diff --git a/cabal2nix.cabal b/cabal2nix.cabal
--- a/cabal2nix.cabal
+++ b/cabal2nix.cabal
@@ -3,7 +3,7 @@
 -- see: https://github.com/sol/hpack
 
 name:           cabal2nix
-version:        2.2.1
+version:        2.3
 synopsis:       Convert Cabal files into Nix build instructions.
 description:    Convert Cabal files into Nix build instructions. Users of Nix can install the latest version by running:
                 .
@@ -80,6 +80,7 @@
 library
   hs-source-dirs:
       src
+  other-extensions: CPP DeriveGeneric FlexibleInstances MultiParamTypeClasses OverloadedStrings RecordWildCards ScopedTypeVariables StandaloneDeriving TemplateHaskell
   ghc-options: -Wall
   build-depends:
       aeson
@@ -90,20 +91,21 @@
     , containers
     , deepseq >= 1.4
     , directory
-    , distribution-nixpkgs
+    , distribution-nixpkgs >= 1.1
     , filepath
     , hackage-db
+    , hopenssl >= 2
     , language-nix
     , lens
     , optparse-applicative
     , pretty >= 1.1.2
     , process
-    , SHA
     , split
     , text
     , transformers
     , yaml
   exposed-modules:
+      Cabal2nix
       Distribution.Nixpkgs.Fetch
       Distribution.Nixpkgs.Haskell
       Distribution.Nixpkgs.Haskell.BuildInfo
@@ -137,15 +139,15 @@
     , containers
     , deepseq >= 1.4
     , directory
-    , distribution-nixpkgs
+    , distribution-nixpkgs >= 1.1
     , filepath
     , hackage-db
+    , hopenssl >= 2
     , language-nix
     , lens
     , optparse-applicative
     , pretty >= 1.1.2
     , process
-    , SHA
     , split
     , text
     , transformers
@@ -169,15 +171,15 @@
     , containers
     , deepseq >= 1.4
     , directory
-    , distribution-nixpkgs
+    , distribution-nixpkgs >= 1.1
     , filepath
     , hackage-db
+    , hopenssl >= 2
     , language-nix
     , lens
     , optparse-applicative
     , pretty >= 1.1.2
     , process
-    , SHA
     , split
     , text
     , transformers
@@ -193,12 +195,12 @@
       HackageGit
   default-language: Haskell2010
 
-test-suite spec
+test-suite doctests
   type: exitcode-stdio-1.0
-  main-is: Main.hs
+  main-is: doctests.hs
   hs-source-dirs:
       test
-  ghc-options: -Wall
+  ghc-options: -Wall -threaded
   build-depends:
       aeson
     , ansi-wl-pprint
@@ -208,15 +210,15 @@
     , containers
     , deepseq >= 1.4
     , directory
-    , distribution-nixpkgs
+    , distribution-nixpkgs >= 1.1
     , filepath
     , hackage-db
+    , hopenssl >= 2
     , language-nix
     , lens
     , optparse-applicative
     , pretty >= 1.1.2
     , process
-    , SHA
     , split
     , text
     , transformers
diff --git a/cabal2nix/Main.hs b/cabal2nix/Main.hs
--- a/cabal2nix/Main.hs
+++ b/cabal2nix/Main.hs
@@ -1,166 +1,4 @@
-{-# LANGUAGE RecordWildCards #-}
-{-# LANGUAGE OverloadedStrings #-}
-
-module Main ( main ) where
-
-import Control.Exception ( bracket )
-import Control.Lens
-import Data.Maybe ( fromMaybe )
-import Data.Monoid ( (<>) )
-import qualified Data.Set as Set
-import Data.String
-import qualified Distribution.Compat.ReadP as P
-import Distribution.Compiler
-import Distribution.Nixpkgs.Fetch
-import Distribution.Nixpkgs.Haskell
-import Distribution.Nixpkgs.Haskell.FromCabal
-import Distribution.Nixpkgs.Haskell.PackageSourceSpec
-import Distribution.Nixpkgs.Meta
-import Distribution.PackageDescription ( FlagName(..), FlagAssignment )
-import Distribution.Simple.Utils ( lowercase )
-import Distribution.System
-import Distribution.Text
-import Language.Nix
-import Options.Applicative
-import Paths_cabal2nix ( version )
-import System.IO ( hFlush, stdout, stderr )
-import qualified Text.PrettyPrint.ANSI.Leijen as P2 hiding ( (<$>), (<>) )
-import Text.PrettyPrint.HughesPJClass ( Doc, Pretty(..), text, vcat, hcat, semi )
-
-data Options = Options
-  { optSha256 :: Maybe String
-  , optMaintainer :: [String]
