking/browsers/vivaldi/default.nix   |   2 +-
 .../networking/cluster/hadoop/default.nix     |   2 +-
 .../networking/dropbox/default.nix            |   2 +-
 .../instant-messengers/discord/default.nix    |   2 +-
 .../instant-messengers/franz/default.nix      |   2 +-
 .../instant-messengers/hipchat/default.nix    |   2 +-
 .../messenger-for-desktop/default.nix         |   2 +-
 .../instant-messengers/rambox/default.nix     |   2 +-
 .../skypeforlinux/default.nix                 |   2 +-
 .../instant-messengers/slack/default.nix      |   2 +-
 .../instant-messengers/teamspeak/client.nix   |   2 +-
 .../instant-messengers/teamspeak/server.nix   |   4 +-
 .../instant-messengers/viber/default.nix      |   2 +-
 .../instant-messengers/zoom-us/default.nix    |   8 +-
 .../networking/insync/default.nix             |   2 +-
 .../mailreaders/nylas-mail-bin/default.nix    |   4 +-
 .../mailreaders/thunderbird-bin/default.nix   |   2 +-
 .../networking/remote/anydesk/default.nix     |   2 +-
 .../remote/citrix-receiver/default.nix        |   2 +-
 .../networking/resilio-sync/default.nix       |   2 +-
 pkgs/applications/office/marp/default.nix     |   2 +-
 .../applications/office/moneyplex/default.nix |   4 +-
 .../applications/office/wpsoffice/default.nix |   2 +-
 .../science/electronics/eagle/default.nix     |   2 +-
 .../science/logic/saw-tools/default.nix       |   2 +-
 .../science/logic/tptp/default.nix            |   2 +-
 .../science/logic/verifast/default.nix        |   2 +-
 .../science/math/mathematica/10.nix           |   2 +-
 .../science/math/mathematica/9.nix            |   2 +-
 .../science/math/mathematica/default.nix      |   2 +-
 .../science/math/scilab-bin/default.nix       |   2 +-
 .../science/medicine/aliza/default.nix        |   4 +-
 .../science/programming/fdr/default.nix       |   2 +-
 .../taxes/aangifte-2006/builder.sh            |   2 +-
 .../taxes/aangifte-2007/builder.sh            |   2 +-
 .../taxes/aangifte-2008/builder.sh            |   2 +-
 .../taxes/aangifte-2009/default.nix           |   2 +-
 .../taxes/aangifte-2010/default.nix           |   2 +-
 .../taxes/aangifte-2011/default.nix           |   2 +-
 .../taxes/aangifte-2012/default.nix           |   2 +-
 .../taxes/aangifte-2013-wa/default.nix        |   2 +-
 .../taxes/aangifte-2013/default.nix           |   2 +-
 .../taxes/aangifte-2014-wa/default.nix        |   2 +-
 .../taxes/aangifte-2014/default.nix           |   2 +-
 .../version-management/gitkraken/default.nix  |   2 +-
 pkgs/applications/video/makemkv/builder.sh    |   2 +-
 .../binutils-wrapper/add-flags.sh             |  40 ---
 .../binutils-wrapper/add-hardening.sh         |  53 ----
 .../binutils-wrapper/default.nix              | 288 ------------------
 .../binutils-wrapper/setup-hook.sh            |  63 ----
 pkgs/build-support/cc-wrapper/add-flags.sh    |  39 ++-
 .../build-support/cc-wrapper/add-hardening.sh |  10 +
 pkgs/build-support/cc-wrapper/cc-wrapper.sh   |  14 +-
 pkgs/build-support/cc-wrapper/default.nix     | 131 ++++++--
 pkgs/build-support/cc-wrapper/gnat-wrapper.sh |   4 +-
 .../ld-solaris-wrapper.sh                     |   0
 .../ld-wrapper.sh                             |  21 +-
 .../macos-sierra-reexport-hack.bash           | 106 +++++++
 pkgs/build-support/cc-wrapper/setup-hook.sh   |  23 ++
 pkgs/build-support/cc-wrapper/utils.sh        |  32 --
 pkgs/desktops/maxx/default.nix                |   2 +-
 .../arduino/arduino-core/default.nix          |   6 +-
 pkgs/development/compilers/cmucl/binary.nix   |   2 +-
 .../development/compilers/crystal/default.nix |   2 +-
 .../compilers/cudatoolkit/default.nix         |   2 +-
 pkgs/development/compilers/gcc/builder.sh     |   2 +-
 .../compilers/ghc/6.10.2-binary.nix           |   2 +-
 .../compilers/ghc/7.0.4-binary.nix            |   2 +-
 .../compilers/ghc/7.4.2-binary.nix            |   2 +-
 .../compilers/gnatboot/default.nix            |   2 +-
 pkgs/development/compilers/llvm/3.4/llvm.nix  |   2 +-
 pkgs/development/compilers/llvm/3.5/llvm.nix  |   2 +-
 pkgs/development/compilers/llvm/3.7/llvm.nix  |   2 +-
 pkgs/development/compilers/llvm/3.8/llvm.nix  |   2 +-
 pkgs/development/compilers/llvm/3.9/llvm.nix  |   2 +-
 pkgs/development/compilers/llvm/4/llvm.nix    |   2 +-
 pkgs/development/compilers/mentor/default.nix |   2 +-
 pkgs/development/compilers/mono/llvm.nix      |   2 +-
 pkgs/development/compilers/mozart/binary.nix  |   2 +-
 pkgs/development/compilers/opendylan/bin.nix  |   2 +-
 .../compilers/oraclejdk/dlj-bundle-builder.sh |   4 +-
 .../compilers/oraclejdk/jdk-linux-base.nix    |   2 +-
 .../compilers/rust/binaryBuild.nix            |   8 +-
 pkgs/development/compilers/sbcl/bootstrap.nix |   2 +-
 pkgs/development/compilers/tinycc/default.nix |   2 +-
 pkgs/development/compilers/zulu/default.nix   |   2 +-
 .../development/interpreters/dart/default.nix |   2 +-
 .../interpreters/rebol/default.nix            |   2 +-
 .../libraries/libstdc++5/default.nix          |   5 +-
 .../oracle-instantclient/default.nix          |   2 +-
 pkgs/development/libraries/wtk/builder.sh     |   2 +-
 pkgs/development/misc/amdapp-sdk/default.nix  |   2 +-
 pkgs/development/mobile/flashtool/default.nix |   2 +-
 .../development/mobile/genymotion/default.nix |   2 +-
 pkgs/development/tools/electron/default.nix   |   2 +-
 .../tools/misc/saleae-logic/default.nix       |   2 +-
 pkgs/development/tools/node-webkit/nw11.nix   |   4 +-
 pkgs/development/tools/node-webkit/nw12.nix   |   4 +-
 pkgs/development/tools/node-webkit/nw9.nix    |   4 +-
 pkgs/development/tools/phantomjs/default.nix  |   2 +-
 .../tools/sauce-connect/default.nix           |   2 +-
 pkgs/development/tools/thrust/default.nix     |   2 +-
 pkgs/development/tools/unity3d/default.nix    |   4 +-
 pkgs/games/adom/default.nix                   |   2 +-
 pkgs/games/andyetitmoves/default.nix          |   2 +-
 pkgs/games/factorio/default.nix               |   2 +-
 pkgs/games/oilrush/default.nix                |   2 +-
 pkgs/games/openarena/default.nix              |   2 +-
 pkgs/games/planetaryannihilation/default.nix  |   4 +-
 pkgs/games/scrolls/default.nix                |   2 +-
 pkgs/games/sdlmame/default.nix                |   2 +-
 pkgs/games/terraria-server/default.nix        |   4 +-
 pkgs/games/vessel/default.nix                 |   4 +-
 pkgs/games/worldofgoo/default.nix             |   2 +-
 pkgs/misc/cups/drivers/kyocera/default.nix    |   2 +-
 .../cups/drivers/mfcl2700dnlpr/default.nix    |   2 +-
 .../cups/drivers/samsung/4.00.39/builder.sh   |   2 +-
 pkgs/misc/cups/drivers/samsung/4.01.17.nix    |   2 +-
 pkgs/misc/cups/drivers/samsung/default.nix    |   2 +-
 pkgs/misc/drivers/gutenprint/bin.nix          |   2 +-
 pkgs/misc/drivers/sundtek/default.nix         |   2 +-
 pkgs/misc/foldingathome/default.nix           |   2 +-
 pkgs/os-specific/darwin/binutils/default.nix  |  15 +-
 pkgs/os-specific/linux/amdgpu-pro/default.nix |   2 +-
 pkgs/os-specific/linux/dmtcp/default.nix      |   2 +-
 .../linux/firmware/raspberrypi/default.nix    |   2 +-
 .../linux/nvidia-x11/builder-legacy173.sh     |   2 +-
 pkgs/os-specific/linux/nvidia-x11/builder.sh  |   2 +-
 pkgs/os-specific/linux/prl-tools/default.nix  |   2 +-
 pkgs/servers/mattermost/default.nix           |   2 +-
 pkgs/servers/meteor/default.nix               |   6 +-
 .../monitoring/newrelic-sysmond/default.nix   |   2 +-
 pkgs/servers/sql/oracle-xe/default.nix        |   2 +-
 pkgs/stdenv/darwin/default.nix                |  55 ++--
 pkgs/stdenv/linux/default.nix                 |  35 +--
 .../tools/filesystems/yandex-disk/default.nix |   2 +-
 pkgs/tools/misc/megacli/default.nix           |   2 +-
 pkgs/tools/misc/ocz-ssd-guru/default.nix      |   2 +-
 pkgs/tools/misc/sam-ba/default.nix            |   2 +-
 pkgs/tools/misc/staruml/default.nix           |   2 +-
 pkgs/tools/misc/xflux/default.nix             |   2 +-
 pkgs/tools/package-management/rpm/default.nix |   9 +-
 pkgs/tools/security/encryptr/default.nix      |   2 +-
 pkgs/tools/security/enpass/default.nix        |   2 +-
 pkgs/tools/security/fprot/default.nix         |   2 +-
 pkgs/tools/security/gorilla-bin/default.nix   |   2 +-
 pkgs/tools/security/keybase-gui/default.nix   |   2 +-
 pkgs/tools/text/xidel/default.nix             |   2 +-
 pkgs/top-level/all-packages.nix               |  38 +--
 pkgs/top-level/darwin-packages.nix            |   4 +-
 pkgs/top-level/haxe-packages.nix              |   2 +-
 183 files changed, 548 insertions(+), 881 deletions(-)
 delete mode 100644 pkgs/build-support/binutils-wrapper/add-flags.sh
 delete mode 100644 pkgs/build-support/binutils-wrapper/add-hardening.sh
 delete mode 100644 pkgs/build-support/binutils-wrapper/default.nix
 delete mode 100644 pkgs/build-support/binutils-wrapper/setup-hook.sh
 rename pkgs/build-support/{binutils-wrapper => cc-wrapper}/ld-solaris-wrapper.sh (100%)
 mode change 100644 => 100755
 rename pkgs/build-support/{binutils-wrapper => cc-wrapper}/ld-wrapper.sh (92%)
 create mode 100644 pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash

diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 5d6d9f595097..dac53bc2b800 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -1,3 +1,4 @@
+
 <chapter xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xml:id="chap-stdenv">
@@ -1341,58 +1342,33 @@ someVar=$(stripHash $name)
 
 <variablelist>
 
-  <varlistentry>
-    <term>Binutils Wrapper</term>
-    <listitem>
-      <para>
-        Binutils Wrapper wraps the binary utilities for a bunch of miscellaneous purposes.
-        Specifically, GNU Binutils (for Linux, but a mix of cctools and GNU Binutils for Darwin), and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by Binutils Wrapper.
-        Packages typically depend on CC Wrapper, which in turn (at run time) depends on binutils-wrapper.
-      </para>
-      <para>
-        Binutils Wrapper was only just recently split off from CC Wrapper, so the division of labor is still being worked out.
-        For example, it shouldn't care about about the C standard library, but just take a derivation with the dynamic loader (which happens to be the glibc on linux).
-        Dependency finding however is a task both wrappers will continue to need to share, and probably the most important to understand.
-        It is currently accomplished by collecting directories of host-platform dependencies (i.e. <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>) in environment variables.
-        Binutils Wrapper's setup hook causes any <filename>lib</filename> and <filename>lib64</filename> subdirectories to <envar>NIX_LDFLAGS</envar>.
-        Sine CC Wrapper and Binutils Wrapper use the same strategy, most of the Binutils Wrapper code is sparsely commented and refers to CC Wrapper.
-        But CC Wrapper's code, by contrast, has quite lengthy comments.
-        Binutils Wrapper merely cites those, rather than repeating them, to avoid falling out of sync.
-      </para>
-      <para>
-        A final task of the setup hook is defining a number of standard environment variables to tell build systems which executables full-fill which purpose.
-        They are defined to just be the base name of the tools, under the assumption that Binutils Wrapper's binaries will be on the path.
-        Firstly, this helps poorly-written packages, e.g. ones that look for just <command>gcc</command> when <envar>CC</envar> isn't defined yet <command>clang</command> is to be used.
-        Secondly, this helps packages not get confused when cross-compiling, in which case multiple Binutils Wrappers may be simultaneous in use (targeting different platforms).
-        <envar>BUILD_</envar>- and <envar>TARGET_</envar>-prefixed versions of the normal environment variable are defined for the additional Binutils Wrappers, properly disambiguating them.
-      </para>
-      <para>
-        A problem with this final task is that Binutils Wrapper is honest and defines <envar>LD</envar> as <command>ld</command>.
-        Most packages, however, firstly use the C compiler for linking, secondly use <envar>LD</envar> anyways, defining it as the C compiler, and thirdly, only so define <envar>LD</envar> when it is undefined as a fallback.
-        This triple-threat means Binutils Wrapper will break those packages, as LD is already defined as the actually linker which the package won't override yet doesn't want to use.
-        The workaround is to define, just for the problematic package, <envar>LD</envar> as the C compiler.
-        A good way to do this would be <command>preConfigure = "LD=$CC"</command>.
-      </para>
-    </listitem>
-  </varlistentry>
-
   <varlistentry>
     <term>CC Wrapper</term>
     <listitem>
       <para>
         CC Wrapper wraps a C toolchain for a bunch of miscellaneous purposes.
-        Specifically, a C compiler (GCC or Clang), Binutils (or the CCTools + binutils mashup when targetting Darwin), and a C standard library (glibc or Darwin's libSystem, just for the dynamic loader) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by Binutils Wrapper.
-        Packages typically depend on CC Wrapper, which in turn (at run time) depends on Binutils Wrapper.
+        Specifically, a C compiler (GCC or Clang), Binutils (or the CCTools + binutils mashup when targetting Darwin), and a C standard library (glibc or Darwin's libSystem) are all fed in, and dependency finding, hardening (see below), and purity checks for each are handled by CC Wrapper.
+        Packages typically depend on only CC Wrapper, instead of those 3 inputs directly.
       </para>
       <para>
-        Dependency finding is undoubtedly the main task of CC Wrapper.
-        This works just like Binutils Wrapper, except the any <filename>include</filename> subdirectory of any relevant dependency is added to <envar>NIX_CFLAGS_COMPILE</envar>.
+        Dependency finding is undoubtedly the main task of CC wrapper.
+        It is currently accomplished by collecting directories of host-platform dependencies (i.e. <varname>buildInputs</varname> and <varname>nativeBuildInputs</varname>) in environment variables.
+        CC wrapper's setup hook causes any <filename>include</filename> subdirectory of such a dependency to be added to <envar>NIX_CFLAGS_COMPILE</envar>, and any <filename>lib</filename> and <filename>lib64</filename> subdirectories to <envar>NIX_LDFLAGS</envar>.
         The setup hook itself contains some lengthy comments describing the exact convoluted mechanism by which this is accomplished.
       </para>
       <para>
-        CC Wrapper also like Binutils Wrapper defines standard environment variables with the names of the tools it wraps, for the same reasons described above.
-        Importantly, while it includes a <command>cc</command> symlink to the c compiler for portability, the <envar>CC</envar> will be defined using the compiler's "real name" (i.e. <command>gcc</command> or <command>clang</command>).
-        This helps lousy build systems that inspect on the name of the compiler rather than run it.
+        A final task of the setup hook is defining a number of standard environment variables to tell build systems which executables full-fill which purpose.
+        They are defined to just be the base name of the tools, under the assumption that CC Wrapper's binaries will be on the path.
+        Firstly, this helps poorly-written packages, e.g. ones that look for just <command>gcc</command> when <envar>CC</envar> isn't defined yet <command>clang</command> is to be used.
+        Secondly, this helps packages not get confused when cross-compiling, in which case multiple CC wrappers may be simultaneous in use (targeting different platforms).
+        <envar>BUILD_</envar>- and <envar>TARGET_</envar>-prefixed versions of the normal environment variable are defined for the additional CC Wrappers, properly disambiguating them.
+      </para>
+      <para>
+        A problem with this final task is that CC Wrapper is honest and defines <envar>LD</envar> as <command>ld</command>.
+        Most packages, however, firstly use the C compiler for linking, secondly use <envar>LD</envar> anyways, defining it as the C compiler, and thirdly, only so define <envar>LD</envar> when it is undefined as a fallback.
+        This triple-threat means CC Wrapper will break those packages, as LD is already defined as the actually linker which the package won't override yet doesn't want to use.
+        The workaround is to define, just for the problematic package, <envar>LD</envar> as the C compiler.
+        A good way to do this would be <command>preConfigure = "LD=$CC"</command>.
       </para>
     </listitem>
   </varlistentry>
diff --git a/pkgs/applications/audio/google-musicmanager/default.nix b/pkgs/applications/audio/google-musicmanager/default.nix
index 27ce9eb3d133..72bec52b2663 100644
--- a/pkgs/applications/audio/google-musicmanager/default.nix
+++ b/pkgs/applications/audio/google-musicmanager/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "$out/opt/google/musicmanager:${stdenv.lib.makeLibraryPath [ readline ncurses stdenv.cc.libc.out qt48 stdenv.cc.cc libidn expat flac libvorbis ]}" opt/google/musicmanager/MusicManager
   '';
 
diff --git a/pkgs/applications/audio/google-play-music-desktop-player/default.nix b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
index 2f235966a399..9d9af6311832 100644
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
     cp -r ./usr/share $out
     cp -r ./usr/bin $out
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
              "$out/share/google-play-music-desktop-player/Google Play Music Desktop Player"
 
     wrapProgram $out/bin/google-play-music-desktop-player \
diff --git a/pkgs/applications/audio/renoise/default.nix b/pkgs/applications/audio/renoise/default.nix
index 6b780cf0a756..d02c551be8af 100644
--- a/pkgs/applications/audio/renoise/default.nix
+++ b/pkgs/applications/audio/renoise/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     ln -s $out/renoise $out/bin/renoise
 
