From 4b6bdc29b0b7f1c3cc2b4952c2774a8baccd45a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 20 Nov 2018 21:44:23 +0000
Subject: [PATCH 001/182] libpfm: fix cross compilation

---
 pkgs/development/libraries/libpfm/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index ffd195b6462d..36e99c8cd911 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
 
   installFlags = "DESTDIR=\${out} PREFIX= LDCONFIG=true";
 
+  makeFlags = [
+    "ARCH=${stdenv.targetPlatform.uname.processor}"
+    "SYS=${stdenv.targetPlatform.uname.system}"
+  ];
+
   NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
 
   meta = with stdenv.lib; {

From f17ff7d6efa1727bb6fa1c33d9f7af3229d94083 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 26 Nov 2018 07:11:23 +0000
Subject: [PATCH 002/182] freetype: fix cross-build

---
 pkgs/development/libraries/freetype/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 5a11d03c5917..59ffd47c3104 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -62,6 +62,9 @@ in stdenv.mkDerivation rec {
   doCheck = true;
 
   postInstall = glib.flattenInclude + ''
+    substituteInPlace $dev/bin/freetype-config \
+      --replace ${buildPackages.pkgconfig} ${pkgconfig}
+
     wrapProgram "$dev/bin/freetype-config" \
       --set PKG_CONFIG_PATH "$PKG_CONFIG_PATH:$dev/lib/pkgconfig"
   '';

From fbb114107d7fae6c0488cc7cc30d4786fc1dd9c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 26 Nov 2018 07:12:45 +0000
Subject: [PATCH 003/182] wayland: fix cross-build

---
 pkgs/development/libraries/wayland/default.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 866b1232aef5..c694cc7b4452 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkgconfig
-, libffi, libxml2
+, libffi, libxml2, wayland
 , expat ? null # Build wayland-scanner (currently cannot be disabled as of 1.7.0)
 }:
 
@@ -15,9 +15,18 @@ stdenv.mkDerivation rec {
     sha256 = "1xajhxad43izq9f7sbww1hlg42nayijy8xnp21kgpk09c6sw4wjf";
   };
 
-  configureFlags = [ "--with-scanner" "--disable-documentation" ];
+  configureFlags = [
+    "--disable-documentation"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "--with-host-scanner"
+  ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    pkgconfig
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    # for wayland-scanner during build
+    wayland
+  ];
 
   buildInputs = [ libffi /* docbook_xsl doxygen graphviz libxslt xmlto */ expat libxml2 ];
 

From 73d537672db04cb0273842f8adf9164a73450f57 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Fri, 5 Oct 2018 15:25:10 -0500
Subject: [PATCH 004/182] xcbuild: set -Wno-error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gcc doesn’t know all of the specific flags here. It is easier to just
set -Wno-error.
---
 pkgs/development/tools/xcbuild/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index e71375402c70..29325fad7243 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     rmdir $out/usr
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-aliasing";
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = [ "-GNinja" ];
 

From 27aed1b6426d204d4db32222b9e846945654c340 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 1 Dec 2018 02:08:04 +0100
Subject: [PATCH 005/182] libinput: fix docs & libinput command

libinput switched from Doxygen to Sphinx for user docs. Since Sphinx is a Python
module, it propagates Python. And because it is listed in nativeBuildInputs,
its python binary takes precedence over the one added in buildInputs.
This results in a wrong interpreter being substituted into shebangs.

The contamination occurred previously too but libinput does not use pyparsing
dependency since 1.12.0, so it could be removed.

I prevented Sphinx from propagating Python and added some additional
dependencies to it. In the future we might want something more reusable.

While at it, I also fixed the tests.
---
 .../libraries/libinput/default.nix            | 36 ++++++++++++++-----
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 1a903978fb8d..09fa16fcf1d2 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -2,15 +2,26 @@
 , libevdev, mtdev, udev, libwacom
 , documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
 , eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
-, testsSupport ? false, check ? null, valgrind ? null, python3Packages ? null
+, testsSupport ? false, check ? null, valgrind ? null, python3 ? null
 }:
 
-assert documentationSupport -> doxygen != null && graphviz != null;
+assert documentationSupport -> doxygen != null && graphviz != null && python3 != null;
 assert eventGUISupport -> cairo != null && glib != null && gtk3 != null;
-assert testsSupport -> check != null && valgrind != null && python3Packages != null;
+assert testsSupport -> check != null && valgrind != null && python3 != null;
 
 let
   mkFlag = optSet: flag: "-D${flag}=${stdenv.lib.boolToString optSet}";
+
+  sphinx-build = if documentationSupport then
+    python3.pkgs.sphinx.overrideAttrs (super: {
+      propagatedBuildInputs = super.propagatedBuildInputs ++ (with python3.pkgs; [ recommonmark sphinx_rtd_theme ]);
+
+      postFixup = super.postFixup or "" + ''
+        # Do not propagate Python
+        rm $out/nix-support/propagated-build-inputs
+      '';
+    })
+  else null;
 in
 
 with stdenv.lib;
@@ -32,18 +43,25 @@ stdenv.mkDerivation rec {
     "--libexecdir=${placeholder "bin"}/libexec"
   ];
 
-  nativeBuildInputs = [ pkgconfig meson ninja python3Packages.python ]
-    ++ optionals documentationSupport [ doxygen graphviz ]
-    ++ optionals testsSupport [ check valgrind python3Packages.pyparsing ];
+  nativeBuildInputs = [ pkgconfig meson ninja ]
+    ++ optionals documentationSupport [ doxygen graphviz sphinx-build ]
+    ++ optionals testsSupport [ valgrind ];
 
-  buildInputs = [ libevdev mtdev libwacom ]
-    ++ optionals eventGUISupport [ cairo glib gtk3 ];
+  buildInputs = [ libevdev mtdev libwacom (python3.withPackages (pkgs: with pkgs; [ evdev ])) ]
+    ++ optionals eventGUISupport [ cairo glib gtk3 ]
+    ++ optionals testsSupport [ check ];
 
   propagatedBuildInputs = [ udev ];
 
   patches = [ ./udev-absolute-path.patch ];
 
-  doCheck = testsSupport;
+  postPatch = ''
+    patchShebangs tools/helper-copy-and-exec-from-tmp.sh
+    patchShebangs test/symbols-leak-test
+    patchShebangs test/check-leftover-udev-rules.sh
+  '';
+
+  doCheck = testsSupport && stdenv.hostPlatform == stdenv.buildPlatform;
 
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";

From 873967b7a5fc8616767bd5789f7ea0e2bb4aeaf7 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Mon, 3 Dec 2018 13:10:54 +0000
Subject: [PATCH 006/182] perl:5.28.0 -> 5.28.1

---
 pkgs/development/interpreters/perl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 8d21d92ef430..1eb3487166bd 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -180,8 +180,8 @@ in rec {
 
   # the latest Maint version
   perl528 = common {
-    version = "5.28.0";
-    sha256 = "1a3f822lcl8dr8v0hk80yyhpzqlljg49z9flb48rs3nbsij9z4ky";
+    version = "5.28.1";
+    sha256 = "0iy3as4hnbjfyws4in3j9d6zhhjxgl5m95i5n9jy2bnzcpz8bgry";
   };
 
   # the latest Devel version

From 03b9bc9e66423113f31f2836bac027c8e4e924b6 Mon Sep 17 00:00:00 2001
From: volth <volth@webmaster.ms>
Date: Mon, 3 Dec 2018 13:46:42 +0000
Subject: [PATCH 007/182] perl526: 5.26.2 -> 5.26.3

---
 pkgs/development/interpreters/perl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 1eb3487166bd..d3927fdee1d3 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -174,8 +174,8 @@ let
   });
 in rec {
   perl526 = common {
-    version = "5.26.2";
-    sha256 = "03gpnxx1g6hvlh0v4aqx00580h787sfywp1vlvw64q2xcbm9qbsp";
+    version = "5.26.3";
+    sha256 = "14y46c1cnrfnd1k5nk6fj5w5vxna5xav6pmk44qaabr9x06y8nmp";
   };
 
   # the latest Maint version

From f17dd04f12a6eccdf613968efca38cfd0edfd2c0 Mon Sep 17 00:00:00 2001
From: eburimu <urusan80@gmail.com>
Date: Thu, 6 Dec 2018 03:42:02 +0300
Subject: [PATCH 008/182] extlinux-conf: fix cross compilation

---
 .../generic-extlinux-compatible/extlinux-conf-builder.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
index 576a07c1d272..9ac6b6b12242 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
@@ -3,6 +3,6 @@
 pkgs.substituteAll {
   src = ./extlinux-conf-builder.sh;
   isExecutable = true;
-  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
-  inherit (pkgs) bash;
+  path = [pkgs.buildPackages.coreutils pkgs.buildPackages.gnused pkgs.buildPackages.gnugrep];
+  inherit (pkgs.buildPackages) bash;
 }

From 82e55907aea8ce9078e76c372c80a0cca4a3222d Mon Sep 17 00:00:00 2001
From: Ivan Kozik <ivan@ludios.org>
Date: Fri, 7 Dec 2018 01:10:03 +0000
Subject: [PATCH 009/182] erlang: disable parallel building

This fixes build errors like

 GEN    asn1ct_eval_ext.erl
{"init terminating in do_boot",{undef,[{asn1ct_func,start_link,[],[]},{prepare_templates,gen_asn1ct_eval,1,[{file,"prepare_templates.erl"},{line,58}]},{init,start_em,1,[]},{init,do_boot,3,[]}]}}
init terminating in do_boot ({undef,[{asn1ct_func,start_link,[],[]},{prepare_templates,gen_asn1ct_eval,1,[{_},{_}]},{init,start_em,1,[]},{init,do_boot,3,[]}]})

that occur on some machines but not others.
---
 pkgs/development/interpreters/erlang/generic-builder.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 0529c9f1e28c..bc0b728ecce4 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -59,7 +59,8 @@ in stdenv.mkDerivation ({
 
   debugInfo = enableDebugInfo;
 
-  enableParallelBuilding = true;
+  # On some machines, parallel build reliably crashes on `GEN    asn1ct_eval_ext.erl` step
+  enableParallelBuilding = false;
 
   # Clang 4 (rightfully) thinks signed comparisons of pointers with NULL are nonsense
   prePatch = ''

From 3183342fc16cb3f1201a475f53d4d26767f7b2e9 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Fri, 7 Dec 2018 20:03:18 -0600
Subject: [PATCH 010/182] libgpgerror: 1.32 -> 1.33

https://dev.gnupg.org/T4205
---
 pkgs/development/libraries/libgpg-error/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index e713eb7f8918..05ae29358fa4 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,11 +17,11 @@
   };
 in stdenv.mkDerivation (rec {
   name = "libgpg-error-${version}";
-  version = "1.32";
+  version = "1.33";
 
   src = fetchurl {
     url = "mirror://gnupg/libgpg-error/${name}.tar.bz2";
-    sha256 = "1jj08ns4sh1hmafqp1giskvdicdz18la516va26jycy27kkwaif3";
+    sha256 = "1zq3pw93d0ani8bam7f4qjivll1b0zg9qbblwwvcjip7ark84f2x";
   };
 
   postPatch = ''

From ff084c72564547347c0f5605ba822cd38091b256 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Fri, 7 Dec 2018 18:16:00 -0600
Subject: [PATCH 011/182] nettle: 3.4 -> 3.4.1 (security)

https://lists.gnu.org/archive/html/info-gnu/2018-12/msg00001.html
---
 pkgs/development/libraries/nettle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 5b998926f0a5..900451351c82 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.4";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "150y8655h629wn946dvzasq16qxsc1m9nf58mifvhl350bgl4ymf";
+    sha256 = "1bcji95n1iz9p9vsgdgr26v6s7zhpsxfbjjwpqcihpfd6lawyhgr";
   };
 })

From 965f95ce0186d0048d4fe287e9865d4db7595496 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 4 Dec 2018 00:55:04 -0600
Subject: [PATCH 012/182] sysvinit: 2.89 -> 2.93

---
 pkgs/os-specific/linux/sysvinit/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 7f84e1cc9b41..0927934b0ba3 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "2.89"; in
+let version = "2.93"; in
 
 stdenv.mkDerivation {
   name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
 
   src = fetchurl {
-    url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.bz2";
-    sha256 = "0rdw5lgg2rpcfdmq90br388qr01w89vsqmpvrqcqjqsmxk9zw3c2";
+    url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
+    sha256 = "1zx84vrzv615na661dd6mg4wh999m0jp25lsa241961x4c74cba7";
   };
 
   prePatch = ''

From 2ca39fe86b4c5581e4a3aa9d716df05db895d582 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 8 Dec 2018 19:25:43 +0000
Subject: [PATCH 013/182] llvm_7: fix cross-compiling

---
 pkgs/development/compilers/llvm/7/llvm.nix | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 67bde813feed..06024856356f 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -23,6 +23,18 @@ let
   # Used when creating a version-suffixed symlink of libLLVM.dylib
   shortVersion = with stdenv.lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
+
+  llvmTarget = platform:
+    if platform.parsed.cpu.family == "x86" then
+      "X86"
+    else if platform.parsed.cpu.name == "aarch64" then
+      "AArch64"
+    else if platform.parsed.cpu.family == "arm" then
+      "ARM"
+    else if platform.parsed.cpu.family == "mips" then
+      "Mips"
+    else
+      throw "Unsupported system";
 in stdenv.mkDerivation (rec {
   name = "llvm-${version}";
 
@@ -78,10 +90,9 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_ENABLE_RTTI=ON"
-
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
+    "-DLLVM_TARGETS_TO_BUILD=${llvmTarget stdenv.hostPlatform};${llvmTarget stdenv.targetPlatform}"
 
     "-DLLVM_ENABLE_DUMP=ON"
   ]

From b11fa4b69f9ea2f6a31a3b2faf0e3620907dea70 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 8 Dec 2018 14:58:15 -0800
Subject: [PATCH 014/182] libv4l: 1.16.0 -> 1.16.2

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/v4l-utils/versions
---
 pkgs/os-specific/linux/v4l-utils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index f586ea50398f..48d5923266db 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   name = "v4l-utils-${version}";
-  version = "1.16.0";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/v4l-utils/${name}.tar.bz2";
-    sha256 = "1b8bx9zfaw0crjkfh0wwyixbv4683mkw0cb3nxwc7fl489c2bd7i";
+    sha256 = "0iwfdp4ghzd6l9qg5545032vwmqy2rnhk0xf1g9mad67l74hhckc";
   };
 
   outputs = [ "out" "dev" ];

From c5ba3e15ab35dc987b446a1364a02662c7477720 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 8 Dec 2018 15:53:01 -0800
Subject: [PATCH 015/182] wildmidi: 0.4.2 -> 0.4.3

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/wildmidi/versions
---
 pkgs/development/libraries/wildmidi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 06a4e48827ed..3b0a447f7376 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, cmake, alsaLib, freepats }:
 
 stdenv.mkDerivation rec {
-  name = "wildmidi-0.4.2";
+  name = "wildmidi-0.4.3";
 
   src = fetchurl {
     url = "https://github.com/Mindwerks/wildmidi/archive/${name}.tar.gz";
-    sha256 = "178hm2wh5h7apkcb1a0dyla2ia8569php8ikz62rh0g6dp5l67am";
+    sha256 = "1igkxv4axnqap59d8pjgqj94x0khn3fdd2hq6wdvkd2v8nb5m3j9";
   };
 
   nativeBuildInputs = [ cmake ];

From ceaee844018ebcd4ca00d22bd4a8e36a2289f6f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 9 Dec 2018 13:45:49 +0000
Subject: [PATCH 016/182] ncurses: fix cross-build by disable stripping

Ncurses uses `install -s` to also strip the binaries while installing.
This broke the cross build because the wrong strip command was chosen.
---
 pkgs/development/libraries/ncurses/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 815db76d5ac3..f5995a8f480e 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
     "--enable-pc-files"
     "--enable-symlinks"
     "--with-manpage-format=normal"
+    "--disable-stripping"
   ] ++ lib.optional unicode "--enable-widec"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5"

From e7d55483d1f414cb57346df5a6cdca759ef9d7f0 Mon Sep 17 00:00:00 2001
From: eburimu <43167692+eburimu@users.noreply.github.com>
Date: Sun, 9 Dec 2018 16:32:38 +0200
Subject: [PATCH 017/182] libselinux: fix cross compilation (#51201)

libselinux needs native python to compute the installation prefix.
Swig generates the c code for the extension and needs python.h at compile,
so we put python into buildInputs
---
 pkgs/os-specific/linux/libselinux/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 915aee6fd860..51e1a3220941 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -19,9 +19,8 @@ stdenv.mkDerivation rec {
     sha256 = "0mwcq78v6ngbq06xmb9dvilpg0jnl2vs9fgrpakhmmiskdvc1znh";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libsepol pcre fts ]
-             ++ optionals enablePython [ swig python ];
+  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
+  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]

From 705babcdf0358e383388771acd0a663f59f05b18 Mon Sep 17 00:00:00 2001
From: c0bw3b <c0bw3b@users.noreply.github.com>
Date: Sun, 9 Dec 2018 17:12:53 +0100
Subject: [PATCH 018/182] iptables: prune libtool files after build

Otherwise -lpcap gets propagated to reverse deps
This can break strongswan build for example
https://github.com/NixOS/nixpkgs/pull/51252#issuecomment-445512680
---
 pkgs/os-specific/linux/iptables/default.nix      | 16 ++++++++++++----
 .../iptables/netinet-headers-collision.patch     | 11 -----------
 2 files changed, 12 insertions(+), 15 deletions(-)
 delete mode 100644 pkgs/os-specific/linux/iptables/netinet-headers-collision.patch

diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 8f98391021fd..ff6ce3b4889d 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, bison, flex, pkgconfig
+{ stdenv, fetchurl, fetchpatch, bison, flex, pkgconfig, pruneLibtoolFiles
 , libnetfilter_conntrack, libnftnl, libmnl, libpcap }:
 
 stdenv.mkDerivation rec {
@@ -21,16 +21,24 @@ stdenv.mkDerivation rec {
       url = "https://git.netfilter.org/iptables/patch/?id=51d374ba41ae4f1bb851228c06b030b83dd2092f";
       sha256 = "05fwrq03f9sm0v2bfwshbrg7pi2p978w1460arnmpay3135gj266";
     })
-    # extensions: libip6t_mh: fix bogus translation error
+    # Extensions: libip6t_mh: fix bogus translation error
     (fetchpatch {
       url = "https://git.netfilter.org/iptables/patch/?id=5839d7fe62ff667af7132fc7d589b386951f27b3";
       sha256 = "0578jn1ip710z9kijwg9g2vjq2kfrbafl03m1rgi4fasz215gvkf";
     })
     # Prevent headers collisions between linux and netfilter (in.h and in6.h)
-    (./netinet-headers-collision.patch)
+    # Fixed upstream with two commits
+    (fetchpatch {
+      url = "https://git.netfilter.org/iptables/patch/?id=8d9d7e4b9ef4c6e6abab2cf35c747d7ca36824bd";
+      sha256 = "0q3wcspiqym1r6dg1jhg7h8hpvsjzx1k7cs39z36mzlbmj9lm0zb";
+    })
+    (fetchpatch {
+      url = "https://git.netfilter.org/iptables/patch/?id=2908eda10bf9fc81119d4f3ad672c67918ab5955";
+      sha256 = "1dci4c8b7gcdrf77l2aicrcwlbp320xjz76fhavams0b4kgs6yr3";
+    })
   ];
 
-  nativeBuildInputs = [ bison flex pkgconfig ];
+  nativeBuildInputs = [ bison flex pkgconfig pruneLibtoolFiles ];
 
   buildInputs = [ libnetfilter_conntrack libnftnl libmnl libpcap ];
 
diff --git a/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch b/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch
deleted file mode 100644
index 940ffa0c29cc..000000000000
--- a/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -3,7 +3,9 @@
- 
- #include <linux/types.h>
- 
-+#ifndef _NETINET_IN_H
- #include <linux/in.h>
- #include <linux/in6.h>
-+#endif
- #include <limits.h>

From ec59713c5c317cfe8f0a0ffc90af55bbd3deeb1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 9 Dec 2018 23:01:59 +0000
Subject: [PATCH 019/182] perl: update perl-cross archive

---
 pkgs/development/interpreters/perl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index d3927fdee1d3..909991e03480 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -153,11 +153,11 @@ let
       platforms = platforms.all;
     };
   } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "ab8d05c9e695d3db4f7dc15c70f23623349c2f49"; # Oct 03, 2018
+    crossVersion = "276849e62f472c1b241d9e7b38a28e4cc9f98563"; # Dez 02, 2018
 
     perl-cross-src = fetchurlBoot {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1g7p7mqmx8x3diqvbh881gr72d106cn6yvm4gx7f0ars3n3b3wj0";
+      sha256 = "1fpr1m9lgkwdp1vmdr0s6gvmcpd0m8q6jwn024bkczc2h37bdynd";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];

From efa57f8820e77971d3212e838eebd36c6a046c83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 11:33:36 +0000
Subject: [PATCH 020/182] glib: fix cross -> inherit devdoc from native build

Glib uses gobject introspection to generate documentation.
If we would want to cross-compile those, we would need native binaries
from the previous build stage. Instead we can simply just copy over
the generated documentation.
---
 pkgs/development/libraries/glib/default.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 1eb50fc4f100..22acd530093e 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -2,6 +2,7 @@
 , libiconv, zlib, libffi, pcre, libelf, gnome3, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45
 # use utillinuxMinimal to avoid circular dependency (utillinux, systemd, glib)
 , utillinuxMinimal ? null
+, buildPackages
 
 # this is just for tests (not in the closure of any regular package)
 , doCheck ? stdenv.config.doCheckByDefault or false
@@ -78,12 +79,16 @@ stdenv.mkDerivation rec {
     utillinuxMinimal # for libmount
   ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 glibcLocales ];
+  nativeBuildInputs = [
+    meson ninja pkgconfig perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 glibcLocales
+  ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
+    # Avoid the need for gobject introspection binaries in PATH in cross-compiling case.
+    # Instead we just copy them over from the native output.
+    "-Dgtk_doc=${if stdenv.hostPlatform == stdenv.buildPlatform then "true" else "false"}"
   ];
 
   LC_ALL = "en_US.UTF-8";
@@ -126,6 +131,8 @@ stdenv.mkDerivation rec {
     # This file is *included* in gtk3 and would introduce runtime reference via __FILE__.
     sed '1i#line 1 "${name}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
       -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
+  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    cp -r ${buildPackages.glib.devdoc} $devdoc
   '';
 
   checkInputs = [ tzdata libxml2 desktop-file-utils shared-mime-info ];

From 900a01ad477e441cf2f1646ac841ab6690243d21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 13:57:03 +0000
Subject: [PATCH 021/182] radare2: fix cross-build

Only the make-based build support cross-compilation.
Also use less vendored libraries
---
 .../tools/analysis/radare2/default.nix        | 48 ++++++++++---------
 1 file changed, 26 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 55bae2740cc2..5b4bde0ff0af 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -1,10 +1,11 @@
 {stdenv, fetchFromGitHub
+, buildPackages
 , callPackage
-, ninja, meson , pkgconfig
+, pkgconfig
 , libusb, readline, libewf, perl, zlib, openssl
-, libuv
+, libuv, file, libzip, xxHash
 , gtk2 ? null, vte ? null, gtkdialog ? null
-, python ? null
+, python3 ? null
 , ruby ? null
 , lua ? null
 , useX11, rubyBindings, pythonBindings, luaBindings
@@ -12,7 +13,7 @@
 
 assert useX11 -> (gtk2 != null && vte != null && gtkdialog != null);
 assert rubyBindings -> ruby != null;
-assert pythonBindings -> python != null;
+assert pythonBindings -> python3 != null;
 
 
 let
@@ -49,39 +50,42 @@ let
         if ! grep -F "CS_TIP=${cs_tip}" shlr/Makefile; then echo "CS_TIP mismatch"; exit 1; fi
         # When using meson, it expects capstone source relative to build directory
         mkdir -p build/shlr
-        ln -s ${capstone} build/shlr/capstone
+        cp -r ${capstone} shlr/capstone
+        chmod -R +w shlr/capstone
       '';
 
       postInstall = ''
-        ln -s $out/bin/radare2 $out/bin/r2
         install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
       '';
 
-      mesonFlags = [
-        "-Dr2_version_commit=${version_commit}"
-        "-Dr2_gittap=${gittap}"
-        "-Dr2_gittip=${gittip}"
-        # 2.8.0 expects this, but later it becomes an option with default=false.
-        "-Dcapstone_in_builddir=true"
-
-        "-Duse_sys_openssl=true"
-        "-Duse_sys_zlib=true"
+      WITHOUT_PULL="1";
+      makeFlags = [
+        "GITTAP=${gittap}"
+        "GITTIP=${gittip}"
+        "RANLIB=${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.bintools.targetPrefix}ranlib"
+      ];
+      configureFlags = [
+        "--with-sysmagic"
+        "--with-syszip"
+        "--with-sysxxhash"
+        "--with-openssl"
       ];
 
       enableParallelBuilding = true;
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-      nativeBuildInputs = [ pkgconfig ninja meson ];
-      buildInputs = [ readline libusb libewf perl zlib openssl libuv ]
-        ++ optional useX11 [gtkdialog vte gtk2]
-        ++ optional rubyBindings [ruby]
-        ++ optional pythonBindings [python]
-        ++ optional luaBindings [lua];
+      nativeBuildInputs = [ pkgconfig ];
+      buildInputs = [ file libzip xxHash readline libusb libewf perl zlib openssl libuv ]
+        ++ optional useX11 [ gtkdialog vte gtk2 ]
+        ++ optional rubyBindings [ ruby ]
+        ++ optional pythonBindings [ python3 ]
+        ++ optional luaBindings [ lua ];
 
       meta = {
         description = "unix-like reverse engineering framework and commandline tools";
         homepage = http://radare.org/;
         license = stdenv.lib.licenses.gpl2Plus;
-        maintainers = with stdenv.lib.maintainers; [raskin makefu mic92];
+        maintainers = with stdenv.lib.maintainers; [ raskin makefu mic92 ];
         platforms = with stdenv.lib.platforms; linux;
         inherit version;
       };

From 9564b8ed9e77b527cb7443b3a7c62638454a3f31 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 10 Dec 2018 17:31:47 -0600
Subject: [PATCH 022/182] =?UTF-8?q?cctools:=20don=E2=80=99t=20depend=20on?=
 =?UTF-8?q?=20clang=20at=20runtime?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

--disable-clang-as flag disables the use of clang by cctools-port
---
 pkgs/os-specific/darwin/cctools/port.nix | 16 +++++++---------
 pkgs/stdenv/cross/default.nix            |  1 -
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 2bca1bcc1d75..864fdca7efae 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -29,15 +29,11 @@ let
 
     outputs = [ "out" "dev" ];
 
-    nativeBuildInputs = [
-      autoconf automake libtool autoreconfHook
-    ];
-    buildInputs = [ libuuid ] ++
-      stdenv.lib.optionals stdenv.isDarwin [ llvm libcxxabi libobjc ];
+    nativeBuildInputs = [ autoconf automake libtool autoreconfHook ];
+    buildInputs = [ libuuid ]
+      ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ];
 
-    patches = [
-      ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
-    ];
+    patches = [ ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch ];
 
     __propagatedImpureHostDeps = [
       # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
@@ -48,7 +44,9 @@ let
     enableParallelBuilding = true;
 
     # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
-    configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+    configurePlatforms = [ "build" "host" ]
+      ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+    configureFlags = [ "--disable-clang-as" ];
 
     postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace cctools/Makefile.am --replace libobjc2 ""
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index a6063049a3ad..4790145e01f6 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -60,7 +60,6 @@ in lib.init bootStages ++ [
         ++ lib.optionals
              (hostPlatform.isLinux && !buildPlatform.isLinux)
              [ buildPackages.patchelf buildPackages.paxctl ]
-        ++ lib.optional hostPlatform.isDarwin buildPackages.clang
         ++ lib.optional
              (let f = p: !p.isx86 || p.libc == "musl"; in f hostPlatform && !(f buildPlatform))
              buildPackages.updateAutotoolsGnuConfigScriptsHook

From 9ab67898f75be85acc2406f2110690b16d1f9b0a Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 10 Dec 2018 18:22:03 -0600
Subject: [PATCH 023/182] treewide: use "buildPackages" darwin for
 bootstrap_cmds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These are almost always from buildPackages. Another issue where
splicing doesn’t seem to pick them up correctly.
---
 pkgs/top-level/all-packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5191f9683a30..3f8ef8ce38dc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6607,7 +6607,7 @@ in
   };
 
   ccl = callPackage ../development/compilers/ccl {
-    inherit (darwin) bootstrap_cmds;
+    inherit (buildPackages.darwin) bootstrap_cmds;
   };
 
   cdb = callPackage ../development/tools/database/cdb { };
@@ -9080,7 +9080,7 @@ in
   jhiccup = callPackage ../development/tools/java/jhiccup { };
 
   valgrind = callPackage ../development/tools/analysis/valgrind {
-    inherit (darwin) xnu bootstrap_cmds cctools;
+    inherit (buildPackages.darwin) xnu bootstrap_cmds cctools;
   };
   valgrind-light = res.valgrind.override { gdb = null; };
 
@@ -10357,7 +10357,7 @@ in
   kinetic-cpp-client = callPackage ../development/libraries/kinetic-cpp-client { };
 
   krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
-    inherit (darwin) bootstrap_cmds;
+    inherit (buildPackages.darwin) bootstrap_cmds;
   };
   krb5Full = krb5;
   libkrb5 = krb5.override {
@@ -14010,7 +14010,7 @@ in
     inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa;
     inherit (darwin.apple_sdk.libs) Xplugin;
-    bootstrap_cmds = if stdenv.isDarwin then darwin.bootstrap_cmds else null;
+    inherit (buildPackages.darwin) bootstrap_cmds;
     udev = if stdenv.isLinux then udev else null;
     libdrm = if stdenv.isLinux then libdrm else null;
     abiCompat = config.xorg.abiCompat # `config` because we have no `xorg.override`

From 10ba78757f4f3630eb37ebae83d4b73353f2fbcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Tue, 11 Dec 2018 08:01:58 +0000
Subject: [PATCH 024/182] ruby: fix cross-build (#51842)

Enable autoreconfHook by default: The build tried to execute autoconf, which was
in the wrong build input. Regenerating autotools configure files is always a good
idea since it delivers fixes.
Also move groff to the native since it is only used at build-time
---
 pkgs/development/interpreters/ruby/default.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index f1d48578541e..1ee5c0b57ace 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -73,20 +73,16 @@ let
         # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
         NROFF = if docSupport then "${groff}/bin/nroff" else null;
 
-        nativeBuildInputs =
-             ops useRailsExpress [ autoreconfHook bison ]
-          ++ ops (stdenv.buildPlatform != stdenv.hostPlatform) [
-               buildPackages.ruby
-             ];
+        nativeBuildInputs = [ autoreconfHook bison ]
+          ++ (op docSupport groff)
+          ++ op (stdenv.buildPlatform != stdenv.hostPlatform) buildPackages.ruby;
         buildInputs =
              (op fiddleSupport libffi)
           ++ (ops cursesSupport [ ncurses readline ])
-          ++ (op docSupport groff)
           ++ (op zlibSupport zlib)
           ++ (op opensslSupport openssl)
           ++ (op gdbmSupport gdbm)
           ++ (op yamlSupport libyaml)
-          ++ (op isRuby25 autoconf)
           # Looks like ruby fails to build on darwin without readline even if curses
           # support is not enabled, so add readline to the build inputs if curses
           # support is disabled (if it's enabled, we already have it) and we're
@@ -149,7 +145,7 @@ let
         postInstall = ''
           # Update rubygems
           pushd rubygems
-          ${buildRuby} setup.rb
+          ${buildRuby} setup.rb --destdir $GEM_HOME
           popd
 
           # Remove unnecessary groff reference from runtime closure, since it's big

From dfdd3482065c0b10b8bbd1955e74c8e092230a02 Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Mon, 6 Nov 2017 14:42:01 +0000
Subject: [PATCH 025/182] kerberos-server: Fix sbin paths

tcpd doesn't have sbin anymore (so it was broken), and heimdal just symlinks to
bin.
---
 nixos/modules/services/system/kerberos.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
index e2c45ed64ac0..e6cfd0a8289c 100644
--- a/nixos/modules/services/system/kerberos.nix
+++ b/nixos/modules/services/system/kerberos.nix
@@ -60,5 +60,4 @@ in
       script = "${heimdalFull}/libexec/heimdal/kpasswdd";
     };
   };
-
 }

From ee3bd730d472b36bf620b0001519c5aab2073f09 Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Mon, 6 Nov 2017 16:08:41 +0000
Subject: [PATCH 026/182] kerberos-server: move kadmind to systemd

Don't use socket activation, as inetd is discouraged by heimdal documentation.
---
 nixos/modules/services/system/kerberos.nix | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
index e6cfd0a8289c..5647281db983 100644
--- a/nixos/modules/services/system/kerberos.nix
+++ b/nixos/modules/services/system/kerberos.nix
@@ -34,16 +34,10 @@ in
   config = mkIf config.services.kerberos_server.enable {
 
     environment.systemPackages = [ heimdalFull ];
-
-    services.xinetd.enable = true;
-    services.xinetd.services = lib.singleton
-      { name = "kerberos-adm";
-        flags = "REUSE NAMEINARGS";
-        protocol = "tcp";
-        user = "root";
-        server = "${pkgs.tcp_wrappers}/bin/tcpd";
-        serverArgs = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
-      };
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
+    };
 
     systemd.services.kdc = {
       description = "Key Distribution Center daemon";

From 4f9af77287b518831ad1267228382705537bb39e Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Mon, 6 Nov 2017 17:17:24 +0000
Subject: [PATCH 027/182] kerberos-server: cleanup of kerberos.nix

General cleanup before adding more options.
---
 nixos/modules/services/system/kerberos.nix | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
index 5647281db983..950756aa8369 100644
--- a/nixos/modules/services/system/kerberos.nix
+++ b/nixos/modules/services/system/kerberos.nix
@@ -1,22 +1,15 @@
 {pkgs, config, lib, ...}:
 
 let
-
   inherit (lib) mkOption mkIf;
-
-  inherit (pkgs) heimdalFull;
-
+  cfg = config.services.kerberos_server;
   stateDir = "/var/heimdal";
 in
 
 {
-
   ###### interface
-
   options = {
-
     services.kerberos_server = {
-
       enable = mkOption {
         default = false;
         description = ''
@@ -25,15 +18,13 @@ in
       };
 
     };
-
   };
 
 
   ###### implementation
 
-  config = mkIf config.services.kerberos_server.enable {
-
-    environment.systemPackages = [ heimdalFull ];
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.heimdalFull ];
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
       script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
@@ -45,13 +36,13 @@ in
       preStart = ''
         mkdir -m 0755 -p ${stateDir}
       '';
-      script = "${heimdalFull}/libexec/heimdal/kdc";
+      script = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
     };
 
     systemd.services.kpasswdd = {
       description = "Kerberos Password Changing daemon";
       wantedBy = [ "multi-user.target" ];
-      script = "${heimdalFull}/libexec/heimdal/kpasswdd";
+      script = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
     };
   };
 }

From fe8f2b8813e75ab8b20e133b60afaac6e955bca7 Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Wed, 8 Nov 2017 10:01:33 +0000
Subject: [PATCH 028/182] kerberos-server: switch to ExecStart

script causes problems for forking services like MIT Kerberos.
---
 nixos/modules/services/system/kerberos.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
index 950756aa8369..694dee8c2313 100644
--- a/nixos/modules/services/system/kerberos.nix
+++ b/nixos/modules/services/system/kerberos.nix
@@ -27,7 +27,7 @@ in
     environment.systemPackages = [ pkgs.heimdalFull ];
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
-      script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
+      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
     };
 
     systemd.services.kdc = {
@@ -36,13 +36,13 @@ in
       preStart = ''
         mkdir -m 0755 -p ${stateDir}
       '';
-      script = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
+      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
     };
 
     systemd.services.kpasswdd = {
       description = "Kerberos Password Changing daemon";
       wantedBy = [ "multi-user.target" ];
-      script = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
+      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
     };
   };
 }

From 6cca9c0f9f2d7ed80ae52609160d2678e6fe38cd Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Mon, 6 Nov 2017 17:41:34 +0000
Subject: [PATCH 029/182] kerberos-server: add kerberos option

Allow switching out kerberos server implementation.

Sharing config is probably sensible, but implementation is different enough to
be worth splitting into two files. Not sure this is the correct way to split an
implementation, but it works for now.

Uses the switch from config.krb5 to select implementation.
---
 nixos/modules/module-list.nix                 |  2 +-
 nixos/modules/services/system/kerberos.nix    | 48 ------------
 .../services/system/kerberos/default.nix      | 76 +++++++++++++++++++
 .../services/system/kerberos/heimdal.nix      | 74 ++++++++++++++++++
 .../modules/services/system/kerberos/mit.nix  | 74 ++++++++++++++++++
 nixos/tests/kerberos/default.nix              |  5 ++
 nixos/tests/kerberos/heimdal.nix              | 53 +++++++++++++
 nixos/tests/kerberos/mit.nix                  | 45 +++++++++++
 8 files changed, 328 insertions(+), 49 deletions(-)
 delete mode 100644 nixos/modules/services/system/kerberos.nix
 create mode 100644 nixos/modules/services/system/kerberos/default.nix
 create mode 100644 nixos/modules/services/system/kerberos/heimdal.nix
 create mode 100644 nixos/modules/services/system/kerberos/mit.nix
 create mode 100644 nixos/tests/kerberos/default.nix
 create mode 100644 nixos/tests/kerberos/heimdal.nix
 create mode 100644 nixos/tests/kerberos/mit.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e3e097dca26f..a02352a2b93c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -690,7 +690,7 @@
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
   ./services/system/localtime.nix
-  ./services/system/kerberos.nix
+  ./services/system/kerberos/default.nix
   ./services/system/nscd.nix
   ./services/system/saslauthd.nix
   ./services/system/uptimed.nix
diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
deleted file mode 100644
index 694dee8c2313..000000000000
--- a/nixos/modules/services/system/kerberos.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{pkgs, config, lib, ...}:
-
-let
-  inherit (lib) mkOption mkIf;
-  cfg = config.services.kerberos_server;
-  stateDir = "/var/heimdal";
-in
-
-{
-  ###### interface
-  options = {
-    services.kerberos_server = {
-      enable = mkOption {
-        default = false;
-        description = ''
-          Enable the kerberos authentification server.
-        '';
-      };
-
-    };
-  };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.heimdalFull ];
-    systemd.services.kadmind = {
-      description = "Kerberos Administration Daemon";
-      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
-    };
-
-    systemd.services.kdc = {
-      description = "Key Distribution Center daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
-    };
-
-    systemd.services.kpasswdd = {
-      description = "Kerberos Password Changing daemon";
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
-    };
-  };
-}
diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix
new file mode 100644
index 000000000000..90be7e8d551a
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/default.nix
@@ -0,0 +1,76 @@
+{pkgs, config, lib, ...}:
+
+let
+  inherit (lib) mkOption mkIf types;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+
+  aclEntry = {
+    options = {
+      principal = mkOption {
+        type = types.str;
+        description = "Which principal the rule applies to";
+      };
+      access = mkOption {
+        type = types.either
+          (types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
+          (types.enum ["all"]);
+        default = "all";
+        description = "The changes the principal is allowed to make.";
+      };
+      target = mkOption {
+        type = types.str;
+        default = "*";
+        description = "The principals that 'access' applies to.";
+      };
+    };
+  };
+
+  realm = {
+    options = {
+      acl = mkOption {
+        type = types.listOf (types.submodule aclEntry);
+        default = [
+          { principal = "*/admin"; access = "all"; }
+          { principal = "admin"; access = "all"; }
+        ];
+        description = ''
+          The privileges granted to a user.
+        '';
+      };
+    };
+  };
+in
+
+{
+  imports = [
+    ./mit.nix
+    ./heimdal.nix
+  ];
+
+  ###### interface
+  options = {
+    services.kerberos_server = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable the kerberos authentification server.
+        '';
+      };
+
+      realms = mkOption {
+        type = types.attrsOf (types.submodule realm);
+        description = ''
+          The realm(s) to serve keys for.
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ kerberos ];
+  };
+}
diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix
new file mode 100644
index 000000000000..554b1580810a
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@@ -0,0 +1,74 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs'
+    nameValuePair attrNames attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/heimdal";
+  aclFiles = mapAttrs'
+    (name: {acl, ...}: nameValuePair "${name}.acl" (
+      pkgs.writeText "${name}.acl" (concatMapStrings ((
+        {principal, access, target, ...} :
+        "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
+      )) acl)
+    )) cfg.realms;
+
+  kdcConfigs = map (name: ''
+    database = {
+      dbname = ${stateDir}/heimdal
+      acl_file = /etc/heimdal-kdc/${name}.acl
+    }
+  '') (attrNames cfg.realms);
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [kdc]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+in
+
+{
+  # No documentation about correct triggers, so guessing at them.
+
+  config = mkIf (cfg.enable && kerberos == pkgs.heimdalFull) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    systemd.services.kpasswdd = {
+      description = "Kerberos Password Changing daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
+      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+    };
+
+    environment.etc = {
+      # Can be set via the --config-file option to KDC
+      "heimdal-kdc/kdc.conf".source = kdcConfFile;
+    } // (
+      mapAttrs'
+      (name: value: nameValuePair "heimdal-kdc/${name}" {source = value;})
+      aclFiles
+    );
+  };
+}
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
new file mode 100644
index 000000000000..9ff67f647284
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -0,0 +1,74 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList
+    mapAttrs' nameValuePair attrNames attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/lib/krb5kdc";
+  PIDFile = "/run/kdc.pid";
+  aclMap = {
+    add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
+    all = "*";
+  };
+  aclFiles = mapAttrs'
+    (name: {acl, ...}: nameValuePair "${name}.acl" (
+      pkgs.writeText "${name}.acl" (concatMapStrings (
+        {principal, access, target, ...} :
+        let access_code = map (a: aclMap.${a}) (toList access); in
+        "${principal} ${concatStrings access_code} ${target}\n"
+      ) acl)
+    )) cfg.realms;
+  kdcConfigs = map (name: ''
+    ${name} = {
+      acl_file = /etc/krb5kdc/${name}.acl
+    }
+  '') (attrNames cfg.realms);
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [realms]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+  env = {
+    # What Debian uses, could possibly link directly to Nix store?
+    KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
+  };
+in
+
+{
+  config = mkIf (cfg.enable && kerberos == pkgs.krb5Full) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/bin/kadmind -nofork";
+      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+      environment = env;
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = PIDFile;
+        ExecStart = "${kerberos}/bin/krb5kdc -P ${PIDFile}";
+      };
+      restartTriggers = [ kdcConfFile ];
+      environment = env;
+    };
+
+    environment.etc = {
+      "krb5kdc/kdc.conf".source = kdcConfFile;
+    } // (
+      mapAttrs'
+      (name: value: nameValuePair "krb5kdc/${name}" {source = value;})
+      aclFiles
+    );
+    environment.variables = env;
+  };
+}
diff --git a/nixos/tests/kerberos/default.nix b/nixos/tests/kerberos/default.nix
new file mode 100644
index 000000000000..ae8bdb8bbc82
--- /dev/null
+++ b/nixos/tests/kerberos/default.nix
@@ -0,0 +1,5 @@
+{ system ? builtins.currentSystem }:
+{
+  mit = import ./mit.nix { inherit system; };
+  heimdal = import ./heimdal.nix { inherit system; };
+}
diff --git a/nixos/tests/kerberos/heimdal.nix b/nixos/tests/kerberos/heimdal.nix
new file mode 100644
index 000000000000..a0551b131e91
--- /dev/null
+++ b/nixos/tests/kerberos/heimdal.nix
@@ -0,0 +1,53 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-heimdal";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.heimdalFull;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kadmin -l init --realm-max-ticket-life='8 day' \\
+       --realm-max-renewable-life='10 day' FOO.BAR"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+    $machine->waitForUnit("kpasswdd.service");
+
+    $machine->succeed(
+      "kadmin -l add --password=admin_pw --use-defaults admin"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=admin.keytab admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -K admin.keytab add --password=alice_pw --use-defaults \\
+       alice"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=alice.keytab alice"
+    );
+    $machine->succeed("kinit -kt alice.keytab alice");
+  '';
+})
diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
new file mode 100644
index 000000000000..6da3a384aa99
--- /dev/null
+++ b/nixos/tests/kerberos/mit.nix
@@ -0,0 +1,45 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-mit";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.krb5Full;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+    users.extraUsers.alice = { isNormalUser = true; };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kdb5_util create -s -r FOO.BAR -P master_key"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+
+    $machine->succeed(
+      "kadmin.local add_principal -pw admin_pw admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -w admin_pw addprinc -pw alice_pw alice"
+    );
+    $machine->succeed("echo alice_pw | sudo -u alice kinit");
+  '';
+})

From 4e4a599e7e20cf04b6dd8dbb10173cea742085c5 Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kjw53@cam.ac.uk>
Date: Mon, 13 Nov 2017 13:09:35 +0000
Subject: [PATCH 030/182] kerberos_server: Keep ACL file in store

Could also move kdc.conf, but this makes it inconvenient to use command line
utilities with heimdal, as it would require specifying --config-file with every
command.
---
 .../services/system/kerberos/heimdal.nix      | 32 ++++++++-----------
 .../modules/services/system/kerberos/mit.nix  | 30 +++++++----------
 2 files changed, 25 insertions(+), 37 deletions(-)

diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix
index 554b1580810a..d0f470f836ed 100644
--- a/nixos/modules/services/system/kerberos/heimdal.nix
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@@ -1,25 +1,23 @@
 { pkgs, config, lib, ... } :
 
 let
-  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs'
-    nameValuePair attrNames attrValues;
+  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs
+    mapAttrsToList attrValues;
   cfg = config.services.kerberos_server;
   kerberos = config.krb5.kerberos;
   stateDir = "/var/heimdal";
-  aclFiles = mapAttrs'
-    (name: {acl, ...}: nameValuePair "${name}.acl" (
-      pkgs.writeText "${name}.acl" (concatMapStrings ((
-        {principal, access, target, ...} :
-        "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
-      )) acl)
-    )) cfg.realms;
+  aclFiles = mapAttrs
+    (name: {acl, ...}: pkgs.writeText "${name}.acl" (concatMapStrings ((
+      {principal, access, target, ...} :
+      "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
+    )) acl)) cfg.realms;
 
-  kdcConfigs = map (name: ''
+  kdcConfigs = mapAttrsToList (name: value: ''
     database = {
       dbname = ${stateDir}/heimdal
-      acl_file = /etc/heimdal-kdc/${name}.acl
+      acl_file = ${value}
     }
-  '') (attrNames cfg.realms);
+  '') aclFiles;
   kdcConfFile = pkgs.writeText "kdc.conf" ''
     [kdc]
     ${concatStringsSep "\n" kdcConfigs}
@@ -38,7 +36,7 @@ in
       '';
       serviceConfig.ExecStart =
         "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
-      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+      restartTriggers = [ kdcConfFile ];
     };
 
     systemd.services.kdc = {
@@ -59,16 +57,12 @@ in
         mkdir -m 0755 -p ${stateDir}
       '';
       serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
-      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+      restartTriggers = [ kdcConfFile ];
     };
 
     environment.etc = {
       # Can be set via the --config-file option to KDC
       "heimdal-kdc/kdc.conf".source = kdcConfFile;
-    } // (
-      mapAttrs'
-      (name: value: nameValuePair "heimdal-kdc/${name}" {source = value;})
-      aclFiles
-    );
+    };
   };
 }
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
index 9ff67f647284..a53d9dd0c6b5 100644
--- a/nixos/modules/services/system/kerberos/mit.nix
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -2,7 +2,7 @@
 
 let
   inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList
-    mapAttrs' nameValuePair attrNames attrValues;
+    mapAttrs mapAttrsToList attrValues;
   cfg = config.services.kerberos_server;
   kerberos = config.krb5.kerberos;
   stateDir = "/var/lib/krb5kdc";
@@ -11,19 +11,17 @@ let
     add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
     all = "*";
   };
-  aclFiles = mapAttrs'
-    (name: {acl, ...}: nameValuePair "${name}.acl" (
-      pkgs.writeText "${name}.acl" (concatMapStrings (
-        {principal, access, target, ...} :
-        let access_code = map (a: aclMap.${a}) (toList access); in
-        "${principal} ${concatStrings access_code} ${target}\n"
-      ) acl)
-    )) cfg.realms;
-  kdcConfigs = map (name: ''
+  aclFiles = mapAttrs
+    (name: {acl, ...}: (pkgs.writeText "${name}.acl" (concatMapStrings (
+      {principal, access, target, ...} :
+      let access_code = map (a: aclMap.${a}) (toList access); in
+      "${principal} ${concatStrings access_code} ${target}\n"
+    ) acl))) cfg.realms;
+  kdcConfigs = mapAttrsToList (name: value: ''
     ${name} = {
-      acl_file = /etc/krb5kdc/${name}.acl
+      acl_file = ${value}
     }
-  '') (attrNames cfg.realms);
+  '') aclFiles;
   kdcConfFile = pkgs.writeText "kdc.conf" ''
     [realms]
     ${concatStringsSep "\n" kdcConfigs}
@@ -43,7 +41,7 @@ in
         mkdir -m 0755 -p ${stateDir}
       '';
       serviceConfig.ExecStart = "${kerberos}/bin/kadmind -nofork";
-      restartTriggers = [ kdcConfFile ] ++ (attrValues aclFiles);
+      restartTriggers = [ kdcConfFile ];
       environment = env;
     };
 
@@ -64,11 +62,7 @@ in
 
     environment.etc = {
       "krb5kdc/kdc.conf".source = kdcConfFile;
-    } // (
-      mapAttrs'
-      (name: value: nameValuePair "krb5kdc/${name}" {source = value;})
-      aclFiles
-    );
+    };
     environment.variables = env;
   };
 }

From f5b4918de42917469d359d3f2e019a7d174e9c1e Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kai.scorpio@gmail.com>
Date: Sun, 19 Nov 2017 15:13:48 +0000
Subject: [PATCH 031/182] kerberos_server: ensure only one realm configured

Leave options for multiple realms for similarity to krb5, and future
expansion. Currently not tested because I can't make it work and don't need
it.
---
 nixos/modules/services/system/kerberos/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix
index 90be7e8d551a..26ac85de402f 100644
--- a/nixos/modules/services/system/kerberos/default.nix
+++ b/nixos/modules/services/system/kerberos/default.nix
@@ -1,7 +1,7 @@
 {pkgs, config, lib, ...}:
 
 let
-  inherit (lib) mkOption mkIf types;
+  inherit (lib) mkOption mkIf types length attrNames;
   cfg = config.services.kerberos_server;
   kerberos = config.krb5.kerberos;
 
@@ -72,5 +72,9 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ kerberos ];
+    assertions = [{
+      assertion = length (attrNames cfg.realms) <= 1;
+      message = "Only one realm per server is currently supported.";
+    }];
   };
 }

From d752677b1b2b8af93b1a6dc0532826aa29e1827f Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kai.scorpio@gmail.com>
Date: Mon, 26 Feb 2018 15:43:37 +0000
Subject: [PATCH 032/182] kerberos: explicitly install krb5Full.dev for tests

This contains all of the user binaries as of 13e6a5c.
---
 nixos/tests/kerberos/mit.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
index 6da3a384aa99..df13992a8360 100644
--- a/nixos/tests/kerberos/mit.nix
+++ b/nixos/tests/kerberos/mit.nix
@@ -21,6 +21,7 @@ import ../make-test.nix ({pkgs, ...}: {
       };
     };
     users.extraUsers.alice = { isNormalUser = true; };
+    environment.systemPackages = [ pkgs.krb5Full.dev ];
   };
 
   testScript = ''

From ade842f51a709e542872dce24fcbe20aa993dff7 Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kai.scorpio@gmail.com>
Date: Thu, 1 Mar 2018 09:20:51 +0000
Subject: [PATCH 033/182] kerberos: move user binaries to default output

The intention of the previous change was to move krb5-config to .dev (it
gives the locations of headers), but it grabbed all of the user-facing
binaries too. This puts them back.
---
 nixos/tests/kerberos/mit.nix                 | 1 -
 pkgs/development/libraries/kerberos/krb5.nix | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
index df13992a8360..6da3a384aa99 100644
--- a/nixos/tests/kerberos/mit.nix
+++ b/nixos/tests/kerberos/mit.nix
@@ -21,7 +21,6 @@ import ../make-test.nix ({pkgs, ...}: {
       };
     };
     users.extraUsers.alice = { isNormalUser = true; };
-    environment.systemPackages = [ pkgs.krb5Full.dev ];
   };
 
   testScript = ''
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 165f9139ff1f..50a669b053f9 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   # not via outputBin, due to reference from libkrb5.so
   postInstall = ''
-    moveToOutput bin "$dev"
+    moveToOutput bin/krb5-config "$dev"
   '';
 
   enableParallelBuilding = true;

From 337bc20e5f00113329940da0fb5516f58e73ab3b Mon Sep 17 00:00:00 2001
From: Kai Wohlfahrt <kai.wohlfahrt@gmail.com>
Date: Tue, 24 Apr 2018 11:20:32 +0100
Subject: [PATCH 034/182] kerberos: Add tests/kerberos to release.nix

---
 nixos/tests/all-tests.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index feffdb97c18f..eddd6496bf47 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -107,6 +107,7 @@ in
   ipv6 = handleTest ./ipv6.nix {};
   jenkins = handleTest ./jenkins.nix {};
   kafka = handleTest ./kafka.nix {};
+  kerberos = handleTest tests/kerberos/default.nix {};
   kernel-latest = handleTest ./kernel-latest.nix {};
   kernel-lts = handleTest ./kernel-lts.nix {};
   keymap = handleTest ./keymap.nix {};

From 2ebe19f3302ee21871cfab11cdadd13f38b51261 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 20:05:12 +0000
Subject: [PATCH 035/182] openldap: fix cross-build

---
 .../libraries/openldap/default.nix            | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 16e00e9f2b95..0a5f83d1c7c6 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -13,18 +13,27 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ openssl cyrus_sasl db groff libtool ];
+  nativeBuildInputs = [ groff ];
 
-  configureFlags =
-    [ "--enable-overlays"
-      "--disable-dependency-tracking"   # speeds up one-time build
-      "--enable-modules"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-      "--enable-crypt"
-    ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
-      ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
-      ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
+  buildInputs = [ openssl cyrus_sasl db libtool ];
+
+  # Disable install stripping as it breaks cross-compiling.
+  # We strip binaries anyway in fixupPhase.
+  makeFlags= [ "STRIP=" ];
+
+  configureFlags = [
+    "--enable-overlays"
+    "--disable-dependency-tracking"   # speeds up one-time build
+    "--enable-modules"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-crypt"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "--with-yielding_select=yes"
+    "ac_cv_func_memcmp_working=yes"
+  ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
+    ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
+    ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
 
   doCheck = false; # needs a running LDAP server
 

From 68d5071e3d7593116810db503b9b1921d6f78702 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 21:48:36 +0000
Subject: [PATCH 036/182] postfix: fix cross-build

---
 pkgs/servers/mail/postfix/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index e2a78477bb63..019cc1b1948c 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper, gnused, db, openssl, cyrus_sasl, libnsl
 , coreutils, findutils, gnugrep, gawk, icu, pcre, m4
+, buildPackages
 , withLDAP ? true, openldap
 , withPgSQL ? false, postgresql
 , withMySQL ? false, mysql
@@ -49,13 +50,17 @@ in stdenv.mkDerivation rec {
     ./relative-symlinks.patch
   ];
 
-  preBuild = ''
+  postPatch = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    sed -e 's!bin/postconf!${buildPackages.postfix}/bin/postconf!' -i postfix-install
+  '' + ''
     sed -e '/^PATH=/d' -i postfix-install
     sed -e "s|@PACKAGE@|$out|" -i conf/post-install
 
     # post-install need skip permissions check/set on all symlinks following to /nix/store
     sed -e "s|@NIX_STORE@|$NIX_STORE|" -i conf/post-install
+  '';
 
+  postConfigure = ''
     export command_directory=$out/sbin
     export config_directory=/etc/postfix
     export meta_directory=$out/etc/postfix
@@ -69,6 +74,8 @@ in stdenv.mkDerivation rec {
     export readme_directory=$out/share/postfix/doc
     export sendmail_path=$out/bin/sendmail
 
+    makeFlagsArray+=(AR=$AR _AR=$AR RANLIB=$RANLIB _RANLIB=$RANLIB)
+
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 

From b6e73918a38f18da65e9b7e6fd085362d1c38cb3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 22:47:27 +0000
Subject: [PATCH 037/182] clucene: fix cross-build

---
 pkgs/development/libraries/clucene-core/2.x.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 004c01a5b69e..6eb310550bcd 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
     "-DBUILD_CONTRIBS=ON"
     "-DBUILD_CONTRIBS_LIB=ON"
     "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-D_CL_HAVE_GCC_ATOMIC_FUNCTIONS=0"
+    "-D_CL_HAVE_NAMESPACES_EXITCODE=0"
+    "-D_CL_HAVE_NO_SNPRINTF_BUG_EXITCODE=0"
+    "-D_CL_HAVE_NO_SNWPRINTF_BUG_EXITCODE=0"
+    "-D_CL_HAVE_TRY_BLOCKS_EXITCODE=0"
+    "-D_CL_HAVE_PTHREAD_MUTEX_RECURSIVE=0"
+    "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE=0"
   ];
 
   patches = # From debian

From 562d9d472c32128a0d7decdb787aea660100efbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 22:48:42 +0000
Subject: [PATCH 038/182] dovecot: fix cross-build

---
 pkgs/servers/mail/dovecot/default.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 6c6ddf651e62..6007d15a3a15 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     sha256 = "01ggzf7b3jpl89mjiqr7xbpbs181g2gjf6wzg70qaqfzz3ppc6yr";
   };
 
+  enableParallelBuilding = true;
+
   preConfigure = ''
     patchShebangs src/config/settings-get.pl
   '';
@@ -57,6 +59,21 @@ stdenv.mkDerivation rec {
     "--with-ldap"
     "--with-lucene"
     "--with-icu"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "i_cv_epoll_works=${if stdenv.isLinux then "yes" else "no"}"
+    "i_cv_posix_fallocate_works=${if stdenv.isDarwin then "no" else "yes"}"
+    "i_cv_inotify_works=${if stdenv.isLinux then "yes" else "no"}"
+    "i_cv_signed_size_t=no"
+    "i_cv_signed_time_t=yes"
+    "i_cv_c99_vsnprintf=yes"
+    "lib_cv_va_copy=yes"
+    "i_cv_mmap_plays_with_write=yes"
+    "i_cv_gmtime_max_time_t=${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    "i_cv_signed_time_t=yes"
+    "i_cv_fd_passing=yes"
+    "lib_cv_va_copy=yes"
+    "lib_cv___va_copy=yes"
+    "lib_cv_va_val_copy=yes"
   ] ++ lib.optional (stdenv.isLinux) "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     ++ lib.optional (stdenv.isDarwin) "--enable-static"
     ++ lib.optional withMySQL "--with-mysql"

From 629d011ceaefad633c0254d8e17e2640fda2e542 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 10 Dec 2018 22:56:30 +0000
Subject: [PATCH 039/182] geoip: fix cross-build

---
 pkgs/development/libraries/geoip/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/geoip/default.nix b/pkgs/development/libraries/geoip/default.nix
index cb8138dc115e..1b1f7373709f 100644
--- a/pkgs/development/libraries/geoip/default.nix
+++ b/pkgs/development/libraries/geoip/default.nix
@@ -17,6 +17,11 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   postConfigure = ''
     find . -name Makefile.in -exec sed -i -r 's#^pkgdatadir\s*=.+$#pkgdatadir = ${dataDir}#' {} \;
   '';

From 999387d7181d4f462436ffb7bac2b88e20f2e8e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 00:23:09 +0000
Subject: [PATCH 040/182] w3m: fix cross-build

---
 .../networking/browsers/w3m/default.nix       | 26 ++++++++++++++++---
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index 70eb381c60e8..75998662f7f2 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -4,7 +4,7 @@
 , graphicsSupport ? true, imlib2 ? null
 , x11Support ? graphicsSupport, libX11 ? null
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses ? null
-, perl, man, pkgconfig
+, perl, man, pkgconfig, buildPackages, w3m
 }:
 
 assert sslSupport -> openssl != null;
@@ -14,7 +14,17 @@ assert mouseSupport -> gpm-ncurses != null;
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+let
+  mktable = buildPackages.stdenv.mkDerivation rec {
+    name = "w3m-mktable";
+    inherit (w3m) src;
+    nativeBuildInputs = [ pkgconfig boehmgc ];
+    makeFlags = [ "mktable" ];
+    installPhase = ''
+      install -D mktable $out/bin/mktable
+    '';
+  };
+in stdenv.mkDerivation rec {
   name = "w3m-0.5.3+git20180125";
 
   src = fetchFromGitHub {
@@ -31,6 +41,8 @@ stdenv.mkDerivation rec {
   PERL = "${perl}/bin/perl";
   MAN = "${man}/bin/man";
 
+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
   patches = [
     ./RAND_egd.libressl.patch
     (fetchpatch {
@@ -40,8 +52,14 @@ stdenv.mkDerivation rec {
     })
   ] ++ optional (graphicsSupport && !x11Support) [ ./no-x11.patch ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ncurses boehmgc gettext zlib ]
+  postPatch = optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    ln -s ${mktable}/bin/mktable mktable
+    # stop make from recompiling mktable
+    sed -ie 's!mktable.*:.*!mktable:!' Makefile.in
+  '';
+
+  nativeBuildInputs = [ pkgconfig gettext ];
+  buildInputs = [ ncurses boehmgc zlib ]
     ++ optional sslSupport openssl
     ++ optional mouseSupport gpm-ncurses
     ++ optional graphicsSupport imlib2

From 693b47bc0b30d5a0c28174674882af04dd03f584 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 00:28:47 +0000
Subject: [PATCH 041/182] xmlto: fix cross-build

---
 pkgs/tools/typesetting/xmlto/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 400a26f84fd2..b5b03b470cde 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
 
   # `libxml2' provides `xmllint', needed at build-time and run-time.
   # `libxslt' provides `xsltproc', used by `xmlto' at run-time.
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl getopt ];
+  nativeBuildInputs = [ makeWrapper getopt ];
+  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl ];
 
   postInstall = ''
     wrapProgram "$out/bin/xmlto" \

From 8871ffccffe2e626c0bf326e8253aa1c692be6f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 01:01:30 +0000
Subject: [PATCH 042/182] nginx: fix cross-build

---
 pkgs/servers/http/nginx/generic.nix | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 25ff20635aff..9ea49267cf8c 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, zlib, pcre, libxml2, libxslt
+{ stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , gd, geoip
 , withDebug ? false
 , withStream ? true
@@ -60,8 +60,25 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [ "-I${libxml2.dev}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
 
+  configurePlatforms = [];
+
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
 
+  patches = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/102-sizeof_test_fix.patch";
+      sha256 = "0i2k30ac8d7inj9l6bl0684kjglam2f68z8lf3xggcc2i5wzhh8a";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/101-feature_test_fix.patch";
+      sha256 = "0v6890a85aqmw60pgj3mm7g8nkaphgq65dj4v9c6h58wdsrc6f0y";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/103-sys_nerr.patch";
+      sha256 = "0s497x6mkz947aw29wdy073k8dyjq8j99lax1a1mzpikzr4rxlmd";
+    })
+  ];
+
   hardeningEnable = optional (!stdenv.isDarwin) "pie";
 
   enableParallelBuilding = true;

From 7bb24a65e4d429ed01736a168687ade3240d6ccd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 11:25:13 +0000
Subject: [PATCH 043/182] bird: fix cross-build

---
 pkgs/servers/bird/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/bird/default.nix b/pkgs/servers/bird/default.nix
index 5683da5e8e3f..94579e1bdb16 100644
--- a/pkgs/servers/bird/default.nix
+++ b/pkgs/servers/bird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, flex, bison, readline }:
+{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline }:
 
 with lib;
 
@@ -18,8 +18,15 @@ let
 
       patches = [
         (./. + "/dont-create-sysconfdir-${builtins.substring 0 1 version}.patch")
+        # https://github.com/BIRD/bird/pull/4
+        (fetchpatch {
+          url = "https://github.com/BIRD/bird/commit/fca9ab48e3823c734886f47156a92f6b804c16e9.patch";
+          sha256 = "1pnndc3n56lqqcy74ln0w5kn3i9rbzsm2dqiyp1qw7j33dpkln1b";
+        })
       ];
 
+      CPP="${stdenv.cc.targetPrefix}cpp -E";
+
       configureFlags = [
         "--localstatedir=/var"
       ] ++ optional enableIPv6 "--enable-ipv6";

From 47bddf5a84f5b8ecb88d10e27bd7aae35528cc7d Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 9 Dec 2018 16:18:34 +0100
Subject: [PATCH 044/182] glu: don't use valgrind on darwin

---
 pkgs/development/libraries/mesa/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index faf1261da4a5..ede4dd889e58 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -146,10 +146,10 @@ let self = stdenv.mkDerivation {
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
-    libpthreadstubs openssl/*or another sha1 provider*/
-    valgrind-light python2 python2.pkgs.Mako
+    libpthreadstubs openssl /*or another sha1 provider*/
+    python2 python2.pkgs.Mako
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ];
+    ++ lib.optionals stdenv.isLinux [ valgrind-light libomxil-bellagio libva-minimal ];
 
   enableParallelBuilding = true;
   doCheck = false;

From 414ea0a10ef97c188b995183ef3eb3dbf3548c9d Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 12 Dec 2018 00:17:41 +0100
Subject: [PATCH 045/182] =?UTF-8?q?meson:=200.48.2=20=E2=86=92=200.49.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../meson/allow-dirs-outside-of-prefix.patch  |  2 +-
 .../tools/build-managers/meson/default.nix    |  4 +--
 .../build-managers/meson/fix-rpath.patch      | 35 +++++++------------
 .../meson/gir-fallback-path.patch             |  2 +-
 4 files changed, 17 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
index 382c2f0c05b2..591927c15285 100644
--- a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
+++ b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
@@ -1,6 +1,6 @@
 --- a/mesonbuild/coredata.py
 +++ b/mesonbuild/coredata.py
-@@ -298,18 +298,13 @@
+@@ -375,18 +375,13 @@
          '''
          if option.endswith('dir') and os.path.isabs(value) and \
             option not in builtin_dir_noprefix_options:
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 13f61fb16177..17938ab47b37 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,12 +1,12 @@
 { lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.48.2";
+  version = "0.49.0";
   pname = "meson";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1shfbr0mf8gmwpw5ivrmwp8282qw9mfhxmccd7fsgidp4x3nslby";
+    sha256 = "0895igla1qav8k250z2qv03a0fg491wzzkfpbk50wwq848vmbkd0";
   };
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/meson/fix-rpath.patch b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
index 30ecb30ee932..1a5f8cb89dce 100644
--- a/pkgs/development/tools/build-managers/meson/fix-rpath.patch
+++ b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
@@ -1,27 +1,18 @@
 --- a/mesonbuild/compilers/compilers.py
 +++ b/mesonbuild/compilers/compilers.py
-@@ -1112,6 +1112,8 @@
-         for p in rpath_paths:
-             if p == from_dir:
-                 relative = '' # relpath errors out in this case
-+            elif os.path.isabs(p):
-+                relative = p # These can be outside of build dir.
-             else:
-                 relative = os.path.relpath(os.path.join(build_dir, p), os.path.join(build_dir, from_dir))
-             rel_rpaths.append(relative)
-@@ -1121,8 +1123,10 @@
-             if paths != '':
-                 paths += ':'
-             paths += build_rpath
--        if len(paths) < len(install_rpath):
--            padding = 'X' * (len(install_rpath) - len(paths))
-+        store_paths = ':'.join(filter(lambda path: path.startswith('@storeDir@'), paths.split(':')))
-+        extra_space_needed = len(install_rpath + (':' if install_rpath and store_paths else '') + store_paths) - len(paths)
-+        if extra_space_needed > 0:
-+            padding = 'X' * extra_space_needed
-             if not paths:
-                 paths = padding
-             else:
+@@ -1202,8 +1202,10 @@
+             # In order to avoid relinking for RPATH removal, the binary needs to contain just
+             # enough space in the ELF header to hold the final installation RPATH.
+             paths = ':'.join(all_paths)
+-            if len(paths) < len(install_rpath):
+-                padding = 'X' * (len(install_rpath) - len(paths))
++            store_paths = ':'.join(filter(lambda path: path.startswith('@storeDir@'), all_paths))
++            extra_space_needed = len(install_rpath + (':' if install_rpath and store_paths else '') + store_paths) - len(paths)
++            if extra_space_needed > 0:
++                padding = 'X' * extra_space_needed
+                 if not paths:
+                     paths = padding
+                 else:
 --- a/mesonbuild/scripts/depfixer.py
 +++ b/mesonbuild/scripts/depfixer.py
 @@ -303,6 +303,14 @@
diff --git a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
index b7667ed493f2..7a33d4127fae 100644
--- a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
+++ b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
@@ -1,6 +1,6 @@
 --- a/mesonbuild/modules/gnome.py
 +++ b/mesonbuild/modules/gnome.py
-@@ -780,6 +780,13 @@
+@@ -805,6 +805,13 @@
          scan_command += self._scan_langs(state, [lc[0] for lc in langs_compilers])
          scan_command += list(external_ldflags)
  

From 5e27842c8caea8fabdc9941aa2fb8ebddfa39e41 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Wed, 12 Dec 2018 00:06:58 +0100
Subject: [PATCH 046/182] =?UTF-8?q?gobject-introspection:=201.58.1=20?=
 =?UTF-8?q?=E2=86=92=201.58.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/gobject-introspection/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 3dc66aec1595..e1acf0e5d2cf 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -9,7 +9,7 @@
 
 let
   pname = "gobject-introspection";
-  version = "1.58.1";
+  version = "1.58.2";
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "12fzs3044047icdfs7cb2lsmnfi6w6fyhkci3m2rbvf5llgnhm29";
+    sha256 = "1a7dw9d4kqi0skyygc2bhdvzipc0kjfy3x5q856cmxws8mlhypia";
   };
 
   outputs = [ "out" "dev" "man" ];

From 6b92dd38e1950b6f3ba85fb2d65292706c831e99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 22:17:11 +0000
Subject: [PATCH 047/182] memcached: fix cross-compiling

---
 pkgs/servers/memcached/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index f35b8ff01884..73251bfd9e19 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "0aav15f0lh8k4i62aza2bdv4s8vv65j38pz2zc4v45snd3arfby0";
   };
 
+  configureFlags = [
+     "ac_cv_c_endian=${if stdenv.hostPlatform.isBigEndian then "big" else "little"}"
+  ];
+
   buildInputs = [cyrus_sasl libevent];
 
   hardeningEnable = [ "pie" ];

From 9637f4d58dd17847203d983954f0b23d9a88f0f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 22:45:07 +0000
Subject: [PATCH 048/182] tcl: fix cross-build

---
 pkgs/development/interpreters/tcl/generic.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index a472ccaafbf2..e1925821e5af 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -15,15 +15,18 @@ stdenv.mkDerivation rec {
   setOutputFlags = false;
 
   preConfigure = ''
-    # Note: using $out instead of $man to prevent a runtime dependency on $man.
-    configureFlagsArray+=(--mandir=$out/share/man --enable-man-symlinks)
-
-    # Don't install tzdata because NixOS already has a more up-to-date copy.
-    configureFlagsArray+=(--with-tzdata=no)
-
     cd unix
   '';
 
+  configureFlags = [
+    # Note: using $out instead of $man to prevent a runtime dependency on $man.
+    "--mandir=${placeholder "out"}/share/man"
+    "--enable-man-symlinks"
+    # Don't install tzdata because NixOS already has a more up-to-date copy.
+    "--with-tzdata=no"
+    "tcl_cv_strtod_unbroken=ok"
+  ];
+
   enableParallelBuilding = true;
 
   postInstall = ''

From 42070c9b0d9e700b0eaf2c49e52955af88155b17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 22:48:45 +0000
Subject: [PATCH 049/182] tcl: enable threads and 64-bit support

64-bit support is only enabled on 64-bit systems
---
 pkgs/development/interpreters/tcl/generic.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index e1925821e5af..011b3a125ef2 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -19,13 +19,14 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
+    "--enable-threads"
     # Note: using $out instead of $man to prevent a runtime dependency on $man.
     "--mandir=${placeholder "out"}/share/man"
     "--enable-man-symlinks"
     # Don't install tzdata because NixOS already has a more up-to-date copy.
     "--with-tzdata=no"
     "tcl_cv_strtod_unbroken=ok"
-  ];
+  ] ++ stdenv.lib.optional stdenv.is64bit "--enable-64bit";
 
   enableParallelBuilding = true;
 

From c3e967dc35df430bfe07a2df1be5af1d4ac7a389 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 23:05:32 +0000
Subject: [PATCH 050/182] libmilter: fix cross-build

---
 pkgs/development/libraries/libmilter/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 7e3c45634d9e..aa606e2a177e 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cd libmilter
     cat > a.m4 <<EOF
+      define(\`confCC', \`$CC')
+      define(\`confAR', \`$AR')
       define(\`confEBINDIR', \`$out/libexec')
       define(\`confINCLUDEDIR', \`$out/include')
       define(\`confLIBDIR', \`$out/lib')
@@ -29,9 +31,9 @@ stdenv.mkDerivation rec {
     sh Build -f ./a.m4
   '';
 
-  patches = [ ./install.patch ./sharedlib.patch];
+  patches = [ ./install.patch ./sharedlib.patch ];
 
-  buildInputs = [ m4 ];
+  nativeBuildInputs = [ m4 ];
 
   meta = with stdenv.lib; {
     description = "Sendmail Milter mail filtering API library";

From 554851e689245b04e79dd0371465d13cdf057a0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 23:48:27 +0000
Subject: [PATCH 051/182] platform.emulator: fix non-x86 systems

---
 lib/systems/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 25df5e174069..9b25052ab88d 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -98,7 +98,7 @@ rec {
       in
         if final.parsed.kernel.name == pkgs.stdenv.hostPlatform.parsed.kernel.name &&
            (final.parsed.cpu.name == pkgs.stdenv.hostPlatform.parsed.cpu.name ||
-            (final.platform.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
+            (final.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
         then pkgs.runtimeShell
         else if final.isWindows
         then "${wine}/bin/${wine-name}"

From b67c061f0a41fde700fa66c678ef9e655dba75b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 11 Dec 2018 23:16:42 +0000
Subject: [PATCH 052/182] tdb: fix cross-compilation

---
 pkgs/development/libraries/tdb/default.nix | 26 +++++++++++++---------
 pkgs/top-level/all-packages.nix            |  4 +---
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index f6e4a0472828..d2ff7c5efd34 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, python, pkgconfig, readline, libxslt
-, docbook_xsl, docbook_xml_dtd_42
+{ stdenv, fetchurl, python2, pkgconfig, readline, libxslt
+, docbook_xsl, docbook_xml_dtd_42, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -10,28 +10,32 @@ stdenv.mkDerivation rec {
     sha256 = "1ibcz466xwk1x6xvzlgzd5va4lyrjzm3rnjak29kkwk7cmhw4gva";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig python2 ];
   buildInputs = [
-    python readline libxslt docbook_xsl docbook_xml_dtd_42
+    readline libxslt docbook_xsl docbook_xml_dtd_42
   ];
 
   preConfigure = ''
-    sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,g' buildtools/bin/waf
+    patchShebangs buildtools/bin/waf
   '';
 
   configureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "--cross-compile"
+    "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
+  configurePlatforms = [ ];
 
   meta = with stdenv.lib; {
     description = "The trivial database";
-    longDescription =
-      '' TDB is a Trivial Database. In concept, it is very much like GDBM,
-         and BSD's DB except that it allows multiple simultaneous writers and
-         uses locking internally to keep writers from trampling on each
-         other.  TDB is also extremely small.
-      '';
+    longDescription = ''
+      TDB is a Trivial Database. In concept, it is very much like GDBM,
+      and BSD's DB except that it allows multiple simultaneous writers
+      and uses locking internally to keep writers from trampling on each
+      other. TDB is also extremely small.
+    '';
     homepage = https://tdb.samba.org/;
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5191f9683a30..0d6b2cf31940 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12588,9 +12588,7 @@ in
     python = python2;
   };
 
-  tdb = callPackage ../development/libraries/tdb {
-    python = python2;
-  };
+  tdb = callPackage ../development/libraries/tdb {};
 
   tecla = callPackage ../development/libraries/tecla { };
 

From 863ceb58912bd67b8210597604a3acb2960494e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 00:17:40 +0000
Subject: [PATCH 053/182] opendkim: fix cross-build

---
 pkgs/development/libraries/opendkim/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/opendkim/default.nix b/pkgs/development/libraries/opendkim/default.nix
index 71c2e56f5410..3d110910b159 100644
--- a/pkgs/development/libraries/opendkim/default.nix
+++ b/pkgs/development/libraries/opendkim/default.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "06v8bqhh604sz9rh5bvw278issrwjgc4h1wx2pz9a84lpxbvm823";
   };
 
-  configureFlags= [ "--with-milter=${libmilter}" ];
+  configureFlags= [
+    "--with-milter=${libmilter}"
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 

From e4556c275cf24811fe14f64dda2e77133f868688 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 00:30:00 +0000
Subject: [PATCH 054/182] gdb: fix cross-build

---
 pkgs/development/tools/misc/gdb/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 29942bb2fc4d..fa4bb3475938 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 
 # Build time
-, fetchurl, fetchpatch, pkgconfig, perl, texinfo, setupDebugInfoDirs
+, fetchurl, fetchpatch, pkgconfig, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
 , ncurses, readline, gmp, mpfr, expat, zlib, dejagnu
@@ -49,6 +49,8 @@ stdenv.mkDerivation rec {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   enableParallelBuilding = true;
 
   # darwin build fails with format hardening since v7.12

From c6d83f297df6e92e585cf3c583899dfb096aa73b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 00:36:37 +0000
Subject: [PATCH 055/182] valgrind: fix cross-build

---
 pkgs/development/tools/analysis/valgrind/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index ca8d64f91327..3927361903c6 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -11,15 +11,15 @@ stdenv.mkDerivation rec {
   # autoreconfHook is needed to pick up patching of Makefile.am
   # Remove when the patch no longer applies.
   patches = [ ./coregrind-makefile-race.patch ];
-  nativeBuildInputs = [ autoreconfHook ];
+  # Perl is needed for `cg_annotate'.
+  nativeBuildInputs = [ autoreconfHook perl ];
 
   outputs = [ "out" "dev" "man" "doc" ];
 
   hardeningDisable = [ "stackprotector" ];
 
-  # Perl is needed for `cg_annotate'.
   # GDB is needed to provide a sane default for `--db-command'.
-  buildInputs = [ perl gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
+  buildInputs = [ gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
 
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.isLinux;

From 220dcada792915dcd86e80b8b90d7e2e4f1645b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 00:45:27 +0000
Subject: [PATCH 056/182] xorg.libXvMC: fix cross-build

---
 pkgs/servers/x11/xorg/overrides.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 8c3917171ecc..68a2e93cb5ff 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -251,6 +251,8 @@ self: super:
 
   libXvMC = super.libXvMC.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "doc" ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
     buildInputs = attrs.buildInputs ++ [self.renderproto];
   });
 

From 054b938c5cd7e675c5526eaf888845e721286aea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 00:53:20 +0000
Subject: [PATCH 057/182] libXt: fix cross-build

---
 pkgs/servers/x11/xorg/overrides.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 68a2e93cb5ff..faabd30fa08c 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -145,7 +145,8 @@ self: super:
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
     propagatedBuildInputs = [ self.libSM ];
-    CPP = stdenv.lib.optionalString stdenv.isDarwin "clang -E -";
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
     outputs = [ "out" "dev" "devdoc" ];
   });
 

From e8738828493a87c389d5ff2d103e1e3c53944fad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 01:10:30 +0000
Subject: [PATCH 058/182] mesa: fix cross-compiling

---
 pkgs/development/libraries/mesa/default.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index ede4dd889e58..700542c6e896 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, intltool, autoreconfHook
 , file, expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
-, libelf, libvdpau, valgrind-light, python2
+, libelf, libvdpau, valgrind-light, python2, python2Packages
 , libglvnd
 , enableRadv ? true
 , galliumDrivers ? null
@@ -134,11 +134,14 @@ let self = stdenv.mkDerivation {
     "--disable-opencl"
   ];
 
-  nativeBuildInputs = [ autoreconfHook intltool pkgconfig file ];
+  nativeBuildInputs = [
+    autoreconfHook intltool pkgconfig file
+    python2 python2Packages.Mako
+  ];
 
-  propagatedBuildInputs = with xorg;
-    [ libXdamage libXxf86vm ]
-    ++ optional stdenv.isLinux libdrm
+  propagatedBuildInputs = with xorg; [
+    libXdamage libXxf86vm
+  ] ++ optional stdenv.isLinux libdrm
     ++ optionals stdenv.isDarwin [ OpenGL Xplugin ];
 
   buildInputs = with xorg; [
@@ -147,7 +150,6 @@ let self = stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
-    python2 python2.pkgs.Mako
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ valgrind-light libomxil-bellagio libva-minimal ];
 

From 4b7a6158998bb3f8a62896be22ad597b7cceba9d Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Thu, 13 Dec 2018 01:13:30 -0500
Subject: [PATCH 059/182] llvm 7: Allow for specifying an arbitrary list of
 backends to build

---
 pkgs/development/compilers/llvm/7/llvm.nix | 19 ++++++-------------
 pkgs/development/compilers/llvm/common.nix | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 13 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/common.nix

diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 06024856356f..6fcdc394bed4 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -13,7 +13,8 @@
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
-, enableWasm ? true
+, targets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
+, enableWasm ? true # TODO fold this into `targets` somehow
 , enablePFM ? !stdenv.isDarwin
 }:
 
@@ -24,17 +25,9 @@ let
   shortVersion = with stdenv.lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
 
-  llvmTarget = platform:
-    if platform.parsed.cpu.family == "x86" then
-      "X86"
-    else if platform.parsed.cpu.name == "aarch64" then
-      "AArch64"
-    else if platform.parsed.cpu.family == "arm" then
-      "ARM"
-    else if platform.parsed.cpu.family == "mips" then
-      "Mips"
-    else
-      throw "Unsupported system";
+  inherit
+    (import ../common.nix { inherit (stdenv) lib; })
+    llvmBackendList;
 in stdenv.mkDerivation (rec {
   name = "llvm-${version}";
 
@@ -92,7 +85,7 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
-    "-DLLVM_TARGETS_TO_BUILD=${llvmTarget stdenv.hostPlatform};${llvmTarget stdenv.targetPlatform}"
+    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList targets}"
 
     "-DLLVM_ENABLE_DUMP=ON"
   ]
diff --git a/pkgs/development/compilers/llvm/common.nix b/pkgs/development/compilers/llvm/common.nix
new file mode 100644
index 000000000000..e4f55963a6fb
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common.nix
@@ -0,0 +1,18 @@
+{ lib }:
+
+rec {
+  llvmBackend = platform:
+    if platform.parsed.cpu.family == "x86" then
+      "X86"
+    else if platform.parsed.cpu.name == "aarch64" then
+      "AArch64"
+    else if platform.parsed.cpu.family == "arm" then
+      "ARM"
+    else if platform.parsed.cpu.family == "mips" then
+      "Mips"
+    else
+      throw "Unsupported system";
+
+  llvmBackendList = platforms:
+    lib.concatStringsSep ";" (map llvmBackend platforms);
+}

From 048c48f405980b8ecad27150a9430ae035760601 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 09:21:18 +0000
Subject: [PATCH 060/182] libXinerama: fix cross-compilation

---
 pkgs/servers/x11/xorg/overrides.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index faabd30fa08c..95e427cf96b8 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -214,6 +214,8 @@ self: super:
 
   libXinerama = super.libXinerama.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
   });
 
   libXmu = super.libXmu.overrideAttrs (attrs: {

From 1ce2cc47fc61c5d3fc3e8a6285f373cc9732803c Mon Sep 17 00:00:00 2001
From: Bas van Dijk <v.dijk.bas@gmail.com>
Date: Sun, 2 Dec 2018 14:27:22 +0100
Subject: [PATCH 061/182] pythonPackages.certifi: 2018.10.15 -> 2018.11.29

---
 pkgs/development/python-modules/certifi/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index ef8d1e52fe07..8ccfd2e9efb7 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2018.10.15";
+  version = "2018.11.29";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6d58c986d22b038c8c0df30d639f23a3e6d172a05c3583e766f4c0b785c0986a";
+    sha256 = "1dvccavd2fzq4j37w0sznylp92ps14zi6gvlxzm23in0yhzciya7";
   };
 
   meta = {
@@ -18,4 +18,4 @@ buildPythonPackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ koral ];
   };
-}
\ No newline at end of file
+}

From 5d970e740eb03c4cbb237e0ea3d8b5083ad0e707 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <v.dijk.bas@gmail.com>
Date: Fri, 30 Nov 2018 00:12:42 +0100
Subject: [PATCH 062/182] pythonPackages.elasticsearch-curator: 5.5.4 -> 5.6.0

---
 nixos/modules/services/search/elasticsearch-curator.nix      | 5 +++--
 .../python-modules/elasticsearch-curator/default.nix         | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/search/elasticsearch-curator.nix b/nixos/modules/services/search/elasticsearch-curator.nix
index 43785c392fee..8cb1275284a3 100644
--- a/nixos/modules/services/search/elasticsearch-curator.nix
+++ b/nixos/modules/services/search/elasticsearch-curator.nix
@@ -82,11 +82,12 @@ in {
   };
 
   config = mkIf cfg.enable {
-
     systemd.services.elasticsearch-curator = {
       startAt = cfg.interval;
       serviceConfig = {
-        ExecStart = ''${pkgs.python36Packages.elasticsearch-curator}/bin/curator --config ${curatorConfig} ${curatorAction}'';
+        ExecStart =
+          "${pkgs.python3Packages.elasticsearch-curator}/bin/curator" +
+          " --config ${curatorConfig} ${curatorAction}";
       };
     };
   };
diff --git a/pkgs/development/python-modules/elasticsearch-curator/default.nix b/pkgs/development/python-modules/elasticsearch-curator/default.nix
index 1ea6e4cabad8..66c124d65a78 100644
--- a/pkgs/development/python-modules/elasticsearch-curator/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-curator/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname   = "elasticsearch-curator";
-  version = "5.5.4";
+  version = "5.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e75abeb7f7be939b1c64c071898760dc10ab5f08307c253fc074abf8a41a76f0";
+    sha256 = "0r4p229233ivprxnvp33hilkgczijmyvi33wivxhhj6q3kkywpyq";
   };
 
   # The test hangs so we disable it.

From 60135e9fe66d870cab423cb685ff58b13baaa918 Mon Sep 17 00:00:00 2001
From: Vaibhav Sagar <vaibhavsagar@gmail.com>
Date: Thu, 13 Dec 2018 15:31:28 -0500
Subject: [PATCH 063/182] acl: 2.2.52 -> 2.2.53

---
 pkgs/development/libraries/acl/default.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index f9559d94174d..4b280cc18621 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, attr }:
 
 stdenv.mkDerivation rec {
-  name = "acl-2.2.52";
+  name = "acl-2.2.53";
 
   src = fetchurl {
-    url = "mirror://savannah/acl/${name}.src.tar.gz";
-    sha256 = "08qd9s3wfhv0ajswsylnfwr5h0d7j9d4rgip855nrh400nxp940p";
+    url = "mirror://savannah/acl/${name}.tar.gz";
+    sha256 = "1ir6my3w74s6nfbgbqgzj6w570sn0qjf3524zx8xh67lqrjrigh6";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
@@ -22,10 +22,6 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ZIP=gzip" "ECHO=echo" "SED=sed" "AWK=gawk" ];
-
-  installTargets = [ "install" "install-lib" "install-dev" ];
-
   meta = with stdenv.lib; {
     homepage = "https://savannah.nongnu.org/projects/acl";
     description = "Library and tools for manipulating access control lists";

From 4e19b09073e2507fd28ae71d96fcb11670b19d62 Mon Sep 17 00:00:00 2001
From: Vaibhav Sagar <vaibhavsagar@gmail.com>
Date: Thu, 13 Dec 2018 15:28:55 -0500
Subject: [PATCH 064/182] attr: 2.4.47 -> 2.4.48

---
 pkgs/development/libraries/attr/default.nix   | 12 ++---
 .../libraries/attr/fix-headers-musl.patch     | 54 -------------------
 2 files changed, 3 insertions(+), 63 deletions(-)
 delete mode 100644 pkgs/development/libraries/attr/fix-headers-musl.patch

diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index f859894cd47b..623864529f0f 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -1,23 +1,17 @@
 { stdenv, fetchurl, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "attr-2.4.47";
+  name = "attr-2.4.48";
 
   src = fetchurl {
-    url = "mirror://savannah/attr/${name}.src.tar.gz";
-    sha256 = "0nd8y0m6awc9ahv0ciiwf8gy54c8d3j51pw9xg7f7cn579jjyxr5";
+    url = "mirror://savannah/attr/${name}.tar.gz";
+    sha256 = "1rr4adzwax4bzr2c00f06zcsljv5y6p9wymz1g89ww7cb2rp5bay";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ gettext ];
 
-  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ECHO=echo" "SED=sed" "AWK=gawk" ];
-
-  installTargets = [ "install" "install-lib" "install-dev" ];
-
-  patches = if (stdenv.hostPlatform.libc == "musl") then [ ./fix-headers-musl.patch ] else null;
-
   postPatch = ''
     for script in install-sh include/install-sh; do
       patchShebangs $script
diff --git a/pkgs/development/libraries/attr/fix-headers-musl.patch b/pkgs/development/libraries/attr/fix-headers-musl.patch
deleted file mode 100644
index e969f640eeef..000000000000
--- a/pkgs/development/libraries/attr/fix-headers-musl.patch
+++ /dev/null
@@ -1,54 +0,0 @@
---- attr-2.4.47/include/xattr.h
-+++ attr-2.4.47/include/xattr.h
-@@ -31,33 +31,37 @@
- #define XATTR_REPLACE 0x2       /* set value, fail if attr does not exist */
- 
- 
--__BEGIN_DECLS
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
- 
- extern int setxattr (const char *__path, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- extern int lsetxattr (const char *__path, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- extern int fsetxattr (int __filedes, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- 
- extern ssize_t getxattr (const char *__path, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- extern ssize_t lgetxattr (const char *__path, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- extern ssize_t fgetxattr (int __filedes, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- 
- extern ssize_t listxattr (const char *__path, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- extern ssize_t llistxattr (const char *__path, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- extern ssize_t flistxattr (int __filedes, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- 
--extern int removexattr (const char *__path, const char *__name) __THROW;
--extern int lremovexattr (const char *__path, const char *__name) __THROW;
--extern int fremovexattr (int __filedes,   const char *__name) __THROW;
-+extern int removexattr (const char *__path, const char *__name);
-+extern int lremovexattr (const char *__path, const char *__name);
-+extern int fremovexattr (int __filedes,   const char *__name);
- 
--__END_DECLS
-+#ifdef __cplusplus
-+}
-+#endif
- 
- #endif	/* __XATTR_H__ */

From fd463810ae7a453b4cccea44d3076e2cfadd00c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 09:22:02 +0000
Subject: [PATCH 065/182] llvm_6: fix cross-compilation

---
 pkgs/development/compilers/llvm/6/llvm.nix | 58 ++++++++++++++--------
 1 file changed, 36 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 787a48416ab7..6c391e78f283 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -9,18 +9,27 @@
 , version
 , release_version
 , zlib
+, buildPackages
+, fetchpatch
 , debugVersion ? false
 , enableManpages ? false
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
 , enableSharedLibraries ? true
-, enableWasm ? true
 }:
 
 let
+  inherit (stdenv.lib) optional optionals optionalString;
+
   src = fetch "llvm" "1qpls3vk85lydi5b4axl0809fv932qgsqgdgrk098567z4jc7mmn";
 
   # Used when creating a version-suffixed symlink of libLLVM.dylib
   shortVersion = with stdenv.lib;
     concatStringsSep "." (take 2 (splitString "." release_version));
+
+  inherit
+    (import ../common.nix { inherit (stdenv) lib; })
+    llvmBackendList;
+
 in stdenv.mkDerivation (rec {
   name = "llvm-${version}";
 
@@ -31,22 +40,30 @@ in stdenv.mkDerivation (rec {
   '';
 
   outputs = [ "out" "python" ]
-    ++ stdenv.lib.optional enableSharedLibraries "lib";
+    ++ optional enableSharedLibraries "lib";
 
   nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    ++ optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  patches = [
+    # fixes tests, included in llvm_7
+    (fetchpatch {
+      url = "https://github.com/llvm-mirror/llvm/commit/737553be0c9c25c497b45a241689994f177d5a5d.patch";
+      sha256 = "0hnaxnkx7zy5yg98f1ggv8a9l0r6g19n6ygqsv26masrnlcbccli";
+    })
+  ];
+
+  postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + stdenv.lib.optionalString (enableSharedLibraries) ''
+  + optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
   '' + ''
@@ -54,7 +71,7 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+  '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
@@ -73,31 +90,28 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_ENABLE_RTTI=ON"
-
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
-
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
+    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList enableTargets}"
+    "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ]
-  ++ stdenv.lib.optional enableSharedLibraries
+  ] ++ optionals enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
-  ++ stdenv.lib.optionals enableManpages [
+  ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ stdenv.lib.optional (!isDarwin)
+  ] ++ optionals (!isDarwin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ stdenv.lib.optionals (isDarwin) [
+  ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ]
-  ++ stdenv.lib.optional enableWasm
-   "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
-  ;
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_6}/bin/llvm-tblgen"
+  ];
 
   postBuild = ''
     rm -fR $out
@@ -117,13 +131,13 @@ in stdenv.mkDerivation (rec {
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
   ''
-  + stdenv.lib.optionalString enableSharedLibraries ''
+  + optionalString enableSharedLibraries ''
     moveToOutput "lib/libLLVM-*" "$lib"
     moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
   ''
-  + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib

From e84bd8db9f6ebacd46e21009e40c0a402930dc5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 12 Dec 2018 09:21:47 +0000
Subject: [PATCH 066/182] llvm_7: fix cross-compilation

---
 pkgs/development/compilers/llvm/7/llvm.nix | 44 +++++++++++-----------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 6fcdc394bed4..69d76effca74 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -10,15 +10,17 @@
 , version
 , release_version
 , zlib
+, buildPackages
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
-, targets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
-, enableWasm ? true # TODO fold this into `targets` somehow
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
 , enablePFM ? !stdenv.isDarwin
 }:
 
 let
+  inherit (stdenv.lib) optional optionals optionalString;
+
   src = fetch "llvm" "08p27wv1pr9ql2zc3f3qkkymci46q7myvh8r5ijippnbwr2gihcb";
 