---, optPlatform :: [String]                                         -- TODO: fix command line handling of platforms
-  , optHaddock :: Bool
-  , optDoCheck :: Bool
-  , optJailbreak :: Bool
-  , optRevision :: Maybe String
-  , optHyperlinkSource :: Bool
-  , optEnableLibraryProfiling :: Bool
-  , optEnableExecutableProfiling :: Bool
-  , optEnableProfiling :: Maybe Bool
-  , optExtraArgs :: [String]
-  , optHackageDb :: Maybe FilePath
-  , optNixShellOutput :: Bool
-  , optFlags :: [String]
-  , optCompiler :: CompilerId
-  , optSystem :: Platform
-  , optSubpath :: Maybe FilePath
-  , optUrl :: String
-  }
-  deriving (Show)
-
-options :: Parser Options
-options = Options
-          <$> optional (strOption $ long "sha256" <> metavar "HASH" <> help "sha256 hash of source tarball")
-          <*> many (strOption $ long "maintainer" <> metavar "MAINTAINER" <> help "maintainer of this package (may be specified multiple times)")
---        <*> many (strOption $ long "platform" <> metavar "PLATFORM" <> help "supported build platforms (may be specified multiple times)")
-          <*> flag True False (long "no-haddock" <> help "don't run Haddock when building this package")
-          <*> flag True False (long "no-check" <> help "don't run regression test suites of this package")
-          <*> switch (long "jailbreak" <> help "disregard version restrictions on build inputs")
-          <*> optional (strOption $ long "revision" <> help "revision to use when fetching from VCS")
-          <*> flag True False (long "no-hyperlink-source" <> help "don't generate pretty-printed source code for the documentation")
-          <*> switch (long "enable-library-profiling" <> help "enable library profiling in the generated build")
-          <*> switch (long "enable-executable-profiling" <> help "enable executable profiling in the generated build")
-          <*> optional (switch (long "enable-profiling" <> help "enable both library and executable profiling in the generated build"))
-          <*> many (strOption $ long "extra-arguments" <> help "extra parameters required for the function body")
-          <*> optional (strOption $ long "hackage-db" <> metavar "PATH" <> help "path to the local hackage db in tar format")
-          <*> switch (long "shell" <> help "generate output suitable for nix-shell")
-          <*> many (strOption $ short 'f' <> long "flag" <> help "Cabal flag (may be specified multiple times)")
-          <*> option (readP parse) (long "compiler" <> help "compiler to use when evaluating the Cabal file" <> value buildCompilerId <> showDefaultWith display)
-          <*> option (readP parsePlatform) (long "system" <> help "target system to use when evaluating the Cabal file" <> value buildPlatform <> showDefaultWith display)
-          <*> optional (strOption $ long "subpath" <> metavar "PATH" <> help "Path to Cabal file's directory relative to the URI (default is root directory)")
-          <*> strArgument (metavar "URI")
-
-readP :: P.ReadP a a -> ReadM a
-readP p = eitherReader $ \s -> case [ r' | (r',"") <- P.readP_to_S p s ] of
-                                    (r:_) -> Right r
-                                    _     -> Left ("invalid value " ++ show s)
-
-parsePlatform :: P.ReadP r Platform
-parsePlatform = do arch <- P.choice [P.string "i686" >> return I386, P.string "x86_64" >> return X86_64]
-                   _ <- P.char '-'
-                   os <- P.choice [P.string "linux" >> return Linux, P.string "darwin" >> return OSX]
-                   return (Platform arch os)
-
-pinfo :: ParserInfo Options
-pinfo = info
-        (   helper
-        <*> infoOption ("cabal2nix " ++ display version) (long "version" <> help "Show version number")
-        <*> options
-        )
-        (  fullDesc
-        <> header "cabal2nix converts Cabal files into build instructions for Nix."