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $out/lib $out/renoise
   '';
 
   meta = {
diff --git a/pkgs/applications/audio/spotify/default.nix b/pkgs/applications/audio/spotify/default.nix
index 29019c14f85b..ad0f7ee14c5a 100644
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@@ -89,7 +89,7 @@ stdenv.mkDerivation {
       rpath="$out/share/spotify:$libdir"
 
       patchelf \
-        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath $rpath $out/share/spotify/spotify
 
       librarypath="${stdenv.lib.makeLibraryPath deps}:$libdir"
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 2238aafee706..e3e889abd87f 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -25,10 +25,10 @@ stdenv.mkDerivation rec {
 
     fixupPhase
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}:$out/share/atom" \
       $out/share/atom/atom
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}" \
       $out/share/atom/resources/app/apm/bin/node
 
diff --git a/pkgs/applications/editors/brackets/default.nix b/pkgs/applications/editors/brackets/default.nix
index 2dd43f9ba3cf..23cb16c0733f 100644
--- a/pkgs/applications/editors/brackets/default.nix
+++ b/pkgs/applications/editors/brackets/default.nix
@@ -36,11 +36,11 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${bracketsLibs}:$out/opt/brackets/lib" \
       $out/opt/brackets/Brackets
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${bracketsLibs}" \
       $out/opt/brackets/Brackets-node
 
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 5c042f2fe49e..95f3c0801d2a 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -35,7 +35,7 @@ let
           ln -s ${cmake} bin/cmake
 
           lldbLibPath=$out/clion-${version}/bin/lldb/lib
-          interp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
+          interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
           ln -s ${ncurses.out}/lib/libncurses.so $lldbLibPath/libtinfo.so.5
 
           patchelf --set-interpreter $interp \
diff --git a/pkgs/applications/editors/kodestudio/default.nix b/pkgs/applications/editors/kodestudio/default.nix
index ef07d7515aaf..a0e941289099 100644
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@@ -50,31 +50,31 @@ in
     postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
       # Patch Binaries
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "$out:${atomEnv.libPath}" \
           $out/kodestudio
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsaLib}/lib:${mesa}/lib:${openssl.out}/lib" \
           $out/resources/app/extensions/krom/Krom/linux/Krom
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib" \
           $out/resources/app/extensions/kha/Kha/Kore/Tools/krafix/krafix-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib" \
           $out/resources/app/extensions/kha/Kha/Kore/Tools/kraffiti/kraffiti-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${stdenv.cc.cc.lib}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/kravur/kravur-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${zlib}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/haxe/haxe-linux64
       patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ".:${stdenv.cc.libc}/lib:${libvorbis}/lib:${libogg}/lib:${flac.out}/lib" \
           $out/resources/app/extensions/kha/Kha/Tools/oggenc/oggenc-linux64
 
diff --git a/pkgs/applications/editors/lighttable/default.nix b/pkgs/applications/editors/lighttable/default.nix
index d16d2d2cc649..74a83c1278af 100644
--- a/pkgs/applications/editors/lighttable/default.nix
+++ b/pkgs/applications/editors/lighttable/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     mv ./${name}-linux/* $out/share/LightTable
 
     patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath ${libPath}:${libPath}/lib64:$out/share/LightTable \
       $out/share/LightTable/LightTable
 
diff --git a/pkgs/applications/editors/sublime/default.nix b/pkgs/applications/editors/sublime/default.nix
index 57e00f7227da..9cf5bd97d0a3 100644
--- a/pkgs/applications/editors/sublime/default.nix
+++ b/pkgs/applications/editors/sublime/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
     echo ${libPath}
     patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
       $out/sublime/sublime_text
 
diff --git a/pkgs/applications/editors/sublime3/default.nix b/pkgs/applications/editors/sublime3/default.nix
index aa19a2ca19af..c295313621e3 100644
--- a/pkgs/applications/editors/sublime3/default.nix
+++ b/pkgs/applications/editors/sublime3/default.nix
@@ -50,7 +50,7 @@ in let
     buildPhase = ''
       for i in sublime_text plugin_host crash_reporter; do
         patchelf \
-          --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath ${libPath}:${stdenv.cc.cc.lib}/lib${stdenv.lib.optionalString stdenv.is64bit "64"} \
           $i
       done
diff --git a/pkgs/applications/editors/typora/default.nix b/pkgs/applications/editors/typora/default.nix
index 4be9b6dda20f..0733bd796656 100644
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
      patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "$out/share/typora:${rpath}" "$out/share/typora/Typora"
 
     ln -s "$out/share/typora/Typora" "$out/bin/typora"
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index 3457429f4dba..1f91bdfa3a58 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -72,7 +72,7 @@ in
 
     postFixup = lib.optionalString (stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux") ''
       patchelf \
-        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "${rpath}" \
         $out/lib/vscode/code
     '';
diff --git a/pkgs/applications/graphics/draftsight/default.nix b/pkgs/applications/graphics/draftsight/default.nix
index 32cce492589d..17334c5b366c 100644
--- a/pkgs/applications/graphics/draftsight/default.nix
+++ b/pkgs/applications/graphics/draftsight/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     mkdir $out/bin
     for exe in DraftSight dsHttpApiController dsHttpApiService FxCrashRptApp HelpGuide; do
       echo "Patching $exe..."
-      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
                --set-rpath $libPath:\$ORIGIN/../Libraries \
                $out/draftsight/opt/dassault-systemes/DraftSight/Linux/$exe
       makeWrapper $out/draftsight/opt/dassault-systemes/DraftSight/Linux/$exe \
diff --git a/pkgs/applications/misc/adobe-reader/builder.sh b/pkgs/applications/misc/adobe-reader/builder.sh
index 75a2bdcf4b01..41281385c990 100644
--- a/pkgs/applications/misc/adobe-reader/builder.sh
+++ b/pkgs/applications/misc/adobe-reader/builder.sh
@@ -17,7 +17,7 @@ rm $p/Reader/intellinux/plug_ins/PPKLite.api
 # More pointless files.
 rm $p/bin/UNINSTALL
 
-patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
     --set-rpath $libPath \
     $p/Reader/intellinux/bin/acroread
 
diff --git a/pkgs/applications/misc/googleearth/default.nix b/pkgs/applications/misc/googleearth/default.nix
index b343c1bf785e..df8cb71d6f9e 100644
--- a/pkgs/applications/misc/googleearth/default.nix
+++ b/pkgs/applications/misc/googleearth/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     rm $out/bin/google-earth $out/opt/google/earth/free/google-earth
     ln -s $out/opt/google/earth/free/googleearth $out/bin/google-earth
 
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${fullPath}:\$ORIGIN" \
       $out/opt/google/earth/free/googleearth-bin
 
diff --git a/pkgs/applications/misc/houdini/runtime.nix b/pkgs/applications/misc/houdini/runtime.nix
index c2fe99744d17..b3ce98895e6f 100644
--- a/pkgs/applications/misc/houdini/runtime.nix
+++ b/pkgs/applications/misc/houdini/runtime.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     echo "export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"" >> $out/houdini/sbin/app_init.sh
   '';
   postFixup = ''
-    INTERPRETER="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
+    INTERPRETER="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
     for BIN in $(find $out/bin -type f -executable); do
       if patchelf $BIN 2>/dev/null ; then
         echo "Patching ELF $BIN"
diff --git a/pkgs/applications/misc/hyper/default.nix b/pkgs/applications/misc/hyper/default.nix
index ba18e346a2fa..3c9eeac891db 100644
--- a/pkgs/applications/misc/hyper/default.nix
+++ b/pkgs/applications/misc/hyper/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin"
     mv opt "$out/"
     ln -s "$out/opt/Hyper/hyper" "$out/bin/hyper"
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "${libPath}:\$ORIGIN" "$out/opt/Hyper/hyper"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${libPath}:\$ORIGIN" "$out/opt/Hyper/hyper"
     mv usr/* "$out/"
   '';
   dontPatchELF = true;
diff --git a/pkgs/applications/misc/ipmiview/default.nix b/pkgs/applications/misc/ipmiview/default.nix
index dd43e703d350..f90784759941 100644
--- a/pkgs/applications/misc/ipmiview/default.nix
+++ b/pkgs/applications/misc/ipmiview/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
    buildPhase = with xorg; ''
      patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libX11 libXext libXrender libXtst libXi ]}" ./jre/lib/amd64/xawt/libmawt.so
      patchelf --set-rpath "${gcc.cc}/lib" ./libiKVM64.so
-     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libXcursor libX11 libXext libXrender libXtst libXi ]}" --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./jre/bin/javaws
-     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./jre/bin/java
+     patchelf --set-rpath "${stdenv.lib.makeLibraryPath [ libXcursor libX11 libXext libXrender libXtst libXi ]}" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/javaws
+     patchelf --set-rpath "${gcc.cc}/lib:$out/jre/lib/amd64/jli" --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./jre/bin/java
    '';
 
    installPhase = ''
diff --git a/pkgs/applications/misc/kdbplus/default.nix b/pkgs/applications/misc/kdbplus/default.nix
index f3855f2bb925..bf1b77534ce6 100644
--- a/pkgs/applications/misc/kdbplus/default.nix
+++ b/pkgs/applications/misc/kdbplus/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/libexec
 
     patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} \
       ./q/l32/q
     mv ./q/l32/q $out/libexec/q
diff --git a/pkgs/applications/misc/kiwix/default.nix b/pkgs/applications/misc/kiwix/default.nix
index 2459b3c411e5..c5b75a0be555 100644
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     cp -r src/dependencies/xulrunner $out/lib/kiwix
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/lib/kiwix/xulrunner/xulrunner
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/lib/kiwix/xulrunner/xulrunner
 
     rm $out/bin/kiwix
     makeWrapper $out/lib/kiwix/kiwix-launcher $out/bin/kiwix \
diff --git a/pkgs/applications/misc/rescuetime/default.nix b/pkgs/applications/misc/rescuetime/default.nix
index 50f09ce1b5cf..03d058783b23 100644
--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     cp usr/bin/rescuetime $out/bin
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/rescuetime
 
     wrapProgram $out/bin/rescuetime \
diff --git a/pkgs/applications/misc/simplenote/default.nix b/pkgs/applications/misc/simplenote/default.nix
index c84c25038d6c..7367c8207054 100644
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@@ -47,7 +47,7 @@
 
     fixupPhase
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${libPath}:$out/share/simplenote" \
       $out/share/simplenote/simplenote
 
diff --git a/pkgs/applications/networking/bittorrentsync/generic.nix b/pkgs/applications/networking/bittorrentsync/generic.nix
index 342385c4b001..3fa7fe180402 100644
--- a/pkgs/applications/networking/bittorrentsync/generic.nix
+++ b/pkgs/applications/networking/bittorrentsync/generic.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     install -D btsync "$out/bin/btsync"
-    patchelf --interpreter "$(< $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath ${libPath} "$out/bin/btsync"
+    patchelf --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" --set-rpath ${libPath} "$out/bin/btsync"
   '';
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 8abcb0cfaac0..f59cb402720d 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -152,7 +152,7 @@ stdenv.mkDerivation {
         updater crashreporter webapprt-stub
       do
         if [ -e "$out/usr/lib/firefox-bin-${version}/$executable" ]; then
-          patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             "$out/usr/lib/firefox-bin-${version}/$executable"
         fi
       done
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index ad79aef88a40..9a4d90701b28 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -130,7 +130,7 @@ in stdenv.mkDerivation rec {
 
     for elf in $out/share/google/$appname/{chrome,chrome-sandbox,nacl_helper}; do
       patchelf --set-rpath $rpath $elf
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $elf
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
     done
   '';
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index cc076fa02f07..0452e7486e6f 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
       $out/lib${lib_suffix}/kde4/kcm_adobe_flash_player.so
 
     patchelf \
-      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       --set-rpath "$rpath" \
       $out/bin/flash-player-properties
   '';
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 9c37979a359b..9a805eb55e4f 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
     cp -pv flashplayer${lib.optionalString debug "debugger"} $out/bin
 
     patchelf \
-      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       --set-rpath "$rpath" \
       $out/bin/flashplayer${lib.optionalString debug "debugger"}
   '';
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
index 2e815f77780f..461db272b12e 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
       cp -prd opt/google/talkplugin/{data,GoogleTalkPlugin,locale,remoting24x24.png,windowpicker.glade} $out/libexec/google/talkplugin/
 
       patchelf \
-        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "${rpathProgram}:${stdenv.cc.cc.lib}/lib64" \
         $out/libexec/google/talkplugin/GoogleTalkPlugin
 
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 66eaf8ecfba3..52a2ce9164c9 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -114,7 +114,7 @@ in stdenv.mkDerivation {
     | while read f
       do
         patchelf \
-          --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "$out/lib:${rpath}" \
           "$f"
       done
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 7967fe539799..756ed095991c 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
   buildCommand = ''
     # For convenience ...
     TBB_IN_STORE=$out/share/tor-browser
-    interp=$(< $NIX_BINUTILS/nix-support/dynamic-linker)
+    interp=$(< $NIX_CC/nix-support/dynamic-linker)
 
     # Unpack & enter
     mkdir -p "$TBB_IN_STORE"
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 7c6ad60116ca..a1238cb5964f 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     echo "Patching Vivaldi binaries"
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${libPath}" \
       opt/vivaldi/vivaldi-bin
   '' + stdenv.lib.optionalString proprietaryCodecs ''
diff --git a/pkgs/applications/networking/cluster/hadoop/default.nix b/pkgs/applications/networking/cluster/hadoop/default.nix
index dcbf609d08e7..9af4cf3f0ed6 100644
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
       sed -i $n -e "s|#!/usr/bin/env bash|#! ${bash}/bin/bash|"
     done
   '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" bin/container-executor;
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" bin/container-executor;
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index 975c5e4a87be..a76d6bc2fa47 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -108,7 +108,7 @@ in mkDerivation {
   '';
 
   preFixup = ''
-    INTERP=$(cat $NIX_BINUTILS/nix-support/dynamic-linker)
+    INTERP=$(cat $NIX_CC/nix-support/dynamic-linker)
     RPATH="${ldpath}:$out/${appdir}"
     getType='s/ *Type: *\([A-Z]*\) (.*/\1/'
     find "$out/${appdir}" -type f -print | while read obj; do
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 701ba477bee5..853a6c96a7a4 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
         # Copying how adobe-reader does it,
         # see pkgs/applications/misc/adobe-reader/builder.sh
-        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
                  --set-rpath "$out/opt/discord:$libPath"                                   \
                  $out/opt/discord/Discord
 
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index f41805748e57..a238009cd11b 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" Franz
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" Franz
     patchelf --set-rpath "$out/opt/franz:${stdenv.lib.makeLibraryPath deps}" Franz
 
     mkdir -p $out/bin $out/opt/franz
diff --git a/pkgs/applications/networking/instant-messengers/hipchat/default.nix b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
index ccbb10c743bb..326f95630707 100644
--- a/pkgs/applications/networking/instant-messengers/hipchat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/hipchat/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
     mv usr/share $out
 
     for file in $(find $d -type f); do
-        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $file || true
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $file || true
         patchelf --set-rpath ${rpath}:$out/libexec/hipchat/lib:\$ORIGIN $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix b/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
index 1db674f9ae13..37a3746669b1 100644
--- a/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/messenger-for-desktop/default.nix
@@ -72,7 +72,7 @@ in stdenv.mkDerivation {
 
     # patch the binaries
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath ${rpath}:$out/libexec $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index b5ce53177a7f..7cb89f019e0e 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -44,7 +44,7 @@ in stdenv.mkDerivation rec {
   dontPatchELF = true;
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" rambox
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" rambox
     patchelf --set-rpath "$out/opt/rambox:${stdenv.lib.makeLibraryPath deps}" rambox
 
     mkdir -p $out/bin $out/opt/rambox
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index f4ad5b74f602..d476b9b35c49 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -78,7 +78,7 @@ in stdenv.mkDerivation {
 
   postFixup = ''
      patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "$out/share/skypeforlinux:${rpath}" "$out/share/skypeforlinux/skypeforlinux"
 
     ln -s "$out/share/skypeforlinux/skypeforlinux" "$out/bin/skypeforlinux"
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 1d1bc86d7ccc..f36f0956f654 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -68,7 +68,7 @@ in stdenv.mkDerivation {
     chmod -R g-w $out
 
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath ${rpath}:$out/lib/slack $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
index 7d1f3fa6791e..efafbd9050cd 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       mv ts3client_linux_${arch} ts3client
       echo "patching ts3client..."
       patchelf \
-        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath ${stdenv.lib.makeLibraryPath deps}:$(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         ts3client
diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
index bfd2469c1cea..c86de07bc842 100644
--- a/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/server.nix
@@ -25,13 +25,13 @@ stdenv.mkDerivation {
     ''
       echo "patching ts3server"
       patchelf \
-        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath $(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         ts3server
       cp tsdns/tsdnsserver tsdnsserver
       patchelf \
-        --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath $(cat $NIX_CC/nix-support/orig-cc)/${libDir} \
         --force-rpath \
         tsdnsserver
diff --git a/pkgs/applications/networking/instant-messengers/viber/default.nix b/pkgs/applications/networking/instant-messengers/viber/default.nix
index afc977ad383b..71d1bccc2b1d 100644
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     chmod -R g-w $out
 
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
       patchelf --set-rpath $libPath:$out/opt/viber/lib $file || true
     done
 
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 208d45ed3dd1..91c77fc9d7ca 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -65,10 +65,10 @@ in stdenv.mkDerivation {
     mkdir -p $out/bin
     cp -ar * $packagePath
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/zoom
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/QtWebEngineProcess
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/qtdiag
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"  $packagePath/zopen
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/zoom
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/QtWebEngineProcess
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/qtdiag
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)"  $packagePath/zopen
     # included from https://github.com/NixOS/nixpkgs/commit/fc218766333a05c9352b386e0cbb16e1ae84bf53
     # it works for me without it, but, well...
     paxmark m $packagePath/zoom
diff --git a/pkgs/applications/networking/insync/default.nix b/pkgs/applications/networking/insync/default.nix
index 4a6bec5d1dab..93efdb74c083 100644
--- a/pkgs/applications/networking/insync/default.nix
+++ b/pkgs/applications/networking/insync/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ makeWrapper ];
 
   postPatch = ''
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" client/insync-portable
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" client/insync-portable
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix b/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
index 2350b9f9465a..4c768325fee9 100644
--- a/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/nylas-mail-bin/default.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
 
     # Patch binaries
     binrp=$(patchelf --print-rpath $out/share/nylas-mail/nylas)
-    patchelf --interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") \
+    patchelf --interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) \
       --set-rpath $binrp:$out/lib:${stdenv.cc.cc.lib}/lib:${lib.makeLibraryPath propagatedBuildInputs } \
       $out/share/nylas-mail/nylas
 