   # Used when creating a version-suffixed symlink of libLLVM.dylib
@@ -38,23 +40,23 @@ in stdenv.mkDerivation (rec {
   '';
 
   outputs = [ "out" "python" ]
-    ++ stdenv.lib.optional enableSharedLibraries "lib";
+    ++ optional enableSharedLibraries "lib";
 
   nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    ++ optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optional enablePFM libpfm; # exegesis
+    ++ optional enablePFM libpfm; # exegesis
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
       --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + stdenv.lib.optionalString (enableSharedLibraries) ''
+  + optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
   '' + ''
@@ -62,7 +64,7 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+  '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
@@ -85,28 +87,26 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_ENABLE_RTTI=ON"
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
     "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
-    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList targets}"
-
+    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList enableTargets}"
+    "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ]
-  ++ stdenv.lib.optional enableSharedLibraries
+  ] ++ optionals enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
-  ++ stdenv.lib.optionals enableManpages [
+  ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ stdenv.lib.optional (!isDarwin)
+  ] ++ optionals (!isDarwin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ stdenv.lib.optionals (isDarwin) [
+  ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ]
-  ++ stdenv.lib.optional enableWasm
-   "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
-  ;
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_7}/bin/llvm-tblgen"
+  ];
 
   postBuild = ''
     rm -fR $out
@@ -126,13 +126,13 @@ in stdenv.mkDerivation (rec {
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
   ''
-  + stdenv.lib.optionalString enableSharedLibraries ''
+  + optionalString enableSharedLibraries ''
     moveToOutput "lib/libLLVM-*" "$lib"
     moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
   ''
-  + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib

From b22f1b0e9ef94015300b54d55f3a025cc82d1ec7 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:52:52 +0000
Subject: [PATCH 067/182] perl526: drop

---
 pkgs/development/interpreters/perl/default.nix | 5 -----
 pkgs/top-level/all-packages.nix                | 6 +-----
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 909991e03480..4e1028184aa1 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -173,11 +173,6 @@ let
     setupHook = ./setup-hook-cross.sh;
   });
 in rec {
-  perl526 = common {
-    version = "5.26.3";
-    sha256 = "14y46c1cnrfnd1k5nk6fj5w5vxna5xav6pmk44qaabr9x06y8nmp";
-  };
-
   # the latest Maint version
   perl528 = common {
     version = "5.28.1";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5191f9683a30..7594d6c0f831 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7815,7 +7815,7 @@ in
 
   ocropus = callPackage ../applications/misc/ocropus { };
 
-  inherit (callPackages ../development/interpreters/perl {}) perl526 perl528 perldevel;
+  inherit (callPackages ../development/interpreters/perl {}) perl528 perldevel;
 
   pachyderm = callPackage ../applications/networking/cluster/pachyderm { };
 
@@ -13158,10 +13158,6 @@ in
 
   ### DEVELOPMENT / PERL MODULES
 
-  perl526Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
-    perl = perl526;
-    overrides = (config.perlPackageOverrides or (p: {})) pkgs;
-  });
   # the latest Maint version
   perl528Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
     perl = perl528;

From 5229e8be63ce66577da1aa088b5dcedc30bba611 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:54:26 +0000
Subject: [PATCH 068/182] perl-packages.nix: min version set to 5.28.1 (so the
 modules bundled with this version can be removed from nixpkgs)

---
 pkgs/top-level/perl-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 74e9e60a0f88..9119878b55c6 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7,8 +7,8 @@
 
 {config, pkgs, fetchurl, fetchFromGitHub, stdenv, gnused, perl, overrides}:
 
-# cpan2nix assumes that perl-packages.nix will be used only with perl 5.26 or above
-assert stdenv.lib.versionAtLeast perl.version "5.26";
+# cpan2nix assumes that perl-packages.nix will be used only with perl 5.28.1 or above
+assert stdenv.lib.versionAtLeast perl.version "5.28.1";
 let
   inherit (stdenv.lib) maintainers;
   self = _self // overrides;

From d4576f77aa97b1805aecd64710f9a27ac20d339c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 14 Dec 2018 15:57:07 +0100
Subject: [PATCH 069/182] =?UTF-8?q?librsvg:=202.44.9=20=E2=86=92=202.44.10?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/librsvg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 5a5fa3e279ab..602b6708df07 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -5,14 +5,14 @@
 
 let
   pname = "librsvg";
-  version = "2.44.9";
+  version = "2.44.10";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1ivg7cz7zlfjhnxvp7z2344r8r0z02mjh4mpgy823az6ps62igwj";
+    sha256 = "1bnasw669dzyxmnx51ymnhbjgb5d4gb1pb3f26qyh017ajqrdz7l";
   };
 
   outputs = [ "out" "dev" "installedTests" ];

From f4bff8b56d824ef89250aca4b386eab16f8c17c5 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:54:48 +0000
Subject: [PATCH 070/182] [cpan2nix] perlPackages.threads: removed built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 9119878b55c6..4b5ce4f813e1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16620,17 +16620,7 @@ let
     buildInputs = [ TestDifferences ];
   };
 
-  threads = buildPerlPackage rec {
-    name = "threads-2.21";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JD/JDHEDDEN/${name}.tar.gz";
-      sha256 = "047i22mdnf7fa0h9w5jhqrjbg561l5jxk8xqzwh6zbmwlac4qf98";
-    };
-    meta = {
-      description = "Perl interpreter-based threads";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  threads = null; # part of Perl 5.28
 
   threadsshared = buildPerlPackage rec {
     name = "threads-shared-1.58";

From 9b4c9e9c7bf07b36e33dfacbc0d41185c861a5c1 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:54:17 +0000
Subject: [PATCH 071/182] [cpan2nix] perlPackages.UnicodeCollate: removed
 built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4b5ce4f813e1..2dde8457dc18 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17004,17 +17004,7 @@ let
     };
   };
 
-  UnicodeCollate = buildPerlPackage rec {
-    name = "Unicode-Collate-1.25";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SA/SADAHIRO/${name}.tar.gz";
-      sha256 = "1dpvck4saah8hqb9c82i25yimy9x2hkr1k3a2f1ly0k0ifhbiyyx";
-    };
-    meta = {
-      description = "Unicode Collation Algorithm";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  UnicodeCollate = null; # part of Perl 5.28
 
   UnicodeLineBreak = buildPerlPackage rec {
     name = "Unicode-LineBreak-2018.003";

From a004f7e6702c31c991a3b4f2ce77556b6db162e4 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:54:13 +0000
Subject: [PATCH 072/182] [cpan2nix] perlPackages.TimeHiRes: removed built-in

---
 pkgs/top-level/perl-packages.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2dde8457dc18..ff8cd940e116 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16808,13 +16808,7 @@ let
     };
   };
 
-  TimeHiRes = buildPerlPackage rec {
-    name = "Time-HiRes-1.9758";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/J/JH/JHI/Time-HiRes-1.9758.tar.gz;
-      sha256 = "07jbydcdzpjm6i4nidci0rlklx4kla210fsl6zishw0yq5di9yjv";
-    };
-  };
+  TimeHiRes = null; # part of Perl 5.28
 
   TimeLocal = buildPerlPackage {
     name = "Time-Local-1.28";

From 6f4c9b145b79b8e2439a5cf2bcedf48bb2a1cafa Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:53:32 +0000
Subject: [PATCH 073/182] [cpan2nix] perlPackages.TestHarness: removed built-in

---
 pkgs/top-level/perl-packages.nix | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ff8cd940e116..1a83bbeb1231 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -15182,19 +15182,7 @@ let
     };
   };
 
-  TestHarness = buildPerlPackage {
-    name = "Test-Harness-3.42";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/L/LE/LEONT/Test-Harness-3.42.tar.gz;
-      sha256 = "0fd90d4efea82d6e262e6933759e85d27cbcfa4091b14bf4042ae20bab528e53";
-    };
-    doCheck = false; # makes assumptions about path to Perl
-    meta = {
-      homepage = http://testanything.org/;
-      description = "Run Perl standard test scripts with statistics";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  TestHarness = null; # part of Perl 5.28
 
   TestHarnessStraps = buildPerlModule {
     name = "Test-Harness-Straps-0.30";

From 2b6efa66cb03382f0b817f3d8f402e1c4064ba09 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:53:04 +0000
Subject: [PATCH 074/182] [cpan2nix] perlPackages.Socket: removed built-in

---
 pkgs/top-level/perl-packages.nix | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1a83bbeb1231..4ee3cd814818 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13573,21 +13573,7 @@ let
     buildInputs = [ TestWarn XMLParserLite ];
   };
 
-  Socket = buildPerlPackage {
-    name = "Socket-2.027";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PEVANS/Socket-2.027.tar.gz;
-      sha256 = "1a725fbqx6bjzjf63bgs5wvzd20kffz1f94pbmv1670p9m4i270l";
-    };
-    postPatch = ''
-      # requires network access
-      rm t/getnameinfo.t t/getaddrinfo.t
-    '';
-    meta = {
-      description = "Networking constants and support functions";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  Socket = null; # part of Perl 5.28
 
   Socket6 = buildPerlPackage rec {
     name = "Socket6-0.29";

From cacfef0891296cee08ca51932b31fd958df9e895 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:53:02 +0000
Subject: [PATCH 075/182] [cpan2nix] perlPackages.SelfLoader: removed built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4ee3cd814818..258125548888 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13391,17 +13391,7 @@ let
     };
   };
 
-  SelfLoader = buildPerlPackage {
-    name = "SelfLoader-1.24";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SM/SMUELLER/SelfLoader-1.24.tar.gz;
-      sha256 = "4c7cd20fd82aa10520ac14b05fa003f60c72bb4c95527bd12aec8bf3c4546098";
-    };
-    meta = {
-      description = "Load functions only on demand";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  SelfLoader = null; # part of Perl 5.28
 
   SerealDecoder = buildPerlPackage rec {
     name = "Sereal-Decoder-4.005";

From 2fe502905edac68c1c3fda41bea70527196498ac Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:51:10 +0000
Subject: [PATCH 076/182] [cpan2nix] perlPackages.IOSocketIP: removed built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 258125548888..a37e94987d32 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7716,17 +7716,7 @@ let
     };
   };
 
-  IOSocketIP = buildPerlModule {
-    name = "IO-Socket-IP-0.39";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PEVANS/IO-Socket-IP-0.39.tar.gz;
-      sha256 = "11950da7636cb786efd3bfb5891da4c820975276bce43175214391e5c32b7b96";
-    };
-    meta = {
-      description = "Family-neutral IP socket supporting both IPv4 and IPv6";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  IOSocketIP = null; # part of Perl 5.28
 
   IOSocketInet6 = buildPerlModule rec {
     name = "IO-Socket-INET6-2.72";

From f2615b7474fe39f9e8a15a2c6dd2a3b32b45c568 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:50:46 +0000
Subject: [PATCH 077/182] [cpan2nix] perlPackages.FilterSimple: removed
 built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a37e94987d32..dd3bfabe2da9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6198,17 +6198,7 @@ let
     };
   };
 
-  FilterSimple = buildPerlPackage {
-    name = "Filter-Simple-0.94";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SM/SMUELLER/Filter-Simple-0.94.tar.gz;
-      sha256 = "1lkrgsqaxf595ha1y29gxqqf4kf8cpm5yzr4gg7zngbq1nb0pz6g";
-    };
-    meta = {
-      description = "Simplified source filtering";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  FilterSimple = null; # part of Perl 5.28
 
   FinanceQuote = buildPerlPackage rec {
     name = "Finance-Quote-1.47";

From 1e5cee06d03adc3dca36ae1cefcb29f4da7f63cf Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:50:35 +0000
Subject: [PATCH 078/182] [cpan2nix] perlPackages.ExtUtilsParseXS: removed
 built-in

---
 pkgs/top-level/perl-packages.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index dd3bfabe2da9..0ba13775a37e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5466,13 +5466,7 @@ let
     };
   };
 
-  ExtUtilsParseXS = buildPerlPackage rec {
-    name = "ExtUtils-ParseXS-3.35";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SM/SMUELLER/${name}.tar.gz";
-      sha256 = "077fqiyabydm8j34wxzxwxskyidh8nmwq9gskaxai8kq298z1pj1";
-    };
-  };
+  ExtUtilsParseXS = null; # part of Perl 5.28
 
   ExtUtilsPkgConfig = buildPerlPackage rec {
     name = "ExtUtils-PkgConfig-1.16";

From 6f900b11698a7d1a5ea0dfa9a231408e6d10dcd2 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:50:28 +0000
Subject: [PATCH 079/182] [cpan2nix] perlPackages.ExtUtilsCBuilder: removed
 built-in

---
 pkgs/top-level/perl-packages.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0ba13775a37e..b80c522b56ef 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5318,13 +5318,7 @@ let
     };
   };
 
-  ExtUtilsCBuilder = buildPerlPackage rec {
-    name = "ExtUtils-CBuilder-0.280230";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/A/AM/AMBS/ExtUtils-CBuilder-0.280230.tar.gz;
-      sha256 = "1mcwvic01x0flcz3jsny5j8j5zz96r63qjwq75hs42cpf3by3ahx";
-    };
-  };
+  ExtUtilsCBuilder = null; # part of Perl 5.28
 
   ExtUtilsCChecker = buildPerlModule rec {
     name = "ExtUtils-CChecker-0.10";

From 6ddd5c1509ec46c0415c73d7113ae3d4a70cf625 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 14:49:30 +0000
Subject: [PATCH 080/182] [cpan2nix] perlPackages.Carp: removed built-in

---
 pkgs/top-level/perl-packages.nix | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b80c522b56ef..e063761da0e3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1088,17 +1088,7 @@ let
     };
   };
 
-  Carp = buildPerlPackage rec {
-    name = "Carp-1.50";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/X/XS/XSAWYERX/Carp-1.50.tar.gz;
-      sha256 = "1ngbpjyd9qi7n4h5r3q3qibd8by7rfiv7364jqlv4lbd3973n9zm";
-    };
-    meta = with stdenv.lib; {
-      description = "Alternative warn and die for modules";
-      license = with licenses; [ artistic1 gpl1Plus ];
-    };
-  };
+  Carp = null; # part of Perl 5.28
 
   CarpAlways = buildPerlPackage rec {
     name = "Carp-Always-0.16";

From 6a9a53347679b553f60a747f89a80a679a1f806e Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 15:08:27 +0000
Subject: [PATCH 081/182] perl-packages.nix: put removed modules under
 config.allowAliases

---
 pkgs/top-level/perl-packages.nix | 34 +++++++++++---------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e063761da0e3..e0186af67458 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1088,8 +1088,6 @@ let
     };
   };
 
-  Carp = null; # part of Perl 5.28
-
   CarpAlways = buildPerlPackage rec {
     name = "Carp-Always-0.16";
     src = fetchurl {
@@ -5308,8 +5306,6 @@ let
     };
   };
 
-  ExtUtilsCBuilder = null; # part of Perl 5.28
-
   ExtUtilsCChecker = buildPerlModule rec {
     name = "ExtUtils-CChecker-0.10";
     src = fetchurl {
@@ -5450,8 +5446,6 @@ let
     };
   };
 
-  ExtUtilsParseXS = null; # part of Perl 5.28
-
   ExtUtilsPkgConfig = buildPerlPackage rec {
     name = "ExtUtils-PkgConfig-1.16";
     src = fetchurl {
@@ -6176,8 +6170,6 @@ let
     };
   };
 
-  FilterSimple = null; # part of Perl 5.28
-
   FinanceQuote = buildPerlPackage rec {
     name = "Finance-Quote-1.47";
     src = fetchurl {
@@ -7684,8 +7676,6 @@ let
     };
   };
 
-  IOSocketIP = null; # part of Perl 5.28
-
   IOSocketInet6 = buildPerlModule rec {
     name = "IO-Socket-INET6-2.72";
     src = fetchurl {
@@ -13349,8 +13339,6 @@ let
     };
   };
 
-  SelfLoader = null; # part of Perl 5.28
-
   SerealDecoder = buildPerlPackage rec {
     name = "Sereal-Decoder-4.005";
     src = fetchurl {
@@ -13521,8 +13509,6 @@ let
     buildInputs = [ TestWarn XMLParserLite ];
   };
 
-  Socket = null; # part of Perl 5.28
-
   Socket6 = buildPerlPackage rec {
     name = "Socket6-0.29";
     src = fetchurl {
@@ -15116,8 +15102,6 @@ let
     };
   };
 
-  TestHarness = null; # part of Perl 5.28
-
   TestHarnessStraps = buildPerlModule {
     name = "Test-Harness-Straps-0.30";
     src = fetchurl {
@@ -16542,8 +16526,6 @@ let
     buildInputs = [ TestDifferences ];
   };
 
-  threads = null; # part of Perl 5.28
-
   threadsshared = buildPerlPackage rec {
     name = "threads-shared-1.58";
     src = fetchurl {
@@ -16730,8 +16712,6 @@ let
     };
   };
 
-  TimeHiRes = null; # part of Perl 5.28
-
   TimeLocal = buildPerlPackage {
     name = "Time-Local-1.28";
     src = fetchurl {
@@ -16920,8 +16900,6 @@ let
     };
   };
 
-  UnicodeCollate = null; # part of Perl 5.28
-
   UnicodeLineBreak = buildPerlPackage rec {
     name = "Unicode-LineBreak-2018.003";
     src = fetchurl {
@@ -17807,6 +17785,18 @@ let
   UnicodeNormalize = null; # part of Perl 5.26
   XSLoader = null; # part of Perl 5.26
 
+  Carp = null; # part of Perl 5.28
+  ExtUtilsCBuilder = null; # part of Perl 5.28
+  ExtUtilsParseXS = null; # part of Perl 5.28
+  FilterSimple = null; # part of Perl 5.28
+  IOSocketIP = null; # part of Perl 5.28
+  SelfLoader = null; # part of Perl 5.28
+  Socket = null; # part of Perl 5.28
+  TestHarness = null; # part of Perl 5.28
+  threads = null; # part of Perl 5.28
+  TimeHiRes = null; # part of Perl 5.28
+  UnicodeCollate = null; # part of Perl 5.28
+
   ArchiveZip_1_53 = self.ArchiveZip;
   Autobox = self.autobox;
   CommonSense = self.commonsense; # For backwards compatibility.

From 707c059eb233b61e0cb9371e81236690ac89bb7d Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 15:31:46 +0000
Subject: [PATCH 082/182] znapzend: fix eval

---
 pkgs/tools/backup/znapzend/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index bc57215c0c4b..e9218fd403e5 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
   postInstall = ''
     substituteInPlace $out/bin/znapzend --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
       "
     substituteInPlace $out/bin/znapzendzetup --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
@@ -68,7 +66,6 @@ stdenv.mkDerivation rec {
       "
     substituteInPlace $out/bin/znapzendztatz --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \

From 6d2edfb0b86927319de59dcd6c98f9a66cd57f65 Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Fri, 14 Dec 2018 15:40:36 +0000
Subject: [PATCH 083/182] treewide: remove aliases evaluated to `null`

---
 .../scripts/nix-generate-from-cpan.nix        |  2 +-
 pkgs/applications/graphics/feh/default.nix    |  2 +-
 pkgs/applications/misc/slic3r/default.nix     |  6 ++--
 pkgs/applications/misc/slic3r/prusa3d.nix     |  1 -
 .../networking/sieve-connect/default.nix      |  2 +-
 pkgs/servers/foswiki/default.nix              |  4 +--
 pkgs/servers/monitoring/munin/default.nix     |  3 +-
 pkgs/servers/openxpki/default.nix             | 36 +++++++++----------
 pkgs/tools/backup/znapzend/default.nix        |  2 +-
 pkgs/tools/security/john/default.nix          |  2 +-
 pkgs/tools/security/signing-party/default.nix |  2 +-
 pkgs/tools/text/popfile/default.nix           |  1 -
 pkgs/tools/text/schema2ldif/default.nix       |  2 +-
 pkgs/tools/typesetting/biber/default.nix      |  4 +--
 pkgs/top-level/perl-packages.nix              |  2 +-
 15 files changed, 34 insertions(+), 37 deletions(-)

diff --git a/maintainers/scripts/nix-generate-from-cpan.nix b/maintainers/scripts/nix-generate-from-cpan.nix
index ec406ac1a703..5c4cf0f6c558 100644
--- a/maintainers/scripts/nix-generate-from-cpan.nix
+++ b/maintainers/scripts/nix-generate-from-cpan.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
   buildInputs = with perlPackages; [
-    makeWrapper perl CPANMeta GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 8938df4d42de..ff59a7fe6eed 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
+  checkInputs = [ perlPackages.TestCommand ];
   preCheck = ''
     export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
   '';
diff --git a/pkgs/applications/misc/slic3r/default.nix b/pkgs/applications/misc/slic3r/default.nix
index 7b28462d5527..e012c3763b34 100644
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pg4jxzb7f58ls5s8mygza8kqdap2c50kwlsdkf28bz1xi611zbi";
   };
 
-  buildInputs = 
-  [boost] ++ 
+  buildInputs =
+  [boost] ++
   (with perlPackages; [ perl makeWrapper which
-    EncodeLocale MathClipper ExtUtilsXSpp threads
+    EncodeLocale MathClipper ExtUtilsXSpp
     MathConvexHullMonotoneChain MathGeometryVoronoi MathPlanePath Moo
     IOStringy ClassXSAccessor Wx GrowlGNTP NetDBus ImportInto XMLSAX
     ExtUtilsMakeMaker OpenGL WxGLCanvas ModuleBuild LWP
diff --git a/pkgs/applications/misc/slic3r/prusa3d.nix b/pkgs/applications/misc/slic3r/prusa3d.nix
index 251ee4d918b4..680703737c2a 100644
--- a/pkgs/applications/misc/slic3r/prusa3d.nix
+++ b/pkgs/applications/misc/slic3r/prusa3d.nix
@@ -74,7 +74,6 @@ stdenv.mkDerivation rec {
     Moo
     NetDBus
     OpenGL
-    threads
     XMLSAX
   ]);
 
diff --git a/pkgs/applications/networking/sieve-connect/default.nix b/pkgs/applications/networking/sieve-connect/default.nix
index 78910d1ecf6e..472a26274f87 100644
--- a/pkgs/applications/networking/sieve-connect/default.nix
+++ b/pkgs/applications/networking/sieve-connect/default.nix
@@ -29,7 +29,7 @@
 
     wrapProgram $out/bin/sieve-connect \
       --prefix PERL5LIB : "${stdenv.lib.makePerlPath (with perlPackages; [
-        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS PodUsage
+        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS
         TermReadKey TermReadLineGnu ])}"
   '';
 
diff --git a/pkgs/servers/foswiki/default.nix b/pkgs/servers/foswiki/default.nix
index 542322d0e621..572d1736755b 100644
--- a/pkgs/servers/foswiki/default.nix
+++ b/pkgs/servers/foswiki/default.nix
@@ -15,8 +15,8 @@ perlPackages.buildPerlPackage rec {
     # minimum requirements from INSTALL.html#System_Requirements
     AlgorithmDiff ArchiveTar AuthenSASL CGI CGISession CryptPasswdMD5
     EmailMIME Encode Error FileCopyRecursive HTMLParser HTMLTree
-    IOSocketIP IOSocketSSL JSON
-    LocaleMaketext LocaleMaketextLexicon LocaleMsgfmt
+    IOSocketSSL JSON
+    LocaleMaketextLexicon LocaleMsgfmt
     LWP URI perlPackages.version
     /*# optional dependencies
     libapreq2 DBI DBDmysql DBDPg DBDSQLite FCGI FCGIProcManager
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 72d5f124c63d..1f3ad21d0e0d 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
     perlPackages.NetSNMP
     perlPackages.NetServer
     perlPackages.ListMoreUtils
-    perlPackages.TimeHiRes
     perlPackages.LWP
     perlPackages.DBDPg
     python
@@ -121,7 +120,7 @@ stdenv.mkDerivation rec {
           --set PERL5LIB "$out/lib/perl5/site_perl:${with perlPackages; stdenv.lib.makePerlPath [
                 LogLog4perl IOSocketInet6 Socket6 URI DBFile DateManip
                 HTMLTemplate FileCopyRecursive FCGI NetCIDR NetSNMP NetServer
-                ListMoreUtils TimeHiRes DBDPg LWP rrdtool
+                ListMoreUtils DBDPg LWP rrdtool
                 ]}"
     done
   '';
diff --git a/pkgs/servers/openxpki/default.nix b/pkgs/servers/openxpki/default.nix
index 2b1000d0d851..192951607bfa 100644
--- a/pkgs/servers/openxpki/default.nix
+++ b/pkgs/servers/openxpki/default.nix
@@ -20,34 +20,34 @@ perlPackages.buildPerlPackage {
       IPCShareLite JSON LogLog4perl LWPProtocolConnect LWPProtocolHttps MailRFC822Address
       Moose NetAddrIP NetDNS NetIP perlldap NetHTTP NetServer NetSSLeay ParamsValidate PathClass
       ProcProcessTable ProcSafeExec RegexpCommon SOAPLite Switch SysSigAction TemplateToolkit
-      TestPod TestPodCoverage TextCSV_XS TimeHiRes Workflow XMLFilterXInclude XMLParser
+      TestPod TestPodCoverage TextCSV_XS Workflow XMLFilterXInclude XMLParser
       XMLSAX XMLSAXWriter XMLSimple XMLValidatorSchema ]
     ++ stdenv.lib.optionals extraDependencies1
     [ # dependencies from parsing through core/server
-      ClassAccessor Carp PathTools DataDumper DateTime DateTimeFormatStrptime DBI DigestMD5
-      Encode ExceptionClass Exporter FilePath FileTemp Filter GetoptLong HTMLParser
-      ScalarListUtils MathBigInt Memoize libnet PodUsage RTClientREST Socket
-      Storable XSLoader ]
+      ClassAccessor PathTools DataDumper DateTime DateTimeFormatStrptime DBI
+      Encode ExceptionClass FilePath FileTemp Filter GetoptLong HTMLParser
+      ScalarListUtils MathBigInt Memoize libnet RTClientREST
+      Storable ]
     ++ stdenv.lib.optionals extraDependencies2
     [ # dependencies taken from Debian
-      MooseXTypesPathClass DataStreamBulk MooseXStrictConstructor NamespaceAutoclean GitPurePerl
+      MooseXTypesPathClass DataStreamBulk MooseXStrictConstructor GitPurePerl
       ConfigGitLike DevelStackTrace TreeDAGNode ClassObservable ClassFactory TimeDate ConfigAny
       CGIFast ClassISA YAML YAMLLibYAML AuthenSASL TextCSV FileFindRulePerl IODigest ]
     ++ stdenv.lib.optionals extraDependencies3
     [ # dependencies taken from https://metacpan.org/pod/release/ALECH/Bundle-OpenXPKI-0.06/lib/Bundle/OpenXPKI.pm
-      AttributeHandlers AttributeParamsValidate AutoLoader BC CGI CPAN CacheCache ClassClassgenclassgen
+      AttributeParamsValidate BC CGI CPAN CacheCache ClassClassgenclassgen
       ClassContainer ClassDataInheritable ClassSingleton ConvertASN1 DBDSQLite DBIxHTMLViewLATEST
-      DBFile DataPage DataSpreadPagination DateTimeLocale DateTimeTimeZone DevelPPPort DevelSelfStubber
-      DevelSymdump DigestSHA1 Env Error ExtUtilsCommand ExtUtilsConstant ExtUtilsInstall
-      ExtUtilsMakeMaker FileCheckTree FilterSimple GoferTransporthttp HTMLMason HTMLTagset
-      HTTPServerSimpleMason I18NCollate IO IPCSysV LocaleCodes LocaleMaketext LogDispatch MathBigRat
-      MathComplex MathRound ModuleBuild ModuleBuildDeprecated NetPing PerlIOviaQuotedPrint PodChecker
-      PodCoverage PodEscapes PodLaTeX PodParser PodPerldoc PodPlainer PodSimple Safe SearchDict SelfLoader
-      SubUplevel SysSyslog TemplatePluginAutoformat TermANSIColor TermCap TermReadKey Test TestException
-      TestHTTPServerSimple TestHarness TestHarnessStraps TextAbbrev TextBalanced TextIconv TextSoundex
-      TextTabsWrap ThreadQueue ThreadSemaphore TieFile TieRefHash TimeLocal URI UnicodeCollate
-      UnicodeNormalize WWWMechanize Want XMLFilterBufferText XMLNamespaceSupport autodie base bignum if_
-      lib libapreq2 libnet podlators threads threadsshared version ];
+      DBFile DataPage DataSpreadPagination DateTimeLocale DateTimeTimeZone DevelPPPort
+      DevelSymdump DigestSHA1 Env Error ExtUtilsConstant ExtUtilsInstall
+      ExtUtilsMakeMaker FileCheckTree GoferTransporthttp HTMLMason HTMLTagset
+      HTTPServerSimpleMason IO IPCSysV LocaleCodes LogDispatch MathBigRat
+      MathRound ModuleBuild ModuleBuildDeprecated NetPing PodChecker
+      PodCoverage PodLaTeX PodParser PodPerldoc PodPlainer PodSimple
+      SubUplevel SysSyslog TemplatePluginAutoformat TermReadKey TestException
+      TestHTTPServerSimple TestHarnessStraps TextBalanced TextIconv TextSoundex
+      ThreadQueue TieFile TieRefHash TimeLocal URI
+      UnicodeNormalize WWWMechanize Want XMLFilterBufferText XMLNamespaceSupport bignum
+      libapreq2 libnet podlators threadsshared version ];
 
   preConfigure = ''
     substituteInPlace core/server/Makefile.PL \
diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index e9218fd403e5..5314eef9eb6a 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     sha256 = checksum;
   };
 
-  buildInputs = [ wget perl perlPackages.TestHarness MojoIOLoopForkCall-0-17 perlPackages.TAPParserSourceHandlerpgTAP ];
+  buildInputs = [ wget perl MojoIOLoopForkCall-0-17 perlPackages.TAPParserSourceHandlerpgTAP ];
 
   nativeBuildInputs = [ autoconf automake ];
 
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index cb545570f51f..97f6ec21b548 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl nss nspr kerberos gmp zlib libpcap re2 gcc pythonPackages.wrapPython perl makeWrapper ];
   propagatedBuildInputs = (with pythonPackages; [ dpkt scapy lxml ]) ++ # For pcap2john.py
-                          (with perlPackages; [ DigestMD4 DigestMD5 DigestSHA1 GetoptLong # For pass_gen.pl
+                          (with perlPackages; [ DigestMD4 DigestSHA1 GetoptLong # For pass_gen.pl
                                                 perlldap ]); # For sha-dump.pl
                           # TODO: Get dependencies for radius2john.pl and lion2john-alt.pl
 
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 14848df3f3ad..2fe7b3e3ceff 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -10,7 +10,7 @@ let
   GnuPGInterfaceRuntimeDependencies = with perlPackages; [
     strictures ClassMethodModifiers DataPerl DevelGlobalDestruction ExporterTiny
     GnuPGInterface ListMoreUtils ModuleRuntime Moo MooXHandlesVia MooXlate
-    RoleTiny SubExporterProgressive SubQuote TypeTiny XSLoader
+    RoleTiny SubExporterProgressive SubQuote TypeTiny
   ];
 in stdenv.mkDerivation rec {
   pname = "signing-party";
diff --git a/pkgs/tools/text/popfile/default.nix b/pkgs/tools/text/popfile/default.nix
index dbc16cf7a453..5e76e3541733 100644
--- a/pkgs/tools/text/popfile/default.nix
+++ b/pkgs/tools/text/popfile/default.nix
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
     perl
     DBI
     DBDSQLite
-    DigestMD5
     HTMLTagset
     TimeDate # == DateParse
     HTMLTemplate
diff --git a/pkgs/tools/text/schema2ldif/default.nix b/pkgs/tools/text/schema2ldif/default.nix
index 699d2d28b82b..b40ceadf978c 100644
--- a/pkgs/tools/text/schema2ldif/default.nix
+++ b/pkgs/tools/text/schema2ldif/default.nix
@@ -18,7 +18,7 @@
     gzip -c man/ldap-schema-manager.1 > $out/share/man/man1/ldap-schema-manager.1.gz
 
     wrapProgram $out/bin/schema2ldif \
-       --prefix PERL5PATH : "${stdenv.lib.makePerlPath [ perlPackages.GetoptLong perlPackages.PodUsage ]}"
+       --prefix PERL5PATH : "${stdenv.lib.makePerlPath [ perlPackages.GetoptLong ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/biber/default.nix b/pkgs/tools/typesetting/biber/default.nix
index ea9b68f02b9e..123147cb5f17 100644
--- a/pkgs/tools/typesetting/biber/default.nix
+++ b/pkgs/tools/typesetting/biber/default.nix
@@ -20,8 +20,8 @@ perlPackages.buildPerlModule rec {
     DateTime DateTimeFormatBuilder DateTimeCalendarJulian
     ExtUtilsLibBuilder FileSlurper FileWhich IPCRun3 LogLog4perl LWPProtocolHttps ListAllUtils
     ListMoreUtils MozillaCA ReadonlyXS RegexpCommon TextBibTeX
-    UnicodeCollate UnicodeLineBreak URI XMLLibXMLSimple XMLLibXSLT XMLWriter
-    ClassAccessor TextCSV TextCSV_XS TextRoman DataUniqid LinguaTranslit UnicodeNormalize SortKey
+    UnicodeLineBreak URI XMLLibXMLSimple XMLLibXSLT XMLWriter
+    ClassAccessor TextCSV TextCSV_XS TextRoman DataUniqid LinguaTranslit SortKey
     TestDifferences
   ];
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e0186af67458..5c006597fa9c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12049,7 +12049,7 @@ let
       sha256 = "0xk4h4dzl80kf97lbx0nznx9ajrb6kkg7k3iwca3rj6f3rqggv9y";
     };
     outputs = [ "out" ];
-    buildInputs = [ DBDmysql DBI IOSocketSSL TermReadKey TimeHiRes ];
+    buildInputs = [ DBDmysql DBI IOSocketSSL TermReadKey ];
     meta = {
       description = ''Collection of advanced command-line tools to perform a variety of MySQL and system tasks.'';
       homepage = http://www.percona.com/software/percona-toolkit;

From a6d4a0c53c88bf47482b17665fe2675f4cc82bb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= <torhedinbronner@gmail.com>
Date: Fri, 14 Dec 2018 09:54:41 +0100
Subject: [PATCH 084/182] valgrind: fix build on darwin

We fixed a race condition in #51505 and #51107. This required running
autoreconfHook to pick up the `coregrind-makefile-race.patch` patch.

Unfortunately this broke darwin's postPatch fixes as autoreconfHook would run
afterwards regenerating the fixed makefiles.

Moving the postPatch fixes to preConfigure should resolve the issue.

I left `postPatch = ""` in to avoid a rebuild on linux.
---
 pkgs/development/tools/analysis/valgrind/default.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index ca8d64f91327..d70ec0ed9ac5 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -31,12 +31,8 @@ stdenv.mkDerivation rec {
     in ''
       echo "Don't derive our xnu version using uname -r."
       substituteInPlace configure --replace "uname -r" "echo ${OSRELEASE}"
-    ''
-  );
 
-  postPatch = stdenv.lib.optionalString (stdenv.isDarwin)
-    # Apple's GCC doesn't recognize `-arch' (as of version 4.2.1, build 5666).
-    ''
+      # Apple's GCC doesn't recognize `-arch' (as of version 4.2.1, build 5666).
       echo "getting rid of the \`-arch' GCC option..."
       find -name Makefile\* -exec \
         sed -i {} -e's/DARWIN\(.*\)-arch [^ ]\+/DARWIN\1/g' \;
@@ -60,7 +56,10 @@ stdenv.mkDerivation rec {
       echo "substitute hardcoded /usr/bin/ld with ${cctools}/bin/ld"
       substituteInPlace coregrind/link_tool_exe_darwin.in \
         --replace /usr/bin/ld ${cctools}/bin/ld
-    '';
+    '');
+
+  # To prevent rebuild on linux when moving darwin's postPatch fixes to preConfigure
+  postPatch = "";
 
   configureFlags =
     stdenv.lib.optional (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin") "--enable-only64bit";

From 921d046537f6d7f0fc0db07b7aa46be7e9df030b Mon Sep 17 00:00:00 2001
From: Craig Younkins <cyounkins@gmail.com>
Date: Fri, 14 Dec 2018 15:49:09 -0500
Subject: [PATCH 085/182] git: wrap git-credential-netrc to set PERL5LIB
 (#50992)

---
 .../version-management/git-and-tools/git/default.nix          | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 88704ef281eb..e218872cca30 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -133,7 +133,6 @@ stdenv.mkDerivation {
       # Install contrib stuff.
       mkdir -p $out/share/git
       cp -a contrib $out/share/git/
-      ln -s "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/
       mkdir -p $out/share/emacs/site-lisp
       ln -s "$out/share/git/contrib/emacs/"*.el $out/share/emacs/site-lisp/
       mkdir -p $out/etc/bash_completion.d
@@ -178,6 +177,9 @@ stdenv.mkDerivation {
       for i in ${builtins.toString perlLibs}; do
         gitperllib=$gitperllib:$i/lib/perl5/site_perl
       done
+
+      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/git-credential-netrc \
+                  --set PERL5LIB "$gitperllib"
       wrapProgram $out/libexec/git-core/git-cvsimport \
                   --set GITPERLLIB "$gitperllib"
       wrapProgram $out/libexec/git-core/git-add--interactive \

From bb9557eb7ca623ac9c12bae1fe4f95c9e290d27d Mon Sep 17 00:00:00 2001
From: volth <volth@volth.com>
Date: Sat, 15 Dec 2018 03:50:31 +0000
Subject: [PATCH 086/182] lib.makePerlPath -> perlPackages.makePerlPath

---
 lib/default.nix                               |   2 +-
 lib/strings.nix                               |  20 ---
 nixos/lib/testing.nix                         |   4 +-
 nixos/modules/config/users-groups.nix         |   4 +-
 nixos/modules/installer/tools/tools.nix       |   2 +-
 .../command-not-found/command-not-found.nix   |   2 +-
 .../web-servers/lighttpd/collectd.nix         |   2 +-
 .../modules/system/boot/loader/grub/grub.nix  |   2 +-
 nixos/modules/system/etc/etc.nix              |   2 +-
 nixos/modules/testing/service-runner.nix      |   2 +-
 pkgs/applications/audio/abcde/default.nix     |   4 +-
 pkgs/applications/audio/crip/default.nix      |   5 +-
 pkgs/applications/graphics/feh/default.nix    |   2 +-
 .../applications/graphics/shutter/default.nix |   6 +-
 .../applications/misc/extract_url/default.nix |  17 ++-
 pkgs/applications/misc/ikiwiki/default.nix    |  25 ++--
 pkgs/applications/misc/qdirstat/default.nix   |   6 +-
 .../misc/rxvt_unicode/default.nix             |   4 +-
 pkgs/applications/misc/tilix/default.nix      |   1 -
 pkgs/applications/misc/yarssr/default.nix     |  12 +-
 .../networking/irc/weechat/wrapper.nix        |   6 +-
 .../networking/sieve-connect/default.nix      |  12 +-
 .../applications/networking/tsung/default.nix |   6 +-
 .../science/biology/N3/default.nix            |   4 +-
 .../science/biology/conglomerate/default.nix  |   6 +-
 .../science/biology/inormalize/default.nix    |   4 +-
 .../science/biology/minc-tools/default.nix    |   4 +-
 .../science/biology/minc-widgets/default.nix  |   4 +-
 .../science/biology/mni_autoreg/default.nix   |   4 +-
 .../git-and-tools/git/default.nix             |  63 ++++-----
 .../git-and-tools/gitweb/default.nix          |   2 +-
 .../version-management/monotone/default.nix   |   4 +-
 .../version-management/vcsh/default.nix       |  10 +-
 pkgs/build-support/writers/default.nix        |   4 +-
 pkgs/development/libraries/hivex/default.nix  |   7 +-
 .../libraries/libguestfs/default.nix          |  15 ++-
 .../perl-modules/DBD-SQLite/default.nix       |   4 +-
 .../tools/misc/creduce/default.nix            |   5 +-
 .../development/tools/misc/csmith/default.nix |   4 +-
 .../tools/misc/help2man/default.nix           |   9 +-
 .../tools/misc/icon-naming-utils/default.nix  |   6 +-
 pkgs/development/tools/sslmate/default.nix    |   6 +-
 pkgs/development/web/wml/default.nix          |   4 +-
 pkgs/os-specific/linux/apparmor/default.nix   |  10 +-
 pkgs/servers/mail/dkimproxy/default.nix       |   6 +-
 pkgs/servers/mail/dspam/default.nix           |   6 +-
 pkgs/servers/mail/postgrey/default.nix        |   8 +-
 pkgs/servers/mail/spamassassin/default.nix    |  10 +-
 pkgs/servers/monitoring/munin/default.nix     |  14 +-
 pkgs/servers/monitoring/net-snmp/default.nix  |   3 +-
 .../monitoring/plugins/labs_consol_de.nix     |  12 +-
 pkgs/servers/slimserver/default.nix           |  10 +-
 pkgs/tools/backup/store-backup/default.nix    |   2 +-
 .../tools/filesystems/file-rename/default.nix |   2 +-
 pkgs/tools/graphics/fgallery/default.nix      |   6 +-
 pkgs/tools/misc/arp-scan/default.nix          |   2 +-
 pkgs/tools/misc/cloc/default.nix              |  10 +-
 pkgs/tools/misc/debian-devscripts/default.nix |  10 +-
 pkgs/tools/misc/moreutils/default.nix         |   4 +-
 pkgs/tools/misc/rrdtool/default.nix           |   4 +-
 .../networking/infiniband-diags/default.nix   |   4 +-
 pkgs/tools/networking/mosh/default.nix        |   8 +-
 pkgs/tools/networking/slimrat/default.nix     |   6 +-
 pkgs/tools/networking/smokeping/default.nix   |  13 +-
 pkgs/tools/networking/swaks/default.nix       |   2 +-
 pkgs/tools/networking/swec/default.nix        |  13 +-
 pkgs/tools/networking/wget/default.nix        |  10 +-
 pkgs/tools/package-management/apt/default.nix |   9 +-
 pkgs/tools/security/kpcli/default.nix         |   2 +-
 pkgs/tools/security/monkeysphere/default.nix  |   2 +-
 pkgs/tools/security/pcsctools/default.nix     |  11 +-
 pkgs/tools/security/signing-party/default.nix |  14 +-
 pkgs/tools/system/logcheck/default.nix        |  11 +-
 pkgs/tools/text/mb2md/default.nix             |   6 +-
 pkgs/tools/text/namazu/default.nix            |  11 +-
 pkgs/tools/text/schema2ldif/default.nix       |   6 +-
 .../tools/typesetting/docbook2odf/default.nix |   6 +-
 pkgs/tools/typesetting/docbook2x/default.nix  |  14 +-
 .../nixos-container/default.nix               |   4 +-
 pkgs/top-level/all-packages.nix               | 122 ++++--------------
 pkgs/top-level/perl-packages.nix              |  30 ++++-
 81 files changed, 313 insertions(+), 427 deletions(-)

diff --git a/lib/default.nix b/lib/default.nix
index d7a05fec8338..aff36d0e5c2d 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -80,7 +80,7 @@ let
     inherit (strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath makePerlPath makeFullPerlPath optionalString
+      makeLibraryPath makeBinPath optionalString
       hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
diff --git a/lib/strings.nix b/lib/strings.nix
index 48420a367815..47c881cfbc7c 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -162,26 +162,6 @@ rec {
   */
   makeBinPath = makeSearchPathOutput "bin" "bin";
 
-
-  /* Construct a perl search path (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makePerlPath [ pkgs.perlPackages.libnet ]
-       => "/nix/store/n0m1fk9c960d8wlrs62sncnadygqqc6y-perl-Net-SMTP-1.25/lib/perl5/site_perl"
-  */
-  # FIXME(zimbatm): this should be moved in perl-specific code
-  makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";
-
-  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makeFullPerlPath [ pkgs.perlPackages.CGI ]
-       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
-  */
-  makeFullPerlPath = deps: makePerlPath (lib.misc.closePropagation deps);
-
   /* Depending on the boolean `cond', return either the given string
      or the empty string. Useful to concatenate against a bigger string.
 
diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
index 0bb3fd53e853..05b06ca467e4 100644
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@@ -34,14 +34,14 @@ in rec {
         cp ${./test-driver/test-driver.pl} $out/bin/nixos-test-driver
         chmod u+x $out/bin/nixos-test-driver
 
-        libDir=$out/lib/perl5/site_perl
+        libDir=$out/${perl.libPrefix}
         mkdir -p $libDir
         cp ${./test-driver/Machine.pm} $libDir/Machine.pm
         cp ${./test-driver/Logger.pm} $libDir/Logger.pm
 
         wrapProgram $out/bin/nixos-test-driver \
           --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
-          --prefix PERL5LIB : "${with perlPackages; lib.makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/lib/perl5/site_perl"
+          --prefix PERL5LIB : "${with perlPackages; makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/${perl.libPrefix}"
       '';
   };
 
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 137ee243813d..c3f228c9bcc4 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -534,8 +534,8 @@ in {
         install -m 0755 -d /home
 
         ${pkgs.perl}/bin/perl -w \
-          -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl \
-          -I${pkgs.perlPackages.JSON}/lib/perl5/site_perl \
+          -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} \
+          -I${pkgs.perlPackages.JSON}/${pkgs.perl.libPrefix} \
           ${./update-users-groups.pl} ${spec}
       '';
 
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index af0a3a2fcc88..00c4d5018bf5 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -37,7 +37,7 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     path = [ pkgs.btrfs-progs ];
-    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
+    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}";
     inherit (config.system.nixos) release;
   };
 
diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix
index bbe7165c62fb..656c255fcb18 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@@ -16,7 +16,7 @@ let
     isExecutable = true;
     inherit (pkgs) perl;
     inherit (cfg) dbPath;
-    perlFlags = concatStrings (map (path: "-I ${path}/lib/perl5/site_perl ")
+    perlFlags = concatStrings (map (path: "-I ${path}/${pkgs.perl.libPrefix} ")
       [ pkgs.perlPackages.DBI pkgs.perlPackages.DBDSQLite pkgs.perlPackages.StringShellQuote ]);
   };
 
diff --git a/nixos/modules/services/web-servers/lighttpd/collectd.nix b/nixos/modules/services/web-servers/lighttpd/collectd.nix
index 35b5edced68b..e70c980d5243 100644
--- a/nixos/modules/services/web-servers/lighttpd/collectd.nix
+++ b/nixos/modules/services/web-servers/lighttpd/collectd.nix
@@ -48,7 +48,7 @@ in
           "/collectd" => "${cfg.collectionCgi}"
         )
         setenv.add-environment = (
-          "PERL5LIB" => "${with pkgs; lib.makePerlPath [ perlPackages.CGI perlPackages.HTMLParser perlPackages.URI rrdtool ]}",
+          "PERL5LIB" => "${with pkgs.perlPackages; makePerlPath [ CGI HTMLParser URI pkgs.rrdtool ]}",
           "COLLECTION_CONF" => "${collectionConf}"
         )
       }
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 3a33b3f65d36..a1537ad3cedc 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -586,7 +586,7 @@ in
         in pkgs.writeScript "install-grub.sh" (''
         #!${pkgs.runtimeShell}
         set -e
-        export PERL5LIB=${makePerlPath (with pkgs.perlPackages; [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ])}
+        export PERL5LIB=${with pkgs.perlPackages; makePerlPath [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ]}
         ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"}
       '' + flip concatMapStrings cfg.mirroredBoots (args: ''
         ${pkgs.perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 7d43ba07ca57..57ade2880962 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -154,7 +154,7 @@ in
       ''
         # Set up the statically computed bits of /etc.
         echo "setting up /etc..."
-        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl ${./setup-etc.pl} ${etc}/etc
+        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} ${./setup-etc.pl} ${etc}/etc
       '';
 
   };
diff --git a/nixos/modules/testing/service-runner.nix b/nixos/modules/testing/service-runner.nix
index 25490d671152..5ead75788e5c 100644
--- a/nixos/modules/testing/service-runner.nix
+++ b/nixos/modules/testing/service-runner.nix
@@ -6,7 +6,7 @@ let
 
   makeScript = name: service: pkgs.writeScript "${name}-runner"
     ''
-      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl
+      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}
 
       use File::Slurp;
 
diff --git a/pkgs/applications/audio/abcde/default.nix b/pkgs/applications/audio/abcde/default.nix
index 58e8ecc4fcab..240729811352 100644
--- a/pkgs/applications/audio/abcde/default.nix
+++ b/pkgs/applications/audio/abcde/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, libcdio-paranoia, cddiscid, wget, which, vorbis-tools, id3v2, eyeD3
 , lame, flac, glyr
-, perl, MusicBrainz, MusicBrainzDiscID
+, perlPackages
 , makeWrapper }:
 
 let version = "2.9.2";
@@ -29,7 +29,7 @@ in
 
     nativeBuildInputs = [ makeWrapper ];
 
-    buildInputs = [ perl MusicBrainz MusicBrainzDiscID ];
+    buildInputs = with perlPackages; [ perl MusicBrainz MusicBrainzDiscID ];
 
     installFlags = [ "sysconfdir=$(out)/etc" ];
 
diff --git a/pkgs/applications/audio/crip/default.nix b/pkgs/applications/audio/crip/default.nix
index 0383af06795e..f7bf919c2212 100644
--- a/pkgs/applications/audio/crip/default.nix
+++ b/pkgs/applications/audio/crip/default.nix
@@ -2,7 +2,6 @@
 , fetchurl
 , makeWrapper
 
-, perl
 , perlPackages
 
 , cdparanoia
@@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pk9152wll6fmkj1pki3fz3ijlf06jyk32v31yarwvdkwrk7s9xz";
   };
 
-  buildInputs = [ perl perlPackages.CDDB_get ];
+  buildInputs = [ perlPackages.perl perlPackages.CDDB_get ];
   nativeBuildInputs = [ makeWrapper ];
 
   toolDeps = makeBinPath [
@@ -53,7 +52,7 @@ stdenv.mkDerivation rec {
         --replace '$editor = "vim";' '$editor = "${nano}/bin/nano";'
 
       wrapProgram $out/bin/$script \
-        --set PERL5LIB "${makePerlPath [ perlPackages.CDDB_get ]}" \
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.CDDB_get ]}" \
         --set PATH "${toolDeps}"
     done
   '';
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 8938df4d42de..0c0b699f431e 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
   preCheck = ''
-    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
+    export PERL5LIB="${perlPackages.TestCommand}/${perlPackages.perl.libPrefix}"
   '';
 
   doCheck = true;
diff --git a/pkgs/applications/graphics/shutter/default.nix b/pkgs/applications/graphics/shutter/default.nix
index 7e7bf644ce79..5800fb6df3cf 100644
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
+{ stdenv, fetchurl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
 , hicolor-icon-theme, procps
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl procps gdk_pixbuf librsvg ] ++ perlModules;
+  buildInputs = [ perlPackages.perl procps gdk_pixbuf librsvg ] ++ perlModules;
 
   installPhase = ''
     mkdir -p "$out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     (cd "$out" && mv CHANGES README COPYING "$out/share/doc/shutter")
 
     wrapProgram $out/bin/shutter \
-      --set PERL5LIB "${stdenv.lib.makePerlPath perlModules}" \
+      --set PERL5LIB "${perlPackages.makePerlPath perlModules}" \
       --prefix PATH : "${imagemagick.out}/bin" \
       --suffix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
diff --git a/pkgs/applications/misc/extract_url/default.nix b/pkgs/applications/misc/extract_url/default.nix
index 389ac7dfb1fc..2b7888c9cd04 100644
--- a/pkgs/applications/misc/extract_url/default.nix
+++ b/pkgs/applications/misc/extract_url/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, perl
-, MIMEtools, HTMLParser
-, cursesSupport ? true, CursesUI
-, uriFindSupport ? true, URIFind
+{ stdenv, lib, fetchFromGitHub, makeWrapper, perlPackages
+, cursesSupport ? true
+, uriFindSupport ? true
 }:
 
 let
   perlDeps =
-    [ MIMEtools HTMLParser ]
-    ++ lib.optional cursesSupport CursesUI
-    ++ lib.optional uriFindSupport URIFind;
+    [ perlPackages.MIMEtools perlPackages.HTMLParser ]
+    ++ lib.optional cursesSupport perlPackages.CursesUI
+    ++ lib.optional uriFindSupport perlPackages.URIFind;
 
 in stdenv.mkDerivation rec {
   name = "extract_url-${version}";
@@ -22,14 +21,14 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ] ++ perlDeps;
+  buildInputs = [ perlPackages.perl ] ++ perlDeps;
 
   makeFlags = [ "prefix=$(out)" ];
   installFlags = [ "INSTALL=install" ];
 
   postFixup = ''
     wrapProgram "$out/bin/extract_url" \
-      --set PERL5LIB "${lib.makeFullPerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makeFullPerlPath perlDeps}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ikiwiki/default.nix b/pkgs/applications/misc/ikiwiki/default.nix
index 6e4fc2065885..957f0f7f68bb 100644
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@@ -1,13 +1,9 @@
-{ stdenv, fetchurl, perl, gettext, makeWrapper, PerlMagick, YAML
-, TextMarkdown, URI, HTMLParser, HTMLScrubber, HTMLTemplate, TimeDate
-, CGISession, CGIFormBuilder, DBFile, LocaleGettext, RpcXML, XMLSimple
-, YAMLLibYAML, which, HTMLTree, AuthenPassphrase, NetOpenIDConsumer
-, LWPxParanoidAgent, CryptSSLeay
+{ stdenv, fetchurl, perlPackages, gettext, makeWrapper, PerlMagick, which
 , gitSupport ? false, git ? null
 , docutilsSupport ? false, python ? null, docutils ? null
 , monotoneSupport ? false, monotone ? null
 , bazaarSupport ? false, bazaar ? null
-, cvsSupport ? false, cvs ? null, cvsps ? null, Filechdir ? null
+, cvsSupport ? false, cvs ? null, cvsps ? null
 , subversionSupport ? false, subversion ? null
 , mercurialSupport ? false, mercurial ? null
 , extraUtils ? []
@@ -17,7 +13,7 @@ assert docutilsSupport -> (python != null && docutils != null);
 assert gitSupport -> (git != null);
 assert monotoneSupport -> (monotone != null);
 assert bazaarSupport -> (bazaar != null);
-assert cvsSupport -> (cvs != null && cvsps != null && Filechdir != null);
+assert cvsSupport -> (cvs != null && cvsps != null && perlPackages.Filechdir != null);
 assert subversionSupport -> (subversion != null);
 assert mercurialSupport -> (mercurial != null);
 
@@ -35,20 +31,21 @@ stdenv.mkDerivation {
     sha256 = "00d7yzv426fvqbhvzyafddv7fa6b4j2647b0wi371wd5yjj9j3sz";
   };
 
-  buildInputs = [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
-    TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
-    RpcXML XMLSimple PerlMagick YAML YAMLLibYAML which HTMLTree AuthenPassphrase
-    NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ]
+  buildInputs = [ which ]
+    ++ (with perlPackages; [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
+          TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
+          RpcXML XMLSimple PerlMagick YAML YAMLLibYAML HTMLTree AuthenPassphrase
+          NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ])
     ++ lib.optionals docutilsSupport [python docutils]
     ++ lib.optionals gitSupport [git]
     ++ lib.optionals monotoneSupport [monotone]
     ++ lib.optionals bazaarSupport [bazaar]
-    ++ lib.optionals cvsSupport [cvs cvsps Filechdir]
+    ++ lib.optionals cvsSupport [cvs cvsps perlPackages.Filechdir]
     ++ lib.optionals subversionSupport [subversion]
     ++ lib.optionals mercurialSupport [mercurial];
 
   patchPhase = ''
-    sed -i s@/usr/bin/perl@${perl}/bin/perl@ pm_filter mdwn2man
+    sed -i s@/usr/bin/perl@${perlPackages.perl}/bin/perl@ pm_filter mdwn2man
     sed -i s@/etc/ikiwiki@$out/etc@ Makefile.PL
     sed -i /ENV{PATH}/d ikiwiki.in
     # State the gcc dependency, and make the cgi use our wrapper
@@ -60,7 +57,7 @@ stdenv.mkDerivation {
 
   postInstall = ''
     for a in "$out/bin/"*; do
-      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perl}/bin:$out/bin \
+      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perlPackages.perl}/bin:$out/bin \
       ${lib.optionalString gitSupport ''--prefix PATH : ${git}/bin \''}
       ${lib.optionalString monotoneSupport ''--prefix PATH : ${monotone}/bin \''}
       ${lib.optionalString bazaarSupport ''--prefix PATH : ${bazaar}/bin \''}
diff --git a/pkgs/applications/misc/qdirstat/default.nix b/pkgs/applications/misc/qdirstat/default.nix
index cbbac11424ec..ab9029512a20 100644
--- a/pkgs/applications/misc/qdirstat/default.nix
+++ b/pkgs/applications/misc/qdirstat/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qmake
 , coreutils, xdg_utils, bash
-, perl, makeWrapper, perlPackages }:
+, makeWrapper, perlPackages }:
 
 let
   version = "1.4";
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ qmake makeWrapper ];
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
 
   preBuild = ''
     substituteInPlace scripts/scripts.pro \
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/qdirstat-cache-writer \
-      --set PERL5LIB "${stdenv.lib.makePerlPath [ perlPackages.URI ]}"
+      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.URI ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/rxvt_unicode/default.nix b/pkgs/applications/misc/rxvt_unicode/default.nix
index 0e59ef5512d8..57ce1f081801 100644
--- a/pkgs/applications/misc/rxvt_unicode/default.nix
+++ b/pkgs/applications/misc/rxvt_unicode/default.nix
@@ -51,8 +51,8 @@ stdenv.mkDerivation (rec {
     ''
     # make urxvt find its perl file lib/perl5/site_perl is added to PERL5LIB automatically
     + stdenv.lib.optionalString perlSupport ''
-      mkdir -p $out/lib/perl5
-      ln -s $out/{lib/urxvt,lib/perl5/site_perl}
+      mkdir -p $(dirname ${perl.libPrefix})
+      ln -s $out/lib/urxvt $out/${perl.libPrefix}
     '';
 
   postInstall = ''
diff --git a/pkgs/applications/misc/tilix/default.nix b/pkgs/applications/misc/tilix/default.nix
index 98e320b7aaf5..eb7a8e41d4b0 100644
--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     makeFlagsArray=(
-      PERL5LIB="${perlPackages.Po4a}/lib/perl5"
       DCFLAGS='-O -inline -release -version=StdLoggerDisableTrace'
     )
   '';
diff --git a/pkgs/applications/misc/yarssr/default.nix b/pkgs/applications/misc/yarssr/default.nix
index a8ff981400a9..a47fb93512db 100644
--- a/pkgs/applications/misc/yarssr/default.nix
+++ b/pkgs/applications/misc/yarssr/default.nix
@@ -1,8 +1,4 @@
-{
-fetchFromGitHub, stdenv, lib,
-makeWrapper, pkgs,
-perl, perlPackages,
-gnome2 }:
+{ fetchFromGitHub, stdenv, lib, gettext, gtk2, makeWrapper, perlPackages, gnome2 }:
 
 let
   perlDeps = with perlPackages; [
@@ -24,7 +20,7 @@ let
   ];
   libs = [
     stdenv.cc.cc.lib
-    pkgs.gtk2
+    gtk2
   ];
 in
 stdenv.mkDerivation rec {
@@ -38,7 +34,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x7hz8x8qyp3i1vb22zhcnvwxm3jhmmmlr22jqc5b09vpmbw1l45";
   };
 
-  nativeBuildInputs = [ perl pkgs.gettext makeWrapper ];
+  nativeBuildInputs = [ perlPackages.perl gettext makeWrapper ];
   buildInputs = perlDeps ++ [gnome2.libglade];
   propagatedBuildInputs = libs ++ perlDeps;
 
@@ -55,7 +51,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     wrapProgram $out/bin/yarssr \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath libs} \
-      --set PERL5LIB "${lib.makePerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makePerlPath perlDeps}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/irc/weechat/wrapper.nix b/pkgs/applications/networking/irc/weechat/wrapper.nix
index 1e371bb8e223..70628722cbad 100644
--- a/pkgs/applications/networking/irc/weechat/wrapper.nix
+++ b/pkgs/applications/networking/irc/weechat/wrapper.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, runCommand, writeScriptBin, buildEnv
-, pythonPackages, perl, perlPackages
+, pythonPackages, perlPackages
 }:
 
 weechat:
@@ -10,7 +10,7 @@ let
   }:
 
   let
-    perlInterpreter = perl;
+    perlInterpreter = perlPackages.perl;
     availablePlugins = let
         simplePlugin = name: {pluginFile = "${weechat.${name}}/lib/weechat/plugins/${name}.so";};
       in rec {
@@ -29,7 +29,7 @@ let
           withPackages = pkgsFun: (perl // {
             extraEnv = ''
               ${perl.extraEnv}
-              export PERL5LIB=${lib.makeFullPerlPath (pkgsFun perlPackages)}
+              export PERL5LIB=${perlPackages.makeFullPerlPath (pkgsFun perlPackages)}
             '';
           });
         };
diff --git a/pkgs/applications/networking/sieve-connect/default.nix b/pkgs/applications/networking/sieve-connect/default.nix
index 78910d1ecf6e..c135c70cd274 100644
--- a/pkgs/applications/networking/sieve-connect/default.nix
+++ b/pkgs/applications/networking/sieve-connect/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl, perlPackages }: stdenv.mkDerivation rec {
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages }:
+
+stdenv.mkDerivation rec {
   name = "sieve-connect-${version}";
   version = "0.89";
 
@@ -9,7 +11,7 @@
     sha256 = "0g7cv29wd5673inl4c87xb802k86bj6gcwh131xrbbg0a0g1c8fp";
   };
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
   nativeBuildInputs = [ makeWrapper ];
 
   preBuild = ''
@@ -20,7 +22,7 @@
     echo "$(date +%Y-%m-%d)" > datefile
   '';
 
-  buildFlags = [ "PERL5LIB=${stdenv.lib.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
+  buildFlags = [ "PERL5LIB=${perlPackages.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
@@ -28,9 +30,9 @@
     gzip -c sieve-connect.1 > $out/share/man/man1/sieve-connect.1.gz
 
     wrapProgram $out/bin/sieve-connect \
-      --prefix PERL5LIB : "${stdenv.lib.makePerlPath (with perlPackages; [
+      --prefix PERL5LIB : "${with perlPackages; makePerlPath [
         AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS PodUsage
-        TermReadKey TermReadLineGnu ])}"
+        TermReadKey TermReadLineGnu ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/tsung/default.nix b/pkgs/applications/networking/tsung/default.nix
index 0ee6d45e369a..050c8502e077 100644
--- a/pkgs/applications/networking/tsung/default.nix
+++ b/pkgs/applications/networking/tsung/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, stdenv, lib, makeWrapper,
   erlang,
   python2, python2Packages,
-  perl, perlPackages,
+  perlPackages,
   gnuplot }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     erlang
     gnuplot
-    perl
+    perlPackages.perl
     perlPackages.TemplateToolkit
     python2
     python2Packages.matplotlib
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     # Add Template Toolkit and gnuplot to tsung_stats.pl
     wrapProgram $out/bin/tsung_stats.pl \
         --prefix PATH : ${lib.makeBinPath [ gnuplot ]} \
-        --set PERL5LIB "${lib.makePerlPath [ perlPackages.TemplateToolkit ]}"
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.TemplateToolkit ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/science/biology/N3/default.nix b/pkgs/applications/science/biology/N3/default.nix
index 3502ac3e51b7..d2dbcf185330 100644
--- a/pkgs/applications/science/biology/N3/default.nix
+++ b/pkgs/applications/science/biology/N3/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, MNI-Perllib, GetoptTabular,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl MNI-Perllib GetoptTabular ];
+  propagatedBuildInputs = with perlPackages; [ perl MNI-Perllib GetoptTabular ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/conglomerate/default.nix b/pkgs/applications/science/biology/conglomerate/default.nix
index c04bc84c156d..23182fcadc6b 100644
--- a/pkgs/applications/science/biology/conglomerate/default.nix
+++ b/pkgs/applications/science/biology/conglomerate/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchFromGitHub, cmake, coreutils, perl, bicpl, libminc, zlib, minc_tools,
-  makeWrapper, GetoptTabular, MNI-Perllib }:
+{ stdenv, fetchFromGitHub, cmake, coreutils, perlPackages, bicpl, libminc, zlib, minc_tools,
+  makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "conglomerate";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc zlib bicpl ];
-  propagatedBuildInputs = [ coreutils minc_tools perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = [ coreutils minc_tools ] ++ (with perlPackages; [ perl GetoptTabular MNI-Perllib ]);
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBICPL_DIR=${bicpl}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/inormalize/default.nix b/pkgs/applications/science/biology/inormalize/default.nix
index 7ba054a592ea..9e63b92b24ed 100644
--- a/pkgs/applications/science/biology/inormalize/default.nix
+++ b/pkgs/applications/science/biology/inormalize/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/minc-tools/default.nix b/pkgs/applications/science/biology/minc-tools/default.nix
index c680eda95d2f..033f78609e9a 100644
--- a/pkgs/applications/science/biology/minc-tools/default.nix
+++ b/pkgs/applications/science/biology/minc-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perl, TextFormat, libminc, libjpeg, zlib }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perlPackages, libminc, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "minc-tools";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake flex bison makeWrapper ];
   buildInputs = [ libminc libjpeg zlib ];
-  propagatedBuildInputs = [ perl TextFormat ];
+  propagatedBuildInputs = with perlPackages; [ perl TextFormat ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/minc-widgets/default.nix b/pkgs/applications/science/biology/minc-widgets/default.nix
index 9084dfb2e1c3..497c39a52a4c 100644
--- a/pkgs/applications/science/biology/minc-widgets/default.nix
+++ b/pkgs/applications/science/biology/minc-widgets/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, octave, coreutils, minc_tools }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib octave coreutils minc_tools ];
+  propagatedBuildInputs = (with perlPackages; [ perl GetoptTabular MNI-Perllib ]) ++ [ octave coreutils minc_tools ];
 
   postFixup = ''
     for p in $out/bin/*; do
diff --git a/pkgs/applications/science/biology/mni_autoreg/default.nix b/pkgs/applications/science/biology/mni_autoreg/default.nix
index 076ecd03a1b1..5901b696d642 100644
--- a/pkgs/applications/science/biology/mni_autoreg/default.nix
+++ b/pkgs/applications/science/biology/mni_autoreg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, perl, GetoptTabular, MNI-Perllib, libminc }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, perlPackages, libminc }:
 
 stdenv.mkDerivation rec {
   pname = "mni_autoreg";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBUILD_TESTING=FALSE" ];
   # testing broken: './minc_wrapper: Permission denied' from Testing/ellipse0.mnc
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index e218872cca30..46e88b1e0fc4 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, buildPackages
-, curl, openssl, zlib, expat, perl, python, gettext, cpio
+, curl, openssl, zlib, expat, perlPackages, python, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
@@ -59,11 +59,11 @@ stdenv.mkDerivation {
         --subst-var-by gettext ${gettext}
   '';
 
-  nativeBuildInputs = [ gettext perl ]
+  nativeBuildInputs = [ gettext perlPackages.perl ]
     ++ stdenv.lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
-    ++ stdenv.lib.optionals perlSupport [ perl ]
+    ++ stdenv.lib.optionals perlSupport [ perlPackages.perl ]
     ++ stdenv.lib.optionals guiSupport [tcl tk]
     ++ stdenv.lib.optionals withpcre2 [ pcre2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.Security ]
@@ -86,7 +86,7 @@ stdenv.mkDerivation {
     "prefix=\${out}"
     "SHELL_PATH=${stdenv.shell}"
   ]
-  ++ (if perlSupport then ["PERL_PATH=${perl}/bin/perl"] else ["NO_PERL=1"])
+  ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
   ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
@@ -152,7 +152,7 @@ stdenv.mkDerivation {
             '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
             '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
             '${coreutils}/bin/wc', '${coreutils}/bin/tr'
-            ${stdenv.lib.optionalString perlSupport ", '${perl}/bin/perl'"}
+            ${stdenv.lib.optionalString perlSupport ", '${perlPackages.perl}/bin/perl'"}
           );
         }
         foreach $c (@a) {
@@ -173,50 +173,37 @@ stdenv.mkDerivation {
       mv $out/share/gitweb $gitweb/
 
       # wrap perl commands
-      gitperllib=$out/lib/perl5/site_perl
-      for i in ${builtins.toString perlLibs}; do
-        gitperllib=$gitperllib:$i/lib/perl5/site_perl
-      done
-
       makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/git-credential-netrc \
-                  --set PERL5LIB "$gitperllib"
+                  --set PERL5LIB   "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-add--interactive \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-archimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-instaweb \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsexportcommit \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
     ''
 
-   + (if svnSupport then
-
-      ''# wrap git-svn
-        gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString perlLibs} ${svn.out}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
-        wrapProgram $out/libexec/git-core/git-svn     \
-                     --set GITPERLLIB "$gitperllib"   \
+   + (if svnSupport then ''
+        # wrap git-svn
+        wrapProgram $out/libexec/git-core/git-svn                                                                                \
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
                      --prefix PATH : "${svn.out}/bin" ''
        else '' # replace git-svn by notification script
         notSupported $out/libexec/git-core/git-svn
-       '')
+     '')
 
-   + (if sendEmailSupport then
-      ''# wrap git-send-email
-        gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString smtpPerlLibs}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
+   + (if sendEmailSupport then ''
+        # wrap git-send-email
         wrapProgram $out/libexec/git-core/git-send-email \
-                     --set GITPERLLIB "$gitperllib" ''
-       else '' # replace git-send-email by notification script
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath smtpPerlLibs}"
+      '' else ''
+        # replace git-send-email by notification script
         notSupported $out/libexec/git-core/git-send-email
-       '')
+      '')
 
    + stdenv.lib.optionalString withManual ''# Install man pages and Info manual
        make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-info \
@@ -238,9 +225,9 @@ stdenv.mkDerivation {
    + stdenv.lib.optionalString stdenv.isDarwin ''
     # enable git-credential-osxkeychain by default if darwin
     cat > $out/etc/gitconfig << EOF
-[credential]
-	helper = osxkeychain
-EOF
+    [credential]
+      helper = osxkeychain
+    EOF
   '';
 
 
diff --git a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
index ce251e11d328..a98dd5bc5862 100644
--- a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
           $out/gitweb.cgi
       # Give access to CGI.pm and friends (was removed from perl core in 5.22)
       for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
-          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
+          sed -i -e "/use CGI /i use lib \"$p/${perlPackages.perl.libPrefix}\";" \
               "$out/gitweb.cgi"
       done
 
diff --git a/pkgs/applications/version-management/monotone/default.nix b/pkgs/applications/version-management/monotone/default.nix
index 0606c58c09d5..010d4d2f86ad 100644
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/share/${name}
     cp -rv contrib/ $out/share/${name}/contrib
-    mkdir -p $out/lib/perl5/site_perl/${perlVersion}
-    cp -v contrib/Monotone.pm $out/lib/perl5/site_perl/${perlVersion}
+    mkdir -p $out/${perl.libPrefix}/${perlVersion}
+    cp -v contrib/Monotone.pm $out/${perl.libPrefix}/${perlVersion}
   '';
 
   #doCheck = true; # some tests fail (and they take VERY long)
diff --git a/pkgs/applications/version-management/vcsh/default.nix b/pkgs/applications/version-management/vcsh/default.nix
index 0f0eec7ef9cd..a90eb531fe59 100644
--- a/pkgs/applications/version-management/vcsh/default.nix
+++ b/pkgs/applications/version-management/vcsh/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, which, git, ronn, perl, ShellCommand
-, TestMost, TestDifferences, TestDeep, TestException, TestWarn
-}:
+{ stdenv, fetchFromGitHub, which, git, ronn, perlPackages }:
 
 stdenv.mkDerivation rec {
   version = "1.20170915";       # date of commit we're pulling
@@ -13,10 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wfzp8167lcq6akdpbi8fikjv0z3h1i5minh3423dljc04q0klm1";
   };
 
-  buildInputs = [
-    which git ronn perl ShellCommand TestMost TestDifferences TestDeep
-    TestException TestWarn
-  ];
+  buildInputs = [ which git ronn ]
+    ++ (with perlPackages; [ perl ShellCommand TestMost TestDifferences TestDeep TestException TestWarn ]);
 
   installPhase = "make install PREFIX=$out";
 
diff --git a/pkgs/build-support/writers/default.nix b/pkgs/build-support/writers/default.nix
index ef520f68320a..6e932ce860f6 100644
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@@ -192,12 +192,12 @@ rec {
       name = "perl-environment";
       paths = libraries;
       pathsToLink = [
-        "/lib/perl5/site_perl"
+        "/${pkgs.perl.libPrefix}"
       ];
     };
   in
   makeScriptWriter {
-    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/lib/perl5/site_perl";
+    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/${pkgs.perl.libPrefix}";
   } name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
diff --git a/pkgs/development/libraries/hivex/default.nix b/pkgs/development/libraries/hivex/default.nix
index b2e2dbd35a40..740d2d3244df 100644
--- a/pkgs/development/libraries/hivex/default.nix
+++ b/pkgs/development/libraries/hivex/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
-, perl, libxml2, IOStringy }:
+, perlPackages, libxml2 }:
 
 stdenv.mkDerivation rec {
   name = "hivex-${version}";
@@ -14,9 +14,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoreconfHook makeWrapper
-    perl libxml2 IOStringy
-  ];
+    autoreconfHook makeWrapper libxml2
+  ] ++ (with perlPackages; [ perl IOStringy ]);
 
   postInstall = ''
     for bin in $out/bin/*; do
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index aad6365e4c2d..4e43ef91e79f 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
-, ncurses, cpio, gperf, perl, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
+, ncurses, cpio, gperf, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
 , acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex
-, gmp, readline, file, libintl_perl, GetoptLong, SysVirt, numactl, xen, libapparmor
+, gmp, readline, file, numactl, xen, libapparmor
 , getopt, perlPackages, ocamlPackages
 , appliance ? null
 , javaSupport ? false, jdk ? null }:
@@ -20,11 +20,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    makeWrapper autoreconfHook ncurses cpio gperf perl
+    makeWrapper autoreconfHook ncurses cpio gperf
     cdrkit flex bison qemu pcre augeas libxml2 acl libcap libcap_ng libconfig
-    systemd fuse yajl libvirt gmp readline file hivex libintl_perl GetoptLong
-    SysVirt numactl xen libapparmor getopt perlPackages.ModuleBuild
-  ] ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt ocaml_gettext ounit ])
+    systemd fuse yajl libvirt gmp readline file hivex
+    numactl xen libapparmor getopt perlPackages.ModuleBuild
+  ] ++ (with perlPackages; [ perl libintl_perl GetoptLong SysVirt ])
+    ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt ocaml_gettext ounit ])
     ++ stdenv.lib.optional javaSupport jdk;
 
   prePatch = ''
@@ -52,7 +53,7 @@ stdenv.mkDerivation rec {
     for bin in $out/bin/*; do
       wrapProgram "$bin" \
         --prefix PATH     : "$out/bin:${hivex}/bin:${qemu}/bin" \
-        --prefix PERL5LIB : "$out/lib/perl5/site_perl"
+        --prefix PERL5LIB : "$out/${perlPackages.perl.libPrefix}"
     done
   '';
 
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index 5b6990810b39..98d98266db17 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
+{ stdenv, fetchurl, buildPerlPackage, perl, DBI, sqlite }:
 
 buildPerlPackage rec {
   name = "DBD-SQLite-1.58";
@@ -20,7 +20,7 @@ buildPerlPackage rec {
 
   postInstall = ''
     # Get rid of a pointless copy of the SQLite sources.
-    rm -rf $out/lib/perl5/site_perl/*/*/auto/share
+    rm -rf $out/${perl.libPrefix}/*/*/auto/share
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/misc/creduce/default.nix b/pkgs/development/tools/misc/creduce/default.nix
index 66f1fff41902..a2b487a4bcce 100644
--- a/pkgs/development/tools/misc/creduce/default.nix
+++ b/pkgs/development/tools/misc/creduce/default.nix
@@ -2,7 +2,7 @@
 , llvm, clang-unwrapped
 , flex
 , zlib
-, perl, ExporterLite, FileWhich, GetoptTabular, RegexpCommon, TermReadKey
+, perlPackages
 , utillinux
 }:
 
@@ -22,8 +22,7 @@ stdenv.mkDerivation rec {
     # Actual deps:
     llvm clang-unwrapped
     flex zlib
-    perl ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey
-  ];
+  ] ++ (with perlPackages; [ perl ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey ]);
 
   # On Linux, c-reduce's preferred way to reason about
   # the cpu architecture/topology is to use 'lscpu',
diff --git a/pkgs/development/tools/misc/csmith/default.nix b/pkgs/development/tools/misc/csmith/default.nix
index a0040e4ed3e5..eff1af8cdb47 100644
--- a/pkgs/development/tools/misc/csmith/default.nix
+++ b/pkgs/development/tools/misc/csmith/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, m4, makeWrapper, libbsd, perl, SysCPU }:
+{ stdenv, fetchurl, m4, makeWrapper, libbsd, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "csmith-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ m4 makeWrapper ];
-  buildInputs = [ perl SysCPU libbsd ];
+  buildInputs = [ libbsd ] ++ (with perlPackages; [ perl SysCPU ]);
 
   postInstall = ''
     substituteInPlace $out/bin/compiler_test.pl \
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index ca48af641968..29ed23117fba 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, gettext, LocaleGettext }:
+{ stdenv, fetchurl, perlPackages, gettext }:
 
 stdenv.mkDerivation rec {
   name = "help2man-1.47.8";
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1p5830h88cx0zn0snwaj0vpph81xicpsirfwlxmcgjrlmn0nm3sj";
   };
 
-  nativeBuildInputs = [ gettext LocaleGettext ];
-  buildInputs = [ perl LocaleGettext ];
+  nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.perl perlPackages.LocaleGettext ];
 
   doCheck = false;                                # target `check' is missing
 
@@ -18,11 +18,10 @@ stdenv.mkDerivation rec {
   # We don't use makeWrapper here because it uses substitutions our
   # bootstrap shell can't handle.
   postInstall = ''
-    gettext_perl="$(echo ${LocaleGettext}/lib/perl*/site_perl)"
     mv $out/bin/help2man $out/bin/.help2man-wrapped
     cat > $out/bin/help2man <<EOF
     #! $SHELL -e
-    export PERL5LIB=\''${PERL5LIB:+:}$gettext_perl
+    export PERL5LIB=\''${PERL5LIB:+:}${perlPackages.LocaleGettext}/${perlPackages.perl.libPrefix}
     ${stdenv.lib.optionalString stdenv.hostPlatform.isCygwin
         ''export PATH=\''${PATH:+:}${gettext}/bin''}
     exec -a \$0 $out/bin/.help2man-wrapped "\$@"
diff --git a/pkgs/development/tools/misc/icon-naming-utils/default.nix b/pkgs/development/tools/misc/icon-naming-utils/default.nix
index 5fd0fe8be2f2..d7b2cd36492e 100644
--- a/pkgs/development/tools/misc/icon-naming-utils/default.nix
+++ b/pkgs/development/tools/misc/icon-naming-utils/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, perl, XMLSimple, librsvg}:
+{stdenv, fetchurl, perlPackages, librsvg}:
 
 stdenv.mkDerivation rec {
   name = "icon-naming-utils-0.8.90";
@@ -8,13 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "071fj2jm5kydlz02ic5sylhmw6h2p3cgrm3gwdfabinqkqcv4jh4";
   };
 
-  buildInputs = [perl XMLSimple librsvg];
+  buildInputs = [ librsvg ] ++ (with perlPackages; [ perl XMLSimple ]);
 
   postInstall =
     ''
       # Add XML::Simple to the runtime search path.
       substituteInPlace $out/libexec/icon-name-mapping \
-          --replace '/bin/perl' '/bin/perl -I${XMLSimple}/lib/perl5/site_perl'
+          --replace '/bin/perl' '/bin/perl -I${perlPackages.XMLSimple}/${perlPackages.perl.libPrefix}'
     '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index 9261b892cca5..8683c75a696d 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perlPackages, perl, makeWrapper, openssl }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, openssl }:
 
 stdenv.mkDerivation rec {
   name = "sslmate-1.7.0";
@@ -10,11 +10,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = "PREFIX=$(out)";
 
-  buildInputs = [ perl makeWrapper ];
+  buildInputs = [ perlPackages.perl makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/sslmate --prefix PERL5LIB : \
-      "${with perlPackages; stdenv.lib.makePerlPath [
+      "${with perlPackages; makePerlPath [
         URI
         JSONPP
         TermReadKey
diff --git a/pkgs/development/web/wml/default.nix b/pkgs/development/web/wml/default.nix
index 58336c80e04f..44ce36b76ddc 100644
--- a/pkgs/development/web/wml/default.nix
+++ b/pkgs/development/web/wml/default.nix
@@ -22,7 +22,7 @@ perlPackages.buildPerlPackage rec {
     sed -i '/p2_mp4h\/doc/d' Makefile.in
   '';
 
-  buildInputs = with perlPackages; 
+  buildInputs = with perlPackages;
     [ perl TermReadKey GD BitVector ncurses lynx makeWrapper ImageSize ];
 
   patches = [ ./redhat-with-thr.patch ./dynaloader.patch ./no_bitvector.patch ];
@@ -45,7 +45,7 @@ perlPackages.buildPerlPackage rec {
 
   preFixup = ''
     wrapProgram $out/bin/wml \
-      --set PERL5LIB ${with perlPackages; stdenv.lib.makePerlPath [
+      --set PERL5LIB ${with perlPackages; makePerlPath [
         BitVector TermReadKey ImageSize
       ]}
   '';
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 851520a93beb..6cb0c123406e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -8,6 +8,7 @@
 , swig
 , ncurses
 , pam
+, libnotify
 , buildPackages
 }:
 
@@ -79,6 +80,8 @@ let
     dontDisableStatic = true;
 
     prePatch = prePatchCommon + ''
+      substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site
+      substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.in --replace install_vendor install_site
       substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
       substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
     '';
@@ -127,9 +130,10 @@ let
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-notify ; do
-        wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
-      done
+      substituteInPlace $out/bin/aa-notify --replace /usr/bin/notify-send ${libnotify}/bin/notify-send
+      # aa-notify checks its name and does not work named ".aa-notify-wrapped"
+      mv $out/bin/aa-notify $out/bin/aa-notify-wrapped
+      makeWrapper ${perl}/bin/perl $out/bin/aa-notify --set PERL5LIB ${libapparmor}/${perl.libPrefix} --add-flags $out/bin/aa-notify-wrapped
     '';
 
     inherit doCheck;
diff --git a/pkgs/servers/mail/dkimproxy/default.nix b/pkgs/servers/mail/dkimproxy/default.nix
index 2912ce4cfcaa..d4bfd3c6ca57 100644
--- a/pkgs/servers/mail/dkimproxy/default.nix
+++ b/pkgs/servers/mail/dkimproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, perl, fetchurl, Error, MailDKIM, MIMETools, NetServer }:
+{ stdenv, perlPackages, fetchurl }:
 
 let
   pkg = "dkimproxy";
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  buildInputs = [ perl ];
-  propagatedBuildInputs = [ Error MailDKIM MIMETools NetServer ];
+  buildInputs = [ perlPackages.perl ];
+  propagatedBuildInputs = with perlPackages; [ Error MailDKIM MIMETools NetServer ];
 
   meta = with stdenv.lib; {
     description = "SMTP-proxy that signs and/or verifies emails";
diff --git a/pkgs/servers/mail/dspam/default.nix b/pkgs/servers/mail/dspam/default.nix
index 8fa7719a722b..44e2223960a2 100644
--- a/pkgs/servers/mail/dspam/default.nix
+++ b/pkgs/servers/mail/dspam/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper
 , gawk, gnused, gnugrep, coreutils, which
-, perl, libnet
+, perlPackages
 , withMySQL ? false, zlib, mysql57
 , withPgSQL ? false, postgresql
 , withSQLite ? false, sqlite
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1acklnxn1wvc7abn31l3qdj8q6k13s51k5gv86vka7q20jb5cxmf";
   };
 
-  buildInputs = [ perl ]
+  buildInputs = [ perlPackages.perl ]
                 ++ lib.optionals withMySQL [ zlib mysql57.connector-c ]
                 ++ lib.optional withPgSQL postgresql
                 ++ lib.optional withSQLite sqlite
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     rm -rf $out/var
 
     wrapProgram $out/bin/dspam_notify \
-      --set PERL5LIB "${lib.makePerlPath [ libnet ]}"
+      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.libnet ]}"
 
     # Install SQL scripts
     mkdir -p $out/share/dspam/sql
diff --git a/pkgs/servers/mail/postgrey/default.nix b/pkgs/servers/mail/postgrey/default.nix
index 3e7163cb1541..0abfc00fdd66 100644
--- a/pkgs/servers/mail/postgrey/default.nix
+++ b/pkgs/servers/mail/postgrey/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchurl, perl, perlPackages, lib, runCommand, postfix }:
+{ stdenv, fetchurl, perlPackages, lib, runCommand, postfix }:
 
 let
-    mk-perl-flags = inputs: lib.concatStringsSep " " (map (dep: "-I ${dep}/lib/perl5/site_perl") inputs);
+    mk-perl-flags = inputs: lib.concatStringsSep " " (map (dep: "-I ${dep}/${perlPackages.perl.libPrefix}") inputs);
     postgrey-flags = mk-perl-flags (with perlPackages; [
       NetServer BerkeleyDB DigestSHA1 NetAddrIP IOMultiplex
     ]);
@@ -26,9 +26,9 @@ in runCommand name {
     cd $out
     tar -xzf $src --strip-components=1
     mv postgrey policy-test bin
-    sed -i -e "s,#!/usr/bin/perl -T,#!${perl}/bin/perl -T ${postgrey-flags}," \
+    sed -i -e "s,#!/usr/bin/perl -T,#!${perlPackages.perl}/bin/perl -T ${postgrey-flags}," \
            -e "s#/etc/postfix#$out#" \
         bin/postgrey
-    sed -i -e "s,#!/usr/bin/perl,#!${perl}/bin/perl ${policy-test-flags}," \
+    sed -i -e "s,#!/usr/bin/perl,#!${perlPackages.perl}/bin/perl ${policy-test-flags}," \
         bin/policy-test
 ''
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index d32957210132..c3fcd13a41f8 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl, perl, perlPackages, HTMLParser, NetDNS, NetAddrIP, DBFile
-, HTTPDate, MailDKIM, LWP, IOSocketSSL, makeWrapper, gnupg1
-}:
+{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg1 }:
 
 perlPackages.buildPerlPackage rec {
   name = "SpamAssassin-3.4.1";
@@ -13,12 +11,12 @@ perlPackages.buildPerlPackage rec {
   # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7434
   patches = [ ./sa-update_add--siteconfigpath.patch ];
 
-  buildInputs = with perlPackages; [ makeWrapper HTMLParser NetDNS NetAddrIP DBFile HTTPDate MailDKIM
-    LWP IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF NetDNSResolverProgrammable ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [ HTMLParser NetDNS NetAddrIP DBFile HTTPDate MailDKIM
+    LWP IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF NetDNSResolverProgrammable ]);
 
   # Enabling 'taint' mode is desirable, but that flag disables support
   # for the PERL5LIB environment variable. Needs further investigation.
-  makeFlags = "PERL_BIN=${perl}/bin/perl PERL_TAINT=no";
+  makeFlags = "PERL_BIN=${perlPackages.perl}/bin/perl PERL_TAINT=no";
 
   makeMakerFlags = "CONFDIR=/homeless/shelter LOCALSTATEDIR=/var/lib/spamassassin";
 
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 72d5f124c63d..97275da9f117 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perl, perlPackages
+{ stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perlPackages
 , python, ruby, jre, nettools, bc
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     coreutils
     rrdtool
     nettools
-    perl
+    perlPackages.perl
     perlPackages.ModuleBuild
     perlPackages.HTMLTemplate
     perlPackages.NetCIDR
@@ -60,8 +60,8 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   checkPhase = ''
-   export PERL5LIB="$PERL5LIB:${rrdtool}/lib/perl5/site_perl"
-   LC_ALL=C make -j1 test 
+   export PERL5LIB="$PERL5LIB:${rrdtool}/${perlPackages.perl.libPrefix}"
+   LC_ALL=C make -j1 test
   '';
 
   patches = [
@@ -95,8 +95,8 @@ stdenv.mkDerivation rec {
   makeFlags = ''
     PREFIX=$(out)
     DESTDIR=$(out)
-    PERLLIB=$(out)/lib/perl5/site_perl
-    PERL=${perl}/bin/perl
+    PERLLIB=$(out)/${perlPackages.perl.libPrefix}
+    PERL=${perlPackages.perl}/bin/perl
     PYTHON=${python}/bin/python
     RUBY=${ruby}/bin/ruby
     JAVARUN=${jre}/bin/java
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
             *.jar) continue;;
         esac
         wrapProgram "$file" \
-          --set PERL5LIB "$out/lib/perl5/site_perl:${with perlPackages; stdenv.lib.makePerlPath [
+          --set PERL5LIB "$out/${perlPackages.perl.libPrefix}:${with perlPackages; makePerlPath [
                 LogLog4perl IOSocketInet6 Socket6 URI DBFile DateManip
                 HTMLTemplate FileCopyRecursive FCGI NetCIDR NetSNMP NetServer
                 ListMoreUtils TimeHiRes DBDPg LWP rrdtool
diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index 0e7a53306eb4..9ecd26af5c03 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -24,9 +24,8 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
-      perlversion=$(perl -e 'use Config; print $Config{version};')
       perlarchname=$(perl -e 'use Config; print $Config{archname};')
-      installFlags="INSTALLSITEARCH=$out/lib/perl5/site_perl/$perlversion/$perlarchname INSTALLSITEMAN3DIR=$out/share/man/man3"
+      installFlags="INSTALLSITEARCH=$out/${perl.libPrefix}/${perl.version}/$perlarchname INSTALLSITEMAN3DIR=$out/share/man/man3"
 
       # http://comments.gmane.org/gmane.network.net-snmp.user/32434
       substituteInPlace "man/Makefile.in" --replace 'grep -vE' '@EGREP@ -v'
diff --git a/pkgs/servers/monitoring/plugins/labs_consol_de.nix b/pkgs/servers/monitoring/plugins/labs_consol_de.nix
index 5d93f4c53496..c47e627f8169 100644
--- a/pkgs/servers/monitoring/plugins/labs_consol_de.nix
+++ b/pkgs/servers/monitoring/plugins/labs_consol_de.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, fetchurl, autoreconfHook, makeWrapper
-, perl, DBDsybase, NetSNMP, coreutils, gnused, gnugrep }:
+, perlPackages, coreutils, gnused, gnugrep }:
 
 let
   glplugin = fetchFromGitHub {
@@ -12,7 +12,7 @@ let
   generic = { pname, version, sha256, description, buildInputs, ... }:
   let
     name' = "${stdenv.lib.replaceStrings [ "-" ] [ "_" ] "${pname}"}-${version}";
-  in perl.stdenv.mkDerivation {
+  in stdenv.mkDerivation {
     name = "${pname}-${version}";
 
     src = fetchurl {
@@ -20,7 +20,7 @@ let
       inherit sha256;
     };
 
-    buildInputs = [ perl ] ++ buildInputs;
+    buildInputs = [ perlPackages.perl ] ++ buildInputs;
 
     nativeBuildInputs = [ autoreconfHook makeWrapper ];
 
@@ -58,7 +58,7 @@ in {
     version     = "2.6.4.14";
     sha256      = "0w6gybrs7imx169l8740s0ax3adya867fw0abrampx59mnsj5pm1";
     description = "Check plugin for Microsoft SQL Server.";
-    buildInputs = [ DBDsybase ];
+    buildInputs = [ perlPackages.DBDsybase ];
   };
 
   check-nwc-health = generic {
@@ -66,7 +66,7 @@ in {
     version     = "7.0.1.3";
     sha256      = "0rgd6zgd7kplx3z72n8zbzwkh8vnd83361sk9ibh6ng78sds1sl5";
     description = "Check plugin for network equipment.";
-    buildInputs = [ NetSNMP ];
+    buildInputs = [ perlPackages.NetSNMP ];
   };
 
   check-ups-health = generic {
@@ -74,6 +74,6 @@ in {
     version     = "2.8.2.2";
     sha256      = "1gc2wjsymay2vk5ywc1jj9cvrbhs0fs851x8l4nc75df2g75v521";
     description = "Check plugin for UPSs.";
-    buildInputs = [ NetSNMP ];
+    buildInputs = [ perlPackages.NetSNMP ];
   };
 }
diff --git a/pkgs/servers/slimserver/default.nix b/pkgs/servers/slimserver/default.nix
index fe14f0f33c81..ffbeb2fca34c 100644
--- a/pkgs/servers/slimserver/default.nix
+++ b/pkgs/servers/slimserver/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchpatch, makeWrapper
-, perl, perlPackages, flac, faad2, sox, lame, monkeysAudio, wavpack }:
+, perlPackages, flac, faad2, sox, lame, monkeysAudio, wavpack }:
 
 perlPackages.buildPerlPackage rec {
   name = "slimserver-${version}";
@@ -12,7 +12,7 @@ perlPackages.buildPerlPackage rec {
 
   buildInputs = [
     makeWrapper
-    perl
+    perlPackages.perl
     perlPackages.AnyEvent
     perlPackages.AudioScan
     perlPackages.CarpClan
@@ -77,9 +77,9 @@ perlPackages.buildPerlPackage rec {
 
   buildPhase = ''
     mv lib tmp
-    mkdir -p lib/perl5/site_perl
-    mv CPAN_used/* lib/perl5/site_perl
-    cp -rf tmp/* lib/perl5/site_perl
+    mkdir -p ${perlPackages.perl.libPrefix}
+    mv CPAN_used/* ${perlPackages.perl.libPrefix}
+    cp -rf tmp/* ${perlPackages.perl.libPrefix}
   '';
 
   doCheck = false;
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 4f8c234b752f..5f44e19fdf27 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
     for p in $out/bin/*
       do wrapProgram "$p" \
-      --prefix PERL5LIB ":" "${perlPackages.DBFile}/lib/perl5/site_perl" \
+      --prefix PERL5LIB ":" "${perlPackages.DBFile}/${perlPackages.perl.libPrefix}" \
       --prefix PATH ":" "${stdenv.lib.makeBinPath [ which bzip2 ]}"
     done
 
diff --git a/pkgs/tools/filesystems/file-rename/default.nix b/pkgs/tools/filesystems/file-rename/default.nix
index 6c226bb97845..e799bc5a4dad 100644
--- a/pkgs/tools/filesystems/file-rename/default.nix
+++ b/pkgs/tools/filesystems/file-rename/default.nix
@@ -12,7 +12,7 @@ perlPackages.buildPerlPackage rec {
 
   postInstall = ''
     wrapProgram $out/bin/rename \
-      --prefix PERL5LIB : $out/lib/perl5/site_perl
+      --prefix PERL5LIB : $out/${perlPackages.perl.libPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index a7bb616d82b5..2bce8ec4941b 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, unzip, makeWrapper, perl, ImageExifTool
-, CpanelJSONXS, coreutils, zip, imagemagick, pngcrush, lcms2
+{ stdenv, fetchurl, unzip, makeWrapper, perlPackages
+, coreutils, zip, imagemagick, pngcrush, lcms2
 , facedetect, fbida }:
 
