diff --git a/overlay/genode/default.nix b/overlay/genode/default.nix
index e281c52..b9f7ea6 100644
--- a/overlay/genode/default.nix
+++ b/overlay/genode/default.nix
@@ -27,7 +27,8 @@ let
     };
 
     nativeBuildInputs = [ expect gnumake tcl ];
-    patches = [ ./init.xsd.patch ./svn-trust-server-cert.patch ];
+    patches =
+      [ ./init.xsd.patch ./openssl.patch ./svn-trust-server-cert.patch ];
     configurePhase = ''
       patchShebangs ./tool
       substituteInPlace repos/base/etc/tools.conf \
@@ -72,28 +73,33 @@ let
       dontConfigure = true;
 
       nativeBuildInputs =
-        [ bison flex gitMinimal glibc glibcLocales rsync wget which ]
+        [ bison flex gitMinimal glibc glibcLocales wget which ]
         ++ (args.nativeBuildInputs or [ ]);
 
-      buildPhase = ''
-        runHook preBuild
-        export CONTRIB_DIR=$NIX_BUILD_TOP/contrib
-        mkdir $CONTRIB_DIR
-        $GENODE_DIR/tool/ports/prepare_port $pname
-        runHook postBuild
-      '';
+      buildPhase =
+        # ignore the port hash, its only for the inputs
+        ''
+          runHook preBuild
+          export CONTRIB_DIR=$NIX_BUILD_TOP/contrib
+          mkdir $CONTRIB_DIR
+          $GENODE_DIR/tool/ports/prepare_port $pname CHECK_HASH=no
+          runHook postBuild
+        '';
 
-      installPhase = ''
-        runHook preInstall
-        rsync $CONTRIB_DIR/* $out/ \
-          -lr --copy-unsafe-links \
-          --exclude '*.git' \
-          --exclude '*.svn' \
-          --exclude '*.gz' \
-          --exclude '*.xz' \
+      installPhase =
+        # this trash is non-deterministic
+        ''
+          runHook preInstall
+          chmod -R +w $CONTRIB_DIR/*
+          find $CONTRIB_DIR/* -name .git -exec rm -rf {} \; || true
+          find $CONTRIB_DIR/* -name .svn -exec rm -rf {} \; || true
+          find $CONTRIB_DIR/* -name '*.t?z' -exec rm -rf {} \; || true
+          find $CONTRIB_DIR/* -name '*.tar.*' -exec rm -rf {} \; || true
 
-        runHook postInstall
-      '';
+          mkdir $out
+          cp -a $CONTRIB_DIR/* $out/
+          runHook postInstall
+        '';
     });
 