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/share/nylas-mail/resources/apm/bin/apm \
       --set PATH "${coreutils}/bin"
-    patchelf --interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") \
+    patchelf --interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) \
       --set-rpath ${gcc-unwrapped.lib}/lib $out/share/nylas-mail/resources/apm/bin/node
   '';
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index 8a4eb4991ad3..4f714cabf79b 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -134,7 +134,7 @@ stdenv.mkDerivation {
       for executable in \
         thunderbird crashreporter thunderbird-bin plugin-container updater
       do
-        patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           "$out/usr/lib/thunderbird-bin-${version}/$executable"
       done
 
diff --git a/pkgs/applications/networking/remote/anydesk/default.nix b/pkgs/applications/networking/remote/anydesk/default.nix
index 93cb7c82b619..a6858a7b5fdf 100644
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   postFixup = ''
     patchelf \
-      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       --set-rpath "${libPath}" \
       $out/bin/anydesk
 
diff --git a/pkgs/applications/networking/remote/citrix-receiver/default.nix b/pkgs/applications/networking/remote/citrix-receiver/default.nix
index f6c7285e3b71..c656ff24df84 100644
--- a/pkgs/applications/networking/remote/citrix-receiver/default.nix
+++ b/pkgs/applications/networking/remote/citrix-receiver/default.nix
@@ -131,7 +131,7 @@ in stdenv.mkDerivation rec {
         echo "Patching ELF intrepreter and rpath for $f"
         chmod u+w "$f"
         patchelf \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           --set-rpath "$ICAInstDir:$libPath" "$f"
       done
 
diff --git a/pkgs/applications/networking/resilio-sync/default.nix b/pkgs/applications/networking/resilio-sync/default.nix
index 6df757626f84..7622cb76ad2a 100644
--- a/pkgs/applications/networking/resilio-sync/default.nix
+++ b/pkgs/applications/networking/resilio-sync/default.nix
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     install -D rslsync "$out/bin/rslsync"
     patchelf \
-      --interpreter "$(< $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(< $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} "$out/bin/rslsync"
   '';
 
diff --git a/pkgs/applications/office/marp/default.nix b/pkgs/applications/office/marp/default.nix
index 124efb139464..0e53d58a083b 100644
--- a/pkgs/applications/office/marp/default.nix
+++ b/pkgs/applications/office/marp/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}:$out/lib/marp" \
       $out/bin/Marp
   '';
diff --git a/pkgs/applications/office/moneyplex/default.nix b/pkgs/applications/office/moneyplex/default.nix
index 279a406327b3..4530305ee12e 100644
--- a/pkgs/applications/office/moneyplex/default.nix
+++ b/pkgs/applications/office/moneyplex/default.nix
@@ -78,9 +78,9 @@ stdenv.mkDerivation rec {
         ${coreutils}/bin/cp "\$MDIR/moneyplex" "\$MDIR/moneyplex.patched"
         ${coreutils}/bin/chmod 0755 "\$MDIR/moneyplex.patched"
     fi
-    if [ ! \`${patchelf}/bin/patchelf --print-interpreter \$MDIR/moneyplex.patched\` = $(cat $NIX_BINUTILS/nix-support/dynamic-linker) ] ||
+    if [ ! \`${patchelf}/bin/patchelf --print-interpreter \$MDIR/moneyplex.patched\` = $(cat $NIX_CC/nix-support/dynamic-linker) ] ||
        [ ! \`${patchelf}/bin/patchelf --print-rpath \$MDIR/moneyplex.patched\` = "${libPath}" ]; then
-        ${patchelf}/bin/patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "${libPath}" "\$MDIR/moneyplex.patched"
+        ${patchelf}/bin/patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "${libPath}" "\$MDIR/moneyplex.patched"
     fi
 
     exec \$MDIR/moneyplex.patched
diff --git a/pkgs/applications/office/wpsoffice/default.nix b/pkgs/applications/office/wpsoffice/default.nix
index 85deae9ec02b..41dd8595c30d 100644
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation rec{
     mkdir $out/bin
     for i in wps wpp et; do
       patchelf \
-        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --force-rpath --set-rpath "$prefix/office6:$libPath" \
         $prefix/office6/$i
 
diff --git a/pkgs/applications/science/electronics/eagle/default.nix b/pkgs/applications/science/electronics/eagle/default.nix
index 9ac4cc820398..edc5845e9887 100644
--- a/pkgs/applications/science/electronics/eagle/default.nix
+++ b/pkgs/applications/science/electronics/eagle/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     gcc -shared -fPIC -DEAGLE_PATH=\"$out/eagle-${version}\" ${./eagle_fixer.c} -o "$out"/lib/eagle_fixer.so -ldl
 
     # Make wrapper script
-    dynlinker="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
+    dynlinker="$(cat $NIX_CC/nix-support/dynamic-linker)"
     mkdir -p "$out"/bin
     cat > "$out"/bin/eagle << EOF
     #!${stdenv.shell}
diff --git a/pkgs/applications/science/logic/saw-tools/default.nix b/pkgs/applications/science/logic/saw-tools/default.nix
index e2c3e1fdc00c..949b34420b79 100644
--- a/pkgs/applications/science/logic/saw-tools/default.nix
+++ b/pkgs/applications/science/logic/saw-tools/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
   fixupPhase = ''
     for x in bin/bcdump bin/extcore-info bin/jss bin/llvm-disasm bin/lss bin/saw; do
-      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "$out/lib:${libPath}" $out/$x;
     done
   '';
diff --git a/pkgs/applications/science/logic/tptp/default.nix b/pkgs/applications/science/logic/tptp/default.nix
index 2ad991e00e39..db7e0c0c9382 100644
--- a/pkgs/applications/science/logic/tptp/default.nix
+++ b/pkgs/applications/science/logic/tptp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     substituteInPlace $sharedir/TPTP2X/tptp2X_install --replace /bin/mv mv
     tcsh $sharedir/TPTP2X/tptp2X_install -default
 
-    patchelf --interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $sharedir/Scripts/tptp4X
+    patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $sharedir/Scripts/tptp4X
 
     mkdir -p $out/bin
     ln -s $sharedir/TPTP2X/tptp2X $out/bin
diff --git a/pkgs/applications/science/logic/verifast/default.nix b/pkgs/applications/science/logic/verifast/default.nix
index 3ee3f8b7decf..ada586fc4e6d 100644
--- a/pkgs/applications/science/logic/verifast/default.nix
+++ b/pkgs/applications/science/logic/verifast/default.nix
@@ -10,7 +10,7 @@ let
     ] + ":${stdenv.cc.cc.lib}/lib64";
 
   patchExe = x: ''
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath ${libPath} ${x}
   '';
 in
diff --git a/pkgs/applications/science/math/mathematica/10.nix b/pkgs/applications/science/math/mathematica/10.nix
index 005c1c496094..6a49976c86b8 100644
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ b/pkgs/applications/science/math/mathematica/10.nix
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
         echo "patching $f executable <<"
         patchelf --shrink-rpath "$f"
         patchelf \
-	  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
           "$f" \
           && patchelf --shrink-rpath "$f" \
diff --git a/pkgs/applications/science/math/mathematica/9.nix b/pkgs/applications/science/math/mathematica/9.nix
index e190d8fde7f9..c4fd0c384c14 100644
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ b/pkgs/applications/science/math/mathematica/9.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
       elif [ "$type" == "EXEC" ]; then
         echo "patching $f executable <<"
         patchelf \
-            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             --set-rpath "${ldpath}" \
             "$f"
         patchelf --shrink-rpath "$f"
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index 89701991e580..1e23cfea27fc 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
         echo "patching $f executable <<"
         patchelf --shrink-rpath "$f"
         patchelf \
-	  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
           "$f" \
           && patchelf --shrink-rpath "$f" \
diff --git a/pkgs/applications/science/math/scilab-bin/default.nix b/pkgs/applications/science/math/scilab-bin/default.nix
index de6868698a70..f6e255ee46e4 100644
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     fullLibPath="$sci/lib/scilab:$sci/lib/thirdparty:$libPath"
     fullLibPath="$fullLibPath:$sci/lib/thirdparty/redist"
 
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
              --set-rpath "$fullLibPath" bin/scilab-bin
     find . -name '*.so' -type f | while read file; do
       patchelf --set-rpath "$fullLibPath" "$file" 2>/dev/null
diff --git a/pkgs/applications/science/medicine/aliza/default.nix b/pkgs/applications/science/medicine/aliza/default.nix
index 74aefc26fc49..b0471b80e2f1 100644
--- a/pkgs/applications/science/medicine/aliza/default.nix
+++ b/pkgs/applications/science/medicine/aliza/default.nix
@@ -29,11 +29,11 @@ stdenv.mkDerivation {
     libs = stdenv.lib.makeLibraryPath [ qt4 zlib stdenv.cc.cc libSM libICE libX11 libXext libXt mesa ];
   in ''
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/aliza
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/aliza-vtkvol
 
     wrapProgram $out/bin/aliza \
diff --git a/pkgs/applications/science/programming/fdr/default.nix b/pkgs/applications/science/programming/fdr/default.nix
index ce48dd6fce7d..8ed8e0e73b00 100644
--- a/pkgs/applications/science/programming/fdr/default.nix
+++ b/pkgs/applications/science/programming/fdr/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
     for b in fdr4 _fdr4 refines _refines cspmprofiler cspmexplorerprof
     do
-      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
         --set-rpath "$libPath:$out/lib" \
         "$out/bin/$b"
     done
diff --git a/pkgs/applications/taxes/aangifte-2006/builder.sh b/pkgs/applications/taxes/aangifte-2006/builder.sh
index aab55608ba5f..1b709b613bd4 100644
--- a/pkgs/applications/taxes/aangifte-2006/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2006/builder.sh
@@ -3,7 +3,7 @@ source $stdenv/setup
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2007/builder.sh b/pkgs/applications/taxes/aangifte-2007/builder.sh
index f35bf307fbe1..79e5b3097696 100644
--- a/pkgs/applications/taxes/aangifte-2007/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2007/builder.sh
@@ -5,7 +5,7 @@ echo $NIX_CC
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib:$libSM/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2008/builder.sh b/pkgs/applications/taxes/aangifte-2008/builder.sh
index f35bf307fbe1..79e5b3097696 100644
--- a/pkgs/applications/taxes/aangifte-2008/builder.sh
+++ b/pkgs/applications/taxes/aangifte-2008/builder.sh
@@ -5,7 +5,7 @@ echo $NIX_CC
 buildPhase() {
     for i in bin/*; do
         patchelf \
-            --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             --set-rpath $libX11/lib:$libXext/lib:$libSM/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib \
             $i
     done
diff --git a/pkgs/applications/taxes/aangifte-2009/default.nix b/pkgs/applications/taxes/aangifte-2009/default.nix
index bad9be357532..c944fc3d68b3 100644
--- a/pkgs/applications/taxes/aangifte-2009/default.nix
+++ b/pkgs/applications/taxes/aangifte-2009/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2010/default.nix b/pkgs/applications/taxes/aangifte-2010/default.nix
index fc2758adff26..b5a85415c376 100644
--- a/pkgs/applications/taxes/aangifte-2010/default.nix
+++ b/pkgs/applications/taxes/aangifte-2010/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2011/default.nix b/pkgs/applications/taxes/aangifte-2011/default.nix
index b45c99f67051..a38bc4254bbe 100644
--- a/pkgs/applications/taxes/aangifte-2011/default.nix
+++ b/pkgs/applications/taxes/aangifte-2011/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2012/default.nix b/pkgs/applications/taxes/aangifte-2012/default.nix
index 9fb42d7b9930..2e51ef9ed4cf 100644
--- a/pkgs/applications/taxes/aangifte-2012/default.nix
+++ b/pkgs/applications/taxes/aangifte-2012/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2013-wa/default.nix b/pkgs/applications/taxes/aangifte-2013-wa/default.nix
index 8b97233c8791..5ee0edb4b5e5 100644
--- a/pkgs/applications/taxes/aangifte-2013-wa/default.nix
+++ b/pkgs/applications/taxes/aangifte-2013-wa/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2013/default.nix b/pkgs/applications/taxes/aangifte-2013/default.nix
index 54cb86885908..3cf85961a9bb 100644
--- a/pkgs/applications/taxes/aangifte-2013/default.nix
+++ b/pkgs/applications/taxes/aangifte-2013/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2014-wa/default.nix b/pkgs/applications/taxes/aangifte-2014-wa/default.nix
index 6a0023d756cc..78bb8214257f 100644
--- a/pkgs/applications/taxes/aangifte-2014-wa/default.nix
+++ b/pkgs/applications/taxes/aangifte-2014-wa/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/taxes/aangifte-2014/default.nix b/pkgs/applications/taxes/aangifte-2014/default.nix
index 697e0cd3561f..0151cca52b2c 100644
--- a/pkgs/applications/taxes/aangifte-2014/default.nix
+++ b/pkgs/applications/taxes/aangifte-2014/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     ''
       for i in bin/*; do
           patchelf \
-              --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
               --set-rpath ${stdenv.lib.makeLibraryPath [ libX11 libXext libSM ]}:$(cat $NIX_CC/nix-support/orig-cc)/lib \
               $i
       done
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index 0d410d230d4d..c7f7a4b02e4d 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
              --set-rpath "$libPath:$out/opt/gitkraken" "$out/opt/gitkraken/gitkraken"
     wrapProgram $out/opt/gitkraken/gitkraken \
       --prefix LD_PRELOAD : "${makeLibraryPath [ curl ]}/libcurl.so.4" \
diff --git a/pkgs/applications/video/makemkv/builder.sh b/pkgs/applications/video/makemkv/builder.sh
index ee2dd392bb78..416d5c0f0b07 100644
--- a/pkgs/applications/video/makemkv/builder.sh
+++ b/pkgs/applications/video/makemkv/builder.sh
@@ -27,7 +27,7 @@ libPath="${libPath}:${out}/lib" # XXX: der. This should be in the nix file?
 