 # TODO: add optional dependencies (snippet from fgallery source):
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "18wlvqbxcng8pawimbc8f2422s8fnk840hfr6946lzsxr0ijakvf";
   };
 
-  buildInputs = [ unzip makeWrapper perl ImageExifTool CpanelJSONXS ];
+  buildInputs = [ unzip makeWrapper ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index 4f683beb06ff..dc51d04e4b5e 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     for name in get-{oui,iab}; do
-      wrapProgram "$out/bin/$name" --set PERL5LIB "${stdenv.lib.makePerlPath perlModules }"
+      wrapProgram "$out/bin/$name" --set PERL5LIB "${perlPackages.makePerlPath perlModules }"
     done;
   '';
 
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index 5a69a6ae7ad2..903b5b13f845 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl
-, AlgorithmDiff, ParallelForkManager, RegexpCommon
-}:
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "cloc-${version}";
@@ -17,9 +15,9 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */Unix)
   '';
 
-  buildInputs = [
-    makeWrapper perl AlgorithmDiff ParallelForkManager RegexpCommon
-  ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+    perl AlgorithmDiff ParallelForkManager RegexpCommon
+  ]);
 
   makeFlags = [ "prefix=" "DESTDIR=$(out)" "INSTALL=install" ];
 
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index a08f465d6cd7..3ed284aa3e1f 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -1,5 +1,5 @@
-{stdenv, fetchurl, perl, CryptSSLeay, LWP, unzip, xz, dpkg, TimeDate, DBFile
-, FileDesktopEntry, libxslt, docbook_xsl, makeWrapper
+{stdenv, fetchurl, unzip, xz, dpkg
+, libxslt, docbook_xsl, makeWrapper
 , python3Packages
 , perlPackages, curl, gnupg, diffutils
 , sendmailPath ? "/run/wrappers/bin/sendmail"
@@ -16,10 +16,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xy1nvqrnifx46g8ch69pk31by0va6hn10wpi1fkrsrgncanjjh1";
   };
 
-  buildInputs = [ perl CryptSSLeay LWP unzip xz dpkg TimeDate DBFile 
-    FileDesktopEntry libxslt python setuptools makeWrapper
-    perlPackages.ParseDebControl perlPackages.LWPProtocolHttps
-    curl gnupg diffutils ];
+  buildInputs = [ unzip xz dpkg libxslt python setuptools makeWrapper curl gnupg diffutils ] ++
+    (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps ]);
 
   preConfigure = ''
     export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${dpkg}";
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index caef0f7b8bb2..e87328f271e9 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper, darwin }:
+{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perlPackages, makeWrapper, darwin }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 makeWrapper ]
     ++ optional stdenv.isDarwin darwin.cctools;
 
-  propagatedBuildInputs = [ perl IPCRun TimeDate TimeDuration ];
+  propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
   buildFlags = "CC=cc";
   installFlags = "PREFIX=$(out)";
diff --git a/pkgs/tools/misc/rrdtool/default.nix b/pkgs/tools/misc/rrdtool/default.nix
index 4d826c97d29c..ab16d8cb6bf3 100644
--- a/pkgs/tools/misc/rrdtool/default.nix
+++ b/pkgs/tools/misc/rrdtool/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # for munin and rrdtool support
-    mkdir -p $out/lib/perl5/site_perl/
-    mv $out/lib/perl/5* $out/lib/perl5/site_perl/
+    mkdir -p $out/${perl.libPrefix}
+    mv $out/lib/perl/5* $out/${perl.libPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/infiniband-diags/default.nix b/pkgs/tools/networking/infiniband-diags/default.nix
index fbca48fa17c8..0e41163577e7 100644
--- a/pkgs/tools/networking/infiniband-diags/default.nix
+++ b/pkgs/tools/networking/infiniband-diags/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  configureFlags = [ "--with-perl-installdir=\${out}/lib/perl5/site_perl" "--sbindir=\${out}/bin" ];
+  configureFlags = [ "--with-perl-installdir=\${out}/${perl.libPrefix}" "--sbindir=\${out}/bin" ];
 
   postInstall = ''
     rmdir $out/var/run $out/var
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     for pls in $out/bin/{ibfindnodesusing.pl,ibidsverify.pl}; do
       echo "wrapping $pls"
-      wrapProgram $pls --prefix PERL5LIB : "$out/lib/perl5/site_perl"
+      wrapProgram $pls --prefix PERL5LIB : "$out/${perl.libPrefix}"
     done
   '';
 
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index c83ab66b27a0..9f81e0d57211 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, zlib, protobuf, ncurses, pkgconfig, IOTty
-, makeWrapper, perl, openssl, autoreconfHook, openssh, bash-completion
+{ lib, stdenv, fetchurl, zlib, protobuf, ncurses, pkgconfig
+, makeWrapper, perlPackages, openssl, autoreconfHook, openssh, bash-completion
 , libutempter ? null, withUtempter ? stdenv.isLinux }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ protobuf ncurses zlib IOTty makeWrapper perl openssl bash-completion ] ++ lib.optional withUtempter libutempter;
+  buildInputs = [ protobuf ncurses zlib makeWrapper openssl bash-completion ]
+    ++ (with perlPackages; [ perl IOTty ])
+    ++ lib.optional withUtempter libutempter;
 
   patches = [ ./ssh_path.patch ./utempter_path.patch ];
   postPatch = ''
diff --git a/pkgs/tools/networking/slimrat/default.nix b/pkgs/tools/networking/slimrat/default.nix
index ef2c91ee2fab..8632a33e3498 100644
--- a/pkgs/tools/networking/slimrat/default.nix
+++ b/pkgs/tools/networking/slimrat/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, perl, WWWMechanize, LWP, makeWrapper}:
+{stdenv, fetchurl, perlPackages, makeWrapper}:
 
 stdenv.mkDerivation {
   name = "slimrat-1.0";
@@ -7,10 +7,10 @@ stdenv.mkDerivation {
     sha256 = "139b71d45k4b1y47iq62a9732cnaqqbh8s4knkrgq2hx0jxpsk5a";
   };
 
-  buildInputs = [ perl WWWMechanize LWP makeWrapper ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [ perl WWWMechanize LWP ]);
 
   patchPhase = ''
-    sed -e 's,#!.*,#!${perl}/bin/perl,' -i src/{slimrat,slimrat-gui}
+    sed -e 's,#!.*,#!${perlPackages.perl}/bin/perl,' -i src/{slimrat,slimrat-gui}
   '';
 
   installPhase = ''
diff --git a/pkgs/tools/networking/smokeping/default.nix b/pkgs/tools/networking/smokeping/default.nix
index 87e0a788383c..08b5e6a211b8 100644
--- a/pkgs/tools/networking/smokeping/default.nix
+++ b/pkgs/tools/networking/smokeping/default.nix
@@ -1,8 +1,4 @@
-{ stdenv, fetchurl, fping, rrdtool, FCGI, CGI
-, CGIFast, ConfigGrammar, DigestHMAC, NetTelnet
-, NetOpenSSH, NetSNMP, LWP, IOTty, perl, NetDNS
-, perlldap
-}:
+{ stdenv, fetchurl, fping, rrdtool, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "smokeping-${version}";
@@ -11,9 +7,10 @@ stdenv.mkDerivation rec {
     url = "https://oss.oetiker.ch/smokeping/pub/smokeping-${version}.tar.gz";
     sha256 = "1p9hpa2zs33p7hzrds80kwrm5255s0869v3s3qmsyx2sx63c7czj";
   };
-  propagatedBuildInputs = [
-    rrdtool FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet NetOpenSSH
-      NetSNMP LWP IOTty fping perl NetDNS perlldap ];
+  propagatedBuildInputs = [ rrdtool ] ++
+    (with perlPackages; [ perl FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet
+      NetOpenSSH NetSNMP LWP IOTty fping NetDNS perlldap ]);
+
   postInstall = ''
     mv $out/htdocs/smokeping.fcgi.dist $out/htdocs/smokeping.fcgi
   '';
diff --git a/pkgs/tools/networking/swaks/default.nix b/pkgs/tools/networking/swaks/default.nix
index 8daf034d4bdd..2abdab773ddf 100644
--- a/pkgs/tools/networking/swaks/default.nix
+++ b/pkgs/tools/networking/swaks/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mv swaks $out/bin/
 
     wrapProgram $out/bin/swaks --set PERL5LIB \
-      "${with perlPackages; stdenv.lib.makePerlPath [
+      "${with perlPackages; makePerlPath [
         NetSSLeay AuthenSASL NetDNS IOSocketInet6
       ]}"
   '';
diff --git a/pkgs/tools/networking/swec/default.nix b/pkgs/tools/networking/swec/default.nix
index bc9c9532e4f0..515fcee6963b 100644
--- a/pkgs/tools/networking/swec/default.nix
+++ b/pkgs/tools/networking/swec/default.nix
@@ -1,5 +1,4 @@
-{ fetchurl, stdenv, makeWrapper, perl, LWP, URI, HTMLParser
-, HTTPServerSimple, Parent }:
+{ fetchurl, stdenv, makeWrapper, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "swec-0.4";
@@ -9,13 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "1m3971z4z1wr0paggprfz0n8ng8vsnkc9m6s3bdplgyz7qjk6jwx";
   };
 
-  buildInputs = [ makeWrapper perl LWP URI HTMLParser ];
-  checkInputs = [ HTTPServerSimple Parent ];
+  buildInputs = [ makeWrapper perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
+  checkInputs = [ perlPackages.HTTPServerSimple perlPackages.Parent ];
 
   configurePhase = ''
     for i in swec tests/{runTests,testServer}
     do
-      sed -i "$i" -e's|/usr/bin/perl|${perl}/bin/perl|g'
+      sed -i "$i" -e's|/usr/bin/perl|${perlPackages.perl}/bin/perl|g'
     done
   '';
 
@@ -29,9 +28,7 @@ stdenv.mkDerivation rec {
     sed -i "$out/bin/swec" -e"s|realpath(\$0)|'$out/share/${name}/swec'|g"
 
     wrapProgram "$out/bin/swec" \
-      --prefix PERL5LIB : \
-      ${stdenv.lib.concatStringsSep ":"
-          (map (x: "${x}/lib/perl5/site_perl") [ LWP URI HTMLParser ])}
+      --prefix PERL5LIB : ${with perlPackages; makePerlPath [ LWP URI HTMLParser ]}
   '';
 
   doCheck = true;
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 077e440d27a3..cb949766f94d 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, gettext, pkgconfig, perl
+{ stdenv, fetchurl, gettext, pkgconfig, perlPackages
 , libidn2, zlib, pcre, libuuid, libiconv, libintl
-, IOSocketSSL, LWP, python3, lzip
+, python3, lzip
 , libpsl ? null
 , openssl ? null }:
 
@@ -28,12 +28,12 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  nativeBuildInputs = [ gettext pkgconfig perl lzip libiconv libintl ];
+  nativeBuildInputs = [ gettext pkgconfig perlPackages.perl lzip libiconv libintl ];
   buildInputs = [ libidn2 zlib pcre libuuid ]
-    ++ stdenv.lib.optionals doCheck [ IOSocketSSL LWP python3 ]
+    ++ stdenv.lib.optionals doCheck [ perlPackages.IOSocketSSL perlPackages.LWP python3 ]
     ++ stdenv.lib.optional (openssl != null) openssl
     ++ stdenv.lib.optional (libpsl != null) libpsl
-    ++ stdenv.lib.optional stdenv.isDarwin perl;
+    ++ stdenv.lib.optional stdenv.isDarwin perlPackages.perl;
 
   configureFlags = [
     (stdenv.lib.withFeatureAs (openssl != null) "ssl" "openssl")
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index b2d5e96f391c..46da85d97488 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -1,9 +1,8 @@
-{ stdenv, lib, fetchzip, pkgconfig, cmake, perl, curl, gtest, lzma, bzip2 , lz4
+{ stdenv, lib, fetchzip, pkgconfig, cmake, perlPackages, curl, gtest, lzma, bzip2, lz4
 , db, dpkg, libxslt, docbook_xsl, docbook_xml_dtd_45
 
 # used when WITH_DOC=ON
 , w3m
-, Po4a
 , doxygen
 
 # used when WITH_NLS=ON
@@ -27,16 +26,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
 
   buildInputs = [
-    cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
+    cmake perlPackages.perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
-    doxygen Po4a w3m docbook_xml_dtd_45
+    doxygen perlPackages.Po4a w3m docbook_xml_dtd_45
   ] ++ lib.optionals withNLS [
     gettext
   ];
 
   preConfigure = ''
-    export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${Po4a}/lib/perl5";
-
     cmakeFlagsArray+=(
       -DBERKELEY_DB_INCLUDE_DIRS=${db.dev}/include
       -DDOCBOOK_XSL="${docbook_xsl}"/share/xml/docbook-xsl
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index cb471d663ecb..350d0e66dc7d 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/share/kpcli.pl
 
     makeWrapper $out/share/kpcli.pl $out/bin/kpcli --set PERL5LIB \
-      "${with perlPackages; stdenv.lib.makePerlPath ([
+      "${with perlPackages; makePerlPath ([
          CaptureTiny Clipboard Clone CryptRijndael SortNaturally TermReadKey TermShellUI FileKeePass TermReadLineGnu XMLParser
       ] ++ stdenv.lib.optional stdenv.isDarwin MacPasteboard)}"
   '';
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index b1c36871fe6b..0ce44b11acc5 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   postFixup =
     let wrapperArgs = runtimeDeps:
           "--prefix PERL5LIB : "
-          + (with perlPackages; stdenv.lib.makePerlPath [
+          + (with perlPackages; makePerlPath [
               CryptOpenSSLRSA
               CryptOpenSSLBignum
             ])
diff --git a/pkgs/tools/security/pcsctools/default.nix b/pkgs/tools/security/pcsctools/default.nix
index 42f1df8b3842..d38babc7d2e0 100644
--- a/pkgs/tools/security/pcsctools/default.nix
+++ b/pkgs/tools/security/pcsctools/default.nix
@@ -1,6 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, pkgconfig, udev, dbus, pcsclite
-, wget, coreutils
-, perl, pcscperl, Glib, Gtk2, Pango, Cairo
+, wget, coreutils, perlPackages
 }:
 
 let deps = lib.makeBinPath [ wget coreutils ];
@@ -13,17 +12,17 @@ in stdenv.mkDerivation rec {
     sha256 = "050x3yqd5ywl385zai3k1zhbm2lz1f5ksalfpm9hd86s50f03ans";
   };
 
-  buildInputs = [ udev dbus perl pcsclite ];
+  buildInputs = [ udev dbus perlPackages.perl pcsclite ];
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
 
   postInstall = ''
     wrapProgram $out/bin/scriptor \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl ]}"
     wrapProgram $out/bin/gscriptor \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl Glib Gtk2 Pango Cairo ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl Glib Gtk2 Pango Cairo ]}"
     wrapProgram $out/bin/ATR_analysis \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl ]}"
     wrapProgram $out/bin/pcsc_scan \
       --set PATH "$out/bin:${deps}"
   '';
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 14848df3f3ad..e7f291dd37b8 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -122,14 +122,14 @@ in stdenv.mkDerivation rec {
     # scripts)
 
     wrapProgram $out/bin/caff --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath ([
+      ${with perlPackages; makePerlPath ([
         TextTemplate MIMETools MailTools TimeDate NetIDNEncode ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ nettools gnupg1 ]}"
 
     wrapProgram $out/bin/gpg-key2latex --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 libpaper ]}"
 
@@ -140,7 +140,7 @@ in stdenv.mkDerivation rec {
       "${stdenv.lib.makeBinPath [ gnupg1 qprint ]}"
 
     wrapProgram $out/bin/gpgdir --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath ([
+      ${with perlPackages; makePerlPath ([
         TermReadKey ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
@@ -155,7 +155,7 @@ in stdenv.mkDerivation rec {
 #    wrapProgram $out/bin/gpgparticipants-prefill
 
     wrapProgram $out/bin/gpgsigs --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
@@ -171,12 +171,12 @@ in stdenv.mkDerivation rec {
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
     wrapProgram $out/bin/pgp-clean --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
     wrapProgram $out/bin/pgp-fixkey --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
@@ -189,7 +189,7 @@ in stdenv.mkDerivation rec {
 #    wrapProgram $out/bin/sig2dot
 
     wrapProgram $out/bin/springgraph --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath [ GD ]}
+      ${with perlPackages; makePerlPath [ GD ]}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/logcheck/default.nix b/pkgs/tools/system/logcheck/default.nix
index 0f2de9888e44..25a9660aed90 100644
--- a/pkgs/tools/system/logcheck/default.nix
+++ b/pkgs/tools/system/logcheck/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lockfileProgs, perl, mimeConstruct }:
+{ stdenv, fetchurl, lockfileProgs, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "logcheck-${version}";
@@ -16,13 +16,13 @@ stdenv.mkDerivation rec {
   '';
 
   preConfigure = ''
-    substituteInPlace src/logtail --replace "/usr/bin/perl" "${perl}/bin/perl"
-    substituteInPlace src/logtail2 --replace "/usr/bin/perl" "${perl}/bin/perl"
+    substituteInPlace src/logtail --replace "/usr/bin/perl" "${perlPackages.perl}/bin/perl"
+    substituteInPlace src/logtail2 --replace "/usr/bin/perl" "${perlPackages.perl}/bin/perl"
 
     sed -i -e 's|! -f /usr/bin/lockfile|! -f ${lockfileProgs}/bin/lockfile|' \
            -e 's|^\([ \t]*\)lockfile-|\1${lockfileProgs}/bin/lockfile-|' \
            -e "s|/usr/sbin/logtail2|$out/sbin/logtail2|" \
-           -e 's|mime-construct|${mimeConstruct}/bin/mime-construct|' \
+           -e 's|mime-construct|${perlPackages.mimeConstruct}/bin/mime-construct|' \
            -e 's|\$(run-parts --list "\$dir")|"$dir"/*|' src/logcheck
   '';
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "SBINDIR=sbin"
     "BINDIR=bin"
     "SHAREDIR=share/logtail/detectrotate"
- ];
+  ];
 
   meta = with stdenv.lib; {
     description = "Mails anomalies in the system logfiles to the administrator";
@@ -44,6 +44,5 @@ stdenv.mkDerivation rec {
     homepage = http://logcheck.alioth.debian.org/;
     license = licenses.gpl2;
     maintainers = [ maintainers.bluescreen303 ];
-    
   };
 }
diff --git a/pkgs/tools/text/mb2md/default.nix b/pkgs/tools/text/mb2md/default.nix
index a920cbf39482..adaff3e2f436 100644
--- a/pkgs/tools/text/mb2md/default.nix
+++ b/pkgs/tools/text/mb2md/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, perl, makeWrapper, perlPackages }:
+{ stdenv, lib, fetchurl, makeWrapper, perlPackages }:
 
 let
   perlDeps = with perlPackages; [ TimeDate ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
 
   unpackPhase = ''
     sourceRoot=.
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/mb2md \
-      --set PERL5LIB "${lib.makePerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makePerlPath perlDeps}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/namazu/default.nix b/pkgs/tools/text/namazu/default.nix
index 67a26cb41aa0..59cfc86efbf3 100644
--- a/pkgs/tools/text/namazu/default.nix
+++ b/pkgs/tools/text/namazu/default.nix
@@ -11,14 +11,13 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ];
 
   # First install the `File::MMagic' Perl module.
-  # !!! this shouldn't refer to Perl 5.10.0!
   preConfigure = ''
-    ( cd File-MMagic &&				\
-      perl Makefile.PL				\
-        LIB="$out/lib/perl5/site_perl/5.10.0"	\
-        INSTALLSITEMAN3DIR="$out/man" &&	\
+    ( cd File-MMagic &&                              \
+      perl Makefile.PL                               \
+        LIB="$out/${perl.libPrefix}/${perl.version}" \
+        INSTALLSITEMAN3DIR="$out/man" &&             \
       make && make install )
-    export PERL5LIB="$out/lib/perl5/site_perl/5.10.0:$PERL5LIB"
+    export PERL5LIB="$out/${perl.libPrefix}/${perl.version}:$PERL5LIB"
   '';
 
   # FIXME: The `tests/namazu-6' test fails on GNU/Linux, presumably because
diff --git a/pkgs/tools/text/schema2ldif/default.nix b/pkgs/tools/text/schema2ldif/default.nix
index 699d2d28b82b..70bae423dd50 100644
--- a/pkgs/tools/text/schema2ldif/default.nix
+++ b/pkgs/tools/text/schema2ldif/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, perl, perlPackages }: stdenv.mkDerivation rec {
+{ stdenv, fetchurl, makeWrapper, perlPackages }: stdenv.mkDerivation rec {
   name = "schema2ldif-${version}";
   version = "1.3";
 
@@ -7,7 +7,7 @@
     sha256 = "00cd9xx9g0mnnfn5lvay3vg166z84jla0ya1x34ljdc8bflxsr9a";
   };
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
@@ -18,7 +18,7 @@
     gzip -c man/ldap-schema-manager.1 > $out/share/man/man1/ldap-schema-manager.1.gz
 
     wrapProgram $out/bin/schema2ldif \
-       --prefix PERL5PATH : "${stdenv.lib.makePerlPath [ perlPackages.GetoptLong perlPackages.PodUsage ]}"
+       --prefix PERL5PATH : "${perlPackages.makePerlPath [ perlPackages.GetoptLong perlPackages.PodUsage ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/docbook2odf/default.nix b/pkgs/tools/typesetting/docbook2odf/default.nix
index 029227cd1186..7200909660bd 100644
--- a/pkgs/tools/typesetting/docbook2odf/default.nix
+++ b/pkgs/tools/typesetting/docbook2odf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, makeWrapper, zip, libxslt, PerlMagick }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, zip, libxslt }:
 
 stdenv.mkDerivation rec {
   name = "docbook2odf-0.244";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "10k44g0qqa37k30pfj8vz95j6zdzz0nmnqjq1lyahfs2h4glzgwb";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  buildInputs = [ perlPackages.perl makeWrapper ];
 
   installPhase = ''
     mkdir -p "$out/bin/"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram "$out/bin/docbook2odf" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ zip libxslt ]}" \
-      --prefix PERL5PATH : "${stdenv.lib.makePerlPath [PerlMagick]}"
+      --prefix PERL5PATH : "${perlPackages.makePerlPath [ perlPackages.PerlMagick ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index e38e4a1f0596..5309e4555b49 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -1,5 +1,4 @@
-{ fetchurl, stdenv, texinfo, perl
-, XMLSAX, XMLSAXBase, XMLParser, XMLNamespaceSupport
+{ fetchurl, stdenv, texinfo, perlPackages
 , groff, libxml2, libxslt, gnused, libiconv, opensp
 , docbook_xml_dtd_43
 , makeWrapper }:
@@ -16,9 +15,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  buildInputs = [ perl texinfo groff libxml2 libxslt makeWrapper
-                  XMLSAX XMLParser XMLNamespaceSupport opensp libiconv
-                ];
+  buildInputs = [ texinfo groff libxml2 libxslt makeWrapper opensp libiconv ]
+    ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
     # Broken substitution is used for `perl/config.pl', which leaves literal
@@ -36,10 +34,8 @@ stdenv.mkDerivation rec {
     do
       # XXX: We work around the fact that `wrapProgram' doesn't support
       # spaces below by inserting escaped backslashes.
-      wrapProgram $out/bin/$i --prefix PERL5LIB : \
-        "${XMLSAX}/lib/perl5/site_perl:${XMLSAXBase}/lib/perl5/site_perl:${XMLParser}/lib/perl5/site_perl" \
-        --prefix PERL5LIB : \
-        "${XMLNamespaceSupport}/lib/perl5/site_perl" \
+      wrapProgram $out/bin/$i \
+        --prefix PERL5LIB : ${with perlPackages; makeFullPerlPath [XMLSAX XMLParser XMLNamespaceSupport]} \
         --prefix XML_CATALOG_FILES "\ " \
         "$out/share/docbook2X/dtd/catalog.xml\ $out/share/docbook2X/xslt/catalog.xml\ ${docbook_xml_dtd_43}/xml/dtd/docbook/catalog.xml"
     done
diff --git a/pkgs/tools/virtualization/nixos-container/default.nix b/pkgs/tools/virtualization/nixos-container/default.nix
index 0763536533f0..94a19c5375ea 100644
--- a/pkgs/tools/virtualization/nixos-container/default.nix
+++ b/pkgs/tools/virtualization/nixos-container/default.nix
@@ -1,11 +1,11 @@
-{ substituteAll, perl, perlPackages, shadow, utillinux }:
+{ substituteAll, perlPackages, shadow, utillinux }:
 
 substituteAll {
     name = "nixos-container";
     dir = "bin";
     isExecutable = true;
     src = ./nixos-container.pl;
-    perl = "${perl}/bin/perl -I${perlPackages.FileSlurp}/lib/perl5/site_perl";
+    perl = "${perlPackages.perl}/bin/perl -I${perlPackages.FileSlurp}/${perlPackages.perl.libPrefix}";
     su = "${shadow.su}/bin/su";
     inherit utillinux;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5191f9683a30..0a2abe9fc54d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -669,7 +669,6 @@ in
   apg = callPackage ../tools/security/apg { };
 
   apt = callPackage ../tools/package-management/apt {
-    inherit (perlPackages) Po4a;
     # include/c++/6.4.0/cstdlib:75:25: fatal error: stdlib.h: No such file or directory
     stdenv = overrideCC stdenv gcc5;
   };
@@ -2068,9 +2067,7 @@ in
 
   client-ip-echo = callPackage ../servers/misc/client-ip-echo { };
 
-  cloc = callPackage ../tools/misc/cloc {
-    inherit (perlPackages) perl AlgorithmDiff ParallelForkManager RegexpCommon;
-  };
+  cloc = callPackage ../tools/misc/cloc { };
 
   cloog = callPackage ../development/libraries/cloog {
     isl = isl_0_14;
@@ -2199,9 +2196,7 @@ in
 
   debianutils = callPackage ../tools/misc/debianutils { };
 
-  debian-devscripts = callPackage ../tools/misc/debian-devscripts {
-    inherit (perlPackages) CryptSSLeay LWP TimeDate DBFile FileDesktopEntry;
-  };
+  debian-devscripts = callPackage ../tools/misc/debian-devscripts { };
 
   debootstrap = callPackage ../tools/misc/debootstrap { };
 
@@ -2303,15 +2298,11 @@ in
 
   dmg2img = callPackage ../tools/misc/dmg2img { };
 
-  docbook2odf = callPackage ../tools/typesetting/docbook2odf {
-    inherit (perlPackages) PerlMagick;
-  };
+  docbook2odf = callPackage ../tools/typesetting/docbook2odf { };
 
   doas = callPackage ../tools/security/doas { };
 
-  docbook2x = callPackage ../tools/typesetting/docbook2x {
-    inherit (perlPackages) XMLSAX XMLSAXBase XMLParser XMLNamespaceSupport;
-  };
+  docbook2x = callPackage ../tools/typesetting/docbook2x { };
 
   docbook2mdoc = callPackage ../tools/misc/docbook2mdoc { };
 
@@ -2545,9 +2536,7 @@ in
 
   ext4magic = callPackage ../tools/filesystems/ext4magic { };
 
-  extract_url = callPackage ../applications/misc/extract_url {
-    inherit (perlPackages) MIMEtools HTMLParser CursesUI URIFind;
-  };
+  extract_url = callPackage ../applications/misc/extract_url { };
 
   extundelete = callPackage ../tools/filesystems/extundelete { };
 
@@ -2629,9 +2618,7 @@ in
 
   ferm = callPackage ../tools/networking/ferm { };
 
-  fgallery = callPackage ../tools/graphics/fgallery {
-    inherit (perlPackages) ImageExifTool CpanelJSONXS;
-  };
+  fgallery = callPackage ../tools/graphics/fgallery { };
 
   flannel = callPackage ../tools/networking/flannel { };
 
@@ -4013,9 +4000,7 @@ in
 
   localtime = callPackage ../tools/system/localtime { };
 
-  logcheck = callPackage ../tools/system/logcheck {
-    inherit (perlPackages) mimeConstruct;
-  };
+  logcheck = callPackage ../tools/system/logcheck { };
 
   logmein-hamachi = callPackage ../tools/networking/logmein-hamachi { };
 
@@ -4252,13 +4237,10 @@ in
   monit = callPackage ../tools/system/monit { };
 
   moreutils = callPackage ../tools/misc/moreutils {
-    inherit (perlPackages) IPCRun TimeDate TimeDuration;
     docbook-xsl = docbook_xsl;
   };
 
-  mosh = callPackage ../tools/networking/mosh {
-    inherit (perlPackages) IOTty;
-  };
+  mosh = callPackage ../tools/networking/mosh { };
 
   motuclient = callPackage ../applications/science/misc/motu-client { };
 
@@ -4764,9 +4746,7 @@ in
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
 
-  pcsctools = callPackage ../tools/security/pcsctools {
-    inherit (perlPackages) pcscperl Glib Gtk2 Pango Cairo;
-  };
+  pcsctools = callPackage ../tools/security/pcsctools { };
 
   pcsc-cyberjack = callPackage ../tools/security/pcsc-cyberjack { };
 
@@ -5443,9 +5423,7 @@ in
 
   sleepyhead = callPackage ../applications/misc/sleepyhead {};
 
-  slimrat = callPackage ../tools/networking/slimrat {
-    inherit (perlPackages) WWWMechanize LWP;
-  };
+  slimrat = callPackage ../tools/networking/slimrat { };
 
   slsnif = callPackage ../tools/misc/slsnif { };
 
@@ -5622,9 +5600,7 @@ in
 
   swagger-codegen = callPackage ../tools/networking/swagger-codegen { };
 
-  swec = callPackage ../tools/networking/swec {
-    inherit (perlPackages) LWP URI HTMLParser HTTPServerSimple Parent;
-  };
+  swec = callPackage ../tools/networking/swec { };
 
   swfdec = callPackage ../tools/graphics/swfdec {};
 
@@ -5965,10 +5941,7 @@ in
 
   vcftools = callPackage ../applications/science/biology/vcftools { };
 
-  vcsh = callPackage ../applications/version-management/vcsh {
-    inherit (perlPackages) ShellCommand TestMost TestDifferences TestDeep
-      TestException TestWarn;
-  };
+  vcsh = callPackage ../applications/version-management/vcsh { };
 
   vcstool = callPackage ../development/tools/vcstool { };
 
@@ -6274,7 +6247,6 @@ in
   weighttp = callPackage ../tools/networking/weighttp { };
 
   wget = callPackage ../tools/networking/wget {
-    inherit (perlPackages) IOSocketSSL LWP;
     libpsl = null;
   };
 
@@ -8411,16 +8383,12 @@ in
   };
 
   creduce = callPackage ../development/tools/misc/creduce {
-    inherit (perlPackages) perl
-      ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey;
     inherit (llvmPackages_6) llvm clang-unwrapped;
   };
 
   cscope = callPackage ../development/tools/misc/cscope { };
 
-  csmith = callPackage ../development/tools/misc/csmith {
-    inherit (perlPackages) perl SysCPU;
-  };
+  csmith = callPackage ../development/tools/misc/csmith { };
 
   csslint = callPackage ../development/web/csslint { };
 
@@ -8630,9 +8598,7 @@ in
 
   hcloud = callPackage ../development/tools/hcloud { };
 
-  help2man = callPackage ../development/tools/misc/help2man {
-    inherit (perlPackages) LocaleGettext;
-  };
+  help2man = callPackage ../development/tools/misc/help2man { };
 
   heroku = callPackage ../development/tools/heroku {
     nodejs = nodejs-10_x;
@@ -8650,9 +8616,7 @@ in
 
   icmake = callPackage ../development/tools/build-managers/icmake { };
 
-  iconnamingutils = callPackage ../development/tools/misc/icon-naming-utils {
-    inherit (perlPackages) XMLSimple;
-  };
+  iconnamingutils = callPackage ../development/tools/misc/icon-naming-utils { };
 
   include-what-you-use = callPackage ../development/tools/analysis/include-what-you-use {
     llvmPackages = llvmPackages_6;
@@ -10185,9 +10149,7 @@ in
 
   hiredis = callPackage ../development/libraries/hiredis { };
 
-  hivex = callPackage ../development/libraries/hivex {
-    inherit (perlPackages) IOStringy;
-  };
+  hivex = callPackage ../development/libraries/hivex { };
 
   hound = callPackage ../development/tools/misc/hound { };
 
@@ -10812,7 +10774,6 @@ in
 
   libguestfs-appliance = callPackage ../development/libraries/libguestfs/appliance.nix {};
   libguestfs = callPackage ../development/libraries/libguestfs {
-    inherit (perlPackages) libintl_perl GetoptLong SysVirt;
     appliance = libguestfs-appliance;
   };
 
@@ -13343,16 +13304,12 @@ in
 
   diod = callPackage ../servers/diod { lua = lua5_1; };
 
-  dkimproxy = callPackage ../servers/mail/dkimproxy {
-    inherit (perlPackages) Error MailDKIM MIMETools NetServer;
-  };
+  dkimproxy = callPackage ../servers/mail/dkimproxy { };
 
   dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
 
-  dspam = callPackage ../servers/mail/dspam {
-    inherit (perlPackages) libnet;
-  };
+  dspam = callPackage ../servers/mail/dspam { };
 
   etcd = callPackage ../servers/etcd { };
 
@@ -13681,7 +13638,7 @@ in
 
   monitoring-plugins = callPackage ../servers/monitoring/plugins { };
 
-  inherit (callPackage ../servers/monitoring/plugins/labs_consol_de.nix { inherit (perlPackages) DBDsybase NetSNMP; })
+  inherit (callPackage ../servers/monitoring/plugins/labs_consol_de.nix { })
     check-mssql-health
     check-nwc-health
     check-ups-health;
@@ -13842,10 +13799,7 @@ in
 
   supervise = callPackage ../tools/system/supervise { };
 
-  spamassassin = callPackage ../servers/mail/spamassassin {
-    inherit (perlPackages) HTMLParser NetDNS NetAddrIP DBFile
-      HTTPDate MailDKIM LWP IOSocketSSL;
-  };
+  spamassassin = callPackage ../servers/mail/spamassassin { };
 
   deadpixi-sam-unstable = callPackage ../applications/editors/deadpixi-sam { };
   deadpixi-sam = deadpixi-sam-unstable;
@@ -15750,7 +15704,6 @@ in
   aacgain = callPackage ../applications/audio/aacgain { };
 
   abcde = callPackage ../applications/audio/abcde {
-    inherit (perlPackages) MusicBrainz MusicBrainzDiscID;
     inherit (pythonPackages) eyeD3;
   };
 
@@ -17455,10 +17408,6 @@ in
   ike = callPackage ../applications/networking/ike { };
 
   ikiwiki = callPackage ../applications/misc/ikiwiki {
-    inherit (perlPackages) TextMarkdown URI HTMLParser HTMLScrubber
-      HTMLTemplate TimeDate CGISession DBFile CGIFormBuilder LocaleGettext
-      RpcXML XMLSimple YAML YAMLLibYAML HTMLTree Filechdir
-      AuthenPassphrase NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay;
     inherit (perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig;}; }) PerlMagick;
   };
 
@@ -21224,9 +21173,7 @@ in
 
   bcftools = callPackage ../applications/science/biology/bcftools { };
 
-  conglomerate = callPackage ../applications/science/biology/conglomerate {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  conglomerate = callPackage ../applications/science/biology/conglomerate { };
 
   dcm2niix = callPackage ../applications/science/biology/dcm2niix { };
 
@@ -21244,9 +21191,7 @@ in
 
   igv = callPackage ../applications/science/biology/igv { };
 
-  inormalize = callPackage ../applications/science/biology/inormalize {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  inormalize = callPackage ../applications/science/biology/inormalize { };
 
   iv = callPackage ../applications/science/biology/iv {
     neuron-version = neuron.version;
@@ -21258,9 +21203,7 @@ in
 
   muscle = callPackage ../applications/science/biology/muscle { };
 
-  n3 = callPackage ../applications/science/biology/N3 {
-    inherit (perlPackages) perl GetoptTabular MNI-Perllib;
-  };
+  n3 = callPackage ../applications/science/biology/N3 { };
 
   neuron = callPackage ../applications/science/biology/neuron {
     python = null;
@@ -21274,17 +21217,11 @@ in
 
   mrbayes = callPackage ../applications/science/biology/mrbayes { };
 
-  minc_tools = callPackage ../applications/science/biology/minc-tools {
-    inherit (perlPackages) TextFormat;
-  };
+  minc_tools = callPackage ../applications/science/biology/minc-tools { };
 
-  minc_widgets = callPackage ../applications/science/biology/minc-widgets {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  minc_widgets = callPackage ../applications/science/biology/minc-widgets { };
 
-  mni_autoreg = callPackage ../applications/science/biology/mni_autoreg {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  mni_autoreg = callPackage ../applications/science/biology/mni_autoreg { };
 
   minimap2 = callPackage ../applications/science/biology/minimap2 { };
 
@@ -22638,12 +22575,7 @@ in
     conf = config.slock.conf or null;
   };
 
-  smokeping = callPackage ../tools/networking/smokeping {
-    inherit fping rrdtool;
-    inherit (perlPackages)
-      FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet
-      NetOpenSSH NetSNMP LWP IOTty perl NetDNS perlldap;
-  };
+  smokeping = callPackage ../tools/networking/smokeping { };
 
   snapraid = callPackage ../tools/filesystems/snapraid { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 74e9e60a0f88..999aad99b42f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -30,6 +30,24 @@ let
       checkPhase = "./Build test";
     });
 
+  /* Construct a perl search path (such as $PERL5LIB)
+
+     Example:
+       pkgs = import <nixpkgs> { }
+       makePerlPath [ pkgs.perlPackages.libnet ]
+       => "/nix/store/n0m1fk9c960d8wlrs62sncnadygqqc6y-perl-Net-SMTP-1.25/lib/perl5/site_perl"
+  */
+  makePerlPath = stdenv.lib.makeSearchPathOutput "lib" perl.libPrefix;
+
+  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
+
+     Example:
+       pkgs = import <nixpkgs> { }
+       makeFullPerlPath [ pkgs.perlPackages.CGI ]
+       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
+  */
+  makeFullPerlPath = deps: makePerlPath (stdenv.lib.misc.closePropagation deps);
+
 
   ack = buildPerlPackage rec {
     name = "ack-2.24";
@@ -4026,8 +4044,8 @@ let
       sha256 = "5509e532cdd0e3d91eda550578deaac29e2f008a12b64576e8c261bb92e8c2c1";
     };
     postInstall = stdenv.lib.optionalString (perl ? crossVersion) ''
-      mkdir -p $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI
-      cat > $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI.pm <<EOF
+      mkdir -p $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI
+      cat > $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI.pm <<EOF
       package DBI;
       BEGIN {
       our \$VERSION = "$version";
@@ -4035,8 +4053,8 @@ let
       1;
       EOF
 
-      autodir=$(echo $out/lib/perl5/site_perl/${perl.version}/*/auto/DBI)
-      cat > $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI/DBD.pm <<EOF
+      autodir=$(echo $out/${perl.libPrefix}/${perl.version}/*/auto/DBI)
+      cat > $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI/DBD.pm <<EOF
       package DBI::DBD;
       use Exporter ();
       use vars qw (@ISA @EXPORT);
@@ -9162,7 +9180,7 @@ let
     buildInputs = [ ModuleBuild NetDNSResolverProgrammable ];
     propagatedBuildInputs = [ Error NetAddrIP NetDNS URI ];
 
-    buildPhase = "perl Build.PL --install_base=$out --install_path=\"sbin=$out/bin\" --install_path=\"lib=$out/lib/perl5/site_perl\"; ./Build build ";
+    buildPhase = "perl Build.PL --install_base=$out --install_path=\"sbin=$out/bin\" --install_path=\"lib=$out/${perl.libPrefix}\"; ./Build build ";
 
     doCheck = false; # The main test performs network access
     meta = {
@@ -16142,7 +16160,7 @@ let
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/biblex"
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/bibparse"
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/dumpnames"
-      install_name_tool -change "$oldPath" "$newPath" "$out/lib/perl5/site_perl/${perl.version}/darwin-2level/auto/Text/BibTeX/BibTeX.bundle"
+      install_name_tool -change "$oldPath" "$newPath" "$out/${perl.libPrefix}/${perl.version}/darwin-2level/auto/Text/BibTeX/BibTeX.bundle"
     '';
     meta = {
       description = "Interface to read and parse BibTeX files";

From e022e80989de895d9ab86bd57a60178eed9a31f2 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 03:17:34 -0800
Subject: [PATCH 087/182] libatomic_ops: 7.6.6 -> 7.6.8

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/libatomic_ops/versions
---
 pkgs/development/libraries/libatomic_ops/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index a887384f94da..ea1df23182d3 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.6";
+  version = "7.6.8";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 = "0x7071z707msvyrv9dmgahd1sghbkw8fpbagvcag6xs8yp2spzlr";
+    sha256 = "0rgni7056gnbn105lln629gwd6s51779yb5ds9s7wxl1vyg2fshx";
   };
 
   outputs = [ "out" "dev" "doc" ];

From 754185b8d1916623a3bd4f5ffc1f915c1417541d Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 05:33:53 -0800
Subject: [PATCH 088/182] libwacom: 0.31 -> 0.32

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/libwacom/versions
---
 pkgs/development/libraries/libwacom/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 6cfc5060b610..da367b52cc0d 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libwacom-${version}";
-  version = "0.31";
+  version = "0.32";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "0qjd4bn2abwzic34cm0sw3srx02spszbsvfdbzbpn2cb62b5gjmw";
+    sha256 = "15fz2z2h2awh2l08cv663s1zk4z8bmvvivwnnfvx2q8lkqgfkr7f";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];

From 3cb3a24ce96cf08106329954427d589dca6b3e00 Mon Sep 17 00:00:00 2001
From: Benjamin Herr <ben@0x539.de>
Date: Sat, 15 Dec 2018 06:53:50 -0800
Subject: [PATCH 089/182] go_1_10: 1.10.3 -> 1.10.7

---
 pkgs/development/compilers/go/1.10.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.10.nix b/pkgs/development/compilers/go/1.10.nix
index 832c020c40de..92a9291222f5 100644
--- a/pkgs/development/compilers/go/1.10.nix
+++ b/pkgs/development/compilers/go/1.10.nix
@@ -22,13 +22,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.10.3";
+  version = "1.10.7";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "0i89298dgnmpmam3ifkm0ax266vvbq1yz7wfw8wwrcma0szrbrnb";
+    sha256 = "1alc7dagijdg4p4hhvlznlgcxsl8gz94v7p9wk3kn303y782dl41";
   };
 
   GOCACHE = "off";

From ce2d980be8f146d88fda3037cd0b476ad2014ed5 Mon Sep 17 00:00:00 2001
From: Benjamin Herr <ben@0x539.de>
Date: Sat, 15 Dec 2018 06:54:12 -0800
Subject: [PATCH 090/182] go: 1.11.2 -> 1.11.4

---
 pkgs/development/compilers/go/1.11.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.11.nix b/pkgs/development/compilers/go/1.11.nix
index 5d4a8e84265f..ab4c7e6ae63e 100644
--- a/pkgs/development/compilers/go/1.11.nix
+++ b/pkgs/development/compilers/go/1.11.nix
@@ -28,13 +28,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.11.2";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "0pk7pxfm3ij2ksdrg49jz501fr1d103zr4mjjwv821if9g279jc9";
+    sha256 = "036nc17hffy0gcfs9j64qzwpjry65znbm4klf2h0xn81dp8d6mxk";
   };
 
   # perl is used for testing go vet

From 0a996c8ef31eb5ffb55d24dc4703fe0fe29589ff Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sat, 15 Dec 2018 12:26:11 -0600
Subject: [PATCH 091/182] =?UTF-8?q?darwin:=20use=20llvm=E2=80=99s=20dsymut?=
 =?UTF-8?q?il=20instead=20of=20dummy=20version?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We were previously using a dummy wrapper for dsymutil. This meant that
debug symbols were not getting generated when dsymutil was otherwise
available. This should fix that issue & provide a real dsymutil from
llvm.

Fixes #52148.
---
 pkgs/os-specific/darwin/binutils/default.nix | 12 ++++++------
 pkgs/os-specific/darwin/cctools/port.nix     |  7 -------
 pkgs/top-level/darwin-packages.nix           |  1 +
 3 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index bd10dde5572c..db33b78a4aba 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,5 +1,4 @@
-{ stdenv, binutils-unwrapped, cctools
-}:
+{ stdenv, binutils-unwrapped, cctools, llvm }:
 
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same targetPrefix.
@@ -8,12 +7,12 @@ assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
 let
   inherit (binutils-unwrapped) targetPrefix;
   cmds = [
-    "ar" "ranlib" "as" "dsymutil" "install_name_tool"
+    "ar" "ranlib" "as" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
   ];
 in
 
-# TODO loop over targetPrefixed binaries too
+# TODO: loop over targetPrefixed binaries too
 stdenv.mkDerivation {
   name = "${targetPrefix}cctools-binutils-darwin";
   outputs = [ "out" "info" "man" ];
@@ -25,9 +24,8 @@ stdenv.mkDerivation {
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
     # - as: as above
-    # - ar: the binutils one prodices .a files that the cctools ld doesn't like
+    # - ar: the binutils one produces .a files that the cctools ld doesn't like
     # - ranlib: for compatibility with ar
-    # - dsymutil: soon going away once it goes into LLVM (this one is fake anyway)
     # - otool: we use it for some of our name mangling
     # - install_name_tool: we use it to rewrite stuff in our bootstrap tools
     # - strip: the binutils one seems to break mach-o files
@@ -37,6 +35,8 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
+    ln -s ${llvm}/bin/llvm-dsymutil $out/bin/dsymutil
+
     ln -s ${binutils-unwrapped.out}/share $out/share
 
     ln -s ${cctools}/libexec $out/libexec
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 2bca1bcc1d75..6753c98239da 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -92,13 +92,6 @@ let
       popd
     '';
 
-    postInstall = ''
-      cat >$out/bin/dsymutil << EOF
-      #!${stdenv.shell}
-      EOF
-      chmod +x $out/bin/dsymutil
-    '';
-
     passthru = {
       inherit targetPrefix;
     };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b52afe98f7fa..1fc36139ac07 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -15,6 +15,7 @@ in
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
     inherit (darwin) cctools;
     inherit (pkgs) binutils-unwrapped;
+    inherit (pkgs.llvmPackages_5) llvm;
   };
 
   binutils = pkgs.wrapBintoolsWith {

From 1d6b0eb7dd7264eec2b3527187280fbe23352be0 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sat, 15 Dec 2018 12:13:26 -0600
Subject: [PATCH 092/182] lldb: add cf-private on darwin

This is necessary to avoid objc errors like:

    "_OBJC_CLASS_$_NSDictionary", referenced from:
        objc-class-ref in liblldbHost.a(HostInfoMacOSX.mm.o)
        objc-class-ref in liblldbPluginPlatformMacOSX.a(PlatformiOSSimulatorCoreSimulatorSupport.mm.o)
  ld: symbol(s) not found for architecture x86_64
---
 pkgs/development/compilers/llvm/4/lldb.nix | 2 +-
 pkgs/development/compilers/llvm/5/lldb.nix | 2 +-
 pkgs/development/compilers/llvm/6/lldb.nix | 2 +-
 pkgs/development/compilers/llvm/7/lldb.nix | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/llvm/4/lldb.nix b/pkgs/development/compilers/llvm/4/lldb.nix
index 325149fc19be..0be8a4d41865 100644
--- a/pkgs/development/compilers/llvm/4/lldb.nix
+++ b/pkgs/development/compilers/llvm/4/lldb.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb.nix
index 5e670d4de159..7be9a7e47b74 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb.nix
index 9571e7ab5a63..d33de2488350 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index 6c3f0699978f..809e992ac586 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];

From adcf4aa5241f8dc37195d9bcbce27a80b913a512 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sat, 15 Dec 2018 12:14:19 -0600
Subject: [PATCH 093/182] lldb: use provided INSTALL_NAME_DIR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #47886

We don’t want llvm to set the install name for us. It should be the
one given to us.
---
 pkgs/development/compilers/llvm/3.8/llvm.nix | 2 +-
 pkgs/development/compilers/llvm/3.9/llvm.nix | 2 +-
 pkgs/development/compilers/llvm/4/llvm.nix   | 2 +-
 pkgs/development/compilers/llvm/5/llvm.nix   | 2 +-
 pkgs/development/compilers/llvm/6/llvm.nix   | 2 +-
 pkgs/development/compilers/llvm/7/llvm.nix   | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index d7324665240f..c246bfe496ed 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
 
     substituteInPlace CMakeLists.txt \
-      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   ''
   + ''
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 9e7fbbe96c35..3cc1a4d6ccec 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -82,7 +82,7 @@ in stdenv.mkDerivation rec {
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
 
     substituteInPlace CMakeLists.txt \
-      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 1b186c730c06..7d93fec6a125 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
 
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index ae4b27441593..5277205f8803 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation (rec {
 
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 6c391e78f283..192439b019bc 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -59,7 +59,7 @@ in stdenv.mkDerivation (rec {
 
   postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 69d76effca74..d085f3af0eab 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -52,7 +52,7 @@ in stdenv.mkDerivation (rec {
 
   postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.

From acb144a477a4086715366a0f90e3d34f0daa30fb Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 17:14:37 -0800
Subject: [PATCH 094/182] jansson: 2.11 -> 2.12

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/jansson/versions
---
 pkgs/development/libraries/jansson/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/jansson/default.nix b/pkgs/development/libraries/jansson/default.nix
index b1167efdfee6..bdb8f3b76ae6 100644
--- a/pkgs/development/libraries/jansson/default.nix
+++ b/pkgs/development/libraries/jansson/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "jansson-2.11";
+  name = "jansson-2.12";
 
   src = fetchurl {
     url = "http://www.digip.org/jansson/releases/${name}.tar.gz";
-    sha256 = "1x5jllzzqamq6kahx9d9a5mrarm9m3f30vfxvcqpi6p4mcnz91bf";
+    sha256 = "1jfj4xq3rdgnkxval1x2gqwhaam34qdxbplsj5fsrvs8a1vfr3az";
   };
 
   meta = with stdenv.lib; {

From fdc6caf14497fab306b09c794adce6582c128d21 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 16 Dec 2018 14:22:54 +0000
Subject: [PATCH 095/182] nss: 3.40.1 -> 3.41

---
 pkgs/development/libraries/nss/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 4d48ae0b12bd..f8b993d202ab 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,7 +5,7 @@ let
     url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.40.1";
+  version = "3.41";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${name}.tar.gz";
-    sha256 = "1wf8qapd2lh8pbjd6pp9m32mx1zyddrmv5c4cr86xj3r5ap6n3jy";
+    sha256 = "0bbif42fzz5gk451sv3yphdrl7m4p6zgk5jk0307j06xs3sihbmb";
   };
 
   buildInputs = [ perl zlib sqlite ]

From 4027966602c1d3bfac7091e390c2cf678115d59f Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sun, 16 Dec 2018 01:02:46 -0800
Subject: [PATCH 096/182] dejagnu: 1.6.1 -> 1.6.2

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/dejagnu/versions
---
 pkgs/development/tools/misc/dejagnu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index 26eaf707b2bd..dbe22bae77fc 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, expect, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "dejagnu-1.6.1";
+  name = "dejagnu-1.6.2";
 
   src = fetchurl {
     url = "mirror://gnu/dejagnu/${name}.tar.gz";
-    sha256 = "14hnq1mh91vqprc43xdy4f15sycw6fbajrh7zi6cw2kyg6xjhnxz";
+    sha256 = "0qfj2wd4qk1yn9yzam6g8nmyxfazcc0knjyyibycb2ainkhp21hd";
   };
 
   buildInputs = [ expect makeWrapper ];

From 4c40adceb983a17e1c94376a5a9000c6e4395c25 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 14 Dec 2018 16:05:44 +0100
Subject: [PATCH 097/182] libgit2-glib: move to top-level

---
 pkgs/applications/editors/gnome-builder/default.nix       | 3 ++-
 pkgs/desktops/gnome-3/default.nix                         | 4 +---
 pkgs/development/libraries/git2/default.nix               | 2 +-
 .../libraries}/libgit2-glib/default.nix                   | 8 +++++---
 pkgs/top-level/all-packages.nix                           | 2 ++
 5 files changed, 11 insertions(+), 8 deletions(-)
 rename pkgs/{desktops/gnome-3/misc => development/libraries}/libgit2-glib/default.nix (80%)

diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index a66b3ba6322d..d57e7e856a31 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -7,6 +7,7 @@
 , flatpak
 , glibcLocales
 , gnome3
+, libgit2-glib
 , gobject-introspection
 , gspell
 , gtk-doc
@@ -61,7 +62,7 @@ in stdenv.mkDerivation {
     ctags
     flatpak
     gnome3.devhelp
-    gnome3.libgit2-glib
+    libgit2-glib
     gnome3.libpeas
     gnome3.vte
     gspell
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 626f4652ecec..536e0f52a2da 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -371,8 +371,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
 
-  libgit2-glib = callPackage ./misc/libgit2-glib { };
-
   libmediaart = callPackage ./misc/libmediaart { };
 
   gexiv2 = callPackage ./misc/gexiv2 { };
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 48d595137b3d..358fc31fc80f 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -6,7 +6,7 @@
 stdenv.mkDerivation (rec {
   name = "libgit2-${version}";
   version = "0.26.6";
-  # keep the version in sync with pythonPackages.pygit2 and gnome3.libgit2-glib
+  # keep the version in sync with pythonPackages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
diff --git a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix b/pkgs/development/libraries/libgit2-glib/default.nix
similarity index 80%
rename from pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
rename to pkgs/development/libraries/libgit2-glib/default.nix
index 8d078ea41e78..477a4a634316 100644
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
+++ b/pkgs/development/libraries/libgit2-glib/default.nix
@@ -2,11 +2,11 @@
 , gtk-doc, gobject-introspection, libgit2, glib, python3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgit2-glib-${version}";
+  pname = "libgit2-glib";
   version = "0.26.4";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libgit2-glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0nhyqas110q7ingw97bvyjdb7v4dzch517dq8sn8c33s8910wqcp";
   };
 
@@ -18,7 +18,9 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "libgit2-glib"; attrPath = "gnome3.libgit2-glib"; };
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ad64b26bffd6..5e1b04774caf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9891,6 +9891,8 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
+
   glbinding = callPackage ../development/libraries/glbinding { };
 
   gle = callPackage ../development/libraries/gle { };

From 472b70af810b20d797371a362c54a5388c188a4c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 14 Dec 2018 16:11:01 +0100
Subject: [PATCH 098/182] =?UTF-8?q?libgit2-glib:=200.26.4=20=E2=86=92=200.?=
 =?UTF-8?q?27.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/libgit2-glib/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libgit2-glib/default.nix b/pkgs/development/libraries/libgit2-glib/default.nix
index 477a4a634316..498858d52e91 100644
--- a/pkgs/development/libraries/libgit2-glib/default.nix
+++ b/pkgs/development/libraries/libgit2-glib/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2-glib";
-  version = "0.26.4";
+  version = "0.27.7";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0nhyqas110q7ingw97bvyjdb7v4dzch517dq8sn8c33s8910wqcp";
+    sha256 = "1hpgs8dx0dk25mc8jsizi2cwwhnmahrn3dyry9p7a1g48mnxyc8i";
   };
 
   postPatch = ''
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
+      versionPolicy = "none";
     };
   };
 

From 976cf1498397a5f7af8a30aa4106568fc5b3cf5d Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 14 Dec 2018 16:30:46 +0100
Subject: [PATCH 099/182] gitg: fix build with latest libgitg2-glib

---
 pkgs/desktops/gnome-3/misc/gitg/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/desktops/gnome-3/misc/gitg/default.nix b/pkgs/desktops/gnome-3/misc/gitg/default.nix
index b424a8a79697..a447d2aa5903 100644
--- a/pkgs/desktops/gnome-3/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gitg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, vala, intltool, pkgconfig, gtk3, glib
+{ stdenv, fetchurl, fetchpatch, vala, intltool, pkgconfig, gtk3, glib
 , json-glib, wrapGAppsHook, libpeas, bash, gobject-introspection
 , gnome3, gtkspell3, shared-mime-info, libgee, libgit2-glib, libsecret
 , meson, ninja, python3
@@ -15,6 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "1fz8q1aiql6k740savdjh0vzbyhcflgf94cfdhvzcrrvm929n2ss";
   };
 
+  patches = [
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gitg/commit/42bceea265f53fe7fd4a41037b936deed975fc6c.patch;
+      sha256 = "1xq245rsi1bi66lswk33pdiazfaagxf77836ds5q73900rx4r7fw";
+    })
+  ];
+
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py

From cc506381761d84bd0047cabba7151ad516fa8a32 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Fri, 14 Dec 2018 16:37:53 +0100
Subject: [PATCH 100/182] =?UTF-8?q?libgit2:=200.26.6=20=E2=86=92=200.27.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../git-and-tools/grv/default.nix             |  4 +--
 pkgs/development/libraries/git2/0.27.nix      | 36 -------------------
 pkgs/development/libraries/git2/default.nix   | 17 +++++----
 .../python-modules/pygit2/default.nix         |  6 ++--
 pkgs/top-level/all-packages.nix               |  8 +----
 5 files changed, 14 insertions(+), 57 deletions(-)
 delete mode 100644 pkgs/development/libraries/git2/0.27.nix

diff --git a/pkgs/applications/version-management/git-and-tools/grv/default.nix b/pkgs/applications/version-management/git-and-tools/grv/default.nix
index dd080799557b..afd187ebb55b 100644
--- a/pkgs/applications/version-management/git-and-tools/grv/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/grv/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2_0_27, ncurses, pkgconfig, readline }:
+{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2, ncurses, pkgconfig, readline }:
 let
   version = "0.3.0";
 in
 buildGo19Package {
   name = "grv-${version}";
 
-  buildInputs = [ ncurses readline curl libgit2_0_27 ];
+  buildInputs = [ ncurses readline curl libgit2 ];
   nativeBuildInputs = [ pkgconfig ];
 
   goPackagePath = "github.com/rgburke/grv";
diff --git a/pkgs/development/libraries/git2/0.27.nix b/pkgs/development/libraries/git2/0.27.nix
deleted file mode 100644
index 93948a1b0d67..000000000000
--- a/pkgs/development/libraries/git2/0.27.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
-, zlib, libssh2, openssl, http-parser, curl
-, libiconv, Security
-}:
-
-stdenv.mkDerivation rec {
-  version = "0.27.7";
-  name = "libgit2-${version}";
-
-  src = fetchFromGitHub {
-    owner = "libgit2";
-    repo = "libgit2";
-    rev = "v${version}";
-    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
-  };
-
-  cmakeFlags = [ "-DTHREADSAFE=ON" ];
-
-  nativeBuildInputs = [ cmake python pkgconfig ];
-
-  buildInputs = [ zlib libssh2 openssl http-parser curl ]
-    ++ stdenv.lib.optional stdenv.isDarwin Security;
-
-  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
-
-  enableParallelBuilding = true;
-
-  doCheck = false; # hangs. or very expensive?
-
-  meta = {
-    description = "The Git linkable library";
-    homepage = https://libgit2.github.com/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = with stdenv.lib.platforms; all;
-  };
-}
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 358fc31fc80f..ec610d1e5656 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake
-, zlib, python, libssh2, openssl, curl, http-parser
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+, zlib, libssh2, openssl, http-parser, curl
 , libiconv, Security
 }:
 
-stdenv.mkDerivation (rec {
-  name = "libgit2-${version}";
-  version = "0.26.6";
+stdenv.mkDerivation rec {
+  pname = "libgit2";
+  version = "0.27.7";
   # keep the version in sync with pythonPackages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "17pjvprmdrx4h6bb1hhc98w9qi6ki7yl57f090n9kbhswxqfs7s3";
+    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
   };
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation (rec {
   buildInputs = [ zlib libssh2 openssl http-parser curl ]
     ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) [ libiconv ];
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
   enableParallelBuilding = true;
 
@@ -34,5 +34,4 @@ stdenv.mkDerivation (rec {
     license = licenses.gpl2;
     platforms = with platforms; all;
   };
-} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-})
+}
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 2334e4a3431b..313a3e5ab189 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2_0_27, six, cffi }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2, six, cffi }:
 
 buildPythonPackage rec {
   pname = "pygit2";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="${libgit2_0_27}/lib"
+    export DYLD_LIBRARY_PATH="${libgit2}/lib"
   '';
 
   patches = [ (fetchpatch {
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "18x1fpmywhjjr4lvakwmy34zpxfqi8pqqj48g1wcib39lh3s7l4f";
   }) ];
 
-  propagatedBuildInputs = [ libgit2_0_27 six ] ++ lib.optional (!isPyPy) cffi;
+  propagatedBuildInputs = [ libgit2 six ] ++ lib.optional (!isPyPy) cffi;
 
   preCheck = ''
     # disable tests that require networking
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5e1b04774caf..91a5bbd27eba 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -993,9 +993,7 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd {
-    libgit2 = libgit2_0_27;
-  };
+  blsd = callPackage ../tools/misc/blsd { };
 
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
@@ -9887,10 +9885,6 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  libgit2_0_27 = callPackage ../development/libraries/git2/0.27.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
 
   glbinding = callPackage ../development/libraries/glbinding { };

From 7a3cf0fbca367538dc580aee0d5a26c7ee67097d Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 07:12:49 -0800
Subject: [PATCH 101/182] libssh: 0.8.4 -> 0.8.5

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/libssh/versions
---
 pkgs/development/libraries/libssh/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index e67ecea07764..f1b9d349a428 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, cmake, zlib, openssl, libsodium }:
 
 stdenv.mkDerivation rec {
-  name = "libssh-0.8.4";
+  name = "libssh-0.8.5";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/0.8/${name}.tar.xz";
-    sha256 = "06xqfm1alfb6faqzjhyhjs0arjcd8rnc7ci046x8d18s089pgc3b";
+    sha256 = "0dd3nmd20jw4z116qbz3wbffxbzrczi6mcxw0rmqzj0g4hqw9lh7";
   };
 
   postPatch = ''

From e6f7f2928f668262577125290dc90ad8df12e724 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Tue, 2 Oct 2018 23:14:32 -0500
Subject: [PATCH 102/182] =?UTF-8?q?darwin:=2010.11=20=E2=86=92=2010.12?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lots of stuff has gotten moved around. Many security libraries have been merged
into the Security monorepo. I’ve cleared them out for now, we will
need to modify Security to build them!

This also moves some things around to more clearly separate
bootstrapping the stdenv from everything else. We want the “normal”
mode to be the non-bootstrapped version. When you ask for “Security”,
you want the actual built software, not a crippled one.

- Add TARGET_OS_OSX to darwin.libSystem. Looks like something
  introduced in 10.12. TARGET_OS_MAC is only set when building for
  desktop (iOS will have TARGET_OS_MAC set)
- Bump darwin.dtrace
- Bump darwin.libpthread
- Remove SmartCardServices, libsecurity*, etc.
- Install some more headers for darling.
---
 .../haskell-modules/configuration-nix.nix     |  19 ---
 pkgs/development/tools/xcbuild/toolchains.nix |   2 +
 .../Libc/CrashReporterClient.h                |  51 ++++++
 .../apple-source-releases/Libc/default.nix    |   2 +
 .../Libsystem/default.nix                     |  20 ++-
 .../Libsystem/system_c_symbols                |  27 +++
 .../Libsystem/system_kernel_symbols           | 160 ++++++++++++++++++
 .../apple-source-releases/Security/boot.nix   | 116 +++++++++++++
 .../Security/default.nix                      | 119 ++-----------
 .../SmartCardServices/default.nix             |  42 -----
 .../apple-source-releases/adv_cmds/boot.nix   |  91 ++++++++++
 .../adv_cmds/default.nix                      | 109 +++++-------
 .../apple-source-releases/adv_cmds/xcode.nix  |  58 -------
 .../bootstrap_cmds/default.nix                |   1 +
 .../darwin/apple-source-releases/default.nix  | 139 ++++++---------
 .../diskdev_cmds/default.nix                  |   4 +-
 .../apple-source-releases/dtrace/default.nix  |  85 +++++-----
 .../apple-source-releases/dtrace/xcode.nix    |  47 -----
 .../file_cmds/default.nix                     |   4 +-
 .../apple-source-releases/hfs/default.nix     |   8 +
 .../libsecurity_apple_csp/GNUmakefile         |  11 --
 .../libsecurity_apple_csp/default.nix         |  31 ----
 .../libsecurity_apple_cspdl/GNUmakefile       |  10 --
 .../libsecurity_apple_cspdl/default.nix       |  16 --
 .../libsecurity_apple_file_dl/GNUmakefile     |  10 --
 .../libsecurity_apple_file_dl/default.nix     |  17 --
 .../libsecurity_apple_x509_cl/GNUmakefile     |  10 --
 .../libsecurity_apple_x509_cl/default.nix     |  18 --
 .../libsecurity_apple_x509_tp/GNUmakefile     |  11 --
 .../libsecurity_apple_x509_tp/default.nix     |  19 ---
 .../libsecurity_asn1/GNUmakefile              |  11 --
 .../libsecurity_asn1/default.nix              |  14 --
 .../libsecurity_cdsa_client/GNUmakefile       |  10 --
 .../libsecurity_cdsa_client/default.nix       |   8 -
 .../libsecurity_cdsa_plugin/GNUmakefile       |  10 --
 .../libsecurity_cdsa_plugin/default.nix       |  15 --
 .../libsecurity_cdsa_utilities/GNUmakefile    |  13 --
 .../libsecurity_cdsa_utilities/default.nix    |  13 --
 .../handletemplates.patch                     |  19 ---
 .../libsecurity_cdsa_utils/GNUmakefile        |  13 --
 .../libsecurity_cdsa_utils/default.nix        |   8 -
 .../libsecurity_codesigning/GNUmakefile       |  10 --
 .../libsecurity_codesigning/default.nix       |  33 ----
 .../libsecurity_cssm/GNUmakefile              |  11 --
 .../libsecurity_cssm/default.nix              |  14 --
 .../libsecurity_filedb/GNUmakefile            |  10 --
 .../libsecurity_filedb/default.nix            |  13 --
 .../libsecurity_generic/default.nix           |  63 -------
 .../libsecurity_generic/impure_deps.nix       | 129 --------------
 .../libsecurity_keychain/GNUmakefile          |  10 --
 .../libsecurity_keychain/default.nix          |  43 -----
 .../libsecurity_mds/GNUmakefile               |  10 --
 .../libsecurity_mds/default.nix               |  11 --
 .../libsecurity_ocspd/GNUmakefile             |  10 --
 .../libsecurity_ocspd/default.nix             |  20 ---
 .../libsecurity_pkcs12/GNUmakefile            |  11 --
 .../libsecurity_pkcs12/default.nix            |  15 --
 .../libsecurity_sd_cspdl/GNUmakefile          |  10 --
 .../libsecurity_sd_cspdl/default.nix          |  10 --
 .../libsecurity_utilities/GNUmakefile         |  11 --
 .../libsecurity_utilities/default.nix         |  28 ---
 .../libsecurityd/GNUmakefile                  |  11 --
 .../libsecurityd/default.nix                  |  23 ---
 .../libsecurityd/xdr-arity.patch              |  79 ---------
 .../apple-source-releases/libutil/default.nix |  32 +++-
 .../apple-source-releases/libutil/new.nix     |  29 ----
 .../security_dotmac_tp/GNUmakefile            |   8 -
 .../security_dotmac_tp/default.nix            |   4 -
 .../security_systemkeychain/default.nix       |  32 ----
 .../apple-source-releases/top/default.nix     |   4 +-
 .../apple-source-releases/xnu/default.nix     |  93 +++++-----
 pkgs/os-specific/darwin/darling/default.nix   |   3 +
 .../darwin/security-tool/GNUmakefile          |  14 --
 .../darwin/security-tool/default.nix          | 101 -----------
 pkgs/top-level/darwin-packages.nix            |   4 -
 75 files changed, 704 insertions(+), 1596 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
 delete mode 100644 pkgs/os-specific/darwin/security-tool/GNUmakefile
 delete mode 100644 pkgs/os-specific/darwin/security-tool/default.nix

diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 590f7f0d9719..89431e486c79 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -126,25 +126,6 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
-  # Prevents needing to add `security_tool` as a run-time dependency for
-  # everything using x509-system to give access to the `security` executable.
-  x509-system = if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
-    then let inherit (pkgs.darwin) security_tool;
-      in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
-        # darwin.security_tool is broken in Mojave (#45042)
-
-        # We will use the system provided security for now.
-        # Beware this WILL break in sandboxes!
-
-        # TODO(matthewbauer): If someone really needs this to work in sandboxes,
-        # I think we can add a propagatedImpureHost dep here, but I’m hoping to
-        # get a proper fix available soonish.
-        postPatch = (drv.postPatch or "") + ''
-          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
-        '';
-      })
-    else super.x509-system;
-
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/tools/xcbuild/toolchains.nix b/pkgs/development/tools/xcbuild/toolchains.nix
index 59e009a43386..e435f0978c5e 100644
--- a/pkgs/development/tools/xcbuild/toolchains.nix
+++ b/pkgs/development/tools/xcbuild/toolchains.nix
@@ -67,5 +67,7 @@ runCommand "Toolchains" {} (''
   done
 
   ln -s ${buildPackages.darwin.bootstrap_cmds}/bin/mig $toolchain/bin
+  mkdir -p $toolchain/libexec
+  ln -s ${buildPackages.darwin.bootstrap_cmds}/libexec/migcom $toolchain/libexec
   ln -s ${mkdep-darwin-src} $toolchain/bin/mkdep
 '')
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h b/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
new file mode 100644
index 000000000000..a1cbb72b9176
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2010 Apple Inc. All rights reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+/***********************************************************************
+ * Not to be installed in /usr/local/include
+ ***********************************************************************/
+
+#ifndef _LIBC_CRASHREPORTERCLIENT_H
+#define _LIBC_CRASHREPORTERCLIENT_H
+
+#include "stdint.h"
+
+/* Fake the CrashReporterClient API */
+#define CRGetCrashLogMessage() 0
+#define CRSetCrashLogMessage(m) true
+
+#define CRASH_REPORTER_CLIENT_HIDDEN __attribute__((visibility("hidden")))
+#define CRASHREPORTER_ANNOTATIONS_VERSION 4
+#define CRASHREPORTER_ANNOTATIONS_SECTION "__crash_info"
+
+struct crashreporter_annotations_t {
+	uint64_t version;		// unsigned long
+	uint64_t message;		// char *
+	uint64_t signature_string;	// char *
+	uint64_t backtrace;		// char *
+	uint64_t message2;		// char *
+	uint64_t thread;		// uint64_t
+	uint64_t dialog_mode;		// unsigned int
+};
+
+#endif
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
index 542ea20de11e..6ebb470145d5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -11,6 +11,8 @@ appleDerivation {
     export PRIVATE_HEADERS_FOLDER_PATH=include
     bash xcodescripts/headers.sh
 
+    cp ${./CrashReporterClient.h} $out/include/CrashReporterClient.h
+
     cp ${Libc_10-9}/include/NSSystemDirectories.h $out/include
 
     # Ugh Apple stopped releasing this stuff so we need an older one...
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 1e27ead69f1b..a0edfbbb3b59 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,9 +1,11 @@
-{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo,
-  dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto, copyfile,
-  removefile, libresolv, Libnotify, libplatform, libpthread, mDNSResponder, launchd, libutil }:
+{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo
+, dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
+, copyfile, removefile, libresolv, Libnotify, libplatform, libpthread
+, mDNSResponder, launchd, libutil, hfs }:
 
 appleDerivation rec {
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
+  dontFixup = true;
 
   nativeBuildInputs = [ cpio ];
 
@@ -17,19 +19,21 @@ appleDerivation rec {
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/Availability*.h $out/include
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/stdarg.h        $out/include
 
-    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} ${libclosure} ${CarbonHeaders} \
-               ${libdispatch} ${ncurses.dev} ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
-               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} ${libutil} ${libpthread}; do
+    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} \
+               ${libclosure} ${CarbonHeaders} ${libdispatch} ${ncurses.dev} \
+               ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
+               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} \
+               ${libutil} ${libpthread} ${hfs}; do
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
-
     (cd ${cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
 
     cat <<EOF > $out/include/TargetConditionals.h
     #ifndef __TARGETCONDITIONALS__
     #define __TARGETCONDITIONALS__
     #define TARGET_OS_MAC           1
+    #define TARGET_OS_OSX           1
     #define TARGET_OS_WIN32         0
     #define TARGET_OS_UNIX          0
     #define TARGET_OS_EMBEDDED      0
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
index 4d83c5cfe9bd..1ec6c6332cf4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -232,6 +232,8 @@ __os_assert_log_ctx
 __os_assumes_log
 __os_assumes_log_ctx
 __os_avoid_tail_call
+__os_crash
+__os_crash_callback
 __os_debug_log
 __os_debug_log_error_str
 __putenvp
@@ -263,6 +265,7 @@ __unsetenvp
 __utmpxname
 _a64l
 _abort
+_abort_report_np
 _abs
 _acl_add_flag_np
 _acl_add_perm
@@ -345,6 +348,7 @@ _backtrace
 _backtrace_symbols
 _backtrace_symbols_fd
 _basename
+_basename_r
 _bcmp
 _bcopy
 _brk
@@ -377,8 +381,12 @@ _chmodx_np
 _clearerr
 _clearerr_unlocked
 _clock
+_clock_getres
+_clock_gettime
+_clock_gettime_nsec_np
 _clock_port
 _clock_sem
+_clock_settime
 _closedir
 _compat_mode
 _confstr
@@ -411,6 +419,7 @@ _digittoint
 _digittoint_l
 _dirfd
 _dirname
+_dirname_r
 _div
 _dprintf
 _dprintf_l
@@ -771,8 +780,12 @@ _mergesort_b
 _mkdirx_np
 _mkdtemp
 _mkfifox_np
+_mkostemp
+_mkostemps
 _mkpath_np
+_mkpathat_np
 _mkstemp
+_mkstemp_dprotected_np
 _mkstemps
 _mktemp
 _mktime
@@ -805,6 +818,7 @@ _nice
 _nl_langinfo
 _nl_langinfo_l
 _nrand48
+_nvis
 _off32
 _off64
 _offtime
@@ -959,6 +973,7 @@ _sleep
 _sleep$NOCANCEL
 _snprintf
 _snprintf_l
+_snvis
 _sockatmark
 _sprintf
 _sprintf_l
@@ -988,6 +1003,7 @@ _strcoll_l
 _strcpy
 _strcspn
 _strdup
+_strenvisx
 _strerror
 _strerror_r
 _strfmon
@@ -1006,14 +1022,23 @@ _strncpy
 _strndup
 _strnlen
 _strnstr
+_strnunvis
+_strnunvisx
+_strnvis
+_strnvisx
 _strpbrk
 _strptime
 _strptime_l
 _strrchr
+_strsenvisx
 _strsep
 _strsignal
+_strsnvis
+_strsnvisx
 _strspn
 _strstr
+_strsvis
+_strsvisx
 _strtod
 _strtod_l
 _strtof
@@ -1046,6 +1071,7 @@ _strvisx
 _strxfrm
 _strxfrm_l
 _suboptarg
+_svis
 _swab
 _swprintf
 _swprintf_l
@@ -1087,6 +1113,7 @@ _timelocal
 _timeoff
 _times
 _timezone
+_timingsafe_bcmp
 _tmpfile
 _tmpnam
 _toascii
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 4d1a1f521b06..0b8456b95013 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -3,6 +3,7 @@ _____old_semwait_signal_nocancel
 _____sigwait_nocancel
 ____kernelVersionNumber
 ____kernelVersionString
+___abort_with_payload
 ___accept
 ___accept_nocancel
 ___access_extended
@@ -13,6 +14,11 @@ ___bsdthread_ctl
 ___bsdthread_register
 ___bsdthread_terminate
 ___carbon_delete
+___channel_get_info
+___channel_get_opt
+___channel_open
+___channel_set_opt
+___channel_sync
 ___chmod
 ___chmod_extended
 ___close_nocancel
@@ -32,6 +38,7 @@ ___fchmod_extended
 ___fcntl
 ___fcntl_nocancel
 ___fork
+___fs_snapshot
 ___fstat64_extended
 ___fstat_extended
 ___fsync_nocancel
@@ -57,6 +64,8 @@ ___ioctl
 ___iopolicysys
 ___kdebug_trace
 ___kdebug_trace64
+___kdebug_trace_string
+___kdebug_typefilter
 ___kill
 ___lchown
 ___libkernel_init
@@ -79,6 +88,7 @@ ___mac_set_file
 ___mac_set_link
 ___mac_set_proc
 ___mac_syscall
+___microstackshot
 ___mkdir_extended
 ___mkfifo_extended
 ___mmap
@@ -90,6 +100,13 @@ ___msgsys
 ___msync
 ___msync_nocancel
 ___munmap
+___nexus_create
+___nexus_deregister
+___nexus_destroy
+___nexus_get_opt
+___nexus_open
+___nexus_register
+___nexus_set_opt
 ___old_semwait_signal
 ___open
 ___open_dprotected_np
@@ -97,12 +114,17 @@ ___open_extended
 ___open_nocancel
 ___openat
 ___openat_nocancel
+___os_nexus_ifattach
+___os_nexus_ifdetach
+___persona
 ___pipe
 ___poll_nocancel
 ___posix_spawn
 ___pread_nocancel
 ___proc_info
 ___process_policy
+___pselect
+___pselect_nocancel
 ___psynch_cvbroad
 ___psynch_cvclrprepost
 ___psynch_cvsignal
@@ -133,6 +155,7 @@ ___recvmsg
 ___recvmsg_nocancel
 ___rename
 ___renameat
+___renameatx_np
 ___rmdir
 ___sandbox_me
 ___sandbox_mm
@@ -175,6 +198,7 @@ ___sigsuspend
 ___sigsuspend_nocancel
 ___sigwait
 ___socketpair
+___stack_snapshot_with_config
 ___stat64_extended
 ___stat_extended
 ___syscall
@@ -182,8 +206,11 @@ ___syscall_logger
 ___sysctl
 ___sysctlbyname
 ___telemetry
+___terminate_with_payload
 ___thread_selfid
 ___thread_selfusage
+___ulock_wait
+___ulock_wake
 ___umask_extended
 ___unlink
 ___unlinkat
@@ -191,6 +218,7 @@ ___vfork
 ___wait4
 ___wait4_nocancel
 ___waitid_nocancel
+___work_interval_ctl
 ___workq_kernreturn
 ___workq_open
 ___write_nocancel
@@ -202,6 +230,7 @@ __get_cpu_capabilities
 __getprivatesystemidentifier
 __host_page_size
 __init_cpu_capabilities
+__kernelrpc_host_create_mach_voucher
 __kernelrpc_mach_port_allocate
 __kernelrpc_mach_port_allocate_full
 __kernelrpc_mach_port_allocate_name
@@ -257,13 +286,17 @@ __kernelrpc_mach_vm_map
 __kernelrpc_mach_vm_map_trap
 __kernelrpc_mach_vm_protect
 __kernelrpc_mach_vm_protect_trap
+__kernelrpc_mach_vm_purgable_control
+__kernelrpc_mach_vm_purgable_control_trap
 __kernelrpc_mach_vm_read
 __kernelrpc_mach_vm_remap
+__kernelrpc_mach_voucher_extract_attr_recipe
 __kernelrpc_task_set_port_space
 __kernelrpc_thread_policy
 __kernelrpc_thread_policy_set
 __kernelrpc_thread_set_policy
 __kernelrpc_vm_map
+__kernelrpc_vm_purgable_control
 __kernelrpc_vm_read
 __kernelrpc_vm_remap
 __mach_errors
@@ -272,6 +305,9 @@ __mach_snprintf
 __mach_vsnprintf
 __os_alloc_once_table
 __register_gethostuuid_callback
+__thread_set_tsd_base
+_abort_with_payload
+_abort_with_reason
 _accept
 _accept$NOCANCEL
 _access
@@ -312,6 +348,8 @@ _clock_set_attributes
 _clock_set_time
 _clock_sleep
 _clock_sleep_trap
+_clonefile
+_clonefileat
 _close
 _close$NOCANCEL
 _coalition_create
@@ -345,6 +383,7 @@ _fchmod
 _fchmodat
 _fchown
 _fchownat
+_fclonefileat
 _fcntl
 _fcntl$NOCANCEL
 _fdatasync
@@ -358,9 +397,17 @@ _flistxattr
 _flock
 _fpathconf
 _fremovexattr
+_fs_snapshot_create
+_fs_snapshot_delete
+_fs_snapshot_list
+_fs_snapshot_mount
+_fs_snapshot_rename
+_fs_snapshot_revert
+_fs_snapshot_root
 _fsctl
 _fsetattrlist
 _fsetxattr
+_fsgetpath
 _fstat
 _fstat$INODE64
 _fstat64
@@ -384,6 +431,7 @@ _getdirentries
 _getdirentriesattr
 _getdtablesize
 _getegid
+_getentropy
 _geteuid
 _getfh
 _getfsstat
@@ -409,6 +457,7 @@ _getsockopt
 _getuid
 _getwgroups_np
 _getxattr
+_grab_pgo_data
 _guarded_close_np
 _guarded_kqueue_np
 _guarded_open_dprotected_np
@@ -416,14 +465,18 @@ _guarded_open_np
 _guarded_pwrite_np
 _guarded_write_np
 _guarded_writev_np
+_host_check_multiuser_mode
 _host_create_mach_voucher
+_host_create_mach_voucher_trap
 _host_default_memory_manager
 _host_get_UNDServer
+_host_get_atm_diagnostic_flag
 _host_get_boot_info
 _host_get_clock_control
 _host_get_clock_service
 _host_get_exception_ports
 _host_get_io_master
+_host_get_multiuser_config_flags
 _host_get_special_port
 _host_info
 _host_kernel_version
@@ -443,7 +496,9 @@ _host_security_set_task_token
 _host_self
 _host_self_trap
 _host_set_UNDServer
+_host_set_atm_diagnostic_flag
 _host_set_exception_ports
+_host_set_multiuser_config_flags
 _host_set_special_port
 _host_statistics
 _host_statistics64
@@ -456,15 +511,28 @@ _internal_catch_exc_subsystem
 _ioctl
 _issetugid
 _kas_info
+_kdebug_is_enabled
+_kdebug_signpost
+_kdebug_signpost_end
+_kdebug_signpost_start
 _kdebug_trace
+_kdebug_trace_string
+_kdebug_typefilter
 _kevent
 _kevent64
+_kevent_qos
 _kext_request
 _kill
 _kmod_control
 _kmod_create
 _kmod_destroy
 _kmod_get_info
+_kpersona_alloc
+_kpersona_dealloc
+_kpersona_find
+_kpersona_get
+_kpersona_info
+_kpersona_pidinfo
 _kqueue
 _lchown
 _ledger
@@ -487,14 +555,20 @@ _lstat$INODE64
 _lstat64
 _mach_absolute_time
 _mach_approximate_time
+_mach_boottime_usec
+_mach_continuous_approximate_time
+_mach_continuous_time
 _mach_error
 _mach_error_full_diag
 _mach_error_string
 _mach_error_type
+_mach_generate_activity_id
+_mach_get_times
 _mach_host_self
 _mach_init
 _mach_make_memory_entry
 _mach_make_memory_entry_64
+_mach_memory_info
 _mach_memory_object_memory_entry
 _mach_memory_object_memory_entry_64
 _mach_msg
@@ -554,6 +628,7 @@ _mach_task_self
 _mach_task_self_
 _mach_thread_self
 _mach_timebase_info
+_mach_timebase_info_trap
 _mach_vm_allocate
 _mach_vm_behavior_set
 _mach_vm_copy
@@ -580,6 +655,7 @@ _mach_voucher_debug_info
 _mach_voucher_extract_all_attr_recipes
 _mach_voucher_extract_attr_content
 _mach_voucher_extract_attr_recipe
+_mach_voucher_extract_attr_recipe_trap
 _mach_wait_until
 _mach_zone_force_gc
 _mach_zone_info
@@ -598,9 +674,11 @@ _mig_get_reply_port
 _mig_put_reply_port
 _mig_reply_setup
 _mig_strncpy
+_mig_strncpy_zerofill
 _mincore
 _minherit
 _mk_timer_arm
+_mk_timer_arm_leeway
 _mk_timer_cancel
 _mk_timer_create
 _mk_timer_destroy
@@ -630,7 +708,10 @@ _msync$NOCANCEL
 _munlock
 _munlockall
 _munmap
+_necp_client_action
 _necp_match_policy
+_necp_open
+_netagent_trigger
 _netname_check_in
 _netname_check_out
 _netname_look_up
@@ -645,6 +726,44 @@ _open_dprotected_np
 _openat
 _openat$NOCANCEL
 _openbyid_np
+_os_channel_advance_slot
+_os_channel_attr_clone
+_os_channel_attr_create
+_os_channel_attr_destroy
+_os_channel_attr_get
+_os_channel_attr_get_key
+_os_channel_attr_set
+_os_channel_attr_set_key
+_os_channel_available_slot_count
+_os_channel_create
+_os_channel_create_extended
+_os_channel_destroy
+_os_channel_get_fd
+_os_channel_get_next_slot
+_os_channel_pending
+_os_channel_read_attr
+_os_channel_read_nexus_extension_info
+_os_channel_ring_id
+_os_channel_rx_ring
+_os_channel_set_slot_properties
+_os_channel_sync
+_os_channel_tx_ring
+_os_channel_write_attr
+_os_nexus_attr_clone
+_os_nexus_attr_create
+_os_nexus_attr_destroy
+_os_nexus_attr_get
+_os_nexus_attr_set
+_os_nexus_controller_alloc_provider_instance
+_os_nexus_controller_bind_provider_instance
+_os_nexus_controller_create
+_os_nexus_controller_deregister_provider
+_os_nexus_controller_destroy
+_os_nexus_controller_free_provider_instance
+_os_nexus_controller_get_fd
+_os_nexus_controller_read_provider_attr
+_os_nexus_controller_register_provider
+_os_nexus_controller_unbind_provider_instance
 _panic
 _panic_init
 _pathconf
@@ -669,6 +788,7 @@ _posix_spawn_file_actions_addopen
 _posix_spawn_file_actions_destroy
 _posix_spawn_file_actions_init
 _posix_spawnattr_destroy
+_posix_spawnattr_get_darwin_role_np
 _posix_spawnattr_get_qos_clamp_np
 _posix_spawnattr_getbinpref_np
 _posix_spawnattr_getcpumonitor
@@ -680,7 +800,12 @@ _posix_spawnattr_getprocesstype_np
 _posix_spawnattr_getsigdefault
 _posix_spawnattr_getsigmask
 _posix_spawnattr_init
+_posix_spawnattr_set_darwin_role_np
 _posix_spawnattr_set_importancewatch_port_np
+_posix_spawnattr_set_persona_gid_np
+_posix_spawnattr_set_persona_groups_np
+_posix_spawnattr_set_persona_np
+_posix_spawnattr_set_persona_uid_np
 _posix_spawnattr_set_qos_clamp_np
 _posix_spawnattr_setauditsessionport_np
 _posix_spawnattr_setbinpref_np
@@ -689,6 +814,7 @@ _posix_spawnattr_setcpumonitor
 _posix_spawnattr_setcpumonitor_default
 _posix_spawnattr_setexceptionports_np
 _posix_spawnattr_setflags
+_posix_spawnattr_setjetsam_ext
 _posix_spawnattr_setmacpolicyinfo_np
 _posix_spawnattr_setpcontrol_np
 _posix_spawnattr_setpgroup
@@ -698,6 +824,7 @@ _posix_spawnattr_setsigmask
 _posix_spawnattr_setspecialport_np
 _pread
 _pread$NOCANCEL
+_proc_clear_cpulimits
 _proc_clear_delayidlesleep
 _proc_clear_dirty
 _proc_clear_vmpressure
@@ -715,8 +842,10 @@ _proc_importance_assertion_begin_with_msg
 _proc_importance_assertion_complete
 _proc_kmsgbuf
 _proc_libversion
+_proc_list_uptrs
 _proc_listallpids
 _proc_listchildpids
+_proc_listcoalitions
 _proc_listpgrppids
 _proc_listpids
 _proc_listpidspath
@@ -728,6 +857,7 @@ _proc_pidinfo
 _proc_pidoriginatorinfo
 _proc_pidpath
 _proc_regionfilename
+_proc_resume_cpumon
 _proc_rlimit_control
 _proc_set_cpumon_defaults
 _proc_set_cpumon_params
@@ -737,6 +867,7 @@ _proc_set_dirty
 _proc_set_owner_vmpressure
 _proc_set_wakemon_defaults
 _proc_set_wakemon_params
+_proc_setcpu_percentage
 _proc_setpcontrol
 _proc_setthread_cpupercent
 _proc_suppress
@@ -790,6 +921,8 @@ _removexattr
 _rename
 _rename_ext
 _renameat
+_renameatx_np
+_renamex_np
 _revoke
 _rmdir
 _searchfs
@@ -876,6 +1009,16 @@ _sigsuspend$NOCANCEL
 _socket
 _socket_delegate
 _socketpair
+_stackshot_capture_with_config
+_stackshot_config_create
+_stackshot_config_dealloc
+_stackshot_config_dealloc_buffer
+_stackshot_config_get_stackshot_buffer
+_stackshot_config_get_stackshot_size
+_stackshot_config_set_delta_timestamp
+_stackshot_config_set_flags
+_stackshot_config_set_pid
+_stackshot_config_set_size_hint
 _stat
 _stat$INODE64
 _stat64
@@ -897,18 +1040,26 @@ _task_assign
 _task_assign_default
 _task_create
 _task_for_pid
+_task_generate_corpse
 _task_get_assignment
+_task_get_dyld_image_infos
 _task_get_emulation_vector
 _task_get_exception_ports
 _task_get_mach_voucher
 _task_get_special_port
 _task_get_state
 _task_info
+_task_map_corpse_info
+_task_map_corpse_info_64
 _task_name_for_pid
 _task_policy
 _task_policy_get
 _task_policy_set
 _task_purgable_info
+_task_register_dyld_get_process_state
+_task_register_dyld_image_infos
+_task_register_dyld_set_dyld_state
+_task_register_dyld_shared_cache_image_info
 _task_resume
 _task_resume2
 _task_sample
@@ -931,7 +1082,10 @@ _task_swap_exception_ports
 _task_swap_mach_voucher
 _task_terminate
 _task_threads
+_task_unregister_dyld_image_infos
 _task_zone_info
+_terminate_with_payload
+_terminate_with_reason
 _thread_abort
 _thread_abort_safely
 _thread_assign
@@ -942,6 +1096,7 @@ _thread_depress_abort
 _thread_get_assignment
 _thread_get_exception_ports
 _thread_get_mach_voucher
+_thread_get_register_pointer_values
 _thread_get_special_port
 _thread_get_state
 _thread_info
@@ -968,6 +1123,7 @@ _undelete
 _unlink
 _unlinkat
 _unmount
+_usrctl
 _utimes
 _vfork
 _vfs_purge
@@ -1008,6 +1164,10 @@ _waitevent
 _waitid
 _waitid$NOCANCEL
 _watchevent
+_work_interval_create
+_work_interval_destroy
+_work_interval_notify
+_work_interval_notify_simple
 _write
 _write$NOCANCEL
 _writev
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
new file mode 100644
index 000000000000..e04142b8b11e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
@@ -0,0 +1,116 @@
+{ appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
+
+  installPhase = ''
+    ###### IMPURITIES
+    mkdir -p $out/Library/Frameworks/Security.framework
+    pushd $out/Library/Frameworks/Security.framework
+    ln -s /System/Library/Frameworks/Security.framework/Security
+    ln -s /System/Library/Frameworks/Security.framework/Resources
+    ln -s /System/Library/Frameworks/Security.framework/PlugIns
+    ln -s /System/Library/Frameworks/Security.framework/XPCServices
+    popd
+
+    ###### HEADERS
+
+    export dest=$out/Library/Frameworks/Security.framework/Headers
+    mkdir -p $dest
+
+    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
+    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
+    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
+    cp libsecurity_asn1/lib/oidsalg.h          $dest
+    cp libsecurity_asn1/lib/oidsattr.h         $dest
+
+    cp libsecurity_authorization/lib/AuthSession.h         $dest
+    cp libsecurity_authorization/lib/Authorization.h       $dest
+    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
+    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
+    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
+
+    cp libsecurity_cms/lib/CMSDecoder.h $dest
+    cp libsecurity_cms/lib/CMSEncoder.h $dest
+
+    cp libsecurity_codesigning/lib/CSCommon.h       $dest
+    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
+    cp libsecurity_codesigning/lib/SecCode.h        $dest
+    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
+    cp libsecurity_codesigning/lib/SecRequirement.h $dest
+    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
+    cp libsecurity_codesigning/lib/SecTask.h        $dest
+
+    cp libsecurity_cssm/lib/certextensions.h $dest
+    cp libsecurity_cssm/lib/cssm.h           $dest
+    cp libsecurity_cssm/lib/cssmaci.h        $dest
+    cp libsecurity_cssm/lib/cssmapi.h        $dest
+    cp libsecurity_cssm/lib/cssmapple.h      $dest
+    cp libsecurity_cssm/lib/cssmcli.h        $dest
+    cp libsecurity_cssm/lib/cssmconfig.h     $dest
+    cp libsecurity_cssm/lib/cssmcspi.h       $dest
+    cp libsecurity_cssm/lib/cssmdli.h        $dest
+    cp libsecurity_cssm/lib/cssmerr.h        $dest
+    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
+    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
+    cp libsecurity_cssm/lib/cssmspi.h        $dest
+    cp libsecurity_cssm/lib/cssmtpi.h        $dest
+    cp libsecurity_cssm/lib/cssmtype.h       $dest
+    cp libsecurity_cssm/lib/eisl.h           $dest
+    cp libsecurity_cssm/lib/emmspi.h         $dest
+    cp libsecurity_cssm/lib/emmtype.h        $dest
+    cp libsecurity_cssm/lib/oidsbase.h       $dest
+    cp libsecurity_cssm/lib/oidscert.h       $dest
+    cp libsecurity_cssm/lib/oidscrl.h        $dest
+    cp libsecurity_cssm/lib/x509defs.h       $dest
+
+    cp libsecurity_keychain/lib/SecACL.h                $dest
+    cp libsecurity_keychain/lib/SecAccess.h             $dest
+    cp libsecurity_keychain/lib/SecBase.h               $dest
+    cp libsecurity_keychain/lib/SecCertificate.h        $dest
+    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
+    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
+    cp libsecurity_keychain/lib/SecIdentity.h           $dest
+    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
+    cp libsecurity_keychain/lib/SecImportExport.h       $dest
+    cp libsecurity_keychain/lib/SecItem.h               $dest
+    cp libsecurity_keychain/lib/SecKey.h                $dest
+    cp libsecurity_keychain/lib/SecKeychain.h           $dest
+    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
+    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
+    cp libsecurity_keychain/lib/SecPolicy.h             $dest
+    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
+    cp libsecurity_keychain/lib/SecRandom.h             $dest
+    cp libsecurity_keychain/lib/SecTrust.h              $dest
+    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
+    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
+    cp libsecurity_keychain/lib/Security.h              $dest
+
+    cp libsecurity_manifest/lib/SecureDownload.h $dest
+
+    cp libsecurity_mds/lib/mds.h        $dest
+    cp libsecurity_mds/lib/mds_schema.h $dest
+
+    cp libsecurity_ssl/lib/CipherSuite.h     $dest
+    cp libsecurity_ssl/lib/SecureTransport.h $dest
+
+    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
+    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
+    cp libsecurity_transform/lib/SecReadTransform.h          $dest
+    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
+    cp libsecurity_transform/lib/SecTransform.h              $dest
+    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
+
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
index e04142b8b11e..be744fa88736 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -1,116 +1,19 @@
-{ appleDerivation }:
+{ stdenv, appleDerivation, xcbuildHook, Foundation, xpc, darling, dtrace, xnu }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
+  nativeBuildInputs = [ xcbuildHook dtrace ];
+  # buildInputs = [ Foundation xpc darling ];
+  buildInputs = [ xpc xnu ];
 