-        <> progDescDoc (Just (P2.vcat
-                     [ P2.text ""
-                     , P2.text "Recognized URI schemes:"
-                     , P2.text ""
-                     , P2.text "  cabal://pkgname-pkgversion     download the specified package from Hackage"
-                     , P2.text "  cabal://pkgname                download latest version of this package from Hackage"
-                     , P2.text "  file:///local/path             load the Cabal file from the local disk"
-                     , P2.text "  /local/path                    abbreviated version of file URI"
-                     , P2.text "  <git/svn/bzr/hg URL>           download the source from the specified repository"
-                     , P2.text ""
-                     , P2.fillSep (map P2.text (words (  "If the URI refers to a cabal file, information for building the package "
-                                                      ++ "will be retrieved from that file, but hackage will be used as a source "
-                                                      ++ "for the derivation. Otherwise, the supplied URI will be used to as the "
-                                                      ++ "souce for the derivation and the information is taken from the cabal file "
-                                                      ++ "at the root of the downloaded source."
-                                                      )))
-                     ]))
-        )
+import qualified Cabal2nix as C
 
 main :: IO ()
-main = bracket (return ()) (\() -> hFlush stdout >> hFlush stderr) $ \() -> do
-  Options {..} <- execParser pinfo
-
-  pkg <- getPackage optHackageDb $ Source optUrl (fromMaybe "" optRevision) (maybe UnknownHash Guess optSha256) (fromMaybe "" optSubpath)
-
-  let
-      deriv :: Derivation
-      deriv = fromGenericPackageDescription (const True)
-                                            (\i -> Just (binding # (i, path # [i])))
-                                            optSystem
-                                            (unknownCompilerInfo optCompiler NoAbiTag)
-                                            (readFlagList optFlags)
-                                            []
-                                            (pkgCabal pkg)
-              & src .~ pkgSource pkg
-              & subpath .~ (fromMaybe "." optSubpath)
-              & runHaddock .~ optHaddock
-              & jailbreak .~ optJailbreak
-              & hyperlinkSource .~ optHyperlinkSource
-              & enableLibraryProfiling .~ (fromMaybe False optEnableProfiling || optEnableLibraryProfiling)
-              & enableExecutableProfiling .~ (fromMaybe False optEnableProfiling || optEnableExecutableProfiling)
-              & metaSection.maintainers .~ Set.fromList (map (review ident) optMaintainer)
---            & metaSection.platforms .~ Set.fromList optPlatform
-              & doCheck &&~ optDoCheck
-              & extraFunctionArgs %~ Set.union (Set.fromList ("inherit stdenv":map (fromString . ("inherit " ++)) optExtraArgs))
-
-      shell :: Doc
-      shell = vcat
-              [ text "{ nixpkgs ? import <nixpkgs> {}, compiler ? \"default\" }:"
-              , text ""
-              , text "let"
-              , text ""
-              , text "  inherit (nixpkgs) pkgs;"
-              , text ""
-              , hcat [ text "  f = ", pPrint deriv, semi ]
-              , text ""
-              , text "  haskellPackages = if compiler == \"default\""
-              , text "                       then pkgs.haskellPackages"
-              , text "                       else pkgs.haskell.packages.${compiler};"
-              , text ""