 for i in ${bin} ; do
   patchelf \
-    --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
     --set-rpath $libPath \
     ${i}
 done 
diff --git a/pkgs/build-support/binutils-wrapper/add-flags.sh b/pkgs/build-support/binutils-wrapper/add-flags.sh
deleted file mode 100644
index a69e2313af3b..000000000000
--- a/pkgs/build-support/binutils-wrapper/add-flags.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-# See cc-wrapper for comments.
-var_templates_list=(
-    NIX+IGNORE_LD_THROUGH_GCC
-    NIX+LDFLAGS
-    NIX+LDFLAGS_BEFORE
-    NIX+LDFLAGS_AFTER
-    NIX+LDFLAGS_HARDEN
-)
-var_templates_bool=(
-    NIX+SET_BUILD_ID
-    NIX+DONT_SET_RPATH
-)
-
-declare -a role_infixes=()
-if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then
-    role_infixes+=(_BUILD_)
-fi
-if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then
-    role_infixes+=(_)
-fi
-if [ "${NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
-    role_infixes+=(_TARGET_)
-fi
-
-for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" "${role_infixes[@]}"
-done
-for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" "${role_infixes[@]}"
-done
-
-if [ -e @out@/nix-support/libc-ldflags ]; then
-    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
-fi
-
-if [ -e @out@/nix-support/libc-ldflags-before ]; then
-    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
-fi
-
-export NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET=1
diff --git a/pkgs/build-support/binutils-wrapper/add-hardening.sh b/pkgs/build-support/binutils-wrapper/add-hardening.sh
deleted file mode 100644
index 6dabc2007bc9..000000000000
--- a/pkgs/build-support/binutils-wrapper/add-hardening.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-hardeningFlags=(relro bindnow)
-# Intentionally word-split in case 'hardeningEnable' is defined in
-# Nix. Also, our bootstrap tools version of bash is old enough that
-# undefined arrays trip `set -u`.
-if [[ -v hardeningEnable[@] ]]; then
-  hardeningFlags+=(${hardeningEnable[@]})
-fi
-hardeningLDFlags=()
-
-declare -A hardeningDisableMap
-
-# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
-for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
-do
-  hardeningDisableMap[$flag]=1
-done
-
-if [[ -n "${NIX_DEBUG:-}" ]]; then
-  printf 'HARDENING: disabled flags:' >&2
-  (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
-  echo >&2
-fi
-
-if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
-  if [[ -n "${NIX_DEBUG:-}" ]]; then
-    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
-  fi
-  for flag in "${hardeningFlags[@]}"
-  do
-    if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
-      case $flag in
-        pie)
-          if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
-            if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
-            hardeningLDFlags+=('-pie')
-          fi
-          ;;
-        relro)
-          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
-          hardeningLDFlags+=('-z' 'relro')
-          ;;
-        bindnow)
-          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
-          hardeningLDFlags+=('-z' 'now')
-          ;;
-        *)
-          # Ignore unsupported. Checked in Nix that at least *some*
-          # tool supports each flag.
-          ;;
-      esac
-    fi
-  done
-fi
diff --git a/pkgs/build-support/binutils-wrapper/default.nix b/pkgs/build-support/binutils-wrapper/default.nix
deleted file mode 100644
index 7e255cdb2eb1..000000000000
--- a/pkgs/build-support/binutils-wrapper/default.nix
+++ /dev/null
@@ -1,288 +0,0 @@
-# The Nixpkgs CC is not directly usable, since it doesn't know where
-# the C library and standard header files are. Therefore the compiler
-# produced by that package cannot be installed directly in a user
-# environment and used from the command line. So we use a wrapper
-# script that sets up the right environment variables so that the
-# compiler and the linker just "work".
-
-{ name ? "", stdenv, nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
-, binutils ? null, libc ? null
-, coreutils ? null, shell ? stdenv.shell, gnugrep ? null
-, extraPackages ? [], extraBuildCommands ? ""
-, buildPackages ? {}
-, useMacosReexportHack ? false
-}:
-
-with stdenv.lib;
-
-assert nativeTools -> nativePrefix != "";
-assert !nativeTools ->
-  binutils != null && coreutils != null && gnugrep != null;
-assert !(nativeLibc && noLibc);
-assert (noLibc || nativeLibc) == (libc == null);
-
-let
-  inherit (stdenv) hostPlatform targetPlatform;
-
-  # Prefix for binaries. Customarily ends with a dash separator.
-  #
-  # TODO(@Ericson2314) Make unconditional, or optional but always true by
-  # default.
-  prefix = stdenv.lib.optionalString (targetPlatform != hostPlatform)
-                                     (targetPlatform.config + "-");
-
-  binutilsVersion = (builtins.parseDrvName binutils.name).version;
-  binutilsName = (builtins.parseDrvName binutils.name).name;
-
-  libc_bin = if libc == null then null else getBin libc;
-  libc_dev = if libc == null then null else getDev libc;
-  libc_lib = if libc == null then null else getLib libc;
-  binutils_bin = if nativeTools then "" else getBin binutils;
-  # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
-  coreutils_bin = if nativeTools then "" else getBin coreutils;
-
-  dashlessTarget = stdenv.lib.replaceStrings ["-"] ["_"] targetPlatform.config;
-
-  # See description in cc-wrapper.
-  infixSalt = dashlessTarget;
-
-  # The dynamic linker has different names on different platforms. This is a
-  # shell glob that ought to match it.
-  dynamicLinker =
-    /**/ if libc == null then null
-    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
-    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
-    # ARM with a wildcard, which can be "" or "-armhf".
-    else if targetPlatform.isArm                      then "${libc_lib}/lib/ld-linux*.so.3"
-    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
-    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
-    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
-    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
-    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
-    else null;
-
-  expand-response-params =
-    if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
-    then import ../expand-response-params { inherit (buildPackages) stdenv; }
-    else "";
-
-in
-
-stdenv.mkDerivation {
-  name = prefix
-    + (if name != "" then name else "${binutilsName}-wrapper")
-    + (stdenv.lib.optionalString (binutils != null && binutilsVersion != "") "-${binutilsVersion}");
-
-  preferLocalBuild = true;
-
-  inherit binutils_bin shell libc_bin libc_dev libc_lib coreutils_bin;
-  gnugrep_bin = if nativeTools then "" else gnugrep;
-
-  binPrefix = prefix;
-  inherit infixSalt;
-
-  outputs = [ "out" "man" ];
-
-  passthru = {
-    inherit binutils libc nativeTools nativeLibc nativePrefix prefix;
-
-    emacsBufferSetup = pkgs: ''
-      ; We should handle propagation here too
-      (mapc
-        (lambda (arg)
-          (when (file-directory-p (concat arg "/lib"))
-            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
-          (when (file-directory-p (concat arg "/lib64"))
-            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64"))))
-        '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
-    '';
-  };
-
-  dontBuild = true;
-  dontConfigure = true;
-
-  unpackPhase = ''
-    src=$PWD
-  '';
-
-  installPhase =
-    ''
-      set -u
-
-      mkdir -p $out/bin $out/nix-support $man/nix-support
-
-      wrap() {
-        local dst="$1"
-        local wrapper="$2"
-        export prog="$3"
-        set +u
-        substituteAll "$wrapper" "$out/bin/$dst"
-        set -u
-        chmod +x "$out/bin/$dst"
-      }
-    ''
-
-    + (if nativeTools then ''
-      echo ${nativePrefix} > $out/nix-support/orig-binutils
-
-      ldPath="${nativePrefix}/bin"
-    '' else ''
-      echo $binutils_bin > $out/nix-support/orig-binutils
-
-      ldPath="${binutils_bin}/bin"
-    ''
-
-    + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
-      # Solaris needs an additional ld wrapper.
-      ldPath="${nativePrefix}/bin"
-      exec="$ldPath/${prefix}ld"
-      wrap ld-solaris ${./ld-solaris-wrapper.sh}
-    '')
-
-    + ''
-      # Create a symlink to as (the assembler).
-      if [ -e $ldPath/${prefix}as ]; then
-        ln -s $ldPath/${prefix}as $out/bin/${prefix}as
-      fi
-
-    '' + (if !useMacosReexportHack then ''
-      wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
-    '' else ''
-      ldInner="${prefix}ld-reexport-delegate"
-      wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
-      wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
-      unset ldInner
-    '') + ''
-
-      if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
-        wrap ${prefix}ld.gold ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
-      fi
-
-      if [ -e ${binutils_bin}/bin/ld.bfd ]; then
-        wrap ${prefix}ld.bfd ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
-      fi
-
-      set +u
-    '';
-
-  propagatedBuildInputs = extraPackages;
-
-  setupHook = ./setup-hook.sh;
-
-  postFixup =
-    ''
-      set -u
-    ''
-
-    + optionalString (libc != null) (''
-      ##
-      ## General libc support
-      ##
-
-      echo "-L${libc_lib}/lib" > $out/nix-support/libc-ldflags
-
-      echo "${libc_lib}" > $out/nix-support/orig-libc
-      echo "${libc_dev}" > $out/nix-support/orig-libc-dev
-
-      ##
-      ## Dynamic linker support
-      ##
-
-      if [[ -z ''${dynamicLinker+x} ]]; then
-        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
-        local dynamicLinker="${libc_lib}/lib/ld*.so.?"
-      fi
-
-      # Expand globs to fill array of options
-      dynamicLinker=($dynamicLinker)
-
-      case ''${#dynamicLinker[@]} in
-        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
-        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
-        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
-      esac
-
-      if [ -n "$dynamicLinker" ]; then
-        echo $dynamicLinker > $out/nix-support/dynamic-linker
-
-    '' + (if targetPlatform.isDarwin then ''
-        printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
-    '' else ''
-        if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
-          echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
-        fi
-
-        local ldflagsBefore=(-dynamic-linker "$dynamicLinker")
-    '') + ''
-      fi
-
-      # The dynamic linker is passed in `ldflagsBefore' to allow
-      # explicit overrides of the dynamic linker by callers to ld
-      # (the *last* value counts, so ours should come first).
-      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
-    '')
-
-    + optionalString (!nativeTools) ''
-
-      ##
-      ## User env support
-      ##
-
-      # Propagate the underling unwrapped binutils so that if you
-      # install the wrapper, you get tools like objdump, the manpages,
-      # etc. as well (same for any binaries of libc).
-      printWords ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
-    ''
-
-    + ''
-
-      ##
-      ## Hardening support
-      ##
-
-      # some linkers on some platforms don't support specific -z flags
-      export hardening_unsupported_flags=""
-      if [[ "$($ldPath/${prefix}ld -z now 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
-        hardening_unsupported_flags+=" bindnow"
-      fi
-      if [[ "$($ldPath/${prefix}ld -z relro 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
-        hardening_unsupported_flags+=" relro"
-      fi
-    ''
-
-    + optionalString hostPlatform.isCygwin ''
-      hardening_unsupported_flags+=" pic"
-    ''
-
-    + ''
-      set +u
-      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
-      substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
-      substituteAll ${../cc-wrapper/utils.sh} $out/nix-support/utils.sh
-
-      ##
-      ## Extra custom steps
-      ##
-
-    ''
-    + extraBuildCommands;
-
-  inherit dynamicLinker expand-response-params;
-
-  # for substitution in utils.sh
-  expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-
-  crossAttrs = {
-    shell = shell.crossDrv + shell.crossDrv.shellPath;
-  };
-
-  meta =
-    let binutils_ = if binutils != null then binutils else {}; in
-    (if binutils_ ? meta then removeAttrs binutils.meta ["priority"] else {}) //
-    { description =
-        stdenv.lib.attrByPath ["meta" "description"] "System binary utilities" binutils_
-        + " (wrapper script)";
-  } // optionalAttrs useMacosReexportHack {
-    platforms = stdenv.lib.platforms.darwin;
-  };
-}
diff --git a/pkgs/build-support/binutils-wrapper/setup-hook.sh b/pkgs/build-support/binutils-wrapper/setup-hook.sh
deleted file mode 100644
index 3395ddd33919..000000000000
--- a/pkgs/build-support/binutils-wrapper/setup-hook.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-# Binutils Wrapper hygiene
-#
-# See comments in cc-wrapper's setup hook. This works exactly the same way.
-
-binutilsWrapper_addLDVars () {
-    case $depOffset in
-        -1) local role='BUILD_' ;;
-        0)  local role='' ;;
-        1)  local role='TARGET_' ;;
-        *)  echo "binutils-wrapper: Error: Cannot be used with $depOffset-offset deps, " >2;
-            return 1 ;;
-    esac
-
-    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
-        export NIX_${role}LDFLAGS+=" -L$1/lib64"
-    fi
-
-    if [[ -d "$1/lib" ]]; then
-        export NIX_${role}LDFLAGS+=" -L$1/lib"
-    fi
-}
-
-if [ -n "${crossConfig:-}" ]; then
-    export NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_BUILD=1
-    role="BUILD_"
-else
-    export NIX_BINUTILS_WRAPPER_@infixSalt@_TARGET_HOST=1
-    role=""
-fi
-
-envHooks+=(binutilsWrapper_addLDVars)
-
-# shellcheck disable=SC2157
-if [ -n "@binutils_bin@" ]; then
-    addToSearchPath _PATH @binutils_bin@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@libc_bin@" ]; then
-    addToSearchPath _PATH @libc_bin@/bin
-fi
-
-# shellcheck disable=SC2157
-if [ -n "@coreutils_bin@" ]; then
-    addToSearchPath _PATH @coreutils_bin@/bin
-fi
-
-# Export tool environment variables so various build systems use the right ones.
-
-export NIX_${role}BINUTILS=@out@
-
-for CMD in \
-    ar as nm objcopy ranlib strip strings size ld windres
-do
-    if
-        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
-    then
-        export "${role}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
-    fi
-done
-
-# No local scope in sourced file
-unset role
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index fb6e38302a5d..39633fce69a8 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -4,14 +4,19 @@
 # that case, it is cheaper/better to not repeat this step and let the forked
 # wrapped binary just inherit the work of the forker's wrapper script.
 
-var_templates_list=(
+var_templates=(
     NIX+CFLAGS_COMPILE
     NIX+CFLAGS_LINK
     NIX+CXXSTDLIB_COMPILE
     NIX+CXXSTDLIB_LINK
     NIX+GNATFLAGS_COMPILE
-)
-var_templates_bool=(
+    NIX+IGNORE_LD_THROUGH_GCC
+    NIX+LDFLAGS
+    NIX+LDFLAGS_BEFORE
+    NIX+LDFLAGS_AFTER
+
+    NIX+SET_BUILD_ID
+    NIX+DONT_SET_RPATH
     NIX+ENFORCE_NO_NATIVE
 )
 
@@ -30,11 +35,17 @@ fi
 
 # We need to mangle names for hygiene, but also take parameters/overrides
 # from the environment.
-for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" "${role_infixes[@]}"
-done
-for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" "${role_infixes[@]}"
+for var in "${var_templates[@]}"; do
+    outputVar="${var/+/_@infixSalt@_}"
+    export ${outputVar}+=''
+    # For each role we serve, we accumulate the input parameters into our own
+    # cc-wrapper-derivation-specific environment variables.
+    for infix in "${role_infixes[@]}"; do
+        inputVar="${var/+/${infix}}"
+        if [ -v "$inputVar" ]; then
+            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
+        fi
+    done
 done
 
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
@@ -55,13 +66,17 @@ if [ -e @out@/nix-support/gnat-cflags ]; then
     NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
 fi
 
+if [ -e @out@/nix-support/libc-ldflags ]; then
+    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
+fi
+
 if [ -e @out@/nix-support/cc-ldflags ]; then
-    # We don't import this above, but just tack this on know. binutils-wrapper's
-    # add-flags will not clobber it.
-    #
-    # TODO(@Ericson2314): Consider `NIX_@infixSalt@_CFLAGS_LINK` instead
     NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi
 
+if [ -e @out@/nix-support/libc-ldflags-before ]; then
+    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
+fi
+
 # That way forked processes will not extend these environment variables again.
 export NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET=1
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 3983e866ee1f..34358e04194a 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -6,6 +6,7 @@ if [[ -v hardeningEnable[@] ]]; then
   hardeningFlags+=(${hardeningEnable[@]})
 fi
 hardeningCFlags=()
+hardeningLDFlags=()
 
 declare -A hardeningDisableMap
 
@@ -43,6 +44,7 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
             if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
             hardeningCFlags+=('-pie')
+            hardeningLDFlags+=('-pie')
           fi
           ;;
         pic)
@@ -57,6 +59,14 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling format >&2; fi
           hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
           ;;
+        relro)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
+          hardeningLDFlags+=('-z' 'relro')
+          ;;
+        bindnow)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
+          hardeningLDFlags+=('-z' 'now')
+          ;;
         *)
           # Ignore unsupported. Checked in Nix that at least *some*
           # tool supports each flag.
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 524e53098476..aacaf196f313 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -11,18 +11,12 @@ if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
     PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
 fi
 
-source @out@/nix-support/utils.sh
-
-# Flirting with a layer violation here.
-if [ -z "${NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
-    source @binutils@/nix-support/add-flags.sh
-fi
-
-# Put this one second so libc ldflags take priority.
 if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
+source @out@/nix-support/utils.sh
+
 
 # Parse command line options and set several variables.
 # For instance, figure out if linker flags should be passed.
@@ -63,6 +57,10 @@ while (( "$n" < "$nParams" )); do
         cppInclude=0
     elif [ "${p:0:1}" != - ]; then
         nonFlagArgs=1
+    elif [ "$p" = -m32 ]; then
+        if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
+            NIX_@infixSalt@_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
+        fi
     fi
     n+=1
 done
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 30520290086c..0114170b8ebc 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -6,20 +6,23 @@
 # compiler and the linker just "work".
 
 { name ? "", stdenv, nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
-, cc ? null, libc ? null, binutils, coreutils ? null, shell ? stdenv.shell
+, cc ? null, libc ? null, binutils ? null, coreutils ? null, shell ? stdenv.shell
 , zlib ? null, extraPackages ? [], extraBuildCommands ? ""
 , isGNU ? false, isClang ? cc.isClang or false, gnugrep ? null
 , buildPackages ? {}
+, useMacosReexportHack ? false
 }:
 
 with stdenv.lib;
 
 assert nativeTools -> nativePrefix != "";
 assert !nativeTools ->
-  cc != null && coreutils != null && gnugrep != null;
+  cc != null && binutils != null && coreutils != null && gnugrep != null;
 assert !(nativeLibc && noLibc);
 assert (noLibc || nativeLibc) == (libc == null);
 
+assert stdenv.targetPlatform != stdenv.hostPlatform -> runCommand != null;
+
 # For ghdl (the vhdl language provider to gcc) we need zlib in the wrapper.
 assert cc.langVhdl or false -> zlib != null;
 
@@ -40,6 +43,7 @@ let
   libc_dev = if libc == null then null else getDev libc;
   libc_lib = if libc == null then null else getLib libc;
   cc_solib = getLib cc;
+  binutils_bin = if nativeTools then "" else getBin binutils;
   # The wrapper scripts use 'cat' and 'grep', so we may need coreutils.
   coreutils_bin = if nativeTools then "" else getBin coreutils;
 
@@ -55,6 +59,21 @@ let
   # unstable implementation detail, however.
   infixSalt = dashlessTarget;
 
+  # The dynamic linker has different names on different platforms. This is a
+  # shell glob that ought to match it.
+  dynamicLinker =
+    /**/ if libc == null then null
+    else if targetPlatform.system == "i686-linux"     then "${libc_lib}/lib/ld-linux.so.2"
+    else if targetPlatform.system == "x86_64-linux"   then "${libc_lib}/lib/ld-linux-x86-64.so.2"
+    # ARM with a wildcard, which can be "" or "-armhf".
+    else if targetPlatform.isArm                      then "${libc_lib}/lib/ld-linux*.so.3"
+    else if targetPlatform.system == "aarch64-linux"  then "${libc_lib}/lib/ld-linux-aarch64.so.1"
+    else if targetPlatform.system == "powerpc-linux"  then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "mips64el-linux" then "${libc_lib}/lib/ld.so.1"
+    else if targetPlatform.system == "x86_64-darwin"  then "/usr/lib/dyld"
+    else if stdenv.lib.hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
+    else null;
+
   expand-response-params =
     if buildPackages.stdenv.cc or null != null && buildPackages.stdenv.cc != "/dev/null"
     then import ../expand-response-params { inherit (buildPackages) stdenv; }
@@ -69,7 +88,7 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  inherit cc shell libc_bin libc_dev libc_lib binutils coreutils_bin;
+  inherit cc shell libc_bin libc_dev libc_lib binutils_bin coreutils_bin;
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
   binPrefix = prefix;
@@ -83,11 +102,13 @@ stdenv.mkDerivation {
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
-      (mapc
-        (lambda (arg)
-          (when (file-directory-p (concat arg "/include"))
-            (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include"))))
-        '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
+      (mapc (lambda (arg)
+        (when (file-directory-p (concat arg "/include"))
+          (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include")))
+        (when (file-directory-p (concat arg "/lib"))
+          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
+        (when (file-directory-p (concat arg "/lib64"))
+          (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64")))) '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
   };
 
@@ -117,18 +138,45 @@ stdenv.mkDerivation {
       echo ${if targetPlatform.isDarwin then cc else nativePrefix} > $out/nix-support/orig-cc
 
       ccPath="${if targetPlatform.isDarwin then cc else nativePrefix}/bin"
+      ldPath="${nativePrefix}/bin"
     '' else ''
       echo $cc > $out/nix-support/orig-cc
 
       ccPath="${cc}/bin"
+      ldPath="${binutils_bin}/bin"
+    ''
+
+    + optionalString (targetPlatform.isSunOS && nativePrefix != "") ''
+      # Solaris needs an additional ld wrapper.
+      ldPath="${nativePrefix}/bin"
+      exec="$ldPath/${prefix}ld"
+      wrap ld-solaris ${./ld-solaris-wrapper.sh}
     '')
 
     + ''
-      # Create symlinks to everything in the binutils wrapper.
-      for bbin in $binutils/bin/*; do
-        mkdir -p "$out/bin"
-        ln -s "$bbin" "$out/bin/$(basename $bbin)"
-      done
+      # Create a symlink to as (the assembler).  This is useful when a
+      # cc-wrapper is installed in a user environment, as it ensures that
+      # the right assembler is called.
+      if [ -e $ldPath/${prefix}as ]; then
+        ln -s $ldPath/${prefix}as $out/bin/${prefix}as
+      fi
+
+    '' + (if !useMacosReexportHack then ''
+      wrap ${prefix}ld ${./ld-wrapper.sh} ''${ld:-$ldPath/${prefix}ld}
+    '' else ''
+      ldInner="${prefix}ld-reexport-delegate"
+      wrap "$ldInner" ${./macos-sierra-reexport-hack.bash} ''${ld:-$ldPath/${prefix}ld}
+      wrap "${prefix}ld" ${./ld-wrapper.sh} "$out/bin/$ldInner"
+      unset ldInner
+    '') + ''
+
+      if [ -e ${binutils_bin}/bin/${prefix}ld.gold ]; then
+        wrap ${prefix}ld.gold ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.gold
+      fi
+
+      if [ -e ${binutils_bin}/bin/ld.bfd ]; then
+        wrap ${prefix}ld.bfd ${./ld-wrapper.sh} ${binutils_bin}/bin/${prefix}ld.bfd
+      fi
 
       # We export environment variables pointing to the wrapped nonstandard
       # cmds, lest some lousy configure script use those to guess compiler
@@ -188,7 +236,7 @@ stdenv.mkDerivation {
       ln -s $ccPath/${prefix}ghdl $out/bin/${prefix}ghdl
     '';
 
-  propagatedBuildInputs = [ binutils ] ++ extraPackages;
+  propagatedBuildInputs = extraPackages;
 
   setupHook = ./setup-hook.sh;
 
@@ -197,7 +245,7 @@ stdenv.mkDerivation {
       set -u
     ''
 
-    + optionalString (libc != null) ''
+    + optionalString (libc != null) (''
       ##
       ## General libc support
       ##
@@ -215,9 +263,48 @@ stdenv.mkDerivation {
       # another -idirafter is necessary to add that directory again.
       echo "-B${libc_lib}/lib/ -idirafter ${libc_dev}/include -idirafter ${cc}/lib/gcc/*/*/include-fixed" > $out/nix-support/libc-cflags
 