-  __propagatedImpureHostDeps = [
-    "/System/Library/Frameworks/Security.framework/Security"
-    "/System/Library/Frameworks/Security.framework/Resources"
-    "/System/Library/Frameworks/Security.framework/PlugIns"
-    "/System/Library/Frameworks/Security.framework/XPCServices"
-    "/System/Library/Frameworks/Security.framework/Versions"
-  ];
+  xcbuildFlags = "-target Security_frameworks_osx";
 
-  installPhase = ''
-    ###### IMPURITIES
-    mkdir -p $out/Library/Frameworks/Security.framework
-    pushd $out/Library/Frameworks/Security.framework
-    ln -s /System/Library/Frameworks/Security.framework/Security
-    ln -s /System/Library/Frameworks/Security.framework/Resources
-    ln -s /System/Library/Frameworks/Security.framework/PlugIns
-    ln -s /System/Library/Frameworks/Security.framework/XPCServices
-    popd
+  # NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
 
-    ###### HEADERS
-
-    export dest=$out/Library/Frameworks/Security.framework/Headers
-    mkdir -p $dest
-
-    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
-    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
-    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
-    cp libsecurity_asn1/lib/oidsalg.h          $dest
-    cp libsecurity_asn1/lib/oidsattr.h         $dest
-
-    cp libsecurity_authorization/lib/AuthSession.h         $dest
-    cp libsecurity_authorization/lib/Authorization.h       $dest
-    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
-    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
-    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
-
-    cp libsecurity_cms/lib/CMSDecoder.h $dest
-    cp libsecurity_cms/lib/CMSEncoder.h $dest
-
-    cp libsecurity_codesigning/lib/CSCommon.h       $dest
-    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
-    cp libsecurity_codesigning/lib/SecCode.h        $dest
-    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
-    cp libsecurity_codesigning/lib/SecRequirement.h $dest
-    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
-    cp libsecurity_codesigning/lib/SecTask.h        $dest
-
-    cp libsecurity_cssm/lib/certextensions.h $dest
-    cp libsecurity_cssm/lib/cssm.h           $dest
-    cp libsecurity_cssm/lib/cssmaci.h        $dest
-    cp libsecurity_cssm/lib/cssmapi.h        $dest
-    cp libsecurity_cssm/lib/cssmapple.h      $dest
-    cp libsecurity_cssm/lib/cssmcli.h        $dest
-    cp libsecurity_cssm/lib/cssmconfig.h     $dest
-    cp libsecurity_cssm/lib/cssmcspi.h       $dest
-    cp libsecurity_cssm/lib/cssmdli.h        $dest
-    cp libsecurity_cssm/lib/cssmerr.h        $dest
-    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
-    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
-    cp libsecurity_cssm/lib/cssmspi.h        $dest
-    cp libsecurity_cssm/lib/cssmtpi.h        $dest
-    cp libsecurity_cssm/lib/cssmtype.h       $dest
-    cp libsecurity_cssm/lib/eisl.h           $dest
-    cp libsecurity_cssm/lib/emmspi.h         $dest
-    cp libsecurity_cssm/lib/emmtype.h        $dest
-    cp libsecurity_cssm/lib/oidsbase.h       $dest
-    cp libsecurity_cssm/lib/oidscert.h       $dest
-    cp libsecurity_cssm/lib/oidscrl.h        $dest
-    cp libsecurity_cssm/lib/x509defs.h       $dest
-
-    cp libsecurity_keychain/lib/SecACL.h                $dest
-    cp libsecurity_keychain/lib/SecAccess.h             $dest
-    cp libsecurity_keychain/lib/SecBase.h               $dest
-    cp libsecurity_keychain/lib/SecCertificate.h        $dest
-    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
-    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
-    cp libsecurity_keychain/lib/SecIdentity.h           $dest
-    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
-    cp libsecurity_keychain/lib/SecImportExport.h       $dest
-    cp libsecurity_keychain/lib/SecItem.h               $dest
-    cp libsecurity_keychain/lib/SecKey.h                $dest
-    cp libsecurity_keychain/lib/SecKeychain.h           $dest
-    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
-    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
-    cp libsecurity_keychain/lib/SecPolicy.h             $dest
-    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
-    cp libsecurity_keychain/lib/SecRandom.h             $dest
-    cp libsecurity_keychain/lib/SecTrust.h              $dest
-    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
-    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
-    cp libsecurity_keychain/lib/Security.h              $dest
-
-    cp libsecurity_manifest/lib/SecureDownload.h $dest
-
-    cp libsecurity_mds/lib/mds.h        $dest
-    cp libsecurity_mds/lib/mds_schema.h $dest
-
-    cp libsecurity_ssl/lib/CipherSuite.h     $dest
-    cp libsecurity_ssl/lib/SecureTransport.h $dest
-
-    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
-    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
-    cp libsecurity_transform/lib/SecReadTransform.h          $dest
-    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
-    cp libsecurity_transform/lib/SecTransform.h              $dest
-    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
+  preBuild = ''
+    dtrace -h -C -s OSX/libsecurity_utilities/lib/security_utilities.d -o OSX/libsecurity_utilities/lib/utilities_dtrace.h
 
+    xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target copyHeadersToSystem
+    NIX_CFLAGS_COMPILE+=" -F./Products/Release"
+    ln -s $PWD/Products/Release/Security.bundle/Contents $PWD/Products/Release/Security.framework
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
deleted file mode 100644
index 6e9003350780..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ stdenv, appleDerivation, xcbuildHook, gnumake, Security
-, libsecurity_utilities, libsecurity_cdsa_utilities }:
-
-appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities ];
-
-  DSTROOT = "$out";
-
-  NIX_CFLAGS_COMPILE = "-I.";
-  preBuild = ''
-    mkdir -p Security
-    cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
-  '';
-
-  patchPhase = ''
-    substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
-      --replace "/usr/bin/gnumake" "${gnumake}/bin/make"
-    substituteInPlace src/PCSC/PCSC.exp \
-      --replace _PCSCVersionString "" \
-      --replace _PCSCVersionNumber ""
-    substituteInPlace Makefile.installPhase \
-      --replace chown "# chown" \
-      --replace /usr/bin/ ""
-  '';
-
-  installPhase = ''
-    make -f Makefile.installPhase install
-    make -f Makefile-exec.installPhase install
-    mv $out/usr/* $out
-    rmdir $out/usr
-
-    mkdir -p $out/Library/Frameworks
-    cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
-  '';
-
-  meta = with stdenv.lib; {
-    maintainers = with maintainers; [ matthewbauer ];
-    platforms   = platforms.darwin;
-    license     = licenses.apsl20;
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
new file mode 100644
index 000000000000..318e2728fc2e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
@@ -0,0 +1,91 @@
+{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
+}:
+
+# this derivation sucks
+# locale data was removed after adv_cmds-118, so our base is that because it's easier than
+# replicating the bizarre bsdmake file structure
+#
+# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
+# longer understand
+#
+# the more recent adv_cmds release is used for everything else in this package
+
+let recentAdvCmds = fetchzip {
+  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
+  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
+};
+
+in appleDerivation {
+  nativeBuildInputs = [ bsdmake perl yacc flex ];
+  buildInputs = [ flex ];
+
+  patchPhase = ''
+    substituteInPlace BSDmakefile \
+      --replace chgrp true \
+      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
+      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
+      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
+      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
+
+    substituteInPlace Makefile --replace perl true
+
+    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
+      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
+        --replace /usr/share/locale "" \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
+        --replace "rsync -a" "cp -r"
+    done
+  '';
+
+  preBuild = ''
+    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+    pushd colldef
+    mv locale/collate.h .
+    flex -t -8 -i scan.l > scan.c
+    yacc -d parse.y
+    clang *.c -o colldef -lfl
+    popd
+    mv colldef/colldef colldef.tproj/colldef
+
+    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
+    pushd mklocale
+    flex -t -8 -i lex.l > lex.c
+    yacc -d yacc.y
+    clang *.c -o mklocale -lfl
+    popd
+    mv mklocale/mklocale mklocale.tproj/mklocale
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    bsdmake -C usr-share-locale.tproj
+
+    clang ${recentAdvCmds}/ps/*.c -o ps
+  '';
+
+  installPhase = ''
+    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
+
+    # need to get rid of runtime dependency on flex
+    # install -d 0755 $locale/bin
+    # install -m 0755 colldef.tproj/colldef $locale/bin
+    # install -m 0755 mklocale.tproj/mklocale $locale/bin
+
+    install -d 0755 $ps/bin
+    install ps $ps/bin/ps
+    touch "$out"
+  '';
+
+  outputs = [
+    "out"
+    "ps"
+    "locale"
+  ];
+  setOutputFlags = false;
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 318e2728fc2e..19755c270bea 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,91 +1,58 @@
-{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
-}:
+{ stdenv, appleDerivation, xcbuild, ncurses, libutil }:
 
-# this derivation sucks
-# locale data was removed after adv_cmds-118, so our base is that because it's easier than
-# replicating the bizarre bsdmake file structure
-#
-# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
-# longer understand
-#
-# the more recent adv_cmds release is used for everything else in this package
+appleDerivation {
+  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
 
-let recentAdvCmds = fetchzip {
-  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
-  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
-};
-
-in appleDerivation {
-  nativeBuildInputs = [ bsdmake perl yacc flex ];
-  buildInputs = [ flex ];
+  # pkill requires special private headers that are unavailable in
+  # NixPkgs. These ones are needed:
+  #  - xpc/xpxc.h
+  #  - os/base_private.h
+  #  - _simple.h
+  # We disable it here for now. TODO: build pkill inside adv_cmds
 
+  # We also disable locale here because of some issues with a missing
+  # "lstdc++".
   patchPhase = ''
-    substituteInPlace BSDmakefile \
-      --replace chgrp true \
-      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
-      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
-      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
-      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
-
-    substituteInPlace Makefile --replace perl true
-
-    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
-      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
-        --replace /usr/share/locale "" \
-        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
-        --replace "rsync -a" "cp -r"
-    done
-  '';
-
-  preBuild = ''
-    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
-    pushd colldef
-    mv locale/collate.h .
-    flex -t -8 -i scan.l > scan.c
-    yacc -d parse.y
-    clang *.c -o colldef -lfl
-    popd
-    mv colldef/colldef colldef.tproj/colldef
-
-    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
-    pushd mklocale
-    flex -t -8 -i lex.l > lex.c
-    yacc -d yacc.y
-    clang *.c -o mklocale -lfl
-    popd
-    mv mklocale/mklocale mklocale.tproj/mklocale
+    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
+      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
+      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
+      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
   '';
 
   buildPhase = ''
-    runHook preBuild
+    targets=$(xcodebuild -list \
+                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
+                | tail -n +2 | sed 's/^[ \t]*//' \
+                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
 
-    bsdmake -C usr-share-locale.tproj
-
-    clang ${recentAdvCmds}/ps/*.c -o ps
+    for i in $targets; do
+      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
+    done
   '';
 
+  # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
+    mkdir -p $out/bin/
+    install Products/Release/* $out/bin/
 
-    # need to get rid of runtime dependency on flex
-    # install -d 0755 $locale/bin
-    # install -m 0755 colldef.tproj/colldef $locale/bin
-    # install -m 0755 mklocale.tproj/mklocale $locale/bin
+    for n in 1 8; do
+      mkdir -p $out/share/man/man$n
+      install */*.$n $out/share/man/man$n
+    done
 
-    install -d 0755 $ps/bin
-    install ps $ps/bin/ps
-    touch "$out"
+    mkdir -p $out/System/Library/LaunchDaemons
+    install fingerd/finger.plist $out/System/Library/LaunchDaemons
+
+    # from variant_links.sh
+    # ln -s $out/bin/pkill $out/bin/pgrep
+    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
   '';
 
-  outputs = [
-    "out"
-    "ps"
-    "locale"
-  ];
-  setOutputFlags = false;
+  nativeBuildInputs = [ xcbuild ];
+  buildInputs = [ ncurses libutil ];
 
   meta = {
     platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
deleted file mode 100644
index 7b1492799ddb..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ stdenv, appleDerivation, xcbuild, ncurses, libutil-new }:
-
-appleDerivation {
-  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
-
-  # pkill requires special private headers that are unavailable in
-  # NixPkgs. These ones are needed:
-  #  - xpc/xpxc.h
-  #  - os/base_private.h
-  #  - _simple.h
-  # We disable it here for now. TODO: build pkill inside adv_cmds
-
-  # We also disable locale here because of some issues with a missing
-  # "lstdc++".
-  patchPhase = ''
-    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
-      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
-      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
-      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
-  '';
-
-  buildPhase = ''
-    targets=$(xcodebuild -list \
-                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
-                | tail -n +2 | sed 's/^[ \t]*//' \
-                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
-
-    for i in $targets; do
-      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
-    done
-  '';
-
-  # temporary install phase until xcodebuild has "install" support
-  installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
-
-    for n in 1 8; do
-      mkdir -p $out/share/man/man$n
-      install */*.$n $out/share/man/man$n
-    done
-
-    mkdir -p $out/System/Library/LaunchDaemons
-    install fingerd/finger.plist $out/System/Library/LaunchDaemons
-
-    # from variant_links.sh
-    # ln -s $out/bin/pkill $out/bin/pgrep
-    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
-  '';
-
-  nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil-new ];
-
-  meta = {
-    platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
index 591e7bd52303..256781f61b11 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
@@ -32,6 +32,7 @@ appleDerivation {
     chmod +x mig.sh
     cp mig.sh   $out/bin/mig
     cp migcom   $out/libexec
+    ln -s $out/libexec/migcom $out/bin/migcom
     cp mig.1    $out/share/man/man1
     cp migcom.1 $out/share/man/man1
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 4fa0c0e3e47f..09f275b8234a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -6,9 +6,31 @@ let
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
   # now it's staying here.
   versions = {
+    "osx-10.12.6" = {
+      xnu           = "3789.70.16";
+      libiconv      = "50";
+      Libnotify     = "165.20.1";
+      objc4         = "709.1";
+      dyld          = "433.5";
+      CommonCrypto  = "60092.50.5";
+      copyfile      = "138";
+      ppp           = "838.50.1";
+      libclosure    = "67";
+      Libinfo       = "503.50.4";
+      Libsystem     = "1238.60.2";
+      removefile    = "45";
+      libresolv     = "64";
+      libplatform   = "126.50.8";
+      mDNSResponder = "765.50.9";
+      libutil       = "47.30.1";
+      libunwind     = "35.3";
+      Libc          = "1158.50.2";
+      dtrace        = "209.50.12";
+      libpthread    = "218.60.3";
+      hfs           = "366.70.1";
+    };
     "osx-10.11.6" = {
       PowerManagement = "572.50.1";
-      SmartCardServices = "55111";
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
@@ -58,7 +80,6 @@ let
       ICU           = "531.48";
       libdispatch   = "442.1.4";
       Security      = "57031.40.6";
-      security_systemkeychain = "55202";
 
       IOAudioFamily                        = "203.3";
       IOFireWireFamily                     = "458";
@@ -94,28 +115,6 @@ let
     "osx-10.8.4" = {
       IOUSBFamily = "560.4.2";
     };
-    "osx-10.7.5" = {
-      libsecurity_apple_csp      = "55003";
-      libsecurity_apple_cspdl    = "55000";
-      libsecurity_apple_file_dl  = "55000";
-      libsecurity_apple_x509_cl  = "55004";
-      libsecurity_apple_x509_tp  = "55009.3";
-      libsecurity_asn1           = "55000.2";
-      libsecurity_cdsa_client    = "55000";
-      libsecurity_cdsa_plugin    = "55001";
-      libsecurity_cdsa_utilities = "55006";
-      libsecurity_cdsa_utils     = "55000";
-      libsecurity_codesigning    = "55037.15";
-      libsecurity_cssm           = "55005.5";
-      libsecurity_filedb         = "55016.1";
-      libsecurity_keychain       = "55050.9";
-      libsecurity_mds            = "55000";
-      libsecurity_ocspd          = "55010";
-      libsecurity_pkcs12         = "55000";
-      libsecurity_sd_cspdl       = "55003";
-      libsecurity_utilities      = "55030.3";
-      libsecurityd               = "55004";
-    };
     "osx-10.7.4" = {
       Libm = "2026";
     };
@@ -166,10 +165,6 @@ let
       callPackage = pkgs.newScope (packages // pkgs.darwin // { inherit appleDerivation name version; });
     in callPackage (./. + "/${namePath}");
 
-  libsecPackage = pkgs.callPackage ./libsecurity_generic {
-    inherit applePackage appleDerivation_;
-  };
-
   IOKitSpecs = {
     IOAudioFamily                        = fetchApple "osx-10.10.5" "0ggq7za3iq8g02j16rj67prqhrw828jsw3ah3bxq8a1cvr55aqnq";
     IOFireWireFamily                     = fetchApple "osx-10.10.5" "059qa1m668kwvchl90cqcx35b31zaqdg61zi11y1imn5s389y2g1";
@@ -194,60 +189,58 @@ let
 
   IOKitSrcs = stdenv.lib.mapAttrs (name: value: if stdenv.lib.isFunction value then value name else value) IOKitSpecs;
 
-  adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
+  # Only used for bootstrapping. It’s convenient because it was the last version to come with a real makefile.
+  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
 
   packages = {
-    SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
-
-    inherit (adv_cmds) ps locale;
+    inherit (adv_cmds-boot) ps locale;
     architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
     bootstrap_cmds  = applePackage "bootstrap_cmds"    "dev-tools-7.0"   "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
     bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "11a9kkhz5bfgi1i8kpdkis78lhc6b5vxmhd598fcdgra1jw4iac2" {};
     CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "1zam29847cxr6y9rnl76zqmkbac53nx0szmqm9w5p469a6wzjqar" {};
-    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.11.6"     "0vllfpb8f4f97wj2vpdd7w5k9ibnsbr6ff1zslpp6q323h01n25y" {};
-    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
-    copyfile        = applePackage "copyfile"          "osx-10.11.6"     "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "0sgsqjcxbdm2g2zfpc50mzmk4b4ldyw7xvvkwiayhpczg1fga4ff" {};
+    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
+      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    };
+    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "0a70bvzndkava1a946cdq42lnjhg7i7b5alpii3lap6r5fkvas0n" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
-    dtrace-xcode    = applePackage "dtrace/xcode.nix"  "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
-    dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
+    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "0hpd6348av463yqf70n3xkygwmf1i5zza8kps4zys52sviqz3a0l" {};
+    dyld            = applePackage "dyld"              "osx-10.12.6"     "0q4jmk78b5ajn33blh4agyq6v2a63lpb3fln78az0dy12bnp1qqk" {};
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
-
-    # Splicing is currently broken in Nixpkgs
-    # cctools need to be specified manually here to handle this
     ICU             = applePackage "ICU"               "osx-10.10.5"     "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
-
     IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
     launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
     libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
-    Libc            = applePackage "Libc"              "osx-10.11.5"     "1qv7r0dgz06jy9i5agbqzxgdibb0m8ylki6g5n5pary88lzrawfd" {
+    Libc            = applePackage "Libc"              "osx-10.12.6"     "183wcy1nlj2wkpfsx3k3lyv917mk8r2p72qw8lb89mbjsw3yw0xx" {
       Libc_10-9 = fetchzip {
         url    = "http://www.opensource.apple.com/tarballs/Libc/Libc-997.90.3.tar.gz";
         sha256 = "1xchgxkxg5288r2b9yfrqji2gsgdap92k4wx2dbjwslixws12pq7";
       };
+      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     };
-    Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     libclosure      = applePackage "libclosure"        "osx-10.11.6"     "1zqy1zvra46cmqv6vsf1mcsz3a76r9bky145phfwh4ab6y15vjpq" {};
     libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "0jsfbzp87lwk9snlby0hd4zvj7j894p5q3cw0wdx9ny1mcp3kdcj" {};
-    libiconv        = applePackage "libiconv"          "osx-10.11.6"     "11h6lfajydri4widis62q8scyz7z8l6msqyx40ly4ahsdlbl0981" {};
+    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "1gg5h6z8sk851bhv87vyxzs54jmqz6lh57ny8j4s51j7srja0nly" {};
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.11.6"     "0zbcyxlcfhf91jxczhd5bq9qfgvg494gwwp3l7q5ayb2qdihzr8b" {};
-    libplatform     = applePackage "libplatform"       "osx-10.11.6"     "1v4ik6vlklwsi0xb1g5kmhy29j9xk5m2y8xb9zbi1k4ng8x39czk" {};
-    libpthread      = applePackage "libpthread"        "osx-10.11.6"     "1kbw738cmr9pa7pz1igmajs307clfq7gv2vm1sqdzhcnnjxbl28w" {};
-    libresolv       = applePackage "libresolv"         "osx-10.11.6"     "09flfdi3dlzq0yap32sxidacpc4nn4va7z12a6viip21ix2xb2gf" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.11.6"     "1nfkmbqml587v2s1d1y2s2v8nmr577jvk51y6vqrfvsrhdhc2w94" {};
-    libutil         = applePackage "libutil"           "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
-    libutil-new     = applePackage "libutil/new.nix"   "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
-    libunwind       = applePackage "libunwind"         "osx-10.11.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
-    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.11.6"     "069incq28a78yh1bnr17h9cd5if5mwqpq8ahnkyxxx25fkaxgzcf" {};
-    objc4           = applePackage "objc4"             "osx-10.11.6"     "00b7vbgxni8frrqyi69b4njjihlwydzjd9zj9x4z5dbx8jabkvrj" {};
-    ppp             = applePackage "ppp"               "osx-10.11.6"     "1dql6r1v0vbcs04958nn2i6p31yfsxyy51jca63bm5mf0gxalk3f" {};
-    removefile      = applePackage "removefile"        "osx-10.11.6"     "1b6r74ry3k01kypvlaclf33fha15pcm0kzx9zrymlg66wg0s0i3r" {};
-    Security        = applePackage "Security"          "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
-    xnu             = applePackage "xnu"               "osx-10.11.6"     "0yhziq4dqqcbjpf6vyqn8xhwva2zb525gndkx8cp8alzwp76jnr9" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "0p5qhvalf6j1w6n8xwywhn6dvbpzv74q5wqrgs8rwfpf74wg6s9z" {};
+    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
+    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
+    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
+    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {
+      libutil = pkgs.darwin.libutil.override { headersOnly = true; };
+      hfs = pkgs.darwin.hfs.override { headersOnly = true; };
+    };
+    libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
+    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk10" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
+    objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
+    ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
+    removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
+    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {};
+    hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-    adv_cmds        = applePackage "adv_cmds/xcode.nix" "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
+    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
     diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
@@ -259,28 +252,8 @@ let
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
-    security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
-
-    libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
-    libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
-    libsecurity_apple_file_dl  = libsecPackage "libsecurity_apple_file_dl"  "osx-10.7.5" "1dfqani3n135i3iqmafc1k9awmz6s0a78zifhk15rx5a8ps870bl" {};
-    libsecurity_apple_x509_cl  = libsecPackage "libsecurity_apple_x509_cl"  "osx-10.7.5" "1gji2i080560s08k1nigsla1zdmi6slyv97xaj5vqxjpxb0g1xf5" {};
-    libsecurity_apple_x509_tp  = libsecPackage "libsecurity_apple_x509_tp"  "osx-10.7.5" "1bsms3nvi62wbvjviwjhjhzhylad8g6vmvlj3ngd0wyd0ywxrs46" {};
-    libsecurity_asn1           = libsecPackage "libsecurity_asn1"           "osx-10.7.5" "0i8aakjxdfj0lqcgqmbip32g7r4h57xhs8w0sxfvfl45q22s782w" {};
-    libsecurity_cdsa_client    = libsecPackage "libsecurity_cdsa_client"    "osx-10.7.5" "127jxnypkycy8zqwicfv333h11318m00gd37jnswbrpg44xd1wdy" {};
-    libsecurity_cdsa_plugin    = libsecPackage "libsecurity_cdsa_plugin"    "osx-10.7.5" "0ifmx85rs51i7zjm015s8kc2dqyrlvbr39lw9xzxgd2ds33i4lfj" {};
-    libsecurity_cdsa_utilities = libsecPackage "libsecurity_cdsa_utilities" "osx-10.7.5" "1kzsl0prvfa8a0m3j3pcxq06aix1csgayd3lzx27iqg84c8mhzan" {};
-    libsecurity_cdsa_utils     = libsecPackage "libsecurity_cdsa_utils"     "osx-10.7.5" "0q55jizav6n0lkj7lcmcr2mjdhnbnnn525fa9ipwgvzbspihw0g6" {};
-    libsecurity_codesigning    = libsecPackage "libsecurity_codesigning"    "osx-10.7.5" "0vf5nj2g383b4hknlp51qll5pm8z4qbf56dnc16n3wm8gj82iasy" {};
-    libsecurity_cssm           = libsecPackage "libsecurity_cssm"           "osx-10.7.5" "0l6ia533bhr8kqp2wa712bnzzzisif3kbn7h3bzzf4nps4wmwzn4" {};
-    libsecurity_filedb         = libsecPackage "libsecurity_filedb"         "osx-10.7.5" "1r0ik95xapdl6l2lhd079vpq41jjgshz2hqb8490gpy5wyc49cxb" {};
-    libsecurity_keychain       = libsecPackage "libsecurity_keychain"       "osx-10.7.5" "15wf2slcgyns61kk7jndgm9h22vidyphh9x15x8viyprra9bkhja" {};
-    libsecurity_mds            = libsecPackage "libsecurity_mds"            "osx-10.7.5" "0vin5hnzvkx2rdzaaj2gxmx38amxlyh6j24a8gc22y09d74p5lzs" {};
-    libsecurity_ocspd          = libsecPackage "libsecurity_ocspd"          "osx-10.7.5" "1bxzpihc6w0ji4x8810a4lfkq83787yhjl60xm24bv1prhqcm73b" {};
-    libsecurity_pkcs12         = libsecPackage "libsecurity_pkcs12"         "osx-10.7.5" "1yq8p2sp39q40fxshb256b7jn9lvmpymgpm8yz9kqrf980xddgsg" {};
-    libsecurity_sd_cspdl       = libsecPackage "libsecurity_sd_cspdl"       "osx-10.7.5" "10v76xycfnvz1n0zqfbwn3yh4w880lbssqhkn23iim3ihxgm5pbd" {};
-    libsecurity_utilities      = libsecPackage "libsecurity_utilities"      "osx-10.7.5" "0ayycfy9jm0n0c7ih9f3m69ynh8hs80v8yicq47aa1h9wclbxg8r" {};
-    libsecurityd               = libsecPackage "libsecurityd"               "osx-10.7.5" "1ywm2qj8l7rhaxy5biwxsyavd0d09d4bzchm03nlvwl313p2747x" {};
-    security_dotmac_tp         = libsecPackage "security_dotmac_tp"         "osx-10.9.5" "1l4fi9qhrghj0pkvywi8da22bh06c5bv3l40a621b5g258na50pl" {};
+    # TODO(matthewbauer):
+    # To be removed, once I figure out how to build a newer Security version.
+    Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
   };
 in packages
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index f27b5ae13022..fa77329008d6 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -1,9 +1,9 @@
 { stdenv, appleDerivation, xcbuildHook
-, Libc, xnu, libutil-new }:
+, Libc, xnu, libutil }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ libutil-new ];
+  buildInputs = [ libutil ];
 
   NIX_CFLAGS_COMPILE = "-I.";
   NIX_LDFLAGS = "-lutil";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index fd2c95563b48..8706d22be19b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -1,50 +1,53 @@
-{ appleDerivation, cctools, zlib }:
+{ appleDerivation, xcbuildHook, CoreSymbolication
+, xnu, bison, flex, darling, stdenv, fixDarwinDylibNames }:
 
 appleDerivation {
-  buildInputs = [ cctools zlib ];
+  nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
+  buildInputs = [ CoreSymbolication darling xnu ];
+  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
+  NIX_LDFLAGS = "-L./Products/Release";
+  xcbuildFlags = "-target dtrace_frameworks -target dtrace";
 
-  buildPhase = ''
-    export CFLAGS=" -I$PWD/head -I$PWD/sys -I$PWD/libelf -I$PWD/libdwarf"
+  doCheck = false;
+  checkPhase = "xcodebuild -target dtrace_tests";
 
-    pushd libelf
-    for f in *.c; do
-      if [ "$f" != "lintsup.c" ]; then # Apple doesn't use it, so I don't either
-        cc -D_INT64_TYPE -D_LONGLONG_TYPE -D_ILP32 $CFLAGS -c $f
-      fi
-    done
-    libtool -static -o libelf.a *.o
-    popd
-
-    pushd libdwarf
-    ./configure CFLAGS="$CFLAGS -Icmplrs"
-    make
-    popd
-
-    cp libelf/libelf.a     tools/ctfconvert
-    cp libdwarf/libdwarf.a tools/ctfconvert
-
-    pushd tools/ctfconvert
-    for f in ../../darwin_shim.c *.c; do
-      cc -DNDEBUG -DNS_BLOCK_ASSERTIONS $CFLAGS -c $f
-    done
-
-    export COMMON="alist.o ctf.o darwin_shim.o hash.o iidesc.o input.o list.o \
-      memory.o output.o stack.o strtab.o symbol.o tdata.o traverse.o util.o"
-
-    export CONVERT="ctfconvert.o dwarf.o merge.o st_bugs.o st_parse.o stabs.o"
-    export MERGE="barrier.o ctfmerge.o dwarf.o fifo.o merge.o st_bugs.o st_parse.o stabs.o utils.o"
-    export DUMP="dump.o fifo.o utils.o"
-
-    clang -o ctfconvert $CONVERT $COMMON -L. -lz -lelf -ldwarf
-    clang -o ctfmerge   $MERGE   $COMMON -L. -lz -lelf -ldwarf
-    clang -o ctfdump    $DUMP    $COMMON -L. -lz -lelf
-    popd
+  postPatch = ''
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace "/usr/sbin" ""
+    substituteInPlace libdtrace/dt_open.c \
+      --replace /usr/bin/clang ${stdenv.cc.cc}/bin/clang \
+      --replace /usr/bin/ld ${stdenv.cc.bintools.bintools}/bin/ld \
+      --replace /usr/lib/dtrace/dt_cpp.h $out/include/dt_cpp.h \
+      --replace /usr/lib/dtrace $out/lib/dtrace
   '';
 
+  # hack to handle xcbuild's broken lex handling
+  preBuild = ''
+    pushd libdtrace
+    yacc -d dt_grammar.y
+    flex -l -d dt_lex.l
+    popd
+
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
+      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+  '';
+
+  # xcbuild doesn't support install
   installPhase = ''
-    mkdir -p $out/bin
-    cp tools/ctfconvert/ctfconvert $out/bin
-    cp tools/ctfconvert/ctfmerge   $out/bin
-    cp tools/ctfconvert/ctfdump    $out/bin
+    mkdir -p $out
+
+    cp -r Products/Release/usr/include $out/include
+    cp scripts/dt_cpp.h $out/include/dt_cpp.h
+
+    mkdir $out/lib
+    cp Products/Release/*.dylib $out/lib
+
+    mkdir $out/bin
+    cp Products/Release/dtrace $out/bin
+
+    mkdir -p $out/lib/dtrace
+
+    install_name_tool -change $PWD/Products/Release/libdtrace.dylib $out/lib/libdtrace.dylib $out/bin/dtrace
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
deleted file mode 100644
index f8636403ed54..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ appleDerivation, xcbuildHook, CoreSymbolication
-, xnu, bison, flex, darling, stdenv }:
-
-appleDerivation {
-  nativeBuildInputs = [ xcbuildHook flex bison ];
-  buildInputs = [ CoreSymbolication darling ];
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
-  NIX_LDFLAGS = "-L./Products/Release";
-  xcbuildFlags = "-target dtrace";
-
-  patchPhase = ''
-    substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
-    substituteInPlace libdtrace/dt_open.c \
-      --replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
-      --replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
-      --replace "/usr/bin/dtrace" $out/lib/dtrace
-  '';
-
-  # hack to handle xcbuild's broken lex handling
-  preBuild = ''
-    cd libdtrace
-    yacc -d dt_grammar.y
-    flex -l -d dt_lex.l
-    cd ..
-
-    substituteInPlace dtrace.xcodeproj/project.pbxproj \
-      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
-      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
-  '';
-
-  # xcbuild doesn't support install
-  installPhase = ''
-    mkdir -p $out
-
-    cp -r Products/Release/usr $out
-    mv $out/usr/* $out
-    rmdir $out/usr
-
-    mkdir $out/lib
-    cp Products/Release/*.dylib $out/lib
-
-    mkdir $out/bin
-    cp Products/Release/dtrace $out/bin
-
-    mkdir -p $out/lib/dtrace
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index a19e0736336d..a723f8b71ac9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil-new }:
+{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil }:
 
 appleDerivation rec {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ zlib bzip2 lzma ncurses libutil-new ];
+  buildInputs = [ zlib bzip2 lzma ncurses libutil ];
 
   # some commands not working:
   # mtree: _simple.h not found
diff --git a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
new file mode 100644
index 000000000000..134994002ee7
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, lib, headersOnly ? false }:
+
+appleDerivation {
+  installPhase = lib.optionalString headersOnly ''
+    mkdir -p $out/include
+    cp core/*.h $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
deleted file mode 100644
index ca263228fde8..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_apple_csp
-
-security_apple_csp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_apple_csp_HEADER_FILES_DIR = lib
-
-security_apple_csp_CC_FILES = $(wildcard lib/*.cpp)
-security_apple_csp_C_FILES = $(wildcard lib/*.c)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
deleted file mode 100644
index 639d377d1b64..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_utilities, CommonCrypto, stdenv }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    libsecurity_cdsa_plugin
-    libsecurity_asn1
-    libsecurity_cdsa_utils
-  ];
-  NIX_CFLAGS_COMPILE = "-Iopen_ssl";
-  patchPhase = ''
-    for file in lib/BlockCryptor.h lib/RSA_DSA_signature.h lib/castContext.h \
-      lib/RawSigner.h lib/MD2Object.h lib/HMACSHA1.h lib/bfContext.h lib/rc4Context.h; do
-      substituteInPlace ''$file --replace \
-        '"CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h"' \
-        '"${stdenv.lib.getDev apple_sdk.sdk}/include/MacTypes.h"'
-    done
-
-    for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
-      substituteInPlace ''$file --replace \
-        '/usr/local/include/CommonCrypto/CommonCryptorSPI.h' \
-        '${CommonCrypto}/include/CommonCrypto/CommonCryptorSPI.h'
-    done
-    
-    substituteInPlace lib/opensshWrap.cpp --replace RSA_DSA_Keys.h RSA_DSA_keys.h
-  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
-    substituteInPlace lib/pbkdf2.c --replace \
-      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/ConditionalMacros.h>' \
-      '"${stdenv.libc}/include/ConditionalMacros.h"'
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
deleted file mode 100644
index a0d48cf49650..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_apple_cspdl
-
-security_apple_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_apple_cspdl_HEADER_FILES_DIR = lib
-
-security_apple_cspdl_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
deleted file mode 100644
index b80d4c8aad28..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    libsecurityd
-    libsecurity_cdsa_client
-    libsecurity_keychain
-  ];
-  patchPhase = ''
-    for file in lib/*; do
-      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
-    done
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
deleted file mode 100644
index f52829c644da..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_apple_file_dl
-
-security_apple_file_dl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_apple_file_dl_HEADER_FILES_DIR = lib
-
-security_apple_file_dl_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
deleted file mode 100644
index 0eb2ee10fd84..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    libsecurityd
-    libsecurity_cdsa_client
-    libsecurity_keychain
-    libsecurity_filedb
-  ];
-  patchPhase = ''
-    for file in lib/*; do
-      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
-    done
-  '';
-}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
deleted file mode 100644
index c7c9c3d4e795..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_apple_x509_cl
-
-security_apple_x509_cl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_apple_x509_cl_HEADER_FILES_DIR = lib
-
-security_apple_x509_cl_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
deleted file mode 100644
index c5e9418ce913..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    libsecurityd
-    libsecurity_cdsa_client
-    libsecurity_keychain
-    libsecurity_filedb
-    libsecurity_asn1
-  ];
-  patchPhase = ''
-    for file in lib/*; do
-      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
-    done
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
deleted file mode 100644
index 166b4e631c84..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_apple_x509_tp
-
-security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_apple_x509_tp_HEADER_FILES_DIR = lib
-
-security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
-security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
deleted file mode 100644
index 6410c134f89a..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_ocspd, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    libsecurityd
-    libsecurity_cdsa_client
-    libsecurity_keychain
-    libsecurity_filedb
-    libsecurity_asn1
-    libsecurity_ocspd
-  ];
-  patchPhase = ''
-    for file in lib/*; do
-      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
-    done
-  '';
-}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
deleted file mode 100644
index 1c3c4f0b25bf..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_asn1
-
-security_asn1_C_FILES = $(wildcard lib/*.c)
-security_asn1_CC_FILES = $(wildcard lib/*.cpp)
-
-security_asn1_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_asn1_HEADER_FILES_DIR = lib
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
deleted file mode 100644
index a1c3204c15a4..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
-appleDerivation {
-  __propagatedImpureHostDeps = [
-    "/System/Library/Frameworks/Security.framework/Security"
-    "/System/Library/Frameworks/Security.framework/Resources"
-    "/System/Library/Frameworks/Security.framework/PlugIns"
-    "/System/Library/Frameworks/Security.framework/XPCServices"
-    "/System/Library/Frameworks/Security.framework/Versions"
-  ];
-  propagatedBuildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
deleted file mode 100644
index 91fb6bb679e5..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_cdsa_client
-
-security_cdsa_client_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_cdsa_client_HEADER_FILES_DIR = lib
-
-security_cdsa_client_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
deleted file mode 100644
index 2ecad568bf7e..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    libsecurityd
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
deleted file mode 100644
index 9e1260f9b9c4..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_cdsa_plugin
-
-security_cdsa_plugin_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_cdsa_plugin_HEADER_FILES_DIR = lib
-
-security_cdsa_plugin_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
deleted file mode 100644
index b2dbb75f2971..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_cssm, libsecurity_utilities, perl }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    perl
-  ];
-  patchPhase = ''
-    unpackFile ${libsecurity_cssm.src}
-    cp libsecurity_cssm*/lib/cssm{dli,aci,cli,cspi,tpi}.h lib
-  '';
-  preBuild = ''
-    perl lib/generator.pl lib lib/generator.cfg lib lib || exit 1
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
deleted file mode 100644
index 24bc1fe7e3af..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
+++ /dev/null
@@ -1,13 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_cdsa_utilities
-
-security_cdsa_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_cdsa_utilities_HEADER_FILES_DIR = lib
-
-security_cdsa_utilities_CC_FILES = $(wildcard lib/*.cpp) lib/Schema.cpp lib/KeySchema.cpp
-
-lib/%.cpp: lib/%.m4
-	m4 $< > $@
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
deleted file mode 100644
index 26515353b730..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ CommonCrypto, appleDerivation, libsecurity_codesigning, libsecurity_utilities, m4 }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    m4
-  ];
-  patchPhase = ''
-    patch -p1 < ${./handletemplates.patch}
-    unpackFile ${libsecurity_codesigning.src}
-    mv libsecurity_codesigning*/lib security_codesigning
-  '';
-  NIX_CFLAGS_COMPILE = "-I${CommonCrypto}/include/CommonCrypto";
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
deleted file mode 100644
index e5a703b2a08f..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
-+++ b/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
-@@ -32,6 +32,7 @@
- #include <security_utilities/threading.h>
- #include <security_utilities/globalizer.h>
- #include <security_cdsa_utilities/cssmerrors.h>
-+#include <vector>
- 
- #if __GNUC__ > 2
- #include <ext/hash_map>
-@@ -129,7 +130,7 @@
-     // @@@  Remove when 4003540 is fixed
-     template <class Subtype>
-     static void findAllRefs(std::vector<_Handle> &refs) {
--        state().findAllRefs<Subtype>(refs);
-+        state().template findAllRefs<Subtype>(refs);
-     }
-     
- protected:
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
deleted file mode 100644
index 7b5b7dc186a1..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
+++ /dev/null
@@ -1,13 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_cdsa_utils
-
-security_cdsa_utils_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_cdsa_utils_HEADER_FILES_DIR = lib
-
-security_cdsa_utils_CC_FILES = $(wildcard lib/*.cpp)
-
-lib/%.cpp: lib/%.m4
-	m4 $< > $@
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
deleted file mode 100644
index e5637d6db410..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, m4 }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    m4
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
deleted file mode 100644
index e923b962c263..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_codesigning
-
-security_codesigning_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_codesigning_HEADER_FILES_DIR = lib
-
-security_codesigning_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
deleted file mode 100644
index f5035a06f1e8..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
-, Security, xnu, xar, antlr, libsecurityd, apple_sdk
-, dtrace-xcode, osx_private_sdk }:
-appleDerivation {
-  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
-                  Security xar antlr libsecurityd ];
-  NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
-  patchPhase = ''
-    substituteInPlace lib/policydb.cpp \
-      --replace "new MutableDictionary::MutableDictionary()" NULL
-    substituteInPlace lib/xpcengine.h \
-      --replace "#include <xpc/private.h>" ""
-    substituteInPlace lib/policyengine.cpp \
-      --replace "#include <OpenScriptingUtilPriv.h>" ""
-
-    rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
-  '';
-  preBuild = ''
-    mkdir -p include
-    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
-    mkdir -p include/CoreServices/
-    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
-
-    unpackFile ${Security.src}
-    mkdir -p include/securityd_client
-    cp Security-*/libsecurityd/lib/*.h include/securityd_client
-    mkdir -p include/xpc
-    cp ${apple_sdk.sdk.out}/include/xpc/*.h include/xpc
-
-    sed -i '1i #define bool int' lib/security_codesigning.d
-    dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
deleted file mode 100644
index c7835aaa9b02..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_cssm
-
-security_cssm_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_cssm_HEADER_FILES_DIR = lib
-
-security_cssm_CC_FILES = $(wildcard lib/*.cpp)
-security_cssm_C_FILES = $(wildcard lib/*.c)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
deleted file mode 100644
index cf9fe411533f..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, perl }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    libsecurity_cdsa_client
-    perl
-    libsecurity_cdsa_plugin
-  ];
-  preBuild = ''
-    mkdir derived_src
-    perl lib/generator.pl lib lib/generator.cfg derived_src
-  '';
-}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
deleted file mode 100644
index 4359810c56b3..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_filedb
-
-security_filedb_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_filedb_HEADER_FILES_DIR = lib
-
-security_filedb_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
deleted file mode 100644
index 435cd0f069f2..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk, lib }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    libsecurity_cdsa_plugin
-  ];
-  patchPhase = ''
-    cp ${osx_private_sdk}/include/sandbox_private.h .
-    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${lib.getDev apple_sdk.sdk}/include/sandbox.h"'
-    substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
deleted file mode 100644
index 714524e8da58..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ appleDerivation_, applePackage, pkgs, stdenv }:
-name: version: sha256: args: let
-  n = stdenv.lib.removePrefix "lib" name;
-  makeFile = ../. + "/${name}/GNUmakefile";
-  appleDerivation = appleDerivation_ name version sha256;
-  in applePackage name version sha256 (args // {
-    appleDerivation = a:
-    appleDerivation (stdenv.lib.mergeAttrsConcatenateValues {
-      __impureHostDeps = import ./impure_deps.nix;
-
-      patchPhase = ''
-        # allows including <Security/some-private-header.h>
-        cp -R ${pkgs.darwin.osx_private_sdk}/include/SecurityPrivateHeaders Security
-
-        grep -Rl MacErrors.h . | while read file; do
-          substituteInPlace "''$file" --replace \
-            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-            '"${pkgs.darwin.apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
-        done || true # grep returns 1 if it can't find the string
-
-        grep -Rl MacTypes.h . | while read file; do
-          substituteInPlace "''$file" --replace \
-            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
-            '"${stdenv.lib.getDev pkgs.darwin.apple_sdk.sdk}/include/MacTypes.h"'
-        done || true # grep returns 1 if it can't find the string
-      '';
-      preBuild = ''
-        ln -s lib ${n}
-        makeFlagsArray=(-j$NIX_BUILD_CORES)
-      '';
-      outputs = [ "out" "dev" ];
-      buildInputs = [
-        pkgs.gnustep.make
-        pkgs.darwin.apple_sdk.frameworks.AppKit
-        pkgs.darwin.apple_sdk.frameworks.Foundation
-      ];
-      makeFlags = [
-        "-f${makeFile}"
-        "MAKEFILE_NAME=${makeFile}"
-        "GNUSTEP_ABSOLUTE_INSTALL_PATHS=yes"
-        "GNUSTEP_MAKEFILES=${pkgs.gnustep.make}/share/GNUstep/Makefiles"
-        "LIB_LINK_INSTALL_DIR=\$(out)/lib"
-      ];
-      installFlags = [
-        "${n}_INSTALL_DIR=\$(out)/lib"
-        "${n}_HEADER_FILES_INSTALL_DIR=\$(out)/include/${n}"
-        "GNUSTEP_HEADERS="
-      ];
-      NIX_CFLAGS_COMPILE = [
-        "-isystem lib"
-        "-iframework ${pkgs.darwin.Security}/Library/Frameworks"
-        "-I."
-        "-Wno-deprecated-declarations"
-        "-DNDEBUG"
-      ];
-      NIX_LDFLAGS = with pkgs.darwin; with apple_sdk.frameworks; [
-        "-L${libobjc}/lib"
-        "-F${Foundation}/Library/Frameworks"
-        "-F${AppKit}/Library/Frameworks"
-        "-no_dtrace_dof"
-      ];
-    } a);
-  })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
deleted file mode 100644
index 7725b9f3d1a2..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-# generated using a ruby script
-[
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib"
-  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib"
-  "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD"
-  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis"
-  "/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox"
-  "/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit"
-  "/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork"
-  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound"
-  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox"
-  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink"
-  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition"
-  "/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio"
-  "/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth"
-  "/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData"
-  "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
-  "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices"
-  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit"
-  "/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText"
-  "/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo"
-  "/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN"
-  "/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration"
-  "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"
-  "/System/Library/Frameworks/GSS.framework/Versions/A/GSS"
-  "/System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth"
-  "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit"
-  "/System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib"
-  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib"
-  "/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos"
-  "/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS"
-  "/System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL"
-  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory"
-  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib"
-  "/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL"
-  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage.framework/Versions/A/CoreImage"
-  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore"
-  "/System/Library/Frameworks/Security.framework/Versions/A/Security"
-  "/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation"
-  "/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement"
-  "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration"
-  "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
-  "/System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG"
-  "/System/Library/PrivateFrameworks/AppleVPA.framework/Versions/A/AppleVPA"
-  "/System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup"
-  "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
-  "/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth"
-  "/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication"
-  "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
-  "/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi"
-  "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
-  "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
-  "/System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols"
-  "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
-  "/System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore"
-  "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
-  "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal"
-  "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
-  "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
-  "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
-  "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
-  "/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis"
-  "/System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices"
-  "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
-  "/System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore"
-  "/System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication"
-  "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
-  "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
-  "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
-  "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
-  "/usr/lib/libCRFSuite.dylib"
-  "/usr/lib/libOpenScriptingUtil.dylib"
-  "/usr/lib/libarchive.2.dylib"
-  "/usr/lib/libbsm.0.dylib"
-  "/usr/lib/libbz2.1.0.dylib"
-  "/usr/lib/libc++.1.dylib"
-  "/usr/lib/libc++abi.dylib"
-  "/usr/lib/libcmph.dylib"
-  "/usr/lib/libcups.2.dylib"
-  "/usr/lib/libextension.dylib"
-  "/usr/lib/libheimdal-asn1.dylib"
-  "/usr/lib/libiconv.2.dylib"
-  "/usr/lib/libicucore.A.dylib"
-  "/usr/lib/liblangid.dylib"
-  "/usr/lib/liblzma.5.dylib"
-  "/usr/lib/libmecabra.dylib"
-  "/usr/lib/libpam.2.dylib"
-  "/usr/lib/libresolv.9.dylib"
-  "/usr/lib/libsqlite3.dylib"
-  "/usr/lib/libxar.1.dylib"
-  "/usr/lib/libxml2.2.dylib"
-  "/usr/lib/libxslt.1.dylib"
-  "/usr/lib/libz.1.dylib"
-]
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
deleted file mode 100644
index 8830006f00e5..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_keychain
-
-security_keychain_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_keychain_HEADER_FILES_DIR = lib
-
-security_keychain_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
deleted file mode 100644
index 724c4788b6cc..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ CF, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp, lib }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_client
-    libsecurity_cdsa_utilities
-    libsecurityd
-    CF
-    libsecurity_asn1
-    libsecurity_pkcs12
-    libsecurity_cdsa_utils
-    openssl
-    libsecurity_ocspd
-    security_dotmac_tp
-  ];
-  patchPhase = ''
-    substituteInPlace lib/Keychains.cpp --replace DLDbListCFPref.h DLDBListCFPref.h
-
-    substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
-
-    cp ${osx_private_sdk}/include/xpc/private.h xpc
-    cp ${lib.getDev apple_sdk.sdk}/include/xpc/*.h xpc
-    cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h
-
-    substituteInPlace lib/SecItemPriv.h \
-      --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
-      --replace "extern CFTypeRef kSecAttrIsSensitive" "extern const CFTypeRef kSecAttrIsSensitive" \
-      --replace "extern CFTypeRef kSecAttrIsExtractable" "extern const CFTypeRef kSecAttrIsExtractable"
-
-    substituteInPlace lib/Keychains.cpp --replace \
-      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
-
-    substituteInPlace lib/CertificateValues.cpp --replace \
-      '#include <Security/SecCertificatePriv.h>' ""
-
-    substituteInPlace lib/DLDBListCFPref.cpp --replace \
-      'dispatch_once_t AppSandboxChecked;' ''$'namespace Security {\ndispatch_once_t AppSandboxChecked;' \
-      --replace 'return mLoginDLDbIdentifier;' 'return mLoginDLDbIdentifier; }' \
-      --replace '_xpc_runtime_is_app_sandboxed()' 'false'
-      # hope that doesn't hurt anything
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
deleted file mode 100644
index 119a43621fbb..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_mds
-
-security_mds_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_mds_HEADER_FILES_DIR = lib
-
-security_mds_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
deleted file mode 100644
index cd691f71e95f..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_cdsa_utilities
-    libsecurity_filedb
-    libsecurity_utilities
-    libsecurity_cdsa_client
-    libsecurityd
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
deleted file mode 100644
index 140c5a909a66..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_ocspd
-
-security_ocspd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_ocspd_HEADER_FILES_DIR = lib
-
-security_ocspd_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
deleted file mode 100644
index 81551e9a76ef..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_utilities, libsecurity_utilities }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    bootstrap_cmds
-  ];
-  postUnpack = ''
-    pushd libsecurity*
-    ls -lah
-    mkdir -p lib
-    cp common/* lib
-    cp client/* lib
-    popd
-  '';
-  preBuild = ''
-    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=. || exit 1
-    cp derived_src/* lib
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
deleted file mode 100644
index b2af7e72c41b..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_pkcs12
-
-security_pkcs12_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_pkcs12_HEADER_FILES_DIR = lib
-
-security_pkcs12_CC_FILES = $(wildcard lib/*.cpp)
-security_pkcs12_C_FILES = $(wildcard lib/*.c)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
deleted file mode 100644
index b225d062dc94..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utils, libsecurity_keychain }:
-appleDerivation {
-  patchPhase = ''
-    substituteInPlace lib/pkcsoids.h --replace '#error' '#warning'
-  '';
-  preBuild = ''
-    unpackFile ${libsecurity_keychain.src}
-    mv libsecurity_keychain*/lib security_keychain
-  '';
-  buildInputs = [
-    libsecurity_asn1
-    libsecurity_cdsa_utils
-    libsecurity_cdsa_client
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
deleted file mode 100644
index 47a1c609d066..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
+++ /dev/null
@@ -1,10 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_sd_cspdl
-
-security_sd_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_sd_cspdl_HEADER_FILES_DIR = lib
-
-security_sd_cspdl_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
deleted file mode 100644
index 224910916615..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_plugin
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    libsecurityd
-    libsecurity_cdsa_client
-  ];
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
deleted file mode 100644
index d3ba09142c96..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_utilities
-
-security_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_utilities_HEADER_FILES_DIR = lib
-
-security_utilities_C_FILES = $(wildcard lib/*.c)
-security_utilities_CC_FILES = $(wildcard lib/*.cpp)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
deleted file mode 100644
index 1ab950a9233c..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ IOKit, appleDerivation, apple_sdk, libauto, libobjc, sqlite, stdenv, osx_private_sdk }:
-appleDerivation {
-  buildInputs = [
-    libauto
-    libobjc
-    IOKit
-  ];
-  propagatedBuildInputs = [
-    sqlite
-    apple_sdk.frameworks.PCSC
-  ];
-  NIX_LDFLAGS = "-framework PCSC";
-  patchPhase = ''
-    substituteInPlace lib/errors.h --replace \
-      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
-      '"MacTypes.h"'
-    substituteInPlace lib/debugging.cpp --replace PATH_MAX 1024
-    substituteInPlace lib/superblob.h --replace 'result->at' 'result->template at'
-    substituteInPlace lib/ccaudit.cpp --replace '<bsm/libbsm.h>' '"bsm/libbsm.h"'
-    substituteInPlace lib/powerwatch.h --replace \
-      '<IOKit/pwr_mgt/IOPMLibPrivate.h>' \
-      '"${IOKit}/Library/Frameworks/IOKit.framework/Headers/pwr_mgt/IOPMLibPrivate.h"'
-    cp -R ${osx_private_sdk}/include/bsm lib
-    cp ${osx_private_sdk}/include/utilities_dtrace.h lib
-  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
-    substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
deleted file mode 100644
index 6058043e79f5..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
+++ /dev/null
@@ -1,11 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = securityd
-
-securityd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-securityd_HEADER_FILES_DIR = lib
-
-securityd_CC_FILES = $(wildcard lib/*.cpp)
-securityd_C_FILES = $(wildcard lib/*.c)
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
deleted file mode 100644
index fb3441f70507..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_utilities }:
-appleDerivation {
-  buildInputs = [
-    libsecurity_cdsa_utilities
-    libsecurity_utilities
-    bootstrap_cmds
-  ];
-  patchPhase = ''
-    unpackFile ${libsecurity_cdsa_client.src}
-    mv libsecurity_cdsa_client*/lib security_cdsa_client
-    ln -s lib securityd_client
-
-    patch -p1 < ${./xdr-arity.patch}
-  '';
-  preBuild = ''
-    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=.
-    cp derived_src/* lib
-    rm lib/ucspClientC.c
-  '';
-  postFixup = ''
-    ln -s $dev/include/securityd $dev/include/securityd_client
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
deleted file mode 100644
index 5d0328629f19..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-diff --git a/lib/sec_xdr.c b/lib/sec_xdr.c
-index fe5f038..6239b6c 100644
---- a/lib/sec_xdr.c
-+++ b/lib/sec_xdr.c
-@@ -223,7 +223,7 @@ bool_t copyin(void *data, xdrproc_t proc, void** copy, u_int *size)
-     sec_xdrmem_create(&xdr, (char *)xdr_data, length, XDR_ENCODE);
- 
-     // cast to void* - function can go both ways (xdr->x_op) 
--    if (proc(&xdr, data)) {
-+    if (proc(&xdr, data, 0)) {
-         *copy = xdr_data;
-         if (size) *size = length;
-         return (TRUE);
-@@ -261,7 +261,7 @@ bool_t copyout(const void *copy, u_int size, xdrproc_t proc, void **data, u_int
-     if (!sec_xdr_arena_init(&arena, &xdr, length_out ? length_out : length_required, length_out ? *data : NULL))
-         return (FALSE);
- 
--    if (proc(&xdr, data))
-+    if (proc(&xdr, data, 0))
-     {
-         *length = length_required;
-         return (TRUE);
-@@ -284,7 +284,7 @@ bool_t copyout_chunked(const void *copy, u_int size, xdrproc_t proc, void **data
- 
-     void *data_out = NULL;
- 
--    if (proc(&xdr, &data_out))
-+    if (proc(&xdr, &data_out, 0))
-     {
-         *data = data_out;
-         return (TRUE);
-diff --git a/lib/sec_xdr_array.c b/lib/sec_xdr_array.c
-index 152a71b..e5ec1ad 100644
---- a/lib/sec_xdr_array.c
-+++ b/lib/sec_xdr_array.c
-@@ -147,7 +147,7 @@ sec_xdr_array(XDR *xdrs, uint8_t **addrp, u_int *sizep, u_int maxsize, u_int els
-     for (i = 0; (i < c) && stat; i++) {
-         if ((xdrs->x_op == XDR_DECODE) && sizeof_alloc)
-             memset(obj, 0, elsize);
--        stat = (*elproc)(xdrs, target);
-+        stat = (*elproc)(xdrs, target, 0);
-         if ((xdrs->x_op == XDR_ENCODE) || !sizeof_alloc)
-             target += elsize;
-     }
-diff --git a/lib/sec_xdr_reference.c b/lib/sec_xdr_reference.c
-index a66fb37..ab5b4c4 100644
---- a/lib/sec_xdr_reference.c
-+++ b/lib/sec_xdr_reference.c
-@@ -121,7 +121,7 @@ sec_xdr_reference(XDR *xdrs, uint8_t **pp, u_int size, xdrproc_t proc)
-                 break;
-             }
- 
--    stat = (*proc)(xdrs, loc);
-+    stat = (*proc)(xdrs, loc, 0);
- 
-     if (xdrs->x_op == XDR_FREE) {
-         sec_mem_free(xdrs, loc, size);
-diff --git a/lib/sec_xdr_sizeof.c b/lib/sec_xdr_sizeof.c
-index a18bcd0..8c33dbc 100644
---- a/lib/sec_xdr_sizeof.c
-+++ b/lib/sec_xdr_sizeof.c
-@@ -190,7 +190,7 @@ sec_xdr_sizeof_in(func, data)
- 
-     sec_xdr_arena_allocator_t size_alloc;
-     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
--    stat = func(&x, data);
-+    stat = func(&x, data, 0);
-     if (x.x_private)
-         free(x.x_private);
-     return (stat == TRUE ? (unsigned) x.x_handy: 0);
-@@ -210,7 +210,7 @@ sec_xdr_sizeof_out(copy, size, func, data)
- 
-     sec_xdr_arena_allocator_t size_alloc;
-     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
--    stat = func(&x, data);
-+    stat = func(&x, data, 0);
-     if (size_alloc.data)
-         free(size_alloc.data);
-     return (stat == TRUE ? (unsigned long)size_alloc.offset : 0);
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index a6f484ba4e8d..87211f481d4f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -1,13 +1,33 @@
-{ stdenv, appleDerivation }:
+{ stdenv, lib, appleDerivation, xcbuildHook
+
+# headersOnly is true when building for libSystem
+, headersOnly ? false }:
 
-# all symbols are located in libSystem
 appleDerivation {
-  installPhase = ''
-    mkdir -p $out/include
-    cp *.h $out/include
+  nativeBuildInputs = lib.optional (!headersOnly) xcbuildHook;
+
+  prePatch = ''
+    substituteInPlace tzlink.c \
+      --replace '#include <xpc/xpc.h>' ""
   '';
 
-  meta = with stdenv.lib; {
+  xcbuildFlags = "-target util";
+
+  installPhase = ''
+    mkdir -p $out/include
+  '' + lib.optionalString headersOnly ''
+    cp *.h $out/include
+  '' + lib.optionalString (!headersOnly)''
+    mkdir -p $out/lib $out/include
+
+    cp Products/Release/*.dylib $out/lib
+    cp Products/Release/*.h $out/include
+
+    # TODO: figure out how to get this to be right the first time around
+    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
+  '';
+
+  meta = with lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
     license     = licenses.apsl20;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
deleted file mode 100644
index 0115ce537e27..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, appleDerivation, xcbuildHook }:
-
-# TODO: make this the official libutil expression once we've integrated xcbuild in the bootstrap
-appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
-
-  prePatch = ''
-    substituteInPlace tzlink.c \
-      --replace '#include <xpc/xpc.h>' ""
-  '';
-
-  xcbuildFlags = "-target util";
-
-  installPhase = ''
-    mkdir -p $out/lib $out/include
-
-    cp Products/Release/*.dylib $out/lib
-    cp Products/Release/*.h $out/include
-
-    # TODO: figure out how to get this to be right the first time around
-    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
-  '';
-
-  meta = with stdenv.lib; {
-    maintainers = with maintainers; [ copumpkin ];
-    platforms   = platforms.darwin;
-    license     = licenses.apsl20;
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
deleted file mode 100644
index 6f6a50bd57a2..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
+++ /dev/null
@@ -1,8 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-LIBRARY_NAME = security_dotmac_tp
-
-security_dotmac_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
-security_dotmac_tp_HEADER_FILES_DIR = lib
-
-include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
deleted file mode 100644
index bfbfb945957e..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-{ appleDerivation }:
-
-appleDerivation {
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
deleted file mode 100644
index d5bc3483c389..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ appleDerivation, xcbuildHook, Security
-, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
-, xnu, osx_private_sdk, pcsclite}:
-
-appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ Security libsecurity_utilities
-                  libsecurity_cdsa_utilities libsecurity_codesigning
-                  pcsclite ];
-
-  NIX_LDFLAGS = "-lpcsclite";
-
-  # can't build the whole thing
-  xcbuildFlags = "-target codesign";
-
-  preBuild = ''
-    mkdir -p include/Security
-    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
-    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
-
-    unpackFile ${xnu.src}
-    mkdir -p include/sys
-    cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
-  '';
-
-  NIX_CFLAGS_COMPILE = "-Iinclude";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp Products/Release/codesign $out/bin/codesign
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index 3513cb2e172c..a2f912ca5782 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -1,8 +1,8 @@
-{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil-new, lib}:
+{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil, lib}:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil-new ];
+  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
   NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 74c9f2543481..aaa3a1ebe327 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,11 +1,11 @@
-{ appleDerivation, bootstrap_cmds, bison, flex, gnum4, unifdef, perl, python }:
+{ appleDerivation, lib, bootstrap_cmds, bison, flex
+, gnum4, unifdef, perl, python
+, headersOnly ? true }:
 
-appleDerivation {
-  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+appleDerivation ({
+  nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
 
-  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
-
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace Makefile \
       --replace "/bin/" "" \
       --replace "MAKEJOBS := " '# MAKEJOBS := '
@@ -40,7 +40,27 @@ appleDerivation {
     patchShebangs .
   '';
 
-  installPhase = ''
+  PLATFORM = "MacOSX";
+  SDKVERSION = "10.11";
+  CC = "cc";
+  CXX = "c++";
+  MIG = "mig";
+  MIGCOM = "migcom";
+  STRIP = "strip";
+  NM = "nm";
+  UNIFDEF = "unifdef";
+  DSYMUTIL = "dsymutil";
+  HOST_OS_VERSION = "10.10";
+  HOST_CC = "cc";
+  HOST_FLEX = "flex";
+  HOST_BISON = "bison";
+  HOST_GM4 = "m4";
+  MIGCC = "cc";
+  ARCHS = "x86_64";
+
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  preBuild = ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
 
@@ -56,49 +76,27 @@ appleDerivation {
 
     export SDKROOT_RESOLVED=$PWD/sdk
     export HOST_SDKROOT_RESOLVED=$PWD/sdk
-    export PLATFORM=MacOSX
-    export SDKVERSION=10.11
-
-    export CC=cc
-    export CXX=c++
-    export MIG=${bootstrap_cmds}/bin/mig
-    export MIGCOM=${bootstrap_cmds}/libexec/migcom
-    export STRIP=sentinel-missing
-    export LIPO=sentinel-missing
-    export LIBTOOL=sentinel-missing
-    export NM=sentinel-missing
-    export UNIFDEF=${unifdef}/bin/unifdef
-    export DSYMUTIL=sentinel-missing
-    export CTFCONVERT=sentinel-missing
-    export CTFMERGE=sentinel-missing
-    export CTFINSERT=sentinel-missing
-    export NMEDIT=sentinel-missing
-
-    export HOST_OS_VERSION=10.7
-    export HOST_CC=cc
-    export HOST_FLEX=${flex}/bin/flex
-    export HOST_BISON=${bison}/bin/bison
-    export HOST_GM4=${gnum4}/bin/m4
-    export HOST_CODESIGN='echo dummy_codesign'
-    export HOST_CODESIGN_ALLOCATE=echo
 
     export BUILT_PRODUCTS_DIR=.
-
     export DSTROOT=$out
-    make installhdrs
+  '';
 
+  buildFlags = lib.optionalString headersOnly "exporthdrs";
+  installTargets = lib.optionalString headersOnly "installhdrs";
+
+  postInstall = lib.optionalString headersOnly ''
     mv $out/usr/include $out
 
+    (cd BUILD/obj/EXPORT_HDRS && find -type f -exec install -D \{} $out/include/\{} \;)
+
     # TODO: figure out why I need to do this
     cp libsyscall/wrappers/*.h $out/include
-    mkdir -p $out/include/os
-    cp libsyscall/os/tsd.h $out/include/os/tsd.h
+    install -D libsyscall/os/tsd.h $out/include/os/tsd.h
     cp EXTERNAL_HEADERS/AssertMacros.h $out/include
     cp EXTERNAL_HEADERS/Availability*.h $out/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/
+    cp -r EXTERNAL_HEADERS/corecrypto $out/include
 
     # Build the mach headers we crave
-    export MIGCC=cc
-    export ARCHS="x86_64"
     export SRCROOT=$PWD/libsyscall
     export DERIVED_SOURCES_DIR=$out/include
     export SDKROOT=$out
@@ -108,14 +106,13 @@ appleDerivation {
 
     # Get rid of the System prefix
     mv $out/System/* $out/
+    rmdir $out/System
 
     # TODO: do I need this?
     mv $out/internal_hdr/include/mach/*.h $out/include/mach
 
     # Get rid of some junk lying around
-    rm -rf $out/internal_hdr
-    rm -rf $out/usr
-    rm -rf $out/local
+    rm -rf $out/internal_hdr $out/usr $out/local
 
     # Add some symlinks
     ln -s $out/Library/Frameworks/System.framework/Versions/B \
@@ -123,8 +120,18 @@ appleDerivation {
     ln -s $out/Library/Frameworks/System.framework/Versions/Current/PrivateHeaders \
           $out/Library/Frameworks/System.framework/Headers
 
-    # IOKit (and possibly the others) is incomplete, so let's not make it visible from here...
+    # IOKit (and possibly the others) is incomplete,
+    # so let's not make it visible from here...
     mkdir $out/Library/PrivateFrameworks
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
-}
+} // lib.optionalAttrs headersOnly {
+  HOST_CODESIGN = "echo";
+  HOST_CODESIGN_ALLOCATE = "echo";
+  LIPO = "echo";
+  LIBTOOL = "echo";
+  CTFCONVERT = "echo";
+  CTFMERGE = "echo";
+  CTFINSERT = "echo";
+  NMEDIT = "echo";
+})
diff --git a/pkgs/os-specific/darwin/darling/default.nix b/pkgs/os-specific/darwin/darling/default.nix
index 6ed3b28eccc3..846831d0a879 100644
--- a/pkgs/os-specific/darwin/darling/default.nix
+++ b/pkgs/os-specific/darwin/darling/default.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cp -rL src/sandbox/include/ $out/
     cp libsystem_sandbox.dylib $out/lib/
+
+    mkdir -p $out/include
+    cp src/libaks/include/* $out/include
   '';
 
   # buildInputs = [ cmake bison flex ];
diff --git a/pkgs/os-specific/darwin/security-tool/GNUmakefile b/pkgs/os-specific/darwin/security-tool/GNUmakefile
deleted file mode 100644
index ae25f6a67c02..000000000000
--- a/pkgs/os-specific/darwin/security-tool/GNUmakefile
+++ /dev/null
@@ -1,14 +0,0 @@
-include $(GNUSTEP_MAKEFILES)/common.make
-
-TOOL_NAME = security
-security_C_FILES = $(wildcard *.c)
-security_CC_FILES = $(wildcard *.cpp)
-
-security_LDFLAGS = \
-	-lsecurity_cdsa_utilities -lsecurity_cdsa_utils -lsecurity_keychain -lsecurity_cssm \
-	-lsecurity_cdsa_client -lsecurity_utilities -lsecurity_asn1 -lsecurity_mds \
-	-lsecurity_cdsa_plugin -lsecurity_pkcs12 -lsecurity_apple_csp -lsecurity_apple_cspdl \
-	-lsecurity_apple_file_dl -lsecurity_apple_x509_cl -lsecurity_apple_x509_tp \
-	-lsecurity_sd_cspdl -lsecurity_filedb -lsecurityd -framework Security -framework PCSC
-
-include $(GNUSTEP_MAKEFILES)/tool.make
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
deleted file mode 100644
index f161a7a88e17..000000000000
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{ Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk,
-fetchurl, gnustep, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl,
-libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp,
-libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin,
-libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb,
-libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl,
-libsecurity_utilities, libsecurityd, osx_private_sdk, Security-framework, stdenv }:
-
-stdenv.mkDerivation rec {
-  version = "55115";
-  name = "SecurityTool-${version}";
-
-  src = fetchurl {
-    url = "http://opensource.apple.com/tarballs/SecurityTool/SecurityTool-${version}.tar.gz";
-    sha256 = "0apcz4vy2z5645jhrs60wj3w27mncjjqv42h5lln36g6qs2n9113";
-  };
-
-  disallowedRequisites = [ apple_sdk.sdk  ];
-
-  patchPhase = ''
-    # copied from libsecurity_generic
-    cp -R ${osx_private_sdk}/include/SecurityPrivateHeaders Security
-
-    substituteInPlace cmsutil.c --replace \
-      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
-    substituteInPlace createFVMaster.c --replace \
-      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
-      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
-  '';
-
-  postUnpack = ''
-    unpackFile ${Security.src}
-    cp Security-*/utilities/src/fileIo.c SecurityTool*
-    cp Security-*/utilities/src/fileIo.h SecurityTool*
-  '';
-
-  preBuild = ''
-    makeFlagsArray=(-j$NIX_BUILD_CORES)
-  '';
-
-  NIX_LDFLAGS = "-no_dtrace_dof";
-
-  makeFlags = [
-    "-f ${./GNUmakefile}"
-    "MAKEFILE_NAME=${./GNUmakefile}"
-    "GNUSTEP_MAKEFILES=${gnustep.make}/share/GNUstep/Makefiles"
-  ];
-
-  installFlags = [
-    "security_INSTALL_DIR=\$(out)/bin"
-  ];
-
-  propagatedBuildInputs = [ GSS Kerberos Security-framework PCSC Foundation ];
-
-  __propagatedImpureHostDeps = [ "/System/Library/Keychains" ];
-
-  buildInputs = [
-    gnustep.make
-    libsecurity_asn1
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-    libobjc
-    libsecurity_cdsa_client
-    libsecurity_keychain
-    libsecurity_cssm
-    libsecurity_cdsa_utils
-    libsecurity_mds
-    libsecurity_cdsa_plugin
-    libsecurity_apple_csp
-    libsecurity_apple_cspdl
-    libsecurity_apple_file_dl
-    libsecurity_apple_x509_cl
-    libsecurity_apple_x509_tp
-    libsecurity_pkcs12
-    libsecurity_sd_cspdl
-    libsecurity_filedb
-    libsecurityd
-    makeWrapper
-  ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-F${Security}/Library/Frameworks"
-    "-F${PCSC}/Library/Frameworks"
-    "-Wno-deprecated-declarations"
-  ];
-
-  postInstall = ''
-    wrapProgram $out/bin/security --set DYLD_INSERT_LIBRARIES /usr/lib/libsqlite3.dylib
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Command line interface to macOS keychains and Security framework";
-    maintainers = with maintainers; [
-      copumpkin
-      joelteon
-    ];
-    platforms = platforms.darwin;
-    license = licenses.apsl20;
-  };
-}
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b52afe98f7fa..9ec85eafd263 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -60,10 +60,6 @@ in
 
   osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { };
 
-  security_tool = darwin.callPackage ../os-specific/darwin/security-tool {
-    Security-framework = darwin.apple_sdk.frameworks.Security;
-  };
-
   stubs = callPackages ../os-specific/darwin/stubs { };
 
   trash = darwin.callPackage ../os-specific/darwin/trash { };

From 84557733f772f60db1d8a48a5aaeeca9513d56f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 21 Nov 2018 01:47:45 +0000
Subject: [PATCH 103/182] rust: Remove unused `buildRustPackage` from
 binaryBuild.nix

---
 pkgs/development/compilers/rust/binaryBuild.nix | 4 +---
 pkgs/development/compilers/rust/bootstrap.nix   | 1 -
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/compilers/rust/binaryBuild.nix b/pkgs/development/compilers/rust/binaryBuild.nix
index 488d43a6fea4..77dba7f9e620 100644
--- a/pkgs/development/compilers/rust/binaryBuild.nix
+++ b/pkgs/development/compilers/rust/binaryBuild.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, bash, buildRustPackage, curl, darwin
+{ stdenv, makeWrapper, bash, curl, darwin
 , version
 , src
 , platform
@@ -18,8 +18,6 @@ let
 in
 
 rec {
-  inherit buildRustPackage;
-
   rustc = stdenv.mkDerivation rec {
     name = "rustc-${versionType}-${version}";
 
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index f0413f194135..9528d798618f 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -37,6 +37,5 @@ let
 
 in callPackage ./binaryBuild.nix
   { inherit version src platform;
-    buildRustPackage = null;
     versionType = "bootstrap";
   }

From fcce28f1af9e89cbce9d0c32899af25240c1d751 Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Thu, 13 Dec 2018 02:05:30 -0500
Subject: [PATCH 104/182] docs: Small change to Rust guide to be more cross
 friendly

---
 doc/languages-frameworks/rust.section.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 4549bbd1686b..14b36f55f52f 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -303,11 +303,15 @@ with import <nixpkgs> {};
 
 stdenv.mkDerivation {
   name = "rust-env";
-  buildInputs = [
+  nativeBuildInputs = [
     rustc cargo
 
-    # Example Additional Dependencies
-    pkgconfig openssl
+    # Example Build-time Additional Dependencies
+    pkgconfig
+  ];
+  buildInputs = [
+    # Example Run-time Additional Dependencies
+    openssl
   ];
 
   # Set Environment Variables

From 14b2dcea8f62b8992d9fc7c74f5b9b62a989affb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 18 Dec 2018 12:06:37 +0000
Subject: [PATCH 105/182] python37: fix cross-compilation

---
 .../python/cpython/3.7/default.nix            | 37 +++++++++++++++++--
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/3.7/default.nix b/pkgs/development/interpreters/python/cpython/3.7/default.nix
index 093d8599690c..d1403ba95e4e 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.7/default.nix
@@ -16,6 +16,7 @@
 , python-setup-hook
 # For the Python package set
 , packageOverrides ? (self: super: {})
+, buildPackages
 }:
 
 assert x11Support -> tcl != null
@@ -38,7 +39,10 @@ let
     ++ optionals stdenv.isDarwin [ CF configd ];
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
-
+  pythonForBuild = if stdenv.hostPlatform == stdenv.buildPlatform then
+    "$out/bin/python"
+  else
+    buildPackages.python37.interpreter;
 in stdenv.mkDerivation {
   name = "python3-${version}";
   pythonVersion = majorVersion;
@@ -46,6 +50,10 @@ in stdenv.mkDerivation {
 
   inherit buildInputs;
 
+  nativeBuildInputs =
+    optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ buildPackages.stdenv.cc buildPackages.python37 ];
+
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
     sha256 = "0v9x4h22rh5cwpsq1mwpdi3c9lc9820lzp2nmn9g20llij72nzps";
@@ -95,6 +103,27 @@ in stdenv.mkDerivation {
     "--with-system-expat"
     "--with-system-ffi"
     "--with-openssl=${openssl.dev}"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_buggy_getaddrinfo=no"
+    # Assume little-endian IEEE 754 floating point when cross compiling
+    "ac_cv_little_endian_double=yes"
+    "ac_cv_big_endian_double=no"
+    "ac_cv_mixed_endian_double=no"
+    "ac_cv_x87_double_rounding=yes"
+    "ac_cv_tanh_preserves_zero_sign=yes"
+    # Generally assume that things are present and work
+    "ac_cv_posix_semaphores_enabled=yes"
+    "ac_cv_broken_sem_getvalue=no"
+    "ac_cv_wchar_t_signed=yes"
+    "ac_cv_rshift_extends_sign=yes"
+    "ac_cv_broken_nice=no"
+    "ac_cv_broken_poll=no"
+    "ac_cv_working_tzset=yes"
+    "ac_cv_have_long_long_format=yes"
+    "ac_cv_have_size_t_format=yes"
+    "ac_cv_computed_gotos=yes"
+    "ac_cv_file__dev_ptmx=yes"
+    "ac_cv_file__dev_ptc=yes"
   ];
 
   preConfigure = ''
@@ -153,9 +182,9 @@ in stdenv.mkDerivation {
     # We rebuild three times, once for each optimization level
     # Python 3.7 implements PEP 552, introducing support for deterministic bytecode.
     # This is automatically used when `SOURCE_DATE_EPOCH` is set.
-    find $out -name "*.py" | $out/bin/python     -m compileall -q -f -x "lib2to3" -i -
-    find $out -name "*.py" | $out/bin/python -O  -m compileall -q -f -x "lib2to3" -i -
-    find $out -name "*.py" | $out/bin/python -OO -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild}     -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild} -O  -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild} -OO -m compileall -q -f -x "lib2to3" -i -
   '';
 
   passthru = let

From 435565d58d12dc04a917329a0008c104808789c0 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 18 Dec 2018 08:23:25 -0600
Subject: [PATCH 106/182] libinput: 1.12.3 -> 1.12.4

https://lists.freedesktop.org/archives/wayland-devel/2018-December/039782.html
---
 pkgs/development/libraries/libinput/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 09fa16fcf1d2..a1563420630b 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "0mg2zqbjcgj0aq7d9nwawvyhx43vakilahrc83hrfyif3a3gyrpj";
+    sha256 = "1riircgrj002w1sd1053aq9098s6ys99gya0k0crhb9f3ij2kwx4";
   };
 
   outputs = [ "bin" "out" "dev" ];

From cbf9402574a51b27b64a2fc1c731b0df6ee7f464 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 05:50:22 -0800
Subject: [PATCH 107/182] libcap: 2.25 -> 2.26

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/libcap/versions
---
 pkgs/os-specific/linux/libcap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index a7e8894ccfef..c6055c2e8497 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
-  version = "2.25";
+  version = "2.26";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${name}.tar.xz";
-    sha256 = "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39";
+    sha256 = "12s5b8fp61jcn4qld8a7fakcz1han4a6l3b8cyl3n6r7hk2bfc5n";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];

From bf49bfc81b67c7daf680ff911e13c9222ed0207c Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Tue, 18 Dec 2018 23:20:21 +0100
Subject: [PATCH 108/182] mesa: 18.2.6 -> 18.3.1

---
 pkgs/development/libraries/mesa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 700542c6e896..95baab1627bc 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "18.2.6";
+  version = "18.3.1";
   branch  = head (splitString "." version);
 in
 
@@ -81,7 +81,7 @@ let self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "04nwxykmc80gicmal0zkk8is34rmbqawmfckirqhrps9h97zmfly";
+    sha256 = "0qyw9dj2p9n91qzc4ylck2an7ibssjvzi2bjcpv2ajk851yq47sv";
   };
 
   prePatch = "patchShebangs .";

From e97dd0788626d4654c1224a434ddbf435472a36f Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 21:46:58 -0800
Subject: [PATCH 109/182] eigen: 3.3.5 -> 3.3.7

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/eigen/versions
---
 pkgs/development/libraries/eigen/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/eigen/default.nix b/pkgs/development/libraries/eigen/default.nix
index c48f8e4c9732..25d0760a32d1 100644
--- a/pkgs/development/libraries/eigen/default.nix
+++ b/pkgs/development/libraries/eigen/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchurl, fetchpatch, cmake}:
 
 let
-  version = "3.3.5";
+  version = "3.3.7";
 in
 stdenv.mkDerivation {
   name = "eigen-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     url = "https://bitbucket.org/eigen/eigen/get/${version}.tar.gz";
     name = "eigen-${version}.tar.gz";
-    sha256 = "13p60x6k61zq2y2in7g4fy5p55cr5dbmj3zvw10zcazxraxbcm04";
+    sha256 = "1nnh0v82a5xibcjaph51mx06mxbllk77fvihnd5ba0kpl23yz13y";
   };
 
   patches = [

From 15bd1279495fa9e6824c3e6c8245b394d61b3454 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 20:44:41 -0800
Subject: [PATCH 110/182] harfbuzz: 2.1.0 -> 2.2.0

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/harfbuzz/versions
---
 pkgs/development/libraries/harfbuzz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 7a7624c96753..2bd757786fdc 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.1.0";
+  version = "2.2.0";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "1y8jzm76wj8pcj3z47fikhasipyizd6w9r20yc7p139jqxp4jnwf";
+    sha256 = "047q63jr513azf3g1y7f5xn60b4jdjs9zsmrx04sfw5rasyzrk5p";
   };
 
   postPatch = ''

From 587d8516804387dd7d18464371e343b36a7aa08d Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 07:20:42 -0800
Subject: [PATCH 111/182] libassuan: 2.5.1 -> 2.5.2

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/libassuan/versions
---
 pkgs/development/libraries/libassuan/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 91ceb959779e..540aef9edf25 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, gettext, pth, libgpgerror }:
 
 stdenv.mkDerivation rec {
-  name = "libassuan-2.5.1";
+  name = "libassuan-2.5.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libassuan/${name}.tar.bz2";
-    sha256 = "0jb4nb4nrjr949gd3lw8lh4v5d6qigxaq6xwy24w5apjnhvnrya7";
+    sha256 = "1rw8nw6fx6ppxga6m4cqcp898lnlzf7vn3s5c2lzfxg3fzr1nswq";
   };
 
   outputs = [ "out" "dev" "info" ];

From 19f303a1447fbca039c070a5a42604d0ae6f791d Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Fri, 14 Dec 2018 18:54:44 -0600
Subject: [PATCH 112/182] gnupg: 2.2.11 -> 2.2.12

https://dev.gnupg.org/T4289
---
 pkgs/tools/security/gnupg/22.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 08dc68889809..b6de575edb90 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1ncwqjhcxh46fgkp84g2lhf91amcha7abk6wdm1kagzm7q93wv29";
+    sha256 = "1jw282iy27j1qygym52aa44zxy7ly4bdadhd628hwr4q9j5hy0yv";
   };
 
   nativeBuildInputs = [ pkgconfig ];

From 8e811ec295424649bd7fca81ec136e2d28bf8230 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bastian=20K=C3=B6cher?= <git@kchr.de>
Date: Fri, 14 Dec 2018 08:41:46 +0100
Subject: [PATCH 113/182] qt5: 5.11 -> 5.12