   ports = stdenv.lib.mapAttrs preparePort
diff --git a/overlay/genode/openssl.patch b/overlay/genode/openssl.patch
new file mode 100644
index 0000000..73ebb95
--- /dev/null
+++ b/overlay/genode/openssl.patch
@@ -0,0 +1,13 @@
+diff --git a/repos/libports/ports/openssl.port b/repos/libports/ports/openssl.port
+index 7cdb34b07a..081a6a9a54 100644
+--- a/repos/libports/ports/openssl.port
++++ b/repos/libports/ports/openssl.port
+@@ -2,7 +2,7 @@ LICENSE   := OpenSSL
+ VERSION   := 1.0.2q
+ DOWNLOADS := openssl.archive
+ 
+-URL(openssl) := https://www.openssl.org/source/openssl-$(VERSION).tar.gz
++URL(openssl) := https://www.openssl.org/source/old/1.0.2/openssl-1.0.2q.tar.gz
+ SHA(openssl) := 5744cfcbcec2b1b48629f7354203bc1e5e9b5466998bbccc5b5fcde3b18eb684
+ DIR(openssl) := src/lib/openssl
+ 
diff --git a/overlay/genode/ports.nix b/overlay/genode/ports.nix
index 6f05f3d..1f94365 100644
--- a/overlay/genode/ports.nix
+++ b/overlay/genode/ports.nix
@@ -2,38 +2,38 @@
 { buildPackages }:
 with buildPackages; {
   dde_bsd.hash = "sha256-2ilZs6JkcQAvU/sQYnHunGtGRZDt7qLTpKZxQxSOf2I=";
-  dde_ipxe.hash = "sha256-KAmDF2t+xKzkEjWZ1bvLO8O+IlaV0ImuFsd8SIC3UQw=";
-  dde_linux.hash = "sha256-a1oaYF5S8OazyCOu/Jq+YOfrN4Kyb4JesLs222Vanjc=";
+  dde_ipxe.hash = "sha256-uK110Cr01D6I2Fo0ZNP5U7rheseuH7LsghSPdFaGU3k=";
+  dde_linux.hash = "sha256-3G5Mprv9ZBNhDJRuVF6Nrkp3KbFaN10IKFq0OdyAY9M=";
   dde_rump = {
     hash = "sha256-Wr5otGkWEa+5xImsFHQzwap5LckNEbyWA/7xbNcOreI=";
     nativeBuildInputs = [ subversion ];
   };
-  expat.hash = "sha256-m4Q/rIeBCe/nxCksipQTAOCNSl2KYF4nItswXmhdKyk=";
+  expat.hash = "sha256-6Kz8qHmSg9/r+o3UJX8ZyB5aDjmfrbsUW/TppbB16jk=";
   jitterentropy.hash = "sha256-6KS732GxtUMz0xPYKtshdn039DgdJq11vTDQesZn4Ds=";
-  jpeg.hash = "sha256-NyO72pMphX/QyPJl5CqX/gJbDhEIwCYbXf18HQBaFEI=";
+  jpeg.hash = "sha256-fiRwzwEDVd1Xgd+k4WOez8AfR4brsBg7g0D9+9VJZr4=";
   libc = {
-    hash = "sha256-xAydMqf2+OTNt7nMUk0KTTil7sIIWGvn0Ytmepkc3rI=";
+    hash = "sha256-RL5l7GHlczc/6Uils9WCuPh9cCawx6XZ4H0HLPdMmAA=";
     nativeBuildInputs = [ buildPackages.gcc subversion ];
   };
-  libiconv.hash = "sha256-3PWJJg0rQTa789Jb5RnuHN0nfBKFnd0g+J7Vk7uXn5c=";
-  libpng.hash = "sha256-bAUkafClnl+BDv0X2xs1iY4rlHVHkGxnb7UfPkCSeds=";
+  libiconv.hash = "sha256-H1BPWDmQ4s0zLnCitg+kz2yNeTU7+S7/w58SqmvHWGQ=";
+  libpng.hash = "sha256-N69Q7ciQuW4sFl5k5XIe7rdkQvYZ3qfo6FlvgDgDGJo=";
   libssh.hash = "sha256-Z/1YdhISh2kqBjWiTOLkS+usoeeekJvAuYrVUgpxnQM=";
-  lighttpd.hash = "sha256-aBClCnOfbPSgisCTHquNhXAzkeslFp0ckK/lazr9AoE=";
-  lwip.hash = "sha256-V0Lo4DcY/Ai60kQmYB92BVlNX+QRLsymM5unXAvP0VI=";
-  lz4.hash = "sha256-Ndpv4NmZTeB737l2ywLrnXoqKzyCaBFMZl7ULfr14lY=";
+  lighttpd.hash = "sha256-fJ5w2YhTwjK+z6+VK50InPnDM5AmMnAwh0imx04sr5E=";
+  lwip.hash = "sha256-mB7RI9ITvS5IDawQS4pXBcDQDQhtXEk3w0Deis+SzLQ=";
+  lz4.hash = "sha256-IFfj+D5l+BE6JnuN0+doIAvTzXz5SHCQ+EF2m75UK08=";
   mesa = {
-    hash = "sha256-vkVbWFKO9OXOb8sEhkCL9x4gxxXjRhM41WXsB7YL/4Q=";
+    hash = "sha256-szIyFAIkL14xBMdszkox00y2uwGwjHDUyQ+5bhljiJ8=";
     nativeBuildInputs = [ python ];
   };
-  mupdf.hash = "sha256-AQwnVdHHWmqnHKvG3+I9zXUoC5IHD0MtS5mRh9u/V+o=";
-  openssl.hash = "sha256-VMMzzaSw17SMETAYwGYNgMDPPgDpMjgrPnhMV8/Pn8o=";
-  qemu-usb.hash = "sha256-PilJvNrJfz4iHj//mmARN47SVcA6+PTey/auTuQcs88=";
+  mupdf.hash = "sha256-+Q4IwYGLynoud2IEsKGfZQjpPRV6wFv5iI/ReAKBZcM=";
+  openssl.hash = "sha256-F0olTWYUwD//eJZ14ibN/IvbFXw3WQUZ/6cPI3lsxZI=";
+  qemu-usb.hash = "sha256-F4ZXeH5sx3FOcD42zFOxKFMsqGookKdav1NJ7YgVw98=";
   stb.hash = "sha256-9LSH1i8jcEvjRAmTvgtK+Axy9hO7uiSzmSgBvs0zkTc=";
-  stdcxx.hash = "sha256-Pec6B3ziRDRGFia0/XyeA3fo6fyevC0LynKU4xa8weI=";
+  stdcxx.hash = "sha256-U5/+yUBXQ+rKmy6hP7OomIU4g2KvSn2qTltQFzNz9Wo=";
   virtualbox5 = {
-    hash = "sha256-UEJTSD+jWc1arZ4ODqbfzM092UMZDiQlkbysxBdFE9w=";
+    hash = "sha256-yKarRyZBQL1rlSbFAOovdy5OeMRTQ95Es3Rl5Vcv0Qk=";
     nativeBuildInputs = [ iasl libxslt unzip yasm ];
   };
-  x86emu.hash = "sha256-Q/fOQjbU0Frtkj+f2rSKuYRSEIk4s569qf3UaTbElLY=";
-  zlib.hash = "sha256-bxTalPJBSs5yEMO2gFKvoR1PadepmkFGt6jcSZN/fgE=";
+  x86emu.hash = "sha256-QY6OL+cDVjQ67JItP1rS4ufPRGZf43AZtWxwza/0q0w=";
+  zlib.hash = "sha256-+jl8Q3b+fw6P3aNDfLi8lohBJNaoapEld5BcE0GGTWg=";
 }