+      echo "-L${libc_lib}/lib" > $out/nix-support/libc-ldflags
+
       echo "${libc_lib}" > $out/nix-support/orig-libc
       echo "${libc_dev}" > $out/nix-support/orig-libc-dev
-    ''
+
+      ##
+      ## Dynamic linker support
+      ##
+
+      if [[ -z ''${dynamicLinker+x} ]]; then
+        echo "Don't know the name of the dynamic linker for platform '${targetPlatform.config}', so guessing instead." >&2
+        local dynamicLinker="${libc_lib}/lib/ld*.so.?"
+      fi
+
+      # Expand globs to fill array of options
+      dynamicLinker=($dynamicLinker)
+
+      case ''${#dynamicLinker[@]} in
+        0) echo "No dynamic linker found for platform '${targetPlatform.config}'." >&2;;
+        1) echo "Using dynamic linker: '$dynamicLinker'" >&2;;
+        *) echo "Multiple dynamic linkers found for platform '${targetPlatform.config}'." >&2;;
+      esac
+
+      if [ -n "$dynamicLinker" ]; then
+        echo $dynamicLinker > $out/nix-support/dynamic-linker
+
+    '' + (if targetPlatform.isDarwin then ''
+        printf "export LD_DYLD_PATH=%q\n" "$dynamicLinker" >> $out/nix-support/setup-hook
+    '' else ''
+        if [ -e ${libc_lib}/lib/32/ld-linux.so.2 ]; then
+          echo ${libc_lib}/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
+        fi
+
+        local ldflagsBefore=(-dynamic-linker "$dynamicLinker")
+    '') + ''
+      fi
+
+      # The dynamic linker is passed in `ldflagsBefore' to allow
+      # explicit overrides of the dynamic linker by callers to gcc/ld
+      # (the *last* value counts, so ours should come first).
+      printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
+    '')
 
     + optionalString (!nativeTools) ''
 
@@ -258,6 +345,7 @@ stdenv.mkDerivation {
       # Propagate the wrapped cc so that if you install the wrapper,
       # you get tools like gcov, the manpages, etc. as well (including
       # for binutils and Glibc).
+      printWords ${cc} ${binutils_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
       printWords ${cc.man or ""}  > $man/nix-support/propagated-user-env-packages
     ''
 
@@ -267,7 +355,14 @@ stdenv.mkDerivation {
       ## Hardening support
       ##
 
+      # some linkers on some platforms don't support specific -z flags
       export hardening_unsupported_flags=""
+      if [[ "$($ldPath/${prefix}ld -z now 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
+        hardening_unsupported_flags+=" bindnow"
+      fi
+      if [[ "$($ldPath/${prefix}ld -z relro 2>&1 || true)" =~ un(recognized|known)\ option ]]; then
+        hardening_unsupported_flags+=" relro"
+      fi
     ''
 
     + optionalString hostPlatform.isCygwin ''
@@ -286,7 +381,7 @@ stdenv.mkDerivation {
     ''
     + extraBuildCommands;
 
-  inherit expand-response-params;
+  inherit dynamicLinker expand-response-params;
 
   # for substitution in utils.sh
   expandResponseParams = "${expand-response-params}/bin/expand-response-params";
@@ -301,5 +396,7 @@ stdenv.mkDerivation {
     { description =
         stdenv.lib.attrByPath ["meta" "description"] "System C compiler" cc_
         + " (wrapper script)";
+  } // optionalAttrs useMacosReexportHack {
+    platforms = stdenv.lib.platforms.darwin;
   };
 }
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index 63e5d99d5017..f0c922a3d5b4 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -13,12 +13,12 @@ if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
-source @out@/nix-support/utils.sh
-
 if [ -z "${NIX_@infixSalt@_GNAT_WRAPPER_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
+source @out@/nix-support/utils.sh
+
 
 # Figure out if linker flags should be passed.  GCC prints annoying
 # warnings when they are not needed.
diff --git a/pkgs/build-support/binutils-wrapper/ld-solaris-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
old mode 100644
new mode 100755
similarity index 100%
rename from pkgs/build-support/binutils-wrapper/ld-solaris-wrapper.sh
rename to pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
diff --git a/pkgs/build-support/binutils-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
similarity index 92%
rename from pkgs/build-support/binutils-wrapper/ld-wrapper.sh
rename to pkgs/build-support/cc-wrapper/ld-wrapper.sh
index dd30c4d55ef7..a9cc1e3f9e6f 100644
--- a/pkgs/build-support/binutils-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -10,12 +10,12 @@ if [ -n "@coreutils_bin@" ]; then
     PATH="@coreutils_bin@/bin"
 fi
 
-source @out@/nix-support/utils.sh
-
-if [ -z "${NIX_BINUTILS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
+source @out@/nix-support/utils.sh
+
 
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
@@ -63,21 +63,6 @@ fi
 
 extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER)
 
-# Choose 32-bit dynamic linker if needed
-if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-    prev=
-    for p in ${params+"${params[@]}"}; do
-        if [[ "$prev" = "-m" && "$p" = "elf_i386" ]]; then
-           extraAfter+=(
-               '-dynamic-linker'
-               "$(< @out@/nix-support/dynamic-linker-m32)"
-           )
-           break
-        fi
-        prev="$p"
-    done
-fi
-
 declare -a libDirs
 declare -A libs
 relocatable=
diff --git a/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash b/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
new file mode 100644
index 000000000000..b7aa7ea5c092
--- /dev/null
+++ b/pkgs/build-support/cc-wrapper/macos-sierra-reexport-hack.bash
@@ -0,0 +1,106 @@
+#! @shell@
+
+set -eu -o pipefail
+
+path_backup="$PATH"
+if [ -n "@coreutils_bin@" ]; then
+  PATH="@coreutils_bin@/bin"
+fi
+
+declare -r recurThreshold=300
+
+declare overflowCount=0
+for ((n=0; n < $#; ++n)); do
+    case "${!n}" in
+        -l*) let overflowCount+=1 ;;
+        -reexport-l*) let overflowCount+=1 ;;
+        *) ;;
+    esac
+done
+
+declare -a allArgs=()
+
+if (( "$overflowCount" <= "$recurThreshold" )); then
+    allArgs=("$@")
+else
+    declare -a childrenLookup=() childrenLink=()
+
+    while (( $# )); do
+        case "$1" in
+            -L/*)
+                childrenLookup+=("$1")
+                allArgs+=("$1")
+                ;;
+            -L)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -l)
+                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+                exit 1
+                ;;
+            -lazy_library | -lazy_framework | -lto_library)
+                # We aren't linking any "azy_library", "to_library", etc.
+                allArgs+=("$1")
+                ;;
+            -lazy-l | -weak-l)    allArgs+=("$1") ;;
+                # We can't so easily prevent header issues from these.
+            -lSystem)             allArgs+=("$1") ;;
+                # Special case as indirection seems like a bad idea for something
+                # so fundamental. Can be removed for simplicity.
+            -l?* | -reexport-l?*) childrenLink+=("$1") ;;
+            *)                    allArgs+=("$1") ;;
+        esac
+
+        shift
+    done
+
+    declare n=0
+    while (( $n < "${#childrenLink[@]}" )); do
+        if [[ "${childrenLink[n]}" = -l* ]]; then
+            childrenLink[n]="-reexport${childrenLink[n]}"
+        fi
+        let ++n
+    done
+    unset n
+
+    declare -r outputNameLibless=$(basename $( \
+        if [[ -z "${outputName:+isUndefined}" ]]; then
+            echo unnamed
+        elif [[ "${outputName:0:3}" = lib ]]; then
+            echo "${outputName:3}"
+        else
+            echo "${outputName}"
+        fi))
+    declare -ra children=("$outputNameLibless-reexport-delegate-0" \
+                          "$outputNameLibless-reexport-delegate-1")
+
+    mkdir -p "$out/lib"
+
+    PATH="$PATH:@out@/bin"
+
+    symbolBloatObject=$outputNameLibless-symbol-hack.o
+    if [[ ! -e $symbolBloatObject ]]; then
+        printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
+            | @binPrefix@as -- -o $symbolBloatObject
+    fi
+
+    # first half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[0]}.dylib" \
+      -install_name "$out/lib/lib${children[0]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
+
+    # second half of libs
+    @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+      -o "$out/lib/lib${children[1]}.dylib" \
+      -install_name "$out/lib/lib${children[1]}.dylib" \
+      "${childrenLookup[@]}" "$symbolBloatObject" \
+      "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
+
+    allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
+fi
+
+PATH="$path_backup"
+exec @prog@ "${allArgs[@]}"
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 9273f50c6670..e43c1609edb1 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -74,6 +74,14 @@ ccWrapper_addCVars () {
         export NIX_${role}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
     fi
 
+    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
+        export NIX_${role}LDFLAGS+=" -L$1/lib64"
+    fi
+
+    if [[ -d "$1/lib" ]]; then
+        export NIX_${role}LDFLAGS+=" -L$1/lib"
+    fi
+
     if [[ -d "$1/Library/Frameworks" ]]; then
         export NIX_${role}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
     fi
@@ -108,6 +116,11 @@ if [ -n "@cc@" ]; then
     addToSearchPath _PATH @cc@/bin
 fi
 
+# shellcheck disable=SC2157
+if [ -n "@binutils_bin@" ]; then
+    addToSearchPath _PATH @binutils_bin@/bin
+fi
+
 # shellcheck disable=SC2157
 if [ -n "@libc_bin@" ]; then
     addToSearchPath _PATH @libc_bin@/bin
@@ -125,5 +138,15 @@ export NIX_${role}CC=@out@
 export ${role}CC=@named_cc@
 export ${role}CXX=@named_cxx@
 
+for CMD in \
+    ar as nm objcopy ranlib strip strings size ld windres
+do
+    if
+        PATH=$_PATH type -p "@binPrefix@$CMD" > /dev/null
+    then
+        export "${role}$(echo "$CMD" | tr "[:lower:]" "[:upper:]")=@binPrefix@${CMD}";
+    fi
+done
+
 # No local scope in sourced file
 unset role
diff --git a/pkgs/build-support/cc-wrapper/utils.sh b/pkgs/build-support/cc-wrapper/utils.sh
index a9ab2b23f24d..c84a094e26b0 100644
--- a/pkgs/build-support/cc-wrapper/utils.sh
+++ b/pkgs/build-support/cc-wrapper/utils.sh
@@ -1,35 +1,3 @@
-mangleVarList() {
-    local var="$1"
-    shift
-    local -a role_infixes=("$@")
-
-    local outputVar="${var/+/_@infixSalt@_}"
-    declare -gx ${outputVar}+=''
-    # For each role we serve, we accumulate the input parameters into our own
-    # cc-wrapper-derivation-specific environment variables.
-    for infix in "${role_infixes[@]}"; do
-        local inputVar="${var/+/${infix}}"
-        if [ -v "$inputVar" ]; then
-            export ${outputVar}+="${!outputVar:+ }${!inputVar}"
-        fi
-    done
-}
-
-mangleVarBool() {
-    local var="$1"
-    shift
-    local -a role_infixes=("$@")
-
-    local outputVar="${var/+/_@infixSalt@_}"
-    declare -gxi ${outputVar}+=''
-    for infix in "${role_infixes[@]}"; do
-        local inputVar="${var/+/${infix}}"
-        if [ -v "$inputVar" ]; then
-            let "${outputVar} |= ${!inputVar}"
-        fi
-    done
-}
-
 skip () {
     if [ -n "${NIX_DEBUG:-}" ]; then
         echo "skipping impure path $1" >&2
diff --git a/pkgs/desktops/maxx/default.nix b/pkgs/desktops/maxx/default.nix
index 5797d6566a81..891d644071c1 100644
--- a/pkgs/desktops/maxx/default.nix
+++ b/pkgs/desktops/maxx/default.nix
@@ -59,7 +59,7 @@ in stdenv.mkDerivation {
 
     while IFS= read -r -d ''$'\0' i; do
       if isELF "$i"; then
-        bin=`patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$i"; echo $?`
+        bin=`patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$i"; echo $?`
         patchelf --set-rpath "${stdenv.lib.makeLibraryPath deps}" "$i"
         if [ "$bin" -eq 0 ]; then
           wrapProgram "$i" \
diff --git a/pkgs/development/arduino/arduino-core/default.nix b/pkgs/development/arduino/arduino-core/default.nix
index 79f65c181141..fdb9d1be6ad2 100644
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@@ -135,7 +135,7 @@ stdenv.mkDerivation rec {
       cp ${teensyduino_src} ./TeensyduinoInstall.${teensy_architecture}
       chmod +w ./TeensyduinoInstall.${teensy_architecture}
       upx -d ./TeensyduinoInstall.${teensy_architecture}
-      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           --set-rpath "${teensy_libpath}" \
           ./TeensyduinoInstall.${teensy_architecture}
       chmod +x ./TeensyduinoInstall.${teensy_architecture}
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$file" || true
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
         patchelf --set-rpath ${rpath}:$out/lib $file || true
     done
 
@@ -203,7 +203,7 @@ stdenv.mkDerivation rec {
     ${stdenv.lib.optionalString withTeensyduino ''
       # Patch the Teensy loader binary
       patchelf --debug \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           --set-rpath "${teensy_libpath}" \
           $out/share/arduino/hardware/tools/teensy
     ''}
diff --git a/pkgs/development/compilers/cmucl/binary.nix b/pkgs/development/compilers/cmucl/binary.nix
index 4086e8d4dd60..2833c5378c1d 100644
--- a/pkgs/development/compilers/cmucl/binary.nix
+++ b/pkgs/development/compilers/cmucl/binary.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out
     tar -C $out -xjf ${dist}
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/lisp
   '';
 
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index b17363516fd4..62a504ef9668 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
         --suffix DYLD_LIBRARY_PATH : $libPath
   ''
   else ''
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       crystal-${version}-1/embedded/bin/crystal
     patchelf --set-rpath ${ stdenv.lib.makeLibraryPath [ stdenv.cc.cc ] } \
       crystal-${version}-1/embedded/bin/crystal
diff --git a/pkgs/development/compilers/cudatoolkit/default.nix b/pkgs/development/compilers/cudatoolkit/default.nix
index f65fd4711ae2..0b219b804471 100644
--- a/pkgs/development/compilers/cudatoolkit/default.nix
+++ b/pkgs/development/compilers/cudatoolkit/default.nix
@@ -49,7 +49,7 @@ let
           echo "patching $i..."
           if [[ ! $i =~ \.so ]]; then
             patchelf \
-              --set-interpreter "''$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $i
+              --set-interpreter "''$(cat $NIX_CC/nix-support/dynamic-linker)" $i
           fi
           rpath2=$rpath:$lib/lib:$out/jre/lib/amd64/jli:$out/lib:$out/lib64:$out/nvvm/lib:$out/nvvm/lib64
           patchelf --set-rpath $rpath2 --force-rpath $i
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 443f674cf1d8..ee56425f00b4 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -25,7 +25,7 @@ if test "$noSysDirs" = "1"; then
         # Figure out what extra flags to pass to the gcc compilers
         # being generated to make sure that they use our glibc.
         extraFlags="$(cat $NIX_CC/nix-support/libc-cflags)"
-        extraLDFlags="$(cat $NIX_BINUTILS/nix-support/libc-ldflags) $(cat $NIX_BINUTILS/nix-support/libc-ldflags-before || true)"
+        extraLDFlags="$(cat $NIX_CC/nix-support/libc-ldflags) $(cat $NIX_CC/nix-support/libc-ldflags-before || true)"
 
         # Use *real* header files, otherwise a limits.h is generated
         # that does not include Glibc's limits.h (notably missing
diff --git a/pkgs/development/compilers/ghc/6.10.2-binary.nix b/pkgs/development/compilers/ghc/6.10.2-binary.nix
index 5d03573dbab4..60749a29b58b 100644
--- a/pkgs/development/compilers/ghc/6.10.2-binary.nix
+++ b/pkgs/development/compilers/ghc/6.10.2-binary.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     # find editline/gmp.
     (if stdenv.isLinux then ''
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "${lib.makeLibraryPath [ libedit ncurses5 gmp ]}" {} \;
       for prog in ld ar gcc strip ranlib; do
         find . -name "setup-config" -exec sed -i "s@/usr/bin/$prog@$(type -p $prog)@g" {} \;
diff --git a/pkgs/development/compilers/ghc/7.0.4-binary.nix b/pkgs/development/compilers/ghc/7.0.4-binary.nix
index 10aa63ed4e35..6140cde4a9ef 100644
--- a/pkgs/development/compilers/ghc/7.0.4-binary.nix
+++ b/pkgs/development/compilers/ghc/7.0.4-binary.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     # find editline/gmp.
     stdenv.lib.optionalString stdenv.isLinux ''
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "${stdenv.lib.makeLibraryPath [ ncurses5 gmp ]}" {} \;
       sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
       sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
diff --git a/pkgs/development/compilers/ghc/7.4.2-binary.nix b/pkgs/development/compilers/ghc/7.4.2-binary.nix
index 43775a343c11..100bb87768b5 100644
--- a/pkgs/development/compilers/ghc/7.4.2-binary.nix
+++ b/pkgs/development/compilers/ghc/7.4.2-binary.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
       mkdir -p "$out/lib"
       ln -sv "${ncurses5.out}/lib/libncurses.so" "$out/lib/libncurses${stdenv.lib.optionalString stdenv.is64bit "w"}.so.5"
       find . -type f -perm -0100 \
-          -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+          -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath "${stdenv.lib.makeLibraryPath [ "$out" gmp ]}" {} \;
 
       paxmark m ./ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
diff --git a/pkgs/development/compilers/gnatboot/default.nix b/pkgs/development/compilers/gnatboot/default.nix
index 1cb2d3904315..a209e392bc6f 100644
--- a/pkgs/development/compilers/gnatboot/default.nix
+++ b/pkgs/development/compilers/gnatboot/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     cp -R * $out
     set +e
     for a in $out/bin/* ; do
-      patchelf --interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
         --set-rpath $(cat $NIX_CC/nix-support/orig-libc)/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib64:$(cat $NIX_CC/nix-support/orig-cc)/lib $a
     done
     set -e
diff --git a/pkgs/development/compilers/llvm/3.4/llvm.nix b/pkgs/development/compilers/llvm/3.4/llvm.nix
index 2080aa64149b..79b0c9ff898d 100644
--- a/pkgs/development/compilers/llvm/3.4/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.4/llvm.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_REQUIRES_RTTI=1"
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev or binutils.binutils}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev or binutils}/include"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
   ] ++ stdenv.lib.optional (!stdenv.isDarwin) "-DBUILD_SHARED_LIBS=ON";
 