-              , text "  drv = haskellPackages.callPackage f {};"
-              , text ""
-              , text "in"
-              , text ""
-              , text "  if pkgs.lib.inNixShell then drv.env else drv"
-              ]
-
-  print (if optNixShellOutput then shell else pPrint deriv)
-
-readFlagList :: [String] -> FlagAssignment
-readFlagList = map tagWithValue
-  where tagWithValue ('-':fname) = (FlagName (lowercase fname), False)
-        tagWithValue fname       = (FlagName (lowercase fname), True)
+main = C.main
diff --git a/hackage2nix/HackageGit.hs b/hackage2nix/HackageGit.hs
--- a/hackage2nix/HackageGit.hs
+++ b/hackage2nix/HackageGit.hs
@@ -3,23 +3,23 @@
 
 module HackageGit where
 
-import Control.Monad
 import Control.Lens hiding ( (<.>) )
+import Control.Monad
 import Data.Aeson
 import Data.ByteString.Char8 ( ByteString )
 import qualified Data.ByteString.Char8 as BS
-import Data.ByteString.Lazy.Char8 ( fromStrict )
-import Data.Digest.Pure.SHA ( sha256, showDigest )
 import Data.Map as Map
 import Data.Set as Set
 import Data.String
 import Data.String.UTF8 ( toString, fromRep )
+import Distribution.Nixpkgs.Hashes
 import Distribution.Nixpkgs.Haskell.OrphanInstances ( )
 import Distribution.Package
 import Distribution.PackageDescription
 import Distribution.PackageDescription.Parse ( parsePackageDescription, ParseResult(..) )
 import Distribution.Text
 import Distribution.Version
+import OpenSSL.Digest ( digest, digestByName )
 import System.Directory
 import System.FilePath
 
@@ -50,10 +50,7 @@
   cabal <- case parsePackageDescription (decodeUTF8 buf) of
              ParseOk _ a  -> return a
              ParseFailed err -> fail (cabalFile ++ ": " ++ show err)
-  return (cabal, mkSHA256 buf)
-
-mkSHA256 :: ByteString -> SHA256Hash
-mkSHA256 = showDigest . sha256 . fromStrict
+  return (cabal, printSHA256 (digest (digestByName "sha256") buf))
 
 declareLenses [d|
   data Meta = Meta { hashes :: Map String String
@@ -76,4 +73,4 @@
   buf <- BS.readFile metaFile
   case eitherDecodeStrict buf of
     Left msg -> fail (metaFile ++ ": " ++ msg)
-    Right x  -> return x
+    Right x  -> return $ over (hashes . ix "SHA256") (printSHA256 . packHex) x
diff --git a/src/Cabal2nix.hs b/src/Cabal2nix.hs
new file mode 100644
--- /dev/null
+++ b/src/Cabal2nix.hs
@@ -0,0 +1,174 @@
+{-# LANGUAGE RecordWildCards #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module Cabal2nix
+  ( main, cabal2nix
+  )
+  where
+
+import Control.Exception ( bracket )
+import Control.Lens
+import Data.Maybe ( fromMaybe )
+import Data.Monoid ( (<>) )
+import qualified Data.Set as Set
+import Data.String
+import qualified Distribution.Compat.ReadP as P
+import Distribution.Compiler
+import Distribution.Nixpkgs.Fetch
+import Distribution.Nixpkgs.Haskell
+import Distribution.Nixpkgs.Haskell.FromCabal
+import Distribution.Nixpkgs.Haskell.PackageSourceSpec
+import Distribution.Nixpkgs.Meta
+import Distribution.PackageDescription ( FlagName(..), FlagAssignment )
+import Distribution.Simple.Utils ( lowercase )
+import Distribution.System
+import Distribution.Text
+import Language.Nix
+import Options.Applicative
+import Paths_cabal2nix ( version )
+import System.Environment ( getArgs )
+import System.IO ( hFlush, stdout, stderr )
+import qualified Text.PrettyPrint.ANSI.Leijen as P2 hiding ( (<$>), (<>) )
+import Text.PrettyPrint.HughesPJClass ( Doc, Pretty(..), text, vcat, hcat, semi )
+
+data Options = Options
+  { optSha256 :: Maybe String
+  , optMaintainer :: [String]
+--, optPlatform :: [String]                                         -- TODO: fix command line handling of platforms
+  , optHaddock :: Bool
+  , optDoCheck :: Bool