---
 .../libraries/qt-5/5.12/default.nix           |  146 +++
 pkgs/development/libraries/qt-5/5.12/fetch.sh |    2 +
 .../qt-5/5.12/qtbase-darwin-nseventtype.patch |   13 +
 .../libraries/qt-5/5.12/qtbase-darwin.patch   |   70 ++
 .../qt-5/5.12/qtbase-fixguicmake.patch        |   30 +
 .../5.12/qtbase-revert-no-macos10.10.patch    |  102 ++
 .../libraries/qt-5/5.12/qtbase.patch          | 1096 +++++++++++++++++
 .../libraries/qt-5/5.12/qtdeclarative.patch   |   33 +
 .../libraries/qt-5/5.12/qtscript.patch        |   13 +
 .../libraries/qt-5/5.12/qtserialport.patch    |   22 +
 .../libraries/qt-5/5.12/qtwebkit.patch        |   12 +
 pkgs/development/libraries/qt-5/5.12/srcs.nix |  325 +++++
 .../libraries/qt-5/modules/qtwebengine.nix    |    5 +-
 pkgs/top-level/all-packages.nix               |   20 +-
 14 files changed, 1884 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/qt-5/5.12/default.nix
 create mode 100644 pkgs/development/libraries/qt-5/5.12/fetch.sh
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtbase.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtscript.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtserialport.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/qtwebkit.patch
 create mode 100644 pkgs/development/libraries/qt-5/5.12/srcs.nix

diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
new file mode 100644
index 000000000000..22535deb7678
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -0,0 +1,146 @@
+/*
+
+# Updates
+
+Before a major version update, make a copy of this directory. (We like to
+keep the old version around for a short time after major updates.) Add a
+top-level attribute to `top-level/all-packages.nix`.
+
+1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
+2. From the top of the Nixpkgs tree, run
+   `./maintainers/scripts/fetch-kde-qt.sh > pkgs/development/libraries/qt-5/$VERSION/srcs.nix`.
+3. Update `qtCompatVersion` below if the minor version number changes.
+4. Check that the new packages build correctly.
+5. Commit the changes and open a pull request.
+
+*/
+
+{
+  newScope,
+  stdenv, fetchurl, fetchFromGitHub, makeSetupHook,
+  bison, cups ? null, harfbuzz, libGL, perl,
+  gstreamer, gst-plugins-base, gtk3, dconf,
+  cf-private,
+
+  # options
+  developerBuild ? false,
+  decryptSslTraffic ? false,
+  debug ? false,
+}:
+
+with stdenv.lib;
+
+let
+
+  qtCompatVersion = "5.12";
+
+  mirror = "https://download.qt.io";
+  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
+    # Community port of the now unmaintained upstream qtwebkit.
+    qtwebkit = {
+      src = fetchFromGitHub {
+        owner = "annulen";
+        repo = "webkit";
+        rev = "4ce8ebc4094512b9916bfa5984065e95ac97c9d8";
+        sha256 = "05h1xnxzbf7sp3plw5dndsvpf6iigh0bi4vlj4svx0hkf1giakjf";
+      };
+      version = "5.212-alpha-01-26-2018";
+    };
+  };
+
+  patches = {
+    qtbase = [
+      ./qtbase.patch
+      ./qtbase-darwin.patch
+      ./qtbase-revert-no-macos10.10.patch
+      ./qtbase-fixguicmake.patch
+    ] ++ optionals stdenv.isDarwin [
+      ./qtbase-darwin-nseventtype.patch
+    ];
+    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtscript = [ ./qtscript.patch ];
+    qtserialport = [ ./qtserialport.patch ];
+    qtwebkit = [ ./qtwebkit.patch ];
+  };
+
+  mkDerivation =
+    import ../mkDerivation.nix
+    { inherit stdenv; inherit (stdenv) lib; }
+    { inherit debug; };
+
+  qtModule =
+    import ../qtModule.nix
+    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    { inherit self srcs patches; };
+
+  addPackages = self: with self;
+    let
+      callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
+    in {
+
+      inherit mkDerivation;
+
+      qtbase = callPackage ../modules/qtbase.nix {
+        inherit (srcs.qtbase) src version;
+        patches = patches.qtbase;
+        inherit bison cups harfbuzz libGL;
+        withGtk3 = true; inherit dconf gtk3;
+        inherit developerBuild decryptSslTraffic;
+      };
+
+      qtcharts = callPackage ../modules/qtcharts.nix {};
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
+      qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
+      qtdoc = callPackage ../modules/qtdoc.nix {};
+      qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
+      qtimageformats = callPackage ../modules/qtimageformats.nix {};
+      qtlocation = callPackage ../modules/qtlocation.nix {};
+      qtmacextras = callPackage ../modules/qtmacextras.nix {
+        inherit cf-private;
+      };
+      qtmultimedia = callPackage ../modules/qtmultimedia.nix {
+        inherit gstreamer gst-plugins-base;
+      };
+      qtquick1 = null;
+      qtquickcontrols = callPackage ../modules/qtquickcontrols.nix {};
+      qtquickcontrols2 = callPackage ../modules/qtquickcontrols2.nix {};
+      qtscript = callPackage ../modules/qtscript.nix {};
+      qtsensors = callPackage ../modules/qtsensors.nix {};
+      qtserialport = callPackage ../modules/qtserialport.nix {};
+      qtspeech = callPackage ../modules/qtspeech.nix {};
+      qtsvg = callPackage ../modules/qtsvg.nix {};
+      qttools = callPackage ../modules/qttools.nix {};
+      qttranslations = callPackage ../modules/qttranslations.nix {};
+      qtvirtualkeyboard = callPackage ../modules/qtvirtualkeyboard.nix {};
+      qtwayland = callPackage ../modules/qtwayland.nix {};
+      qtwebchannel = callPackage ../modules/qtwebchannel.nix {};
+      qtwebengine = callPackage ../modules/qtwebengine.nix {};
+      qtwebglplugin = callPackage ../modules/qtwebglplugin.nix {};
+      qtwebkit = callPackage ../modules/qtwebkit.nix {};
+      qtwebsockets = callPackage ../modules/qtwebsockets.nix {};
+      qtx11extras = callPackage ../modules/qtx11extras.nix {};
+      qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
+
+      env = callPackage ../qt-env.nix {};
+      full = env "qt-full-${qtbase.version}" ([
+        qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
+        qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
+        qtscript qtsensors qtserialport qtsvg qttools qttranslations
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtx11extras qtxmlpatterns
+      ] ++ optional (!stdenv.isDarwin) qtwayland
+        ++ optional (stdenv.isDarwin) qtmacextras);
+
+      qmake = makeSetupHook {
+        deps = [ self.qtbase.dev ];
+        substitutions = {
+          inherit (stdenv) isDarwin;
+          qtbase_dev = self.qtbase.dev;
+          fix_qt_builtin_paths = ../hooks/fix-qt-builtin-paths.sh;
+        };
+      } ../hooks/qmake-hook.sh;
+    };
+
+   self = makeScope newScope addPackages;
+
+in self
diff --git a/pkgs/development/libraries/qt-5/5.12/fetch.sh b/pkgs/development/libraries/qt-5/5.12/fetch.sh
new file mode 100644
index 000000000000..b77a58cafa2e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/fetch.sh
@@ -0,0 +1,2 @@
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.12/5.12.0/submodules/ \
+            -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch
new file mode 100644
index 000000000000..9ef6e8ef0692
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch
@@ -0,0 +1,13 @@
+--- a/src/plugins/platforms/cocoa/qcocoawindow.mm
++++ b/src/plugins/platforms/cocoa/qcocoawindow.mm
+@@ -404,8 +404,8 @@ void QCocoaWindow::setVisible(bool visible)
+                         removeMonitor();
+                         monitor = [NSEvent addGlobalMonitorForEventsMatchingMask:NSLeftMouseDownMask|NSRightMouseDownMask|NSOtherMouseDownMask|NSMouseMovedMask handler:^(NSEvent *e) {
+                             QPointF localPoint = QCocoaScreen::mapFromNative([NSEvent mouseLocation]);
+-                            const auto button = e.type == NSEventTypeMouseMoved ? Qt::NoButton : cocoaButton2QtButton([e buttonNumber]);
+-                            const auto eventType = e.type == NSEventTypeMouseMoved ? QEvent::MouseMove : QEvent::MouseButtonPress;
++                            const auto button = e.type == NSMouseMoved ? Qt::NoButton : cocoaButton2QtButton([e buttonNumber]);
++                            const auto eventType = e.type == NSMouseMoved ? QEvent::MouseMove : QEvent::MouseButtonPress;
+                             QWindowSystemInterface::handleMouseEvent(window(), window()->mapFromGlobal(localPoint.toPoint()), localPoint,
+                                                                      Qt::MouseButtons(uint(NSEvent.pressedMouseButtons & 0xFFFF)), button, eventType);
+                         }];
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch
new file mode 100644
index 000000000000..7ce27a99758e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch
@@ -0,0 +1,70 @@
+diff --git a/src/plugins/bearer/corewlan/qcorewlanengine.mm b/src/plugins/bearer/corewlan/qcorewlanengine.mm
+index c3dd49ff3e..6871399817 100644
+--- a/src/plugins/bearer/corewlan/qcorewlanengine.mm
++++ b/src/plugins/bearer/corewlan/qcorewlanengine.mm
+@@ -283,7 +283,7 @@ void QScanThread::getUserConfigurations()
+     QMacAutoReleasePool pool;
+     userProfiles.clear();
+ 
+-    NSArray<NSString *> *wifiInterfaces = [CWWiFiClient interfaceNames];
++    NSArray *wifiInterfaces = [CWWiFiClient interfaceNames];
+     for (NSString *ifName in wifiInterfaces) {
+ 
+         CWInterface *wifiInterface = [[CWWiFiClient sharedWiFiClient] interfaceWithName:ifName];
+@@ -598,7 +598,7 @@ void QCoreWlanEngine::doRequestUpdate()
+ 
+     QMacAutoReleasePool pool;
+ 
+-    NSArray<NSString *> *wifiInterfaces = [CWWiFiClient interfaceNames];
++    NSArray *wifiInterfaces = [CWWiFiClient interfaceNames];
+     for (NSString *ifName in wifiInterfaces) {
+             scanThread->interfaceName = QString::fromNSString(ifName);
+             scanThread->start();
+diff --git a/src/plugins/platforms/cocoa/qcocoascreen.mm b/src/plugins/platforms/cocoa/qcocoascreen.mm
+index afe14e623c..74d69c2fa1 100644
+--- a/src/plugins/platforms/cocoa/qcocoascreen.mm
++++ b/src/plugins/platforms/cocoa/qcocoascreen.mm
+@@ -127,7 +127,7 @@ void QCocoaScreen::updateProperties()
+     const qreal previousRefreshRate = m_refreshRate;
+ 
+     // The reference screen for the geometry is always the primary screen
+-    QRectF primaryScreenGeometry = QRectF::fromCGRect([[NSScreen screens] firstObject].frame);
++    QRectF primaryScreenGeometry = QRectF::fromCGRect([[[NSScreen screens] firstObject] frame]);
+     m_geometry = qt_mac_flip(QRectF::fromCGRect(nsScreen.frame), primaryScreenGeometry).toRect();
+     m_availableGeometry = qt_mac_flip(QRectF::fromCGRect(nsScreen.visibleFrame), primaryScreenGeometry).toRect();
+ 
+diff --git a/src/plugins/platforms/cocoa/qcocoawindow.mm b/src/plugins/platforms/cocoa/qcocoawindow.mm
+index df1ad82592..0318a4ff96 100644
+--- a/src/plugins/platforms/cocoa/qcocoawindow.mm
++++ b/src/plugins/platforms/cocoa/qcocoawindow.mm
+@@ -1704,7 +1704,7 @@ void QCocoaWindow::applyContentBorderThickness(NSWindow *window)
+ 
+     if (!m_drawContentBorderGradient) {
+         window.styleMask = window.styleMask & ~NSWindowStyleMaskTexturedBackground;
+-        [window.contentView.superview setNeedsDisplay:YES];
++        [[window.contentView superview] setNeedsDisplay:YES];
+         window.titlebarAppearsTransparent = NO;
+         return;
+     }
+diff --git a/src/plugins/platforms/cocoa/qnswindow.mm b/src/plugins/platforms/cocoa/qnswindow.mm
+index c17ad47aba..a0f1dd38fb 100644
+--- a/src/plugins/platforms/cocoa/qnswindow.mm
++++ b/src/plugins/platforms/cocoa/qnswindow.mm
+@@ -230,7 +230,7 @@ static bool isMouseEvent(NSEvent *ev)
+     if (pw->frameStrutEventsEnabled() && isMouseEvent(theEvent)) {
+         NSPoint loc = [theEvent locationInWindow];
+         NSRect windowFrame = [self convertRectFromScreen:self.frame];
+-        NSRect contentFrame = self.contentView.frame;
++        NSRect contentFrame = [self.contentView frame];
+         if (NSMouseInRect(loc, windowFrame, NO) && !NSMouseInRect(loc, contentFrame, NO))
+             [qnsview_cast(pw->view()) handleFrameStrutMouseEvent:theEvent];
+     }
+@@ -257,7 +257,7 @@ static bool isMouseEvent(NSEvent *ev)
+ + (void)applicationActivationChanged:(NSNotification*)notification
+ {
+     const id sender = self;
+-    NSEnumerator<NSWindow*> *windowEnumerator = nullptr;
++    NSEnumerator *windowEnumerator = nullptr;
+     NSApplication *application = [NSApplication sharedApplication];
+ 
+     // Unfortunately there's no NSWindowListOrderedBackToFront,
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch
new file mode 100644
index 000000000000..8b46d432812a
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch
@@ -0,0 +1,30 @@
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 0bbc871..3673634 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -286,7 +286,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-        set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
++        set(imported_location \"${PLUGIN_LOCATION}\")
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+index 5baf0fd..3583745 100644
+--- a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+@@ -2,10 +2,10 @@
+ add_library(Qt5::$$CMAKE_PLUGIN_NAME MODULE IMPORTED)
+ 
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
+ !!ENDIF
+ !!IF !isEmpty(CMAKE_DEBUG_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
+ !!ENDIF
+ 
+ list(APPEND Qt5$${CMAKE_MODULE_NAME}_PLUGINS Qt5::$$CMAKE_PLUGIN_NAME)
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch
new file mode 100644
index 000000000000..29776518379d
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch
@@ -0,0 +1,102 @@
+Revert "Remove code paths for macOS < 10.11"
+
+This reverts commit 138a65e0cfa80b13fd018a01e7d8b33341a3cfd3.
+
+From 138a65e0cfa80b13fd018a01e7d8b33341a3cfd3 Mon Sep 17 00:00:00 2001
+From: Jake Petroules <jake.petroules@qt.io>
+Date: Thu, 8 Feb 2018 11:05:42 -0800
+Subject: [PATCH] Remove code paths for macOS < 10.11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I5ae02d88aa3dcd97d1f2ebf6255a68643e5d6daa
+Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
+Reviewed-by: Gabriel de Dietrich <gabriel.dedietrich@qt.io>
+Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com>
+---
+ .../fontdatabases/mac/qfontengine_coretext.mm            | 16 +++-------------
+ src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm    |  6 +-----
+ src/plugins/platforms/cocoa/qnswindowdelegate.mm         | 16 ----------------
+ 3 files changed, 4 insertions(+), 34 deletions(-)
+
+diff --git a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
+index 98b753eff9..489d9cd031 100644
+--- a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
++++ b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
+@@ -47,18 +47,28 @@
+ 
+ #include <cmath>
+ 
+-#if defined(Q_OS_MACOS)
++#if defined(Q_OS_OSX) && !QT_OSX_DEPLOYMENT_TARGET_BELOW(__MAC_10_11)
+ #import <AppKit/AppKit.h>
+ #endif
+ 
+-#if defined(QT_PLATFORM_UIKIT)
++#if defined(QT_PLATFORM_UIKIT) && !QT_IOS_DEPLOYMENT_TARGET_BELOW(__IPHONE_8_2)
+ #import <UIKit/UIKit.h>
+ #endif
+ 
+ // These are available cross platform, exported as kCTFontWeightXXX from CoreText.framework,
+ // but they are not documented and are not in public headers so are private API and exposed
+ // only through the NSFontWeightXXX and UIFontWeightXXX aliases in AppKit and UIKit (rdar://26109857)
+-#if defined(Q_OS_MACOS)
++#if QT_MAC_DEPLOYMENT_TARGET_BELOW(__MAC_10_11, __IPHONE_8_2)
++#define kCTFontWeightUltraLight -0.8
++#define kCTFontWeightThin -0.6
++#define kCTFontWeightLight -0.4
++#define kCTFontWeightRegular 0
++#define kCTFontWeightMedium 0.23
++#define kCTFontWeightSemibold 0.3
++#define kCTFontWeightBold 0.4
++#define kCTFontWeightHeavy 0.56
++#define kCTFontWeightBlack 0.62
++#elif defined(Q_OS_OSX)
+ #define kCTFontWeightUltraLight NSFontWeightUltraLight
+ #define kCTFontWeightThin NSFontWeightThin
+ #define kCTFontWeightLight NSFontWeightLight
+diff --git a/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm b/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
+index 94f2125bad..272cd9f3dc 100644
+--- a/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
++++ b/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
+@@ -162,7 +162,11 @@ QT_NAMESPACE_ALIAS_OBJC_CLASS(QNSOpenSavePanelDelegate);
+     // resetting our mCurrentDir, set the delegate
+     // here to make sure it gets the correct value.
+     [mSavePanel setDelegate:self];
+-    mOpenPanel.accessoryViewDisclosed = YES;
++
++#if QT_OSX_PLATFORM_SDK_EQUAL_OR_ABOVE(__MAC_10_11)
++    if (__builtin_available(macOS 10.11, *))
++        mOpenPanel.accessoryViewDisclosed = YES;
++#endif
+ 
+     if (mOptions->isLabelExplicitlySet(QFileDialogOptions::Accept))
+         [mSavePanel setPrompt:[self strip:options->labelText(QFileDialogOptions::Accept)]];
+diff --git a/src/plugins/platforms/cocoa/qnswindowdelegate.mm b/src/plugins/platforms/cocoa/qnswindowdelegate.mm
+index 057a4c2943..eb55e50622 100644
+--- a/src/plugins/platforms/cocoa/qnswindowdelegate.mm
++++ b/src/plugins/platforms/cocoa/qnswindowdelegate.mm
+@@ -103,6 +103,22 @@ static QRegExp whitespaceRegex = QRegExp(QStringLiteral("\\s*"));
+     return QCocoaScreen::mapToNative(maximizedFrame);
+ }
+ 
++#if QT_MACOS_DEPLOYMENT_TARGET_BELOW(__MAC_10_11)
++/*
++    AppKit on OS X 10.10 wrongly calls windowWillUseStandardFrame:defaultFrame
++    from -[NSWindow _frameForFullScreenMode] when going into fullscreen, resulting
++    in black bars on top and bottom of the window. By implementing the following
++    method, AppKit will choose that instead, and resolve the right fullscreen
++    geometry.
++*/
++- (NSSize)window:(NSWindow *)window willUseFullScreenContentSize:(NSSize)proposedSize
++{
++    Q_UNUSED(proposedSize);
++    Q_ASSERT(window == m_cocoaWindow->nativeWindow());
++    return NSSizeFromCGSize(m_cocoaWindow->screen()->geometry().size().toCGSize());
++}
++#endif
++
+ - (BOOL)window:(NSWindow *)window shouldPopUpDocumentPathMenu:(NSMenu *)menu
+ {
+     Q_UNUSED(window);
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase.patch b/pkgs/development/libraries/qt-5/5.12/qtbase.patch
new file mode 100644
index 000000000000..68ebd56b76c0
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase.patch
@@ -0,0 +1,1096 @@
+diff --git a/mkspecs/common/mac.conf b/mkspecs/common/mac.conf
+index 61bea952b2..9909dae726 100644
+--- a/mkspecs/common/mac.conf
++++ b/mkspecs/common/mac.conf
+@@ -23,7 +23,7 @@ QMAKE_INCDIR_OPENGL     = \
+ 
+ QMAKE_FIX_RPATH         = install_name_tool -id
+ 
+-QMAKE_LFLAGS_RPATH      = -Wl,-rpath,
++QMAKE_LFLAGS_RPATH      =
+ QMAKE_LFLAGS_GCSECTIONS = -Wl,-dead_strip
+ 
+ QMAKE_LFLAGS_REL_RPATH  =
+diff --git a/mkspecs/features/create_cmake.prf b/mkspecs/features/create_cmake.prf
+index 2ed708e085..05e60ff45f 100644
+--- a/mkspecs/features/create_cmake.prf
++++ b/mkspecs/features/create_cmake.prf
+@@ -21,7 +21,7 @@ load(cmake_functions)
+ # at cmake time whether package has been found via a symlink, and correct
+ # that to an absolute path. This is only done for installations to
+ # the /usr or / prefix.
+-CMAKE_INSTALL_LIBS_DIR = $$cmakeTargetPath($$[QT_INSTALL_LIBS])
++CMAKE_INSTALL_LIBS_DIR = $$cmakeTargetPath($$NIX_OUTPUT_OUT/lib/)
+ contains(CMAKE_INSTALL_LIBS_DIR, ^(/usr)?/lib(64)?.*): CMAKE_USR_MOVE_WORKAROUND = $$CMAKE_INSTALL_LIBS_DIR
+ 
+ CMAKE_OUT_DIR = $$MODULE_BASE_OUTDIR/lib/cmake
+@@ -51,45 +51,20 @@ split_incpath {
+         $$cmake_extra_source_includes.output
+ }
+ 
+-CMAKE_INCLUDE_DIR = $$cmakeRelativePath($$[QT_INSTALL_HEADERS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_INCLUDE_DIR, "^\\.\\./.*") {
+-    CMAKE_INCLUDE_DIR = $$[QT_INSTALL_HEADERS]/
+-    CMAKE_INCLUDE_DIR_IS_ABSOLUTE = True
+-}
++CMAKE_INCLUDE_DIR = $$NIX_OUTPUT_DEV/include/
++CMAKE_INCLUDE_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_LIB_DIR = $$cmakeRelativePath($$[QT_INSTALL_LIBS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_LIB_DIR,"^\\.\\./.*") {
+-    CMAKE_LIB_DIR = $$[QT_INSTALL_LIBS]/
+-    CMAKE_LIB_DIR_IS_ABSOLUTE = True
+-} else {
+-    CMAKE_RELATIVE_INSTALL_LIBS_DIR = $$cmakeRelativePath($$[QT_INSTALL_PREFIX], $$[QT_INSTALL_LIBS])
+-    # We need to go up another two levels because the CMake files are
+-    # installed in $${CMAKE_LIB_DIR}/cmake/Qt5$${CMAKE_MODULE_NAME}
+-    CMAKE_RELATIVE_INSTALL_DIR = "$${CMAKE_RELATIVE_INSTALL_LIBS_DIR}../../"
+-}
++CMAKE_BIN_DIR = $$NIX_OUTPUT_BIN/bin/
++CMAKE_BIN_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_BIN_DIR = $$cmakeRelativePath($$[QT_HOST_BINS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_BIN_DIR, "^\\.\\./.*") {
+-    CMAKE_BIN_DIR = $$[QT_HOST_BINS]/
+-    CMAKE_BIN_DIR_IS_ABSOLUTE = True
+-}
++CMAKE_LIB_DIR = $$NIX_OUTPUT_OUT/lib/
++CMAKE_LIB_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_PLUGIN_DIR = $$cmakeRelativePath($$[QT_INSTALL_PLUGINS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_PLUGIN_DIR, "^\\.\\./.*") {
+-    CMAKE_PLUGIN_DIR = $$[QT_INSTALL_PLUGINS]/
+-    CMAKE_PLUGIN_DIR_IS_ABSOLUTE = True
+-}
+-
+-win32:!static:!staticlib {
+-    CMAKE_DLL_DIR = $$cmakeRelativePath($$[QT_INSTALL_BINS], $$[QT_INSTALL_PREFIX])
+-    contains(CMAKE_DLL_DIR, "^\\.\\./.*") {
+-        CMAKE_DLL_DIR = $$[QT_INSTALL_BINS]/
+-        CMAKE_DLL_DIR_IS_ABSOLUTE = True
+-    }
+-} else {
+-    CMAKE_DLL_DIR = $$CMAKE_LIB_DIR
+-    CMAKE_DLL_DIR_IS_ABSOLUTE = $$CMAKE_LIB_DIR_IS_ABSOLUTE
+-}
++CMAKE_PLUGIN_DIR = $$NIX_OUTPUT_PLUGIN/
++CMAKE_PLUGIN_DIR_IS_ABSOLUTE = True
++ 
++CMAKE_DLL_DIR = $$NIX_OUTPUT_OUT/lib/
++CMAKE_DLL_DIR_IS_ABSOLUTE = True
+ 
+ static|staticlib:CMAKE_STATIC_TYPE = true
+ 
+@@ -169,7 +144,7 @@ contains(CONFIG, plugin) {
+       cmake_target_file
+ 
+     cmake_qt5_plugin_file.files = $$cmake_target_file.output
+-    cmake_qt5_plugin_file.path = $$[QT_INSTALL_LIBS]/cmake/Qt5$${CMAKE_MODULE_NAME}
++    cmake_qt5_plugin_file.path = $$NIX_OUTPUT_OUT/lib/cmake/Qt5$${CMAKE_MODULE_NAME}
+     INSTALLS += cmake_qt5_plugin_file
+ 
+     return()
+@@ -316,7 +291,7 @@ exists($$cmake_macros_file.input) {
+     cmake_qt5_module_files.files += $$cmake_macros_file.output
+ }
+ 
+-cmake_qt5_module_files.path = $$[QT_INSTALL_LIBS]/cmake/Qt5$${CMAKE_MODULE_NAME}
++cmake_qt5_module_files.path = $$NIX_OUTPUT_OUT/lib/cmake/Qt5$${CMAKE_MODULE_NAME}
+ 
+ # We are generating cmake files. Most developers of Qt are not aware of cmake,
+ # so we require automatic tests to be available. The only module which should
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 3ed6dd5889..4c7c8da21a 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -3,30 +3,6 @@ if (CMAKE_VERSION VERSION_LESS 3.1.0)
+     message(FATAL_ERROR \"Qt 5 $${CMAKE_MODULE_NAME} module requires at least CMake version 3.1.0\")
+ endif()
+ 
+-!!IF !isEmpty(CMAKE_USR_MOVE_WORKAROUND)
+-!!IF !isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-set(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$[QT_INSTALL_PREFIX]\")
+-!!ELSE
+-get_filename_component(_IMPORT_PREFIX \"${CMAKE_CURRENT_LIST_FILE}\" PATH)
+-# Use original install prefix when loaded through a
+-# cross-prefix symbolic link such as /lib -> /usr/lib.
+-get_filename_component(_realCurr \"${_IMPORT_PREFIX}\" REALPATH)
+-get_filename_component(_realOrig \"$$CMAKE_INSTALL_LIBS_DIR/cmake/Qt5$${CMAKE_MODULE_NAME}\" REALPATH)
+-if(_realCurr STREQUAL _realOrig)
+-    get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$CMAKE_INSTALL_LIBS_DIR/$${CMAKE_RELATIVE_INSTALL_LIBS_DIR}\" ABSOLUTE)
+-else()
+-    get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"${CMAKE_CURRENT_LIST_DIR}/$${CMAKE_RELATIVE_INSTALL_DIR}\" ABSOLUTE)
+-endif()
+-unset(_realOrig)
+-unset(_realCurr)
+-unset(_IMPORT_PREFIX)
+-!!ENDIF
+-!!ELIF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"${CMAKE_CURRENT_LIST_DIR}/$${CMAKE_RELATIVE_INSTALL_DIR}\" ABSOLUTE)
+-!!ELSE
+-set(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$[QT_INSTALL_PREFIX]\")
+-!!ENDIF
+-
+ !!IF !equals(TEMPLATE, aux)
+ # For backwards compatibility only. Use Qt5$${CMAKE_MODULE_NAME}_VERSION instead.
+ set(Qt5$${CMAKE_MODULE_NAME}_VERSION_STRING "$$eval(QT.$${MODULE}.VERSION)")
+@@ -52,11 +28,7 @@ endmacro()
+ macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATION IMPLIB_LOCATION)
+     set_property(TARGET Qt5::$${CMAKE_MODULE_NAME} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+-!!ELSE
+     set(imported_location \"$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+-!!ENDIF
+     _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+     set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
+         \"INTERFACE_LINK_LIBRARIES\" \"${_Qt5$${CMAKE_MODULE_NAME}_LIB_DEPENDENCIES}\"
+@@ -69,11 +41,7 @@ macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATI
+     )
+ 
+ !!IF !isEmpty(CMAKE_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_implib \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+-!!ELSE
+     set(imported_implib \"IMPORTED_IMPLIB_${Configuration}\" \"$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+-!!ENDIF
+     _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_implib})
+     if(NOT \"${IMPLIB_LOCATION}\" STREQUAL \"\")
+         set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
+@@ -89,24 +57,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !no_module_headers
+ !!IF !isEmpty(CMAKE_BUILD_IS_FRAMEWORK)
+     set(_Qt5$${CMAKE_MODULE_NAME}_OWN_INCLUDE_DIRS
+-      \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework\"
+-      \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Headers\"
++      \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework\"
++      \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Headers\"
+     )
+ !!IF isEmpty(CMAKE_NO_PRIVATE_INCLUDES)
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/\"
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/$${MODULE_INCNAME}\"
+-    )
+-!!ELSE
+-    set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+-!!ENDIF
+-!!ELSE
+-!!IF isEmpty(CMAKE_INCLUDE_DIR_IS_ABSOLUTE)
+-    set(_Qt5$${CMAKE_MODULE_NAME}_OWN_INCLUDE_DIRS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$$CMAKE_INCLUDE_DIR\" \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}\")
+-!!IF isEmpty(CMAKE_NO_PRIVATE_INCLUDES)
+-    set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}/$$VERSION\"
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}/$$VERSION/$${MODULE_INCNAME}\"
++        \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/\"
++        \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/$${MODULE_INCNAME}\"
+     )
+ !!ELSE
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+@@ -122,7 +79,6 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+ !!ENDIF
+ !!ENDIF
+-!!ENDIF
+ !!IF !isEmpty(CMAKE_ADD_SOURCE_INCLUDE_DIRS)
+     include(\"${CMAKE_CURRENT_LIST_DIR}/ExtraSourceIncludes.cmake\" OPTIONAL)
+ !!ENDIF
+@@ -272,25 +228,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
+ !!IF isEmpty(CMAKE_DEBUG_TYPE)
+ !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    if (EXISTS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ELSE // CMAKE_LIB_DIR_IS_ABSOLUTE
+     if (EXISTS \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ENDIF // CMAKE_LIB_DIR_IS_ABSOLUTE
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(DEBUG \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" \"\" )
+ !!ELSE // CMAKE_STATIC_WINDOWS_BUILD
+     if (EXISTS
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}$${CMAKE_LIB_FILE_LOCATION_DEBUG}\"
+-!!ELSE
+         \"$${CMAKE_LIB_FILE_LOCATION_DEBUG}\"
+-!!ENDIF
+       AND EXISTS
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ELSE
+         \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ENDIF
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(DEBUG \"$${CMAKE_LIB_FILE_LOCATION_DEBUG}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+ !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
+     endif()
+@@ -309,25 +253,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
+ !!IF isEmpty(CMAKE_RELEASE_TYPE)
+ !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    if (EXISTS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ELSE // CMAKE_LIB_DIR_IS_ABSOLUTE
+     if (EXISTS \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ENDIF // CMAKE_LIB_DIR_IS_ABSOLUTE
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(RELEASE \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" \"\" )
+ !!ELSE // CMAKE_STATIC_WINDOWS_BUILD
+     if (EXISTS
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}$${CMAKE_LIB_FILE_LOCATION_RELEASE}\"
+-!!ELSE
+         \"$${CMAKE_LIB_FILE_LOCATION_RELEASE}\"
+-!!ENDIF
+       AND EXISTS
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ELSE
+         \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ENDIF
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(RELEASE \"$${CMAKE_LIB_FILE_LOCATION_RELEASE}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+ !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
+     endif()
+@@ -346,11 +278,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-!!IF isEmpty(CMAKE_PLUGIN_DIR_IS_ABSOLUTE)
+-        set(imported_location \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
+-!!ELSE
+         set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
+-!!ENDIF
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/mac/default_post.prf b/mkspecs/features/mac/default_post.prf
+index 99f68b78f5..dde69cb7c2 100644
+--- a/mkspecs/features/mac/default_post.prf
++++ b/mkspecs/features/mac/default_post.prf
+@@ -63,199 +63,3 @@ qt {
+         }
+     }
+ }
+-
+-# Add the same default rpaths as Xcode does for new projects.
+-# This is especially important for iOS/tvOS/watchOS where no other option is possible.
+-!no_default_rpath {
+-    QMAKE_RPATHDIR += @executable_path/Frameworks
+-    equals(TEMPLATE, lib):!plugin:lib_bundle: QMAKE_RPATHDIR += @loader_path/Frameworks
+-}
+-
+-# Don't pass -headerpad_max_install_names when using Bitcode.
+-# In that case the linker emits a warning stating that the flag is ignored when
+-# used with bitcode, for reasons that cannot be determined (rdar://problem/20748962).
+-# Using this flag is also unnecessary in practice on UIKit platforms since they
+-# are sandboxed, and only UIKit platforms support bitcode to begin with.
+-!bitcode: QMAKE_LFLAGS += $$QMAKE_LFLAGS_HEADERPAD
+-
+-app_extension_api_only {
+-    QMAKE_CFLAGS              += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_CXXFLAGS            += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_CXXFLAGS_PRECOMPILE += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_LFLAGS              += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-}
+-
+-macx-xcode {
+-    qmake_pkginfo_typeinfo.name = QMAKE_PKGINFO_TYPEINFO
+-    !isEmpty(QMAKE_PKGINFO_TYPEINFO): \
+-        qmake_pkginfo_typeinfo.value = $$QMAKE_PKGINFO_TYPEINFO
+-    else: \
+-        qmake_pkginfo_typeinfo.value = "????"
+-    QMAKE_MAC_XCODE_SETTINGS += qmake_pkginfo_typeinfo
+-
+-    !isEmpty(VERSION) {
+-        l = $$split(VERSION, '.') 0 0  # make sure there are at least three
+-        VER_MAJ = $$member(l, 0, 0)
+-        VER_MIN = $$member(l, 1, 1)
+-        VER_PAT = $$member(l, 2, 2)
+-        unset(l)
+-
+-        qmake_full_version.name = QMAKE_FULL_VERSION
+-        qmake_full_version.value = $${VER_MAJ}.$${VER_MIN}.$${VER_PAT}
+-        QMAKE_MAC_XCODE_SETTINGS += qmake_full_version
+-
+-        qmake_short_version.name = QMAKE_SHORT_VERSION
+-        qmake_short_version.value = $${VER_MAJ}.$${VER_MIN}
+-        QMAKE_MAC_XCODE_SETTINGS += qmake_short_version
+-    }
+-
+-    !isEmpty(QMAKE_XCODE_DEBUG_INFORMATION_FORMAT) {
+-        debug_information_format.name = DEBUG_INFORMATION_FORMAT
+-        debug_information_format.value = $$QMAKE_XCODE_DEBUG_INFORMATION_FORMAT
+-        debug_information_format.build = debug
+-        QMAKE_MAC_XCODE_SETTINGS += debug_information_format
+-    }
+-
+-    QMAKE_XCODE_ARCHS =
+-
+-    arch_device.name = "ARCHS[sdk=$${device.sdk}*]"
+-    arch_device.value = $$QMAKE_APPLE_DEVICE_ARCHS
+-    QMAKE_XCODE_ARCHS += $$QMAKE_APPLE_DEVICE_ARCHS
+-    QMAKE_MAC_XCODE_SETTINGS += arch_device
+-
+-    simulator {
+-        arch_simulator.name = "ARCHS[sdk=$${simulator.sdk}*]"
+-        arch_simulator.value = $$QMAKE_APPLE_SIMULATOR_ARCHS
+-        QMAKE_XCODE_ARCHS += $$QMAKE_APPLE_SIMULATOR_ARCHS
+-        QMAKE_MAC_XCODE_SETTINGS += arch_simulator
+-    }
+-
+-    only_active_arch.name = ONLY_ACTIVE_ARCH
+-    only_active_arch.value = YES
+-    only_active_arch.build = debug
+-    QMAKE_MAC_XCODE_SETTINGS += only_active_arch
+-} else {
+-    device|!simulator: VALID_DEVICE_ARCHS = $$QMAKE_APPLE_DEVICE_ARCHS
+-    simulator: VALID_SIMULATOR_ARCHS = $$QMAKE_APPLE_SIMULATOR_ARCHS
+-    VALID_ARCHS = $$VALID_DEVICE_ARCHS $$VALID_SIMULATOR_ARCHS
+-
+-    isEmpty(VALID_ARCHS): \
+-        error("QMAKE_APPLE_DEVICE_ARCHS or QMAKE_APPLE_SIMULATOR_ARCHS must contain at least one architecture")
+-
+-    single_arch: VALID_ARCHS = $$first(VALID_ARCHS)
+-
+-    ACTIVE_ARCHS = $(filter $(EXPORT_VALID_ARCHS), $(ARCHS))
+-    ARCH_ARGS = $(foreach arch, $(if $(EXPORT_ACTIVE_ARCHS), $(EXPORT_ACTIVE_ARCHS), $(EXPORT_VALID_ARCHS)), -arch $(arch))
+-
+-    QMAKE_EXTRA_VARIABLES += VALID_ARCHS ACTIVE_ARCHS ARCH_ARGS
+-
+-    arch_flags = $(EXPORT_ARCH_ARGS)
+-
+-    QMAKE_CFLAGS += $$arch_flags
+-    QMAKE_CXXFLAGS += $$arch_flags
+-    QMAKE_LFLAGS += $$arch_flags
+-
+-    QMAKE_PCH_ARCHS = $$VALID_ARCHS
+-
+-    macos: deployment_target = $$QMAKE_MACOSX_DEPLOYMENT_TARGET
+-    ios: deployment_target = $$QMAKE_IOS_DEPLOYMENT_TARGET
+-    tvos: deployment_target = $$QMAKE_TVOS_DEPLOYMENT_TARGET
+-    watchos: deployment_target = $$QMAKE_WATCHOS_DEPLOYMENT_TARGET
+-
+-    # If we're doing a simulator and device build, device and simulator
+-    # architectures use different paths and flags for the sysroot and
+-    # deployment target switch, so we must multiplex them across multiple
+-    # architectures using -Xarch. Otherwise we fall back to the simple path.
+-    # This is not strictly necessary, but results in cleaner command lines
+-    # and makes it easier for people to override EXPORT_VALID_ARCHS to limit
+-    # individual rules to a different set of architecture(s) from the overall
+-    # build (such as machtest in QtCore).
+-    simulator:device {
+-        QMAKE_XARCH_CFLAGS =
+-        QMAKE_XARCH_LFLAGS =
+-        QMAKE_EXTRA_VARIABLES += QMAKE_XARCH_CFLAGS QMAKE_XARCH_LFLAGS
+-
+-        for (arch, VALID_ARCHS) {
+-            contains(VALID_SIMULATOR_ARCHS, $$arch) {
+-                sdk = $$simulator.sdk
+-                version_identifier = $$simulator.deployment_identifier
+-            } else {
+-                sdk = $$device.sdk
+-                version_identifier = $$device.deployment_identifier
+-            }
+-
+-            version_min_flags = \
+-                -Xarch_$${arch} \
+-                -m$${version_identifier}-version-min=$$deployment_target
+-            QMAKE_XARCH_CFLAGS_$${arch} = $$version_min_flags \
+-                -Xarch_$${arch} \
+-                -isysroot$$xcodeSDKInfo(Path, $$sdk)
+-            QMAKE_XARCH_LFLAGS_$${arch} = $$version_min_flags \
+-                -Xarch_$${arch} \
+-                -Wl,-syslibroot,$$xcodeSDKInfo(Path, $$sdk)
+-
+-            QMAKE_XARCH_CFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS_$${arch})
+-            QMAKE_XARCH_LFLAGS += $(EXPORT_QMAKE_XARCH_LFLAGS_$${arch})
+-
+-            QMAKE_EXTRA_VARIABLES += \
+-                QMAKE_XARCH_CFLAGS_$${arch} \
+-                QMAKE_XARCH_LFLAGS_$${arch}
+-        }
+-
+-        QMAKE_CFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS)
+-        QMAKE_CXXFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS)
+-        QMAKE_LFLAGS += $(EXPORT_QMAKE_XARCH_LFLAGS)
+-    } else {
+-        simulator: \
+-            version_identifier = $$simulator.deployment_identifier
+-        else: \
+-            version_identifier = $$device.deployment_identifier
+-        version_min_flag = -m$${version_identifier}-version-min=$$deployment_target
+-        QMAKE_CFLAGS += -isysroot $$QMAKE_MAC_SDK_PATH $$version_min_flag
+-        QMAKE_CXXFLAGS += -isysroot $$QMAKE_MAC_SDK_PATH $$version_min_flag
+-        QMAKE_LFLAGS += -Wl,-syslibroot,$$QMAKE_MAC_SDK_PATH $$version_min_flag
+-    }
+-
+-    # Enable precompiled headers for multiple architectures
+-    QMAKE_CFLAGS_USE_PRECOMPILE =
+-    for (arch, VALID_ARCHS) {
+-        icc_pch_style: \
+-            use_flag = "-pch-use "
+-        else: \
+-            use_flag = -include
+-
+-        # Only use Xarch with multi-arch, as the option confuses ccache
+-        count(VALID_ARCHS, 1, greaterThan): \
+-            QMAKE_CFLAGS_USE_PRECOMPILE += \
+-                -Xarch_$${arch}
+-
+-        QMAKE_CFLAGS_USE_PRECOMPILE += \
+-            $${use_flag}${QMAKE_PCH_OUTPUT_$${arch}}
+-    }
+-    icc_pch_style {
+-        QMAKE_CXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE -include ${QMAKE_PCH_INPUT}
+-        QMAKE_CFLAGS_USE_PRECOMPILE =
+-    } else {
+-        QMAKE_CXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-        QMAKE_OBJCFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-        QMAKE_OBJCXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-    }
+-
+-    QMAKE_PCH_OUTPUT_EXT = _${QMAKE_PCH_ARCH}$${QMAKE_PCH_OUTPUT_EXT}
+-}
+-
+-cache(QMAKE_XCODE_DEVELOPER_PATH, stash)
+-!isEmpty(QMAKE_XCODE_VERSION): \
+-    cache(QMAKE_XCODE_VERSION, stash)
+-
+-QMAKE_XCODE_LIBRARY_SUFFIX = $$qtPlatformTargetSuffix()
+-
+-xcode_product_bundle_identifier_setting.name = PRODUCT_BUNDLE_IDENTIFIER
+-xcode_product_bundle_identifier_setting.value = $$QMAKE_TARGET_BUNDLE_PREFIX
+-isEmpty(xcode_product_bundle_identifier_setting.value): \
+-    xcode_product_bundle_identifier_setting.value = "com.yourcompany"
+-xcode_product_bundle_target = $$QMAKE_BUNDLE
+-isEmpty(xcode_product_bundle_target): \
+-    xcode_product_bundle_target = ${PRODUCT_NAME:rfc1034identifier}
+-xcode_product_bundle_identifier_setting.value = "$${xcode_product_bundle_identifier_setting.value}.$${xcode_product_bundle_target}"
+-QMAKE_MAC_XCODE_SETTINGS += xcode_product_bundle_identifier_setting
+diff --git a/mkspecs/features/mac/default_pre.prf b/mkspecs/features/mac/default_pre.prf
+index e3534561a5..3b01424e67 100644
+--- a/mkspecs/features/mac/default_pre.prf
++++ b/mkspecs/features/mac/default_pre.prf
+@@ -1,60 +1,2 @@
+ CONFIG = asset_catalogs rez $$CONFIG
+ load(default_pre)
+-
+-isEmpty(QMAKE_XCODE_DEVELOPER_PATH) {
+-    # Get path of Xcode's Developer directory
+-    QMAKE_XCODE_DEVELOPER_PATH = $$system("/usr/bin/xcode-select --print-path 2>/dev/null")
+-    isEmpty(QMAKE_XCODE_DEVELOPER_PATH): \
+-        error("Xcode path is not set. Please use xcode-select to choose Xcode installation path.")
+-
+-    # Make sure Xcode path is valid
+-    !exists($$QMAKE_XCODE_DEVELOPER_PATH): \
+-        error("Xcode is not installed in $${QMAKE_XCODE_DEVELOPER_PATH}. Please use xcode-select to choose Xcode installation path.")
+-}
+-
+-isEmpty(QMAKE_XCODEBUILD_PATH): \
+-    QMAKE_XCODEBUILD_PATH = $$system("/usr/bin/xcrun -find xcodebuild 2>/dev/null")
+-
+-!isEmpty(QMAKE_XCODEBUILD_PATH) {
+-    # Make sure Xcode is set up properly
+-    !system("/usr/bin/xcrun xcodebuild -license check 2>/dev/null"): \
+-        error("Xcode not set up properly. You need to confirm the license agreement by running 'sudo xcrun xcodebuild -license accept'.")
+-
+-    isEmpty(QMAKE_XCODE_VERSION) {
+-        # Extract Xcode version using xcodebuild
+-        xcode_version = $$system("/usr/bin/xcrun xcodebuild -version")
+-        QMAKE_XCODE_VERSION = $$member(xcode_version, 1)
+-        isEmpty(QMAKE_XCODE_VERSION): error("Could not resolve Xcode version.")
+-        unset(xcode_version)
+-    }
+-}
+-
+-isEmpty(QMAKE_TARGET_BUNDLE_PREFIX) {
+-    QMAKE_XCODE_PREFERENCES_FILE = $$(HOME)/Library/Preferences/com.apple.dt.Xcode.plist
+-    exists($$QMAKE_XCODE_PREFERENCES_FILE): \
+-        QMAKE_TARGET_BUNDLE_PREFIX = $$system("/usr/libexec/PlistBuddy -c 'print IDETemplateOptions:bundleIdentifierPrefix' $$QMAKE_XCODE_PREFERENCES_FILE 2>/dev/null")
+-
+-    !isEmpty(_QMAKE_CACHE_):!isEmpty(QMAKE_TARGET_BUNDLE_PREFIX): \
+-        cache(QMAKE_TARGET_BUNDLE_PREFIX)
+-}
+-
+-QMAKE_ASSET_CATALOGS_APP_ICON = AppIcon
+-
+-# Make the default debug info format for static debug builds
+-# DWARF instead of DWARF with dSYM. This cuts down build times
+-# for application debug builds significantly, as Xcode doesn't
+-# have to pull out all the DWARF info from the Qt static libs
+-# and put it into a dSYM file. We don't need that dSYM file in
+-# the first place, since the information is available in the
+-# object files inside the archives (static libraries).
+-macx-xcode:qtConfig(static): \
+-    QMAKE_XCODE_DEBUG_INFORMATION_FORMAT = dwarf
+-
+-# This variable is used by the xcode_dynamic_library_suffix
+-# feature, which allows Xcode to choose the Qt libraries to link to
+-# at build time, depending on the current Xcode SDK and configuration.
+-QMAKE_XCODE_LIBRARY_SUFFIX_SETTING = QT_LIBRARY_SUFFIX
+-
+-xcode_copy_phase_strip_setting.name = COPY_PHASE_STRIP
+-xcode_copy_phase_strip_setting.value = NO
+-QMAKE_MAC_XCODE_SETTINGS += xcode_copy_phase_strip_setting
+diff --git a/mkspecs/features/mac/sdk.prf b/mkspecs/features/mac/sdk.prf
+index 8360dd8b38..8b13789179 100644
+--- a/mkspecs/features/mac/sdk.prf
++++ b/mkspecs/features/mac/sdk.prf
+@@ -1,58 +1 @@
+ 
+-isEmpty(QMAKE_MAC_SDK): \
+-    error("QMAKE_MAC_SDK must be set when using CONFIG += sdk.")
+-
+-contains(QMAKE_MAC_SDK, .*/.*): \
+-    error("QMAKE_MAC_SDK can only contain short-form SDK names (eg. macosx, iphoneos)")
+-
+-defineReplace(xcodeSDKInfo) {
+-    info = $$1
+-    equals(info, "Path"): \
+-        infoarg = --show-sdk-path
+-    equals(info, "PlatformPath"): \
+-        infoarg = --show-sdk-platform-path
+-    equals(info, "SDKVersion"): \
+-        infoarg = --show-sdk-version
+-    sdk = $$2
+-    isEmpty(sdk): \
+-        sdk = $$QMAKE_MAC_SDK
+-
+-    isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}) {
+-        QMAKE_MAC_SDK.$${sdk}.$${info} = $$system("/usr/bin/xcrun --sdk $$sdk $$infoarg 2>/dev/null")
+-        # --show-sdk-platform-path won't work for Command Line Tools; this is fine
+-        # only used by the XCTest backend to testlib
+-        isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}):if(!isEmpty(QMAKE_XCODEBUILD_PATH)|!equals(infoarg, "--show-sdk-platform-path")): \
+-            error("Could not resolve SDK $$info for \'$$sdk\' using $$infoarg")
+-        cache(QMAKE_MAC_SDK.$${sdk}.$${info}, set stash, QMAKE_MAC_SDK.$${sdk}.$${info})
+-    }
+-
+-    return($$eval(QMAKE_MAC_SDK.$${sdk}.$${info}))
+-}
+-
+-QMAKE_MAC_SDK_PATH = $$xcodeSDKInfo(Path)
+-QMAKE_MAC_SDK_PLATFORM_PATH = $$xcodeSDKInfo(PlatformPath)
+-QMAKE_MAC_SDK_VERSION = $$xcodeSDKInfo(SDKVersion)
+-
+-sysrootified =
+-for(val, QMAKE_INCDIR_OPENGL): sysrootified += $${QMAKE_MAC_SDK_PATH}$$val
+-QMAKE_INCDIR_OPENGL = $$sysrootified
+-
+-QMAKESPEC_NAME = $$basename(QMAKESPEC)
+-
+-# Resolve SDK version of various tools
+-for(tool, $$list(QMAKE_CC QMAKE_CXX QMAKE_FIX_RPATH QMAKE_AR QMAKE_RANLIB QMAKE_LINK QMAKE_LINK_SHLIB QMAKE_ACTOOL QMAKE_LINK_C QMAKE_LINK_C_SHLIB)) {
+-    tool_variable = QMAKE_MAC_SDK.$${QMAKESPEC_NAME}.$${QMAKE_MAC_SDK}.$${tool}
+-    !isEmpty($$tool_variable) {
+-        $$tool = $$eval($$tool_variable)
+-        next()
+-    }
+-
+-    value = $$eval($$tool)
+-    isEmpty(value): next()
+-
+-    sysrooted = $$system("/usr/bin/xcrun -sdk $$QMAKE_MAC_SDK -find $$first(value) 2>/dev/null")
+-    isEmpty(sysrooted): next()
+-
+-    $$tool = $$sysrooted $$member(value, 1, -1)
+-    cache($$tool_variable, set stash, $$tool)
+-}
+diff --git a/mkspecs/features/qml_module.prf b/mkspecs/features/qml_module.prf
+index 65212b2abf..accd4c07f0 100644
+--- a/mkspecs/features/qml_module.prf
++++ b/mkspecs/features/qml_module.prf
+@@ -52,7 +52,7 @@ qmldir.base = $$_PRO_FILE_PWD_
+ # Tools need qmldir and plugins.qmltypes always installed on the file system
+ qmldir.files = $$qmldir_file $$fq_aux_qml_files
+ install_qml_files: qmldir.files += $$fq_qml_files
+-qmldir.path = $$instbase/$$TARGETPATH
++qmldir.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ INSTALLS += qmldir
+ 
+ !debug_and_release|!build_all|CONFIG(release, debug|release) {
+diff --git a/mkspecs/features/qml_plugin.prf b/mkspecs/features/qml_plugin.prf
+index cd6377dcc6..e98bf98151 100644
+--- a/mkspecs/features/qml_plugin.prf
++++ b/mkspecs/features/qml_plugin.prf
+@@ -56,7 +56,7 @@ qml1_target {
+     instbase = $$[QT_INSTALL_QML]
+ }
+ 
+-target.path = $$instbase/$$TARGETPATH
++target.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ INSTALLS += target
+ 
+ # Some final setup
+diff --git a/mkspecs/features/qt_app.prf b/mkspecs/features/qt_app.prf
+index 8354f30eea..62028fef8e 100644
+--- a/mkspecs/features/qt_app.prf
++++ b/mkspecs/features/qt_app.prf
+@@ -30,7 +30,7 @@ host_build:force_bootstrap {
+     target.path = $$[QT_HOST_BINS]
+ } else {
+     !build_pass:qtConfig(debug_and_release): CONFIG += release
+-    target.path = $$[QT_INSTALL_BINS]
++    target.path = $$NIX_OUTPUT_BIN/bin
+     CONFIG += relative_qt_rpath  # Qt's tools and apps should be relocatable
+ }
+ INSTALLS += target
+diff --git a/mkspecs/features/qt_build_paths.prf b/mkspecs/features/qt_build_paths.prf
+index 3bb3823a8e..655b7b7db8 100644
+--- a/mkspecs/features/qt_build_paths.prf
++++ b/mkspecs/features/qt_build_paths.prf
+@@ -24,6 +24,6 @@ exists($$MODULE_BASE_INDIR/.git): \
+ !force_independent {
+     # If the module is not built independently, everything ends up in qtbase.
+     # This is the case in non-prefix builds, except for selected modules.
+-    MODULE_BASE_OUTDIR = $$[QT_HOST_PREFIX]
+-    MODULE_QMAKE_OUTDIR = $$[QT_HOST_PREFIX]
++    MODULE_BASE_OUTDIR = $$NIX_OUTPUT_OUT
++    MODULE_QMAKE_OUTDIR = $$NIX_OUTPUT_OUT
+ }
+diff --git a/mkspecs/features/qt_common.prf b/mkspecs/features/qt_common.prf
+index 4ad9946ae0..6d66f29c26 100644
+--- a/mkspecs/features/qt_common.prf
++++ b/mkspecs/features/qt_common.prf
+@@ -34,8 +34,8 @@ contains(TEMPLATE, .*lib) {
+         qqt_libdir = \$\$\$\$[QT_HOST_LIBS]
+         qt_libdir = $$[QT_HOST_LIBS]
+     } else {
+-        qqt_libdir = \$\$\$\$[QT_INSTALL_LIBS]
+-        qt_libdir = $$[QT_INSTALL_LIBS]
++        qqt_libdir = \$\$\$\$NIX_OUTPUT_OUT/lib
++        qt_libdir = $$NIX_OUTPUT_OUT/lib
+     }
+     contains(QMAKE_DEFAULT_LIBDIRS, $$qt_libdir) {
+         lib_replace.match = "[^ ']*$$rplbase/lib"
+diff --git a/mkspecs/features/qt_docs.prf b/mkspecs/features/qt_docs.prf
+index 3139c443c6..1b4f2fddd8 100644
+--- a/mkspecs/features/qt_docs.prf
++++ b/mkspecs/features/qt_docs.prf
+@@ -45,7 +45,7 @@ QMAKE_DOCS_OUTPUTDIR = $$QMAKE_DOCS_BASE_OUTDIR/$$QMAKE_DOCS_TARGETDIR
+ 
+ QDOC += -outputdir $$shell_quote($$QMAKE_DOCS_OUTPUTDIR)
+ !build_online_docs: \
+-    QDOC += -installdir $$shell_quote($$[QT_INSTALL_DOCS])
++    QDOC += -installdir $$shell_quote($$NIX_OUTPUT_DOC)
+ PREP_DOC_INDEXES =
+ DOC_INDEXES =
+ !isEmpty(QTREPOS) {
+@@ -64,8 +64,8 @@ DOC_INDEXES =
+         DOC_INDEXES += -indexdir $$shell_quote($$qrep/doc)
+ } else {
+     prepare_docs: \
+-        PREP_DOC_INDEXES += -indexdir $$shell_quote($$[QT_INSTALL_DOCS/get])
+-    DOC_INDEXES += -indexdir $$shell_quote($$[QT_INSTALL_DOCS/get])
++        PREP_DOC_INDEXES += -indexdir $$shell_quote($$NIX_OUTPUT_DOC)
++    DOC_INDEXES += -indexdir $$shell_quote($$NIX_OUTPUT_DOC)
+ }
+ 
+ qtattributionsscanner.target = qtattributionsscanner
+@@ -88,12 +88,12 @@ prepare_docs {
+     qch_docs.commands = $$QHELPGENERATOR $$shell_quote($$QMAKE_DOCS_OUTPUTDIR/$${QMAKE_DOCS_TARGET}.qhp) -o $$shell_quote($$QMAKE_DOCS_BASE_OUTDIR/$${QMAKE_DOCS_TARGET}.qch)
+ 
+     inst_html_docs.files = $$QMAKE_DOCS_OUTPUTDIR
+-    inst_html_docs.path = $$[QT_INSTALL_DOCS]
++    inst_html_docs.path = $$NIX_OUTPUT_DOC
+     inst_html_docs.CONFIG += no_check_exist directory no_default_install no_build
+     INSTALLS += inst_html_docs
+ 
+     inst_qch_docs.files = $$QMAKE_DOCS_BASE_OUTDIR/$${QMAKE_DOCS_TARGET}.qch
+-    inst_qch_docs.path = $$[QT_INSTALL_DOCS]
++    inst_qch_docs.path = $$NIX_OUTPUT_DOC
+     inst_qch_docs.CONFIG += no_check_exist no_default_install no_build
+     INSTALLS += inst_qch_docs
+ 
+diff --git a/mkspecs/features/qt_example_installs.prf b/mkspecs/features/qt_example_installs.prf
+index 43b58817fe..e635b8f67a 100644
+--- a/mkspecs/features/qt_example_installs.prf
++++ b/mkspecs/features/qt_example_installs.prf
+@@ -88,7 +88,7 @@ sourcefiles += \
+     $$SOURCES $$HEADERS $$FORMS $$RESOURCES $$TRANSLATIONS \
+     $$DBUS_ADAPTORS $$DBUS_INTERFACES
+ addInstallFiles(sources.files, $$sourcefiles)
+-sources.path = $$[QT_INSTALL_EXAMPLES]/$$probase
++sources.path = $$NIX_OUTPUT_DEV/share/examples/$$probase
+ INSTALLS += sources
+ 
+ check_examples {
+diff --git a/mkspecs/features/qt_functions.prf b/mkspecs/features/qt_functions.prf
+index 1903e509c8..ae7b585989 100644
+--- a/mkspecs/features/qt_functions.prf
++++ b/mkspecs/features/qt_functions.prf
+@@ -69,7 +69,7 @@ defineTest(qtHaveModule) {
+ defineTest(qtPrepareTool) {
+     cmd = $$eval(QT_TOOL.$${2}.binary)
+     isEmpty(cmd) {
+-        cmd = $$[QT_HOST_BINS]/$$2
++        cmd = $$system("command -v $$2")
+         exists($${cmd}.pl) {
+             $${1}_EXE = $${cmd}.pl
+             cmd = perl -w $$system_path($${cmd}.pl)
+diff --git a/mkspecs/features/qt_installs.prf b/mkspecs/features/qt_installs.prf
+index 8f98987b99..21b3bb8b32 100644
+--- a/mkspecs/features/qt_installs.prf
++++ b/mkspecs/features/qt_installs.prf
+@@ -12,16 +12,10 @@
+ #library
+ !qt_no_install_library {
+     win32 {
+-       host_build: \
+-           dlltarget.path = $$[QT_HOST_BINS]
+-       else: \
+-           dlltarget.path = $$[QT_INSTALL_BINS]
++        dlltarget.path = $$NIX_OUTPUT_BIN/bin
+        INSTALLS += dlltarget
+     }
+-    host_build: \
+-        target.path = $$[QT_HOST_LIBS]
+-    else: \
+-        target.path = $$[QT_INSTALL_LIBS]
++    target.path = $$NIX_OUTPUT_OUT/lib
+     !static: target.CONFIG = no_dll
+     INSTALLS += target
+ }
+@@ -29,33 +23,33 @@
+ #headers
+ qt_install_headers {
+     gen_headers.files = $$SYNCQT.GENERATED_HEADER_FILES
+-    gen_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME
++    gen_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME
+     INSTALLS += gen_headers
+ 
+     targ_headers.files = $$SYNCQT.HEADER_FILES $$SYNCQT.INJECTED_HEADER_FILES
+-    targ_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME
++    targ_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME
+     INSTALLS += targ_headers
+ 
+     private_headers.files = $$SYNCQT.PRIVATE_HEADER_FILES $$SYNCQT.INJECTED_PRIVATE_HEADER_FILES
+-    private_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
++    private_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
+     INSTALLS += private_headers
+ 
+     qpa_headers.files = $$SYNCQT.QPA_HEADER_FILES
+-    qpa_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/qpa
++    qpa_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/qpa
+     INSTALLS += qpa_headers
+ }
+ 
+ #module
+ qt_install_module {
+     !isEmpty(MODULE_PRI) {
+-        pritarget.path = $$[QT_HOST_DATA]/mkspecs/modules
++        pritarget.path = $$NIX_OUTPUT_DEV/mkspecs/modules
+         pritarget.files = $$MODULE_PRI
+         INSTALLS += pritarget
+     } else: isEmpty(MODULE_PRIVATE_PRI) {
+         warning("Project $$basename(_PRO_FILE_) is a module, but has not defined MODULE_PRI, which is required for Qt to expose the module to other projects.")
+     }
+     !isEmpty(MODULE_PRIVATE_PRI) {
+-        privpritarget.path = $$[QT_HOST_DATA]/mkspecs/modules
++        privpritarget.path = $$NIX_OUTPUT_DEV/mkspecs/modules
+         privpritarget.files = $$MODULE_PRIVATE_PRI
+         INSTALLS += privpritarget
+     }
+diff --git a/mkspecs/features/qt_plugin.prf b/mkspecs/features/qt_plugin.prf
+index 40528a65e2..903f795284 100644
+--- a/mkspecs/features/qt_plugin.prf
++++ b/mkspecs/features/qt_plugin.prf
+@@ -88,7 +88,7 @@ CONFIG(static, static|shared)|prefix_build {
+     }
+ }
+ 
+-target.path = $$[QT_INSTALL_PLUGINS]/$$PLUGIN_TYPE
++target.path = $$NIX_OUTPUT_PLUGIN/$$PLUGIN_TYPE
+ INSTALLS += target
+ 
+ TARGET = $$qt5LibraryTarget($$TARGET)
+diff --git a/src/corelib/Qt5CoreConfigExtras.cmake.in b/src/corelib/Qt5CoreConfigExtras.cmake.in
+index e0652fdcf9..450b2a2d28 100644
+--- a/src/corelib/Qt5CoreConfigExtras.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::qmake)
+     add_executable(Qt5::qmake IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -18,7 +18,7 @@ if (NOT TARGET Qt5::moc)
+     add_executable(Qt5::moc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -35,7 +35,7 @@ if (NOT TARGET Qt5::rcc)
+     add_executable(Qt5::rcc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -116,7 +116,7 @@ if (NOT TARGET Qt5::WinMain)
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ENDIF
+@@ -130,7 +130,7 @@ if (NOT TARGET Qt5::WinMain)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
+ 
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+index c357237d0e..6f0c75de3c 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_HOST_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_HOST_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+index 706304cf34..546420f6ad 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_INSTALL_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_INSTALL_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/kernel/qcoreapplication.cpp b/src/corelib/kernel/qcoreapplication.cpp
+index 463e30e1c3..0e1ab669e4 100644
+--- a/src/corelib/kernel/qcoreapplication.cpp
++++ b/src/corelib/kernel/qcoreapplication.cpp
+@@ -2665,6 +2665,15 @@ QStringList QCoreApplication::libraryPaths()
+         QStringList *app_libpaths = new QStringList;
+         coreappdata()->app_libpaths.reset(app_libpaths);
+ 
++        // Add library paths derived from PATH
++        const QStringList paths = QFile::decodeName(qgetenv("PATH")).split(':');
++        const QString plugindir = QStringLiteral("../" NIXPKGS_QT_PLUGIN_PREFIX);
++        for (const QString &path: paths) {
++            if (!path.isEmpty()) {
++                app_libpaths->append(QDir::cleanPath(path + QDir::separator() + plugindir));
++            }
++        }
++
+         const QByteArray libPathEnv = qgetenv("QT_PLUGIN_PATH");
+         if (!libPathEnv.isEmpty()) {
+             QStringList paths = QFile::decodeName(libPathEnv).split(QDir::listSeparator(), QString::SkipEmptyParts);
+diff --git a/src/corelib/tools/qtimezoneprivate_tz.cpp b/src/corelib/tools/qtimezoneprivate_tz.cpp
+index bed62a02bd..73158993f7 100644
+--- a/src/corelib/tools/qtimezoneprivate_tz.cpp
++++ b/src/corelib/tools/qtimezoneprivate_tz.cpp
+@@ -70,7 +70,11 @@ typedef QHash<QByteArray, QTzTimeZone> QTzTimeZoneHash;
+ // Parse zone.tab table, assume lists all installed zones, if not will need to read directories
+ static QTzTimeZoneHash loadTzTimeZones()
+ {
+-    QString path = QStringLiteral("/usr/share/zoneinfo/zone.tab");
++    // Try TZDIR first, in case we're running on NixOS.
++    QString path = QFile::decodeName(qgetenv("TZDIR")) + QStringLiteral("/zone.tab");
++    // Fallback to traditional paths in case we are not on NixOS.
++    if (!QFile::exists(path))
++        path = QStringLiteral("/usr/share/zoneinfo/zone.tab");
+     if (!QFile::exists(path))
+         path = QStringLiteral("/usr/lib/zoneinfo/zone.tab");
+ 
+@@ -644,12 +648,16 @@ void QTzTimeZonePrivate::init(const QByteArray &ianaId)
+         if (!tzif.open(QIODevice::ReadOnly))
+             return;
+     } else {
+-        // Open named tz, try modern path first, if fails try legacy path
+-        tzif.setFileName(QLatin1String("/usr/share/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++        // Try TZDIR first, in case we're running on NixOS
++        tzif.setFileName(QFile::decodeName(qgetenv("TZDIR")) + QStringLiteral("/") + QString::fromLocal8Bit(ianaId));
+         if (!tzif.open(QIODevice::ReadOnly)) {
+-            tzif.setFileName(QLatin1String("/usr/lib/zoneinfo/") + QString::fromLocal8Bit(ianaId));
+-            if (!tzif.open(QIODevice::ReadOnly))
+-                return;
++            // Open named tz, try modern path first, if fails try legacy path
++            tzif.setFileName(QLatin1String("/usr/share/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++            if (!tzif.open(QIODevice::ReadOnly)) {
++                tzif.setFileName(QLatin1String("/usr/lib/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++                if (!tzif.open(QIODevice::ReadOnly))
++                    return;
++            }
+         }
+     }
+ 
+diff --git a/src/dbus/Qt5DBusConfigExtras.cmake.in b/src/dbus/Qt5DBusConfigExtras.cmake.in
+index 1d947159e2..b36865fc48 100644
+--- a/src/dbus/Qt5DBusConfigExtras.cmake.in
++++ b/src/dbus/Qt5DBusConfigExtras.cmake.in
+@@ -2,11 +2,7 @@
+ if (NOT TARGET Qt5::qdbuscpp2xml)
+     add_executable(Qt5::qdbuscpp2xml IMPORTED)
+ 
+-!!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5DBus_install_prefix}/$${CMAKE_BIN_DIR}qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+-!!ELSE
+-    set(imported_location \"$${CMAKE_BIN_DIR}qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+-!!ENDIF
++    set(imported_location \"$$NIX_OUTPUT_DEV/bin/qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+     _qt5_DBus_check_file_exists(${imported_location})
+ 
+     set_target_properties(Qt5::qdbuscpp2xml PROPERTIES
+@@ -17,11 +13,7 @@ endif()
+ if (NOT TARGET Qt5::qdbusxml2cpp)
+     add_executable(Qt5::qdbusxml2cpp IMPORTED)
+ 
+-!!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5DBus_install_prefix}/$${CMAKE_BIN_DIR}qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+-!!ELSE
+-    set(imported_location \"$${CMAKE_BIN_DIR}qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+-!!ENDIF
++    set(imported_location \"$$NIX_OUTPUT_DEV/bin/qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+     _qt5_DBus_check_file_exists(${imported_location})
+ 
+     set_target_properties(Qt5::qdbusxml2cpp PROPERTIES
+diff --git a/src/gui/Qt5GuiConfigExtras.cmake.in b/src/gui/Qt5GuiConfigExtras.cmake.in
+index 07869efd7d..fb4183bada 100644
+--- a/src/gui/Qt5GuiConfigExtras.cmake.in
++++ b/src/gui/Qt5GuiConfigExtras.cmake.in
+@@ -2,7 +2,7 @@
+ !!IF !isEmpty(CMAKE_ANGLE_EGL_DLL_RELEASE)
+ 
+ !!IF isEmpty(CMAKE_INCLUDE_DIR_IS_ABSOLUTE)
+-set(Qt5Gui_EGL_INCLUDE_DIRS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$$CMAKE_INCLUDE_DIR/QtANGLE\")
++set(Qt5Gui_EGL_INCLUDE_DIRS \"$$NIX_OUTPUT_DEV/$$CMAKE_INCLUDE_DIR/QtANGLE\")
+ !!ELSE
+ set(Qt5Gui_EGL_INCLUDE_DIRS \"$$CMAKE_INCLUDE_DIR/QtANGLE\")
+ !!ENDIF
+@@ -17,13 +17,13 @@ macro(_populate_qt5gui_gl_target_properties TargetName Configuration LIB_LOCATIO
+     set_property(TARGET Qt5::${TargetName} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+ !!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Gui_install_prefix}/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
++    set(imported_location \"$$NIX_OUTPUT_OUT/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+ !!ENDIF
+ 
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_implib \"${_qt5Gui_install_prefix}/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
++    set(imported_implib \"$$NIX_OUTPUT_OUT/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+ !!ELSE
+     set(imported_implib \"$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+ !!ENDIF
+diff --git a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+index b5a0a5bbeb..6c20305f4d 100644
+--- a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
++++ b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+@@ -265,12 +265,9 @@ void TableGenerator::initPossibleLocations()
+     m_possibleLocations.reserve(7);
+     if (qEnvironmentVariableIsSet("QTCOMPOSE"))
+         m_possibleLocations.append(QString::fromLocal8Bit(qgetenv("QTCOMPOSE")));
+-    m_possibleLocations.append(QStringLiteral("/usr/share/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/local/share/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/lib/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/local/lib/X11/locale"));
+     m_possibleLocations.append(QStringLiteral(X11_PREFIX "/share/X11/locale"));
+     m_possibleLocations.append(QStringLiteral(X11_PREFIX "/lib/X11/locale"));
++    m_possibleLocations.append(QLatin1String(NIXPKGS_QTCOMPOSE));
+ }
+ 
+ QString TableGenerator::findComposeFile()
+diff --git a/src/plugins/platforms/xcb/qxcbcursor.cpp b/src/plugins/platforms/xcb/qxcbcursor.cpp
+index 57629ac03a..8a7f219a98 100644
+--- a/src/plugins/platforms/xcb/qxcbcursor.cpp
++++ b/src/plugins/platforms/xcb/qxcbcursor.cpp
+@@ -316,10 +316,10 @@ QXcbCursor::QXcbCursor(QXcbConnection *conn, QXcbScreen *screen)
+ #if QT_CONFIG(xcb_xlib) && QT_CONFIG(library)
+     static bool function_ptrs_not_initialized = true;
+     if (function_ptrs_not_initialized) {
+-        QLibrary xcursorLib(QLatin1String("Xcursor"), 1);
++        QLibrary xcursorLib(QLatin1String(NIXPKGS_LIBXCURSOR), 1);
+         bool xcursorFound = xcursorLib.load();
+         if (!xcursorFound) { // try without the version number
+-            xcursorLib.setFileName(QLatin1String("Xcursor"));
++            xcursorLib.setFileName(QLatin1String(NIXPKGS_LIBXCURSOR));
+             xcursorFound = xcursorLib.load();
+         }
+         if (xcursorFound) {
+diff --git a/src/plugins/platformthemes/gtk3/main.cpp b/src/plugins/platformthemes/gtk3/main.cpp
+index fb1c425d8e..bb8bab9795 100644
+--- a/src/plugins/platformthemes/gtk3/main.cpp
++++ b/src/plugins/platformthemes/gtk3/main.cpp
+@@ -39,6 +39,7 @@
+ 
+ #include <qpa/qplatformthemeplugin.h>
+ #include "qgtk3theme.h"
++#include <QFile>
+ 
+ QT_BEGIN_NAMESPACE
+ 
+@@ -54,8 +55,22 @@ public:
+ QPlatformTheme *QGtk3ThemePlugin::create(const QString &key, const QStringList &params)
+ {
+     Q_UNUSED(params);
+-    if (!key.compare(QLatin1String(QGtk3Theme::name), Qt::CaseInsensitive))
++    if (!key.compare(QLatin1String(QGtk3Theme::name), Qt::CaseInsensitive)) {
++
++#ifdef NIXPKGS_QGTK3_XDG_DATA_DIRS
++        QStringList XDG_DATA_DIRS = QFile::decodeName(qgetenv("XDG_DATA_DIRS")).split(':');
++        XDG_DATA_DIRS << QLatin1String(NIXPKGS_QGTK3_XDG_DATA_DIRS);
++        qputenv("XDG_DATA_DIRS", QFile::encodeName(XDG_DATA_DIRS.join(':')));
++#endif
++
++#ifdef NIXPKGS_QGTK3_GIO_EXTRA_MODULES
++        QStringList GIO_EXTRA_MODULES = QFile::decodeName(qgetenv("GIO_EXTRA_MODULES")).split(':');
++        GIO_EXTRA_MODULES << QLatin1String(NIXPKGS_QGTK3_GIO_EXTRA_MODULES);
++        qputenv("GIO_EXTRA_MODULES", QFile::encodeName(GIO_EXTRA_MODULES.join(':')));
++#endif
++
+         return new QGtk3Theme;
++    }
+ 
+     return 0;
+ }
+diff --git a/src/testlib/qtestassert.h b/src/testlib/qtestassert.h
+index 6498ea84ef..d821ced7fc 100644
+--- a/src/testlib/qtestassert.h
++++ b/src/testlib/qtestassert.h
+@@ -44,10 +44,13 @@
+ 
+ QT_BEGIN_NAMESPACE
+ 
+-
++#if defined(QT_NO_DEBUG) && !defined(QT_FORCE_ASSERTS)
++#define QTEST_ASSERT(cond) do { } while ((false) && (cond))
++#define QTEST_ASSERT_X(cond, where, what) do { } while ((false) && (cond))
++#else
+ #define QTEST_ASSERT(cond) do { if (!(cond)) qt_assert(#cond,__FILE__,__LINE__); } while (false)
+-
+ #define QTEST_ASSERT_X(cond, where, what) do { if (!(cond)) qt_assert_x(where, what,__FILE__,__LINE__); } while (false)
++#endif
+ 
+ QT_END_NAMESPACE
+ 
+diff --git a/src/widgets/Qt5WidgetsConfigExtras.cmake.in b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+index 99d87e2e46..a4eab2aa72 100644
+--- a/src/widgets/Qt5WidgetsConfigExtras.cmake.in
++++ b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::uic)
+     add_executable(Qt5::uic IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Widgets_install_prefix}/$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
diff --git a/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch b/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch
new file mode 100644
index 000000000000..8f5b5d4790fb
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch
@@ -0,0 +1,33 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 005db4248..685c5b1b2 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1760,6 +1760,15 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     QString installImportsPath =  QLibraryInfo::location(QLibraryInfo::Qml2ImportsPath);
+     addImportPath(installImportsPath);
+ 
++    // Add import paths derived from PATH
++    const QStringList paths = QFile::decodeName(qgetenv("PATH")).split(':');
++    const QString qmldir = QStringLiteral("../" NIXPKGS_QML2_IMPORT_PREFIX);
++    for (const QString &path: paths) {
++        if (!path.isEmpty()) {
++            addImportPath(QDir::cleanPath(path + QDir::separator() + qmldir));
++        }
++    }
++
+     // env import paths
+     if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty("QML2_IMPORT_PATH"))) {
+         const QString envImportPath = qEnvironmentVariable("QML2_IMPORT_PATH");
+diff --git a/tools/qmlcachegen/qmlcache.prf b/tools/qmlcachegen/qmlcache.prf
+index 537eaf62e..e21de58f6 100644
+--- a/tools/qmlcachegen/qmlcache.prf
++++ b/tools/qmlcachegen/qmlcache.prf
+@@ -26,7 +26,7 @@ defineReplace(qmlCacheOutputFileName) {
+ }
+ 
+ qmlcacheinst.base = $$QMLCACHE_DESTDIR
+-qmlcacheinst.path = $$[QT_INSTALL_QML]/$$TARGETPATH
++qmlcacheinst.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ qmlcacheinst.CONFIG = no_check_exist
+ 
+ qmlcachegen.input = CACHEGEN_FILES
diff --git a/pkgs/development/libraries/qt-5/5.12/qtscript.patch b/pkgs/development/libraries/qt-5/5.12/qtscript.patch
new file mode 100644
index 000000000000..5508dec1280e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtscript.patch
@@ -0,0 +1,13 @@
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
+index 1f6d25e..087c3fb 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
+@@ -81,7 +81,7 @@
+ #include <pthread.h>
+ #elif PLATFORM(GTK)
+ #include <wtf/gtk/GOwnPtr.h>
+-typedef struct _GMutex GMutex;
++typedef union _GMutex GMutex;
+ typedef struct _GCond GCond;
+ #endif
+ 
diff --git a/pkgs/development/libraries/qt-5/5.12/qtserialport.patch b/pkgs/development/libraries/qt-5/5.12/qtserialport.patch
new file mode 100644
index 000000000000..f25524e80bcf
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtserialport.patch
@@ -0,0 +1,22 @@
+diff --git a/src/serialport/qtudev_p.h b/src/serialport/qtudev_p.h
+index af2dab2..8e17f64 100644
+--- a/src/serialport/qtudev_p.h
++++ b/src/serialport/qtudev_p.h
+@@ -111,9 +111,17 @@ inline QFunctionPointer resolveSymbol(QLibrary *udevLibrary, const char *symbolN
+ inline bool resolveSymbols(QLibrary *udevLibrary)
+ {
+     if (!udevLibrary->isLoaded()) {
++#ifdef NIXPKGS_LIBUDEV
++        udevLibrary->setFileNameAndVersion(QLatin1String(NIXPKGS_LIBUDEV), 1);
++#else
+         udevLibrary->setFileNameAndVersion(QStringLiteral("udev"), 1);
++#endif
+         if (!udevLibrary->load()) {
++#ifdef NIXPKGS_LIBUDEV
++            udevLibrary->setFileNameAndVersion(QLatin1String(NIXPKGS_LIBUDEV), 0);
++#else
+             udevLibrary->setFileNameAndVersion(QStringLiteral("udev"), 0);
++#endif
+             if (!udevLibrary->load()) {
+                 qWarning("Failed to load the library: %s, supported version(s): %i and %i", qPrintable(udevLibrary->fileName()), 1, 0);
+                 return false;
diff --git a/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch b/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch
new file mode 100644
index 000000000000..b94a4b76cbab
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch
@@ -0,0 +1,12 @@
+diff --git a/Source/WebKit2/PlatformQt.cmake b/Source/WebKit2/PlatformQt.cmake
+--- a/Source/WebKit2/PlatformQt.cmake
++++ b/Source/WebKit2/PlatformQt.cmake
+@@ -261,6 +261,7 @@
+ list(APPEND WebKit2_SYSTEM_INCLUDE_DIRECTORIES
+     ${GLIB_INCLUDE_DIRS}
+     ${GSTREAMER_INCLUDE_DIRS}
++    ${GSTREAMER_PBUTILS_INCLUDE_DIRS}
+     ${Qt5Quick_INCLUDE_DIRS}
+     ${Qt5Quick_PRIVATE_INCLUDE_DIRS}
+     ${SQLITE_INCLUDE_DIR}
+
diff --git a/pkgs/development/libraries/qt-5/5.12/srcs.nix b/pkgs/development/libraries/qt-5/5.12/srcs.nix
new file mode 100644
index 000000000000..d83edc97e94f
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/srcs.nix
@@ -0,0 +1,325 @@
+# DO NOT EDIT! This file is generated automatically by fetch-kde-qt.sh
+{ fetchurl, mirror }:
+
+{
+  qt3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qt3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nii8qz8791ripmqd158qah40j2dj50zn7lmqksqz8gz2jfdqam1";
+      name = "qt3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtactiveqt = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtactiveqt-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gkdx3mc6ysqlf0ci77kf9c961dc9sbi4j3z5q237d1w4js7ca52";
+      name = "qtactiveqt-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtandroidextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtandroidextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0s083ngvya8bknp0bvgb3hyk6zr8shg8rmkzn98956dqz0xs3agm";
+      name = "qtandroidextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtbase = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtbase-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1jzfx8c0hzch0kmz2m4vkn65s7ikiymnm29lsymil4hfg0fj40sy";
+      name = "qtbase-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtcanvas3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcanvas3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0a61z5amp409aq9v7j0fyk003fbz2i247idl7lgfbl4qqh0ry6xj";
+      name = "qtcanvas3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtcharts = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcharts-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0l6lrrwqbqaf6agsghaw4ysm2vb6b4n9j5lgrs1i0q8h9i51rmww";
+      name = "qtcharts-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtconnectivity = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtconnectivity-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1912a4my72wcqmmdyj24wkwq9p9ih4gzzzvgiq75pfwyhnxa3g4f";
+      name = "qtconnectivity-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdatavis3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdatavis3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0czlj088gf2r6w5ahh0p8n36lbwmds86mxqijshmhzax5cspxnjf";
+      name = "qtdatavis3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdeclarative = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdeclarative-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0yr29hm3bqlwxcmna0bzyxw8k4hw3x8k3k4iiw2sw52p5c85izag";
+      name = "qtdeclarative-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdoc = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdoc-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1k8caa1nmc9nrhb29vq1qzaz608klnjxy509w6ppxlzz2zbpcr9h";
+      name = "qtdoc-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtgamepad = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgamepad-everywhere-src-5.12.0.tar.xz";
+      sha256 = "14b0np15gm5lzvip33pg6w9dfs065wwdfz18na28bhbxj6wh06ac";
+      name = "qtgamepad-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtgraphicaleffects = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0m9l031zhw8il66ld8bj1lwqlc2xx89nl6dvssz1kl2d5nqqy1c1";
+      name = "qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtimageformats = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtimageformats-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bkkk5skpplwfbqv7g41rhgynyxs3khvf8gk2rl2gdixdplpv42z";
+      name = "qtimageformats-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtlocation = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtlocation-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0ja4cwj59y1xhwwf4f5gzr0fdrrsxbh14g2x812n03x0yd6i78xh";
+      name = "qtlocation-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtmacextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmacextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "00xhkj66i3srwmzzin1mcx9m94l5ns08f93c1za3wl23ani7n2nr";
+      name = "qtmacextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtmultimedia = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmultimedia-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a96x6c2w9rs6vfsdcnzmmad4w32dxy2dvismldcwmwcq2whqjsw";
+      name = "qtmultimedia-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtnetworkauth = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtnetworkauth-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0x877ra8375pf8d8p6hgdkyw8yzjqfca6rgki6vi1q8fyi31j4a1";
+      name = "qtnetworkauth-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtpurchasing = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtpurchasing-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nk0dp247v1rfbnj84g99zsj6iv86pq32f478r92adz9qcgfs2yr";
+      name = "qtpurchasing-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtquickcontrols = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0wyd24aphpixi3k9vbxw73z3dy1xnf8hwc99wimr5mpf1cj67yrb";
+      name = "qtquickcontrols-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtquickcontrols2 = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1ikxj32rd9pipnrz81l5ln700lnw8w6bx573w01x424sx0p7wxw9";
+      name = "qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtremoteobjects = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtremoteobjects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0pwx2m17yw1qqv8qigfndgj1yd5kq8w5cbiaqlw4zdk1m6jd0h09";
+      name = "qtremoteobjects-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtscript = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscript-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a7ziipvy8cfmrpw2b868167sw21zrqhfv2la0w9vs6hwli1mzlp";
+      name = "qtscript-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtscxml = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscxml-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0syx3bx9pxxrsxanfv245ifppjhbj7sbrndh8il86xlrcr9cwvnw";
+      name = "qtscxml-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtsensors = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsensors-everywhere-src-5.12.0.tar.xz";
+      sha256 = "19n5vlx0j5a0h86mpgs86qzsxbyq8fcrls7yqnjdaw0zga234cf5";
+      name = "qtsensors-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtserialbus = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialbus-everywhere-src-5.12.0.tar.xz";
+      sha256 = "16imi82v17n18a5m0i2fcfj6hqdpnzn2z9kdcf6a8h93fv4qd4kb";
+      name = "qtserialbus-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtserialport = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialport-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1fx9fm0418jq05j2hlb52lblq8nr4m0hj8sizi86p708jmb01m2r";
+      name = "qtserialport-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtspeech = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtspeech-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1yx4wahl7iaj6lgpvnw8pdi2q4wc2fkpzfidd3j1bc98wpna4f8r";
+      name = "qtspeech-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtsvg = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsvg-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1kpvqd0p7dblgh26p3a99npqr0wmyg5yv0dcmf78ssrvsy58vrpb";
+      name = "qtsvg-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qttools = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttools-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1hyschrj568h65m3kl35xqz25hpk61vr98r08375vkavdr5y6k2p";
+      name = "qttools-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qttranslations = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttranslations-everywhere-src-5.12.0.tar.xz";
+      sha256 = "023m68vdjj75xnbpc1jflyg85amnjc9i6nwv650k0w4n1dp1hksv";
+      name = "qttranslations-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtvirtualkeyboard = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nnns0i577zda6qxxd7pxcy06dq0y7lnni8ghn4adh9yl6dvi4yv";
+      name = "qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwayland = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwayland-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1mvyv4wkcxj4h3q0mqw53zb1d0pahf8mz3r29kckadvk64djsp2m";
+      name = "qtwayland-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebchannel = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebchannel-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1w2b31d7xjzdcgwkb4mz3qrl9ci7c9l4c3v4h8y59isip45g66l5";
+      name = "qtwebchannel-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebengine = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebengine-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0z38ad25n7ckylxnmqrxy95ds4pn7i5k7qxh856zgq1h18wiwn5x";
+      name = "qtwebengine-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebglplugin = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebglplugin-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bk5dg33kn2l5lmgd6slsrs9xg15x9h9li91lr1q7qs67b8kl8k5";
+      name = "qtwebglplugin-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebsockets = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebsockets-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gzwfjnlgcijym5bn9gi93qlvzizrhf1q9dq06576419sg0s2ka4";
+      name = "qtwebsockets-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebview = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebview-everywhere-src-5.12.0.tar.xz";
+      sha256 = "11b16b31bxcazqzg1ag9rzh4gj9pif2cf3jz2mj1sdprxp22ra5p";
+      name = "qtwebview-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwinextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwinextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1l6s140vrfxb9ar4p1dq9w2gfk3zvgrpqdxbbzs4ngfpwk6mlky6";
+      name = "qtwinextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtx11extras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtx11extras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "114b4akzpcgx57c6gkl558bl0mbasi34r22fmq3ny84dhvlv9m06";
+      name = "qtx11extras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtxmlpatterns = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0xckcw1j6f5l92c269pb8cx77d21sghp7m7dc05jl1dqmyy7jqpk";
+      name = "qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+}
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index ad54a49e50b7..71ecde66a1f3 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -42,9 +42,8 @@ qtModule {
       ( cd src/3rdparty/chromium; patchShebangs . )
     ''
     # Patch Chromium build files
-    + ''
-      substituteInPlace ./src/3rdparty/chromium/build/common.gypi \
-        --replace /bin/echo ${coreutils}/bin/echo
+    + optionalString (builtins.compareVersions qtCompatVersion "5.12" < 0) ''
+      substituteInPlace ./src/3rdparty/chromium/build/common.gypi --replace /bin/echo ${coreutils}/bin/echo
       substituteInPlace ./src/3rdparty/chromium/v8/${if qt56 then "build" else "gypfiles"}/toolchain.gypi \
         --replace /bin/echo ${coreutils}/bin/echo
       substituteInPlace ./src/3rdparty/chromium/v8/${if qt56 then "build" else "gypfiles"}/standalone.gypi \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index faffb5d8f2c4..d0e1bb5b525f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12091,8 +12091,24 @@ in
 
   libsForQt511 = recurseIntoAttrs (lib.makeScope qt511.newScope mkLibsForQt5);
 
-  qt5 = qt511;
-  libsForQt5 = libsForQt511;
+  qt512 = recurseIntoAttrs (makeOverridable
+    (import ../development/libraries/qt-5/5.12) {
+      inherit newScope;
+      inherit stdenv fetchurl fetchFromGitHub makeSetupHook;
+      bison = bison2; # error: too few arguments to function 'int yylex(...
+      inherit cups;
+      harfbuzz = harfbuzzFull;
+      inherit libGL;
+      inherit perl;
+      inherit (darwin) cf-private;
+      inherit (gnome3) gtk3 dconf;
+      inherit (gst_all_1) gstreamer gst-plugins-base;
+    });
+
+  libsForQt512 = recurseIntoAttrs (lib.makeScope qt512.newScope mkLibsForQt5);
+
+  qt5 = qt512;
+  libsForQt5 = libsForQt512;
 
   qt5ct = libsForQt5.callPackage ../tools/misc/qt5ct { };
 

From fdfb809a9b7ab0b2896682d90b38d8a1489804d7 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Thu, 13 Dec 2018 19:55:11 -0800
Subject: [PATCH 114/182] unbound: 1.8.1 -> 1.8.3

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/unbound/versions
---
 pkgs/tools/networking/unbound/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 4da6f6e177be..0c7acaad49fe 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.8.1";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0p9w6spar5dfi7fplxjcq4394wldabaws0ns30cqq6sxqfwv6qn3";
+    sha256 = "1k6fljr7k721vg2ivn5dfr0hs1kn8p1sm003glgd9ypd261jns9b";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB

From 5a8660bd29f0cd327cc27da186e234ddb03a02e3 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Sat, 15 Dec 2018 00:08:57 -0600
Subject: [PATCH 115/182] curl: 7.62.0 -> 7.63.0

https://curl.haxx.se/mail/lib-2018-12/0036.html
https://curl.haxx.se/changes.html
---
 pkgs/tools/networking/curl/default.nix        |  9 +---
 .../curl/fix-ipv6-url-parsing.patch           | 54 -------------------
 2 files changed, 2 insertions(+), 61 deletions(-)
 delete mode 100644 pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 42ea641afb67..bf37678d06c9 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,21 +24,16 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.62.0";
+  name = "curl-7.63.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "084niy7cin13ba65p8x38w2xcyc54n3fgzbin40fa2shfr0ca0kq";
+    sha256 = "1n4dzlbllwks8xkz466j362da0pbnxgwr11d64504xzzxka7xawv";
   };
 
-  patches = [
-    # Cherry picked fix for https://github.com/curl/curl/issues/3218
-    ./fix-ipv6-url-parsing.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch b/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
deleted file mode 100644
index 8a74b27ce7fd..000000000000
--- a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From b28094833a971870fd8c07960b3b12bf6fbbaad3 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Fri, 2 Nov 2018 15:11:16 +0100
-Subject: [PATCH] URL: fix IPv6 numeral address parser
-
-Regression from 46e164069d1a52. Extended test 1560 to verify.
-
-Reported-by: tpaukrt on github
-Fixes #3218
-Closes #3219
----
- lib/urlapi.c            | 8 ++++++--
- tests/libtest/lib1560.c | 9 +++++++++
- 2 files changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/lib/urlapi.c b/lib/urlapi.c
-index c53e523434..18a6076fff 100644
---- a/lib/urlapi.c
-+++ b/lib/urlapi.c
-@@ -499,8 +499,12 @@ static CURLUcode parse_port(struct Curl_URL *u, char *hostname)
-      (']' == endbracket)) {
-     /* this is a RFC2732-style specified IP-address */
-     portptr = &hostname[len];
--    if (*portptr != ':')
--      return CURLUE_MALFORMED_INPUT;
-+    if(*portptr) {
-+      if(*portptr != ':')
-+        return CURLUE_MALFORMED_INPUT;
-+    }
-+    else
-+      portptr = NULL;
-   }
-   else
-     portptr = strchr(hostname, ':');
-diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
-index e0faa12b29..57469a9063 100644
---- a/tests/libtest/lib1560.c
-+++ b/tests/libtest/lib1560.c
-@@ -128,6 +128,15 @@ struct querycase {
- };
- 
- static struct testcase get_parts_list[] ={
-+  {"http://[fd00:a41::50]:8080",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | 8080 | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-+  {"http://[fd00:a41::50]/",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-+  {"http://[fd00:a41::50]",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-   {"https://[::1%252]:1234",
-    "https | [11] | [12] | [13] | [::1%252] | 1234 | / | [16] | [17]",
-    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},

From c30247407706ba2ee4fade67c1055eef1148c1d0 Mon Sep 17 00:00:00 2001
From: Piotr Bogdan <ppbogdan@gmail.com>
Date: Sun, 9 Dec 2018 02:54:53 +0000
Subject: [PATCH 116/182] binutils: remove dtneeded.patch

---
 pkgs/development/tools/misc/binutils/default.nix    |  5 -----
 pkgs/development/tools/misc/binutils/dtneeded.patch | 12 ------------
 2 files changed, 17 deletions(-)
 delete mode 100644 pkgs/development/tools/misc/binutils/dtneeded.patch

diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 7d045115b594..5d60903ee86f 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -30,11 +30,6 @@ stdenv.mkDerivation rec {
   });
 
   patches = [
-    # Since binutils 2.22, DT_NEEDED flags aren't copied for dynamic outputs.
-    # That requires upstream changes for things to work. So we can patch it to
-    # get the old behaviour by now.
-    ./dtneeded.patch
-
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
diff --git a/pkgs/development/tools/misc/binutils/dtneeded.patch b/pkgs/development/tools/misc/binutils/dtneeded.patch
deleted file mode 100644
index 3754ec569eec..000000000000
--- a/pkgs/development/tools/misc/binutils/dtneeded.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/ld/ldmain.c b/ld/ldmain.c
-index 15f8ebf..f71241e 100644
---- a/ld/ldmain.c
-+++ b/ld/ldmain.c
-@@ -298,6 +298,7 @@ main (int argc, char **argv)
-   lang_init ();
-   ldemul_before_parse ();
-   lang_has_input_file = FALSE;
-+  input_flags.add_DT_NEEDED_for_dynamic = TRUE;
-   parse_args (argc, argv);
- 
-   if (config.hash_table_size != 0)

From bf174887e53ebe85cdfba2cd404fb0d47c8586da Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 5 Dec 2018 18:28:18 -0600
Subject: [PATCH 117/182] cups: 2.2.6 -> 2.2.9

https://github.com/apple/cups/releases/tag/v2.2.9
https://github.com/apple/cups/releases/tag/v2.2.8
https://github.com/apple/cups/releases/tag/v2.2.7
---
 pkgs/misc/cups/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 227886e126fc..55621c7cd1a5 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -10,13 +10,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "cups-${version}";
-  version = "2.2.6";
+  version = "2.2.9";
 
   passthru = { inherit version; };
 
   src = fetchurl {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
+    sha256 = "0mhii4fq94v0sd8imv73mgr5zn5cfiazj2ys40rn95rv4pdda8kd";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];

From 61e9fc2e52db45960d0d341b6264818a8a2f2189 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Fri, 14 Dec 2018 19:06:26 -0600
Subject: [PATCH 118/182] cups: 2.2.9 -> 2.2.10

https://www.cups.org/blog/2018-12-07-cups-2.2.10.html
---
 pkgs/misc/cups/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 55621c7cd1a5..df2d94c1f898 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -10,13 +10,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "cups-${version}";
-  version = "2.2.9";
+  version = "2.2.10";
 
   passthru = { inherit version; };
 
   src = fetchurl {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "0mhii4fq94v0sd8imv73mgr5zn5cfiazj2ys40rn95rv4pdda8kd";
+    sha256 = "1fq52aw1mini3ld2czv5gg37wbbvh4n7yc7wzzxvbs3zpfrv5j3p";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];

From ee9bfb40b0e8ed24480c07fdcf49337fbac5c41a Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 19 Dec 2018 09:37:34 +0100
Subject: [PATCH 119/182] python: scipy: 1.1.0 -> 1.2.0

---
 pkgs/development/python-modules/scipy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 597a8e0783a2..5fe21024e008 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "878352408424dffaa695ffedf2f9f92844e116686923ed9aa8626fc30d32cfd1";
+    sha256 = "51a2424c8ed80e60bdb9a896806e7adaf24a58253b326fbad10f80a6d06f2214";
   };
 
   checkInputs = [ nose pytest ];

From 87d993f64182afd56010e8cee24a11a82b08ea1d Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 19 Dec 2018 09:37:59 +0100
Subject: [PATCH 120/182] fix update-python-libraries

---
 maintainers/scripts/update-python-libraries | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/maintainers/scripts/update-python-libraries b/maintainers/scripts/update-python-libraries
index d56c9e6338cc..4a6024c40380 100755
--- a/maintainers/scripts/update-python-libraries
+++ b/maintainers/scripts/update-python-libraries
@@ -1,3 +1,5 @@
 #!/bin/sh
-exec nix-shell -p "python3.withPackages(ps: with ps; [ packaging requests toolz ])" -p git --run pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py
+build=`nix-build -E "with import (fetchTarball "channel:nixpkgs-unstable") {}; python3.withPackages(ps: with ps; [ packaging requests toolz ])"`
+python=${build}/bin/python
+exec ${python} pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py $@
 

From 0faa9008d50c5994cda0300b9be934e262d50f0f Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 15 Dec 2018 23:48:08 -0800
Subject: [PATCH 121/182] fluidsynth: 2.0.1 -> 2.0.2

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/fluidsynth/versions
---
 pkgs/applications/audio/fluidsynth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index d40544a0fa40..3eb5806aa4c1 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -11,8 +11,8 @@ let
       sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
     };
     "2" = {
-      fluidsynthVersion = "2.0.1";
-      sha256 = "1mqyym5qkh8xd1rqj3yhfxbw5dxjcrljb6nkfqzvcarlv4h6rjn7";
+      fluidsynthVersion = "2.0.2";
+      sha256 = "02vs5sfsyh1dl7wlcvgs4w3x0qcmsl7vi000qgp99ynwh3wjb274";
     };
   };
 in

From ce7a6c5217b258d3bfa9ab5d3341b8dcf7becafd Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 8 Dec 2018 14:13:25 -0800
Subject: [PATCH 122/182] zeromq: 4.2.5 -> 4.3.0

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/zeromq/versions
---
 pkgs/development/libraries/zeromq/4.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 79bebd87dbc2..ab0482559a43 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zeromq-${version}";
-  version = "4.2.5";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "18mjmbhvfhr4463dqayl5hdjfy5rx7na1xsq9dsvlaz9qlr5fskw";
+    sha256 = "12a2l6dzxkk1x8yl8bihnfs6gi2vgyi4jm9q8acj46f6niryhsmr";
   };
 
   nativeBuildInputs = [ cmake asciidoc ];

From 425112151db3b05fec01e86cb10c90b4037e9367 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Wed, 19 Dec 2018 23:46:06 -0600
Subject: [PATCH 123/182] darwin: remove missing symbols

these symbols are not needed apparently
---
 .../apple-source-releases/Libsystem/system_kernel_symbols       | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 0b8456b95013..7c5b90f95ed7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -403,7 +403,6 @@ _fs_snapshot_list
 _fs_snapshot_mount
 _fs_snapshot_rename
 _fs_snapshot_revert
-_fs_snapshot_root
 _fsctl
 _fsetattrlist
 _fsetxattr
@@ -678,7 +677,6 @@ _mig_strncpy_zerofill
 _mincore
 _minherit
 _mk_timer_arm
-_mk_timer_arm_leeway
 _mk_timer_cancel
 _mk_timer_create
 _mk_timer_destroy

From 07a6bc6ab21a9708ff6bd684aa9f9a0375d32f6b Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Wed, 19 Dec 2018 17:14:16 -0500
Subject: [PATCH 124/182] x265: fix build on ARM

---
 pkgs/development/libraries/x265/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 4212687a02ac..7ea28f6b61e8 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation rec {
       url = "https://bitbucket.org/multicoreware/x265/commits/471726d3a0462739ff8e3518eb1a1e8a01de4e8d/raw";
       sha256 = "0mj8lb8ng8lrhzjavap06vjhqf6j0r3sn76c6rhs3012f86lv928";
     })
+    # Fix build on ARM (#406) 
+    (fetchpatch {
+      url = "https://bitbucket.org/multicoreware/x265/issues/attachments/406/multicoreware/x265/1527562952.26/406/X265-2.8-asm-primitives.patch";
+      sha256 = "1vf8bpl37gbd9dcbassgkq9i0rp24qm3bl6hx9zv325174bn402v";
+    })
   ];
 
   postPatch = ''

From 855777ad22e056557d8e8a8c71aebb156f21a711 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 20 Dec 2018 14:03:23 +0000
Subject: [PATCH 125/182] wrap-python: fix pypy site-packages path

---
 pkgs/development/interpreters/python/wrap-python.nix | 2 +-
 pkgs/development/interpreters/python/wrap.sh         | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index 1efd777bb052..4ff0a62d7fbd 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -7,7 +7,7 @@ with lib;
 
 makeSetupHook {
       deps = makeWrapper;
-      substitutions.libPrefix = python.libPrefix;
+      substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
       substitutions.python = python;
       substitutions.magicalSedExpression = let
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 01b573e6ad5d..6fa8c316a17d 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -92,7 +92,7 @@ _addToPythonPath() {
     pythonPathsSeen[$dir]=1
     # addToSearchPath is defined in stdenv/generic/setup.sh. It will have
     # the effect of calling `export program_X=$dir/...:$program_X`.
-    addToSearchPath program_PYTHONPATH $dir/lib/@libPrefix@/site-packages
+    addToSearchPath program_PYTHONPATH $dir/@sitePackages@
     addToSearchPath program_PATH $dir/bin
 
     # Inspect the propagated inputs (if they exist) and recur on them.
@@ -113,9 +113,9 @@ createBuildInputsPth() {
             if $(echo -n $x |grep -q python-recursive-pth-loader); then
                 continue
             fi
-            if test -d "$x"/lib/@libPrefix@/site-packages; then
-                echo $x/lib/@libPrefix@/site-packages \
-                    >> "$out"/lib/@libPrefix@/site-packages/${name}-nix-python-$category.pth
+            if test -d "$x"/@sitePackages@; then
+                echo $x/@sitePackages@ \
+                    >> "$out"/@sitePackages@/${name}-nix-python-$category.pth
             fi
         done
     fi

From 2dd13d4ba0fb22bf5b6e86ddcb916075e070a455 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 20 Dec 2018 14:54:56 +0000
Subject: [PATCH 126/182] nixos/glusterfs: remove unused PYTHONPATH

this directory does not exists
---
 nixos/modules/services/network-filesystems/glusterfs.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix
index eb7f060c7da0..00875c6c4a18 100644
--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@@ -201,7 +201,6 @@ in
 
       serviceConfig = {
         Type="simple";
-        Environment="PYTHONPATH=${glusterfs}/usr/lib/python2.7/site-packages";
         PIDFile="/run/glustereventsd.pid";
         ExecStart="${glusterfs}/sbin/glustereventsd --pid-file /run/glustereventsd.pid";
         ExecReload="/bin/kill -SIGUSR2 $MAINPID";

From ec040d9b2206e60e1dc86dbfab3b1942490f3c48 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 5 Dec 2018 18:31:21 -0600
Subject: [PATCH 127/182] cups: drop patches

(cherry picked from commit 085a74cb42074384958c23bd762af589da570042)
---
 pkgs/misc/cups/cups-clean-dirty.patch | 13 -------------
 pkgs/misc/cups/default.nix            | 10 ----------
 2 files changed, 23 deletions(-)
 delete mode 100644 pkgs/misc/cups/cups-clean-dirty.patch

diff --git a/pkgs/misc/cups/cups-clean-dirty.patch b/pkgs/misc/cups/cups-clean-dirty.patch
deleted file mode 100644
index 0bdc8198e8fb..000000000000
--- a/pkgs/misc/cups/cups-clean-dirty.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/scheduler/main.c b/scheduler/main.c
-index 8925c8373..acf031684 100644
---- a/scheduler/main.c
-+++ b/scheduler/main.c
-@@ -893,7 +893,7 @@ main(int  argc,				/* I - Number of command-line args */
-     * Write dirty config/state files...
-     */
- 
--    if (DirtyCleanTime && current_time >= DirtyCleanTime && cupsArrayCount(Clients) == 0)
-+    if (DirtyCleanTime && current_time >= DirtyCleanTime)
-       cupsdCleanDirty();
- 
- #ifdef __APPLE__
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index df2d94c1f898..e3649bb821b3 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -21,16 +21,6 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" "man" ];
 
-  patches = [
-    (fetchpatch {
-      name = "cups"; # weird name to avoid change (for now)
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/cups-systemd-socket.patch"
-          + "?h=packages/cups&id=41fefa22ac518";
-      sha256 = "1ddgdlg9s0l2ph6l8lx1m1lx6k50gyxqi3qiwr44ppq1rxs80ny5";
-    })
-    ./cups-clean-dirty.patch
-  ];
-
   postPatch = ''
     substituteInPlace cups/testfile.c \
       --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'