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
index b88cd232415e..c5503da9b838 100644
--- a/pkgs/development/compilers/llvm/3.5/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries
     "-DBUILD_SHARED_LIBS=ON"
     ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DCMAKE_CXX_FLAGS=-stdlib=libc++"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index ce35a71272bb..81aaa7cd65c2 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries
     "-DBUILD_SHARED_LIBS=ON"
     ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index ce366cb4973f..a3f652d783be 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
     ++ stdenv.lib.optionals ( isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 98d5a0edffe6..654e1ce0023b 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -106,7 +106,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
   ] ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
     ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index c116164f5031..4978570334ea 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -90,7 +90,7 @@ in stdenv.mkDerivation rec {
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
   ]
   ++ stdenv.lib.optional (!isDarwin)
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
   ++ stdenv.lib.optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
diff --git a/pkgs/development/compilers/mentor/default.nix b/pkgs/development/compilers/mentor/default.nix
index 2922cef7e7a1..74905c6ffae4 100644
--- a/pkgs/development/compilers/mentor/default.nix
+++ b/pkgs/development/compilers/mentor/default.nix
@@ -18,7 +18,7 @@ let
         tar --strip-components=1 -xjf "$src" -C "$out"
 
         # Patch binaries
-        interpreter="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
+        interpreter="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
         for file in "$out"/bin/* "$out"/libexec/gcc/*/*/* "$out"/*/bin/*; do
             # Skip non-executable files
             case "$file" in
diff --git a/pkgs/development/compilers/mono/llvm.nix b/pkgs/development/compilers/mono/llvm.nix
index 70eac4e83b3e..1036e43ea941 100644
--- a/pkgs/development/compilers/mono/llvm.nix
+++ b/pkgs/development/compilers/mono/llvm.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = with stdenv; [
     "-DLLVM_ENABLE_FFI=ON"
-    "-DLLVM_BINUTILS_INCDIR=${binutils.binutils.dev}/include"
+    "-DLLVM_BINUTILS_INCDIR=${binutils.dev}/include"
     "-DCMAKE_CXX_FLAGS=-std=c++11"
   ] ++ stdenv.lib.optional (!isDarwin) "-DBUILD_SHARED_LIBS=ON";
 
diff --git a/pkgs/development/compilers/mozart/binary.nix b/pkgs/development/compilers/mozart/binary.nix
index 4857af087570..ebe562fcde32 100644
--- a/pkgs/development/compilers/mozart/binary.nix
+++ b/pkgs/development/compilers/mozart/binary.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     tar xvf $src -C $out --strip-components=1
 
     for exe in $out/bin/{ozemulator,ozwish} ; do
-      patchelf --set-interpreter $(< $NIX_BINUTILS/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(< $NIX_CC/nix-support/dynamic-linker) \
                --set-rpath $libPath \
                $exe
     done
diff --git a/pkgs/development/compilers/opendylan/bin.nix b/pkgs/development/compilers/opendylan/bin.nix
index 009f36f57f5d..8382be7a2091 100644
--- a/pkgs/development/compilers/opendylan/bin.nix
+++ b/pkgs/development/compilers/opendylan/bin.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     mkdir -p "$out"
     tar --strip-components=1 -xjf "$src" -C "$out"
 
-    interpreter="$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")"
+    interpreter="$(cat "$NIX_CC"/nix-support/dynamic-linker)"
     for a in "$out"/bin/*; do 
       patchelf --set-interpreter "$interpreter" "$a"
       patchelf --set-rpath "$out/lib:${boehmgc.out}/lib" "$a"
diff --git a/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh b/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
index 2cee0adc7d03..459bfce50988 100644
--- a/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
+++ b/pkgs/development/compilers/oraclejdk/dlj-bundle-builder.sh
@@ -5,7 +5,7 @@ unzip ${src} || true
 
 # set the dynamic linker of unpack200, necessary for construct script
 echo "patching unpack200"
-patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "" */bin/unpack200
+patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "" */bin/unpack200
 
 echo "constructing JDK and JRE installations"
 if test -z "$installjdk"; then
@@ -46,7 +46,7 @@ rpath=$rpath${rpath:+:}$jrePath/lib/$architecture/jli
 
 # set all the dynamic linkers
 find $out -type f -perm -0100 \
-    -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
     --set-rpath "$rpath" {} \;
 
 find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index ca954f53ab1a..2a00cf5f2d29 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -179,7 +179,7 @@ let result = stdenv.mkDerivation rec {
 
     # set all the dynamic linkers
     find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "$rpath" {} \;
 
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/compilers/rust/binaryBuild.nix b/pkgs/development/compilers/rust/binaryBuild.nix
index cd20fb4afdee..37b06555bdbd 100644
--- a/pkgs/development/compilers/rust/binaryBuild.nix
+++ b/pkgs/development/compilers/rust/binaryBuild.nix
@@ -42,17 +42,17 @@ rec {
 
       ${optionalString (needsPatchelf && bootstrapping) ''
         patchelf \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustdoc"
         patchelf \
           --set-rpath "${stdenv.lib.makeLibraryPath [ curl zlib ]}" \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}
 
       ${optionalString needsPatchelf ''
         patchelf \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/rustc"
 
       # Do NOT, I repeat, DO NOT use `wrapProgram` on $out/bin/rustc
@@ -88,7 +88,7 @@ rec {
       ${optionalString needsPatchelf ''
         patchelf \
           --set-rpath "${stdenv.lib.makeLibraryPath [ curl zlib ]}" \
-          --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+          --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
           "$out/bin/cargo"
       ''}
 
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index 1cddcd6bc5bd..707f7966dd9b 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = stdenv.lib.optionalString (!stdenv.isArm && stdenv.isLinux) ''
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $out/share/sbcl/sbcl
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $out/share/sbcl/sbcl
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index 89e77769f5a8..094007aa2d0f 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     echo ${version} > VERSION
 
     configureFlagsArray+=("--cc=cc")
-    configureFlagsArray+=("--elfinterp=$(< $NIX_BINUTILS/nix-support/dynamic-linker)")
+    configureFlagsArray+=("--elfinterp=$(< $NIX_CC/nix-support/dynamic-linker)")
     configureFlagsArray+=("--crtprefix=${getLib stdenv.cc.libc}/lib")
     configureFlagsArray+=("--sysincludepaths=${getDev stdenv.cc.libc}/include:{B}/include")
     configureFlagsArray+=("--libpaths=${getLib stdenv.cc.libc}/lib")
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 72ee89dc3504..f7638757ff7a 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
 
     # set all the dynamic linkers
     find $out -type f -perm -0100 \
-        -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "$rpath" {} \;
 
     find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/interpreters/dart/default.nix b/pkgs/development/interpreters/dart/default.nix
index bb800bb62a93..3d19f7ba2911 100644
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/interpreters/dart/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     mkdir -p $out
     cp -R * $out/
     echo $libPath
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
              --set-rpath $libPath \
              $out/bin/dart
   '';
diff --git a/pkgs/development/interpreters/rebol/default.nix b/pkgs/development/interpreters/rebol/default.nix
index 5af1fd62256a..8a13c4efce61 100644
--- a/pkgs/development/interpreters/rebol/default.nix
+++ b/pkgs/development/interpreters/rebol/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     cp ${r3} make/r3-make
     chmod 777 make/r3-make
-    patchelf  --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" ./make/r3-make
+    patchelf  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" ./make/r3-make
     cd make
     perl -pi -e 's#-m32##g' makefile
     perl -pi -e 's#sudo .*#echo#g' makefile
diff --git a/pkgs/development/libraries/libstdc++5/default.nix b/pkgs/development/libraries/libstdc++5/default.nix
index 4f4040ce5ed7..abe0538b8a9c 100644
--- a/pkgs/development/libraries/libstdc++5/default.nix
+++ b/pkgs/development/libraries/libstdc++5/default.nix
@@ -62,10 +62,7 @@ stdenv.mkDerivation rec {
     # being generated to make sure that they use our glibc.
     EXTRA_FLAGS="-I$NIX_FIXINC_DUMMY $(cat $NIX_CC/nix-support/libc-cflags) -O2"
 
-    extraLDFlags="-L$glibc_libdir -rpath $glibc_libdir"
-    extraLDFlags+=" $(cat $NIX_BINUTILS/nix-support/libc-ldflags)"
-    extraLDFlags+=" $(cat $NIX_BINUTILS/nix-support/libc-ldflags-before)"
-
+    extraLDFlags="-L$glibc_libdir -rpath $glibc_libdir $(cat $NIX_CC/nix-support/libc-ldflags) $(cat $NIX_CC/nix-support/libc-ldflags-before)"
     for i in $extraLDFlags; do
       EXTRA_FLAGS="$EXTRA_FLAGS -Wl,$i"
     done
diff --git a/pkgs/development/libraries/oracle-instantclient/default.nix b/pkgs/development/libraries/oracle-instantclient/default.nix
index 9119e4beb4f5..d0085752623d 100644
--- a/pkgs/development/libraries/oracle-instantclient/default.nix
+++ b/pkgs/development/libraries/oracle-instantclient/default.nix
@@ -67,7 +67,7 @@ in stdenv.mkDerivation rec {
     done
 
     for exe in $out/bin/sqlplus; do
-      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
                --force-rpath --set-rpath "$out/lib:${libaio}/lib" \
                $exe
     done
diff --git a/pkgs/development/libraries/wtk/builder.sh b/pkgs/development/libraries/wtk/builder.sh
index ed9c052cf09d..86f2719537cd 100644
--- a/pkgs/development/libraries/wtk/builder.sh
+++ b/pkgs/development/libraries/wtk/builder.sh
@@ -22,6 +22,6 @@ for i in $libraries; do
     rpath=$rpath${rpath:+:}$i/lib
 done
 find $out -type f -perm -0100 \
-    -exec patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" {} \;
+    -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" {} \;
 find $out -type f -perm -0100 \
     -exec patchelf --set-rpath "$rpath" {} \;
diff --git a/pkgs/development/misc/amdapp-sdk/default.nix b/pkgs/development/misc/amdapp-sdk/default.nix
index 5486230541f1..fc2981f7f1f7 100644
--- a/pkgs/development/misc/amdapp-sdk/default.nix
+++ b/pkgs/development/misc/amdapp-sdk/default.nix
@@ -87,7 +87,7 @@ in stdenv.mkDerivation rec {
     }
 
     # Create wrappers
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/bin/clinfo
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/clinfo
     patchelf --set-rpath ${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib $out/bin/clinfo
 
     # Fix modes
diff --git a/pkgs/development/mobile/flashtool/default.nix b/pkgs/development/mobile/flashtool/default.nix
index f9cd6bc3c403..0c1bb5d4d42d 100644
--- a/pkgs/development/mobile/flashtool/default.nix
+++ b/pkgs/development/mobile/flashtool/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     ln -s ${libusb1.out}/lib/libusb-1.0.so.0 ./x10flasher_lib/linux/lib32/libusbx-1.0.so
 
     chmod +x x10flasher_lib/unyaffs.linux.x86 x10flasher_lib/bin2elf x10flasher_lib/bin2sin
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" x10flasher_lib/unyaffs.linux.x86
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" x10flasher_lib/unyaffs.linux.x86
     ln -sf unyaffs.linux.x86 x10flasher_lib/unyaffs.linux
 
     ln -s swt32.jar x10flasher_lib/swtlin/swt.jar
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index c957f4151a07..745111171bb6 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   fixupPhase = ''
     patchInterpreter() {
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         "$out/libexec/genymotion/$1"
     }
 
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 7a4e326ee8a0..74884e6f5a8a 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -31,7 +31,7 @@ let
       fixupPhase
 
       patchelf \
-        --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath "${atomEnv.libPath}:$out/lib/electron" \
         $out/lib/electron/electron
 
diff --git a/pkgs/development/tools/misc/saleae-logic/default.nix b/pkgs/development/tools/misc/saleae-logic/default.nix
index 5a20a2ac1674..86be86cb6d63 100644
--- a/pkgs/development/tools/misc/saleae-logic/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     cp -r * "$out"
 
     # Patch it
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/Logic"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/Logic"
     patchelf --set-rpath "${stdenv.cc.cc.lib}/lib:${stdenv.cc.cc.lib}/lib64:${libPath}:\$ORIGIN/Analyzers:\$ORIGIN" "$out/Logic"
 
     # Build the LD_PRELOAD library that makes Logic work from a read-only directory
diff --git a/pkgs/development/tools/node-webkit/nw11.nix b/pkgs/development/tools/node-webkit/nw11.nix
index 373032686ae1..5028ac9580c5 100644
--- a/pkgs/development/tools/node-webkit/nw11.nix
+++ b/pkgs/development/tools/node-webkit/nw11.nix
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/node-webkit
     cp -R * $out/share/node-webkit
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nw
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nw
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/node-webkit/libudev.so.0
 
diff --git a/pkgs/development/tools/node-webkit/nw12.nix b/pkgs/development/tools/node-webkit/nw12.nix
index 5205d534ab82..8e2953839b71 100644
--- a/pkgs/development/tools/node-webkit/nw12.nix
+++ b/pkgs/development/tools/node-webkit/nw12.nix
@@ -36,8 +36,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/nwjs
     cp -R * $out/share/nwjs
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/nwjs/nw
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/nwjs/nwjc
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/nwjs/nw
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/nwjs/nwjc
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/nwjs/libudev.so.0
 
diff --git a/pkgs/development/tools/node-webkit/nw9.nix b/pkgs/development/tools/node-webkit/nw9.nix
index 803f55f81347..ba5d6c8e3343 100644
--- a/pkgs/development/tools/node-webkit/nw9.nix
+++ b/pkgs/development/tools/node-webkit/nw9.nix
@@ -32,8 +32,8 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/share/node-webkit
     cp -R * $out/share/node-webkit
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nw
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nw
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/share/node-webkit/nwsnapshot
 
     ln -s ${systemd.lib}/lib/libudev.so $out/share/node-webkit/libudev.so.0
 
diff --git a/pkgs/development/tools/phantomjs/default.nix b/pkgs/development/tools/phantomjs/default.nix
index 9daa93ca3bb1..8b6b655b6a56 100644
--- a/pkgs/development/tools/phantomjs/default.nix
+++ b/pkgs/development/tools/phantomjs/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   buildPhase = lib.optionalString (!stdenv.isDarwin) ''
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${stdenv.lib.makeLibraryPath [ freetype fontconfig stdenv.cc.cc stdenv.cc.cc openssl ]}" \
       bin/phantomjs
   '';
diff --git a/pkgs/development/tools/sauce-connect/default.nix b/pkgs/development/tools/sauce-connect/default.nix
index 4f06c3ad63db..3caec9a75c15 100644
--- a/pkgs/development/tools/sauce-connect/default.nix
+++ b/pkgs/development/tools/sauce-connect/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = stdenv.lib.optionalString stdenv.isLinux ''
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "$out/lib:${makeLibraryPath [zlib]}" \
       bin/sc
   '';
diff --git a/pkgs/development/tools/thrust/default.nix b/pkgs/development/tools/thrust/default.nix
index a59c8153cafc..91a01edc23a6 100644
--- a/pkgs/development/tools/thrust/default.nix
+++ b/pkgs/development/tools/thrust/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
     mkdir -p $out/libexec/thrust
     unzip -d $out/libexec/thrust/ $src
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/libexec/thrust/thrust_shell
     wrapProgram $out/libexec/thrust/thrust_shell \
       --prefix "LD_LIBRARY_PATH" : "${thrustEnv}/lib:${thrustEnv}/lib64"
diff --git a/pkgs/development/tools/unity3d/default.nix b/pkgs/development/tools/unity3d/default.nix
index e3d0f7f5845e..c7ba985d0f75 100644
--- a/pkgs/development/tools/unity3d/default.nix
+++ b/pkgs/development/tools/unity3d/default.nix
@@ -99,10 +99,10 @@ in stdenv.mkDerivation rec {
       if [[ "$ftype" =~ LSB\ .*dynamically\ linked ]]; then
         if [[ "$ftype" =~ 32-bit ]]; then
           rpath="${libPath32}"
-          intp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker-m32)"
+          intp="$(cat $NIX_CC/nix-support/dynamic-linker-m32)"
         else
           rpath="${libPath64}"
-          intp="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
+          intp="$(cat $NIX_CC/nix-support/dynamic-linker)"
         fi
 
         oldRpath="$(patchelf --print-rpath "$1")"
diff --git a/pkgs/games/adom/default.nix b/pkgs/games/adom/default.nix
index 77157e962e1a..016c965b6c0b 100644
--- a/pkgs/games/adom/default.nix
+++ b/pkgs/games/adom/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     done
 
     ${patchelf}/bin/patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "$out/lib:${lpath}" \
       $out/adom
 
diff --git a/pkgs/games/andyetitmoves/default.nix b/pkgs/games/andyetitmoves/default.nix
index c9fa3a1d05e6..092f07737084 100644
--- a/pkgs/games/andyetitmoves/default.nix
+++ b/pkgs/games/andyetitmoves/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
     binName=${if commercialVersion then "AndYetItMoves" else "AndYetItMovesDemo"}
 
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath $fullPath $out/opt/andyetitmoves/lib/$binName
     cat > $out/bin/$binName << EOF
     #!/bin/sh
     cd $out/opt/andyetitmoves
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index e8db1de76283..e10d97a047b4 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -82,7 +82,7 @@ let
       cp -a data $out/share/factorio
       cp -a bin/${arch.inTar}/factorio $out/bin/factorio
       patchelf \
-        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
         $out/bin/factorio
     '';
 
diff --git a/pkgs/games/oilrush/default.nix b/pkgs/games/oilrush/default.nix
index b6c4e5f71f97..d637c1595954 100644
--- a/pkgs/games/oilrush/default.nix
+++ b/pkgs/games/oilrush/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     cd bin
     for f in launcher_$arch libQtCoreUnigine_$arch.so.4 OilRush_$arch
     do
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $f
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $f
     done
     patchelf --set-rpath ${stdenv.cc.cc.lib}/lib64:${makeLibraryPath [ stdenv.cc.cc libX11 libXext libXrender fontconfig freetype ]}\
              launcher_$arch
diff --git a/pkgs/games/openarena/default.nix b/pkgs/games/openarena/default.nix
index 41feab11f2a3..1e396318bbbd 100644
--- a/pkgs/games/openarena/default.nix
+++ b/pkgs/games/openarena/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   installPhase = let
     gameDir = "$out/openarena-$version";
-    interpreter = "$(< \"$NIX_BINUTILS/nix-support/dynamic-linker\")";
+    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
     libPath = stdenv.lib.makeLibraryPath [ SDL libogg libvorbis ];
   in ''
     mkdir -pv $out/bin
diff --git a/pkgs/games/planetaryannihilation/default.nix b/pkgs/games/planetaryannihilation/default.nix
index 1f3223a30543..451d4b71296a 100644
--- a/pkgs/games/planetaryannihilation/default.nix
+++ b/pkgs/games/planetaryannihilation/default.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation {
 
     ln -s ${systemd}/lib/libudev.so.1 $out/lib/libudev.so.0
 
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/PA"
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome3.gconf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/PA"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib xorg.libXdamage xorg.libXfixes gtk2 glib stdenv.glibc.out "$out" xorg.libXext pango udev xorg.libX11 xorg.libXcomposite alsaLib atk nspr fontconfig cairo pango nss freetype gnome3.gconf gdk_pixbuf xorg.libXrender ]}:{stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64" "$out/host/CoherentUI_Host"
 
     wrapProgram $out/PA --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib stdenv.glibc.out xorg.libX11 xorg.libXcursor gtk2 glib curl "$out" ]}:${stdenv.cc.cc.lib}/lib64:${stdenv.glibc.out}/lib64"
 
diff --git a/pkgs/games/scrolls/default.nix b/pkgs/games/scrolls/default.nix
index dd84c38b486b..c2beeb13cadf 100644
--- a/pkgs/games/scrolls/default.nix
+++ b/pkgs/games/scrolls/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
     cp -r ../Scrolls_Data "$out/opt/Scrolls/"
     chmod +x "$out/opt/Scrolls/Scrolls"
 