+  , optJailbreak :: Bool
+  , optRevision :: Maybe String
+  , optHyperlinkSource :: Bool
+  , optEnableLibraryProfiling :: Bool
+  , optEnableExecutableProfiling :: Bool
+  , optEnableProfiling :: Maybe Bool
+  , optExtraArgs :: [String]
+  , optHackageDb :: Maybe FilePath
+  , optNixShellOutput :: Bool
+  , optFlags :: [String]
+  , optCompiler :: CompilerId
+  , optSystem :: Platform
+  , optSubpath :: Maybe FilePath
+  , optUrl :: String
+  }
+  deriving (Show)
+
+options :: Parser Options
+options = Options
+          <$> optional (strOption $ long "sha256" <> metavar "HASH" <> help "sha256 hash of source tarball")
+          <*> many (strOption $ long "maintainer" <> metavar "MAINTAINER" <> help "maintainer of this package (may be specified multiple times)")
+--        <*> many (strOption $ long "platform" <> metavar "PLATFORM" <> help "supported build platforms (may be specified multiple times)")
+          <*> flag True False (long "no-haddock" <> help "don't run Haddock when building this package")
+          <*> flag True False (long "no-check" <> help "don't run regression test suites of this package")
+          <*> switch (long "jailbreak" <> help "disregard version restrictions on build inputs")
+          <*> optional (strOption $ long "revision" <> help "revision to use when fetching from VCS")
+          <*> flag True False (long "no-hyperlink-source" <> help "don't generate pretty-printed source code for the documentation")
+          <*> switch (long "enable-library-profiling" <> help "enable library profiling in the generated build")
+          <*> switch (long "enable-executable-profiling" <> help "enable executable profiling in the generated build")
+          <*> optional (switch (long "enable-profiling" <> help "enable both library and executable profiling in the generated build"))
+          <*> many (strOption $ long "extra-arguments" <> help "extra parameters required for the function body")
+          <*> optional (strOption $ long "hackage-db" <> metavar "PATH" <> help "path to the local hackage db in tar format")
+          <*> switch (long "shell" <> help "generate output suitable for nix-shell")
+          <*> many (strOption $ short 'f' <> long "flag" <> help "Cabal flag (may be specified multiple times)")
+          <*> option (readP parse) (long "compiler" <> help "compiler to use when evaluating the Cabal file" <> value buildCompilerId <> showDefaultWith display)
+          <*> option (readP parsePlatform) (long "system" <> help "target system to use when evaluating the Cabal file" <> value buildPlatform <> showDefaultWith display)
+          <*> optional (strOption $ long "subpath" <> metavar "PATH" <> help "Path to Cabal file's directory relative to the URI (default is root directory)")
+          <*> strArgument (metavar "URI")
+
+readP :: P.ReadP a a -> ReadM a
+readP p = eitherReader $ \s -> case [ r' | (r',"") <- P.readP_to_S p s ] of
+                                    (r:_) -> Right r
+                                    _     -> Left ("invalid value " ++ show s)
+
+parsePlatform :: P.ReadP r Platform
+parsePlatform = do arch <- P.choice [P.string "i686" >> return I386, P.string "x86_64" >> return X86_64]
+                   _ <- P.char '-'
+                   os <- P.choice [P.string "linux" >> return Linux, P.string "darwin" >> return OSX]
+                   return (Platform arch os)
+
+pinfo :: ParserInfo Options
+pinfo = info
+        (   helper
+        <*> infoOption ("cabal2nix " ++ display version) (long "version" <> help "Show version number")
+        <*> options
+        )
+        (  fullDesc
+        <> header "cabal2nix converts Cabal files into build instructions for Nix."
