Merge branch 'master' into closure-size

Beware that stdenv doesn't build. It seems something more will be needed
than just resolution of merge conflicts.

17 files changed, 158 insertions, 97 deletions

diff --git a/pkgs/build-support/build-fhs-chrootenv/env.nix b/pkgs/build-support/build-fhs-chrootenv/env.nix
index d28773f00ace..8c45c9c9036b 100644
--- a/pkgs/build-support/build-fhs-chrootenv/env.nix
+++ b/pkgs/build-support/build-fhs-chrootenv/env.nix
@@ -57,6 +57,11 @@ let
     export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
     export LD_LIBRARY_PATH='/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32'
     export PATH='/var/setuid-wrappers:/usr/bin:/usr/sbin'
+
+    # Force compilers to look in default search paths
+    export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
+    export NIX_LDFLAGS_BEFORE='-L/usr/lib -L/usr/lib32'
+
     ${profile}
   '';
 
diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix
index 4177846c4336..a7e1bd11977a 100644
--- a/pkgs/build-support/build-fhs-userenv/default.nix
+++ b/pkgs/build-support/build-fhs-userenv/default.nix
@@ -1,9 +1,8 @@
-{ runCommand, lib, writeText, writeScriptBin, stdenv, bash, ruby } :
-{ env, runScript ? "${bash}/bin/bash", extraBindMounts ? [], extraInstallCommands ? "", importMeta ? {} } :
+{ runCommand, lib, writeText, writeScriptBin, stdenv, ruby } :
+{ env, runScript ? "bash", extraBindMounts ? [], extraInstallCommands ? "", importMeta ? {} } :
 
 let
   name = env.pname;
-  bash' = "${bash}/bin/bash";
 
   # Sandboxing script
   chroot-user = writeScriptBin "chroot-user" ''
@@ -33,7 +32,7 @@ in runCommand name {
     runCommand "${name}-shell-env" {
       shellHook = ''
         export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"
-        exec ${chroot-user}/bin/chroot-user ${env} ${bash'} -l ${init bash'} "$(pwd)"
+        exec ${chroot-user}/bin/chroot-user ${env} bash -l ${init "bash"} "$(pwd)"
       '';
     } ''
       echo >&2 ""
@@ -46,7 +45,7 @@ in runCommand name {
   cat <<EOF >$out/bin/${name}
   #! ${stdenv.shell}
   export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:\$CHROOTENV_EXTRA_BINDS"
-  exec ${chroot-user}/bin/chroot-user ${env} ${bash'} ${init runScript} "\$(pwd)" "\$@"
+  exec ${chroot-user}/bin/chroot-user ${env} bash ${init runScript} "\$(pwd)" "\$@"
   EOF
   chmod +x $out/bin/${name}
   ${extraInstallCommands}
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 99cee577cd33..ddb549a2a136 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -15,29 +15,37 @@ fi
 source @out@/nix-support/utils.sh
 
 
-# Figure out if linker flags should be passed.  GCC prints annoying
-# warnings when they are not needed.
+# Parse command line options and set several variables.
+# For instance, figure out if linker flags should be passed.
+# GCC prints annoying warnings when they are not needed.
 dontLink=0
 getVersion=0
 nonFlagArgs=0
+[[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
 
-for i in "$@"; do
-    if [ "$i" = -c ]; then
+params=("$@")
+n=0
+while [ $n -lt ${#params[*]} ]; do
+    p=${params[n]}
+    p2=${params[$((n+1))]}
+    if [ "$p" = -c ]; then
         dontLink=1
-    elif [ "$i" = -S ]; then
+    elif [ "$p" = -S ]; then
         dontLink=1
-    elif [ "$i" = -E ]; then
+    elif [ "$p" = -E ]; then
         dontLink=1
-    elif [ "$i" = -E ]; then
+    elif [ "$p" = -E ]; then
         dontLink=1
-    elif [ "$i" = -M ]; then
+    elif [ "$p" = -M ]; then
         dontLink=1
-    elif [ "$i" = -MM ]; then
+    elif [ "$p" = -MM ]; then
         dontLink=1
-    elif [ "$i" = -x ]; then
-        # At least for the cases c-header or c++-header we should set dontLink.
-        # I expect no one use -x other than making precompiled headers.
+    elif [[ "$p" = -x && "$p2" = *-header ]]; then
         dontLink=1
+    elif [[ "$p" = -x && "$p2" = c++* && "$isCpp" = 0 ]]; then
+        isCpp=1
+    elif [ "$p" = -nostdlib ]; then
+        isCpp=-1
     elif [ "${i:0:1}" != - ]; then
         nonFlagArgs=1
     elif [ "$i" = -m32 ]; then
@@ -45,6 +53,7 @@ for i in "$@"; do
             NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
+    n=$((n + 1))
 done
 