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       --set-rpath "$libPath" "$out/opt/Scrolls/Scrolls"
 
     mkdir "$out/bin"
diff --git a/pkgs/games/sdlmame/default.nix b/pkgs/games/sdlmame/default.nix
index 5064c8d9d343..947e52e1f13d 100644
--- a/pkgs/games/sdlmame/default.nix
+++ b/pkgs/games/sdlmame/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${stdenv.lib.makeLibraryPath [ alsaLib qt48 SDL fontconfig freetype SDL_ttf xorg.libX11 xorg.libXinerama stdenv.cc.cc ]}" \
       share/sdlmame/sdlmame
 
diff --git a/pkgs/games/terraria-server/default.nix b/pkgs/games/terraria-server/default.nix
index 15a5c2ec9070..5fcb5063bbc8 100644
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@@ -21,8 +21,8 @@ stdenv.mkDerivation rec {
     # Fix "/lib64/ld-linux-x86-64.so.2" like references in ELF executables.
     find "$out" | while read filepath; do
       if file "$filepath" | grep -q "ELF.*executable"; then
-        echo "setting interpreter $(cat "$NIX_BINUTILS/nix-support/dynamic-linker") in $filepath"
-        patchelf --set-interpreter "$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")" "$filepath"
+        echo "setting interpreter $(cat "$NIX_CC"/nix-support/dynamic-linker) in $filepath"
+        patchelf --set-interpreter "$(cat "$NIX_CC"/nix-support/dynamic-linker)" "$filepath"
         test $? -eq 0 || { echo "patchelf failed to process $filepath"; exit 1; }
       fi
     done
diff --git a/pkgs/games/vessel/default.nix b/pkgs/games/vessel/default.nix
index 64f19ff7ab86..34b9a606fb96 100644
--- a/pkgs/games/vessel/default.nix
+++ b/pkgs/games/vessel/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     echo @@@ 
 
     # if we call ld.so $(bin) we don't need to set the ELF interpreter, and save a patchelf step. 
-    LD_PRELOAD=./isatty.so $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $src << IM_A_BOT
+    LD_PRELOAD=./isatty.so $(cat $NIX_CC/nix-support/dynamic-linker) $src << IM_A_BOT
     n
     $out/libexec/strangeloop/vessel/
     IM_A_BOT
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     # props to Ethan Lee (the Vessel porter) for understanding
     # how $ORIGIN works in rpath. There is hope for humanity. 
     patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath $libPath:$out/libexec/strangeloop/vessel/x86/ \
       $out/libexec/strangeloop/vessel/x86/vessel.x86
 
diff --git a/pkgs/games/worldofgoo/default.nix b/pkgs/games/worldofgoo/default.nix
index d69a50f56e7d..ba887d91de19 100644
--- a/pkgs/games/worldofgoo/default.nix
+++ b/pkgs/games/worldofgoo/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/libexec/2dboy/WorldOfGoo/
     mkdir -p $out/bin
 
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath $libPath ./WorldOfGoo.bin64
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath $libPath ./WorldOfGoo.bin64
 
     cp -r * $out/libexec/2dboy/WorldOfGoo/
 
diff --git a/pkgs/misc/cups/drivers/kyocera/default.nix b/pkgs/misc/cups/drivers/kyocera/default.nix
index b75b903d06e4..be9d4f837092 100644
--- a/pkgs/misc/cups/drivers/kyocera/default.nix
+++ b/pkgs/misc/cups/drivers/kyocera/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     install -Dm755 English/rastertokpsl $out/lib/cups/filter/rastertokpsl
     patchelf \
       --set-rpath ${libPath} \
-      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       $out/lib/cups/filter/rastertokpsl
 
     mkdir -p $out/share/cups/model/Kyocera
diff --git a/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix b/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
index fba2bb88acb7..b0a030469349 100644
--- a/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
+++ b/pkgs/misc/cups/drivers/mfcl2700dnlpr/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
         coreutils ghostscript gnugrep gnused which
       ]}
 
-    interpreter=$(cat $NIX_BINUTILS/nix-support/dynamic-linker)
+    interpreter=$(cat $NIX_CC/nix-support/dynamic-linker)
     patchelf --set-interpreter "$interpreter" $dir/inf/braddprinter
     patchelf --set-interpreter "$interpreter" $dir/lpd/brprintconflsr3
     patchelf --set-interpreter "$interpreter" $dir/lpd/rawtobr3
diff --git a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
index 0d68fc5b09c1..f750df6e5063 100644
--- a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
+++ b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
@@ -27,7 +27,7 @@ ln -s ppd model
 cd $out/lib/cups/filter
 for i in $(ls); do
     echo "Patching $i..."
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $i ||
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $i ||
       echo "Couldn't set interpreter!"
     patchelf --set-rpath $cups/lib:$gcc/lib:$glibc/lib $i  # This might not be necessary.
 done
diff --git a/pkgs/misc/cups/drivers/samsung/4.01.17.nix b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
index 22a0986e1fbb..b30b4c4a2c18 100644
--- a/pkgs/misc/cups/drivers/samsung/4.01.17.nix
+++ b/pkgs/misc/cups/drivers/samsung/4.01.17.nix
@@ -43,7 +43,7 @@ in stdenv.mkDerivation rec {
       echo "Patching $exe"
       patchelf \
         --set-rpath ${libPath} \
-        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
         $exe
     done
     unset GLOBIGNORE
diff --git a/pkgs/misc/cups/drivers/samsung/default.nix b/pkgs/misc/cups/drivers/samsung/default.nix
index e837807c89e6..556c408012d2 100644
--- a/pkgs/misc/cups/drivers/samsung/default.nix
+++ b/pkgs/misc/cups/drivers/samsung/default.nix
@@ -69,7 +69,7 @@ in stdenv.mkDerivation rec {
 
   preFixup = ''
     for bin in "$out/bin/"*; do
-      patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$bin"
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$bin"
       patchelf --set-rpath "$out/lib:${stdenv.lib.getLib cups}/lib" "$bin"
     done
 
diff --git a/pkgs/misc/drivers/gutenprint/bin.nix b/pkgs/misc/drivers/gutenprint/bin.nix
index 768b9902c4b6..ac3e96e26589 100644
--- a/pkgs/misc/drivers/gutenprint/bin.nix
+++ b/pkgs/misc/drivers/gutenprint/bin.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
         $out/cups/lib/backend/{canon,epson} \
         $out/sbin/cups-genppd.5.0 \
       ; do
-      patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
           --set-rpath $libPath $p
     done
     
diff --git a/pkgs/misc/drivers/sundtek/default.nix b/pkgs/misc/drivers/sundtek/default.nix
index 1d7021137c0b..4dc0f2591d82 100644
--- a/pkgs/misc/drivers/sundtek/default.nix
+++ b/pkgs/misc/drivers/sundtek/default.nix
@@ -34,7 +34,7 @@ in
 
     postFixup = ''
       find $out -type f -exec \
-        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" {} \
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" {} \
         patchelf --set-rpath ${rpath} {} \;
     '';
 
diff --git a/pkgs/misc/foldingathome/default.nix b/pkgs/misc/foldingathome/default.nix
index 1b8bdc891b00..aaa932c0a1c4 100644
--- a/pkgs/misc/foldingathome/default.nix
+++ b/pkgs/misc/foldingathome/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   installPhase = ''
     BINFILES="fah6 mpiexec";
     for a in $BINFILES; do 
-      patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $a
+      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $a
     done
     mkdir -p $out/bin
     cp $BINFILES $out/bin
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 690fd93fcf8a..933e7558dbbf 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -2,15 +2,12 @@
 , hostPlatform, targetPlatform
 }:
 
-# despite the name, binutils-raw is in fact wrapped.
-let binutils-unwrapped = binutils-raw.binutils; in
-
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same prefix.
-assert binutils-unwrapped.prefix == cctools.prefix;
+assert binutils-raw.prefix == cctools.prefix;
 
 let
-  inherit (binutils-unwrapped) prefix;
+  inherit (binutils-raw) prefix;
   cmds = [
     "ar" "ranlib" "as" "dsymutil" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
@@ -23,7 +20,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-unwrapped.out}/bin/${prefix}c++filt $out/bin/${prefix}c++filt
+    ln -s ${binutils-raw.out}/bin/${prefix}c++filt $out/bin/${prefix}c++filt
 
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
@@ -40,7 +37,7 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
-    for i in ${binutils-unwrapped.dev or binutils-unwrapped.out}/include/*.h; do
+    for i in ${binutils-raw.dev or binutils-raw.out}/include/*.h; do
       ln -s "$i" "$out/include/$(basename $i)"
     done
 
@@ -49,8 +46,8 @@ stdenv.mkDerivation {
     done
 
     # FIXME: this will give us incorrect man pages for bits of cctools
-    ln -s ${binutils-unwrapped.out}/share $out/share
-    ln -s ${binutils-unwrapped.out}/lib $out/lib
+    ln -s ${binutils-raw.out}/share $out/share
+    ln -s ${binutils-raw.out}/lib $out/lib
 
     ln -s ${cctools}/libexec $out/libexec
   '';
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index 3d7bb74ce213..e7825a0ebd69 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -131,7 +131,7 @@ in stdenv.mkDerivation rec {
       "install -Dm444 usr/src/amdgpu-pro-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
   + ''
     mv $out/etc/vulkan $out/share
-    interpreter="$(cat $NIX_BINUTILS/nix-support/dynamic-linker)"
+    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
     libPath="$out/lib:$out/lib/gbm:$depLibPath"
   '' + optionalString (!stdenv.is64bit) ''
     for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 1fdff871b73f..e67e54f7b439 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace configure \
       --replace '#define ELF_INTERPRETER "$interp"' \
-                "#define ELF_INTERPRETER \"$(cat $NIX_BINUTILS/nix-support/dynamic-linker)\""
+                "#define ELF_INTERPRETER \"$(cat $NIX_CC/nix-support/dynamic-linker)\""
   '';
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index a029b582f38b..bb714f60c2df 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
     for f in $out/bin/*; do
       if isELF "$f"; then
-        patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$f"
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f"
         patchelf --set-rpath "$out/lib" "$f"
       fi
     done
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
index a4704fd51dfa..5d47df9a87a7 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
@@ -81,7 +81,7 @@ installPhase() {
 
         for i in nvidia-settings nvidia-xconfig; do
 	    cp usr/bin/$i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
 	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
         done
     
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index f41229ace86c..99813d38236b 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -111,7 +111,7 @@ installPhase() {
         for i in nvidia-cuda-mps-control nvidia-cuda-mps-server nvidia-smi nvidia-debugdump; do
             if [ -e "$i" ]; then
                 install -Dm755 $i $bin/bin/$i
-                patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+                patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
                     --set-rpath $out/lib:$libPath $bin/bin/$i
             fi
         done
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index bc574bc0d799..9ca48ccaf057 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
 
         for i in $out/bin/* $out/sbin/*; do
           patchelf \
-            --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+            --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
             --set-rpath "$out/lib:$libPath" \
             $i
         done
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 787c685e61e1..4668ac240961 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/bin/platform
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/platform
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/meteor/default.nix b/pkgs/servers/meteor/default.nix
index 36384da20478..0b82f1deef62 100644
--- a/pkgs/servers/meteor/default.nix
+++ b/pkgs/servers/meteor/default.nix
@@ -39,21 +39,21 @@ stdenv.mkDerivation rec {
     patch -p1 < ${./main.patch}
     popd
     substituteInPlace $out/tools/cli/main.js \
-      --replace "@INTERPRETER@" "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --replace "@INTERPRETER@" "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --replace "@RPATH@" "${lib.makeLibraryPath [ stdenv.cc.cc zlib ]}" \
       --replace "@PATCHELF@" "${patchelf}/bin/patchelf"
 
     # Patch node.
     node=$devBundle/bin/node
     patchelf \
-      --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       --set-rpath "$(patchelf --print-rpath $node):${stdenv.cc.cc.lib}/lib" \
       $node
 
     # Patch mongo.
     for p in $devBundle/mongodb/bin/mongo{,d}; do
       patchelf \
-        --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+        --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
         --set-rpath "$(patchelf --print-rpath $p):${lib.makeLibraryPath [ stdenv.cc.cc zlib ]}" \
         $p
     done
diff --git a/pkgs/servers/monitoring/newrelic-sysmond/default.nix b/pkgs/servers/monitoring/newrelic-sysmond/default.nix
index 8ba554d1b771..e9a9fcff2b93 100644
--- a/pkgs/servers/monitoring/newrelic-sysmond/default.nix
+++ b/pkgs/servers/monitoring/newrelic-sysmond/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     install -v -m755 daemon/nrsysmond.x64 $out/bin/nrsysmond
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/nrsysmond
   '';
 
diff --git a/pkgs/servers/sql/oracle-xe/default.nix b/pkgs/servers/sql/oracle-xe/default.nix
index f499743d7621..e86406cd469c 100644
--- a/pkgs/servers/sql/oracle-xe/default.nix
+++ b/pkgs/servers/sql/oracle-xe/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
       \( -name '*.sh' \
       -o -path "$basedir/bin/*" \
       \) -print -exec "${patchelf}/bin/patchelf" \
-           --interpreter "$(cat "$NIX_BINUTILS/nix-support/dynamic-linker")" \
+           --interpreter "$(cat "$NIX_CC/nix-support/dynamic-linker")" \
            --set-rpath "${libs}:$out/libexec/oracle/lib" \
            --force-rpath '{}' \;
   '';
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index d71cda7f8a96..f4801d674e8a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -63,40 +63,10 @@ in rec {
                           extraBuildInputs,
                           allowedRequisites ? null}:
     let
-      buildPackages = lib.optionalAttrs (last ? stdenv) {
-        inherit (last) stdenv;
-      };
-
-      coreutils = { name = "coreutils-9.9.9"; outPath = bootstrapTools; };
-      gnugrep   = { name = "gnugrep-9.9.9";   outPath = bootstrapTools; };
-
-      binutils = import ../../build-support/binutils-wrapper {
-        inherit shell;
-        inherit (last) stdenv;
-
-        nativeTools  = false;
-        nativeLibc   = false;
-        inherit buildPackages coreutils gnugrep;
-        libc         = last.pkgs.darwin.Libsystem;
-        binutils     = { name = "binutils-9.9.9";  outPath = bootstrapTools; };
-      };
-
-      cc = if isNull last then "/dev/null" else import ../../build-support/cc-wrapper {
-        inherit shell;
-        inherit (last) stdenv;
-
-        nativeTools  = false;
-        nativeLibc   = false;
-        inherit buildPackages coreutils gnugrep binutils;
-        libc         = last.pkgs.darwin.Libsystem;
-        isClang      = true;
-        cc           = { name = "clang-9.9.9";     outPath = bootstrapTools; };
-      };
-
       thisStdenv = import ../generic {
         inherit config shell extraNativeBuildInputs extraBuildInputs;
         allowedRequisites = if allowedRequisites == null then null else allowedRequisites ++ [
-          cc.expand-response-params cc.binutils
+          thisStdenv.cc.expand-response-params
         ];
 
         name = "stdenv-darwin-boot-${toString step}";
@@ -105,9 +75,24 @@ in rec {
         hostPlatform = localSystem;
         targetPlatform = localSystem;
 
-        inherit cc;
+        cc = if isNull last then "/dev/null" else import ../../build-support/cc-wrapper {
+          inherit shell;
+          inherit (last) stdenv;
 
-        preHook = lib.optionalString (shell == "${bootstrapTools}/bin/bash") ''
+          nativeTools  = false;
+          nativeLibc   = false;
+          buildPackages = lib.optionalAttrs (last ? stdenv) {
+            inherit (last) stdenv;
+          };
+          libc         = last.pkgs.darwin.Libsystem;
+          isClang      = true;
+          cc           = { name = "clang-9.9.9";     outPath = bootstrapTools; };
+          binutils     = { name = "binutils-9.9.9";  outPath = bootstrapTools; };
+          coreutils    = { name = "coreutils-9.9.9"; outPath = bootstrapTools; };
+          gnugrep      = { name = "gnugrep-9.9.9";   outPath = bootstrapTools; };
+        };
+
+        preHook = stage0.stdenv.lib.optionalString (shell == "${bootstrapTools}/bin/bash") ''
           # Don't patch #!/interpreter because it leads to retained
           # dependencies on the bootstrapTools in the final stdenv.
           dontPatchShebangs=1
@@ -365,8 +350,8 @@ in rec {
       xz.out xz.bin libcxx libcxxabi gmp.out gnumake findutils bzip2.out
       bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped patch pcre.out gettext
-      binutils-raw.binutils.out binutils-raw.binutils.dev binutils binutils.binutils
+      gnugrep llvmPackages.clang-unwrapped patch pcre.out binutils-raw.out
+      binutils-raw.dev binutils gettext
       cc.expand-response-params
     ]) ++ (with pkgs.darwin; [
       dyld Libsystem CF cctools ICU libiconv locale
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 08166c55a5a9..fab1985b9765 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -143,16 +143,7 @@ in
         '';
       };
       gcc-unwrapped = bootstrapTools;
-      binutils = import ../../build-support/binutils-wrapper {
-        nativeTools = false;
-        nativeLibc = false;
-        buildPackages = { };
-        libc = self.glibc;
-        inherit (self) coreutils gnugrep;
-        binutils = bootstrapTools;
-        name = "bootstrap-binutils-wrapper";
-        stdenv = self.stdenv;
-      };
+      binutils = bootstrapTools;
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
     };
@@ -174,7 +165,7 @@ in
 
     # Rebuild binutils to use from stage2 onwards.
     overrides = self: super: {
-      binutils = super.binutils_nogold;
+      binutils = super.binutils.override { gold = false; };
       inherit (prevStage)
         ccWrapperStdenv
         glibc gcc-unwrapped coreutils gnugrep;
@@ -197,14 +188,9 @@ in
     overrides = self: super: {
       inherit (prevStage)
         ccWrapperStdenv
-        gcc-unwrapped coreutils gnugrep
+        binutils gcc-unwrapped coreutils gnugrep
         perl paxctl gnum4 bison;
       # This also contains the full, dynamically linked, final Glibc.
-      binutils = prevStage.binutils.override {
-        # Rewrap the binutils with the new glibc, so both the next
-        # stage's wrappers use it.
-        libc = self.glibc;
-      };
     };
   })
 
@@ -249,15 +235,6 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison gmp perl glibc zlib linuxHeaders;
 