+        <> progDescDoc (Just (P2.vcat
+                     [ P2.text ""
+                     , P2.text "Recognized URI schemes:"
+                     , P2.text ""
+                     , P2.text "  cabal://pkgname-pkgversion     download the specified package from Hackage"
+                     , P2.text "  cabal://pkgname                download latest version of this package from Hackage"
+                     , P2.text "  file:///local/path             load the Cabal file from the local disk"
+                     , P2.text "  /local/path                    abbreviated version of file URI"
+                     , P2.text "  <git/svn/bzr/hg URL>           download the source from the specified repository"
+                     , P2.text ""
+                     , P2.fillSep (map P2.text (words (  "If the URI refers to a cabal file, information for building the package "
+                                                      ++ "will be retrieved from that file, but hackage will be used as a source "
+                                                      ++ "for the derivation. Otherwise, the supplied URI will be used to as the "
+                                                      ++ "souce for the derivation and the information is taken from the cabal file "
+                                                      ++ "at the root of the downloaded source."
+                                                      )))
+                     ]))
+        )
+
+main :: IO ()
+main = bracket (return ()) (\() -> hFlush stdout >> hFlush stderr) $ \() ->
+  cabal2nix =<< getArgs
+
+cabal2nix :: [String] -> IO ()
+cabal2nix args = do
+  Options {..} <- handleParseResult $ execParserPure defaultPrefs pinfo args
+
+  pkg <- getPackage optHackageDb $ Source optUrl (fromMaybe "" optRevision) (maybe UnknownHash Guess optSha256) (fromMaybe "" optSubpath)
+
+  let
+      deriv :: Derivation
+      deriv = fromGenericPackageDescription (const True)
+                                            (\i -> Just (binding # (i, path # [i])))
+                                            optSystem
+                                            (unknownCompilerInfo optCompiler NoAbiTag)
+                                            (readFlagList optFlags)
+                                            []
+                                            (pkgCabal pkg)
+              & src .~ pkgSource pkg
+              & subpath .~ (fromMaybe "." optSubpath)
+              & runHaddock .~ optHaddock
+              & jailbreak .~ optJailbreak
+              & hyperlinkSource .~ optHyperlinkSource
+              & enableLibraryProfiling .~ (fromMaybe False optEnableProfiling || optEnableLibraryProfiling)
+              & enableExecutableProfiling .~ (fromMaybe False optEnableProfiling || optEnableExecutableProfiling)
+              & metaSection.maintainers .~ Set.fromList (map (review ident) optMaintainer)
+--            & metaSection.platforms .~ Set.fromList optPlatform
+              & doCheck &&~ optDoCheck
+              & extraFunctionArgs %~ Set.union (Set.fromList ("inherit stdenv":map (fromString . ("inherit " ++)) optExtraArgs))
+
+      shell :: Doc
+      shell = vcat
+              [ text "{ nixpkgs ? import <nixpkgs> {}, compiler ? \"default\" }:"
+              , text ""
+              , text "let"
+              , text ""
+              , text "  inherit (nixpkgs) pkgs;"
+              , text ""
+              , hcat [ text "  f = ", pPrint deriv, semi ]
+              , text ""
+              , text "  haskellPackages = if compiler == \"default\""
+              , text "                       then pkgs.haskellPackages"
+              , text "                       else pkgs.haskell.packages.${compiler};"
+              , text ""