From b4c56f90ac259afb2e77784485308629438f1118 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 20 Dec 2018 18:51:03 +0100
Subject: [PATCH 128/182] iana-etc: 20180905 -> 20181219

---
 pkgs/data/misc/iana-etc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index af8270e6eefa..59773e34ccec 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchzip }:
 
 let
-  version = "20180905";
+  version = "20181219";
 in fetchzip {
   name = "iana-etc-${version}";
   url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-  sha256 = "1vl3by24xddl267cjq9bcwb7yvfd7gqalwgd5sgx8i7kz9bk40q2";
+  sha256 = "0i3f7shvf1g6dp984w8xfix6id3q5c10b292wz2qw3v5n7h6wkm3";
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1

From 8032edf6af80e6fb435757f81c262127aaf0fa21 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Thu, 13 Dec 2018 13:58:01 -0500
Subject: [PATCH 129/182] libpfm: use placeholder for PREFIX

---
 pkgs/development/libraries/libpfm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 36e99c8cd911..d64591273bcc 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "0jabhjx77yppr7x38bkfww6n2a480gj62rw0qp7prhdmg19mf766";
   };
 
-  installFlags = "DESTDIR=\${out} PREFIX= LDCONFIG=true";
-
   makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "LDCONFIG=true"
     "ARCH=${stdenv.targetPlatform.uname.processor}"
     "SYS=${stdenv.targetPlatform.uname.system}"
   ];

From 1b146a8c6f55b23981c3817d8346f95bb3a799fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 22 Dec 2018 12:49:41 +0100
Subject: [PATCH 130/182] treewide: remove paxutils from stdenv

More then one year ago we removed grsecurity kernels from nixpkgs:
https://github.com/NixOS/nixpkgs/pull/25277

This removes now also paxutils from stdenv.
---
 doc/stdenv.xml                                |  24 --
 .../altcoins/parity-ui/default.nix            |   2 -
 pkgs/applications/editors/atom/default.nix    |   3 -
 .../networking/browsers/chromium/common.nix   |   2 -
 .../networking/browsers/firefox/common.nix    |   8 -
 .../instant-messengers/discord/default.nix    |   2 -
 .../instant-messengers/franz/default.nix      |   1 -
 .../instant-messengers/wavebox/default.nix    |   1 -
 .../mailreaders/thunderbird/default.nix       |  11 +-
 pkgs/applications/office/mendeley/default.nix |   1 -
 .../virtualization/qemu/default.nix           |   3 -
 .../adoptopenjdk-bin/jdk-linux-base.nix       |   8 -
 pkgs/development/compilers/gcc/builder.sh     |   5 -
 .../compilers/ghc/8.2.2-binary.nix            |   2 -
 pkgs/development/compilers/ghc/8.2.2.nix      |   5 -
 pkgs/development/compilers/ghc/8.4.4.nix      |   5 -
 pkgs/development/compilers/ghc/8.6.1.nix      |   5 -
 pkgs/development/compilers/ghc/8.6.2.nix      |   5 -
 pkgs/development/compilers/ghc/8.6.3.nix      |   5 -
 pkgs/development/compilers/ghc/head.nix       |   5 -
 .../compilers/jetbrains-jdk/default.nix       |   5 -
 .../compilers/julia/0004-hardened.patch       |  25 --
 pkgs/development/compilers/julia/default.nix  |   7 +-
 pkgs/development/compilers/julia/shared.nix   |   7 +-
 pkgs/development/compilers/llvm/3.5/llvm.nix  |   6 -
 pkgs/development/compilers/llvm/3.7/llvm.nix  |   2 -
 pkgs/development/compilers/llvm/3.8/llvm.nix  |   2 -
 pkgs/development/compilers/llvm/3.9/llvm.nix  |   2 -
 pkgs/development/compilers/llvm/4/llvm.nix    |   6 -
 pkgs/development/compilers/llvm/5/llvm.nix    |   6 -
 pkgs/development/compilers/llvm/6/llvm.nix    |   6 -
 pkgs/development/compilers/llvm/7/llvm.nix    |   6 -
 pkgs/development/compilers/openjdk/11.nix     |   9 -
 pkgs/development/compilers/openjdk/8.nix      |   9 -
 .../compilers/openjdk/bootstrap.nix           |   8 -
 .../compilers/oraclejdk/jdk-linux-base.nix    |   8 -
 pkgs/development/compilers/swift/default.nix  |   9 +-
 .../swift/patches/build-script-pax.patch      |  33 ---
 pkgs/development/compilers/terra/default.nix  |   4 -
 pkgs/development/compilers/tinycc/default.nix |   4 -
 .../interpreters/python/cpython/2.7/boot.nix  |   2 -
 .../python/cpython/2.7/default.nix            |   2 -
 .../python/cpython/3.5/default.nix            |   1 -
 .../python/cpython/3.6/default.nix            |   1 -
 .../python/cpython/3.7/default.nix            |   1 -
 .../interpreters/spidermonkey/1.8.5.nix       |   5 +-
 .../gstreamer/legacy/gstreamer/default.nix    |   2 -
 pkgs/development/libraries/polkit/default.nix |   7 -
 .../libraries/qt-5/5.11/default.nix           |   1 -
 .../5.11/qtwebengine-paxmark-mksnapshot.patch |  48 ----
 .../libraries/qt-5/5.6/default.nix            |   3 +-
 .../5.6/qtwebengine-paxmark-mksnapshot.patch  |  46 ----
 .../libraries/qt-5/5.9/default.nix            |   1 -
 .../5.9/qtwebengine-paxmark-mksnapshot.patch  |  48 ----
 .../libraries/qt-5/modules/qtwebengine.nix    |   3 +-
 .../tools/analysis/valgrind/default.nix       |   2 -
 .../tools/misc/binutils/default.nix           |   5 -
 .../tools/misc/binutils/pt-pax-flags.patch    | 233 ------------------
 pkgs/development/web/nodejs/nodejs.nix        |   1 -
 pkgs/stdenv/cross/default.nix                 |   2 +-
 pkgs/stdenv/generic/default.nix               |   3 -
 pkgs/stdenv/generic/setup.sh                  |   4 -
 pkgs/stdenv/linux/default.nix                 |  10 +-
 pkgs/tools/misc/grub/2.0x.nix                 |   2 -
 pkgs/tools/misc/grub/trusted.nix              |   4 -
 65 files changed, 17 insertions(+), 687 deletions(-)
 delete mode 100644 pkgs/development/compilers/julia/0004-hardened.patch
 delete mode 100644 pkgs/development/compilers/swift/patches/build-script-pax.patch
 delete mode 100644 pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch
 delete mode 100644 pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch
 delete mode 100644 pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch
 delete mode 100644 pkgs/development/tools/misc/binutils/pt-pax-flags.patch

diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 1c18fab86696..564471bbbbc6 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -2433,30 +2433,6 @@ addEnvHooks "$hostOffset" myBashFunction
       </para>
      </listitem>
     </varlistentry>
-    <varlistentry>
-     <term>
-      paxctl
-     </term>
-     <listitem>
-      <para>
-       Defines the <varname>paxmark</varname> helper for setting per-executable
-       PaX flags on Linux (where it is available by default; on all other
-       platforms, <varname>paxmark</varname> is a no-op). For example, to
-       disable secure memory protections on the executable
-       <replaceable>foo</replaceable>
-<programlisting>
-      postFixup = ''
-        paxmark m $out/bin/<replaceable>foo</replaceable>
-      '';
-    </programlisting>
-       The <literal>m</literal> flag is the most common flag and is typically
-       required for applications that employ JIT compilation or otherwise need
-       to execute code generated at run-time. Disabling PaX protections should
-       be considered a last resort: if possible, problematic features should be
-       disabled or patched to work with PaX.
-      </para>
-     </listitem>
-    </varlistentry>
     <varlistentry>
      <term>
       autoPatchelfHook
diff --git a/pkgs/applications/altcoins/parity-ui/default.nix b/pkgs/applications/altcoins/parity-ui/default.nix
index ec2e571e3f0b..c59b2ccb8ac3 100644
--- a/pkgs/applications/altcoins/parity-ui/default.nix
+++ b/pkgs/applications/altcoins/parity-ui/default.nix
@@ -34,8 +34,6 @@ in stdenv.mkDerivation rec {
 
     find $out/share/parity-ui -name "*.node" -exec patchelf --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" {} \;
 
-    paxmark m $out/share/parity-ui/parity-ui
-
     mkdir -p $out/bin
     ln -s $out/share/parity-ui/parity-ui $out/bin/parity-ui
   '';
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 710c3ca335a6..13dc9e1285b1 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -70,9 +70,6 @@ let
       ln -s ${pkgs.git}/bin/git $dugite/git/libexec/git-core/git
 
       find $share -name "*.node" -exec patchelf --set-rpath "${atomEnv.libPath}:$share" {} \;
-
-      paxmark m $share/atom
-      paxmark m $share/resources/app/apm/bin/node
     '';
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index bcf6df7417f7..0c199dab6bc8 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -282,8 +282,6 @@ let
           MENUNAME="Chromium"
           process_template chrome/app/resources/manpage.1.in "${buildPath}/chrome.1"
         )
-      '' + optionalString (target == "mksnapshot" || target == "chrome") ''
-        paxmark m "${buildPath}/${target}"
       '';
       targets = extraAttrs.buildTargets or [];
       commands = map buildCommand targets;
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 2a2f71d419fd..8f135614f4d2 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -263,20 +263,12 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = false; # "--disable-tests" above
 
-  preInstall = ''
-    # The following is needed for startup cache creation on grsecurity kernels.
-    paxmark m dist/bin/xpcshell
-  '';
-
   installPhase = if stdenv.isDarwin then ''
     mkdir -p $out/Applications
     cp -LR dist/Firefox.app $out/Applications
   '' else null;
 
   postInstall = lib.optionalString stdenv.isLinux ''
-    # For grsecurity kernels
-    paxmark m $out/lib/firefox*/{firefox,firefox-bin,plugin-container}
-
     # Remove SDK cruft. FIXME: move to a separate output?
     rm -rf $out/share/idl $out/include $out/lib/firefox-devel-*
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 09ead9b3de65..4b1af80d6243 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
         patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
                  $out/opt/discord/Discord
 
-        paxmark m $out/opt/discord/Discord
-
         wrapProgram $out/opt/discord/Discord --prefix LD_LIBRARY_PATH : ${libPath}
 
         ln -s $out/opt/discord/Discord $out/bin/
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index 2f3870d78994..4b8670f23d43 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -54,7 +54,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/franz/Franz
     wrapProgram $out/opt/franz/Franz --prefix PATH : ${xdg_utils}/bin
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index b85e9d3d4cb8..d7d882564e7f 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -52,7 +52,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/wavebox/Wavebox
     makeWrapper $out/opt/wavebox/Wavebox $out/bin/wavebox \
       --prefix PATH : ${xdg_utils}/bin
   '';
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index c048c2938a92..b53c7b910f6a 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -100,7 +100,7 @@ in stdenv.mkDerivation rec {
     ''
       cxxLib=$( echo -n ${gcc}/include/c++/* )
       archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
-  
+
       test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
 
       configureScript="$(realpath ./configure)"
@@ -108,18 +108,9 @@ in stdenv.mkDerivation rec {
       cd ../objdir
     '';
 
-  preInstall =
-    ''
-      # The following is needed for startup cache creation on grsecurity kernels.
-      paxmark m ../objdir/dist/bin/xpcshell
-    '';
-
   dontWrapGApps = true; # we do it ourselves
   postInstall =
     ''
-      # For grsecurity kernels
-      paxmark m $out/lib/thunderbird/thunderbird
-
       # TODO: Move to a dev output?
       rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
 
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index aa9317d2ffd6..9c4c22dabe97 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -112,7 +112,6 @@ stdenv.mkDerivation {
     patchelf --set-interpreter $interpreter \
              --set-rpath ${stdenv.lib.makeLibraryPath deps}:$out/lib \
              $out/bin/mendeleydesktop
-    paxmark m $out/bin/mendeleydesktop
 
     wrapProgram $out/bin/mendeleydesktop \
       --add-flags "--unix-distro-build" \
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 1cd85cead125..49ddab1d6d23 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -125,9 +125,6 @@ stdenv.mkDerivation rec {
 
   postFixup =
     ''
-      for exe in $out/bin/qemu-system-* ; do
-        paxmark m $exe
-      done
       # copy qemu-ga (guest agent) to separate output
       mkdir -p $ga/bin
       cp $out/bin/qemu-ga $ga/bin/
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index eb614b0784f9..531cf3a80517 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -61,14 +61,6 @@ let result = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    # Set PaX markings
-    exes=$(file $sourceRoot/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file"
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''}
-    done
-
     mv $sourceRoot $out
 
     rm -rf $out/demo
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 75e70006d749..07a003691d6b 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -282,11 +282,6 @@ postInstall() {
         fi
     done
 
-    # Disable RANDMMAP on grsec, which causes segfaults when using
-    # precompiled headers.
-    # See https://bugs.gentoo.org/show_bug.cgi?id=301299#c31
-    paxmark r $out/libexec/gcc/*/*/{cc1,cc1plus}
-
     # Two identical man pages are shipped (moving and compressing is done later)
     ln -sf gcc.1 "$out"/share/man/man1/g++.1
 }
diff --git a/pkgs/development/compilers/ghc/8.2.2-binary.nix b/pkgs/development/compilers/ghc/8.2.2-binary.nix
index 039eea744f36..f52d8fd4a11f 100644
--- a/pkgs/development/compilers/ghc/8.2.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.2.2-binary.nix
@@ -105,8 +105,6 @@ stdenv.mkDerivation rec {
           --replace-needed libtinfo.so libtinfo.so.5 \
           --interpreter ${glibcDynLinker} {} \;
 
-      paxmark m ./ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
-
       sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
       sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
     '';
diff --git a/pkgs/development/compilers/ghc/8.2.2.nix b/pkgs/development/compilers/ghc/8.2.2.nix
index 3b9fecd55e10..3e355dc302d6 100644
--- a/pkgs/development/compilers/ghc/8.2.2.nix
+++ b/pkgs/development/compilers/ghc/8.2.2.nix
@@ -238,11 +238,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.4.4.nix b/pkgs/development/compilers/ghc/8.4.4.nix
index 4db5c07b4601..c5fe3c925f00 100644
--- a/pkgs/development/compilers/ghc/8.4.4.nix
+++ b/pkgs/development/compilers/ghc/8.4.4.nix
@@ -214,11 +214,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.1.nix b/pkgs/development/compilers/ghc/8.6.1.nix
index 5710c60338a8..b54164ccc696 100644
--- a/pkgs/development/compilers/ghc/8.6.1.nix
+++ b/pkgs/development/compilers/ghc/8.6.1.nix
@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.2.nix b/pkgs/development/compilers/ghc/8.6.2.nix
index 914d6ae08fac..07d4420804dd 100644
--- a/pkgs/development/compilers/ghc/8.6.2.nix
+++ b/pkgs/development/compilers/ghc/8.6.2.nix
@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.3.nix b/pkgs/development/compilers/ghc/8.6.3.nix
index b29b7facd1f4..4e1f0dd9fc72 100644
--- a/pkgs/development/compilers/ghc/8.6.3.nix
+++ b/pkgs/development/compilers/ghc/8.6.3.nix
@@ -192,11 +192,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 42119682892d..65a4a0c4ecdb 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -177,11 +177,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 39fab8b25d8f..876e474bed97 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -25,11 +25,6 @@ let drv = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    exes=$(file $sourceRoot/bin/* $sourceRoot/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file"
-    done
-
     mv $sourceRoot $out
     jrePath=$out/jre
   '';
diff --git a/pkgs/development/compilers/julia/0004-hardened.patch b/pkgs/development/compilers/julia/0004-hardened.patch
deleted file mode 100644
index 901f967c9d55..000000000000
--- a/pkgs/development/compilers/julia/0004-hardened.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From eddb251a00ace6e63e32e7dcb9e1ec632cac14e0 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Wed, 1 Feb 2017 06:09:49 -0600
-Subject: [PATCH] Set pax flags on julia binaries to disable memory protection.
-
----
- Makefile | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/Makefile b/Makefile
-index 0e28cc87b..aab8cfa8d 100644
---- a/Makefile
-+++ b/Makefile
-@@ -91,6 +91,8 @@ julia-src-release julia-src-debug : julia-src-% : julia-deps julia_flisp.boot.in
- 
- julia-ui-release julia-ui-debug : julia-ui-% : julia-src-%
- 	@$(MAKE) $(QUIET_MAKE) -C $(BUILDROOT)/ui julia-$*
-+	@echo "setting PaX flags on $(JULIA_EXECUTABLE_$*)"
-+	@paxctl -czexm $(JULIA_EXECUTABLE_$*)
- 
- julia-inference : julia-base julia-ui-$(JULIA_BUILD_MODE) $(build_prefix)/.examples
- 	@$(MAKE) $(QUIET_MAKE) -C $(BUILDROOT) $(build_private_libdir)/inference.ji JULIA_BUILD_MODE=$(JULIA_BUILD_MODE)
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 086570f5ce20..4c0b1359bd8d 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2, paxctl
+, gfortran, m4, makeWrapper, patchelf, perl, which, python2
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
 , llvm
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   patches = [
     ./0001.1-use-system-utf8proc.patch
     ./0002-use-system-suitesparse.patch
-  ] ++ stdenv.lib.optional stdenv.needsPax ./0004-hardened.patch;
+  ];
 
   postPatch = ''
     patchShebangs . contrib
@@ -96,8 +96,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
   ;
 
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ]
-    ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ];
 
   makeFlags =
     let
diff --git a/pkgs/development/compilers/julia/shared.nix b/pkgs/development/compilers/julia/shared.nix
index 70ff40cd7ec5..95b45adcc6fc 100644
--- a/pkgs/development/compilers/julia/shared.nix
+++ b/pkgs/development/compilers/julia/shared.nix
@@ -5,7 +5,7 @@
 }:
 { stdenv, fetchurl, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2, paxctl
+, gfortran, m4, makeWrapper, patchelf, perl, which, python2
 , llvm, cmake
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001.1-use-system-utf8proc.patch
-  ] ++ stdenv.lib.optional stdenv.needsPax ./0004-hardened.patch;
+  ];
 
   postPatch = ''
     patchShebangs . contrib
@@ -117,8 +117,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
   ;
 
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ]
-    ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ];
 
   makeFlags =
     let
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
index 388da007d33d..2645469767ad 100644
--- a/pkgs/development/compilers/llvm/3.5/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -81,12 +81,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-
-    paxmark m unittests/ExecutionEngine/JIT/JITTests
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/Support/SupportTests
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index e540469c6278..a6fd18f94d68 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -89,8 +89,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index c246bfe496ed..fcb4214a1de8 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -97,8 +97,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   postInstall = stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 3cc1a4d6ccec..00c56e49e374 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -141,8 +141,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   postInstall = ""
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 7d93fec6a125..aac9c4275ad4 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -121,12 +121,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 5277205f8803..9e181a1202ba 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -98,12 +98,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 192439b019bc..328f95f11b34 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -115,12 +115,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index d085f3af0eab..2ef6b147214c 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -110,12 +110,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 42208ecf8d95..a389f0f5ca1a 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -21,7 +21,6 @@ let
   update = ".0.1";
   build = "13";
   repover = "jdk-${major}${update}+${build}";
-  paxflags = if stdenv.isi686 then "msp" else "m";
 
   openjdk = stdenv.mkDerivation {
     name = "openjdk-${major}${update}-b${build}";
@@ -106,14 +105,6 @@ let
         rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
       ''}
 
-      # Set PaX markings
-      exes=$(file $out/lib/openjdk/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-      echo "to mark: *$exes*"
-      for file in $exes; do
-        echo "marking *$file*"
-        paxmark ${paxflags} "$file"
-      done
-
       ln -s $out/lib/openjdk/bin $out/bin
     '';
 
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index d26627ff5b9c..19b16921e329 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -25,7 +25,6 @@ let
   build = "26";
   baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = "jdk8u${update}-b${build}";
-  paxflags = if stdenv.isi686 then "msp" else "m";
   jdk8 = fetchurl {
              url = "${baseurl}/archive/${repover}.tar.gz";
              sha256 = "1hx5sfsglc101aqs9n7cz7rh447d6rxfxkbw03crvzbvy9n6ag2d";
@@ -176,14 +175,6 @@ let
       rm -rf $out/lib/openjdk/jre/lib/cmm
       ln -s {$jre,$out}/lib/openjdk/jre/lib/cmm
 
-      # Set PaX markings
-      exes=$(file $out/lib/openjdk/bin/* $jre/lib/openjdk/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-      echo "to mark: *$exes*"
-      for file in $exes; do
-        echo "marking *$file*"
-        paxmark ${paxflags} "$file"
-      done
-
       # Remove duplicate binaries.
       for i in $(cd $out/lib/openjdk/bin && echo *); do
         if [ "$i" = java ]; then continue; fi
diff --git a/pkgs/development/compilers/openjdk/bootstrap.nix b/pkgs/development/compilers/openjdk/bootstrap.nix
index 1b20ca6cc606..e58888cc9ed8 100644
--- a/pkgs/development/compilers/openjdk/bootstrap.nix
+++ b/pkgs/development/compilers/openjdk/bootstrap.nix
@@ -36,13 +36,5 @@ let
       patchelf --set-interpreter $(cat "${stdenv.cc}/nix-support/dynamic-linker") "$elf" || true
       patchelf --set-rpath "${stdenv.cc.libc}/lib:${stdenv.cc.cc.lib}/lib:${zlib}/lib:$LIBDIRS" "$elf" || true
     done
-
-    # Temporarily, while NixOS's OpenJDK bootstrap tarball doesn't have PaX markings:
-    find "$out/bin" -type f -print0 | while IFS= read -r -d "" elf; do
-      isELF "$elf" || continue
-      paxmark m "$elf"
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$elf"''}
-    done
   '';
 in bootstrap
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 5d55e0554e55..8e04b776ed8a 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -93,14 +93,6 @@ let result = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    # Set PaX markings
-    exes=$(file $sourceRoot/bin/* $sourceRoot/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file" || true
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''}
-    done
-
     if test -z "$installjdk"; then
       mv $sourceRoot/jre $out
     else
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index bbfa1be8f921..02b100fe6130 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -27,7 +27,6 @@
 , git
 , libgit2
 , fetchFromGitHub
-, paxctl
 , findutils
 , makeWrapper
 , gnumake
@@ -150,7 +149,7 @@ stdenv.mkDerivation rec {
     findutils
     makeWrapper
     gnumake
-  ] ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  ];
 
   # TODO: Revisit what's propagated and how
   propagatedBuildInputs = [
@@ -218,9 +217,6 @@ stdenv.mkDerivation rec {
     substituteInPlace swift/utils/build-script-impl \
       --replace '/usr/include/c++' "${clang.cc.gcc}/include/c++"
     patch -p1 -d swift -i ${./patches/glibc-arch-headers.patch}
-  '' + stdenv.lib.optionalString stdenv.needsPax ''
-    patch -p1 -d swift -i ${./patches/build-script-pax.patch}
-  '' + ''
     patch -p1 -d swift -i ${./patches/0001-build-presets-linux-don-t-require-using-Ninja.patch}
     patch -p1 -d swift -i ${./patches/0002-build-presets-linux-allow-custom-install-prefix.patch}
     patch -p1 -d swift -i ${./patches/0004-build-presets-linux-plumb-extra-cmake-options.patch}
@@ -266,9 +262,6 @@ stdenv.mkDerivation rec {
     tar xf $INSTALLABLE_PACKAGE -C $out --strip-components=3 $PREFIX
     find $out -type d -empty -delete
 
-    paxmark pmr $out/bin/swift
-    paxmark pmr $out/bin/*
-
     # TODO: Use wrappers to get these on the PATH for swift tools, instead
     ln -s ${clang}/bin/* $out/bin/
     ln -s ${targetPackages.stdenv.cc.bintools.bintools_bin}/bin/ar $out/bin/ar
diff --git a/pkgs/development/compilers/swift/patches/build-script-pax.patch b/pkgs/development/compilers/swift/patches/build-script-pax.patch
deleted file mode 100644
index 1f47bf8ee045..000000000000
--- a/pkgs/development/compilers/swift/patches/build-script-pax.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- swift/utils/build-script-impl	2017-01-23 12:47:20.401326309 -0600
-+++ swift-pax/utils/build-script-impl	2017-01-23 13:24:10.339366996 -0600
-@@ -1837,6 +1837,17 @@ function set_lldb_xcodebuild_options() {
-     fi
- }
- 
-+## XXX: Taken from nixpkgs /pkgs/stdenv/generic/setup.sh
-+isELF() {
-+    local fn="$1"
-+    local fd
-+    local magic
-+    exec {fd}< "$fn"
-+    read -n 4 -u $fd magic
-+    exec {fd}<&-
-+    if [[ "$magic" =~ ELF ]]; then return 0; else return 1; fi
-+}
-+
- #
- # Configure and build each product
- #
-@@ -2735,6 +2746,12 @@ for host in "${ALL_HOSTS[@]}"; do
-             fi
- 
-             call "${CMAKE_BUILD[@]}" "${build_dir}" $(cmake_config_opt ${product}) -- "${BUILD_ARGS[@]}" ${build_targets[@]}
-+            
-+						while IFS= read -r -d $'\0' i; do
-+								if ! isELF "$i"; then continue; fi
-+								echo "setting pax flags on $i"
-+								paxctl -czexm "$i" || true
-+						done < <(find "${build_dir}" -executable -type f -wholename "*/bin/*" -print0)
-         fi
-     done
- done
diff --git a/pkgs/development/compilers/terra/default.nix b/pkgs/development/compilers/terra/default.nix
index 98795f96ffa5..80d04080aac3 100644
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@@ -51,10 +51,6 @@ stdenv.mkDerivation rec {
   ''
   ;
 
-  postFixup = ''
-    paxmark m $bin/bin/terra
-  '';
-
   buildInputs = with llvmPackages; [ lua llvm clang-unwrapped ncurses ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index da706d502e6f..a5c3db65857f 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -33,10 +33,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
 
-  postFixup = ''
-    paxmark m $out/bin/tcc
-  '';
-
   meta = {
     description = "Small, fast, and embeddable C compiler and interpreter";
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/boot.nix b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
index 976d30819dbe..ccb366903c5c 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/boot.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
@@ -77,8 +77,6 @@ stdenv.mkDerivation rec {
     ''
       ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
 
-      paxmark E $out/bin/python2.7
-
       rm "$out"/lib/python*/plat-*/regen # refers to glibc.dev
     '';
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 63dad3bf42ff..ff1497a24e46 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -229,8 +229,6 @@ in stdenv.mkDerivation ({
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb${majorVersion}
         ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
 
-        paxmark E $out/bin/python${majorVersion}
-
         # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
         echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
 
diff --git a/pkgs/development/interpreters/python/cpython/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 92c277aacd4f..19e9f3169c7a 100644
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -143,7 +143,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index 4c9d0c2a8962..692f5c263a3e 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -164,7 +164,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
diff --git a/pkgs/development/interpreters/python/cpython/3.7/default.nix b/pkgs/development/interpreters/python/cpython/3.7/default.nix
index d1403ba95e4e..80d519b109e3 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.7/default.nix
@@ -154,7 +154,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
diff --git a/pkgs/development/interpreters/spidermonkey/1.8.5.nix b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
index 466371955868..9c81b230ada2 100644
--- a/pkgs/development/interpreters/spidermonkey/1.8.5.nix
+++ b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   # so the failure of that test does not matter much.
   configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ] ++
     stdenv.lib.optionals (stdenv.hostPlatform.system == "armv5tel-linux") [
-        "--with-cpu-arch=armv5t" 
+        "--with-cpu-arch=armv5t"
         "--disable-tracejit" ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
@@ -59,9 +59,6 @@ stdenv.mkDerivation rec {
 
   preCheck = ''
     rm jit-test/tests/sunspider/check-date-format-tofte.js    # https://bugzil.la/600522
-
-    paxmark mr shell/js
-    paxmark mr jsapi-tests/jsapi-tests
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
index d4d4082509e4..96c9d8e0c8e1 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
@@ -36,8 +36,6 @@ stdenv.mkDerivation rec {
   postInstall = ''
     # Hm, apparently --disable-gtk-doc is ignored...
     rm -rf $out/share/gtk-doc
-
-    paxmark m $out/bin/gst-launch* $out/libexec/gstreamer-*/gst-plugin-scanner
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 8093aec6bcc6..83f19e442c60 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -72,13 +72,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0 INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0";
 
-  # The following is required on grsecurity/PaX due to spidermonkey's JIT
-  postBuild = stdenv.lib.optionalString stdenv.isLinux ''
-    paxmark mr src/polkitbackend/.libs/polkitd
-  '' + stdenv.lib.optionalString (stdenv.isLinux && doCheck) ''
-    paxmark mr test/polkitbackend/.libs/polkitbackendjsauthoritytest
-  '';
-
   installFlags=["datadir=$(out)/share" "sysconfdir=$(out)/etc"];
 
   inherit doCheck;
diff --git a/pkgs/development/libraries/qt-5/5.11/default.nix b/pkgs/development/libraries/qt-5/5.11/default.nix
index 6f90f1cea7f0..5fbab32acda8 100644
--- a/pkgs/development/libraries/qt-5/5.11/default.nix
+++ b/pkgs/development/libraries/qt-5/5.11/default.nix
@@ -61,7 +61,6 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index e1621b005c61..000000000000
--- a/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/src/3rdparty/chromium/v8/src/v8.gyp b/chromium/v8/src/v8.gyp
-index e7e19f5059..934448c7d8 100644
---- a/src/3rdparty/chromium/v8/src/v8.gyp
-+++ b/src/3rdparty/chromium/v8/src/v8.gyp
-@@ -35,6 +35,7 @@
-     'v8_extra_library_files%': [],
-     'v8_experimental_extra_library_files%': [],
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'v8_os_page_size%': 0,
-   },
-   'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi', 'inspector/inspector.gypi'],
-@@ -2576,7 +2577,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': [
-         'v8_base',
-@@ -2606,5 +2607,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index e815cc8f70f2..9391999f1e90 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -51,8 +51,7 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = [ ./qtwebengine-seccomp.patch ]
-      ++ optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
+    qtwebengine = [ ./qtwebengine-seccomp.patch ];
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index b3316188f7d9..000000000000
--- a/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,46 +0,0 @@
---- qtwebengine-opensource-src-5.6.0-orig/src/3rdparty/chromium/v8/tools/gyp/v8.gyp	2016-03-04 01:48:36.000000000 +1100
-+++ qtwebengine-opensource-src-5.6.0/src/3rdparty/chromium/v8/tools/gyp/v8.gyp	2016-05-01 19:15:44.052770543 +1000
-@@ -33,6 +33,7 @@
-     'embed_script%': "",
-     'v8_extra_library_files%': [],
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'remove_v8base_debug_symbols%': 0,
-   },
-   'includes': ['../../build/toolchain.gypi', '../../build/features.gypi'],
-@@ -1913,7 +1914,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': ['v8_base', 'v8_nosnapshot', 'v8_libplatform'],
-       'include_dirs+': [
-@@ -1936,5 +1937,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/5.9/default.nix b/pkgs/development/libraries/qt-5/5.9/default.nix
index 6fcb7a0dc5eb..4acc6a6393f1 100644
--- a/pkgs/development/libraries/qt-5/5.9/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/default.nix
@@ -43,7 +43,6 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index 5e170567ce5d..000000000000
--- a/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-Index: qtwebengine-opensource-src-5.9.0/src/3rdparty/chromium/v8/src/v8.gyp
-===================================================================
---- qtwebengine-opensource-src-5.9.0.orig/src/3rdparty/chromium/v8/src/v8.gyp
-+++ qtwebengine-opensource-src-5.9.0/src/3rdparty/chromium/v8/src/v8.gyp
-@@ -36,6 +36,7 @@
-     'v8_experimental_extra_library_files%': [],
-     'v8_enable_inspector%': 0,
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'mkpeephole_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkpeephole<(EXECUTABLE_SUFFIX)',
-     'v8_os_page_size%': 0,
-   },
-@@ -2432,7 +2433,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': [
-         'v8_base',
-@@ -2485,5 +2486,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 71ecde66a1f3..a80488bad5e1 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -14,7 +14,7 @@
 , enableProprietaryCodecs ? true
 , gn, darwin, openbsm
 , ffmpeg ? null
-, lib, stdenv # lib.optional, needsPax
+, lib, stdenv
 }:
 
 with stdenv.lib;
@@ -181,7 +181,6 @@ EOF
     [Paths]
     Prefix = ..
     EOF
-    paxmark m $out/libexec/QtWebEngineProcess
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 2e04cac6c493..78f40913eb5f 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -73,8 +73,6 @@ stdenv.mkDerivation rec {
         --replace 'obj:/usr/X11R6/lib' 'obj:*/lib' \
         --replace 'obj:/usr/lib' 'obj:*/lib'
     done
-
-    paxmark m $out/lib/valgrind/*-*-linux
   '';
 
   meta = {
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 5d60903ee86f..787a5dbc646e 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -33,11 +33,6 @@ stdenv.mkDerivation rec {
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
-    # Always add PaX flags section to ELF files.
-    # This is needed, for instance, so that running "ldd" on a binary that is
-    # PaX-marked to disable mprotect doesn't fail with permission denied.
-    ./pt-pax-flags.patch
-
     # Bfd looks in BINDIR/../lib for some plugins that don't
     # exist. This is pointless (since users can't install plugins
     # there) and causes a cycle between the lib and bin outputs, so
diff --git a/pkgs/development/tools/misc/binutils/pt-pax-flags.patch b/pkgs/development/tools/misc/binutils/pt-pax-flags.patch
deleted file mode 100644
index 3c060012ad0e..000000000000
--- a/pkgs/development/tools/misc/binutils/pt-pax-flags.patch
+++ /dev/null
@@ -1,233 +0,0 @@
---- binutils-2.15.94.0.2.2.orig/bfd/elf-bfd.h	2005-02-07 20:42:44.000000000 +0100
-+++ binutils-2.15.94.0.2.2/bfd/elf-bfd.h	2005-02-20 13:13:17.362558200 +0100
-@@ -1266,6 +1266,9 @@
-   /* Should the PT_GNU_RELRO segment be emitted?  */
-   bfd_boolean relro;
- 
-+  /* Segment flags for the PT_PAX_FLAGS segment.  */
-+  unsigned int pax_flags;
-+
-   /* Symbol version definitions in external objects.  */
-   Elf_Internal_Verdef *verdef;
- 
---- binutils-2.17.50.0.18/bfd/elf.c.orig	2007-08-01 11:12:02.000000000 -0400
-+++ binutils-2.17.50.0.18/bfd/elf.c	2007-08-01 14:27:36.086986774 -0400
-@@ -1085,6 +1085,7 @@
-     case PT_GNU_EH_FRAME: pt = "EH_FRAME"; break;
-     case PT_GNU_STACK: pt = "STACK"; break;
-     case PT_GNU_RELRO: pt = "RELRO"; break;
-+    case PT_PAX_FLAGS: pt = "PAX_FLAGS"; break;
-     default: pt = NULL; break;
-     }
-   return pt;
-@@ -2346,6 +2347,9 @@
-     case PT_GNU_RELRO:
-       return _bfd_elf_make_section_from_phdr (abfd, hdr, hdr_index, "relro");
- 
-+    case PT_PAX_FLAGS:
-+      return _bfd_elf_make_section_from_phdr (abfd, hdr, hdr_index, "pax_flags");
-+
-     default:
-       /* Check for any processor-specific program segment types.  */
-       bed = get_elf_backend_data (abfd);
-@@ -3326,6 +3330,11 @@
-       ++segs;
-     }
- 
-+    {
-+      /* We need a PT_PAX_FLAGS segment.  */
-+      ++segs;
-+    }
-+
-   for (s = abfd->sections; s != NULL; s = s->next)
-     {
-       if ((s->flags & SEC_LOAD) != 0
-@@ -3945,6 +3954,20 @@
- 	  pm = &m->next;
- 	}
- 
-+      {
-+        amt = sizeof (struct elf_segment_map);
-+        m = bfd_zalloc (abfd, amt);
-+        if (m == NULL)
-+  	goto error_return;
-+        m->next = NULL;
-+        m->p_type = PT_PAX_FLAGS;
-+        m->p_flags = elf_tdata (abfd)->pax_flags;
-+        m->p_flags_valid = 1;
-+  
-+        *pm = m;
-+        pm = &m->next;
-+      }
-+
-       free (sections);
-       elf_tdata (abfd)->segment_map = mfirst;
-     }
-@@ -5129,7 +5152,8 @@
-        5. PT_GNU_STACK segments do not include any sections.
-        6. PT_TLS segment includes only SHF_TLS sections.
-        7. SHF_TLS sections are only in PT_TLS or PT_LOAD segments.
--       8. PT_DYNAMIC should not contain empty sections at the beginning
-+       8. PT_PAX_FLAGS segments do not include any sections.
-+       9. PT_DYNAMIC should not contain empty sections at the beginning
- 	  (with the possible exception of .dynamic).  */
- #define IS_SECTION_IN_INPUT_SEGMENT(section, segment, bed)		\
-   ((((segment->p_paddr							\
-@@ -5138,6 +5162,7 @@
-      && (section->flags & SEC_ALLOC) != 0)				\
-     || IS_COREFILE_NOTE (segment, section))				\
-    && segment->p_type != PT_GNU_STACK					\
-+   && segment->p_type != PT_PAX_FLAGS					\
-    && (segment->p_type != PT_TLS					\
-        || (section->flags & SEC_THREAD_LOCAL))				\
-    && (segment->p_type == PT_LOAD					\
---- binutils-2.23.52.0.1/bfd/elflink.c.orig	2013-02-27 21:28:03.000000000 +0100
-+++ binutils-2.23.52.0.1/bfd/elflink.c	2013-03-01 17:32:44.922717879 +0100
-@@ -5764,18 +5764,32 @@
-       && ! (*bed->elf_backend_always_size_sections) (output_bfd, info))
-     return FALSE;
- 
-+  elf_tdata (output_bfd)->pax_flags = PF_NORANDEXEC;
-+
-+  if (info->execheap)
-+    elf_tdata (output_bfd)->pax_flags |= PF_NOMPROTECT;
-+  else if (info->noexecheap)
-+    elf_tdata (output_bfd)->pax_flags |= PF_MPROTECT;
-+
-   /* Determine any GNU_STACK segment requirements, after the backend
-      has had a chance to set a default segment size.  */
-   if (info->execstack)
-+  {
-     elf_stack_flags (output_bfd) = PF_R | PF_W | PF_X;
-+    elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
-+  }
-   else if (info->noexecstack)
-+  {
-     elf_stack_flags (output_bfd) = PF_R | PF_W;
-+    elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
-+  }
-   else
-     {
-       bfd *inputobj;
-       asection *notesec = NULL;
-       int exec = 0;
- 
-+      elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
-       for (inputobj = info->input_bfds;
- 	   inputobj;
- 	   inputobj = inputobj->link_next)
-@@ -5789,7 +5803,11 @@
- 	  if (s)
- 	    {
- 	      if (s->flags & SEC_CODE)
--		exec = PF_X;
-+		{
-+		  elf_tdata (output_bfd)->pax_flags &= ~PF_NOEMUTRAMP;
-+		  elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
-+		  exec = PF_X;
-+		}
- 	      notesec = s;
- 	    }
- 	  else if (bed->default_execstack)
---- binutils-2.15.94.0.2.2.orig/binutils/readelf.c	2005-02-18 07:14:30.000000000 +0100
-+++ binutils-2.15.94.0.2.2/binutils/readelf.c	2005-02-20 13:13:17.470541784 +0100
-@@ -2293,6 +2293,7 @@
- 			return "GNU_EH_FRAME";
-     case PT_GNU_STACK:	return "GNU_STACK";
-     case PT_GNU_RELRO:  return "GNU_RELRO";
-+    case PT_PAX_FLAGS:	return "PAX_FLAGS";
- 
-     default:
-       if ((p_type >= PT_LOPROC) && (p_type <= PT_HIPROC))
---- binutils-2.15.94.0.2.2.orig/include/bfdlink.h	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/include/bfdlink.h	2005-02-20 13:13:17.476540872 +0100
-@@ -313,6 +313,14 @@
-      flags.  */
-   unsigned int noexecstack: 1;
- 
-+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_NOMPROTECT
-+     flags.  */
-+  unsigned int execheap: 1;
-+
-+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_MPROTECT
-+     flags.  */
-+  unsigned int noexecheap: 1;
-+
-   /* TRUE if PT_GNU_RELRO segment should be created.  */
-   unsigned int relro: 1;
- 
---- binutils-2.15.94.0.2.2.orig/include/elf/common.h	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/include/elf/common.h	2005-02-20 13:13:17.482539960 +0100
-@@ -423,6 +423,7 @@
- #define PT_SUNW_EH_FRAME PT_GNU_EH_FRAME      /* Solaris uses the same value */
- #define PT_GNU_STACK	(PT_LOOS + 0x474e551) /* Stack flags */
- #define PT_GNU_RELRO	(PT_LOOS + 0x474e552) /* Read-only after relocation */
-+#define PT_PAX_FLAGS   (PT_LOOS + 0x5041580) /* PaX flags */
- 
- /* Program segment permissions, in program header p_flags field.  */
- 
-@@ -433,6 +434,19 @@
- #define PF_MASKOS	0x0FF00000	/* New value, Oct 4, 1999 Draft */
- #define PF_MASKPROC	0xF0000000	/* Processor-specific reserved bits */
- 
-+#define PF_PAGEEXEC        (1 << 4)    /* Enable  PAGEEXEC */
-+#define PF_NOPAGEEXEC  (1 << 5)    /* Disable PAGEEXEC */
-+#define PF_SEGMEXEC        (1 << 6)    /* Enable  SEGMEXEC */
-+#define PF_NOSEGMEXEC  (1 << 7)    /* Disable SEGMEXEC */
-+#define PF_MPROTECT        (1 << 8)    /* Enable  MPROTECT */
-+#define PF_NOMPROTECT  (1 << 9)    /* Disable MPROTECT */
-+#define PF_RANDEXEC        (1 << 10)   /* Enable  RANDEXEC */
-+#define PF_NORANDEXEC  (1 << 11)   /* Disable RANDEXEC */
-+#define PF_EMUTRAMP        (1 << 12)   /* Enable  EMUTRAMP */
-+#define PF_NOEMUTRAMP  (1 << 13)   /* Disable EMUTRAMP */
-+#define PF_RANDMMAP        (1 << 14)   /* Enable  RANDMMAP */
-+#define PF_NORANDMMAP  (1 << 15)   /* Disable RANDMMAP */
-+
- /* Values for section header, sh_type field.  */
- 
- #define SHT_NULL	0		/* Section header table entry unused */
---- binutils-2.18.50.0.1/ld/emultempl/elf32.em.orig	2007-09-08 19:34:12.000000000 +0200
-+++ binutils-2.18.50.0.1/ld/emultempl/elf32.em	2007-09-15 21:41:35.688212063 +0200
-@@ -2139,6 +2139,16 @@
- 	  link_info.noexecstack = TRUE;
- 	  link_info.execstack = FALSE;
- 	}
-+      else if (strcmp (optarg, "execheap") == 0)
-+	{
-+	  link_info.execheap = TRUE;
-+	  link_info.noexecheap = FALSE;
-+	}
-+      else if (strcmp (optarg, "noexecheap") == 0)
-+	{
-+	  link_info.noexecheap = TRUE;
-+	  link_info.execheap = FALSE;
-+	}
- EOF
- 
-   if test -n "$COMMONPAGESIZE"; then
---- binutils-2.15.94.0.2.2.orig/ld/ldgram.y	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/ld/ldgram.y	2005-02-20 13:13:17.499537376 +0100
-@@ -1073,6 +1073,8 @@
- 			    $$ = exp_intop (0x6474e550);
- 			  else if (strcmp (s, "PT_GNU_STACK") == 0)
- 			    $$ = exp_intop (0x6474e551);
-+			  else if (strcmp (s, "PT_PAX_FLAGS") == 0)
-+			    $$ = exp_intop (0x65041580);
- 			  else
- 			    {
- 			      einfo (_("\
---- binutils-2.26/ld/lexsup.c.orig	2015-11-13 09:27:42.000000000 +0100
-+++ binutils-2.26/ld/lexsup.c	2016-01-26 21:08:41.787138458 +0100
-@@ -1793,8 +1793,12 @@
-   fprintf (file, _("\
-   -z muldefs                  Allow multiple definitions\n"));
-   fprintf (file, _("\
-+  -z execheap                 Mark executable as requiring executable heap\n"));
-+  fprintf (file, _("\
-   -z execstack                Mark executable as requiring executable stack\n"));
-   fprintf (file, _("\
-+  -z noexecheap               Mark executable as not requiring executable heap\n"));
-+  fprintf (file, _("\
-   -z noexecstack              Mark executable as not requiring executable stack\n"));
- }
- 
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index a9c08e1c5b73..e5c52f620ac5 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -88,7 +88,6 @@ in
     doCheck = false; # fails 4 out of 1453 tests
 
     postInstall = ''
-      paxmark m $out/bin/node
       PATH=$out/bin:$PATH patchShebangs $out
 
       ${optionalString enableNpm ''
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 4790145e01f6..7d98e5cf4886 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -59,7 +59,7 @@ in lib.init bootStages ++ [
       extraNativeBuildInputs = old.extraNativeBuildInputs
         ++ lib.optionals
              (hostPlatform.isLinux && !buildPlatform.isLinux)
-             [ buildPackages.patchelf buildPackages.paxctl ]
+             [ buildPackages.patchelf ]
         ++ lib.optional
              (let f = p: !p.isx86 || p.libc == "musl"; in f hostPlatform && !(f buildPlatform))
              buildPackages.updateAutotoolsGnuConfigScriptsHook
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index be9d38f9780a..f77f43aea886 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -130,9 +130,6 @@ let
       # The derivation's `system` is `buildPlatform.system`.
       inherit (buildPlatform) system;
 
-      # Whether we should run paxctl to pax-mark binaries.
-      needsPax = isLinux;
-
       inherit (import ./make-derivation.nix {
         inherit lib config stdenv;
       }) mkDerivation;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index be96d018612c..03fa589138d5 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -280,10 +280,6 @@ if [ -z "${SHELL:-}" ]; then echo "SHELL not set"; exit 1; fi
 BASH="$SHELL"
 export CONFIG_SHELL="$SHELL"
 
-# Dummy implementation of the paxmark function. On Linux, this is
-# overwritten by paxctl's setup hook.
-paxmark() { true; }
-
 
 # Execute the pre-hook.
 if [ -z "${shell:-}" ]; then export shell="$SHELL"; fi
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 28c3b9f3fb45..12bf781de709 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -216,7 +216,7 @@ in
       inherit (prevStage)
         ccWrapperStdenv
         gcc-unwrapped coreutils gnugrep
-        perl paxctl gnum4 bison;
+        perl gnum4 bison;
       # This also contains the full, dynamically linked, final Glibc.
       binutils = prevStage.binutils.override {
         # Rewrap the binutils with the new glibc, so both the next
@@ -250,7 +250,7 @@ in
         isl = isl_0_17;
       };
     };
-    extraNativeBuildInputs = [ prevStage.patchelf prevStage.paxctl ] ++
+    extraNativeBuildInputs = [ prevStage.patchelf ] ++
       # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
       lib.optional (!localSystem.isx86 || localSystem.libc == "musl")
                    prevStage.updateAutotoolsGnuConfigScriptsHook;
@@ -325,7 +325,7 @@ in
       initialPath =
         ((import ../common-path.nix) {pkgs = prevStage;});
 
-      extraNativeBuildInputs = [ prevStage.patchelf prevStage.paxctl ] ++
+      extraNativeBuildInputs = [ prevStage.patchelf ] ++
         # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
         lib.optional (!localSystem.isx86 || localSystem.libc == "musl")
         prevStage.updateAutotoolsGnuConfigScriptsHook;
@@ -349,7 +349,7 @@ in
         # Simple executable tools
         concatMap (p: [ (getBin p) (getLib p) ]) [
             gzip bzip2 xz bash binutils.bintools coreutils diffutils findutils
-            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
+            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed
           ]
         # Library dependencies
         ++ map getLib (
@@ -368,7 +368,7 @@ in
         inherit (prevStage)
           gzip bzip2 xz bash coreutils diffutils findutils gawk
           gnumake gnused gnutar gnugrep gnupatch patchelf
-          attr acl paxctl zlib pcre;
+          attr acl zlib pcre;
         ${localSystem.libc} = getLibc prevStage;
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
         # Need to get rid of these when cross-compiling.
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 86287779792d..d50797508596 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -109,8 +109,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    paxmark pms $out/sbin/grub-{probe,bios-setup}
-
     # Avoid a runtime reference to gcc
     sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
   '';
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index d4d79c6e59fa..94beff8dfe37 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -90,10 +90,6 @@ stdenv.mkDerivation rec {
   doCheck = false;
   enableParallelBuilding = true;
 
-  postInstall = ''
-    paxmark pms $out/sbin/grub-{probe,bios-setup}
-  '';
-
   meta = with stdenv.lib; {
     description = "GRUB 2.0 extended with TCG (TPM) support for integrity measured boot process (trusted boot)";
     homepage = https://github.com/Sirrix-AG/TrustedGRUB2;

From 9d1bac05fb83d0897858c10784b5e84f6a84357a Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 22 Dec 2018 23:35:21 +0100
Subject: [PATCH 131/182] =?UTF-8?q?vala=5F0=5F36:=200.36.15=20=E2=86=92=20?=
 =?UTF-8?q?0.36.17?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/compilers/vala/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index a721625b1f46..6f03155b5b92 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -53,8 +53,8 @@ in rec {
 
   vala_0_36 = generic {
     major   = "0.36";
-    minor   = "15";
-    sha256  = "11lnwjbhiz2l7g6y1f0jb0s81ymgssinlil3alibzcwmzpk175ix";
+    minor   = "17";
+    sha256  = "1f6qg40zd6jzhbwr3dy4fb66k4qs1xlk2whdyqh64zxxjw0k9pv7";
   };
 
   vala_0_38 = generic {

From d4baea0c509dfa1a234852338b9e756233d3b7ca Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 22 Dec 2018 23:35:54 +0100
Subject: [PATCH 132/182] =?UTF-8?q?vala=5F0=5F40:=200.40.11=20=E2=86=92=20?=
 =?UTF-8?q?0.40.12?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/compilers/vala/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 6f03155b5b92..92edbff09da1 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -66,8 +66,8 @@ in rec {
 
   vala_0_40 = generic {
     major   = "0.40";
-    minor   = "11";
-    sha256  = "0xhm61kjdws167pafcji43s7icfvpq58lkbq3irb1jv3icjr3i8z";
+    minor   = "12";
+    sha256  = "1nhk45w5iwg97q3cfybn0i4qz5w9qvk423ndpg6mq6cnna076snx";
   };
 
   vala_0_42 = generic {

From 73ed35d72f5e83c0a7c518d1e9bb917e0ca2a41c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 22 Dec 2018 23:36:22 +0100
Subject: [PATCH 133/182] =?UTF-8?q?vala=5F0=5F42:=200.42.3=20=E2=86=92=200?=
 =?UTF-8?q?.42.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/compilers/vala/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 92edbff09da1..952f18c9bb2d 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -72,8 +72,8 @@ in rec {
 
   vala_0_42 = generic {
     major   = "0.42";
-    minor   = "3";
-    sha256  = "0zaq9009wqk5aah131m426a2ia0scwpjpl4npf8p7p43wv8kvisz";
+    minor   = "4";
+    sha256  = "07jgkx812y7wq4cswwfsf1f4k3lq9hcjra45682bdi8a11nr0a5m";
   };
 
   vala = vala_0_42;

From 903e0de62cfbbdead65ab8c29191f791022d94e8 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 23 Dec 2018 00:04:55 +0100
Subject: [PATCH 134/182] =?UTF-8?q?python3.pkgs.pygobject3:=203.30.2=20?=
 =?UTF-8?q?=E2=86=92=203.30.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/python-modules/pygobject/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index acc8ee713117..d1b2f075b914 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -3,13 +3,13 @@ pycairo, cairo, which, ncurses, meson, ninja, isPy3k, gnome3 }:
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.30.2";
+  version = "3.30.4";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "15zd4w43js048y7fd1kdi6wpvccz1njjy60xw1ckvfy1qhikbz54";
+    sha256 = "0hscyvr6hh8l90fyz97b9d03506g3r8s5hl1bgk5aadq8jja3h9d";
   };
 
   outputs = [ "out" "dev" ];

From 3148c89b3cae9f508001b80e674f3578474480cc Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 23 Dec 2018 02:01:49 +0100
Subject: [PATCH 135/182] openjpeg: fix includedir in cmake config files

---
 pkgs/development/libraries/openjpeg/2.x.nix   | 10 ++++
 .../fix-cmake-config-includedir.patch         | 55 +++++++++++++++++++
 .../libraries/openjpeg/generic.nix            |  4 +-
 3 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch

diff --git a/pkgs/development/libraries/openjpeg/2.x.nix b/pkgs/development/libraries/openjpeg/2.x.nix
index fd9c7eea8c2e..3aa2fdf0dd25 100644
--- a/pkgs/development/libraries/openjpeg/2.x.nix
+++ b/pkgs/development/libraries/openjpeg/2.x.nix
@@ -6,6 +6,11 @@ callPackage ./generic.nix (args // rec {
   revision = "v${version}";
   sha256 = "08plxrnfl33sn2vh5nwbsngyv6b1sfpplvx881crm1v1ai10m2lz";
 
+  extraFlags = [
+    "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/openjpeg-${branch}"
+    "-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/openjpeg-${branch}"
+  ];
+
   patches = [
     (fetchpatch {
       name = "CVE-2018-7648.patch";
@@ -17,5 +22,10 @@ callPackage ./generic.nix (args // rec {
       url = "https://github.com/uclouvain/openjpeg/commit/92023cd6c377e0384a7725949b25655d4d94dced.patch";
       sha256 = "0rrxxqcp3vjkmvywxj9ac766m3fppy0x0nszrkf8irrqy1gnp38k";
     })
+    (fetchpatch {
+      url = https://github.com/uclouvain/openjpeg/commit/24fd3ce777a64b8b315cfe1ee642ec7b1cc6aa97.patch;
+      sha256 = "1sl5wplgdfiqw8qbd8s5j5hq3ynbwgsnv8nxqfrk5s7vyrzx9pxv";
+    })
+    ./fix-cmake-config-includedir.patch
   ];
 })
diff --git a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
new file mode 100644
index 000000000000..6ff720ead4e1
--- /dev/null
+++ b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
@@ -0,0 +1,55 @@
+--- a/cmake/OpenJPEGConfig.cmake.in
++++ b/cmake/OpenJPEGConfig.cmake.in
+@@ -32,7 +32,7 @@
+   set(INC_DIR "@CMAKE_INSTALL_PREFIX@/@OPENJPEG_INSTALL_INCLUDE_DIR@")
+   file(RELATIVE_PATH PKG_TO_INC_RPATH "${PKG_DIR}" "${INC_DIR}")
+ 
+-  get_filename_component(OPENJPEG_INCLUDE_DIRS "${SELF_DIR}/${PKG_TO_INC_RPATH}" ABSOLUTE)
++  get_filename_component(OPENJPEG_INCLUDE_DIRS "@OPENJPEG_INSTALL_INCLUDE_DIR@" ABSOLUTE)
+ 
+ else()
+   if(EXISTS ${SELF_DIR}/OpenJPEGExports.cmake)
+--- a/src/lib/openjp2/libopenjp2.pc.cmake.in
++++ b/src/lib/openjp2/libopenjp2.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjp2
+ Description: JPEG2000 library (Part 1 and 2)
+--- a/src/lib/openjp3d/libopenjp3d.pc.cmake.in
++++ b/src/lib/openjp3d/libopenjp3d.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjp3d
+ Description: JPEG2000 Extensions for three-dimensional data (Part 10)
+--- a/src/lib/openjpip/libopenjpip.pc.cmake.in
++++ b/src/lib/openjpip/libopenjpip.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjpip
+ Description: JPEG2000 Interactivity tools, APIs and protocols (Part 9)
+--- a/src/lib/openjpwl/libopenjpwl.pc.cmake.in
++++ b/src/lib/openjpwl/libopenjpwl.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjpwl
+ Description: JPEG2000 Wireless library (Part 11)
diff --git a/pkgs/development/libraries/openjpeg/generic.nix b/pkgs/development/libraries/openjpeg/generic.nix
index 96cf0451ebf4..d3130a64b030 100644
--- a/pkgs/development/libraries/openjpeg/generic.nix
+++ b/pkgs/development/libraries/openjpeg/generic.nix
@@ -11,7 +11,7 @@
 , testsSupport ? false
 , jdk ? null
 # Inherit generics
-, branch, version, revision, sha256, patches ? [], ...
+, branch, version, revision, sha256, patches ? [], extraFlags ? [], ...
 }:
 
 assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     (mkFlag jp3dSupport "BUILD_JP3D")
     (mkFlag thirdPartySupport "BUILD_THIRDPARTY")
     (mkFlag testsSupport "BUILD_TESTING")
-  ];
+  ] ++ extraFlags;
 
   nativeBuildInputs = [ cmake pkgconfig ];
 

From 8aea3e4ca6ae4bf2eef011fdb4622f8dc2ecf1fa Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 23 Dec 2018 02:25:20 +0100
Subject: [PATCH 136/182] =?UTF-8?q?poppler:=200.67.0=20=E2=86=92=200.72.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/poppler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 53ed04527a84..e5b469f73956 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let # beware: updates often break cups-filters build
-  version = "0.67.0";
+  version = "0.72.0";
   mkFlag = optset: flag: "-DENABLE_${flag}=${if optset then "on" else "off"}";
 in
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "1yb6agmcxf0ixqm65d4aknl0hgmswf94x0k59ic0qqav1wd4yjm3";
+    sha256 = "0lfs1b1jfamxl13zbl5n448dqvl9n8frbv8180y7b7kfyaw7wx61";
   };
 
   outputs = [ "out" "dev" ];

From 6d36caab188bdf80a8842a5e1144022b28a16a47 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 23 Dec 2018 02:39:47 +0100
Subject: [PATCH 137/182] =?UTF-8?q?cups-filters:=201.20.4=20=E2=86=92=201.?=
 =?UTF-8?q?21.6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/misc/cups/filters.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/misc/cups/filters.nix b/pkgs/misc/cups/filters.nix
index 9eeadda73fc8..348b7c6550e2 100644
--- a/pkgs/misc/cups/filters.nix
+++ b/pkgs/misc/cups/filters.nix
@@ -2,7 +2,6 @@
 , libjpeg, libpng, perl, ijs, qpdf, dbus, avahi
 , makeWrapper, coreutils, gnused, bc, gawk, gnugrep, which, ghostscript
 , mupdf
-, fetchpatch
 }:
 
 let
@@ -10,23 +9,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "cups-filters-${version}";
-  version = "1.20.4";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://openprinting.org/download/cups-filters/${name}.tar.xz";
-    sha256 = "0sjkmclcb1r77015wllsyz26272br3s17v6b1q2xwb2nm2gnwx9k";
+    sha256 = "0k0x9p40bahq44189vy9zai2ia9i91h26chrddr0m9agzsy5s3k3";
   };
 
-  patches = [
-    # This patch fixes cups-filters when compiled with poppler-0.67.0.
-    # Issue: https://github.com/OpenPrinting/cups-filters/pull/50
-    # PR: https://github.com/OpenPrinting/cups-filters/pull/51
-    (fetchpatch {
-      url = "https://github.com/OpenPrinting/cups-filters/commit/219de01c61f3b1ec146abf142d0dfc8c560cc58e.patch";
-      sha256 = "0f0lql3rbm2g8mxrpigfyi8fb4i2g4av20g417jzdilp60jq0ny8";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
   buildInputs = [

From 76725778ce9f1ada7535502f8dfbbf5424ba7fdd Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 23 Dec 2018 03:07:29 +0100
Subject: [PATCH 138/182] texlive.bin.core: Fix build with poppler 0.72

---
 pkgs/tools/typesetting/tex/texlive/bin.nix | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 29a7f05af071..207c885ef4a5 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -28,9 +28,19 @@ let
 
     patches = [
       (fetchurl {
-        name = "texlive-poppler-0.64.patch";
-        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.64.patch?h=packages/texlive-bin&id=da56abf0f8a1e85daca0ec0f031b8fa268519e6b;
-        sha256 = "0443d074zl3c5raba8jyhavish706arjcd80ibb84zwnwck4ai0w";
+        name = "poppler-compat-fixes-up-to-0.70.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/poppler-compat-fixes-up-to-0.70.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "0a8bvyl7v6zlyyg3ycl0dmg2g2qahxlq3qmc1nv33r24anzb8xhs";
+      })
+      (fetchurl {
+        name = "luatex-poppler-0.70-const-fixes.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/luatex-poppler-0.70-const-fixes.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "0yiw2x97whdi23dc10xnqpxqj3aja15alir1byp1y03j60zv5n7i";
+      })
+      (fetchurl {
+        name = "texlive-poppler-0.71.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.71.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "164wibyf786gdcb0ij4svsmyi13wvcx0cpdr4flki0lpy3igvlnq";
       })
       (fetchurl {
         name = "synctex-missing-header.patch";
@@ -89,8 +99,10 @@ core = stdenv.mkDerivation rec {
     for i in texk/kpathsea/mktex*; do
       sed -i '/^mydir=/d' "$i"
     done
-    cp -pv texk/web2c/pdftexdir/pdftoepdf{-newpoppler.cc,.cc}
-    cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler.cc,.cc}
+    cp -pv texk/web2c/pdftexdir/pdftoepdf{-poppler0.70.0,}.cc
+    cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler,}.cc
+    # fix build with poppler 0.71
+    find texk/web2c/{lua,pdf}texdir -type f | xargs sed -e 's|gTrue|true|g' -e 's|gFalse|false|g' -e 's|GBool|bool|g' -e 's|getCString|c_str|g' -i
   '';
 
   preConfigure = ''

From 0a35c5cc8ca13ea185d9092db641da7fb1aed05c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 22 Dec 2018 11:42:22 +0000
Subject: [PATCH 139/182] coreutils: fix unprivileged sandbox build

In usernamespaces some POSIX assumptions break, which
make some coreutils fail when running with sandbox but without a nix-deamon.
With this pull request it is possible to bootstrap stdenv without root-permission,
which is quiet useful in HPC environments.
---
 pkgs/tools/misc/coreutils/default.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 0ddfad65a7a1..70f72513795e 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -25,16 +25,27 @@ stdenv.mkDerivation rec {
 
   patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
-  # The test tends to fail on btrfs and maybe other unusual filesystems.
   postPatch = ''
+    # The test tends to fail on btrfs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 0' -i ./tests/dd/sparse.sh
     sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh
+
+    # sandbox does not allow setgid
     sed '2i echo Skipping chmod setgid test && exit 0' -i ./tests/chmod/setgid.sh
-    sed '2i print "Skipping env -S test";  exit 0;' -i ./tests/misc/env-S.pl
     substituteInPlace ./tests/install/install-C.sh \
       --replace 'mode3=2755' 'mode3=1755'
+
+    sed '2i print "Skipping env -S test";  exit 0;' -i ./tests/misc/env-S.pl
+
+    # these tests fail in the unprivileged nix sandbox (without nix-daemon) as we break posix assumptions
+    for f in ./tests/chgrp/{basic.sh,recurse.sh,default-no-deref.sh,no-x.sh,posix-H.sh}; do
+      sed '2i echo Skipping chgrp && exit 0' -i "$f"
+    done
+    for f in gnulib-tests/{test-chown.c,test-fchownat.c,test-lchown.c}; do
+      echo "int main() { return 0; }" > "$f"
+    done
   '';
 
   outputs = [ "out" "info" ];

From 2a1c199e2937b8eba8b4513b3ba9a2b7757e4136 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 03:10:01 +0100
Subject: [PATCH 140/182] =?UTF-8?q?gtk3:=203.24.1=20=E2=86=92=203.24.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also fixes language names.
---
 pkgs/development/libraries/gtk+/3.x.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 421029a9d55f..5c6cd2c7eda0 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, gettext, perl, makeWrapper, shared-mime-info
+{ stdenv, fetchurl, fetchpatch, pkgconfig, gettext, perl, makeWrapper, shared-mime-info, isocodes
 , expat, glib, cairo, pango, gdk_pixbuf, atk, at-spi2-atk, gobject-introspection
 , xorg, epoxy, json-glib, libxkbcommon, gmp, gnome3
 , x11Support ? stdenv.isLinux
@@ -13,14 +13,14 @@ assert cupsSupport -> cups != null;
 with stdenv.lib;
 
 let
-  version = "3.24.1";
+  version = "3.24.2";
 in
 stdenv.mkDerivation rec {
   name = "gtk+3-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "0bxhsp7cjph7szg1iyv16nwi60bz59x1smjkqv6sv6mr0zipnf38";
+    sha256 = "14l8mimdm44r3h5pn5hzigl1z25jna8jxvb16l88v4nc4zj0afsv";
   };
 
   outputs = [ "out" "dev" ];
@@ -35,9 +35,14 @@ stdenv.mkDerivation rec {
       url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
+    # https://gitlab.gnome.org/GNOME/gtk/issues/1521
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gtk/commit/2905fc861acda3d134a198e56ef2f6c962ad3061.patch;
+      sha256 = "0y8ljny59kgdhrcfpimi2r082bax60d5kflw1qj9k1mnzjcvjjwl";
+    })
   ];
 
-  buildInputs = [ libxkbcommon epoxy json-glib ]
+  buildInputs = [ libxkbcommon epoxy json-glib isocodes ]
     ++ optional stdenv.isDarwin AppKit;
   propagatedBuildInputs = with xorg; with stdenv.lib;
     [ expat glib cairo pango gdk_pixbuf atk at-spi2-atk gnome3.gsettings-desktop-schemas

From 4e1dd3ce7a36dc2048f1aae22163637ead2e03a9 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 03:45:34 +0100
Subject: [PATCH 141/182] =?UTF-8?q?gtkmm3:=203.22.2=20=E2=86=92=203.24.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/gtkmm/3.x.nix | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index 7845143ebeb5..ba20af1caf51 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -1,15 +1,12 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy }:
+{ stdenv, fetchurl, pkgconfig, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy, gnome3 }:
 
-let
-  ver_maj = "3.22";
-  ver_min = "2";
-in
 stdenv.mkDerivation rec {
-  name = "gtkmm-${ver_maj}.${ver_min}";
+  pname = "gtkmm";
+  version = "3.24.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gtkmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "91afd98a31519536f5f397c2d79696e3d53143b80b75778521ca7b48cb280090";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0hxaq4x9jqj8vvnv3sb6nwapz83v8lclbm887qqci0g50llcjpyg";
   };
 
   outputs = [ "out" "dev" ];
@@ -24,6 +21,13 @@ stdenv.mkDerivation rec {
   # https://bugzilla.gnome.org/show_bug.cgi?id=764521
   doCheck = false;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "${pname}3";
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the GTK+ graphical user interface library";
 

From d1e5f0060c5c857664ba6ca5e5804bf9f62de7e4 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 03:53:08 +0100
Subject: [PATCH 142/182] =?UTF-8?q?glibmm:=202.56.0=20=E2=86=92=202.58.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/glibmm/default.nix | 27 ++++++++-----------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index ee77f4b498e4..10d5ee275006 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -1,27 +1,16 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, gnum4, glib, libsigcxx }:
+{ stdenv, fetchurl, pkgconfig, gnum4, glib, libsigcxx, gnome3 }:
 
-let
-  ver_maj = "2.56";
-  ver_min = "0";
-in
 stdenv.mkDerivation rec {
-  name = "glibmm-${ver_maj}.${ver_min}";
+  pname = "glibmm";
+  version = "2.58.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/glibmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "1abrkqhca5p8n6ly3vp1232rny03s7lrd8f8iz2m2m141nxgqx3f";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0idnaii4h3mdym2a55gkavipyxigwvbgfmzmwql85s4rgciqjhfk";
   };
 
   outputs = [ "out" "dev" ];
 
-  patchFlags = "-p0";
-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/macports/macports-ports/e864b2340be9ef003d8ff4aef92e7151d06287dd/devel/glibmm/files/0001-ustring-Fix-wchar-conversion-on-macOS-with-libc.patch";
-      sha256 = "02qvnailw1i59cjbj3cy7y02kfcivsvkdjrf4njkp4plarayyqp9";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig gnum4 ];
   propagatedBuildInputs = [ glib libsigcxx ];
 
@@ -29,6 +18,12 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails. one test needs the net, another /etc/fstab
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the GLib library";
 

From 426e6ee1836a89c51d7278cb5f31344ac476891c Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 04:14:37 +0100
Subject: [PATCH 143/182] =?UTF-8?q?pangomm:=202.40.1=20=E2=86=92=202.42.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../development/libraries/pangomm/default.nix | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/pangomm/default.nix b/pkgs/development/libraries/pangomm/default.nix
index 93c2501a6203..064ebf71cc32 100644
--- a/pkgs/development/libraries/pangomm/default.nix
+++ b/pkgs/development/libraries/pangomm/default.nix
@@ -1,16 +1,13 @@
-{ stdenv, fetchurl, pkgconfig, pango, glibmm, cairomm
+{ stdenv, fetchurl, pkgconfig, pango, glibmm, cairomm, gnome3
 , ApplicationServices }:
 
-let
-  ver_maj = "2.40";
-  ver_min = "1";
-in
 stdenv.mkDerivation rec {
-  name = "pangomm-${ver_maj}.${ver_min}";
+  pname = "pangomm";
+  version= "2.42.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/pangomm/${ver_maj}/${name}.tar.xz";
-    sha256 = "9762ee2a2d5781be6797448d4dd2383ce14907159b30bc12bf6b08e7227be3af";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0mmzxp3wniaafkxr30sb22mq9x44xckb5d60h1bl99lkzxks0vfa";
   };
 
   outputs = [ "out" "dev" ];
@@ -22,6 +19,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the Pango text rendering library";
     homepage    = https://www.pango.org/;

From 4439234623502140b9596e4bf066574b89f718a1 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 04:22:07 +0100
Subject: [PATCH 144/182] =?UTF-8?q?libgsf:=201.14.44=20=E2=86=92=201.14.45?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/libgsf/default.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libgsf/default.nix b/pkgs/development/libraries/libgsf/default.nix
index bcd37396bf7f..4e7ff0314381 100644
--- a/pkgs/development/libraries/libgsf/default.nix
+++ b/pkgs/development/libraries/libgsf/default.nix
@@ -1,12 +1,13 @@
 { fetchurl, stdenv, pkgconfig, intltool, gettext, glib, libxml2, zlib, bzip2
-, python, perl, gdk_pixbuf, libiconv, libintl }:
+, python, perl, gdk_pixbuf, libiconv, libintl, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgsf-1.14.44";
+  pname = "libgsf";
+  version = "1.14.45";
 
   src = fetchurl {
-    url    = "mirror://gnome/sources/libgsf/1.14/${name}.tar.xz";
-    sha256 = "1ppzfk3zmmgrg9jh8vc4dacddbfngjslq2wpj94pcr3i0c8dxgk8";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1yk91ccf7z9b8d8ac6vip3gc5c0pkwgabqy6l0pj0kf43l7jrg2w";
   };
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
@@ -21,6 +22,12 @@ stdenv.mkDerivation rec {
   doCheck = true;
   preCheck = "patchShebangs ./tests/";
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "GNOME's Structured File Library";
     homepage    = https://www.gnome.org/projects/libgsf;

From 1feaf340784cd401105a2b5a085e0a55f7a7452a Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 04:27:53 +0100
Subject: [PATCH 145/182] =?UTF-8?q?atkmm:=202.24.2=20=E2=86=92=202.28.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/atkmm/default.nix | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/atkmm/default.nix b/pkgs/development/libraries/atkmm/default.nix
index 9ec9e6284f83..5338aa683a7c 100644
--- a/pkgs/development/libraries/atkmm/default.nix
+++ b/pkgs/development/libraries/atkmm/default.nix
@@ -1,14 +1,12 @@
-{ stdenv, fetchurl, atk, glibmm, pkgconfig }:
-let
-  ver_maj = "2.24";
-  ver_min = "2";
-in
+{ stdenv, fetchurl, atk, glibmm, pkgconfig, gnome3 }:
+
 stdenv.mkDerivation rec {
-  name = "atkmm-${ver_maj}.${ver_min}";
+  pname = "atkmm";
+  version = "2.28.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/atkmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "ff95385759e2af23828d4056356f25376cfabc41e690ac1df055371537e458bd";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0fnxrspxkhhbrjphqrpvl3zjm66n50s4cywrrrwkhbflgy8zqk2c";
   };
 
   outputs = [ "out" "dev" ];
@@ -19,6 +17,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = {
     description = "C++ wrappers for ATK accessibility toolkit";
     license = stdenv.lib.licenses.lgpl21Plus;

From 192f4171d8a9cb7f2e675b4b96f16770bcf2bd15 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 15:38:52 +0100
Subject: [PATCH 146/182] llvm: allow passing arbitrary targets

Mesa requires AMDGPU target but previously, we only allowed a pre-defined set
of targets.
---
 pkgs/development/compilers/llvm/common.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/common.nix b/pkgs/development/compilers/llvm/common.nix
index e4f55963a6fb..27f48ff3f113 100644
--- a/pkgs/development/compilers/llvm/common.nix
+++ b/pkgs/development/compilers/llvm/common.nix
@@ -2,7 +2,9 @@
 
 rec {
   llvmBackend = platform:
-    if platform.parsed.cpu.family == "x86" then
+    if builtins.typeOf platform == "string" then
+      platform
+    else if platform.parsed.cpu.family == "x86" then
       "X86"
     else if platform.parsed.cpu.name == "aarch64" then
       "AArch64"

From ff22d90308d404dede8319fa6e22502ea058d3aa Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Mon, 24 Dec 2018 15:39:49 +0100
Subject: [PATCH 147/182] mesa_noglu: fix build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LLVM’s `LLVM_TARGETS_TO_BUILD` build flag defauls to `all`, which contains
`AMDGPU` among others. [1] Changes in llvm [2] switched to explicitly listing
host and target platforms, excluding the AMDGPU target, which is required
for Mesa to build.

[1]: https://github.com/llvm-mirror/llvm/blob/db50b6fe399b8ad8caef80fd8ee77607fb051fa5/CMakeLists.txt#L286-L302
[2]: https://github.com/NixOS/nixpkgs/pull/52031
---
 pkgs/development/compilers/llvm/6/llvm.nix | 3 ++-
 pkgs/development/compilers/llvm/7/llvm.nix | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 328f95f11b34..54617a075734 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -13,7 +13,8 @@
 , fetchpatch
 , debugVersion ? false
 , enableManpages ? false
-, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
+# Mesa requires AMDGPU target
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform "AMDGPU" ]
 , enableSharedLibraries ? true
 }:
 
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 2ef6b147214c..a852822cddc4 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -14,7 +14,8 @@
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
-, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform ]
+# Mesa requires AMDGPU target
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform "AMDGPU" ]
 , enablePFM ? !stdenv.isDarwin
 }:
 

From e16ec2920a785f5183ea2c10a051772abc8c6404 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Tue, 25 Dec 2018 10:21:36 +0100
Subject: [PATCH 148/182] texlive.bin.core-big: use postPatch from .core

Otherwise it wouldn't build with new poppler either.
(Perhaps not all of it is needed here, but why not apply it all?)
---
 pkgs/tools/typesetting/tex/texlive/bin.nix | 25 +++++++++++-----------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 207c885ef4a5..209cc45eee95 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -48,6 +48,17 @@ let
         sha256 = "1c4aq8lk8g3mlfq3mdjnxvmhss3qs7nni5rmw0k054dmj6q1xj5n";
       })
     ];
+
+    postPatch = ''
+      for i in texk/kpathsea/mktex*; do
+        sed -i '/^mydir=/d' "$i"
+      done
+      cp -pv texk/web2c/pdftexdir/pdftoepdf{-poppler0.70.0,}.cc
+      cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler,}.cc
+      # fix build with poppler 0.71
+      find texk/web2c/{lua,pdf}texdir -type f | xargs sed -e 's|gTrue|true|g' -e 's|gFalse|false|g' -e 's|GBool|bool|g' -e 's|getCString|c_str|g' -i
+    '';
+
     # remove when removing synctex-missing-header.patch
     preAutoreconf = "pushd texk/web2c";
     postAutoreconf = "popd";
@@ -82,7 +93,7 @@ texliveYear = year;
 core = stdenv.mkDerivation rec {
   name = "texlive-bin-${version}";
 
-  inherit (common) src patches preAutoreconf postAutoreconf;
+  inherit (common) src patches postPatch preAutoreconf postAutoreconf;
 
   outputs = [ "out" "doc" ];
 
@@ -95,16 +106,6 @@ core = stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  postPatch = ''
-    for i in texk/kpathsea/mktex*; do
-      sed -i '/^mydir=/d' "$i"
-    done
-    cp -pv texk/web2c/pdftexdir/pdftoepdf{-poppler0.70.0,}.cc
-    cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler,}.cc
-    # fix build with poppler 0.71
-    find texk/web2c/{lua,pdf}texdir -type f | xargs sed -e 's|gTrue|true|g' -e 's|gFalse|false|g' -e 's|GBool|bool|g' -e 's|getCString|c_str|g' -i
-  '';
-
   preConfigure = ''
     rm -r libs/{cairo,freetype2,gd,gmp,graphite2,harfbuzz,icu,libpaper,libpng} \
       libs/{mpfr,pixman,poppler,potrace,xpdf,zlib,zziplib}
@@ -184,7 +185,7 @@ inherit (core-big) metafont metapost luatex xetex;
 core-big = stdenv.mkDerivation { #TODO: upmendex
   name = "texlive-core-big.bin-${version}";
 
-  inherit (common) src patches preAutoreconf postAutoreconf;
+  inherit (common) src patches postPatch preAutoreconf postAutoreconf;
 
   hardeningDisable = [ "format" ];
 

From f5e2228708de5bfdaca9aadb41888916fbd04234 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 25 Dec 2018 02:20:16 -0800
Subject: [PATCH 149/182] nasm: 2.14 -> 2.14.01

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/nasm/versions
---
 pkgs/development/compilers/nasm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index 271d26eda1c0..511565495526 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nasm-${version}";
-  version = "2.14";
+  version = "2.14.01";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}.tar.bz2";
-    sha256 = "0i678zbm1ljn5jwia7gj1n503izwvzlh55xzm4i0qgfmr8kzsg6l";
+    sha256 = "1v9fazd3in0rphnw5ck58wqnl8dis4dyqpsqgjsm4h9jjj0vylvz";
   };
 
   nativeBuildInputs = [ perl ];

From c387a82979abe1227244ce1908ea9ee3f94f016e Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 16:32:09 +0100
Subject: [PATCH 150/182] =?UTF-8?q?python3.pkgs.pygobject3:=203.30.2=20?=
 =?UTF-8?q?=E2=86=92=203.30.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/python-modules/pygobject/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index acc8ee713117..d1b2f075b914 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -3,13 +3,13 @@ pycairo, cairo, which, ncurses, meson, ninja, isPy3k, gnome3 }:
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.30.2";
+  version = "3.30.4";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "15zd4w43js048y7fd1kdi6wpvccz1njjy60xw1ckvfy1qhikbz54";
+    sha256 = "0hscyvr6hh8l90fyz97b9d03506g3r8s5hl1bgk5aadq8jja3h9d";
   };
 
   outputs = [ "out" "dev" ];

From 5f77bef30b0ce4d43c3a83ae8cca34612965b347 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:06:47 +0100
Subject: [PATCH 151/182] libgxps: rename from gnome3.libgxps

---
 pkgs/desktops/gnome-3/default.nix                          | 4 +---
 .../core => development/libraries}/libgxps/default.nix     | 7 ++-----
 pkgs/top-level/all-packages.nix                            | 2 ++
 3 files changed, 5 insertions(+), 8 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgxps/default.nix (91%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 0f7b9f75d1a7..f15f4825aa13 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -169,8 +169,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgdata = callPackage ./core/libgdata { };
 
-  libgxps = callPackage ./core/libgxps { };
-
   libpeas = callPackage ./core/libpeas {};
 
   libgweather = callPackage ./core/libgweather { };
diff --git a/pkgs/desktops/gnome-3/core/libgxps/default.nix b/pkgs/development/libraries/libgxps/default.nix
similarity index 91%
rename from pkgs/desktops/gnome-3/core/libgxps/default.nix
rename to pkgs/development/libraries/libgxps/default.nix
index 852a546f4bf3..3b7f29de573f 100644
--- a/pkgs/desktops/gnome-3/core/libgxps/default.nix
+++ b/pkgs/development/libraries/libgxps/default.nix
@@ -2,14 +2,12 @@
 , libarchive, freetype, libjpeg, libtiff, gnome3, fetchpatch
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgxps";
   version = "0.3.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "412b1343bd31fee41f7204c47514d34c563ae34dafa4cc710897366bd6cd0fae";
   };
 
@@ -38,7 +36,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d89ecf338d44..2d864ae75474 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10783,6 +10783,8 @@ in
 
   libgrss = callPackage ../development/libraries/libgrss { };
 
+  libgxps = callPackage ../development/libraries/libgxps { };
+
   libiio = callPackage ../development/libraries/libiio { };
 
   libseccomp = callPackage ../development/libraries/libseccomp { };

From d6ab3a534fc7ee156c5d457acbb122ea81d8ce2a Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:11:30 +0100
Subject: [PATCH 152/182] libgdata: rename from gnome3.libgdata

---
 pkgs/desktops/gnome-3/default.nix                  |  4 +---
 .../libraries}/libgdata/default.nix                | 14 +++++---------
 pkgs/top-level/all-packages.nix                    |  2 +-
 3 files changed, 7 insertions(+), 13 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgdata/default.nix (80%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index f15f4825aa13..b88180c61669 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -167,8 +167,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgepub = callPackage ./core/libgepub { };
 
-  libgdata = callPackage ./core/libgdata { };
-
   libpeas = callPackage ./core/libpeas {};
 
   libgweather = callPackage ./core/libgweather { };
diff --git a/pkgs/desktops/gnome-3/core/libgdata/default.nix b/pkgs/development/libraries/libgdata/default.nix
similarity index 80%
rename from pkgs/desktops/gnome-3/core/libgdata/default.nix
rename to pkgs/development/libraries/libgdata/default.nix
index 4cbf0a78d894..b05468a478df 100644
--- a/pkgs/desktops/gnome-3/core/libgdata/default.nix
+++ b/pkgs/development/libraries/libgdata/default.nix
@@ -1,30 +1,27 @@
 { stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib
 , gobject-introspection, liboauth, gnome3, p11-kit, openssl, uhttpmock }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgdata";
   version = "0.17.9";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0fj54yqxdapdppisqm1xcyrpgcichdmipq0a0spzz6009ikzgi45";
   };
 
   NIX_CFLAGS_COMPILE = "-I${gnome3.libsoup.dev}/include/libsoup-gnome-2.4/ -I${gnome3.gcr}/include/gcr-3 -I${gnome3.gcr}/include/gck-1";
 
+  nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
+
   buildInputs = with gnome3;
-    [ pkgconfig libsoup intltool libxml2 glib gobject-introspection
-      liboauth gcr gnome-online-accounts p11-kit openssl uhttpmock ];
+    [ libsoup libxml2 glib liboauth gcr gnome-online-accounts p11-kit openssl uhttpmock ];
 
   propagatedBuildInputs = [ json-glib ];
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none"; # Stable version has not been updated for a long time.
     };
   };
@@ -36,5 +33,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.lgpl21Plus;
   };
-
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d864ae75474..ea302c2d7004 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10766,7 +10766,7 @@ in
 
   libgdamm = callPackage ../development/libraries/libgdamm { };
 
-  libgdata = gnome3.libgdata;
+  libgdata = callPackage ../development/libraries/libgdata { };
 
   libgig = callPackage ../development/libraries/libgig { };
 

From 878d289c6ff4d87e344d8ee3481ded0e8d110bb7 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:17:20 +0100
Subject: [PATCH 153/182] libgepub: rename from gnome3.libgepub

---
 pkgs/desktops/gnome-3/default.nix                          | 4 +---
 .../core => development/libraries}/libgepub/default.nix    | 7 ++-----
 pkgs/top-level/all-packages.nix                            | 2 ++
 3 files changed, 5 insertions(+), 8 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgepub/default.nix (85%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index b88180c61669..6873cc0e82dd 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -165,8 +165,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgee = callPackage ./core/libgee { };
 
-  libgepub = callPackage ./core/libgepub { };
-
   libpeas = callPackage ./core/libpeas {};
 
   libgweather = callPackage ./core/libgweather { };
diff --git a/pkgs/desktops/gnome-3/core/libgepub/default.nix b/pkgs/development/libraries/libgepub/default.nix
similarity index 85%
rename from pkgs/desktops/gnome-3/core/libgepub/default.nix
rename to pkgs/development/libraries/libgepub/default.nix
index 26531a61ffaa..70ec222f88fb 100644
--- a/pkgs/desktops/gnome-3/core/libgepub/default.nix
+++ b/pkgs/development/libraries/libgepub/default.nix
@@ -1,14 +1,12 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, glib, gobject-introspection, gnome3
 , webkitgtk, libsoup, libxml2, libarchive }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgepub";
   version = "0.6.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "16dkyywqdnfngmwsgbyga0kl9vcnzczxi3lmhm27pifrq5f3k2n7";
   };
 
@@ -20,7 +18,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ea302c2d7004..fb72a72d8615 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10768,6 +10768,8 @@ in
 
   libgdata = callPackage ../development/libraries/libgdata { };
 
+  libgepub = callPackage ../development/libraries/libgepub { };
+
   libgig = callPackage ../development/libraries/libgig { };
 
   libgnome-keyring = callPackage ../development/libraries/libgnome-keyring { };

From 1ba8575f9aacb118467ec20ba34135ce764e6ca6 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:23:40 +0100
Subject: [PATCH 154/182] libcroco: rename from gnome3.libcroco

---
 pkgs/desktops/gnome-3/default.nix                          | 4 +---
 .../core => development/libraries}/libcroco/default.nix    | 7 +++----
 pkgs/top-level/all-packages.nix                            | 4 ++--
 3 files changed, 6 insertions(+), 9 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libcroco/default.nix (92%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 6873cc0e82dd..a9cf9b7e9be7 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -161,8 +161,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   eog = callPackage ./core/eog { };
 
-  libcroco = callPackage ./core/libcroco {};
-
   libgee = callPackage ./core/libgee { };
 
   libpeas = callPackage ./core/libpeas {};
diff --git a/pkgs/desktops/gnome-3/core/libcroco/default.nix b/pkgs/development/libraries/libcroco/default.nix
similarity index 92%
rename from pkgs/desktops/gnome-3/core/libcroco/default.nix
rename to pkgs/development/libraries/libcroco/default.nix
index 312231f648f3..dc4a967e7ac6 100644
--- a/pkgs/desktops/gnome-3/core/libcroco/default.nix
+++ b/pkgs/development/libraries/libcroco/default.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libxml2, glib, fetchpatch, gnome3 }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libcroco";
   version = "0.6.12";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0q7qhi7z64i26zabg9dbs5706fa8pmzp1qhpa052id4zdiabbi6x";
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fb72a72d8615..1ea64311c399 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3709,6 +3709,8 @@ in
 
   libcloudproviders = callPackage ../development/libraries/libcloudproviders { };
 
+  libcroco = callPackage ../development/libraries/libcroco { };
+
   libsmi = callPackage ../development/libraries/libsmi { };
 
   lesspipe = callPackage ../tools/misc/lesspipe { };
@@ -10611,8 +10613,6 @@ in
 
   libconfuse = callPackage ../development/libraries/libconfuse { };
 
-  inherit (gnome3) libcroco;
-
   libcangjie = callPackage ../development/libraries/libcangjie { };
 
   libcollectdclient = callPackage ../development/libraries/libcollectdclient { };

From df89d4ce4100413e873ae05efae0b174ede83a6f Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:30:59 +0100
Subject: [PATCH 155/182] libpeas: rename from gnome3.libpeas

---
 pkgs/desktops/gnome-3/default.nix             |  4 +---
 .../libraries}/libpeas/default.nix            | 22 ++++++++++---------
 pkgs/top-level/all-packages.nix               |  4 +++-
 3 files changed, 16 insertions(+), 14 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libpeas/default.nix (51%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index a9cf9b7e9be7..963275db1ed7 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -163,8 +163,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgee = callPackage ./core/libgee { };
 
-  libpeas = callPackage ./core/libpeas {};
-
   libgweather = callPackage ./core/libgweather { };
 
   libzapojit = callPackage ./core/libzapojit { };
diff --git a/pkgs/desktops/gnome-3/core/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
similarity index 51%
rename from pkgs/desktops/gnome-3/core/libpeas/default.nix
rename to pkgs/development/libraries/libpeas/default.nix
index fdbeb94c5054..314d5884501f 100644
--- a/pkgs/desktops/gnome-3/core/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -1,32 +1,34 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnome3
-, glib, gtk3, gobject-introspection, python3Packages, ncurses
+, glib, gtk3, gobject-introspection, python3, ncurses
 }:
 
 stdenv.mkDerivation rec {
-  name = "libpeas-${version}";
+  pname = "libpeas";
   version = "1.22.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libpeas/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0qm908kisyjzjxvygdl18hjqxvvgkq9w0phs2g55pck277sw0bsv";
   };
 
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "libpeas"; attrPath = "gnome3.libpeas"; };
-  };
-
   configureFlags = [ "--enable-python3" ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs =  [ intltool glib gtk3 gnome3.defaultIconTheme ncurses python3Packages.python python3Packages.pygobject3 ];
+  nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
+  buildInputs =  [ glib gtk3 ncurses python3 python3.pkgs.pygobject3 ];
   propagatedBuildInputs = [
     # Required by libpeas-1.0.pc
     gobject-introspection
   ];
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "A GObject-based plugins engine";
-    homepage = http://ftp.acc.umu.se/pub/GNOME/sources/libpeas/;
+    homepage = https://wiki.gnome.org/Projects/Libpeas;
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = gnome3.maintainers;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1ea64311c399..d2e2b0edc1b6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11217,6 +11217,8 @@ in
 
   libpcap = callPackage ../development/libraries/libpcap { };
 
+  libpeas = callPackage ../development/libraries/libpeas { };
+
   libpipeline = callPackage ../development/libraries/libpipeline { };
 
   libpgf = callPackage ../development/libraries/libpgf { };
@@ -17933,7 +17935,7 @@ in
   libvmi = callPackage ../development/libraries/libvmi { };
 
   liferea = callPackage ../applications/networking/newsreaders/liferea {
-    inherit (gnome3) libpeas gsettings-desktop-schemas dconf;
+    inherit (gnome3) gsettings-desktop-schemas dconf;
   };
 
   lightworks = callPackage ../applications/video/lightworks {

From 7ca5ec11b0333b74f0dbb13518953b8f830ce0bd Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 04:34:57 +0100
Subject: [PATCH 156/182] libgee: rename from gnome3.libgee

---
 pkgs/desktops/gnome-3/default.nix             |  4 +---
 .../libraries}/libgee/default.nix             |  9 +++------
 pkgs/top-level/all-packages.nix               | 20 +++++++------------
 3 files changed, 11 insertions(+), 22 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgee/default.nix (90%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 963275db1ed7..38a73fcd0521 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -161,8 +161,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   eog = callPackage ./core/eog { };
 
-  libgee = callPackage ./core/libgee { };
-
   libgweather = callPackage ./core/libgweather { };
 
   libzapojit = callPackage ./core/libzapojit { };
diff --git a/pkgs/desktops/gnome-3/core/libgee/default.nix b/pkgs/development/libraries/libgee/default.nix
similarity index 90%
rename from pkgs/desktops/gnome-3/core/libgee/default.nix
rename to pkgs/development/libraries/libgee/default.nix
index 2de8b430843c..260c3a3d97bf 100644
--- a/pkgs/desktops/gnome-3/core/libgee/default.nix
+++ b/pkgs/development/libraries/libgee/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl, autoconf, vala, pkgconfig, glib, gobject-introspection, gnome3 }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libgee";
   version = "0.20.1";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0c26x8gi3ivmhlbqcmiag4jwrkvcy28ld24j55nqr3jikb904a5v";
   };
 
@@ -24,7 +22,6 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d2e2b0edc1b6..94f1f6cf0e62 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1981,7 +1981,7 @@ in
   libpinyin = callPackage ../development/libraries/libpinyin { };
 
   libskk = callPackage ../development/libraries/libskk {
-    inherit (gnome3) gnome-common libgee;
+    inherit (gnome3) gnome-common;
   };
 
   m17n_db = callPackage ../tools/inputmethods/m17n-db { };
@@ -1999,9 +1999,7 @@ in
     inherit (pythonPackages) marisa;
   };
 
-  libkkc = callPackage ../tools/inputmethods/libkkc {
-    inherit (gnome3) libgee;
-  };
+  libkkc = callPackage ../tools/inputmethods/libkkc { };
 
   ibus = callPackage ../tools/inputmethods/ibus {
     gconf = gnome2.GConf;
@@ -6205,9 +6203,7 @@ in
 
   urlwatch = callPackage ../tools/networking/urlwatch { };
 
-  valum = callPackage ../development/web/valum {
-    inherit (gnome3) libgee;
-  };
+  valum = callPackage ../development/web/valum { };
 
   inherit (callPackages ../servers/varnish { })
     varnish4 varnish5 varnish6;
@@ -10768,6 +10764,8 @@ in
 
   libgdata = callPackage ../development/libraries/libgdata { };
 
+  libgee = callPackage ../development/libraries/libgee { };
+
   libgepub = callPackage ../development/libraries/libgepub { };
 
   libgig = callPackage ../development/libraries/libgig { };
@@ -18408,9 +18406,7 @@ in
     ruby = ruby_2_3.override { cursesSupport = true; };
   };
 
-  synapse = callPackage ../applications/misc/synapse {
-    inherit (gnome3) libgee;
-  };
+  synapse = callPackage ../applications/misc/synapse { };
 
   synapse-bt = callPackage ../applications/networking/p2p/synapse-bt {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -18657,7 +18653,6 @@ in
   pdfgrep  = callPackage ../tools/typesetting/pdfgrep { };
 
   pdfpc = callPackage ../applications/misc/pdfpc {
-    inherit (gnome3) libgee;
     inherit (gst_all_1) gstreamer gst-plugins-base;
   };
 
@@ -19243,7 +19238,6 @@ in
   lightdm_qt = lightdm.override { withQt5 = true; };
 
   lightdm-enso-os-greeter = callPackage ../applications/display-managers/lightdm-enso-os-greeter {
-    inherit (gnome3) libgee;
     inherit (xorg) libX11 libXdmcp libpthreadstubs;
   };
 