-      binutils = super.binutils.override {
-        # Don't use stdenv's shell but our own
-        shell = self.bash + "/bin/bash";
-        # Build expand-response-params with last stage like below
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
-      };
-
       gcc = lib.makeOverridable (import ../../build-support/cc-wrapper) {
         nativeTools = false;
         nativeLibc = false;
@@ -322,8 +299,8 @@ in
       allowedRequisites = with prevStage; with lib;
         # Simple executable tools
         concatMap (p: [ (getBin p) (getLib p) ])
-          [ gzip bzip2 xz bash binutils.binutils coreutils diffutils findutils
-            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
+          [ gzip bzip2 xz bash binutils coreutils diffutils findutils gawk
+            gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
           ]
         # Library dependencies
         ++ map getLib (
@@ -333,7 +310,7 @@ in
         # More complicated cases
         ++ [
             glibc.out glibc.dev glibc.bin/*propagated from .dev*/ linuxHeaders
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params
+            gcc gcc.cc gcc.cc.lib gcc.expand-response-params
           ]
           ++ lib.optionals (system == "aarch64-linux")
             [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ];
diff --git a/pkgs/tools/filesystems/yandex-disk/default.nix b/pkgs/tools/filesystems/yandex-disk/default.nix
index 72291ccb0061..77302f3d4a2b 100644
--- a/pkgs/tools/filesystems/yandex-disk/default.nix
+++ b/pkgs/tools/filesystems/yandex-disk/default.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
       $out/etc/bash_completion.d/yandex-disk-completion.bash
 
     ${patchelf}/bin/patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${zlib.out}/lib:${p.gcclib}" \
       $out/bin/yandex-disk
   '';
diff --git a/pkgs/tools/misc/megacli/default.nix b/pkgs/tools/misc/megacli/default.nix
index cf15473e2403..5341c9840be8 100644
--- a/pkgs/tools/misc/megacli/default.nix
+++ b/pkgs/tools/misc/megacli/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     cd $out
     unzip ${src}
     rpmextract linux/MegaCli-8.07.07-1.noarch.rpm
-    ${patchelf}/bin/patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" --set-rpath ${libPath}:$out/opt/lsi/3rdpartylibs/x86_64:$out/opt/lsi/3rdpartylibs:${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib opt/MegaRAID/MegaCli/MegaCli64
+    ${patchelf}/bin/patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath ${libPath}:$out/opt/lsi/3rdpartylibs/x86_64:$out/opt/lsi/3rdpartylibs:${stdenv.cc.cc.lib}/lib64:${stdenv.cc.cc.lib}/lib opt/MegaRAID/MegaCli/MegaCli64
     wrapProgram $out/opt/MegaRAID/MegaCli/MegaCli64 --set LD_LIBRARY_PATH $out/opt/lsi/3rdpartylibs/x86_64
     ln -s $out/opt/MegaRAID/MegaCli/MegaCli64 $out/bin/MegaCli64
     eval fixupPhase
diff --git a/pkgs/tools/misc/ocz-ssd-guru/default.nix b/pkgs/tools/misc/ocz-ssd-guru/default.nix
index 9b98ac0137cd..21786f3f15f5 100644
--- a/pkgs/tools/misc/ocz-ssd-guru/default.nix
+++ b/pkgs/tools/misc/ocz-ssd-guru/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     cp ${system}/SSDGuru $out/bin/
     rm -rf linux{32,64}
     patchelf \
-      --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath $libPath:$out \
       $out/bin/SSDGuru
 
diff --git a/pkgs/tools/misc/sam-ba/default.nix b/pkgs/tools/misc/sam-ba/default.nix
index 68675958fd3e..2d1db4eb64c7 100644
--- a/pkgs/tools/misc/sam-ba/default.nix
+++ b/pkgs/tools/misc/sam-ba/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin/" \
              "$out/opt/sam-ba/"
     cp -a . "$out/opt/sam-ba/"
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/opt/sam-ba/sam-ba${maybe64}"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/opt/sam-ba/sam-ba${maybe64}"
     cat > "$out/bin/sam-ba" << EOF
     export LD_LIBRARY_PATH="${libPath}"
     exec "$out/opt/sam-ba/sam-ba${maybe64}"
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index 538f9d4a9455..e1d6604970e5 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     mv opt/staruml $out/bin
 
     ${patchelf}/bin/patchelf \
-      --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       $out/bin/StarUML
 
     mkdir -p $out/lib
diff --git a/pkgs/tools/misc/xflux/default.nix b/pkgs/tools/misc/xflux/default.nix
index b861c9b4d9da..d0f358446952 100644
--- a/pkgs/tools/misc/xflux/default.nix
+++ b/pkgs/tools/misc/xflux/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
     cp  xflux "$out/bin"
   '';
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "$libPath" "$out/bin/xflux"
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "$libPath" "$out/bin/xflux"
   '';
   meta = {
     description = "Adjusts your screen to emit warmer light at night";
diff --git a/pkgs/tools/package-management/rpm/default.nix b/pkgs/tools/package-management/rpm/default.nix
index 6a9c46671282..78d815eb7c19 100644
--- a/pkgs/tools/package-management/rpm/default.nix
+++ b/pkgs/tools/package-management/rpm/default.nix
@@ -13,13 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cpio zlib bzip2 file libarchive nspr nss db xz python lua pkgconfig autoreconfHook ];
 
-  # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as
-  # linkage requirements
-  #
-  # Binutils.binutils for headers
-  propagatedBuildInputs = [
-    popt elfutils nss db bzip2 libarchive binutils binutils.binutils
-  ];
+  # rpm/rpmlib.h includes popt.h, and then the pkg-config file mentions these as linkage requirements
+  propagatedBuildInputs = [ popt elfutils nss db bzip2 libarchive binutils ];
 
   NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss";
 
diff --git a/pkgs/tools/security/encryptr/default.nix b/pkgs/tools/security/encryptr/default.nix
index abea3eccf124..2cf07c63a84a 100644
--- a/pkgs/tools/security/encryptr/default.nix
+++ b/pkgs/tools/security/encryptr/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
     cp -v lib* $out/lib
     ln -sv ${systemd.lib}/lib/libudev.so.1 $out/lib/libudev.so.0
 
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) \
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
              --set-rpath $out/lib:${rpath} \
              $out/bin/encryptr
   '';
diff --git a/pkgs/tools/security/enpass/default.nix b/pkgs/tools/security/enpass/default.nix
index 5774de21c549..449a6911a150 100644
--- a/pkgs/tools/security/enpass/default.nix
+++ b/pkgs/tools/security/enpass/default.nix
@@ -73,7 +73,7 @@ let
       	$out/share/applications/enpass.desktop
 
       for i in $out/bin/{Enpass,EnpassHelper/EnpassHelper}; do
-        patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) $i
+        patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $i
       done
 
       # The helper's sha256 sum must match, hence the use of libredirect.
diff --git a/pkgs/tools/security/fprot/default.nix b/pkgs/tools/security/fprot/default.nix
index 0062758196f3..14a4c985d502 100644
--- a/pkgs/tools/security/fprot/default.nix
+++ b/pkgs/tools/security/fprot/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     cp f-prot.conf.default $out/opt/f-prot/f-prot.conf
     ln -s $out/opt/f-prot/fpupdate $out/bin/fpupdate
 
-    patchelf --interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" $out/opt/f-prot/fpupdate
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/opt/f-prot/fpupdate
 
     mkdir -p $out/share/man/
     mkdir -p $out/share/man/man1
diff --git a/pkgs/tools/security/gorilla-bin/default.nix b/pkgs/tools/security/gorilla-bin/default.nix
index dc99d1953d56..cbd260455d8e 100644
--- a/pkgs/tools/security/gorilla-bin/default.nix
+++ b/pkgs/tools/security/gorilla-bin/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = let
-    interpreter = "$(< \"$NIX_BINUTILS/nix-support/dynamic-linker\")";
+    interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
     libPath = stdenv.lib.makeLibraryPath [ libXft libX11 freetype fontconfig libXrender libXScrnSaver libXext ];
   in ''
     mkdir -p $out/opt/password-gorilla
diff --git a/pkgs/tools/security/keybase-gui/default.nix b/pkgs/tools/security/keybase-gui/default.nix
index 63bba05b6a09..a45a6ea2a04c 100644
--- a/pkgs/tools/security/keybase-gui/default.nix
+++ b/pkgs/tools/security/keybase-gui/default.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/bin/keybase-gui
   '';
   postFixup = ''
-    patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker) --set-rpath "${libPath}:\$ORIGIN" "$out/share/keybase/Keybase"
+    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) --set-rpath "${libPath}:\$ORIGIN" "$out/share/keybase/Keybase"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/xidel/default.nix b/pkgs/tools/text/xidel/default.nix
index 95b8e270689f..91cecce61225 100644
--- a/pkgs/tools/text/xidel/default.nix
+++ b/pkgs/tools/text/xidel/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out/bin"
     cp -a usr/* "$out/"
-    patchelf --set-interpreter "$(cat $NIX_BINUTILS/nix-support/dynamic-linker)" "$out/bin/xidel"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$out/bin/xidel"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8ec33282113..d7071ac940ed 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1809,7 +1809,7 @@ with pkgs;
   emscripten = callPackage ../development/compilers/emscripten { };
 
   emscriptenfastcomp-unwrapped = callPackage ../development/compilers/emscripten-fastcomp { };
-  emscriptenfastcomp-wrapped = wrapCCWith stdenv.cc.libc stdenv.cc.binutils ''
+  emscriptenfastcomp-wrapped = wrapCCWith stdenv.cc.libc ''
     # hardening flags break WASM support
     cat > $out/nix-support/add-hardening.sh
   '' emscriptenfastcomp-unwrapped;
@@ -5259,9 +5259,7 @@ with pkgs;
 
   clang-sierraHack = clang.override {
     name = "clang-wrapper-with-reexport-hack";
-    binutils = clang.binutils.override {
-      useMacosReexportHack = true;
-    };
+    useMacosReexportHack = true;
   };
 
   clang_4  = llvmPackages_4.clang;
@@ -5353,12 +5351,8 @@ with pkgs;
         extraBuildCommands = ''
           echo "dontMoveLib64=1" >> $out/nix-support/setup-hook
         '';
-        # Binutils with glibc multi
-        binutils = cc.binutils.override {
-          libc = glibc_multi;
-        };
-      in wrapCCWith glibc_multi binutils extraBuildCommands (cc.cc.override {
-        stdenv = overrideCC stdenv (wrapCCWith glibc_multi binutils "" cc.cc);
+      in wrapCCWith glibc_multi extraBuildCommands (cc.cc.override {
+        stdenv = overrideCC stdenv (wrapCCWith glibc_multi "" cc.cc);
         profiledCompiler = false;
         enableMultilib = true;
       }))
@@ -6160,20 +6154,19 @@ with pkgs;
 
   wla-dx = callPackage ../development/compilers/wla-dx { };
 
-  wrapCCWith = libc: binutils: extraBuildCommands: baseCC: ccWrapperFun {
+  wrapCCWith = libc: extraBuildCommands: baseCC: ccWrapperFun {
     nativeTools = stdenv.cc.nativeTools or false;
     nativeLibc = stdenv.cc.nativeLibc or false;
     nativePrefix = stdenv.cc.nativePrefix or "";
     cc = baseCC;
     isGNU = baseCC.isGNU or false;
     isClang = baseCC.isClang or false;
-    inherit libc binutils extraBuildCommands;
+    inherit libc extraBuildCommands;
   };
 
   ccWrapperFun = callPackage ../build-support/cc-wrapper;
-  binutilsWrapperFun = callPackage ../build-support/binutils-wrapper;
 
-  wrapCC = wrapCCWith stdenv.cc.libc stdenv.cc.binutils "";
+  wrapCC = wrapCCWith stdenv.cc.libc "";
   # legacy version, used for gnat bootstrapping
   wrapGCC-old = baseGCC: callPackage ../build-support/gcc-wrapper-old {
     nativeTools = stdenv.cc.nativeTools or false;
@@ -6197,15 +6190,6 @@ with pkgs;
       inherit cc binutils libc shell name;
     };
 
-  wrapBinutils = baseBinutils: binutilsWrapperFun {
-    nativeTools = stdenv.cc.nativeTools or false;
-    nativeLibc = stdenv.cc.nativeLibc or false;
-    nativePrefix = stdenv.cc.nativePrefix or "";
-    libc = stdenv.cc.libc;
-    binutils = baseBinutils;
-    extraBuildCommands = "";
-  };
-
   # prolog
   yap = callPackage ../development/compilers/yap { };
 
@@ -6766,15 +6750,13 @@ with pkgs;
     then darwin.binutils
     else binutils-raw;
 
-  binutils-raw = wrapBinutils (callPackage ../development/tools/misc/binutils {
+  binutils-raw = callPackage ../development/tools/misc/binutils {
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (targetPlatform != buildPlatform) || noSysDirs;
-  });
+  };
 
   binutils_nogold = lowPrio (binutils-raw.override {
-    binutils = binutils-raw.binutils.override {
-      gold = false;
-    };
+    gold = false;
   });
 
   bison2 = callPackage ../development/tools/parsing/bison/2.x.nix { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index a8c8f744d8a1..32d540a8f967 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -10,9 +10,9 @@ in
 
   apple_sdk = callPackage ../os-specific/darwin/apple-sdk { };
 
-  binutils = pkgs.wrapBinutils (callPackage ../os-specific/darwin/binutils {
+  binutils = callPackage ../os-specific/darwin/binutils {
     inherit (darwin) cctools;
-  });
+  };
 
   cctools = callPackage ../os-specific/darwin/cctools/port.nix {
     inherit (darwin) libobjc maloader;
diff --git a/pkgs/top-level/haxe-packages.nix b/pkgs/top-level/haxe-packages.nix
index a79f264848b8..5a85dc3433ba 100644
--- a/pkgs/top-level/haxe-packages.nix
+++ b/pkgs/top-level/haxe-packages.nix
@@ -67,7 +67,7 @@ let
       postFixup = ''
         for f in $out/lib/haxe/${withCommas libname}/${withCommas version}/{,project/libs/nekoapi/}bin/Linux{,64}/*; do
           chmod +w "$f"
-          patchelf --set-interpreter $(cat $NIX_BINUTILS/nix-support/dynamic-linker)   "$f" || true
+          patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker)   "$f" || true
           patchelf --set-rpath ${ stdenv.lib.makeLibraryPath [ stdenv.cc.cc ] }  "$f" || true
         done
       '';

From 6b3cef22461d33bb829aafd3b166fd3c9828731b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 7 Sep 2017 22:15:37 +0200
Subject: [PATCH 130/134] Remove tracePhases

This has not been used in a long time.
---
 pkgs/stdenv/generic/setup.sh | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 61877701b716..8a000091491d 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1016,11 +1016,6 @@ genericBuild() {
         if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then continue; fi
         if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then continue; fi
 
-        if [[ -n "${tracePhases:-}" ]]; then
-            echo
-            echo "@ phase-started $out $curPhase"
-        fi
-
         showPhaseHeader "$curPhase"
         dumpVars
 
@@ -1034,11 +1029,6 @@ genericBuild() {
         if [ "$curPhase" = unpackPhase ]; then
             cd "${sourceRoot:-.}"
         fi
-
-        if [ -n "${tracePhases:-}" ]; then
-            echo
-            echo "@ phase-succeeded $out $curPhase"
-        fi
     done
 }
 

From 0061fae2e6fd62f6d2a76418b62815bd49add51c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 7 Sep 2017 22:24:27 +0200
Subject: [PATCH 131/134] genericBuild: Communicate the current build phase to
 Nix

This allows the progress bar to show e.g.

  [1/9/59 built] building bison-3.0.4 (configurePhase): checking for strdup... yes
---
 pkgs/stdenv/generic/setup.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 8a000091491d..ce8c3ecef829 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1016,6 +1016,10 @@ genericBuild() {
         if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then continue; fi
         if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then continue; fi
 
+        if [[ -n $NIX_LOG_FD ]]; then
+            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&$NIX_LOG_FD
+        fi
+
         showPhaseHeader "$curPhase"
         dumpVars
 

From 9d6ac8eadaade4f8564aa54b64bb9eb0dabfa322 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sat, 9 Sep 2017 07:53:46 +0200
Subject: [PATCH 132/134] mesa: maintenance 17.1.8 -> 17.1.9

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index bdce7ce3dbe7..c9cb0b36bc50 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.1.8";
+  version = "17.1.9";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "75ed2eaeae26ddd536150f294386468ae2e1a7717948c41cd14b7875be5269db";
+    sha256 = "5f51ad94341696097d5df7b838183534478216858ac0fc8de183671a36ffea1a";
   };
 
   prePatch = "patchShebangs .";

From c86eb1da5f1c29838bd8a1f88560bc23b78e4fd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Sun, 10 Sep 2017 11:16:47 +0200
Subject: [PATCH 133/134] stdenv bootstrap: fix evaluation

This is probably a fallout from #28557 merge and revert.
I can't see why exactly this happened, but it seems a safe fix.
---
 pkgs/stdenv/linux/make-bootstrap-tools.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index 702fef4c75bc..c8cddf248ab9 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -126,9 +126,9 @@ rec {
 
         # Copy binutils.
         for i in as ld ar ranlib nm strip readelf objdump; do
-          cp ${binutils.binutils.out}/bin/$i $out/bin
+          cp ${binutils.out}/bin/$i $out/bin
         done
-        cp -d ${binutils.binutils.lib}/lib/lib*.so* $out/lib
+        cp -d ${binutils.lib}/lib/lib*.so* $out/lib
 
         chmod -R u+w $out
 

From ab62b7e9b9c05498cd5e2d9f2521a3d51d5aeedf Mon Sep 17 00:00:00 2001
From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Date: Tue, 12 Sep 2017 12:23:53 +0300
Subject: [PATCH 134/134] Revert "libgcrypt: Add pre-ARMv7 patch"

This reverts commit 1cfe9539f99d4d0f9dd00a48f79d13e8a37b4d08.

No longer needed after the upgrade in 095af3e63b26e4.
---
 pkgs/development/libraries/libgcrypt/default.nix | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 8d71cfd313d9..e32ba050c38f 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, libgpgerror, enableCapabilities ? false, libcap }:
+{ stdenv, fetchurl, libgpgerror, enableCapabilities ? false, libcap }:
 
 assert enableCapabilities -> stdenv.isLinux;
 
@@ -22,15 +22,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ libgpgerror ]
     ++ stdenv.lib.optional enableCapabilities libcap;
 
-  # Shouldn't be needed after 1.8.1
-  patches = if stdenv.isArm && stdenv.system != "armv7l-linux"
-    then fetchpatch {
-        url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=4a7aa30ae9f3ce798dd886c2f2d4164c43027748";
-        name = "arm.patch";
-        sha256 = "1dq9s0xwpbg7s5sghvssmwh4v88x733zm6c8ab3flllq8h7c8fq5";
-      }
-    else null;
-
   # Make sure libraries are correct for .pc and .la files
   # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
   postFixup = ''