+              , text "  drv = haskellPackages.callPackage f {};"
+              , text ""
+              , text "in"
+              , text ""
+              , text "  if pkgs.lib.inNixShell then drv.env else drv"
+              ]
+
+  print (if optNixShellOutput then shell else pPrint deriv)
+
+readFlagList :: [String] -> FlagAssignment
+readFlagList = map tagWithValue
+  where tagWithValue ('-':fname) = (FlagName (lowercase fname), False)
+        tagWithValue fname       = (FlagName (lowercase fname), True)
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
@@ -143,8 +143,8 @@
 libNixName "wayland-egl"                        = return "mesa"
 libNixName "wayland-server"                     = return "wayland"
 -- These are the old APIs, of which 2.4 is the last provider, so map directly to that
-libNixName "javascriptcoregtk-3.0"              = return "webkitgtk24x"
-libNixName "webkitgtk-3.0"                      = return "webkitgtk24x"
+libNixName "javascriptcoregtk-3.0"              = return "webkitgtk24x-gtk3"
+libNixName "webkitgtk-3.0"                      = return "webkitgtk24x-gtk3"
 -- This is the current API, so let it reference an alias for the latest version
 libNixName "javascriptcoregtk-4.0"              = return "webkitgtk"
 libNixName "webkit2gtk-4.0"                     = return "webkitgtk"
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
@@ -94,7 +94,7 @@
   , ("mysql", set (libraryDepends . system . contains (pkg "mysql")) True)
   , ("network-attoparsec", set doCheck False) -- test suite requires network access
   , ("numeric-qq", set doCheck False) -- test suite doesn't finish even after 1+ days
-  , ("opencv", set phaseOverrides "hardeningDisable = [ \"bindnow\" ];")
+  , ("opencv", opencvOverrides)
   , ("pandoc >= 1.16.0.2", set doCheck False) -- https://github.com/jgm/pandoc/issues/2709 and https://github.com/fpco/stackage/issues/1332
   , ("pandoc-citeproc", set doCheck False) -- https://github.com/jgm/pandoc-citeproc/issues/172
   , ("pandoc", set jailbreak False) -- jailbreak-cabal break the build
@@ -124,7 +124,8 @@
   , ("wxc", wxcHook)
   , ("X11", over (libraryDepends . system) (Set.union (Set.fromList $ map bind ["pkgs.xorg.libXinerama","pkgs.xorg.libXext","pkgs.xorg.libXrender"])))
   , ("xmonad", set phaseOverrides xmonadPostInstall)
-  , ("zip-archive", over (testDepends . tool) (replace (bind "self.zip") (pkg "zip")))
+  , ("zip-archive < 0.3.1", over (testDepends . tool) (replace (bind "self.zip") (pkg "zip")))
+  , ("zip-archive >= 0.3.1", set (testDepends . tool . contains (pkg "zip")) True)  -- https://github.com/jgm/zip-archive/issues/35
   ]
 
 pkg :: Identifier -> Binding
@@ -160,9 +161,13 @@
   where
     gitAnnexOverrides = unlines
       [ "preConfigure = \"export HOME=$TEMPDIR; patchShebangs .\";"
-      , "postBuild = \"ln -sf dist/build/git-annex/git-annex git-annex\";"
       , "installPhase = \"make PREFIX=$out BUILDER=: install\";"
-      , "checkPhase = \"./git-annex test\";"
+      , "checkPhase = ''"
+      , "  ln -sf dist/build/git-annex/git-annex git-annex"
+      , "  ln -sf git-annex git-annex-shell"
+      , "  export PATH+=\":$PWD\""
+      , "  git-annex test"
+      , "'';"
       , "enableSharedExecutables = false;"
       ]
     buildInputs = pkgs ["git","rsync","gnupg","curl","wget","lsof","openssh","which","bup","perl"]
@@ -284,3 +289,9 @@
 webkitgtk24xHook :: Derivation -> Derivation    -- https://github.com/NixOS/cabal2nix/issues/145
 webkitgtk24xHook = set (libraryDepends . pkgconfig . contains (pkg "webkitgtk24x")) True
                  . over (libraryDepends . pkgconfig) (Set.filter (\b -> view localName b /= "webkitgtk24x"))
+
+opencvOverrides :: Derivation -> Derivation
+opencvOverrides = set phaseOverrides "hardeningDisable = [ \"bindnow\" ];"