@@ -23085,7 +23079,7 @@ in
   iterm2 = callPackage ../applications/misc/iterm2 {};
 
   sequeler = callPackage ../applications/misc/sequeler {
-    inherit (gnome3) gtksourceview libgda libgee;
+    inherit (gnome3) gtksourceview libgda;
   };
 
   sequelpro = callPackage ../applications/misc/sequelpro {};

From 93a6f4414cab403362c3c6c2e47058367f013160 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 17:28:34 +0100
Subject: [PATCH 157/182] geocode-glib: rename from gnome3.geocode-glib

---
 pkgs/desktops/gnome-3/default.nix                        | 4 +---
 .../libraries}/geocode-glib/default.nix                  | 9 ++++-----
 .../libraries}/geocode-glib/installed-tests-path.patch   | 0
 pkgs/top-level/all-packages.nix                          | 2 ++
 4 files changed, 7 insertions(+), 8 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/geocode-glib/default.nix (83%)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/geocode-glib/installed-tests-path.patch (100%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 38a73fcd0521..88c9a0ae0e95 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -73,8 +73,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   evolution-data-server = callPackage ./core/evolution-data-server { };
 
-  geocode-glib = callPackage ./core/geocode-glib { };
-
   gcr = callPackage ./core/gcr { }; # ToDo: tests fail
 
   gdm = callPackage ./core/gdm { };
diff --git a/pkgs/desktops/gnome-3/core/geocode-glib/default.nix b/pkgs/development/libraries/geocode-glib/default.nix
similarity index 83%
rename from pkgs/desktops/gnome-3/core/geocode-glib/default.nix
rename to pkgs/development/libraries/geocode-glib/default.nix
index ce5f46534c7b..2d308add87ad 100644
--- a/pkgs/desktops/gnome-3/core/geocode-glib/default.nix
+++ b/pkgs/development/libraries/geocode-glib/default.nix
@@ -1,13 +1,13 @@
 { fetchurl, stdenv, meson, ninja, pkgconfig, gettext, gtk-doc, docbook_xsl, gobject-introspection, gnome3, libsoup, json-glib }:
 
 stdenv.mkDerivation rec {
-  name = "geocode-glib-${version}";
+  pname = "geocode-glib";
   version = "3.26.0";
 
-  outputs = [ "out" "dev" "installedTests" ];
+  outputs = [ "out" "dev" "devdoc" "installedTests" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/geocode-glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/geocode-glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1vmydxs5xizcmaxpkfrq75xpj6pqrpdjizxyb30m00h54yqqch7a";
   };
 
@@ -24,8 +24,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome3.updateScript {
-      packageName = "geocode-glib";
-      attrPath = "gnome3.geocode-glib";
+      packageName = pname;
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/core/geocode-glib/installed-tests-path.patch b/pkgs/development/libraries/geocode-glib/installed-tests-path.patch
similarity index 100%
rename from pkgs/desktops/gnome-3/core/geocode-glib/installed-tests-path.patch
rename to pkgs/development/libraries/geocode-glib/installed-tests-path.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 94f1f6cf0e62..b4ae7f28d00d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9806,6 +9806,8 @@ in
 
   geoclue2 = callPackage ../development/libraries/geoclue {};
 
+  geocode-glib = callPackage ../development/libraries/geocode-glib {};
+
   geoipWithDatabase = makeOverridable (callPackage ../development/libraries/geoip) {
     drvName = "geoip-tools";
     geoipDatabase = geolite-legacy;

From 3ca8d0f814cd752189256a98724e755f1266c423 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 17:33:21 +0100
Subject: [PATCH 158/182] libgweather: rename from gnome3.libgweather

---
 pkgs/desktops/gnome-3/default.nix                     |  4 +---
 .../libraries}/libgweather/default.nix                | 11 ++++-------
 pkgs/top-level/all-packages.nix                       |  2 ++
 3 files changed, 7 insertions(+), 10 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgweather/default.nix (79%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 88c9a0ae0e95..e040e38203bb 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -159,8 +159,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   eog = callPackage ./core/eog { };
 
-  libgweather = callPackage ./core/libgweather { };
-
   libzapojit = callPackage ./core/libzapojit { };
 
   mutter = callPackage ./core/mutter { };
diff --git a/pkgs/desktops/gnome-3/core/libgweather/default.nix b/pkgs/development/libraries/libgweather/default.nix
similarity index 79%
rename from pkgs/desktops/gnome-3/core/libgweather/default.nix
rename to pkgs/development/libraries/libgweather/default.nix
index f9feb21749ae..b5fda25a8c55 100644
--- a/pkgs/desktops/gnome-3/core/libgweather/default.nix
+++ b/pkgs/development/libraries/libgweather/default.nix
@@ -1,21 +1,19 @@
-{ stdenv, fetchurl, meson, ninja, pkgconfig, libxml2, glib, gtk, gettext, libsoup
+{ stdenv, fetchurl, meson, ninja, pkgconfig, libxml2, glib, gtk3, gettext, libsoup
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43, gobject-introspection, python3, tzdata, geocode-glib, vala, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgweather";
   version = "3.28.2";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0xfy5ghwvnz2g9074dy6512m4z2pv66pmja14vhi9imgacbfh708";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext vala gtk-doc docbook_xsl docbook_xml_dtd_43 gobject-introspection python3 ];
-  buildInputs = [ glib gtk libsoup libxml2 geocode-glib ];
+  buildInputs = [ glib gtk3 libsoup libxml2 geocode-glib ];
 
   postPatch = ''
     chmod +x meson/meson_post_install.py
@@ -31,7 +29,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b4ae7f28d00d..442c2a787a83 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10785,6 +10785,8 @@ in
 
   libgrss = callPackage ../development/libraries/libgrss { };
 
+  libgweather = callPackage ../development/libraries/libgweather { };
+
   libgxps = callPackage ../development/libraries/libgxps { };
 
   libiio = callPackage ../development/libraries/libiio { };

From 0f0179c2fa6ac404d2f54f159cd43716b22e5b07 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 17:45:11 +0100
Subject: [PATCH 159/182] librest: rename from gnome3.rest

---
 pkgs/desktops/gnome-3/default.nix                   |  5 ++---
 .../libraries/librest}/default.nix                  | 13 ++++++-------
 pkgs/top-level/all-packages.nix                     |  2 ++
 3 files changed, 10 insertions(+), 10 deletions(-)
 rename pkgs/{desktops/gnome-3/core/rest => development/libraries/librest}/default.nix (72%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index e040e38203bb..a9708f7b2e1a 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -47,6 +47,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   gtkmm = gtkmm3;
   vala = pkgs.vala_0_42;
   gegl_0_4 = pkgs.gegl_0_4.override { inherit gtk; };
+  rest = librest;
 
 # Simplify the nixos module and gnome packages
   defaultIconTheme = adwaita-icon-theme;
@@ -198,8 +199,6 @@ lib.makeScope pkgs.newScope (self: with self; {
     withGnome = true;
   };
 
-  rest = callPackage ./core/rest { };
-
   rygel = callPackage ./core/rygel { };
 
   simple-scan = callPackage ./core/simple-scan { };
diff --git a/pkgs/desktops/gnome-3/core/rest/default.nix b/pkgs/development/libraries/librest/default.nix
similarity index 72%
rename from pkgs/desktops/gnome-3/core/rest/default.nix
rename to pkgs/development/libraries/librest/default.nix
index 70cc31cd706c..e70ac9a53626 100644
--- a/pkgs/desktops/gnome-3/core/rest/default.nix
+++ b/pkgs/development/libraries/librest/default.nix
@@ -1,29 +1,28 @@
 { stdenv, fetchurl, pkgconfig, glib, libsoup, gobject-introspection, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "rest";
   version = "0.8.1";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0513aad38e5d3cedd4ae3c551634e3be1b9baaa79775e53b2dba9456f15b01c9";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ glib libsoup gobject-introspection];
+  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+  buildInputs = [ glib libsoup ];
 
   configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
+      attrPath = "librest";
     };
   };
 
   meta = with stdenv.lib; {
+    description = "Helper library for RESTful services";
     homepage = https://wiki.gnome.org/Projects/Librest;
     license = licenses.lgpl21;
     platforms = platforms.linux;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 442c2a787a83..9a6be7439d08 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4003,6 +4003,8 @@ in
 
   libreswan = callPackage ../tools/networking/libreswan { };
 
+  librest = callPackage ../development/libraries/librest { };
+
   libwebsockets = callPackage ../development/libraries/libwebsockets { };
 
   lidarr = callPackage ../servers/lidarr { };

From 38582b0f32c4972836832062e7104dd15f08c7e6 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 17:48:38 +0100
Subject: [PATCH 160/182] libzapojit: rename from gnome3.libzapojit

---
 pkgs/desktops/gnome-3/default.nix                  |  4 +---
 .../libraries}/libzapojit/default.nix              | 14 ++++++--------
 pkgs/top-level/all-packages.nix                    |  2 ++
 3 files changed, 9 insertions(+), 11 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libzapojit/default.nix (65%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index a9708f7b2e1a..7f8b8743ee8c 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -160,8 +160,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   eog = callPackage ./core/eog { };
 
-  libzapojit = callPackage ./core/libzapojit { };
-
   mutter = callPackage ./core/mutter { };
 
   # Needed for elementary's gala and greeter until they get around to adapting to all the API breaking changes in libmutter-3
diff --git a/pkgs/desktops/gnome-3/core/libzapojit/default.nix b/pkgs/development/libraries/libzapojit/default.nix
similarity index 65%
rename from pkgs/desktops/gnome-3/core/libzapojit/default.nix
rename to pkgs/development/libraries/libzapojit/default.nix
index 5c0291767877..2ad017dc90be 100644
--- a/pkgs/desktops/gnome-3/core/libzapojit/default.nix
+++ b/pkgs/development/libraries/libzapojit/default.nix
@@ -1,30 +1,28 @@
-{ stdenv, fetchurl, pkgconfig, glib, intltool, json-glib, rest, libsoup, gnome-online-accounts, gnome3, gobject-introspection }:
-let
+{ stdenv, fetchurl, pkgconfig, glib, intltool, json-glib, librest, libsoup, gnome3, gobject-introspection }:
+
+stdenv.mkDerivation rec {
   pname = "libzapojit";
   version = "0.0.3";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0zn3s7ryjc3k1abj4k55dr2na844l451nrg9s6cvnnhh569zj99x";
   };
 
   nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
-  propagatedBuildInputs = [ glib json-glib rest libsoup gnome-online-accounts ]; # zapojit-0.0.pc
+  propagatedBuildInputs = [ glib json-glib librest libsoup gnome3.gnome-online-accounts ]; # zapojit-0.0.pc
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
   meta = with stdenv.lib; {
     description = "GObject wrapper for the SkyDrive and Hotmail REST APIs";
+    homepage = https://wiki.gnome.org/Projects/Zapojit;
     license = licenses.lgpl21Plus;
     maintainers = gnome3.maintainers;
     platforms = platforms.linux;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9a6be7439d08..271197eb7245 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11500,6 +11500,8 @@ in
 
   libyubikey = callPackage ../development/libraries/libyubikey { };
 
+  libzapojit = callPackage ../development/libraries/libzapojit { };
+
   libzen = callPackage ../development/libraries/libzen { };
 
   libzip = callPackage ../development/libraries/libzip { };

From c6eece711e86acb7a93a8726eef4f92417356a2b Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 18:01:39 +0100
Subject: [PATCH 161/182] libmediaart: rename from gnome3.libmediaart

---
 pkgs/desktops/gnome-3/default.nix                |  4 +---
 .../libraries}/libmediaart/default.nix           | 16 ++++++++--------
 pkgs/top-level/all-packages.nix                  |  2 ++
 3 files changed, 11 insertions(+), 11 deletions(-)
 rename pkgs/{desktops/gnome-3/misc => development/libraries}/libmediaart/default.nix (63%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 7f8b8743ee8c..72172cf96ac8 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -348,8 +348,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
 
-  libmediaart = callPackage ./misc/libmediaart { };
-
   gexiv2 = callPackage ./misc/gexiv2 { };
 
   gnome-applets = callPackage ./misc/gnome-applets { };
diff --git a/pkgs/desktops/gnome-3/misc/libmediaart/default.nix b/pkgs/development/libraries/libmediaart/default.nix
similarity index 63%
rename from pkgs/desktops/gnome-3/misc/libmediaart/default.nix
rename to pkgs/development/libraries/libmediaart/default.nix
index fac5db943871..48bd959009a1 100644
--- a/pkgs/desktops/gnome-3/misc/libmediaart/default.nix
+++ b/pkgs/development/libraries/libmediaart/default.nix
@@ -1,24 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, glib, gdk_pixbuf, gobject-introspection, gnome3 }:
+{ stdenv, fetchurl, meson, ninja, pkgconfig, vala, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, gdk_pixbuf, gobject-introspection, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libmediaart";
   version = "1.9.4";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "a57be017257e4815389afe4f58fdacb6a50e74fd185452b23a652ee56b04813d";
   };
 
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+  nativeBuildInputs = [ meson ninja pkgconfig vala gtk-doc docbook_xsl docbook_xml_dtd_412 gobject-introspection ];
   buildInputs = [ glib gdk_pixbuf ];
 
+  doCheck = true;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 271197eb7245..cc0c320c2b27 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10951,6 +10951,8 @@ in
 
   libmcrypt = callPackage ../development/libraries/libmcrypt {};
 
+  libmediaart = callPackage ../development/libraries/libmediaart { };
+
   libmediainfo = callPackage ../development/libraries/libmediainfo { };
 
   libmhash = callPackage ../development/libraries/libmhash {};

From f6afec36fa28bfd8d1ccfe7bce52e379fd85757e Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 18:05:36 +0100
Subject: [PATCH 162/182] gfbgraph: rename from gnome3.gfbgraph

---
 pkgs/desktops/gnome-3/default.nix                    |  4 +---
 .../libraries}/gfbgraph/default.nix                  | 12 +++++-------
 pkgs/top-level/all-packages.nix                      |  2 ++
 3 files changed, 8 insertions(+), 10 deletions(-)
 rename pkgs/{desktops/gnome-3/misc => development/libraries}/gfbgraph/default.nix (77%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 72172cf96ac8..369d21c0f7b9 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -342,8 +342,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   geary = callPackage ./misc/geary { };
 
-  gfbgraph = callPackage ./misc/gfbgraph { };
-
   gitg = callPackage ./misc/gitg { };
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
diff --git a/pkgs/desktops/gnome-3/misc/gfbgraph/default.nix b/pkgs/development/libraries/gfbgraph/default.nix
similarity index 77%
rename from pkgs/desktops/gnome-3/misc/gfbgraph/default.nix
rename to pkgs/development/libraries/gfbgraph/default.nix
index f4c0d6134c0f..1bdcb7d8b28d 100644
--- a/pkgs/desktops/gnome-3/misc/gfbgraph/default.nix
+++ b/pkgs/development/libraries/gfbgraph/default.nix
@@ -1,22 +1,20 @@
-{ stdenv, fetchurl, pkgconfig, glib
+{ stdenv, fetchurl, pkgconfig, glib, librest
 , gnome3, libsoup, json-glib, gobject-introspection }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gfbgraph";
   version = "0.2.3";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1dp0v8ia35fxs9yhnqpxj3ir5lh018jlbiwifjfn8ayy7h47j4fs";
   };
 
   nativeBuildInputs = [ pkgconfig gobject-introspection ];
   buildInputs = [ glib gnome3.gnome-online-accounts ];
-  propagatedBuildInputs = [ libsoup json-glib gnome3.rest ];
+  propagatedBuildInputs = [ libsoup json-glib librest ];
 
   configureFlags = [ "--enable-introspection" ];
 
@@ -25,11 +23,11 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
   meta = with stdenv.lib; {
+    homepage = https://wiki.gnome.org/Projects/GFBGraph;
     description = "GLib/GObject wrapper for the Facebook Graph API";
     maintainers = gnome3.maintainers;
     license = licenses.lgpl2;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cc0c320c2b27..15830e56fa6c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2875,6 +2875,8 @@ in
 
   gftp = callPackage ../tools/networking/gftp { };
 
+  gfbgraph = callPackage ../development/libraries/gfbgraph { };
+
   ggobi = callPackage ../tools/graphics/ggobi { };
 
   gibo = callPackage ../tools/misc/gibo { };

From 73f32e7e58a6fef3e6db0f3caadafb6724487e38 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 25 Dec 2018 18:43:33 +0100
Subject: [PATCH 163/182] gexiv2: rename from gnome3.gexiv2

---
 pkgs/desktops/gnome-3/default.nix             |  4 +---
 .../libraries}/gexiv2/default.nix             | 24 +++++++++----------
 pkgs/top-level/all-packages.nix               |  4 ++--
 3 files changed, 15 insertions(+), 17 deletions(-)
 rename pkgs/{desktops/gnome-3/misc => development/libraries}/gexiv2/default.nix (70%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 369d21c0f7b9..327c17508747 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -346,8 +346,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
 
-  gexiv2 = callPackage ./misc/gexiv2 { };
-
   gnome-applets = callPackage ./misc/gnome-applets { };
 
   gnome-flashback = callPackage ./misc/gnome-flashback { };
diff --git a/pkgs/desktops/gnome-3/misc/gexiv2/default.nix b/pkgs/development/libraries/gexiv2/default.nix
similarity index 70%
rename from pkgs/desktops/gnome-3/misc/gexiv2/default.nix
rename to pkgs/development/libraries/gexiv2/default.nix
index d74faf09fb7d..74311525f1e2 100644
--- a/pkgs/desktops/gnome-3/misc/gexiv2/default.nix
+++ b/pkgs/development/libraries/gexiv2/default.nix
@@ -1,29 +1,29 @@
-{ stdenv, fetchurl, meson, ninja, pkgconfig, exiv2, glib, gnome3, gobject-introspection, vala }:
+{ stdenv, fetchurl, meson, ninja, pkgconfig, exiv2, glib, gnome3, gobject-introspection, vala, gtk-doc, docbook_xsl, docbook_xml_dtd_43 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gexiv2";
   version = "0.10.9";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1vf0zv92p9hybdhn7zx53h3ia53ph97a21xz8rfk877xlr5261l8";
   };
 
-  preConfigure = ''
-    patchShebangs .
-  '';
-
-  nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection vala ];
+  nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection vala gtk-doc docbook_xsl docbook_xml_dtd_43 ];
   buildInputs = [ glib ];
   propagatedBuildInputs = [ exiv2 ];
 
+  mesonFlags = [
+    "-Denable-gtk-doc=true" # TODO: change to gtk_doc in a next release
+  ];
+
+  doCheck = true;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 15830e56fa6c..1238a07d3395 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2873,6 +2873,8 @@ in
 
   getopt = callPackage ../tools/misc/getopt { };
 
+  gexiv2 = callPackage ../development/libraries/gexiv2 { };
+
   gftp = callPackage ../tools/networking/gftp { };
 
   gfbgraph = callPackage ../development/libraries/gfbgraph { };
@@ -5966,7 +5968,6 @@ in
 
   viking = callPackage ../applications/misc/viking {
     inherit (gnome2) scrollkeeper;
-    inherit (gnome3) gexiv2;
   };
 
   vim-vint = callPackage ../development/tools/vim-vint { };
@@ -17221,7 +17222,6 @@ in
   gimp = callPackage ../applications/graphics/gimp {
     gegl = gegl_0_4;
     lcms = lcms2;
-    inherit (gnome3) gexiv2;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
     inherit (darwin) cf-private;
   };

From 634eaf80b22ea3e22e762f36488ff3eee686e94b Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 17:05:45 -0500
Subject: [PATCH 164/182] folks: rename from gnome3.folks

---
 pkgs/desktops/gnome-3/default.nix             |  4 +---
 .../libraries}/folks/default.nix              | 19 +++++++------------
 pkgs/top-level/all-packages.nix               |  2 ++
 3 files changed, 10 insertions(+), 15 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/folks/default.nix (74%)

diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 327c17508747..65507870dd8a 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -114,8 +114,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgnomekbd = callPackage ./core/libgnomekbd { };
 
-  folks = callPackage ./core/folks { };
-
   gnome-online-accounts = callPackage ./core/gnome-online-accounts { };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
diff --git a/pkgs/desktops/gnome-3/core/folks/default.nix b/pkgs/development/libraries/folks/default.nix
similarity index 74%
rename from pkgs/desktops/gnome-3/core/folks/default.nix
rename to pkgs/development/libraries/folks/default.nix
index 2eb33cde975f..2ce50a92ea36 100644
--- a/pkgs/desktops/gnome-3/core/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -1,20 +1,19 @@
 { fetchurl, stdenv, pkgconfig, glib, gnome3, nspr, intltool, gobject-introspection
-, vala, sqlite, libxml2, dbus-glib, libsoup, nss, dbus
+, vala, sqlite, libxml2, dbus-glib, libsoup, nss, dbus, libgee
 , telepathy-glib, evolution-data-server, libsecret, db }:
 
 # TODO: enable more folks backends
 
-let
+stdenv.mkDerivation rec {
+  pname = "folks";
   version = "0.11.4";
-in stdenv.mkDerivation rec {
-  name = "folks-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/folks/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "16hqh2gxlbx0b0hgq216hndr1m72vj54jvryzii9zqkk0g9kxc57";
   };
 
-  propagatedBuildInputs = [ glib gnome3.libgee sqlite ];
+  propagatedBuildInputs = [ glib libgee sqlite ];
   # dbus_daemon needed for tests
   buildInputs = [
     dbus-glib telepathy-glib evolution-data-server dbus
@@ -33,19 +32,15 @@ in stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome3.updateScript {
-      packageName = "folks";
-      attrPath = "gnome3.folks";
+      packageName = pname;
       versionPolicy = "none";
     };
   };
 
   meta = {
-    description = "Folks";
-
+    description = "A library that aggregates people from multiple sources to create metacontacts";
     homepage = https://wiki.gnome.org/Projects/Folks;
-
     license = stdenv.lib.licenses.lgpl2Plus;
-
     maintainers = gnome3.maintainers;
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1238a07d3395..c4d3368fd914 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9752,6 +9752,8 @@ in
 
   folly = callPackage ../development/libraries/folly { };
 
+  folks = callPackage ../development/libraries/folks { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;

From 1954e6a9493de153b4670e118e1b096304e72962 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 17:27:49 -0500
Subject: [PATCH 165/182] totem-pl-parser: rename from gnome3.totem-pl-parser

---
 pkgs/applications/audio/lollypop/default.nix              | 4 ++--
 pkgs/applications/audio/rhythmbox/default.nix             | 3 ++-
 pkgs/desktops/gnome-3/core/grilo-plugins/default.nix      | 4 ++--
 pkgs/desktops/gnome-3/core/grilo/default.nix              | 4 ++--
 pkgs/desktops/gnome-3/core/totem/default.nix              | 4 ++--
 pkgs/desktops/gnome-3/core/tracker-miners/default.nix     | 4 ++--
 pkgs/desktops/gnome-3/default.nix                         | 4 +---
 .../libraries}/totem-pl-parser/default.nix                | 8 +++++---
 pkgs/top-level/all-packages.nix                           | 2 ++
 9 files changed, 20 insertions(+), 17 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/totem-pl-parser/default.nix (71%)

diff --git a/pkgs/applications/audio/lollypop/default.nix b/pkgs/applications/audio/lollypop/default.nix
index 5fbf9108ed77..29edf818ce70 100644
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit, meson, ninja, pkgconfig
 , python3, gtk3, gst_all_1, libsecret, libsoup
-, appstream-glib, desktop-file-utils, gnome3
+, appstream-glib, desktop-file-utils, totem-pl-parser
 , gobject-introspection, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec  {
@@ -28,7 +28,6 @@ python3.pkgs.buildPythonApplication rec  {
   ];
 
   buildInputs = with gst_all_1; [
-    gnome3.totem-pl-parser
     gst-libav
     gst-plugins-bad
     gst-plugins-base
@@ -38,6 +37,7 @@ python3.pkgs.buildPythonApplication rec  {
     gtk3
     libsecret
     libsoup
+    totem-pl-parser
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index 968c5edae63a..e540016ac81c 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -6,6 +6,7 @@
 , intltool
 , libsoup
 , gnome3
+, totem-pl-parser
 , tdb
 , json-glib
 , itstool
@@ -48,7 +49,7 @@ in stdenv.mkDerivation rec {
 
     gtk3
     gnome3.libpeas
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.defaultIconTheme
 
     gst_all_1.gstreamer
diff --git a/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix b/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
index 124db9272363..ab2ead7d3449 100644
--- a/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, sqlite
 , gnome3, libxml2, gupnp, gssdp, lua5, liboauth, gupnp-av
-, gmime, json-glib, avahi, tracker, dleyna-server, itstool }:
+, gmime, json-glib, avahi, tracker, dleyna-server, itstool, totem-pl-parser }:
 
 let
   pname = "grilo-plugins";
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     gnome3.grilo libxml2 gupnp gssdp gnome3.libgdata
     lua5 liboauth gupnp-av sqlite gnome3.gnome-online-accounts
-    gnome3.totem-pl-parser gnome3.rest gmime json-glib
+    totem-pl-parser gnome3.rest gmime json-glib
     avahi gnome3.libmediaart tracker dleyna-server
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/grilo/default.nix b/pkgs/desktops/gnome-3/core/grilo/default.nix
index acde7a385727..a2bee6ac41ee 100644
--- a/pkgs/desktops/gnome-3/core/grilo/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, vala, glib, liboauth, gtk3
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43
-, libxml2, gnome3, gobject-introspection, libsoup }:
+, libxml2, gnome3, gobject-introspection, libsoup, totem-pl-parser }:
 
 let
   pname = "grilo";
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     meson ninja pkgconfig gettext gobject-introspection vala
     gtk-doc docbook_xsl docbook_xml_dtd_43
   ];
-  buildInputs = [ glib liboauth gtk3 libxml2 libsoup gnome3.totem-pl-parser ];
+  buildInputs = [ glib liboauth gtk3 libxml2 libsoup totem-pl-parser ];
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index 3b7015919141..3565931e4df1 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, intltool, gst_all_1
 , clutter-gtk, clutter-gst, python3Packages, shared-mime-info
-, pkgconfig, gtk3, glib, gobject-introspection
+, pkgconfig, gtk3, glib, gobject-introspection, totem-pl-parser
 , wrapGAppsHook, itstool, libxml2, vala, gnome3
 , gdk_pixbuf, tracker, nautilus }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja vala pkgconfig intltool python3Packages.python itstool gobject-introspection wrapGAppsHook ];
   buildInputs = [
-    gtk3 glib gnome3.grilo clutter-gtk clutter-gst gnome3.totem-pl-parser gnome3.grilo-plugins
+    gtk3 glib gnome3.grilo clutter-gtk clutter-gst totem-pl-parser gnome3.grilo-plugins
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly gst_all_1.gst-libav gnome3.libpeas shared-mime-info
     gdk_pixbuf libxml2 gnome3.defaultIconTheme gnome3.gnome-desktop
diff --git a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
index 5e57a22906c8..7127ab71b1fc 100644
--- a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
@@ -2,7 +2,7 @@
 , meson, ninja, pkgconfig, vala, wrapGAppsHook, bzip2, dbus, evolution-data-server
 , exempi, flac, giflib, glib, gnome3, gst_all_1, icu, json-glib, libcue, libexif
 , libgrss, libgsf, libiptcdata, libjpeg, libpng, libseccomp, libsoup, libtiff, libuuid
-, libvorbis, libxml2, poppler, taglib, upower }:
+, libvorbis, libxml2, poppler, taglib, upower, totem-pl-parser }:
 
 let
   pname = "tracker-miners";
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
     giflib
     glib
     gnome3.gexiv2
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.tracker
     gst_all_1.gst-plugins-base
     gst_all_1.gstreamer
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 65507870dd8a..d001b9282ca8 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -203,8 +203,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   totem = callPackage ./core/totem { };
 
-  totem-pl-parser = callPackage ./core/totem-pl-parser { };
-
   tracker = callPackage ./core/tracker { };
 
   tracker-miners = callPackage ./core/tracker-miners { };
diff --git a/pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix b/pkgs/development/libraries/totem-pl-parser/default.nix
similarity index 71%
rename from pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix
rename to pkgs/development/libraries/totem-pl-parser/default.nix
index baf42b88e15b..4c052a5c02f6 100644
--- a/pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix
+++ b/pkgs/development/libraries/totem-pl-parser/default.nix
@@ -1,16 +1,18 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, gmime, libxml2, gobject-introspection, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "totem-pl-parser-${version}";
+  pname = "totem-pl-parser";
   version = "3.26.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/totem-pl-parser/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0k5pnka907invgds48d73c1xx1a366v5dcld3gr2l1dgmjwc9qka";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "totem-pl-parser"; attrPath = "gnome3.totem-pl-parser"; };
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c4d3368fd914..e7642f9c482e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12773,6 +12773,8 @@ in
 
   torch-hdf5 = callPackage ../development/libraries/torch-hdf5 {};
 
+  totem-pl-parser = callPackage ../development/libraries/totem-pl-parser { };
+
   tremor = callPackage ../development/libraries/tremor { };
 
   twolame = callPackage ../development/libraries/twolame { };

From c1599d29d914faa6222915c6342ae73533523b1a Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 17:41:02 -0500
Subject: [PATCH 166/182] gcr: rename from gnome3.gcr

---
 .../modules/services/desktops/gnome3/gnome-keyring.nix |  2 +-
 pkgs/applications/graphics/shotwell/default.nix        |  4 ++--
 .../networking/browsers/midori/default.nix             |  4 ++--
 .../networking/newsreaders/pan/default.nix             |  4 ++--
 pkgs/desktops/gnome-3/apps/seahorse/default.nix        |  4 ++--
 .../gnome-3/core/evolution-data-server/default.nix     |  2 +-
 pkgs/desktops/gnome-3/core/gnome-shell/default.nix     |  2 +-
 pkgs/desktops/gnome-3/default.nix                      |  4 +---
 pkgs/desktops/gnome-3/misc/geary/default.nix           |  4 ++--
 .../core => development/libraries}/gcr/default.nix     | 10 +++++-----
 pkgs/development/libraries/gvfs/default.nix            |  2 +-
 pkgs/development/libraries/libgdata/default.nix        |  4 ++--
 pkgs/tools/networking/network-manager/applet.nix       |  4 ++--
 pkgs/top-level/all-packages.nix                        |  4 +++-
 14 files changed, 27 insertions(+), 27 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/gcr/default.nix (75%)

diff --git a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
index aa1165ab3bba..5ea4350be5b4 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
@@ -33,7 +33,7 @@ with lib;
 
     environment.systemPackages = [ pkgs.gnome3.gnome-keyring ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gnome3.gcr ];
+    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];
 
   };
 
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index aef7143f7e03..2f06451438d9 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, meson, ninja, gtk3, libexif, libgphoto2, libsoup, libxml2, vala, sqlite
-, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib
+, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib, gcr
 , gettext, desktop-file-utils, gdk_pixbuf, librsvg, wrapGAppsHook
 , gobject-introspection, itstool, libgdata, python3 }:
 
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.libgee
     libgudev gnome3.gexiv2 gnome3.gsettings-desktop-schemas
     libraw json-glib glib gdk_pixbuf librsvg gnome3.rest
-    gnome3.gcr gnome3.defaultIconTheme libgdata
+    gcr gnome3.defaultIconTheme libgdata
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/browsers/midori/default.nix b/pkgs/applications/networking/browsers/midori/default.nix
index 6091c25ccd94..290810198ade 100644
--- a/pkgs/applications/networking/browsers/midori/default.nix
+++ b/pkgs/applications/networking/browsers/midori/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook
+{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook, gcr
 , gtk3, webkitgtk, sqlite, gsettings-desktop-schemas, libsoup, glib-networking, gnome3
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk3 webkitgtk sqlite gsettings-desktop-schemas gnome3.gcr
+    gtk3 webkitgtk sqlite gsettings-desktop-schemas gcr
     (libsoup.override { gnomeSupport = true; }) gnome3.libpeas
     glib-networking
   ];
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index 9d51a76f5360..308c857644eb 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -2,7 +2,7 @@
 , stdenv, fetchurl, pkgconfig, gtk3, gtkspell3 ? null
 , perl, gmime2, gettext, intltool, itstool, libxml2, dbus-glib, libnotify, gnutls
 , makeWrapper, gnupg
-, gnomeSupport ? true, gnome3, libsecret
+, gnomeSupport ? true, libsecret, gcr
 }:
 
 assert spellChecking -> gtkspell3 != null;
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig gettext intltool itstool libxml2 makeWrapper ];
   buildInputs = [ gtk3 gmime2 libnotify gnutls ]
     ++ stdenv.lib.optional spellChecking gtkspell3
-    ++ stdenv.lib.optionals gnomeSupport [ libsecret gnome3.gcr ];
+    ++ stdenv.lib.optionals gnomeSupport [ libsecret gcr ];
 
   configureFlags = [
     "--with-dbus"
diff --git a/pkgs/desktops/gnome-3/apps/seahorse/default.nix b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
index 344fb4a5738e..9ef2b57e6d14 100644
--- a/pkgs/desktops/gnome-3/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, vala, meson, ninja
 , pkgconfig, gtk3, glib, gobject-introspection
 , wrapGAppsHook, itstool, gnupg, libsoup
-, gnome3, gpgme, python3, openldap
+, gnome3, gpgme, python3, openldap, gcr
 , libsecret, avahi, p11-kit, openssh }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     python3 gobject-introspection
   ];
   buildInputs = [
-    gtk3 glib gnome3.gcr
+    gtk3 glib gcr
     gnome3.gsettings-desktop-schemas gnupg
     gnome3.defaultIconTheme gpgme
     libsecret avahi libsoup p11-kit
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index c9c8acfecb3b..5efd50a006b0 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, substituteAll, pkgconfig, gnome3, python3, gobject-introspection
-, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3
+, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3, gcr
 , p11-kit, db, nspr, nss, libical, gperf, wrapGAppsHook, glib-networking, pcre
 , vala, cmake, ninja, kerberos, openldap, webkitgtk, libaccounts-glib, json-glib }:
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index c1d5a5a916b7..0c662070cef2 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -2,7 +2,7 @@
 , python3Packages, libsoup, polkit, clutter, networkmanager, docbook_xsl , docbook_xsl_ns, at-spi2-core
 , libstartup_notification, telepathy-glib, telepathy-logger, libXtst, unzip, glibcLocales, shared-mime-info
 , libgweather, libcanberra-gtk3, librsvg, geoclue2, perl, docbook_xml_dtd_42, desktop-file-utils
-, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt
+, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt, gcr
 , accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet
 , sassc, systemd, gst_all_1 }:
 
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index d001b9282ca8..5911f0a224a9 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -74,8 +74,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   evolution-data-server = callPackage ./core/evolution-data-server { };
 
-  gcr = callPackage ./core/gcr { }; # ToDo: tests fail
-
   gdm = callPackage ./core/gdm { };
 
   gjs = callPackage ./core/gjs { };
diff --git a/pkgs/desktops/gnome-3/misc/geary/default.nix b/pkgs/desktops/gnome-3/misc/geary/default.nix
index 7bb54904fb0f..0841fa13a73f 100644
--- a/pkgs/desktops/gnome-3/misc/geary/default.nix
+++ b/pkgs/desktops/gnome-3/misc/geary/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, intltool, pkgconfig, gtk3, vala_0_40, enchant
 , wrapGAppsHook, gdk_pixbuf, cmake, ninja, desktop-file-utils
 , libnotify, libcanberra-gtk3, libsecret, gmime, isocodes
-, gobject-introspection, libpthreadstubs, sqlite
+, gobject-introspection, libpthreadstubs, sqlite, gcr
 , gnome3, librsvg, gnome-doc-utils, webkitgtk, fetchpatch }:
 
 let
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ vala_0_40 intltool pkgconfig wrapGAppsHook cmake ninja desktop-file-utils gnome-doc-utils gobject-introspection ];
   buildInputs = [
     gtk3 enchant webkitgtk libnotify libcanberra-gtk3 gnome3.libgee libsecret gmime sqlite
-    libpthreadstubs gnome3.gsettings-desktop-schemas gnome3.gcr isocodes
+    libpthreadstubs gnome3.gsettings-desktop-schemas gcr isocodes
     gdk_pixbuf librsvg gnome3.defaultIconTheme
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
similarity index 75%
rename from pkgs/desktops/gnome-3/core/gcr/default.nix
rename to pkgs/development/libraries/gcr/default.nix
index 2cfdb518dfab..56c52e1e3688 100644
--- a/pkgs/desktops/gnome-3/core/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -1,19 +1,19 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnupg, p11-kit, glib
-, libgcrypt, libtasn1, dbus-glib, gtk, pango, gdk_pixbuf, atk
+, libgcrypt, libtasn1, dbus-glib, gtk3, pango, gdk_pixbuf, atk
 , gobject-introspection, makeWrapper, libxslt, vala, gnome3
 , python2 }:
 
 stdenv.mkDerivation rec {
-  name = "gcr-${version}";
+  pname = "gcr";
   version = "3.28.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gcr/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "02xgky22xgvhgd525khqh64l5i21ca839fj9jzaqdi3yvb8pbq8m";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "gcr"; attrPath = "gnome3.gcr"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   postPatch = ''
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     gpg libgcrypt libtasn1 dbus-glib pango gdk_pixbuf atk
   ];
 
-  propagatedBuildInputs = [ glib gtk p11-kit ];
+  propagatedBuildInputs = [ glib gtk3 p11-kit ];
 
   checkInputs = [ python2 ];
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 03f4b0fe687a..05f115804551 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -2,7 +2,7 @@
 , glib, libgudev, udisks2, libgcrypt, libcap, polkit
 , libgphoto2, avahi, libarchive, fuse, libcdio
 , libxml2, libxslt, docbook_xsl, docbook_xml_dtd_42, samba, libmtp
-, gnomeSupport ? false, gnome, makeWrapper
+, gnomeSupport ? false, gnome, makeWrapper, gcr
 , libimobiledevice, libbluray, libcdio-paranoia, libnfs, openssh
 , libsecret, libgdata, python3
 }:
diff --git a/pkgs/development/libraries/libgdata/default.nix b/pkgs/development/libraries/libgdata/default.nix
index b05468a478df..f22cc568a97c 100644
--- a/pkgs/development/libraries/libgdata/default.nix
+++ b/pkgs/development/libraries/libgdata/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib
+{ stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib, gcr
 , gobject-introspection, liboauth, gnome3, p11-kit, openssl, uhttpmock }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0fj54yqxdapdppisqm1xcyrpgcichdmipq0a0spzz6009ikzgi45";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${gnome3.libsoup.dev}/include/libsoup-gnome-2.4/ -I${gnome3.gcr}/include/gcr-3 -I${gnome3.gcr}/include/gck-1";
+  NIX_CFLAGS_COMPILE = "-I${gnome3.libsoup.dev}/include/libsoup-gnome-2.4/ -I${gcr}/include/gcr-3 -I${gcr}/include/gck-1";
 
   nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
 
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index 9f1b50085078..f3fe14e4f246 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -2,7 +2,7 @@
 , libnotify, libsecret, polkit, isocodes, modemmanager, libxml2, docbook_xsl, docbook_xml_dtd_43
 , mobile-broadband-provider-info, glib-networking, gsettings-desktop-schemas
 , libgudev, jansson, wrapGAppsHook, gobject-introspection, python3
-, libappindicator-gtk3, withGnome ? false }:
+, libappindicator-gtk3, withGnome ? false, gcr }:
 
 let
   pname = "network-manager-applet";
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
     polkit isocodes mobile-broadband-provider-info libgudev
     modemmanager jansson glib-networking
     libappindicator-gtk3 gnome3.defaultIconTheme
-  ] ++ stdenv.lib.optionals withGnome [ gnome3.gcr ]; # advanced certificate chooser
+  ] ++ stdenv.lib.optionals withGnome [ gcr ]; # advanced certificate chooser
 
   nativeBuildInputs = [ meson ninja intltool pkgconfig wrapGAppsHook gobject-introspection python3 gtk-doc docbook_xsl docbook_xml_dtd_43 libxml2 ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7642f9c482e..1e3fec0693ba 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4834,7 +4834,7 @@ in
   };
 
   pinentry_gnome = res.pinentry.override {
-    gcr = gnome3.gcr;
+    inherit gcr;
   };
 
   pinentry_qt4 = res.pinentry.override {
@@ -9787,6 +9787,8 @@ in
 
   gcab = callPackage ../development/libraries/gcab { };
 
+  gcr = callPackages ../development/libraries/gcr { };
+
   gdome2 = callPackage ../development/libraries/gdome2 {
     inherit (gnome2) gtkdoc;
   };

From 702168a67cf6aa0f70c74a5c03599e3d1edbcc5e Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 17:47:20 -0500
Subject: [PATCH 167/182] gsound: rename from gnome3.gsound

---
 pkgs/applications/video/pitivi/default.nix                 | 4 ++--
 pkgs/desktops/gnome-3/default.nix                          | 4 +---
 .../core => development/libraries}/gsound/default.nix      | 7 ++-----
 pkgs/top-level/all-packages.nix                            | 2 ++
 4 files changed, 7 insertions(+), 10 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/gsound/default.nix (84%)

diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index bce8e3981d13..2cd4f19ca939 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, itstool, python3, wrapGAppsHook
 , python3Packages, gst_all_1, gtk3
-, gobject-introspection, librsvg, gnome3, libnotify
+, gobject-introspection, librsvg, gnome3, libnotify, gsound
 , meson, ninja
 }:
 
@@ -47,7 +47,7 @@ in python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [ meson ninja pkgconfig intltool itstool python3 wrapGAppsHook ];
 
   buildInputs = [
-    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gnome3.gsound
+    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gsound
     gnome3.defaultIconTheme
     gnome3.gsettings-desktop-schemas libnotify
     gst-transcoder
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 5911f0a224a9..0f0758f0111b 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -148,8 +148,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gsettings-desktop-schemas = callPackage ./core/gsettings-desktop-schemas { };
 
-  gsound = callPackage ./core/gsound { };
-
   gucharmap = callPackage ./core/gucharmap { };
 
   gvfs = pkgs.gvfs.override { gnome = gnome3; gnomeSupport = true; };
diff --git a/pkgs/desktops/gnome-3/core/gsound/default.nix b/pkgs/development/libraries/gsound/default.nix
similarity index 84%
rename from pkgs/desktops/gnome-3/core/gsound/default.nix
rename to pkgs/development/libraries/gsound/default.nix
index b0384c1ebb09..337a2472babd 100644
--- a/pkgs/desktops/gnome-3/core/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@@ -1,13 +1,11 @@
 { stdenv, fetchurl, pkgconfig, glib, libcanberra, gobject-introspection, libtool, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gsound";
   version = "1.0.2";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "bba8ff30eea815037e53bee727bbd5f0b6a2e74d452a7711b819a7c444e78e53";
   };
 
@@ -17,7 +15,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1e3fec0693ba..cfa040bc2f22 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10089,6 +10089,8 @@ in
 
   gsoap = callPackage ../development/libraries/gsoap { };
 
+  gsound = callPackages ../development/libraries/gsound { };
+
   gss = callPackage ../development/libraries/gss { };
 
   gtkimageview = callPackage ../development/libraries/gtkimageview { };

From 0b14f7896d18fed387acfa9347719112b42db0c0 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 17:54:17 -0500
Subject: [PATCH 168/182] libgnomekbd: rename from gnome3.libgnomekbd

---
 pkgs/desktops/gnome-3/core/gnome-shell/default.nix          | 5 ++---
 pkgs/desktops/gnome-3/default.nix                           | 4 +---
 .../core => development/libraries}/libgnomekbd/default.nix  | 6 +++---
 pkgs/top-level/all-packages.nix                             | 2 ++
 4 files changed, 8 insertions(+), 9 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/libgnomekbd/default.nix (73%)

diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 0c662070cef2..76e5bd13522e 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -3,7 +3,7 @@
 , libstartup_notification, telepathy-glib, telepathy-logger, libXtst, unzip, glibcLocales, shared-mime-info
 , libgweather, libcanberra-gtk3, librsvg, geoclue2, perl, docbook_xml_dtd_42, desktop-file-utils
 , libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt, gcr
-, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet
+, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet, libgnomekbd
 , sassc, systemd, gst_all_1 }:
 
 # http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/gnome-base/gnome-shell/gnome-shell-3.10.2.1.ebuild?revision=1.3&view=markup
@@ -56,8 +56,7 @@ in stdenv.mkDerivation rec {
     })
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit (gnome3) libgnomekbd;
-      inherit unzip;
+      inherit libgnomekbd unzip;
     })
   ];
 
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 0f0758f0111b..f030201927a1 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -110,8 +110,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   libgnome-keyring = callPackage ./core/libgnome-keyring { };
 
-  libgnomekbd = callPackage ./core/libgnomekbd { };
-
   gnome-online-accounts = callPackage ./core/gnome-online-accounts { };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
diff --git a/pkgs/desktops/gnome-3/core/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
similarity index 73%
rename from pkgs/desktops/gnome-3/core/libgnomekbd/default.nix
rename to pkgs/development/libraries/libgnomekbd/default.nix
index a9b27fa65a47..20a9bb91604e 100644
--- a/pkgs/desktops/gnome-3/core/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, pkgconfig, file, intltool, glib, gtk3, libxklavier, makeWrapper, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgnomekbd-${version}";
+  pname = "libgnomekbd";
   version = "3.26.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libgnomekbd/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "ea3b418c57c30615f7ee5b6f718def7c9d09ce34637324361150744258968875";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "libgnomekbd"; attrPath = "gnome3.libgnomekbd"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   nativeBuildInputs = [ pkgconfig file intltool makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cfa040bc2f22..ac3301060f01 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10786,6 +10786,8 @@ in
   libgnome-keyring = callPackage ../development/libraries/libgnome-keyring { };
   libgnome-keyring3 = gnome3.libgnome-keyring;
 
+  libgnomekbd = callPackage ../development/libraries/libgnomekbd { };
+
   libglvnd = callPackage ../development/libraries/libglvnd { };
 
   libgnurl = callPackage ../development/libraries/libgnurl { };

From 2c76519900eb2955de74b68db9c8e2446a47ca37 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 18:15:46 -0500
Subject: [PATCH 169/182] vte, vte_290, vte-ng: rename frome gnome3.vte*

---
 .../editors/gnome-builder/default.nix         |  3 +-
 pkgs/applications/misc/terminator/default.nix |  4 +--
 pkgs/applications/misc/termite/default.nix    |  4 +--
 .../virtualization/qemu/default.nix           |  4 +--
 pkgs/desktops/deepin/default.nix              |  2 +-
 pkgs/desktops/gnome-3/default.nix             |  8 +-----
 pkgs/desktops/mate/mate-terminal/default.nix  |  6 ++--
 .../apps/pantheon-terminal/default.nix        |  2 +-
 pkgs/desktops/xfce4-13/default.nix            |  4 +--
 pkgs/development/libraries/gtkd/default.nix   |  4 +--
 .../libraries}/vte/2.90.nix                   |  4 +--
 .../libraries}/vte/default.nix                | 12 ++++----
 .../core => development/libraries}/vte/ng.nix |  4 +--
 pkgs/top-level/all-packages.nix               | 28 ++++++++-----------
 14 files changed, 38 insertions(+), 51 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/vte/2.90.nix (88%)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/vte/default.nix (78%)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/vte/ng.nix (76%)

diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index a0357f3572f7..8e0176797d2d 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -27,6 +27,7 @@
 , sysprof
 , template-glib
 , vala
+, vte
 , webkitgtk
 , wrapGAppsHook
 }:
@@ -64,7 +65,7 @@ in stdenv.mkDerivation {
     gnome3.devhelp
     libgit2-glib
     gnome3.libpeas
-    gnome3.vte
+    vte
     gspell
     gtk3
     gtksourceview4
diff --git a/pkgs/applications/misc/terminator/default.nix b/pkgs/applications/misc/terminator/default.nix
index f32a27b9b78d..4a6ad4e5ea38 100644
--- a/pkgs/applications/misc/terminator/default.nix
+++ b/pkgs/applications/misc/terminator/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python2, keybinder3, intltool, file, gtk3, gobject-introspection
-, libnotify, wrapGAppsHook, gnome3
+, libnotify, wrapGAppsHook, vte
 }:
 
 python2.pkgs.buildPythonApplication rec {
@@ -12,7 +12,7 @@ python2.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ file intltool wrapGAppsHook gobject-introspection ];
-  buildInputs = [ gtk3 gnome3.vte libnotify keybinder3 ];
+  buildInputs = [ gtk3 vte libnotify keybinder3 ];
   propagatedBuildInputs = with python2.pkgs; [ pygobject3 psutil pycairo ];
 
   postPatch = ''
diff --git a/pkgs/applications/misc/termite/default.nix b/pkgs/applications/misc/termite/default.nix
index 957b5bc0e8d5..22f669f03294 100644
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk3, ncurses, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, pkgconfig, vte-ng, gtk3, ncurses, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "termite-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
 
-  buildInputs = [ vte gtk3 ncurses ];
+  buildInputs = [ vte-ng gtk3 ncurses ];
 
   nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
 
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 49ddab1d6d23..86cf5352d6b6 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -8,7 +8,7 @@
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, gnome3
+, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, vte
 , vncSupport ? true, libjpeg, libpng
 , smartcardSupport ? true, libcacard
 , spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     ++ optionals numaSupport [ numactl ]
     ++ optionals pulseSupport [ libpulseaudio ]
     ++ optionals sdlSupport [ SDL2 ]
-    ++ optionals gtkSupport [ gtk3 gettext gnome3.vte ]
+    ++ optionals gtkSupport [ gtk3 gettext vte ]
     ++ optionals vncSupport [ libjpeg libpng ]
     ++ optionals smartcardSupport [ libcacard ]
     ++ optionals spiceSupport [ spice-protocol spice ]
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 62a67c11492b..4fe787bc5d4b 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -23,7 +23,7 @@ let
     deepin-shortcut-viewer = callPackage ./deepin-shortcut-viewer { };
     deepin-sound-theme = callPackage ./deepin-sound-theme { };
     deepin-terminal = callPackage ./deepin-terminal {
-      inherit (pkgs.gnome3) libgee vte;
+      inherit (pkgs.gnome3) libgee;
       wnck = pkgs.libwnck3;
     };
     deepin-wallpapers = callPackage ./deepin-wallpapers { };
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index f030201927a1..edf687c5d6bf 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd vte vte_290 vte-ng;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -201,12 +201,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   tracker-miners = callPackage ./core/tracker-miners { };
 
-  vte = callPackage ./core/vte { };
-
-  vte_290 = callPackage ./core/vte/2.90.nix { };
-
-  vte-ng = callPackage ./core/vte/ng.nix { };
-
   vino = callPackage ./core/vino { };
 
   yelp = callPackage ./core/yelp { };
diff --git a/pkgs/desktops/mate/mate-terminal/default.nix b/pkgs/desktops/mate/mate-terminal/default.nix
index a2f35284f4e3..ce8f58cc99b2 100644
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, wrapGAppsHook }:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, gtk3, vte, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "mate-terminal-${version}";
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
      mate.mate-desktop
 
-     gnome3.vte
-     gnome3.gtk
+     vte
+     gtk3
      gnome3.dconf
   ];
 
diff --git a/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix b/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
index 95d371959e53..d6bc8f5330b0 100644
--- a/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
+{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, vte_290, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   majorVersion = "0.4";
diff --git a/pkgs/desktops/xfce4-13/default.nix b/pkgs/desktops/xfce4-13/default.nix
index 4809cec839ad..d3e46cf23654 100644
--- a/pkgs/desktops/xfce4-13/default.nix
+++ b/pkgs/desktops/xfce4-13/default.nix
@@ -81,9 +81,7 @@ makeScope newScope (self: with self; {
 
   xfce4-taskmanager = callPackage ./xfce4-taskmanager { };
 
-  xfce4-terminal = callPackage ./xfce4-terminal {
-    inherit (gnome3) vte;
-  };
+  xfce4-terminal = callPackage ./xfce4-terminal { };
 
   xfce4-volumed-pulse = callPackage ./xfce4-volumed-pulse { };
 
diff --git a/pkgs/development/libraries/gtkd/default.nix b/pkgs/development/libraries/gtkd/default.nix
index 66ba526f08e2..780b00f9d9a2 100644
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchzip, atk, cairo, dmd, gdk_pixbuf, gnome3, gst_all_1, librsvg
-, pango, pkgconfig, which }:
+, pango, pkgconfig, which, vte }:
 
 stdenv.mkDerivation rec {
   name = "gtkd-${version}";
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   inherit atk cairo gdk_pixbuf librsvg pango;
-  inherit (gnome3) glib gtk3 gtksourceview libgda libpeas vte;
+  inherit (gnome3) glib gtk3 gtksourceview libgda libpeas;
   inherit (gst_all_1) gstreamer;
   gst_plugins_base = gst_all_1.gst-plugins-base;
 
diff --git a/pkgs/desktops/gnome-3/core/vte/2.90.nix b/pkgs/development/libraries/vte/2.90.nix
similarity index 88%
rename from pkgs/desktops/gnome-3/core/vte/2.90.nix
rename to pkgs/development/libraries/vte/2.90.nix
index 52bf198f29ce..4b2b74c5e1d5 100644
--- a/pkgs/desktops/gnome-3/core/vte/2.90.nix
+++ b/pkgs/development/libraries/vte/2.90.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gnome3, ncurses, gobject-introspection }:
+{ stdenv, fetchurl, intltool, pkgconfig, gnome3, glib, gtk3, ncurses, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   versionMajor = "0.36";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gobject-introspection intltool gnome3.glib gnome3.gtk3 ncurses ];
+  buildInputs = [ gobject-introspection intltool glib gtk3 ncurses ];
 
   configureFlags = [ "--enable-introspection" ];
 
diff --git a/pkgs/desktops/gnome-3/core/vte/default.nix b/pkgs/development/libraries/vte/default.nix
similarity index 78%
rename from pkgs/desktops/gnome-3/core/vte/default.nix
rename to pkgs/development/libraries/vte/default.nix
index 904bdd323d81..97bb961c4bc5 100644
--- a/pkgs/desktops/gnome-3/core/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -1,27 +1,27 @@
 { stdenv, fetchurl, intltool, pkgconfig
-, gnome3, ncurses, gobject-introspection, vala, libxml2, gnutls
+, gnome3, glib, gtk3, ncurses, gobject-introspection, vala, libxml2, gnutls
 , gperf, pcre2
 }:
 
 stdenv.mkDerivation rec {
-  name = "vte-${version}";
+  pname = "vte";
   version = "0.54.3";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/vte/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1zgb8jgi6sr4km58zfml8zkm24qipbngl2h7s5razhi5a0a84dk9";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "vte"; attrPath = "gnome3.vte"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   nativeBuildInputs = [ gobject-introspection intltool pkgconfig vala gperf libxml2 ];
-  buildInputs = [ gnome3.glib gnome3.gtk3 ncurses ];
+  buildInputs = [ glib gtk3 ncurses ];
 
   propagatedBuildInputs = [
     # Required by vte-2.91.pc.
-    gnome3.gtk3
+    gtk3
     gnutls
     pcre2
   ];
diff --git a/pkgs/desktops/gnome-3/core/vte/ng.nix b/pkgs/development/libraries/vte/ng.nix
similarity index 76%
rename from pkgs/desktops/gnome-3/core/vte/ng.nix
rename to pkgs/development/libraries/vte/ng.nix
index e6dc005fe58e..3aee9e9dcdf3 100644
--- a/pkgs/desktops/gnome-3/core/vte/ng.nix
+++ b/pkgs/development/libraries/vte/ng.nix
@@ -1,6 +1,6 @@
-{ gnome3, fetchFromGitHub, autoconf, automake, gtk-doc, gettext, libtool, gperf }:
+{ vte, fetchFromGitHub, autoconf, automake, gtk-doc, gettext, libtool, gperf }:
 
-gnome3.vte.overrideAttrs (oldAttrs: rec {
+vte.overrideAttrs (oldAttrs: rec {
   name = "vte-ng-${version}";
   version = "0.50.2.a";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac3301060f01..19c28e749dd7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12886,6 +12886,12 @@ in
 
   vsqlite = callPackage ../development/libraries/vsqlite { };
 
+  vte = callPackage ../development/libraries/vte { };
+
+  vte_290 = callPackage ../development/libraries/vte/2.90.nix { };
+
+  vte-ng = callPackage ../development/libraries/vte/ng.nix { };
+
   vtk = callPackage ../development/libraries/vtk {
     inherit (darwin) cf-private libobjc;
     inherit (darwin.apple_sdk.libs) xpc;
@@ -17439,9 +17445,7 @@ in
     inherit (gnome2) gtk;
   };
 
-  guake = callPackage ../applications/misc/guake {
-    inherit (gnome3) vte;
-  };
+  guake = callPackage ../applications/misc/guake { };
 
   guitone = callPackage ../applications/version-management/guitone {
     graphviz = graphviz_2_32;
@@ -19114,9 +19118,7 @@ in
 
   udiskie = python3Packages.callPackage ../applications/misc/udiskie { };
 
-  sakura = callPackage ../applications/misc/sakura {
-    vte = gnome3.vte;
-  };
+  sakura = callPackage ../applications/misc/sakura { };
 
   sayonara = callPackage ../applications/audio/sayonara { };
 
@@ -19201,7 +19203,6 @@ in
   ssvnc = callPackage ../applications/networking/remote/ssvnc { };
 
   stupidterm = callPackage ../applications/misc/stupidterm {
-    vte = gnome3.vte;
     gtk = gtk3;
   };
 
@@ -19504,18 +19505,14 @@ in
 
   terminus = callPackage ../applications/misc/terminus { };
 
-  lxterminal = callPackage ../applications/misc/lxterminal {
-    vte = gnome3.vte;
-  };
+  lxterminal = callPackage ../applications/misc/lxterminal { };
 
   aminal = callPackage ../applications/misc/aminal {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel;
     inherit (darwin) cf-private;
   };
 
-  termite-unwrapped = callPackage ../applications/misc/termite {
-    vte = gnome3.vte-ng;
-  };
+  termite-unwrapped = callPackage ../applications/misc/termite { };
 
   termite = callPackage ../applications/misc/termite/wrapper.nix { termite = termite-unwrapped; };
 
@@ -19551,7 +19548,6 @@ in
   tig = gitAndTools.tig;
 
   tilda = callPackage ../applications/misc/tilda {
-    vte = gnome3.vte;
     gtk = gtk3;
   };
 
@@ -19759,7 +19755,6 @@ in
   virt-what = callPackage ../applications/virtualization/virt-what { };
 
   virtmanager = callPackage ../applications/virtualization/virt-manager {
-    vte = gnome3.vte;
     dconf = gnome3.dconf;
     system-libvirt = libvirt;
   };
@@ -20261,13 +20256,12 @@ in
   xterm = callPackage ../applications/misc/xterm { };
 
   mlterm = callPackage ../applications/misc/mlterm {
-    vte = gnome3.vte;
     libssh2 = null;
     openssl = null;
   };
 
   roxterm = callPackage ../applications/misc/roxterm {
-    inherit (gnome3) gsettings-desktop-schemas vte;
+    inherit (gnome3) gsettings-desktop-schemas;
   };
 
   termonad-with-packages = callPackage ../applications/misc/termonad {

From 51088d7d96cbb38260aeda24d1599e1997e5ec86 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@users.noreply.github.com>
Date: Tue, 25 Dec 2018 18:29:06 -0500
Subject: [PATCH 170/182] gnome-menus: rename from gnome3.gnome-menus

---
 pkgs/applications/misc/plank/default.nix                   | 4 ++--
 pkgs/applications/misc/pmenu/default.nix                   | 4 ++--
 .../gnome-3/core/gnome-shell-extensions/default.nix        | 4 ++--
 pkgs/desktops/gnome-3/default.nix                          | 4 +---
 .../core => development/libraries}/gnome-menus/default.nix | 7 +++----
 pkgs/top-level/all-packages.nix                            | 2 ++
 6 files changed, 12 insertions(+), 13 deletions(-)
 rename pkgs/{desktops/gnome-3/core => development/libraries}/gnome-menus/default.nix (69%)

diff --git a/pkgs/applications/misc/plank/default.nix b/pkgs/applications/misc/plank/default.nix
index 626e400eac4b..cc6b74dc9989 100644
--- a/pkgs/applications/misc/plank/default.nix
+++ b/pkgs/applications/misc/plank/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, vala, atk, cairo, glib, gnome3, gtk3, libwnck3
 , libX11, libXfixes, libXi, pango, intltool, pkgconfig, libxml2
-, bamf, gdk_pixbuf, libdbusmenu-gtk3, file
+, bamf, gdk_pixbuf, libdbusmenu-gtk3, file, gnome-menus
 , wrapGAppsHook, autoreconfHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  buildInputs = [ vala atk cairo glib gnome3.gnome-menus
+  buildInputs = [ vala atk cairo glib gnome-menus
                   gtk3 gnome3.libgee libwnck3 libX11 libXfixes
                   libXi pango gnome3.gnome-common bamf gdk_pixbuf
                   libdbusmenu-gtk3 gnome3.dconf ];
diff --git a/pkgs/applications/misc/pmenu/default.nix b/pkgs/applications/misc/pmenu/default.nix
index b14bb445b5d1..4b39e9291a8a 100644
--- a/pkgs/applications/misc/pmenu/default.nix
+++ b/pkgs/applications/misc/pmenu/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, python2Packages, gnome3 }:
+{ stdenv, fetchFromGitLab, python2Packages, gnome-menus }:
 
 stdenv.mkDerivation rec {
   name = "pmenu-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ python2Packages.wrapPython ];
 
-  buildInputs = [ python2Packages.pygtk gnome3.gnome-menus ];
+  buildInputs = [ python2Packages.pygtk gnome-menus ];
 
   pythonPath = [ python2Packages.pygtk ];
     
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
index ff4263f74e3b..ec6d1af015a5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, meson, ninja, gettext, pkgconfig, spidermonkey_52, glib
-, gnome3, substituteAll }:
+, gnome3, gnome-menus, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "gnome-shell-extensions-${version}";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix_gmenu.patch;
-      gmenu_path = "${gnome3.gnome-menus}/lib/girepository-1.0";
+      gmenu_path = "${gnome-menus}/lib/girepository-1.0";
     })
   ];
 
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index edf687c5d6bf..e79ca7c3af86 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd vte vte_290 vte-ng;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd vte vte_290 vte-ng gnome-menus;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -104,8 +104,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-font-viewer = callPackage ./core/gnome-font-viewer { };
 
-  gnome-menus = callPackage ./core/gnome-menus { };
-
   gnome-keyring = callPackage ./core/gnome-keyring { };
 
   libgnome-keyring = callPackage ./core/libgnome-keyring { };
diff --git a/pkgs/desktops/gnome-3/core/gnome-menus/default.nix b/pkgs/development/libraries/gnome-menus/default.nix
similarity index 69%
rename from pkgs/desktops/gnome-3/core/gnome-menus/default.nix
rename to pkgs/development/libraries/gnome-menus/default.nix
index 9d49eb5e007c..0538b8ec06be 100644
--- a/pkgs/desktops/gnome-3/core/gnome-menus/default.nix
+++ b/pkgs/development/libraries/gnome-menus/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, intltool, pkgconfig, glib, gobject-introspection }:
 
 stdenv.mkDerivation rec {
-  name = "gnome-menus-${version}";
+  pname = "gnome-menus";
   version = "3.10.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnome-menus/3.10/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0wcacs1vk3pld8wvrwq7fdrm11i56nrajkrp6j1da6jc4yx0m5a6";
   };
 
@@ -16,8 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = https://www.gnome.org;
-    description = "Gnome menu specification";
-
+    description = "Library that implements freedesktops's Desktop Menu Specification in GNOME";
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 19c28e749dd7..e2f42334c93e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10145,6 +10145,8 @@ in
 
   gnome-sharp = callPackage ../development/libraries/gnome-sharp { mono = mono4; };
 
+  gnome-menus = callPackage ../development/libraries/gnome-menus { };
+
   granite = callPackage ../development/libraries/granite { };
   elementary-cmake-modules = callPackage ../development/libraries/elementary-cmake-modules { };
 

From d030db0fc01fd847bda892d446bf57fdf4a90140 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Tue, 18 Dec 2018 10:43:38 -0600
Subject: [PATCH 171/182] glib: 2.58.1 -> 2.58.2

---
 pkgs/development/libraries/glib/default.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 22acd530093e..37275489cc3d 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, meson, ninja, pkgconfig, perl, python3, glibcLocales
+{ stdenv, fetchurl, fetchpatch, gettext, meson, ninja, pkgconfig, perl, python3, glibcLocales
 , libiconv, zlib, libffi, pcre, libelf, gnome3, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45
 # use utillinuxMinimal to avoid circular dependency (utillinux, systemd, glib)
 , utillinuxMinimal ? null
@@ -44,7 +44,7 @@ let
     ln -sr -t "''${!outputInclude}/include/" "''${!outputInclude}"/lib/*/include/* 2>/dev/null || true
   '';
 
-  version = "2.58.1";
+  version = "2.58.2";
 in
 
 stdenv.mkDerivation rec {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1mnp4vankish8bqxymdl591p9v1ynk7pfc5dmpx3vamn4vcskmlp";
+    sha256 = "0jrxfm4gn1qz3y1450z709v74ys2bkjr8yffkgy106kgagb4xcn7";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch
@@ -64,6 +64,12 @@ stdenv.mkDerivation rec {
       ./schema-override-variable.patch
       # Require substituteInPlace in postPatch
       ./fix-gio-launch-desktop-path.patch
+      # https://gitlab.gnome.org/GNOME/glib/issues/1626
+      # https://gitlab.gnome.org/GNOME/glib/merge_requests/557
+      (fetchpatch {
+        url = https://gitlab.gnome.org/GNOME/glib/commit/85c4031696add9797e2334ced20678edcd96c869.patch;
+        sha256 = "1hmyvhx89wip2a26gk1rvd87k0pjfia51s0ysybjyzf5f1pzw877";
+      })
     ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];

From ae0f5d2705a34d590f6e439432926f89cfff0744 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Wed, 26 Dec 2018 00:50:17 -0800
Subject: [PATCH 172/182] diceware: 0.9.5 -> 0.9.6

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/diceware/versions
---
 pkgs/tools/security/diceware/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/diceware/default.nix b/pkgs/tools/security/diceware/default.nix
index 32819b603f90..1c3d5f1d465f 100644
--- a/pkgs/tools/security/diceware/default.nix
+++ b/pkgs/tools/security/diceware/default.nix
@@ -6,11 +6,11 @@ with pythonPackages;
 
 buildPythonApplication rec {
   pname = "diceware";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "22a998361fd2afbc7890062e228235b3501084de1e6a5bb61f16d2637977f50d";
+    sha256 = "0klb0ysybzlh2wihvir82hgq62v0jjmlcqklwajyms7c0p529yby";
   };
 
   nativeBuildInputs = [ pytestrunner ];

From 2526f9f157465cfc66385ea3213ed833a3944c43 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Sat, 8 Dec 2018 13:19:02 +0100
Subject: [PATCH 173/182] python37: remove references to openssl.dev

---
 .../interpreters/python/cpython/3.7/default.nix    | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/3.7/default.nix b/pkgs/development/interpreters/python/cpython/3.7/default.nix
index 30ebe5c6591f..177b5aa184d8 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.7/default.nix
@@ -14,6 +14,7 @@
 , self
 , CF, configd
 , python-setup-hook
+, nukeReferences
 # For the Python package set
 , packageOverrides ? (self: super: {})
 , buildPackages
@@ -34,7 +35,7 @@ let
   sitePackages = "lib/${libPrefix}/site-packages";
 
   buildInputs = filter (p: p != null) [
-    zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl ]
+    zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl nukeReferences ]
     ++ optionals x11Support [ tcl tk libX11 xproto ]
     ++ optionals stdenv.isDarwin [ CF configd ];
 
@@ -173,9 +174,14 @@ in stdenv.mkDerivation {
     # some $TMPDIR references to improve binary reproducibility.
     # Note that the .pyc file of _sysconfigdata.py should be regenerated!
     for i in $out/lib/python${majorVersion}/_sysconfigdata*.py $out/lib/python${majorVersion}/config-${majorVersion}m*/Makefile; do
-      sed -i $i -e "s|-I/nix/store/[^ ']*||g" -e "s|-L/nix/store/[^ ']*||g" -e "s|$TMPDIR|/no-such-path|g"
+      sed -i $i -e "s|$TMPDIR|/no-such-path|g"
+      nuke-refs $i
     done
 
+    # Further get rid of references. https://github.com/NixOS/nixpkgs/issues/51668
+    find $out/lib/python*/config-*-* -type f -print -exec nuke-refs '{}' +
+    find $out/lib -name '_sysconfigdata_m*.py*' -print -exec nuke-refs '{}' +
+
     # Determinism: rebuild all bytecode
     # We exclude lib2to3 because that's Python 2 code which fails
     # We rebuild three times, once for each optimization level
@@ -186,6 +192,10 @@ in stdenv.mkDerivation {
     find $out -name "*.py" | ${pythonForBuild} -OO -m compileall -q -f -x "lib2to3" -i -
   '';
 
+  # Enforce that we don't have references to the OpenSSL -dev package, which we
+  # explicitly specify in our configure flags above.
+  disallowedReferences = [ openssl.dev ];
+
   passthru = let
     pythonPackages = callPackage ../../../../../top-level/python-packages.nix {
       python = self;

From e039310f9673d8e4d4975c0aa97e7b294536e4b5 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Thu, 27 Dec 2018 09:22:53 +0100
Subject: [PATCH 174/182] python.pkgs.importlib-resources: invoke tests
 differently

Follow what upstream does. That solves the issue previously encountered.
---
 .../python-modules/importlib-resources/default.nix          | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 331c88a5e3a0..f5769bf0b2d9 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -5,6 +5,7 @@
 , typing
 , isPy3k
 , pythonOlder
+, python
 }:
 
 buildPythonPackage rec {
@@ -21,8 +22,9 @@ buildPythonPackage rec {
     ++ lib.optional (pythonOlder "3.5") typing
   ;
 
-  # https://gitlab.com/python-devs/importlib_resources/issues/69
-  doCheck = !isPy3k;
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover
+  '';
 
   meta = with lib; {
     description = "Read resources from Python packages";

From a1d297374df55c30b8b74834a85924e9dc739dda Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Thu, 27 Dec 2018 11:12:18 -0600
Subject: [PATCH 175/182] darwin.hfs: put headers in hfs/ directory

This is where they are supposed to go. My mistake in the original
commit.
---
 pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
index 134994002ee7..ab294b143d39 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
@@ -2,7 +2,7 @@
 
 appleDerivation {
   installPhase = lib.optionalString headersOnly ''
-    mkdir -p $out/include
-    cp core/*.h $out/include
+    mkdir -p $out/include/hfs
+    cp core/*.h $out/include/hfs
   '';
 }

From d0dc91d24f643ca2cb6901f80a641099db975966 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 19 Mar 2018 22:02:49 -0500
Subject: [PATCH 176/182] darwin: bump apple_sdks to 10.12

(cherry picked from commit 0b468bf0335eaa606fccfe98d4a36c3efbe83f2a)
---
 pkgs/os-specific/darwin/apple-sdk/default.nix | 22 ++++++-------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index c23a2148143a..71574998885f 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,30 +1,22 @@
-{ stdenv, fetchurl, xar, xz, cpio, pkgs, python, lib }:
+{ stdenv, fetchurl, xar, cpio, pkgs, python, pbzx, lib }:
 
 let
-  # TODO: make this available to other packages and generalize the unpacking a bit
-  # from https://gist.github.com/pudquick/ff412bcb29c9c1fa4b8d
-  # This isn't needed until we get to SDK 10.11, but that presents other challenges
-  # unpbzx = fetchurl {
-  #   url    = "https://gist.githubusercontent.com/pudquick/ff412bcb29c9c1fa4b8d/raw/24b25538ea8df8d0634a2a6189aa581ccc6a5b4b/parse_pbzx2.py";
-  #   sha256 = "0jgp6qbfl36i0jlz7as5zk2w20z4ca8wlrhdw49lwsld6wi3rfhc";
-  # };
-
   # sadly needs to be exported because security_tool needs it
   sdk = stdenv.mkDerivation rec {
-    version = "10.10";
+    version = "10.12";
     name    = "MacOS_SDK-${version}";
 
-    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.10.merged-1.sucatalog, which we found by:
+    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.12.merged-1.sucatalog, which we found by:
     #  1. Google: site:swscan.apple.com and look for a name that seems appropriate for your version
     #  2. In the resulting file, search for a file called DevSDK ending in .pkg
     #  3. ???
     #  4. Profit
     src = fetchurl {
-      url    = "http://swcdn.apple.com/content/downloads/22/52/031-45139/hcjjv7cm4n6yqk56ict73qqw15ikm5iaql/DevSDK_OSX1010.pkg";
-      sha256 = "08bxa93zw7r4vzs28j9giq2qyk3b68ky6jx1bb9850gflr3nvgq1";
+      url    = "http://swcdn.apple.com/content/downloads/28/09/091-29862/pafhn2u002b9slnrxzy9p86rpedycnjhb5/DevSDK_OSX1012.pkg";
+      sha256 = "1sggc70rypqwcjwr7ciavw8sczwll16cwqxdxrbw7r2qvy3b0nhx";
     };
 
-    buildInputs = [ xar xz cpio python ];
+    buildInputs = [ xar cpio python pbzx ];
 
     phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
     outputs = [ "out" "dev" "man" ];
@@ -37,7 +29,7 @@ let
       start="$(pwd)"
       mkdir -p $out
       cd $out
-      cat $start/Payload | gzip -d | cpio -idm
+      pbzx -n $start/Payload | cpio -idm
 
       mv usr/* .
       rmdir usr

From 4f522648cbb80a3f733ac33898191106c5eb1ec2 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sat, 29 Dec 2018 23:58:10 -0600
Subject: [PATCH 177/182] darwin: fix *_cmds installation

These just copy commands from Products/Release/. But with #52256 we
now build .dsym directories that somehow wind up in Products/Release/.
This makes things more exact by just copying the files in Products/Release/.
---
 .../darwin/apple-source-releases/adv_cmds/default.nix      | 7 +++++--
 .../darwin/apple-source-releases/basic_cmds/default.nix    | 7 +++++--
 .../apple-source-releases/developer_cmds/default.nix       | 7 +++++--
 .../darwin/apple-source-releases/diskdev_cmds/default.nix  | 6 ++++--
 .../darwin/apple-source-releases/file_cmds/default.nix     | 7 +++++--
 .../darwin/apple-source-releases/network_cmds/default.nix  | 7 +++++--
 .../darwin/apple-source-releases/shell_cmds/default.nix    | 7 +++++--
 .../darwin/apple-source-releases/text_cmds/default.nix     | 5 +++--
 8 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 19755c270bea..ba80ab923bd4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -32,8 +32,11 @@ appleDerivation {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
+    done
 
     for n in 1 8; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 5d9781f3aa4a..8d44a17f6ed4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -13,8 +13,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/usr/bin/$(basename $f)
+      fi
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 4220c50d61cb..b2d8522f3264 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -10,8 +10,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $f $out/bin/$(basename $f)
+      fi
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index fa77329008d6..4da9144bbe1a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -22,8 +22,10 @@ appleDerivation {
   installPhase = ''
     install -D Products/Release/libdisk.a $out/lib/libdisk.a
     rm Products/Release/libdisk.a
-    for bin in Products/Release/*; do
-      install -D $bin $out/bin/$(basename $bin)
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
     done
   '';
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index a723f8b71ac9..96dae723b2ee 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -19,8 +19,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index dccc83a70bff..9dc5150ac2f5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -20,8 +20,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
+    done
 
     for n in 1 5; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index bec05ef85757..5b2322915dc9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -28,8 +28,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/usr/bin
-    install Products/Release/* $out/usr/bin
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $f $out/usr/bin/$(basename $f)
+      fi
+    done
 
     export DSTROOT=$out
     export SRCROOT=$PWD
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 91abb3ca07a8..14d7a5e3b32d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -13,9 +13,10 @@ appleDerivation {
   '';
 
   installPhase = ''
-    mkdir -p $out/bin
     for f in Products/Release/*; do
-      install -D $f $out/bin/$(basename $f)
+      if [ -f $f ]; then
+        install -D $f $out/bin/$(basename $f)
+      fi
     done
   '';
 

From ec1f78d1cb6ac86743ffb797bf88d4633b91e733 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 30 Dec 2018 00:00:30 -0600
Subject: [PATCH 178/182] darwin.libunwind: fix hash

---
 pkgs/os-specific/darwin/apple-source-releases/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 09f275b8234a..a1440c937092 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -232,7 +232,7 @@ let
       hfs = pkgs.darwin.hfs.override { headersOnly = true; };
     };
     libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
-    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk10" {};
+    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
     mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
     objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
     ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};

From 8505e710e707b2e425379dc356721194f742d8d0 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Thu, 3 Jan 2019 15:09:44 -0600
Subject: [PATCH 179/182] Revert "darwin 10.12 commits"

Reverts commits bumping to macOS stuff to 10.12:

commit ec1f78d1cb6ac86743ffb797bf88d4633b91e733.
commit d0dc91d24f643ca2cb6901f80a641099db975966.
commit a1d297374df55c30b8b74834a85924e9dc739dda.
commit 425112151db3b05fec01e86cb10c90b4037e9367.
commit e6f7f2928f668262577125290dc90ad8df12e724.
---
 .../haskell-modules/configuration-nix.nix     |  19 +++
 pkgs/development/tools/xcbuild/toolchains.nix |   2 -
 pkgs/os-specific/darwin/apple-sdk/default.nix |  22 ++-
 .../Libc/CrashReporterClient.h                |  51 ------
 .../apple-source-releases/Libc/default.nix    |   2 -
 .../Libsystem/default.nix                     |  20 +--
 .../Libsystem/system_c_symbols                |  27 ---
 .../Libsystem/system_kernel_symbols           | 158 ------------------
 .../apple-source-releases/Security/boot.nix   | 116 -------------
 .../Security/default.nix                      | 119 +++++++++++--
 .../SmartCardServices/default.nix             |  42 +++++
 .../apple-source-releases/adv_cmds/boot.nix   |  91 ----------
 .../adv_cmds/default.nix                      | 105 ++++++++----
 .../apple-source-releases/adv_cmds/xcode.nix  |  58 +++++++
 .../bootstrap_cmds/default.nix                |   1 -
 .../darwin/apple-source-releases/default.nix  | 139 ++++++++-------
 .../diskdev_cmds/default.nix                  |   4 +-
 .../apple-source-releases/dtrace/default.nix  |  81 +++++----
 .../apple-source-releases/dtrace/xcode.nix    |  47 ++++++
 .../file_cmds/default.nix                     |   4 +-
 .../apple-source-releases/hfs/default.nix     |   8 -
 .../libsecurity_apple_csp/GNUmakefile         |  11 ++
 .../libsecurity_apple_csp/default.nix         |  31 ++++
 .../libsecurity_apple_cspdl/GNUmakefile       |  10 ++
 .../libsecurity_apple_cspdl/default.nix       |  16 ++
 .../libsecurity_apple_file_dl/GNUmakefile     |  10 ++
 .../libsecurity_apple_file_dl/default.nix     |  17 ++
 .../libsecurity_apple_x509_cl/GNUmakefile     |  10 ++
 .../libsecurity_apple_x509_cl/default.nix     |  18 ++
 .../libsecurity_apple_x509_tp/GNUmakefile     |  11 ++
 .../libsecurity_apple_x509_tp/default.nix     |  19 +++
 .../libsecurity_asn1/GNUmakefile              |  11 ++
 .../libsecurity_asn1/default.nix              |  14 ++
 .../libsecurity_cdsa_client/GNUmakefile       |  10 ++
 .../libsecurity_cdsa_client/default.nix       |   8 +
 .../libsecurity_cdsa_plugin/GNUmakefile       |  10 ++
 .../libsecurity_cdsa_plugin/default.nix       |  15 ++
 .../libsecurity_cdsa_utilities/GNUmakefile    |  13 ++
 .../libsecurity_cdsa_utilities/default.nix    |  13 ++
 .../handletemplates.patch                     |  19 +++
 .../libsecurity_cdsa_utils/GNUmakefile        |  13 ++
 .../libsecurity_cdsa_utils/default.nix        |   8 +
 .../libsecurity_codesigning/GNUmakefile       |  10 ++
 .../libsecurity_codesigning/default.nix       |  33 ++++
 .../libsecurity_cssm/GNUmakefile              |  11 ++
 .../libsecurity_cssm/default.nix              |  14 ++
 .../libsecurity_filedb/GNUmakefile            |  10 ++
 .../libsecurity_filedb/default.nix            |  13 ++
 .../libsecurity_generic/default.nix           |  63 +++++++
 .../libsecurity_generic/impure_deps.nix       | 129 ++++++++++++++
 .../libsecurity_keychain/GNUmakefile          |  10 ++
 .../libsecurity_keychain/default.nix          |  43 +++++
 .../libsecurity_mds/GNUmakefile               |  10 ++
 .../libsecurity_mds/default.nix               |  11 ++
 .../libsecurity_ocspd/GNUmakefile             |  10 ++
 .../libsecurity_ocspd/default.nix             |  20 +++
 .../libsecurity_pkcs12/GNUmakefile            |  11 ++
 .../libsecurity_pkcs12/default.nix            |  15 ++
 .../libsecurity_sd_cspdl/GNUmakefile          |  10 ++
 .../libsecurity_sd_cspdl/default.nix          |  10 ++
 .../libsecurity_utilities/GNUmakefile         |  11 ++
 .../libsecurity_utilities/default.nix         |  28 ++++
 .../libsecurityd/GNUmakefile                  |  11 ++
 .../libsecurityd/default.nix                  |  23 +++
 .../libsecurityd/xdr-arity.patch              |  79 +++++++++
 .../apple-source-releases/libutil/default.nix |  26 +--
 .../apple-source-releases/libutil/new.nix     |  29 ++++
 .../security_dotmac_tp/GNUmakefile            |   8 +
 .../security_dotmac_tp/default.nix            |   4 +
 .../security_systemkeychain/default.nix       |  32 ++++
 .../apple-source-releases/top/default.nix     |   4 +-
 .../apple-source-releases/xnu/default.nix     |  93 +++++------
 pkgs/os-specific/darwin/darling/default.nix   |   3 -
 .../darwin/security-tool/GNUmakefile          |  14 ++
 .../darwin/security-tool/default.nix          | 101 +++++++++++
 pkgs/top-level/darwin-packages.nix            |   4 +
 76 files changed, 1608 insertions(+), 698 deletions(-)
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
 delete mode 100644 pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
 create mode 100644 pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
 create mode 100644 pkgs/os-specific/darwin/security-tool/GNUmakefile
 create mode 100644 pkgs/os-specific/darwin/security-tool/default.nix

diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index cdba7013cfa3..f0d629ad5e44 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -126,6 +126,25 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system = if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then let inherit (pkgs.darwin) security_tool;
+      in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
+        # darwin.security_tool is broken in Mojave (#45042)
+
+        # We will use the system provided security for now.
+        # Beware this WILL break in sandboxes!
+
+        # TODO(matthewbauer): If someone really needs this to work in sandboxes,
+        # I think we can add a propagatedImpureHost dep here, but I’m hoping to
+        # get a proper fix available soonish.
+        postPatch = (drv.postPatch or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+        '';
+      })
+    else super.x509-system;
+
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/tools/xcbuild/toolchains.nix b/pkgs/development/tools/xcbuild/toolchains.nix
index e435f0978c5e..59e009a43386 100644
--- a/pkgs/development/tools/xcbuild/toolchains.nix
+++ b/pkgs/development/tools/xcbuild/toolchains.nix
@@ -67,7 +67,5 @@ runCommand "Toolchains" {} (''
   done
 
   ln -s ${buildPackages.darwin.bootstrap_cmds}/bin/mig $toolchain/bin
-  mkdir -p $toolchain/libexec
-  ln -s ${buildPackages.darwin.bootstrap_cmds}/libexec/migcom $toolchain/libexec
   ln -s ${mkdep-darwin-src} $toolchain/bin/mkdep
 '')
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 71574998885f..c23a2148143a 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,22 +1,30 @@
-{ stdenv, fetchurl, xar, cpio, pkgs, python, pbzx, lib }:
+{ stdenv, fetchurl, xar, xz, cpio, pkgs, python, lib }:
 
 let
+  # TODO: make this available to other packages and generalize the unpacking a bit
+  # from https://gist.github.com/pudquick/ff412bcb29c9c1fa4b8d
+  # This isn't needed until we get to SDK 10.11, but that presents other challenges
+  # unpbzx = fetchurl {
+  #   url    = "https://gist.githubusercontent.com/pudquick/ff412bcb29c9c1fa4b8d/raw/24b25538ea8df8d0634a2a6189aa581ccc6a5b4b/parse_pbzx2.py";
+  #   sha256 = "0jgp6qbfl36i0jlz7as5zk2w20z4ca8wlrhdw49lwsld6wi3rfhc";
+  # };
+
   # sadly needs to be exported because security_tool needs it
   sdk = stdenv.mkDerivation rec {
-    version = "10.12";
+    version = "10.10";
     name    = "MacOS_SDK-${version}";
 
-    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.12.merged-1.sucatalog, which we found by:
+    # This URL comes from https://swscan.apple.com/content/catalogs/others/index-10.10.merged-1.sucatalog, which we found by:
     #  1. Google: site:swscan.apple.com and look for a name that seems appropriate for your version
     #  2. In the resulting file, search for a file called DevSDK ending in .pkg
     #  3. ???
     #  4. Profit
     src = fetchurl {
-      url    = "http://swcdn.apple.com/content/downloads/28/09/091-29862/pafhn2u002b9slnrxzy9p86rpedycnjhb5/DevSDK_OSX1012.pkg";
-      sha256 = "1sggc70rypqwcjwr7ciavw8sczwll16cwqxdxrbw7r2qvy3b0nhx";
+      url    = "http://swcdn.apple.com/content/downloads/22/52/031-45139/hcjjv7cm4n6yqk56ict73qqw15ikm5iaql/DevSDK_OSX1010.pkg";
+      sha256 = "08bxa93zw7r4vzs28j9giq2qyk3b68ky6jx1bb9850gflr3nvgq1";
     };
 
-    buildInputs = [ xar cpio python pbzx ];
+    buildInputs = [ xar xz cpio python ];
 
     phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
     outputs = [ "out" "dev" "man" ];
@@ -29,7 +37,7 @@ let
       start="$(pwd)"
       mkdir -p $out
       cd $out
-      pbzx -n $start/Payload | cpio -idm
+      cat $start/Payload | gzip -d | cpio -idm
 
       mv usr/* .
       rmdir usr
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h b/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
deleted file mode 100644
index a1cbb72b9176..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/CrashReporterClient.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (c) 2010 Apple Inc. All rights reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-/***********************************************************************
- * Not to be installed in /usr/local/include
- ***********************************************************************/
-
-#ifndef _LIBC_CRASHREPORTERCLIENT_H
-#define _LIBC_CRASHREPORTERCLIENT_H
-
-#include "stdint.h"
-
-/* Fake the CrashReporterClient API */
-#define CRGetCrashLogMessage() 0
-#define CRSetCrashLogMessage(m) true
-
-#define CRASH_REPORTER_CLIENT_HIDDEN __attribute__((visibility("hidden")))
-#define CRASHREPORTER_ANNOTATIONS_VERSION 4
-#define CRASHREPORTER_ANNOTATIONS_SECTION "__crash_info"
-
-struct crashreporter_annotations_t {
-	uint64_t version;		// unsigned long
-	uint64_t message;		// char *
-	uint64_t signature_string;	// char *
-	uint64_t backtrace;		// char *
-	uint64_t message2;		// char *
-	uint64_t thread;		// uint64_t
-	uint64_t dialog_mode;		// unsigned int
-};
-
-#endif
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
index 6ebb470145d5..542ea20de11e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -11,8 +11,6 @@ appleDerivation {
     export PRIVATE_HEADERS_FOLDER_PATH=include
     bash xcodescripts/headers.sh
 
-    cp ${./CrashReporterClient.h} $out/include/CrashReporterClient.h
-
     cp ${Libc_10-9}/include/NSSystemDirectories.h $out/include
 
     # Ugh Apple stopped releasing this stuff so we need an older one...
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index a0edfbbb3b59..1e27ead69f1b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,11 +1,9 @@
-{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo
-, dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto
-, copyfile, removefile, libresolv, Libnotify, libplatform, libpthread
-, mDNSResponder, launchd, libutil, hfs }:
+{ stdenv, appleDerivation, cpio, xnu, Libc, Libm, libdispatch, cctools, Libinfo,
+  dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto, copyfile,
+  removefile, libresolv, Libnotify, libplatform, libpthread, mDNSResponder, launchd, libutil }:
 
 appleDerivation rec {
-  dontBuild = true;
-  dontFixup = true;
+  phases = [ "unpackPhase" "installPhase" ];
 
   nativeBuildInputs = [ cpio ];
 
@@ -19,21 +17,19 @@ appleDerivation rec {
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/Availability*.h $out/include
     cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/stdarg.h        $out/include
 
-    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} \
-               ${libclosure} ${CarbonHeaders} ${libdispatch} ${ncurses.dev} \
-               ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
-               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} \
-               ${libutil} ${libpthread} ${hfs}; do
+    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} ${libclosure} ${CarbonHeaders} \
+               ${libdispatch} ${ncurses.dev} ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
+               ${Libnotify} ${libplatform} ${mDNSResponder} ${launchd} ${libutil} ${libpthread}; do
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
+
     (cd ${cctools.dev}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
 
     cat <<EOF > $out/include/TargetConditionals.h
     #ifndef __TARGETCONDITIONALS__
     #define __TARGETCONDITIONALS__
     #define TARGET_OS_MAC           1
-    #define TARGET_OS_OSX           1
     #define TARGET_OS_WIN32         0
     #define TARGET_OS_UNIX          0
     #define TARGET_OS_EMBEDDED      0
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
index 1ec6c6332cf4..4d83c5cfe9bd 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -232,8 +232,6 @@ __os_assert_log_ctx
 __os_assumes_log
 __os_assumes_log_ctx
 __os_avoid_tail_call
-__os_crash
-__os_crash_callback
 __os_debug_log
 __os_debug_log_error_str
 __putenvp
@@ -265,7 +263,6 @@ __unsetenvp
 __utmpxname
 _a64l
 _abort
-_abort_report_np
 _abs
 _acl_add_flag_np
 _acl_add_perm
@@ -348,7 +345,6 @@ _backtrace
 _backtrace_symbols
 _backtrace_symbols_fd
 _basename
-_basename_r
 _bcmp
 _bcopy
 _brk
@@ -381,12 +377,8 @@ _chmodx_np
 _clearerr
 _clearerr_unlocked
 _clock
-_clock_getres
-_clock_gettime
-_clock_gettime_nsec_np
 _clock_port
 _clock_sem
-_clock_settime
 _closedir
 _compat_mode
 _confstr
@@ -419,7 +411,6 @@ _digittoint
 _digittoint_l
 _dirfd
 _dirname
-_dirname_r
 _div
 _dprintf
 _dprintf_l
@@ -780,12 +771,8 @@ _mergesort_b
 _mkdirx_np
 _mkdtemp
 _mkfifox_np
-_mkostemp
-_mkostemps
 _mkpath_np
-_mkpathat_np
 _mkstemp
-_mkstemp_dprotected_np
 _mkstemps
 _mktemp
 _mktime
@@ -818,7 +805,6 @@ _nice
 _nl_langinfo
 _nl_langinfo_l
 _nrand48
-_nvis
 _off32
 _off64
 _offtime
@@ -973,7 +959,6 @@ _sleep
 _sleep$NOCANCEL
 _snprintf
 _snprintf_l
-_snvis
 _sockatmark
 _sprintf
 _sprintf_l
@@ -1003,7 +988,6 @@ _strcoll_l
 _strcpy
 _strcspn
 _strdup
-_strenvisx
 _strerror
 _strerror_r
 _strfmon
@@ -1022,23 +1006,14 @@ _strncpy
 _strndup
 _strnlen
 _strnstr
-_strnunvis
-_strnunvisx
-_strnvis
-_strnvisx
 _strpbrk
 _strptime
 _strptime_l
 _strrchr
-_strsenvisx
 _strsep
 _strsignal
-_strsnvis
-_strsnvisx
 _strspn
 _strstr
-_strsvis
-_strsvisx
 _strtod
 _strtod_l
 _strtof
@@ -1071,7 +1046,6 @@ _strvisx
 _strxfrm
 _strxfrm_l
 _suboptarg
-_svis
 _swab
 _swprintf
 _swprintf_l
@@ -1113,7 +1087,6 @@ _timelocal
 _timeoff
 _times
 _timezone
-_timingsafe_bcmp
 _tmpfile
 _tmpnam
 _toascii
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
index 7c5b90f95ed7..4d1a1f521b06 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -3,7 +3,6 @@ _____old_semwait_signal_nocancel
 _____sigwait_nocancel
 ____kernelVersionNumber
 ____kernelVersionString
-___abort_with_payload
 ___accept
 ___accept_nocancel
 ___access_extended
@@ -14,11 +13,6 @@ ___bsdthread_ctl
 ___bsdthread_register
 ___bsdthread_terminate
 ___carbon_delete
-___channel_get_info
-___channel_get_opt
-___channel_open
-___channel_set_opt
-___channel_sync
 ___chmod
 ___chmod_extended
 ___close_nocancel
@@ -38,7 +32,6 @@ ___fchmod_extended
 ___fcntl
 ___fcntl_nocancel
 ___fork
-___fs_snapshot
 ___fstat64_extended
 ___fstat_extended
 ___fsync_nocancel
@@ -64,8 +57,6 @@ ___ioctl
 ___iopolicysys
 ___kdebug_trace
 ___kdebug_trace64
-___kdebug_trace_string
-___kdebug_typefilter
 ___kill
 ___lchown
 ___libkernel_init
@@ -88,7 +79,6 @@ ___mac_set_file
 ___mac_set_link
 ___mac_set_proc
 ___mac_syscall
-___microstackshot
 ___mkdir_extended
 ___mkfifo_extended
 ___mmap
@@ -100,13 +90,6 @@ ___msgsys
 ___msync
 ___msync_nocancel
 ___munmap
-___nexus_create
-___nexus_deregister
-___nexus_destroy
-___nexus_get_opt
-___nexus_open
-___nexus_register
-___nexus_set_opt
 ___old_semwait_signal
 ___open
 ___open_dprotected_np
@@ -114,17 +97,12 @@ ___open_extended
 ___open_nocancel
 ___openat
 ___openat_nocancel
-___os_nexus_ifattach
-___os_nexus_ifdetach
-___persona
 ___pipe
 ___poll_nocancel
 ___posix_spawn
 ___pread_nocancel
 ___proc_info
 ___process_policy
-___pselect
-___pselect_nocancel
 ___psynch_cvbroad
 ___psynch_cvclrprepost
 ___psynch_cvsignal
@@ -155,7 +133,6 @@ ___recvmsg
 ___recvmsg_nocancel
 ___rename
 ___renameat
-___renameatx_np
 ___rmdir
 ___sandbox_me
 ___sandbox_mm
@@ -198,7 +175,6 @@ ___sigsuspend
 ___sigsuspend_nocancel
 ___sigwait
 ___socketpair
-___stack_snapshot_with_config
 ___stat64_extended
 ___stat_extended
 ___syscall
@@ -206,11 +182,8 @@ ___syscall_logger
 ___sysctl
 ___sysctlbyname
 ___telemetry
-___terminate_with_payload
 ___thread_selfid
 ___thread_selfusage
-___ulock_wait
-___ulock_wake
 ___umask_extended
 ___unlink
 ___unlinkat
@@ -218,7 +191,6 @@ ___vfork
 ___wait4
 ___wait4_nocancel
 ___waitid_nocancel
-___work_interval_ctl
 ___workq_kernreturn
 ___workq_open
 ___write_nocancel
@@ -230,7 +202,6 @@ __get_cpu_capabilities
 __getprivatesystemidentifier
 __host_page_size
 __init_cpu_capabilities
-__kernelrpc_host_create_mach_voucher
 __kernelrpc_mach_port_allocate
 __kernelrpc_mach_port_allocate_full
 __kernelrpc_mach_port_allocate_name
@@ -286,17 +257,13 @@ __kernelrpc_mach_vm_map
 __kernelrpc_mach_vm_map_trap
 __kernelrpc_mach_vm_protect
 __kernelrpc_mach_vm_protect_trap
-__kernelrpc_mach_vm_purgable_control
-__kernelrpc_mach_vm_purgable_control_trap
 __kernelrpc_mach_vm_read
 __kernelrpc_mach_vm_remap
-__kernelrpc_mach_voucher_extract_attr_recipe
 __kernelrpc_task_set_port_space
 __kernelrpc_thread_policy
 __kernelrpc_thread_policy_set
 __kernelrpc_thread_set_policy
 __kernelrpc_vm_map
-__kernelrpc_vm_purgable_control
 __kernelrpc_vm_read
 __kernelrpc_vm_remap
 __mach_errors
@@ -305,9 +272,6 @@ __mach_snprintf
 __mach_vsnprintf
 __os_alloc_once_table
 __register_gethostuuid_callback
-__thread_set_tsd_base
-_abort_with_payload
-_abort_with_reason
 _accept
 _accept$NOCANCEL
 _access
@@ -348,8 +312,6 @@ _clock_set_attributes
 _clock_set_time
 _clock_sleep
 _clock_sleep_trap
-_clonefile
-_clonefileat
 _close
 _close$NOCANCEL
 _coalition_create
@@ -383,7 +345,6 @@ _fchmod
 _fchmodat
 _fchown
 _fchownat
-_fclonefileat
 _fcntl
 _fcntl$NOCANCEL
 _fdatasync
@@ -397,16 +358,9 @@ _flistxattr
 _flock
 _fpathconf
 _fremovexattr
-_fs_snapshot_create
-_fs_snapshot_delete
-_fs_snapshot_list
-_fs_snapshot_mount
-_fs_snapshot_rename
-_fs_snapshot_revert
 _fsctl
 _fsetattrlist
 _fsetxattr
-_fsgetpath
 _fstat
 _fstat$INODE64
 _fstat64
@@ -430,7 +384,6 @@ _getdirentries
 _getdirentriesattr
 _getdtablesize
 _getegid
-_getentropy
 _geteuid
 _getfh
 _getfsstat
@@ -456,7 +409,6 @@ _getsockopt
 _getuid
 _getwgroups_np
 _getxattr
-_grab_pgo_data
 _guarded_close_np
 _guarded_kqueue_np
 _guarded_open_dprotected_np
@@ -464,18 +416,14 @@ _guarded_open_np
 _guarded_pwrite_np
 _guarded_write_np
 _guarded_writev_np
-_host_check_multiuser_mode
 _host_create_mach_voucher
-_host_create_mach_voucher_trap
 _host_default_memory_manager
 _host_get_UNDServer
-_host_get_atm_diagnostic_flag
 _host_get_boot_info
 _host_get_clock_control
 _host_get_clock_service
 _host_get_exception_ports
 _host_get_io_master
-_host_get_multiuser_config_flags
 _host_get_special_port
 _host_info
 _host_kernel_version
@@ -495,9 +443,7 @@ _host_security_set_task_token
 _host_self
 _host_self_trap
 _host_set_UNDServer
-_host_set_atm_diagnostic_flag
 _host_set_exception_ports
-_host_set_multiuser_config_flags
 _host_set_special_port
 _host_statistics
 _host_statistics64
@@ -510,28 +456,15 @@ _internal_catch_exc_subsystem
 _ioctl
 _issetugid
 _kas_info
-_kdebug_is_enabled
-_kdebug_signpost
-_kdebug_signpost_end
-_kdebug_signpost_start
 _kdebug_trace
-_kdebug_trace_string
-_kdebug_typefilter
 _kevent
 _kevent64
-_kevent_qos
 _kext_request
 _kill
 _kmod_control
 _kmod_create
 _kmod_destroy
 _kmod_get_info
-_kpersona_alloc
-_kpersona_dealloc
-_kpersona_find
-_kpersona_get
-_kpersona_info
-_kpersona_pidinfo
 _kqueue
 _lchown
 _ledger
@@ -554,20 +487,14 @@ _lstat$INODE64
 _lstat64
 _mach_absolute_time
 _mach_approximate_time
-_mach_boottime_usec
-_mach_continuous_approximate_time
-_mach_continuous_time
 _mach_error
 _mach_error_full_diag
 _mach_error_string
 _mach_error_type
-_mach_generate_activity_id
-_mach_get_times
 _mach_host_self
 _mach_init
 _mach_make_memory_entry
 _mach_make_memory_entry_64
-_mach_memory_info
 _mach_memory_object_memory_entry
 _mach_memory_object_memory_entry_64
 _mach_msg
@@ -627,7 +554,6 @@ _mach_task_self
 _mach_task_self_
 _mach_thread_self
 _mach_timebase_info
-_mach_timebase_info_trap
 _mach_vm_allocate
 _mach_vm_behavior_set
 _mach_vm_copy
@@ -654,7 +580,6 @@ _mach_voucher_debug_info
 _mach_voucher_extract_all_attr_recipes
 _mach_voucher_extract_attr_content
 _mach_voucher_extract_attr_recipe
-_mach_voucher_extract_attr_recipe_trap
 _mach_wait_until
 _mach_zone_force_gc
 _mach_zone_info
@@ -673,7 +598,6 @@ _mig_get_reply_port
 _mig_put_reply_port
 _mig_reply_setup
 _mig_strncpy
-_mig_strncpy_zerofill
 _mincore
 _minherit
 _mk_timer_arm
@@ -706,10 +630,7 @@ _msync$NOCANCEL
 _munlock
 _munlockall
 _munmap
-_necp_client_action
 _necp_match_policy
-_necp_open
-_netagent_trigger
 _netname_check_in
 _netname_check_out
 _netname_look_up
@@ -724,44 +645,6 @@ _open_dprotected_np
 _openat
 _openat$NOCANCEL
 _openbyid_np
-_os_channel_advance_slot
-_os_channel_attr_clone
-_os_channel_attr_create
-_os_channel_attr_destroy
-_os_channel_attr_get
-_os_channel_attr_get_key
-_os_channel_attr_set
-_os_channel_attr_set_key
-_os_channel_available_slot_count
-_os_channel_create
-_os_channel_create_extended
-_os_channel_destroy
-_os_channel_get_fd
-_os_channel_get_next_slot
-_os_channel_pending
-_os_channel_read_attr
-_os_channel_read_nexus_extension_info
-_os_channel_ring_id
-_os_channel_rx_ring
-_os_channel_set_slot_properties
-_os_channel_sync
-_os_channel_tx_ring
-_os_channel_write_attr
-_os_nexus_attr_clone
-_os_nexus_attr_create
-_os_nexus_attr_destroy
-_os_nexus_attr_get
-_os_nexus_attr_set
-_os_nexus_controller_alloc_provider_instance
-_os_nexus_controller_bind_provider_instance
-_os_nexus_controller_create
-_os_nexus_controller_deregister_provider
-_os_nexus_controller_destroy
-_os_nexus_controller_free_provider_instance
-_os_nexus_controller_get_fd
-_os_nexus_controller_read_provider_attr
-_os_nexus_controller_register_provider
-_os_nexus_controller_unbind_provider_instance
 _panic
 _panic_init
 _pathconf
@@ -786,7 +669,6 @@ _posix_spawn_file_actions_addopen
 _posix_spawn_file_actions_destroy
 _posix_spawn_file_actions_init
 _posix_spawnattr_destroy
-_posix_spawnattr_get_darwin_role_np
 _posix_spawnattr_get_qos_clamp_np
 _posix_spawnattr_getbinpref_np
 _posix_spawnattr_getcpumonitor
@@ -798,12 +680,7 @@ _posix_spawnattr_getprocesstype_np
 _posix_spawnattr_getsigdefault
 _posix_spawnattr_getsigmask
 _posix_spawnattr_init
-_posix_spawnattr_set_darwin_role_np
 _posix_spawnattr_set_importancewatch_port_np
-_posix_spawnattr_set_persona_gid_np
-_posix_spawnattr_set_persona_groups_np
-_posix_spawnattr_set_persona_np
-_posix_spawnattr_set_persona_uid_np
 _posix_spawnattr_set_qos_clamp_np
 _posix_spawnattr_setauditsessionport_np
 _posix_spawnattr_setbinpref_np
@@ -812,7 +689,6 @@ _posix_spawnattr_setcpumonitor
 _posix_spawnattr_setcpumonitor_default
 _posix_spawnattr_setexceptionports_np
 _posix_spawnattr_setflags
-_posix_spawnattr_setjetsam_ext
 _posix_spawnattr_setmacpolicyinfo_np
 _posix_spawnattr_setpcontrol_np
 _posix_spawnattr_setpgroup
@@ -822,7 +698,6 @@ _posix_spawnattr_setsigmask
 _posix_spawnattr_setspecialport_np
 _pread
 _pread$NOCANCEL
-_proc_clear_cpulimits
 _proc_clear_delayidlesleep
 _proc_clear_dirty
 _proc_clear_vmpressure
@@ -840,10 +715,8 @@ _proc_importance_assertion_begin_with_msg
 _proc_importance_assertion_complete
 _proc_kmsgbuf
 _proc_libversion
-_proc_list_uptrs
 _proc_listallpids
 _proc_listchildpids
-_proc_listcoalitions
 _proc_listpgrppids
 _proc_listpids
 _proc_listpidspath
@@ -855,7 +728,6 @@ _proc_pidinfo
 _proc_pidoriginatorinfo
 _proc_pidpath
 _proc_regionfilename
-_proc_resume_cpumon
 _proc_rlimit_control
 _proc_set_cpumon_defaults
 _proc_set_cpumon_params
@@ -865,7 +737,6 @@ _proc_set_dirty
 _proc_set_owner_vmpressure
 _proc_set_wakemon_defaults
 _proc_set_wakemon_params
-_proc_setcpu_percentage
 _proc_setpcontrol
 _proc_setthread_cpupercent
 _proc_suppress
@@ -919,8 +790,6 @@ _removexattr
 _rename
 _rename_ext
 _renameat
-_renameatx_np
-_renamex_np
 _revoke
 _rmdir
 _searchfs
@@ -1007,16 +876,6 @@ _sigsuspend$NOCANCEL
 _socket
 _socket_delegate
 _socketpair
-_stackshot_capture_with_config
-_stackshot_config_create
-_stackshot_config_dealloc
-_stackshot_config_dealloc_buffer
-_stackshot_config_get_stackshot_buffer
-_stackshot_config_get_stackshot_size
-_stackshot_config_set_delta_timestamp
-_stackshot_config_set_flags
-_stackshot_config_set_pid
-_stackshot_config_set_size_hint
 _stat
 _stat$INODE64
 _stat64
@@ -1038,26 +897,18 @@ _task_assign
 _task_assign_default
 _task_create
 _task_for_pid
-_task_generate_corpse
 _task_get_assignment
-_task_get_dyld_image_infos
 _task_get_emulation_vector
 _task_get_exception_ports
 _task_get_mach_voucher
 _task_get_special_port
 _task_get_state
 _task_info
-_task_map_corpse_info
-_task_map_corpse_info_64
 _task_name_for_pid
 _task_policy
 _task_policy_get
 _task_policy_set
 _task_purgable_info
-_task_register_dyld_get_process_state
-_task_register_dyld_image_infos
-_task_register_dyld_set_dyld_state
-_task_register_dyld_shared_cache_image_info
 _task_resume
 _task_resume2
 _task_sample
@@ -1080,10 +931,7 @@ _task_swap_exception_ports
 _task_swap_mach_voucher
 _task_terminate
 _task_threads
-_task_unregister_dyld_image_infos
 _task_zone_info
-_terminate_with_payload
-_terminate_with_reason
 _thread_abort
 _thread_abort_safely
 _thread_assign
@@ -1094,7 +942,6 @@ _thread_depress_abort
 _thread_get_assignment
 _thread_get_exception_ports
 _thread_get_mach_voucher
-_thread_get_register_pointer_values
 _thread_get_special_port
 _thread_get_state
 _thread_info
@@ -1121,7 +968,6 @@ _undelete
 _unlink
 _unlinkat
 _unmount
-_usrctl
 _utimes
 _vfork
 _vfs_purge
@@ -1162,10 +1008,6 @@ _waitevent
 _waitid
 _waitid$NOCANCEL
 _watchevent
-_work_interval_create
-_work_interval_destroy
-_work_interval_notify
-_work_interval_notify_simple
 _write
 _write$NOCANCEL
 _writev
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
deleted file mode 100644
index e04142b8b11e..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ /dev/null
@@ -1,116 +0,0 @@
-{ appleDerivation }:
-
-appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
-  __propagatedImpureHostDeps = [
-    "/System/Library/Frameworks/Security.framework/Security"
-    "/System/Library/Frameworks/Security.framework/Resources"
-    "/System/Library/Frameworks/Security.framework/PlugIns"
-    "/System/Library/Frameworks/Security.framework/XPCServices"
-    "/System/Library/Frameworks/Security.framework/Versions"
-  ];
-
-  installPhase = ''
-    ###### IMPURITIES
-    mkdir -p $out/Library/Frameworks/Security.framework
-    pushd $out/Library/Frameworks/Security.framework
-    ln -s /System/Library/Frameworks/Security.framework/Security
-    ln -s /System/Library/Frameworks/Security.framework/Resources
-    ln -s /System/Library/Frameworks/Security.framework/PlugIns
-    ln -s /System/Library/Frameworks/Security.framework/XPCServices
-    popd
-
-    ###### HEADERS
-
-    export dest=$out/Library/Frameworks/Security.framework/Headers
-    mkdir -p $dest
-
-    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
-    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
-    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
-    cp libsecurity_asn1/lib/oidsalg.h          $dest
-    cp libsecurity_asn1/lib/oidsattr.h         $dest
-
-    cp libsecurity_authorization/lib/AuthSession.h         $dest
-    cp libsecurity_authorization/lib/Authorization.h       $dest
-    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
-    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
-    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
-
-    cp libsecurity_cms/lib/CMSDecoder.h $dest
-    cp libsecurity_cms/lib/CMSEncoder.h $dest
-
-    cp libsecurity_codesigning/lib/CSCommon.h       $dest
-    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
-    cp libsecurity_codesigning/lib/SecCode.h        $dest
-    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
-    cp libsecurity_codesigning/lib/SecRequirement.h $dest
-    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
-    cp libsecurity_codesigning/lib/SecTask.h        $dest
-
-    cp libsecurity_cssm/lib/certextensions.h $dest
-    cp libsecurity_cssm/lib/cssm.h           $dest
-    cp libsecurity_cssm/lib/cssmaci.h        $dest
-    cp libsecurity_cssm/lib/cssmapi.h        $dest
-    cp libsecurity_cssm/lib/cssmapple.h      $dest
-    cp libsecurity_cssm/lib/cssmcli.h        $dest
-    cp libsecurity_cssm/lib/cssmconfig.h     $dest
-    cp libsecurity_cssm/lib/cssmcspi.h       $dest
-    cp libsecurity_cssm/lib/cssmdli.h        $dest
-    cp libsecurity_cssm/lib/cssmerr.h        $dest
-    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
-    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
-    cp libsecurity_cssm/lib/cssmspi.h        $dest
-    cp libsecurity_cssm/lib/cssmtpi.h        $dest
-    cp libsecurity_cssm/lib/cssmtype.h       $dest
-    cp libsecurity_cssm/lib/eisl.h           $dest
-    cp libsecurity_cssm/lib/emmspi.h         $dest
-    cp libsecurity_cssm/lib/emmtype.h        $dest
-    cp libsecurity_cssm/lib/oidsbase.h       $dest
-    cp libsecurity_cssm/lib/oidscert.h       $dest
-    cp libsecurity_cssm/lib/oidscrl.h        $dest
-    cp libsecurity_cssm/lib/x509defs.h       $dest
-
-    cp libsecurity_keychain/lib/SecACL.h                $dest
-    cp libsecurity_keychain/lib/SecAccess.h             $dest
-    cp libsecurity_keychain/lib/SecBase.h               $dest
-    cp libsecurity_keychain/lib/SecCertificate.h        $dest
-    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
-    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
-    cp libsecurity_keychain/lib/SecIdentity.h           $dest
-    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
-    cp libsecurity_keychain/lib/SecImportExport.h       $dest
-    cp libsecurity_keychain/lib/SecItem.h               $dest
-    cp libsecurity_keychain/lib/SecKey.h                $dest
-    cp libsecurity_keychain/lib/SecKeychain.h           $dest
-    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
-    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
-    cp libsecurity_keychain/lib/SecPolicy.h             $dest
-    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
-    cp libsecurity_keychain/lib/SecRandom.h             $dest
-    cp libsecurity_keychain/lib/SecTrust.h              $dest
-    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
-    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
-    cp libsecurity_keychain/lib/Security.h              $dest
-
-    cp libsecurity_manifest/lib/SecureDownload.h $dest
-
-    cp libsecurity_mds/lib/mds.h        $dest
-    cp libsecurity_mds/lib/mds_schema.h $dest
-
-    cp libsecurity_ssl/lib/CipherSuite.h     $dest
-    cp libsecurity_ssl/lib/SecureTransport.h $dest
-
-    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
-    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
-    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
-    cp libsecurity_transform/lib/SecReadTransform.h          $dest
-    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
-    cp libsecurity_transform/lib/SecTransform.h              $dest
-    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
-
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
index be744fa88736..e04142b8b11e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -1,19 +1,116 @@
-{ stdenv, appleDerivation, xcbuildHook, Foundation, xpc, darling, dtrace, xnu }:
+{ appleDerivation }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook dtrace ];
-  # buildInputs = [ Foundation xpc darling ];
-  buildInputs = [ xpc xnu ];
+  phases = [ "unpackPhase" "installPhase" ];
 
-  xcbuildFlags = "-target Security_frameworks_osx";
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
 
-  # NIX_CFLAGS_COMPILE = "-Wno-error -I${xnu}/include/libkern -DPRIVATE -I${xnu}/Library/Frameworks/System.framework/Headers";
+  installPhase = ''
+    ###### IMPURITIES
+    mkdir -p $out/Library/Frameworks/Security.framework
+    pushd $out/Library/Frameworks/Security.framework
+    ln -s /System/Library/Frameworks/Security.framework/Security
+    ln -s /System/Library/Frameworks/Security.framework/Resources
+    ln -s /System/Library/Frameworks/Security.framework/PlugIns
+    ln -s /System/Library/Frameworks/Security.framework/XPCServices
+    popd
 
-  preBuild = ''
-    dtrace -h -C -s OSX/libsecurity_utilities/lib/security_utilities.d -o OSX/libsecurity_utilities/lib/utilities_dtrace.h
+    ###### HEADERS
+
+    export dest=$out/Library/Frameworks/Security.framework/Headers
+    mkdir -p $dest
+
+    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
+    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
+    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
+    cp libsecurity_asn1/lib/oidsalg.h          $dest
+    cp libsecurity_asn1/lib/oidsattr.h         $dest
+
+    cp libsecurity_authorization/lib/AuthSession.h         $dest
+    cp libsecurity_authorization/lib/Authorization.h       $dest
+    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
+    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
+    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
+
+    cp libsecurity_cms/lib/CMSDecoder.h $dest
+    cp libsecurity_cms/lib/CMSEncoder.h $dest
+
+    cp libsecurity_codesigning/lib/CSCommon.h       $dest
+    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
+    cp libsecurity_codesigning/lib/SecCode.h        $dest
+    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
+    cp libsecurity_codesigning/lib/SecRequirement.h $dest
+    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
+    cp libsecurity_codesigning/lib/SecTask.h        $dest
+
+    cp libsecurity_cssm/lib/certextensions.h $dest
+    cp libsecurity_cssm/lib/cssm.h           $dest
+    cp libsecurity_cssm/lib/cssmaci.h        $dest
+    cp libsecurity_cssm/lib/cssmapi.h        $dest
+    cp libsecurity_cssm/lib/cssmapple.h      $dest
+    cp libsecurity_cssm/lib/cssmcli.h        $dest
+    cp libsecurity_cssm/lib/cssmconfig.h     $dest
+    cp libsecurity_cssm/lib/cssmcspi.h       $dest
+    cp libsecurity_cssm/lib/cssmdli.h        $dest
+    cp libsecurity_cssm/lib/cssmerr.h        $dest
+    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
+    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
+    cp libsecurity_cssm/lib/cssmspi.h        $dest
+    cp libsecurity_cssm/lib/cssmtpi.h        $dest
+    cp libsecurity_cssm/lib/cssmtype.h       $dest
+    cp libsecurity_cssm/lib/eisl.h           $dest
+    cp libsecurity_cssm/lib/emmspi.h         $dest
+    cp libsecurity_cssm/lib/emmtype.h        $dest
+    cp libsecurity_cssm/lib/oidsbase.h       $dest
+    cp libsecurity_cssm/lib/oidscert.h       $dest
+    cp libsecurity_cssm/lib/oidscrl.h        $dest
+    cp libsecurity_cssm/lib/x509defs.h       $dest
+
+    cp libsecurity_keychain/lib/SecACL.h                $dest
+    cp libsecurity_keychain/lib/SecAccess.h             $dest
+    cp libsecurity_keychain/lib/SecBase.h               $dest
+    cp libsecurity_keychain/lib/SecCertificate.h        $dest
+    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
+    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
+    cp libsecurity_keychain/lib/SecIdentity.h           $dest
+    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
+    cp libsecurity_keychain/lib/SecImportExport.h       $dest
+    cp libsecurity_keychain/lib/SecItem.h               $dest
+    cp libsecurity_keychain/lib/SecKey.h                $dest
+    cp libsecurity_keychain/lib/SecKeychain.h           $dest
+    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
+    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
+    cp libsecurity_keychain/lib/SecPolicy.h             $dest
+    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
+    cp libsecurity_keychain/lib/SecRandom.h             $dest
+    cp libsecurity_keychain/lib/SecTrust.h              $dest
+    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
+    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
+    cp libsecurity_keychain/lib/Security.h              $dest
+
+    cp libsecurity_manifest/lib/SecureDownload.h $dest
+
+    cp libsecurity_mds/lib/mds.h        $dest
+    cp libsecurity_mds/lib/mds_schema.h $dest
+
+    cp libsecurity_ssl/lib/CipherSuite.h     $dest
+    cp libsecurity_ssl/lib/SecureTransport.h $dest
+
+    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
+    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
+    cp libsecurity_transform/lib/SecReadTransform.h          $dest
+    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
+    cp libsecurity_transform/lib/SecTransform.h              $dest
+    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
 
-    xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target copyHeadersToSystem
-    NIX_CFLAGS_COMPILE+=" -F./Products/Release"
-    ln -s $PWD/Products/Release/Security.bundle/Contents $PWD/Products/Release/Security.framework
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
new file mode 100644
index 000000000000..6e9003350780
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, appleDerivation, xcbuildHook, gnumake, Security
+, libsecurity_utilities, libsecurity_cdsa_utilities }:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities ];
+
+  DSTROOT = "$out";
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  preBuild = ''
+    mkdir -p Security
+    cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
+  '';
+
+  patchPhase = ''
+    substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
+      --replace "/usr/bin/gnumake" "${gnumake}/bin/make"
+    substituteInPlace src/PCSC/PCSC.exp \
+      --replace _PCSCVersionString "" \
+      --replace _PCSCVersionNumber ""
+    substituteInPlace Makefile.installPhase \
+      --replace chown "# chown" \
+      --replace /usr/bin/ ""
+  '';
+
+  installPhase = ''
+    make -f Makefile.installPhase install
+    make -f Makefile-exec.installPhase install
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir -p $out/Library/Frameworks
+    cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
deleted file mode 100644
index 318e2728fc2e..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
-}:
-
-# this derivation sucks
-# locale data was removed after adv_cmds-118, so our base is that because it's easier than
-# replicating the bizarre bsdmake file structure
-#
-# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
-# longer understand
-#
-# the more recent adv_cmds release is used for everything else in this package
-
-let recentAdvCmds = fetchzip {
-  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
-  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
-};
-
-in appleDerivation {
-  nativeBuildInputs = [ bsdmake perl yacc flex ];
-  buildInputs = [ flex ];
-
-  patchPhase = ''
-    substituteInPlace BSDmakefile \
-      --replace chgrp true \
-      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
-      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
-      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
-      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
-
-    substituteInPlace Makefile --replace perl true
-
-    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
-      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
-        --replace /usr/share/locale "" \
-        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
-        --replace "rsync -a" "cp -r"
-    done
-  '';
-
-  preBuild = ''
-    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
-    pushd colldef
-    mv locale/collate.h .
-    flex -t -8 -i scan.l > scan.c
-    yacc -d parse.y
-    clang *.c -o colldef -lfl
-    popd
-    mv colldef/colldef colldef.tproj/colldef
-
-    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
-    pushd mklocale
-    flex -t -8 -i lex.l > lex.c
-    yacc -d yacc.y
-    clang *.c -o mklocale -lfl
-    popd
-    mv mklocale/mklocale mklocale.tproj/mklocale
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    bsdmake -C usr-share-locale.tproj
-
-    clang ${recentAdvCmds}/ps/*.c -o ps
-  '';
-
-  installPhase = ''
-    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
-
-    # need to get rid of runtime dependency on flex
-    # install -d 0755 $locale/bin
-    # install -m 0755 colldef.tproj/colldef $locale/bin
-    # install -m 0755 mklocale.tproj/mklocale $locale/bin
-
-    install -d 0755 $ps/bin
-    install ps $ps/bin/ps
-    touch "$out"
-  '';
-
-  outputs = [
-    "out"
-    "ps"
-    "locale"
-  ];
-  setOutputFlags = false;
-
-  meta = {
-    platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index ba80ab923bd4..a3b12d73a115 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -1,36 +1,69 @@
-{ stdenv, appleDerivation, xcbuild, ncurses, libutil }:
+{ stdenv, appleDerivation, fetchzip, bsdmake, perl, flex, yacc
+}:
 
-appleDerivation {
-  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
+# this derivation sucks
+# locale data was removed after adv_cmds-118, so our base is that because it's easier than
+# replicating the bizarre bsdmake file structure
+#
+# sadly adv_cmds-118 builds a mklocale and colldef that generate files that our libc can no
+# longer understand
+#
+# the more recent adv_cmds release is used for everything else in this package
 
-  # pkill requires special private headers that are unavailable in
-  # NixPkgs. These ones are needed:
-  #  - xpc/xpxc.h
-  #  - os/base_private.h
-  #  - _simple.h
-  # We disable it here for now. TODO: build pkill inside adv_cmds
+let recentAdvCmds = fetchzip {
+  url = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-158.tar.gz";
+  sha256 = "0z081kcprzg5jcvqivfnwvvv6wfxzkjg2jc2lagsf8c7j7vgm8nn";
+};
+
+in appleDerivation {
+  nativeBuildInputs = [ bsdmake perl yacc flex ];
+  buildInputs = [ flex ];
 
-  # We also disable locale here because of some issues with a missing
-  # "lstdc++".
   patchPhase = ''
-    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
-      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
-      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
-      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
-  '';
+    substituteInPlace BSDmakefile \
+      --replace chgrp true \
+      --replace /Developer/Makefiles/bin/compress-man-pages.pl true \
+      --replace "ps.tproj" "" --replace "gencat.tproj" "" --replace "md.tproj" "" \
+      --replace "tabs.tproj" "" --replace "cap_mkdb.tproj" "" \
+      --replace "!= tconf --test TARGET_OS_EMBEDDED" "= NO"
 
-  buildPhase = ''
-    targets=$(xcodebuild -list \
-                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
-                | tail -n +2 | sed 's/^[ \t]*//' \
-                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
+    substituteInPlace Makefile --replace perl true
 
-    for i in $targets; do
-      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
+    for subproject in colldef mklocale monetdef msgdef numericdef timedef; do
+      substituteInPlace usr-share-locale.tproj/$subproject/BSDmakefile \
+        --replace /usr/share/locale "" \
+        --replace '-o ''${BINOWN} -g ''${BINGRP}' "" \
+        --replace "rsync -a" "cp -r"
     done
   '';
 
-  # temporary install phase until xcodebuild has "install" support
+  preBuild = ''
+    cp -r --no-preserve=all ${recentAdvCmds}/colldef .
+    pushd colldef
+    mv locale/collate.h .
+    flex -t -8 -i scan.l > scan.c
+    yacc -d parse.y
+    clang *.c -o colldef -lfl
+    popd
+    mv colldef/colldef colldef.tproj/colldef
+
+    cp -r --no-preserve=all ${recentAdvCmds}/mklocale .
+    pushd mklocale
+    flex -t -8 -i lex.l > lex.c
+    yacc -d yacc.y
+    clang *.c -o mklocale -lfl
+    popd
+    mv mklocale/mklocale mklocale.tproj/mklocale
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    bsdmake -C usr-share-locale.tproj
+
+    clang ${recentAdvCmds}/ps/*.c -o ps
+  '';
+
   installPhase = ''
     for f in Products/Release/*; do
       if [ -f $f ]; then
@@ -43,19 +76,27 @@ appleDerivation {
       install */*.$n $out/share/man/man$n
     done
 
-    mkdir -p $out/System/Library/LaunchDaemons
-    install fingerd/finger.plist $out/System/Library/LaunchDaemons
+    bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
 
-    # from variant_links.sh
-    # ln -s $out/bin/pkill $out/bin/pgrep
-    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
+    # need to get rid of runtime dependency on flex
+    # install -d 0755 $locale/bin
+    # install -m 0755 colldef.tproj/colldef $locale/bin
+    # install -m 0755 mklocale.tproj/mklocale $locale/bin
+
+    install -d 0755 $ps/bin
+    install ps $ps/bin/ps
+    touch "$out"
   '';
 
-  nativeBuildInputs = [ xcbuild ];
-  buildInputs = [ ncurses libutil ];
+  outputs = [
+    "out"
+    "ps"
+    "locale"
+  ];
+  setOutputFlags = false;
 
   meta = {
     platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
new file mode 100644
index 000000000000..7b1492799ddb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
@@ -0,0 +1,58 @@
+{ stdenv, appleDerivation, xcbuild, ncurses, libutil-new }:
+
+appleDerivation {
+  # We can't just run the root build, because https://github.com/facebook/xcbuild/issues/264
+
+  # pkill requires special private headers that are unavailable in
+  # NixPkgs. These ones are needed:
+  #  - xpc/xpxc.h
+  #  - os/base_private.h
+  #  - _simple.h
+  # We disable it here for now. TODO: build pkill inside adv_cmds
+
+  # We also disable locale here because of some issues with a missing
+  # "lstdc++".
+  patchPhase = ''
+    substituteInPlace adv_cmds.xcodeproj/project.pbxproj \
+      --replace "FD201DC214369B4200906237 /* pkill.c in Sources */," "" \
+      --replace "FDF278D60FC6204E00D7A3C6 /* locale.cc in Sources */," "" \
+      --replace '/usr/lib/libtermcap.dylib' 'libncurses.dylib'
+  '';
+
+  buildPhase = ''
+    targets=$(xcodebuild -list \
+                | awk '/Targets:/{p=1;print;next} p&&/^\s*$/{p=0};p' \
+                | tail -n +2 | sed 's/^[ \t]*//' \
+                | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
+
+    for i in $targets; do
+      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
+    done
+  '';
+
+  # temporary install phase until xcodebuild has "install" support
+  installPhase = ''
+    mkdir -p $out/bin/
+    install Products/Release/* $out/bin/
+
+    for n in 1 8; do
+      mkdir -p $out/share/man/man$n
+      install */*.$n $out/share/man/man$n
+    done
+
+    mkdir -p $out/System/Library/LaunchDaemons
+    install fingerd/finger.plist $out/System/Library/LaunchDaemons
+
+    # from variant_links.sh
+    # ln -s $out/bin/pkill $out/bin/pgrep
+    # ln -s $out/share/man/man1/pkill.1 $out/share/man/man1/pgrep.1
+  '';
+
+  nativeBuildInputs = [ xcbuild ];
+  buildInputs = [ ncurses libutil-new ];
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
index 256781f61b11..591e7bd52303 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
@@ -32,7 +32,6 @@ appleDerivation {
     chmod +x mig.sh
     cp mig.sh   $out/bin/mig
     cp migcom   $out/libexec
-    ln -s $out/libexec/migcom $out/bin/migcom
     cp mig.1    $out/share/man/man1
     cp migcom.1 $out/share/man/man1
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index a1440c937092..4fa0c0e3e47f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -6,31 +6,9 @@ let
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
   # now it's staying here.
   versions = {
-    "osx-10.12.6" = {
-      xnu           = "3789.70.16";
-      libiconv      = "50";
-      Libnotify     = "165.20.1";
-      objc4         = "709.1";
-      dyld          = "433.5";
-      CommonCrypto  = "60092.50.5";
-      copyfile      = "138";
-      ppp           = "838.50.1";
-      libclosure    = "67";
-      Libinfo       = "503.50.4";
-      Libsystem     = "1238.60.2";
-      removefile    = "45";
-      libresolv     = "64";
-      libplatform   = "126.50.8";
-      mDNSResponder = "765.50.9";
-      libutil       = "47.30.1";
-      libunwind     = "35.3";
-      Libc          = "1158.50.2";
-      dtrace        = "209.50.12";
-      libpthread    = "218.60.3";
-      hfs           = "366.70.1";
-    };
     "osx-10.11.6" = {
       PowerManagement = "572.50.1";
+      SmartCardServices = "55111";
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
@@ -80,6 +58,7 @@ let
       ICU           = "531.48";
       libdispatch   = "442.1.4";
       Security      = "57031.40.6";
+      security_systemkeychain = "55202";
 
       IOAudioFamily                        = "203.3";
       IOFireWireFamily                     = "458";
@@ -115,6 +94,28 @@ let
     "osx-10.8.4" = {
       IOUSBFamily = "560.4.2";
     };
+    "osx-10.7.5" = {
+      libsecurity_apple_csp      = "55003";
+      libsecurity_apple_cspdl    = "55000";
+      libsecurity_apple_file_dl  = "55000";
+      libsecurity_apple_x509_cl  = "55004";
+      libsecurity_apple_x509_tp  = "55009.3";
+      libsecurity_asn1           = "55000.2";
+      libsecurity_cdsa_client    = "55000";
+      libsecurity_cdsa_plugin    = "55001";
+      libsecurity_cdsa_utilities = "55006";
+      libsecurity_cdsa_utils     = "55000";
+      libsecurity_codesigning    = "55037.15";
+      libsecurity_cssm           = "55005.5";
+      libsecurity_filedb         = "55016.1";
+      libsecurity_keychain       = "55050.9";
+      libsecurity_mds            = "55000";
+      libsecurity_ocspd          = "55010";
+      libsecurity_pkcs12         = "55000";
+      libsecurity_sd_cspdl       = "55003";
+      libsecurity_utilities      = "55030.3";
+      libsecurityd               = "55004";
+    };
     "osx-10.7.4" = {
       Libm = "2026";
     };
@@ -165,6 +166,10 @@ let
       callPackage = pkgs.newScope (packages // pkgs.darwin // { inherit appleDerivation name version; });
     in callPackage (./. + "/${namePath}");
 
+  libsecPackage = pkgs.callPackage ./libsecurity_generic {
+    inherit applePackage appleDerivation_;
+  };
+
   IOKitSpecs = {
     IOAudioFamily                        = fetchApple "osx-10.10.5" "0ggq7za3iq8g02j16rj67prqhrw828jsw3ah3bxq8a1cvr55aqnq";
     IOFireWireFamily                     = fetchApple "osx-10.10.5" "059qa1m668kwvchl90cqcx35b31zaqdg61zi11y1imn5s389y2g1";
@@ -189,58 +194,60 @@ let
 
   IOKitSrcs = stdenv.lib.mapAttrs (name: value: if stdenv.lib.isFunction value then value name else value) IOKitSpecs;
 
-  # Only used for bootstrapping. It’s convenient because it was the last version to come with a real makefile.
-  adv_cmds-boot = applePackage "adv_cmds/boot.nix" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
+  adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
 
   packages = {
-    inherit (adv_cmds-boot) ps locale;
+    SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
+
+    inherit (adv_cmds) ps locale;
     architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
     bootstrap_cmds  = applePackage "bootstrap_cmds"    "dev-tools-7.0"   "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
     bsdmake         = applePackage "bsdmake"           "dev-tools-3.2.6" "11a9kkhz5bfgi1i8kpdkis78lhc6b5vxmhd598fcdgra1jw4iac2" {};
     CarbonHeaders   = applePackage "CarbonHeaders"     "osx-10.6.2"      "1zam29847cxr6y9rnl76zqmkbac53nx0szmqm9w5p469a6wzjqar" {};
-    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.12.6"     "0sgsqjcxbdm2g2zfpc50mzmk4b4ldyw7xvvkwiayhpczg1fga4ff" {};
-    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {
-      Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
-    };
-    copyfile        = applePackage "copyfile"          "osx-10.12.6"     "0a70bvzndkava1a946cdq42lnjhg7i7b5alpii3lap6r5fkvas0n" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "osx-10.11.6"     "0vllfpb8f4f97wj2vpdd7w5k9ibnsbr6ff1zslpp6q323h01n25y" {};
+    configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
+    copyfile        = applePackage "copyfile"          "osx-10.11.6"     "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.12.6"     "0hpd6348av463yqf70n3xkygwmf1i5zza8kps4zys52sviqz3a0l" {};
-    dyld            = applePackage "dyld"              "osx-10.12.6"     "0q4jmk78b5ajn33blh4agyq6v2a63lpb3fln78az0dy12bnp1qqk" {};
+    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dtrace-xcode    = applePackage "dtrace/xcode.nix"  "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
+
+    # Splicing is currently broken in Nixpkgs
+    # cctools need to be specified manually here to handle this
     ICU             = applePackage "ICU"               "osx-10.10.5"     "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
+
     IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
     launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
     libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
-    Libc            = applePackage "Libc"              "osx-10.12.6"     "183wcy1nlj2wkpfsx3k3lyv917mk8r2p72qw8lb89mbjsw3yw0xx" {
+    Libc            = applePackage "Libc"              "osx-10.11.5"     "1qv7r0dgz06jy9i5agbqzxgdibb0m8ylki6g5n5pary88lzrawfd" {
       Libc_10-9 = fetchzip {
         url    = "http://www.opensource.apple.com/tarballs/Libc/Libc-997.90.3.tar.gz";
         sha256 = "1xchgxkxg5288r2b9yfrqji2gsgdap92k4wx2dbjwslixws12pq7";
       };
-      Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     };
+    Libc_old        = applePackage "Libc/825_40_1.nix" "osx-10.8.5"      "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
     libclosure      = applePackage "libclosure"        "osx-10.11.6"     "1zqy1zvra46cmqv6vsf1mcsz3a76r9bky145phfwh4ab6y15vjpq" {};
     libdispatch     = applePackage "libdispatch"       "osx-10.10.5"     "0jsfbzp87lwk9snlby0hd4zvj7j894p5q3cw0wdx9ny1mcp3kdcj" {};
-    libiconv        = applePackage "libiconv"          "osx-10.12.6"     "1gg5h6z8sk851bhv87vyxzs54jmqz6lh57ny8j4s51j7srja0nly" {};
+    libiconv        = applePackage "libiconv"          "osx-10.11.6"     "11h6lfajydri4widis62q8scyz7z8l6msqyx40ly4ahsdlbl0981" {};
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "0p5qhvalf6j1w6n8xwywhn6dvbpzv74q5wqrgs8rwfpf74wg6s9z" {};
-    libplatform     = applePackage "libplatform"       "osx-10.12.6"     "0rh1f5ybvwz8s0nwfar8s0fh7jbgwqcy903cv2x8m15iq1x599yn" {};
-    libpthread      = applePackage "libpthread"        "osx-10.12.6"     "1j6541rcgjpas1fc77ip5krjgw4bvz6jq7bq7h9q7axb0jv2ns6c" {};
-    libresolv       = applePackage "libresolv"         "osx-10.12.6"     "077j6ljfh7amqpk2146rr7dsz5vasvr3als830mgv5jzl7l6vz88" {};
-    Libsystem       = applePackage "Libsystem"         "osx-10.12.6"     "1082ircc1ggaq3wha218vmfa75jqdaqidsy1bmrc4ckfkbr3bwx2" {
-      libutil = pkgs.darwin.libutil.override { headersOnly = true; };
-      hfs = pkgs.darwin.hfs.override { headersOnly = true; };
-    };
-    libutil         = applePackage "libutil"           "osx-10.12.6"     "0lqdxaj82h8yjbjm856jjz9k2d96k0viimi881akfng08xk1246y" {};
-    libunwind       = applePackage "libunwind"         "osx-10.12.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
-    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.12.6"     "02ms1p8zlgmprzn65jzr7yaqxykh3zxjcrw0c06aayim6h0dsqfy" {};
-    objc4           = applePackage "objc4"             "osx-10.12.6"     "1cj1vhbcs9pkmag2ms8wslagicnq9bxi2qjkszmp3ys7z7ccrbwz" {};
-    ppp             = applePackage "ppp"               "osx-10.12.6"     "1kcc2nc4x1kf8sz0a23i6nfpvxg381kipi0qdisrp8x9z2gbkxb8" {};
-    removefile      = applePackage "removefile"        "osx-10.12.6"     "0jzjxbmxgjzhssqd50z7kq9dlwrv5fsdshh57c0f8mdwcs19bsyx" {};
-    xnu             = applePackage "xnu"               "osx-10.12.6"     "1sjb0i7qzz840v2h4z3s4jyjisad4r5yyi6sg8pakv3wd81i5fg5" {};
-    hfs             = applePackage "hfs"               "osx-10.12.6"     "1mj3xvqpq1mgd80b6kl1s04knqnap7hccr0gz8rjphalq14rbl5g" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.11.6"     "0zbcyxlcfhf91jxczhd5bq9qfgvg494gwwp3l7q5ayb2qdihzr8b" {};
+    libplatform     = applePackage "libplatform"       "osx-10.11.6"     "1v4ik6vlklwsi0xb1g5kmhy29j9xk5m2y8xb9zbi1k4ng8x39czk" {};
+    libpthread      = applePackage "libpthread"        "osx-10.11.6"     "1kbw738cmr9pa7pz1igmajs307clfq7gv2vm1sqdzhcnnjxbl28w" {};
+    libresolv       = applePackage "libresolv"         "osx-10.11.6"     "09flfdi3dlzq0yap32sxidacpc4nn4va7z12a6viip21ix2xb2gf" {};
+    Libsystem       = applePackage "Libsystem"         "osx-10.11.6"     "1nfkmbqml587v2s1d1y2s2v8nmr577jvk51y6vqrfvsrhdhc2w94" {};
+    libutil         = applePackage "libutil"           "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
+    libutil-new     = applePackage "libutil/new.nix"   "osx-10.11.6"     "1gmgmcyqdyc684ih7dimdmxdljnq7mzjy5iqbf589wc0pa8h5abm" {};
+    libunwind       = applePackage "libunwind"         "osx-10.11.6"     "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "osx-10.11.6"     "069incq28a78yh1bnr17h9cd5if5mwqpq8ahnkyxxx25fkaxgzcf" {};
+    objc4           = applePackage "objc4"             "osx-10.11.6"     "00b7vbgxni8frrqyi69b4njjihlwydzjd9zj9x4z5dbx8jabkvrj" {};
+    ppp             = applePackage "ppp"               "osx-10.11.6"     "1dql6r1v0vbcs04958nn2i6p31yfsxyy51jca63bm5mf0gxalk3f" {};
+    removefile      = applePackage "removefile"        "osx-10.11.6"     "1b6r74ry3k01kypvlaclf33fha15pcm0kzx9zrymlg66wg0s0i3r" {};
+    Security        = applePackage "Security"          "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    xnu             = applePackage "xnu"               "osx-10.11.6"     "0yhziq4dqqcbjpf6vyqn8xhwva2zb525gndkx8cp8alzwp76jnr9" {};
     Librpcsvc       = applePackage "Librpcsvc"         "osx-10.11.6"     "1zwfwcl9irxl1dlnf2b4v30vdybp0p0r6n6g1pd14zbdci1jcg2k" {};
-    adv_cmds        = applePackage "adv_cmds"          "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
+    adv_cmds        = applePackage "adv_cmds/xcode.nix" "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
     diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
@@ -252,8 +259,28 @@ let
     top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
     PowerManagement = applePackage "PowerManagement"   "osx-10.11.6"     "1llimhvp0gjffd47322lnjq7cqwinx0c5z7ikli04ad5srpa68mh" {};
 
-    # TODO(matthewbauer):
-    # To be removed, once I figure out how to build a newer Security version.
-    Security      = applePackage "Security/boot.nix" "osx-10.9.5"      "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
+
+    libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
+    libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
+    libsecurity_apple_file_dl  = libsecPackage "libsecurity_apple_file_dl"  "osx-10.7.5" "1dfqani3n135i3iqmafc1k9awmz6s0a78zifhk15rx5a8ps870bl" {};
+    libsecurity_apple_x509_cl  = libsecPackage "libsecurity_apple_x509_cl"  "osx-10.7.5" "1gji2i080560s08k1nigsla1zdmi6slyv97xaj5vqxjpxb0g1xf5" {};
+    libsecurity_apple_x509_tp  = libsecPackage "libsecurity_apple_x509_tp"  "osx-10.7.5" "1bsms3nvi62wbvjviwjhjhzhylad8g6vmvlj3ngd0wyd0ywxrs46" {};
+    libsecurity_asn1           = libsecPackage "libsecurity_asn1"           "osx-10.7.5" "0i8aakjxdfj0lqcgqmbip32g7r4h57xhs8w0sxfvfl45q22s782w" {};
+    libsecurity_cdsa_client    = libsecPackage "libsecurity_cdsa_client"    "osx-10.7.5" "127jxnypkycy8zqwicfv333h11318m00gd37jnswbrpg44xd1wdy" {};
+    libsecurity_cdsa_plugin    = libsecPackage "libsecurity_cdsa_plugin"    "osx-10.7.5" "0ifmx85rs51i7zjm015s8kc2dqyrlvbr39lw9xzxgd2ds33i4lfj" {};
+    libsecurity_cdsa_utilities = libsecPackage "libsecurity_cdsa_utilities" "osx-10.7.5" "1kzsl0prvfa8a0m3j3pcxq06aix1csgayd3lzx27iqg84c8mhzan" {};
+    libsecurity_cdsa_utils     = libsecPackage "libsecurity_cdsa_utils"     "osx-10.7.5" "0q55jizav6n0lkj7lcmcr2mjdhnbnnn525fa9ipwgvzbspihw0g6" {};
+    libsecurity_codesigning    = libsecPackage "libsecurity_codesigning"    "osx-10.7.5" "0vf5nj2g383b4hknlp51qll5pm8z4qbf56dnc16n3wm8gj82iasy" {};
+    libsecurity_cssm           = libsecPackage "libsecurity_cssm"           "osx-10.7.5" "0l6ia533bhr8kqp2wa712bnzzzisif3kbn7h3bzzf4nps4wmwzn4" {};
+    libsecurity_filedb         = libsecPackage "libsecurity_filedb"         "osx-10.7.5" "1r0ik95xapdl6l2lhd079vpq41jjgshz2hqb8490gpy5wyc49cxb" {};
+    libsecurity_keychain       = libsecPackage "libsecurity_keychain"       "osx-10.7.5" "15wf2slcgyns61kk7jndgm9h22vidyphh9x15x8viyprra9bkhja" {};
+    libsecurity_mds            = libsecPackage "libsecurity_mds"            "osx-10.7.5" "0vin5hnzvkx2rdzaaj2gxmx38amxlyh6j24a8gc22y09d74p5lzs" {};
+    libsecurity_ocspd          = libsecPackage "libsecurity_ocspd"          "osx-10.7.5" "1bxzpihc6w0ji4x8810a4lfkq83787yhjl60xm24bv1prhqcm73b" {};
+    libsecurity_pkcs12         = libsecPackage "libsecurity_pkcs12"         "osx-10.7.5" "1yq8p2sp39q40fxshb256b7jn9lvmpymgpm8yz9kqrf980xddgsg" {};
+    libsecurity_sd_cspdl       = libsecPackage "libsecurity_sd_cspdl"       "osx-10.7.5" "10v76xycfnvz1n0zqfbwn3yh4w880lbssqhkn23iim3ihxgm5pbd" {};
+    libsecurity_utilities      = libsecPackage "libsecurity_utilities"      "osx-10.7.5" "0ayycfy9jm0n0c7ih9f3m69ynh8hs80v8yicq47aa1h9wclbxg8r" {};
+    libsecurityd               = libsecPackage "libsecurityd"               "osx-10.7.5" "1ywm2qj8l7rhaxy5biwxsyavd0d09d4bzchm03nlvwl313p2747x" {};
+    security_dotmac_tp         = libsecPackage "security_dotmac_tp"         "osx-10.9.5" "1l4fi9qhrghj0pkvywi8da22bh06c5bv3l40a621b5g258na50pl" {};
   };
 in packages
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index 4da9144bbe1a..0f46e50de3a0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -1,9 +1,9 @@
 { stdenv, appleDerivation, xcbuildHook
-, Libc, xnu, libutil }:
+, Libc, xnu, libutil-new }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ libutil ];
+  buildInputs = [ libutil-new ];
 
   NIX_CFLAGS_COMPILE = "-I.";
   NIX_LDFLAGS = "-lutil";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
index 8706d22be19b..fd2c95563b48 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -1,53 +1,50 @@
-{ appleDerivation, xcbuildHook, CoreSymbolication
-, xnu, bison, flex, darling, stdenv, fixDarwinDylibNames }:
+{ appleDerivation, cctools, zlib }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook flex bison fixDarwinDylibNames ];
-  buildInputs = [ CoreSymbolication darling xnu ];
-  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers -Wno-error=implicit-function-declaration";
-  NIX_LDFLAGS = "-L./Products/Release";
-  xcbuildFlags = "-target dtrace_frameworks -target dtrace";
+  buildInputs = [ cctools zlib ];
 
-  doCheck = false;
-  checkPhase = "xcodebuild -target dtrace_tests";
+  buildPhase = ''
+    export CFLAGS=" -I$PWD/head -I$PWD/sys -I$PWD/libelf -I$PWD/libdwarf"
 
-  postPatch = ''
-    substituteInPlace dtrace.xcodeproj/project.pbxproj \
-      --replace "/usr/sbin" ""
-    substituteInPlace libdtrace/dt_open.c \
-      --replace /usr/bin/clang ${stdenv.cc.cc}/bin/clang \
-      --replace /usr/bin/ld ${stdenv.cc.bintools.bintools}/bin/ld \
-      --replace /usr/lib/dtrace/dt_cpp.h $out/include/dt_cpp.h \
-      --replace /usr/lib/dtrace $out/lib/dtrace
-  '';
-
-  # hack to handle xcbuild's broken lex handling
-  preBuild = ''
-    pushd libdtrace
-    yacc -d dt_grammar.y
-    flex -l -d dt_lex.l
+    pushd libelf
+    for f in *.c; do
+      if [ "$f" != "lintsup.c" ]; then # Apple doesn't use it, so I don't either
+        cc -D_INT64_TYPE -D_LONGLONG_TYPE -D_ILP32 $CFLAGS -c $f
+      fi
+    done
+    libtool -static -o libelf.a *.o
     popd
 
-    substituteInPlace dtrace.xcodeproj/project.pbxproj \
-      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
-      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+    pushd libdwarf
+    ./configure CFLAGS="$CFLAGS -Icmplrs"
+    make
+    popd
+
+    cp libelf/libelf.a     tools/ctfconvert
+    cp libdwarf/libdwarf.a tools/ctfconvert
+
+    pushd tools/ctfconvert
+    for f in ../../darwin_shim.c *.c; do
+      cc -DNDEBUG -DNS_BLOCK_ASSERTIONS $CFLAGS -c $f
+    done
+
+    export COMMON="alist.o ctf.o darwin_shim.o hash.o iidesc.o input.o list.o \
+      memory.o output.o stack.o strtab.o symbol.o tdata.o traverse.o util.o"
+
+    export CONVERT="ctfconvert.o dwarf.o merge.o st_bugs.o st_parse.o stabs.o"
+    export MERGE="barrier.o ctfmerge.o dwarf.o fifo.o merge.o st_bugs.o st_parse.o stabs.o utils.o"
+    export DUMP="dump.o fifo.o utils.o"
+
+    clang -o ctfconvert $CONVERT $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfmerge   $MERGE   $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfdump    $DUMP    $COMMON -L. -lz -lelf
+    popd
   '';
 
-  # xcbuild doesn't support install
   installPhase = ''
-    mkdir -p $out
-
-    cp -r Products/Release/usr/include $out/include
-    cp scripts/dt_cpp.h $out/include/dt_cpp.h
-
-    mkdir $out/lib
-    cp Products/Release/*.dylib $out/lib
-
-    mkdir $out/bin
-    cp Products/Release/dtrace $out/bin
-
-    mkdir -p $out/lib/dtrace
-
-    install_name_tool -change $PWD/Products/Release/libdtrace.dylib $out/lib/libdtrace.dylib $out/bin/dtrace
+    mkdir -p $out/bin
+    cp tools/ctfconvert/ctfconvert $out/bin
+    cp tools/ctfconvert/ctfmerge   $out/bin
+    cp tools/ctfconvert/ctfdump    $out/bin
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
new file mode 100644
index 000000000000..f8636403ed54
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
@@ -0,0 +1,47 @@
+{ appleDerivation, xcbuildHook, CoreSymbolication
+, xnu, bison, flex, darling, stdenv }:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook flex bison ];
+  buildInputs = [ CoreSymbolication darling ];
+  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
+  NIX_LDFLAGS = "-L./Products/Release";
+  xcbuildFlags = "-target dtrace";
+
+  patchPhase = ''
+    substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
+    substituteInPlace libdtrace/dt_open.c \
+      --replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
+      --replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
+      --replace "/usr/bin/dtrace" $out/lib/dtrace
+  '';
+
+  # hack to handle xcbuild's broken lex handling
+  preBuild = ''
+    cd libdtrace
+    yacc -d dt_grammar.y
+    flex -l -d dt_lex.l
+    cd ..
+
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
+      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+  '';
+
+  # xcbuild doesn't support install
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r Products/Release/usr $out
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir $out/lib
+    cp Products/Release/*.dylib $out/lib
+
+    mkdir $out/bin
+    cp Products/Release/dtrace $out/bin
+
+    mkdir -p $out/lib/dtrace
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index 96dae723b2ee..c23205253221 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil }:
+{ stdenv, appleDerivation, xcbuildHook, zlib, bzip2, lzma, ncurses, libutil-new }:
 
 appleDerivation rec {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ zlib bzip2 lzma ncurses libutil ];
+  buildInputs = [ zlib bzip2 lzma ncurses libutil-new ];
 
   # some commands not working:
   # mtree: _simple.h not found
diff --git a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix b/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
deleted file mode 100644
index ab294b143d39..000000000000
--- a/pkgs/os-specific/darwin/apple-source-releases/hfs/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ appleDerivation, lib, headersOnly ? false }:
-
-appleDerivation {
-  installPhase = lib.optionalString headersOnly ''
-    mkdir -p $out/include/hfs
-    cp core/*.h $out/include/hfs
-  '';
-}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
new file mode 100644
index 000000000000..ca263228fde8
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_csp
+
+security_apple_csp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_csp_HEADER_FILES_DIR = lib
+
+security_apple_csp_CC_FILES = $(wildcard lib/*.cpp)
+security_apple_csp_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
new file mode 100644
index 000000000000..639d377d1b64
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
@@ -0,0 +1,31 @@
+{ appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_utilities, CommonCrypto, stdenv }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurity_cdsa_plugin
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+  ];
+  NIX_CFLAGS_COMPILE = "-Iopen_ssl";
+  patchPhase = ''
+    for file in lib/BlockCryptor.h lib/RSA_DSA_signature.h lib/castContext.h \
+      lib/RawSigner.h lib/MD2Object.h lib/HMACSHA1.h lib/bfContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '"CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h"' \
+        '"${stdenv.lib.getDev apple_sdk.sdk}/include/MacTypes.h"'
+    done
+
+    for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '/usr/local/include/CommonCrypto/CommonCryptorSPI.h' \
+        '${CommonCrypto}/include/CommonCrypto/CommonCryptorSPI.h'
+    done
+    
+    substituteInPlace lib/opensshWrap.cpp --replace RSA_DSA_Keys.h RSA_DSA_keys.h
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/pbkdf2.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/ConditionalMacros.h>' \
+      '"${stdenv.libc}/include/ConditionalMacros.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
new file mode 100644
index 000000000000..a0d48cf49650
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_cspdl
+
+security_apple_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_cspdl_HEADER_FILES_DIR = lib
+
+security_apple_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
new file mode 100644
index 000000000000..b80d4c8aad28
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
@@ -0,0 +1,16 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
new file mode 100644
index 000000000000..f52829c644da
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_file_dl
+
+security_apple_file_dl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_file_dl_HEADER_FILES_DIR = lib
+
+security_apple_file_dl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
new file mode 100644
index 000000000000..0eb2ee10fd84
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
@@ -0,0 +1,17 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
new file mode 100644
index 000000000000..c7c9c3d4e795
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_cl
+
+security_apple_x509_cl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_cl_HEADER_FILES_DIR = lib
+
+security_apple_x509_cl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
new file mode 100644
index 000000000000..c5e9418ce913
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
@@ -0,0 +1,18 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
new file mode 100644
index 000000000000..166b4e631c84
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_tp
+
+security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_tp_HEADER_FILES_DIR = lib
+
+security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
+security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
new file mode 100644
index 000000000000..6410c134f89a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
@@ -0,0 +1,19 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_ocspd, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+    libsecurity_ocspd
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
new file mode 100644
index 000000000000..1c3c4f0b25bf
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_asn1
+
+security_asn1_C_FILES = $(wildcard lib/*.c)
+security_asn1_CC_FILES = $(wildcard lib/*.cpp)
+
+security_asn1_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_asn1_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
new file mode 100644
index 000000000000..a1c3204c15a4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
+  propagatedBuildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
new file mode 100644
index 000000000000..91fb6bb679e5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_client
+
+security_cdsa_client_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_client_HEADER_FILES_DIR = lib
+
+security_cdsa_client_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
new file mode 100644
index 000000000000..2ecad568bf7e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
new file mode 100644
index 000000000000..9e1260f9b9c4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_plugin
+
+security_cdsa_plugin_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_plugin_HEADER_FILES_DIR = lib
+
+security_cdsa_plugin_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
new file mode 100644
index 000000000000..b2dbb75f2971
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_cssm, libsecurity_utilities, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    perl
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cssm.src}
+    cp libsecurity_cssm*/lib/cssm{dli,aci,cli,cspi,tpi}.h lib
+  '';
+  preBuild = ''
+    perl lib/generator.pl lib lib/generator.cfg lib lib || exit 1
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
new file mode 100644
index 000000000000..24bc1fe7e3af
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utilities
+
+security_cdsa_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utilities_HEADER_FILES_DIR = lib
+
+security_cdsa_utilities_CC_FILES = $(wildcard lib/*.cpp) lib/Schema.cpp lib/KeySchema.cpp
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
new file mode 100644
index 000000000000..26515353b730
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
@@ -0,0 +1,13 @@
+{ CommonCrypto, appleDerivation, libsecurity_codesigning, libsecurity_utilities, m4 }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    m4
+  ];
+  patchPhase = ''
+    patch -p1 < ${./handletemplates.patch}
+    unpackFile ${libsecurity_codesigning.src}
+    mv libsecurity_codesigning*/lib security_codesigning
+  '';
+  NIX_CFLAGS_COMPILE = "-I${CommonCrypto}/include/CommonCrypto";
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
new file mode 100644
index 000000000000..e5a703b2a08f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
@@ -0,0 +1,19 @@
+--- a/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
++++ b/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
+@@ -32,6 +32,7 @@
+ #include <security_utilities/threading.h>
+ #include <security_utilities/globalizer.h>
+ #include <security_cdsa_utilities/cssmerrors.h>
++#include <vector>
+ 
+ #if __GNUC__ > 2
+ #include <ext/hash_map>
+@@ -129,7 +130,7 @@
+     // @@@  Remove when 4003540 is fixed
+     template <class Subtype>
+     static void findAllRefs(std::vector<_Handle> &refs) {
+-        state().findAllRefs<Subtype>(refs);
++        state().template findAllRefs<Subtype>(refs);
+     }
+     
+ protected:
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
new file mode 100644
index 000000000000..7b5b7dc186a1
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utils
+
+security_cdsa_utils_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utils_HEADER_FILES_DIR = lib
+
+security_cdsa_utils_CC_FILES = $(wildcard lib/*.cpp)
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
new file mode 100644
index 000000000000..e5637d6db410
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, m4 }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    m4
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
new file mode 100644
index 000000000000..e923b962c263
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_codesigning
+
+security_codesigning_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_codesigning_HEADER_FILES_DIR = lib
+
+security_codesigning_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
new file mode 100644
index 000000000000..f5035a06f1e8
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -0,0 +1,33 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
+, Security, xnu, xar, antlr, libsecurityd, apple_sdk
+, dtrace-xcode, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
+                  Security xar antlr libsecurityd ];
+  NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
+  patchPhase = ''
+    substituteInPlace lib/policydb.cpp \
+      --replace "new MutableDictionary::MutableDictionary()" NULL
+    substituteInPlace lib/xpcengine.h \
+      --replace "#include <xpc/private.h>" ""
+    substituteInPlace lib/policyengine.cpp \
+      --replace "#include <OpenScriptingUtilPriv.h>" ""
+
+    rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
+  '';
+  preBuild = ''
+    mkdir -p include
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
+    mkdir -p include/CoreServices/
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
+
+    unpackFile ${Security.src}
+    mkdir -p include/securityd_client
+    cp Security-*/libsecurityd/lib/*.h include/securityd_client
+    mkdir -p include/xpc
+    cp ${apple_sdk.sdk.out}/include/xpc/*.h include/xpc
+
+    sed -i '1i #define bool int' lib/security_codesigning.d
+    dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
new file mode 100644
index 000000000000..c7835aaa9b02
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cssm
+
+security_cssm_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cssm_HEADER_FILES_DIR = lib
+
+security_cssm_CC_FILES = $(wildcard lib/*.cpp)
+security_cssm_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
new file mode 100644
index 000000000000..cf9fe411533f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_client
+    perl
+    libsecurity_cdsa_plugin
+  ];
+  preBuild = ''
+    mkdir derived_src
+    perl lib/generator.pl lib lib/generator.cfg derived_src
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
new file mode 100644
index 000000000000..4359810c56b3
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_filedb
+
+security_filedb_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_filedb_HEADER_FILES_DIR = lib
+
+security_filedb_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
new file mode 100644
index 000000000000..435cd0f069f2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -0,0 +1,13 @@
+{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk, lib }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_plugin
+  ];
+  patchPhase = ''
+    cp ${osx_private_sdk}/include/sandbox_private.h .
+    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${lib.getDev apple_sdk.sdk}/include/sandbox.h"'
+    substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
new file mode 100644
index 000000000000..714524e8da58
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -0,0 +1,63 @@
+{ appleDerivation_, applePackage, pkgs, stdenv }:
+name: version: sha256: args: let
+  n = stdenv.lib.removePrefix "lib" name;
+  makeFile = ../. + "/${name}/GNUmakefile";
+  appleDerivation = appleDerivation_ name version sha256;
+  in applePackage name version sha256 (args // {
+    appleDerivation = a:
+    appleDerivation (stdenv.lib.mergeAttrsConcatenateValues {
+      __impureHostDeps = import ./impure_deps.nix;
+
+      patchPhase = ''
+        # allows including <Security/some-private-header.h>
+        cp -R ${pkgs.darwin.osx_private_sdk}/include/SecurityPrivateHeaders Security
+
+        grep -Rl MacErrors.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+            '"${pkgs.darwin.apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+        done || true # grep returns 1 if it can't find the string
+
+        grep -Rl MacTypes.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+            '"${stdenv.lib.getDev pkgs.darwin.apple_sdk.sdk}/include/MacTypes.h"'
+        done || true # grep returns 1 if it can't find the string
+      '';
+      preBuild = ''
+        ln -s lib ${n}
+        makeFlagsArray=(-j$NIX_BUILD_CORES)
+      '';
+      outputs = [ "out" "dev" ];
+      buildInputs = [
+        pkgs.gnustep.make
+        pkgs.darwin.apple_sdk.frameworks.AppKit
+        pkgs.darwin.apple_sdk.frameworks.Foundation
+      ];
+      makeFlags = [
+        "-f${makeFile}"
+        "MAKEFILE_NAME=${makeFile}"
+        "GNUSTEP_ABSOLUTE_INSTALL_PATHS=yes"
+        "GNUSTEP_MAKEFILES=${pkgs.gnustep.make}/share/GNUstep/Makefiles"
+        "LIB_LINK_INSTALL_DIR=\$(out)/lib"
+      ];
+      installFlags = [
+        "${n}_INSTALL_DIR=\$(out)/lib"
+        "${n}_HEADER_FILES_INSTALL_DIR=\$(out)/include/${n}"
+        "GNUSTEP_HEADERS="
+      ];
+      NIX_CFLAGS_COMPILE = [
+        "-isystem lib"
+        "-iframework ${pkgs.darwin.Security}/Library/Frameworks"
+        "-I."
+        "-Wno-deprecated-declarations"
+        "-DNDEBUG"
+      ];
+      NIX_LDFLAGS = with pkgs.darwin; with apple_sdk.frameworks; [
+        "-L${libobjc}/lib"
+        "-F${Foundation}/Library/Frameworks"
+        "-F${AppKit}/Library/Frameworks"
+        "-no_dtrace_dof"
+      ];
+    } a);
+  })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
new file mode 100644
index 000000000000..7725b9f3d1a2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
@@ -0,0 +1,129 @@
+# generated using a ruby script
+[
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib"
+  "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis"
+  "/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox"
+  "/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit"
+  "/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition"
+  "/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio"
+  "/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth"
+  "/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData"
+  "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
+  "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit"
+  "/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText"
+  "/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo"
+  "/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN"
+  "/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration"
+  "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"
+  "/System/Library/Frameworks/GSS.framework/Versions/A/GSS"
+  "/System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth"
+  "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit"
+  "/System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib"
+  "/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos"
+  "/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS"
+  "/System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage.framework/Versions/A/CoreImage"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore"
+  "/System/Library/Frameworks/Security.framework/Versions/A/Security"
+  "/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation"
+  "/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement"
+  "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration"
+  "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
+  "/System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG"
+  "/System/Library/PrivateFrameworks/AppleVPA.framework/Versions/A/AppleVPA"
+  "/System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup"
+  "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
+  "/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth"
+  "/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication"
+  "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
+  "/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi"
+  "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
+  "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
+  "/System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols"
+  "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
+  "/System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore"
+  "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
+  "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal"
+  "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
+  "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
+  "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
+  "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
+  "/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis"
+  "/System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices"
+  "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
+  "/System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore"
+  "/System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication"
+  "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
+  "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+  "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
+  "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
+  "/usr/lib/libCRFSuite.dylib"
+  "/usr/lib/libOpenScriptingUtil.dylib"
+  "/usr/lib/libarchive.2.dylib"
+  "/usr/lib/libbsm.0.dylib"
+  "/usr/lib/libbz2.1.0.dylib"
+  "/usr/lib/libc++.1.dylib"
+  "/usr/lib/libc++abi.dylib"
+  "/usr/lib/libcmph.dylib"
+  "/usr/lib/libcups.2.dylib"
+  "/usr/lib/libextension.dylib"
+  "/usr/lib/libheimdal-asn1.dylib"
+  "/usr/lib/libiconv.2.dylib"
+  "/usr/lib/libicucore.A.dylib"
+  "/usr/lib/liblangid.dylib"
+  "/usr/lib/liblzma.5.dylib"
+  "/usr/lib/libmecabra.dylib"
+  "/usr/lib/libpam.2.dylib"
+  "/usr/lib/libresolv.9.dylib"
+  "/usr/lib/libsqlite3.dylib"
+  "/usr/lib/libxar.1.dylib"
+  "/usr/lib/libxml2.2.dylib"
+  "/usr/lib/libxslt.1.dylib"
+  "/usr/lib/libz.1.dylib"
+]
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
new file mode 100644
index 000000000000..8830006f00e5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_keychain
+
+security_keychain_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_keychain_HEADER_FILES_DIR = lib
+
+security_keychain_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
new file mode 100644
index 000000000000..724c4788b6cc
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -0,0 +1,43 @@
+{ CF, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp, lib }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurity_cdsa_utilities
+    libsecurityd
+    CF
+    libsecurity_asn1
+    libsecurity_pkcs12
+    libsecurity_cdsa_utils
+    openssl
+    libsecurity_ocspd
+    security_dotmac_tp
+  ];
+  patchPhase = ''
+    substituteInPlace lib/Keychains.cpp --replace DLDbListCFPref.h DLDBListCFPref.h
+
+    substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
+
+    cp ${osx_private_sdk}/include/xpc/private.h xpc
+    cp ${lib.getDev apple_sdk.sdk}/include/xpc/*.h xpc
+    cp ${osx_private_sdk}/include/sandbox_private.h lib/sandbox.h
+
+    substituteInPlace lib/SecItemPriv.h \
+      --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
+      --replace "extern CFTypeRef kSecAttrIsSensitive" "extern const CFTypeRef kSecAttrIsSensitive" \
+      --replace "extern CFTypeRef kSecAttrIsExtractable" "extern const CFTypeRef kSecAttrIsExtractable"
+
+    substituteInPlace lib/Keychains.cpp --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+
+    substituteInPlace lib/CertificateValues.cpp --replace \
+      '#include <Security/SecCertificatePriv.h>' ""
+
+    substituteInPlace lib/DLDBListCFPref.cpp --replace \
+      'dispatch_once_t AppSandboxChecked;' ''$'namespace Security {\ndispatch_once_t AppSandboxChecked;' \
+      --replace 'return mLoginDLDbIdentifier;' 'return mLoginDLDbIdentifier; }' \
+      --replace '_xpc_runtime_is_app_sandboxed()' 'false'
+      # hope that doesn't hurt anything
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
new file mode 100644
index 000000000000..119a43621fbb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_mds
+
+security_mds_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_mds_HEADER_FILES_DIR = lib
+
+security_mds_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
new file mode 100644
index 000000000000..cd691f71e95f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
@@ -0,0 +1,11 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_filedb
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
new file mode 100644
index 000000000000..140c5a909a66
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_ocspd
+
+security_ocspd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_ocspd_HEADER_FILES_DIR = lib
+
+security_ocspd_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
new file mode 100644
index 000000000000..81551e9a76ef
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
@@ -0,0 +1,20 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    bootstrap_cmds
+  ];
+  postUnpack = ''
+    pushd libsecurity*
+    ls -lah
+    mkdir -p lib
+    cp common/* lib
+    cp client/* lib
+    popd
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=. || exit 1
+    cp derived_src/* lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
new file mode 100644
index 000000000000..b2af7e72c41b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_pkcs12
+
+security_pkcs12_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_pkcs12_HEADER_FILES_DIR = lib
+
+security_pkcs12_CC_FILES = $(wildcard lib/*.cpp)
+security_pkcs12_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
new file mode 100644
index 000000000000..b225d062dc94
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utils, libsecurity_keychain }:
+appleDerivation {
+  patchPhase = ''
+    substituteInPlace lib/pkcsoids.h --replace '#error' '#warning'
+  '';
+  preBuild = ''
+    unpackFile ${libsecurity_keychain.src}
+    mv libsecurity_keychain*/lib security_keychain
+  '';
+  buildInputs = [
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
new file mode 100644
index 000000000000..47a1c609d066
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_sd_cspdl
+
+security_sd_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_sd_cspdl_HEADER_FILES_DIR = lib
+
+security_sd_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
new file mode 100644
index 000000000000..224910916615
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
@@ -0,0 +1,10 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
new file mode 100644
index 000000000000..d3ba09142c96
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_utilities
+
+security_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_utilities_HEADER_FILES_DIR = lib
+
+security_utilities_C_FILES = $(wildcard lib/*.c)
+security_utilities_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
new file mode 100644
index 000000000000..1ab950a9233c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -0,0 +1,28 @@
+{ IOKit, appleDerivation, apple_sdk, libauto, libobjc, sqlite, stdenv, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libauto
+    libobjc
+    IOKit
+  ];
+  propagatedBuildInputs = [
+    sqlite
+    apple_sdk.frameworks.PCSC
+  ];
+  NIX_LDFLAGS = "-framework PCSC";
+  patchPhase = ''
+    substituteInPlace lib/errors.h --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+      '"MacTypes.h"'
+    substituteInPlace lib/debugging.cpp --replace PATH_MAX 1024
+    substituteInPlace lib/superblob.h --replace 'result->at' 'result->template at'
+    substituteInPlace lib/ccaudit.cpp --replace '<bsm/libbsm.h>' '"bsm/libbsm.h"'
+    substituteInPlace lib/powerwatch.h --replace \
+      '<IOKit/pwr_mgt/IOPMLibPrivate.h>' \
+      '"${IOKit}/Library/Frameworks/IOKit.framework/Headers/pwr_mgt/IOPMLibPrivate.h"'
+    cp -R ${osx_private_sdk}/include/bsm lib
+    cp ${osx_private_sdk}/include/utilities_dtrace.h lib
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
new file mode 100644
index 000000000000..6058043e79f5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = securityd
+
+securityd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+securityd_HEADER_FILES_DIR = lib
+
+securityd_CC_FILES = $(wildcard lib/*.cpp)
+securityd_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
new file mode 100644
index 000000000000..fb3441f70507
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
@@ -0,0 +1,23 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    bootstrap_cmds
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cdsa_client.src}
+    mv libsecurity_cdsa_client*/lib security_cdsa_client
+    ln -s lib securityd_client
+
+    patch -p1 < ${./xdr-arity.patch}
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=.
+    cp derived_src/* lib
+    rm lib/ucspClientC.c
+  '';
+  postFixup = ''
+    ln -s $dev/include/securityd $dev/include/securityd_client
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
new file mode 100644
index 000000000000..5d0328629f19
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
@@ -0,0 +1,79 @@
+diff --git a/lib/sec_xdr.c b/lib/sec_xdr.c
+index fe5f038..6239b6c 100644
+--- a/lib/sec_xdr.c
++++ b/lib/sec_xdr.c
+@@ -223,7 +223,7 @@ bool_t copyin(void *data, xdrproc_t proc, void** copy, u_int *size)
+     sec_xdrmem_create(&xdr, (char *)xdr_data, length, XDR_ENCODE);
+ 
+     // cast to void* - function can go both ways (xdr->x_op) 
+-    if (proc(&xdr, data)) {
++    if (proc(&xdr, data, 0)) {
+         *copy = xdr_data;
+         if (size) *size = length;
+         return (TRUE);
+@@ -261,7 +261,7 @@ bool_t copyout(const void *copy, u_int size, xdrproc_t proc, void **data, u_int
+     if (!sec_xdr_arena_init(&arena, &xdr, length_out ? length_out : length_required, length_out ? *data : NULL))
+         return (FALSE);
+ 
+-    if (proc(&xdr, data))
++    if (proc(&xdr, data, 0))
+     {
+         *length = length_required;
+         return (TRUE);
+@@ -284,7 +284,7 @@ bool_t copyout_chunked(const void *copy, u_int size, xdrproc_t proc, void **data
+ 
+     void *data_out = NULL;
+ 
+-    if (proc(&xdr, &data_out))
++    if (proc(&xdr, &data_out, 0))
+     {
+         *data = data_out;
+         return (TRUE);
+diff --git a/lib/sec_xdr_array.c b/lib/sec_xdr_array.c
+index 152a71b..e5ec1ad 100644
+--- a/lib/sec_xdr_array.c
++++ b/lib/sec_xdr_array.c
+@@ -147,7 +147,7 @@ sec_xdr_array(XDR *xdrs, uint8_t **addrp, u_int *sizep, u_int maxsize, u_int els
+     for (i = 0; (i < c) && stat; i++) {
+         if ((xdrs->x_op == XDR_DECODE) && sizeof_alloc)
+             memset(obj, 0, elsize);
+-        stat = (*elproc)(xdrs, target);
++        stat = (*elproc)(xdrs, target, 0);
+         if ((xdrs->x_op == XDR_ENCODE) || !sizeof_alloc)
+             target += elsize;
+     }
+diff --git a/lib/sec_xdr_reference.c b/lib/sec_xdr_reference.c
+index a66fb37..ab5b4c4 100644
+--- a/lib/sec_xdr_reference.c
++++ b/lib/sec_xdr_reference.c
+@@ -121,7 +121,7 @@ sec_xdr_reference(XDR *xdrs, uint8_t **pp, u_int size, xdrproc_t proc)
+                 break;
+             }
+ 
+-    stat = (*proc)(xdrs, loc);
++    stat = (*proc)(xdrs, loc, 0);
+ 
+     if (xdrs->x_op == XDR_FREE) {
+         sec_mem_free(xdrs, loc, size);
+diff --git a/lib/sec_xdr_sizeof.c b/lib/sec_xdr_sizeof.c
+index a18bcd0..8c33dbc 100644
+--- a/lib/sec_xdr_sizeof.c
++++ b/lib/sec_xdr_sizeof.c
+@@ -190,7 +190,7 @@ sec_xdr_sizeof_in(func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (x.x_private)
+         free(x.x_private);
+     return (stat == TRUE ? (unsigned) x.x_handy: 0);
+@@ -210,7 +210,7 @@ sec_xdr_sizeof_out(copy, size, func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (size_alloc.data)
+         free(size_alloc.data);
+     return (stat == TRUE ? (unsigned long)size_alloc.offset : 0);
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
index 87211f481d4f..a6f484ba4e8d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -1,33 +1,13 @@
-{ stdenv, lib, appleDerivation, xcbuildHook
-
-# headersOnly is true when building for libSystem
-, headersOnly ? false }:
+{ stdenv, appleDerivation }:
 
+# all symbols are located in libSystem
 appleDerivation {
-  nativeBuildInputs = lib.optional (!headersOnly) xcbuildHook;
-
-  prePatch = ''
-    substituteInPlace tzlink.c \
-      --replace '#include <xpc/xpc.h>' ""
-  '';
-
-  xcbuildFlags = "-target util";
-
   installPhase = ''
     mkdir -p $out/include
-  '' + lib.optionalString headersOnly ''
     cp *.h $out/include
-  '' + lib.optionalString (!headersOnly)''
-    mkdir -p $out/lib $out/include
-
-    cp Products/Release/*.dylib $out/lib
-    cp Products/Release/*.h $out/include
-
-    # TODO: figure out how to get this to be right the first time around
-    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
   '';
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     maintainers = with maintainers; [ copumpkin ];
     platforms   = platforms.darwin;
     license     = licenses.apsl20;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
new file mode 100644
index 000000000000..0115ce537e27
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
@@ -0,0 +1,29 @@
+{ stdenv, appleDerivation, xcbuildHook }:
+
+# TODO: make this the official libutil expression once we've integrated xcbuild in the bootstrap
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+
+  prePatch = ''
+    substituteInPlace tzlink.c \
+      --replace '#include <xpc/xpc.h>' ""
+  '';
+
+  xcbuildFlags = "-target util";
+
+  installPhase = ''
+    mkdir -p $out/lib $out/include
+
+    cp Products/Release/*.dylib $out/lib
+    cp Products/Release/*.h $out/include
+
+    # TODO: figure out how to get this to be right the first time around
+    install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
new file mode 100644
index 000000000000..6f6a50bd57a2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
@@ -0,0 +1,8 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_dotmac_tp
+
+security_dotmac_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_dotmac_tp_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
new file mode 100644
index 000000000000..bfbfb945957e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
@@ -0,0 +1,4 @@
+{ appleDerivation }:
+
+appleDerivation {
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
new file mode 100644
index 000000000000..d5bc3483c389
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
@@ -0,0 +1,32 @@
+{ appleDerivation, xcbuildHook, Security
+, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
+, xnu, osx_private_sdk, pcsclite}:
+
+appleDerivation {
+  nativeBuildInputs = [ xcbuildHook ];
+  buildInputs = [ Security libsecurity_utilities
+                  libsecurity_cdsa_utilities libsecurity_codesigning
+                  pcsclite ];
+
+  NIX_LDFLAGS = "-lpcsclite";
+
+  # can't build the whole thing
+  xcbuildFlags = "-target codesign";
+
+  preBuild = ''
+    mkdir -p include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
+
+    unpackFile ${xnu.src}
+    mkdir -p include/sys
+    cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Iinclude";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp Products/Release/codesign $out/bin/codesign
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
index a2f912ca5782..3513cb2e172c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -1,8 +1,8 @@
-{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil, lib}:
+{xcbuildHook, appleDerivation, apple_sdk, ncurses, libutil-new, lib}:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil ];
+  buildInputs = [ apple_sdk.frameworks.IOKit ncurses libutil-new ];
   NIX_LDFLAGS = "-lutil";
   installPhase = ''
     install -D Products/Release/libtop.a $out/lib/libtop.a
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index aaa3a1ebe327..74c9f2543481 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,11 +1,11 @@
-{ appleDerivation, lib, bootstrap_cmds, bison, flex
-, gnum4, unifdef, perl, python
-, headersOnly ? true }:
+{ appleDerivation, bootstrap_cmds, bison, flex, gnum4, unifdef, perl, python }:
 
-appleDerivation ({
-  nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
+appleDerivation {
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
 
-  postPatch = ''
+  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python ];
+
+  patchPhase = ''
     substituteInPlace Makefile \
       --replace "/bin/" "" \
       --replace "MAKEJOBS := " '# MAKEJOBS := '
@@ -40,27 +40,7 @@ appleDerivation ({
     patchShebangs .
   '';
 
-  PLATFORM = "MacOSX";
-  SDKVERSION = "10.11";
-  CC = "cc";
-  CXX = "c++";
-  MIG = "mig";
-  MIGCOM = "migcom";
-  STRIP = "strip";
-  NM = "nm";
-  UNIFDEF = "unifdef";
-  DSYMUTIL = "dsymutil";
-  HOST_OS_VERSION = "10.10";
-  HOST_CC = "cc";
-  HOST_FLEX = "flex";
-  HOST_BISON = "bison";
-  HOST_GM4 = "m4";
-  MIGCC = "cc";
-  ARCHS = "x86_64";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  preBuild = ''
+  installPhase = ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
 
@@ -76,27 +56,49 @@ appleDerivation ({
 
     export SDKROOT_RESOLVED=$PWD/sdk
     export HOST_SDKROOT_RESOLVED=$PWD/sdk
+    export PLATFORM=MacOSX
+    export SDKVERSION=10.11
+
+    export CC=cc
+    export CXX=c++
+    export MIG=${bootstrap_cmds}/bin/mig
+    export MIGCOM=${bootstrap_cmds}/libexec/migcom
+    export STRIP=sentinel-missing
+    export LIPO=sentinel-missing
+    export LIBTOOL=sentinel-missing
+    export NM=sentinel-missing
+    export UNIFDEF=${unifdef}/bin/unifdef
+    export DSYMUTIL=sentinel-missing
+    export CTFCONVERT=sentinel-missing
+    export CTFMERGE=sentinel-missing
+    export CTFINSERT=sentinel-missing
+    export NMEDIT=sentinel-missing
+
+    export HOST_OS_VERSION=10.7
+    export HOST_CC=cc
+    export HOST_FLEX=${flex}/bin/flex
+    export HOST_BISON=${bison}/bin/bison
+    export HOST_GM4=${gnum4}/bin/m4
+    export HOST_CODESIGN='echo dummy_codesign'
+    export HOST_CODESIGN_ALLOCATE=echo
 
     export BUILT_PRODUCTS_DIR=.
+
     export DSTROOT=$out
-  '';
+    make installhdrs
 
-  buildFlags = lib.optionalString headersOnly "exporthdrs";
-  installTargets = lib.optionalString headersOnly "installhdrs";
-
-  postInstall = lib.optionalString headersOnly ''
     mv $out/usr/include $out
 
-    (cd BUILD/obj/EXPORT_HDRS && find -type f -exec install -D \{} $out/include/\{} \;)
-
     # TODO: figure out why I need to do this
     cp libsyscall/wrappers/*.h $out/include
-    install -D libsyscall/os/tsd.h $out/include/os/tsd.h
+    mkdir -p $out/include/os
+    cp libsyscall/os/tsd.h $out/include/os/tsd.h
     cp EXTERNAL_HEADERS/AssertMacros.h $out/include
     cp EXTERNAL_HEADERS/Availability*.h $out/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/
-    cp -r EXTERNAL_HEADERS/corecrypto $out/include
 
     # Build the mach headers we crave
+    export MIGCC=cc
+    export ARCHS="x86_64"
     export SRCROOT=$PWD/libsyscall
     export DERIVED_SOURCES_DIR=$out/include
     export SDKROOT=$out
@@ -106,13 +108,14 @@ appleDerivation ({
 
     # Get rid of the System prefix
     mv $out/System/* $out/
-    rmdir $out/System
 
     # TODO: do I need this?
     mv $out/internal_hdr/include/mach/*.h $out/include/mach
 
     # Get rid of some junk lying around
-    rm -rf $out/internal_hdr $out/usr $out/local
+    rm -rf $out/internal_hdr
+    rm -rf $out/usr
+    rm -rf $out/local
 
     # Add some symlinks
     ln -s $out/Library/Frameworks/System.framework/Versions/B \
@@ -120,18 +123,8 @@ appleDerivation ({
     ln -s $out/Library/Frameworks/System.framework/Versions/Current/PrivateHeaders \
           $out/Library/Frameworks/System.framework/Headers
 
-    # IOKit (and possibly the others) is incomplete,
-    # so let's not make it visible from here...
+    # IOKit (and possibly the others) is incomplete, so let's not make it visible from here...
     mkdir $out/Library/PrivateFrameworks
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
-} // lib.optionalAttrs headersOnly {
-  HOST_CODESIGN = "echo";
-  HOST_CODESIGN_ALLOCATE = "echo";
-  LIPO = "echo";
-  LIBTOOL = "echo";
-  CTFCONVERT = "echo";
-  CTFMERGE = "echo";
-  CTFINSERT = "echo";
-  NMEDIT = "echo";
-})
+}
diff --git a/pkgs/os-specific/darwin/darling/default.nix b/pkgs/os-specific/darwin/darling/default.nix
index 846831d0a879..6ed3b28eccc3 100644
--- a/pkgs/os-specific/darwin/darling/default.nix
+++ b/pkgs/os-specific/darwin/darling/default.nix
@@ -26,9 +26,6 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cp -rL src/sandbox/include/ $out/
     cp libsystem_sandbox.dylib $out/lib/
-
-    mkdir -p $out/include
-    cp src/libaks/include/* $out/include
   '';
 
   # buildInputs = [ cmake bison flex ];
diff --git a/pkgs/os-specific/darwin/security-tool/GNUmakefile b/pkgs/os-specific/darwin/security-tool/GNUmakefile
new file mode 100644
index 000000000000..ae25f6a67c02
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/GNUmakefile
@@ -0,0 +1,14 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+TOOL_NAME = security
+security_C_FILES = $(wildcard *.c)
+security_CC_FILES = $(wildcard *.cpp)
+
+security_LDFLAGS = \
+	-lsecurity_cdsa_utilities -lsecurity_cdsa_utils -lsecurity_keychain -lsecurity_cssm \
+	-lsecurity_cdsa_client -lsecurity_utilities -lsecurity_asn1 -lsecurity_mds \
+	-lsecurity_cdsa_plugin -lsecurity_pkcs12 -lsecurity_apple_csp -lsecurity_apple_cspdl \
+	-lsecurity_apple_file_dl -lsecurity_apple_x509_cl -lsecurity_apple_x509_tp \
+	-lsecurity_sd_cspdl -lsecurity_filedb -lsecurityd -framework Security -framework PCSC
+
+include $(GNUSTEP_MAKEFILES)/tool.make
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
new file mode 100644
index 000000000000..f161a7a88e17
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -0,0 +1,101 @@
+{ Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk,
+fetchurl, gnustep, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl,
+libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp,
+libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin,
+libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb,
+libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl,
+libsecurity_utilities, libsecurityd, osx_private_sdk, Security-framework, stdenv }:
+
+stdenv.mkDerivation rec {
+  version = "55115";
+  name = "SecurityTool-${version}";
+
+  src = fetchurl {
+    url = "http://opensource.apple.com/tarballs/SecurityTool/SecurityTool-${version}.tar.gz";
+    sha256 = "0apcz4vy2z5645jhrs60wj3w27mncjjqv42h5lln36g6qs2n9113";
+  };
+
+  disallowedRequisites = [ apple_sdk.sdk  ];
+
+  patchPhase = ''
+    # copied from libsecurity_generic
+    cp -R ${osx_private_sdk}/include/SecurityPrivateHeaders Security
+
+    substituteInPlace cmsutil.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+    substituteInPlace createFVMaster.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk.out}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+  '';
+
+  postUnpack = ''
+    unpackFile ${Security.src}
+    cp Security-*/utilities/src/fileIo.c SecurityTool*
+    cp Security-*/utilities/src/fileIo.h SecurityTool*
+  '';
+
+  preBuild = ''
+    makeFlagsArray=(-j$NIX_BUILD_CORES)
+  '';
+
+  NIX_LDFLAGS = "-no_dtrace_dof";
+
+  makeFlags = [
+    "-f ${./GNUmakefile}"
+    "MAKEFILE_NAME=${./GNUmakefile}"
+    "GNUSTEP_MAKEFILES=${gnustep.make}/share/GNUstep/Makefiles"
+  ];
+
+  installFlags = [
+    "security_INSTALL_DIR=\$(out)/bin"
+  ];
+
+  propagatedBuildInputs = [ GSS Kerberos Security-framework PCSC Foundation ];
+
+  __propagatedImpureHostDeps = [ "/System/Library/Keychains" ];
+
+  buildInputs = [
+    gnustep.make
+    libsecurity_asn1
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libobjc
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_cssm
+    libsecurity_cdsa_utils
+    libsecurity_mds
+    libsecurity_cdsa_plugin
+    libsecurity_apple_csp
+    libsecurity_apple_cspdl
+    libsecurity_apple_file_dl
+    libsecurity_apple_x509_cl
+    libsecurity_apple_x509_tp
+    libsecurity_pkcs12
+    libsecurity_sd_cspdl
+    libsecurity_filedb
+    libsecurityd
+    makeWrapper
+  ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-F${Security}/Library/Frameworks"
+    "-F${PCSC}/Library/Frameworks"
+    "-Wno-deprecated-declarations"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/security --set DYLD_INSERT_LIBRARIES /usr/lib/libsqlite3.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Command line interface to macOS keychains and Security framework";
+    maintainers = with maintainers; [
+      copumpkin
+      joelteon
+    ];
+    platforms = platforms.darwin;
+    license = licenses.apsl20;
+  };
+}
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index da1878c5fc12..1fc36139ac07 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -61,6 +61,10 @@ in
 
   osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { };
 
+  security_tool = darwin.callPackage ../os-specific/darwin/security-tool {
+    Security-framework = darwin.apple_sdk.frameworks.Security;
+  };
+
   stubs = callPackages ../os-specific/darwin/stubs { };
 
   trash = darwin.callPackage ../os-specific/darwin/trash { };

From 8cb2d3576064a2c5f591349260219fd7489c8c23 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 31 Dec 2018 13:31:46 -0600
Subject: [PATCH 180/182] darwin: fix typos in install scripts

fixes some issues in my commits in:

- basic_cmds
- network_cmds

(cherry picked from commit f283145308aec6aa9a8c3c6cbd4864718ccb7c53)
---
 .../darwin/apple-source-releases/basic_cmds/default.nix         | 2 +-
 .../darwin/apple-source-releases/network_cmds/default.nix       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 8d44a17f6ed4..f646e57549ea 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -15,7 +15,7 @@ appleDerivation rec {
   installPhase = ''
     for f in Products/Release/*; do
       if [ -f $f ]; then
-        install -D $file $out/usr/bin/$(basename $f)
+        install -D $f $out/usr/bin/$(basename $f)
       fi
     done
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 9dc5150ac2f5..8e69cb4bfa7e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -23,7 +23,7 @@ appleDerivation rec {
     for f in Products/Release/*; do
       if [ -f $f ]; then
         install -D $file $out/bin/$(basename $f)
-      done
+      fi
     done
 
     for n in 1 5; do

From 030f66400db0ce32f988045e5b35b27d75f2fe33 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Fri, 4 Jan 2019 10:28:22 -0600
Subject: [PATCH 181/182] darwin.adv_cmds: fix build

---
 .../darwin/apple-source-releases/adv_cmds/default.nix      | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index a3b12d73a115..80d57484ecc7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -68,12 +68,7 @@ in appleDerivation {
     for f in Products/Release/*; do
       if [ -f $f ]; then
         install -D $file $out/bin/$(basename $f)
-      done
-    done
-
-    for n in 1 8; do
-      mkdir -p $out/share/man/man$n
-      install */*.$n $out/share/man/man$n
+      fi
     done
 
     bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"

From d9707792b5e1af8999ddcb790b8b1b06305dd186 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Fri, 4 Jan 2019 23:25:48 -0600
Subject: [PATCH 182/182] mesa: make sure $drivers output gets created

Not all installs will have a $drivers output, so we just create an
empty one here.
---
 pkgs/development/libraries/mesa/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 95baab1627bc..9b496134774a 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -163,7 +163,10 @@ let self = stdenv.mkDerivation {
   ];
 
   # TODO: probably not all .la files are completely fixed, but it shouldn't matter;
-  postInstall = optionalString (galliumDrivers != []) ''
+  postInstall = ''
+    # Some installs don't have any drivers so this directory is never created.
+    mkdir -p $drivers
+  '' + optionalString (galliumDrivers != []) ''
     # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
     mv -t "$drivers/lib/"    \
       $out/lib/libXvMC*      \