+                . over (libraryDepends . pkgconfig) (replace (pkg "opencv") (pkg "opencv3"))
+                . set (configureFlags . contains "--with-gcc=${stdenv.cc}/bin/c++") True
+                . set (configureFlags . contains "--with-ld=${stdenv.cc}/bin/c++") True
diff --git a/src/Distribution/Nixpkgs/Haskell/Hackage.hs b/src/Distribution/Nixpkgs/Haskell/Hackage.hs
--- a/src/Distribution/Nixpkgs/Haskell/Hackage.hs
+++ b/src/Distribution/Nixpkgs/Haskell/Hackage.hs
@@ -1,10 +1,11 @@
 module Distribution.Nixpkgs.Haskell.Hackage ( readHashedHackage, readHashedHackage', module Distribution.Hackage.DB ) where
 
 import Data.ByteString.Lazy ( ByteString )
-import Data.Digest.Pure.SHA ( sha256, showDigest )
 import Distribution.Hackage.DB
 import qualified Distribution.Hackage.DB.Parsed as Unparsed ( parsePackage )
 import qualified Distribution.Hackage.DB.Unparsed as Unparsed
+import Distribution.Nixpkgs.Hashes
+import OpenSSL.Digest ( digest, digestByName )
 
 -- | A variant of 'readHackage' that adds the SHA256 digest of the
 -- original Cabal file to the parsed 'GenericPackageDescription'. That
@@ -24,7 +25,7 @@
     parsePackage :: String -> Version -> ByteString -> GenericPackageDescription
     parsePackage name version buf =
       let pkg = Unparsed.parsePackage name version buf
-          hash = showDigest (sha256 buf)
+          hash = printSHA256 (digest (digestByName "sha256") buf)
       in
        pkg { packageDescription = (packageDescription pkg) {
                 customFieldsPD = ("X-Cabal-File-Hash", hash) : customFieldsPD (packageDescription pkg)
diff --git a/src/Distribution/Nixpkgs/Haskell/PackageSourceSpec.hs b/src/Distribution/Nixpkgs/Haskell/PackageSourceSpec.hs
--- a/src/Distribution/Nixpkgs/Haskell/PackageSourceSpec.hs
+++ b/src/Distribution/Nixpkgs/Haskell/PackageSourceSpec.hs
@@ -6,18 +6,19 @@
 import Control.Monad
 import Control.Monad.IO.Class
 import Control.Monad.Trans.Maybe
-import qualified Data.ByteString.Lazy.Char8 as BS8
-import Data.Digest.Pure.SHA ( sha256, showDigest )
+import qualified Data.ByteString.Lazy.Char8 as LBS8
 import Data.List ( isSuffixOf, isPrefixOf )
 import Data.Maybe
 import Data.Version
 import Distribution.Hackage.DB.Parsed
 import Distribution.Nixpkgs.Fetch
+import Distribution.Nixpkgs.Hashes
 import qualified Distribution.Nixpkgs.Haskell.Hackage as DB
 import qualified Distribution.Package as Cabal
 import Distribution.PackageDescription
 import qualified Distribution.PackageDescription as Cabal
 import Distribution.Text ( simpleParse )
+import OpenSSL.Digest ( digest, digestByName )
 import System.Directory ( doesDirectoryExist, doesFileExist, createDirectoryIfMissing, getHomeDirectory, getDirectoryContents )
 import System.Exit ( exitFailure )
 import System.FilePath ( (</>), (<.>) )
@@ -145,8 +146,8 @@
   -- wrap the whole block in `catchIO`, because of lazy IO. The `case` will force
   -- the reading of the file, so we will always catch the expression here.
   MaybeT $ handleIO (\err -> Nothing <$ hPutStrLn stderr ("*** parsing cabal file: " ++ show err)) $ do
-    buf <- BS8.readFile file
-    let hash = showDigest (sha256 buf)
+    buf <- LBS8.readFile file
+    let hash = printSHA256 (digest (digestByName "sha256") buf)
     case parsePackage' buf of
       Left msg    -> if failHard
                      then fail ("*** cannot parse " ++ show file ++ ": " ++ msg)
diff --git a/test/Main.hs b/test/Main.hs
deleted file mode 100644
--- a/test/Main.hs
+++ /dev/null
@@ -1,6 +0,0 @@
-module Main ( main ) where
-
-import Test.DocTest
-
-main :: IO ()
-main = doctest [ "-isrc", "src" ]
diff --git a/test/doctests.hs b/test/doctests.hs
new file mode 100644
--- /dev/null
+++ b/test/doctests.hs
@@ -0,0 +1,6 @@
+module Main ( main ) where
+
+import Test.DocTest
+
+main :: IO ()
+main = doctest ["src"]