 # If we pass a flag like -Wl, then gcc will call the linker unless it
@@ -58,7 +67,6 @@ fi
 
 
 # Optionally filter out paths not refering to the store.
-params=("$@")
 if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
     rest=()
     n=0
@@ -76,18 +84,30 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
         elif [ "$p" = -isystem ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
         else
-            rest=("${rest[@]}" "$p")
+            rest+=("$p")
         fi
         n=$((n + 1))
     done
     params=("${rest[@]}")
 fi
 
-if [[ "@prog@" = *++ ]]; then
-    if  echo "$@" | grep -qv -- -nostdlib; then
-        NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
-        NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK $NIX_CXXSTDLIB_LINK"
-    fi
+
+# Clear march/mtune=native -- they bring impurity.
+if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
+    rest=()
+    for i in "${params[@]}"; do
+        if [[ "$i" = -m*=native ]]; then
+            skip $i
+        else
+            rest+=("$i")
+        fi
+    done
+    params=("${rest[@]}")
+fi
+
+if [[ "$isCpp" = 1 ]]; then
+    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE ${NIX_CXXSTDLIB_COMPILE-@default_cxx_stdlib_compile@}"
+    NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK $NIX_CXXSTDLIB_LINK"
 fi
 
 # Add the flags for the C compiler proper.
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index 06858da512a7..0d74527dd8ad 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -62,7 +62,7 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
         elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
             skip $p
         else
-            rest=("${rest[@]}" "$p")
+            rest+=("$p")
         fi
         n=$((n + 1))
     done
@@ -70,6 +70,20 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
 fi
 
 
+# Clear march/mtune=native -- they bring impurity.
+if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
+    rest=()
+    for i in "${params[@]}"; do
+        if [[ "$i" = -m*=native ]]; then
+            skip $i
+        else
+            rest+=("$i")
+        fi
+    done
+    params=("${rest[@]}")
+fi
+
+
 # Add the flags for the GNAT compiler proper.
 extraAfter=($NIX_GNATFLAGS_COMPILE)
 extraBefore=()
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 955b3767a62f..28d73f046e68 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -146,11 +146,26 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
 
     # Finally, add `-rpath' switches.
     for i in $rpath; do
-        extra=(${extra[@]} -rpath $i)
+        extra+=(-rpath $i)
     done
 fi
 
 
+# Only add --build-id if this is a final link. FIXME: should build gcc
+# with --enable-linker-build-id instead?
+if [ "$NIX_SET_BUILD_ID" = 1 ]; then
+    for p in "${params[@]}"; do
+        if [ "$p" = "-r" -o "$p" = "--relocatable" -o "$p" = "-i" ]; then
+            relocatable=1
+            break
+        fi
+    done
+    if [ -z "$relocatable" ]; then
+        extra+=(--build-id)
+    fi
+fi
+
+
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
   echo "original flags to @prog@:" >&2
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index d8fb88b41d18..f4f7ab181d3e 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -23,19 +23,19 @@ envHooks+=(addCVars)
 # Note: these come *after* $out in the PATH (see setup.sh).
 
 if [ -n "@cc@" ]; then
-    addToSearchPath PATH @cc@/bin
+    addToSearchPath _PATH @cc@/bin
 fi
 
 if [ -n "@binutils_bin@" ]; then
-    addToSearchPath PATH @binutils_bin@/bin
+    addToSearchPath _PATH @binutils_bin@/bin
 fi
 
 if [ -n "@libc_bin@" ]; then
-    addToSearchPath PATH @libc_bin@/bin
+    addToSearchPath _PATH @libc_bin@/bin
 fi
 
 if [ -n "@coreutils_bin@" ]; then
-    addToSearchPath PATH @coreutils_bin@/bin
+    addToSearchPath _PATH @coreutils_bin@/bin
 fi
 
 if [ -z "$crossConfig" ]; then
diff --git a/pkgs/build-support/dotnetbuildhelpers/default.nix b/pkgs/build-support/dotnetbuildhelpers/default.nix
index ed0d4f790c81..0edfd0b467ab 100644
--- a/pkgs/build-support/dotnetbuildhelpers/default.nix
+++ b/pkgs/build-support/dotnetbuildhelpers/default.nix
@@ -1,5 +1,5 @@
-{ helperFunctions, mono, pkgconfig }:
-  helperFunctions.runCommand
+{ runCommand, mono, pkgconfig }:
+  runCommand
     "dotnetbuildhelpers"
     { preferLocalBuild = true; }
     ''
diff --git a/pkgs/build-support/fetchbower/default.nix b/pkgs/build-support/fetchbower/default.nix
index 7c6b1a8a0983..11d88ae10e9f 100644
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@@ -1,11 +1,26 @@
-{ stdenv, fetch-bower, git }: name: version: target: outputHash: stdenv.mkDerivation {
-  name = "${name}-${version}";
-  buildCommand = ''
-    out=$PWD/out fetch-bower ${name} ${version} ${target}
-    cp -R out $out
-  '';
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  inherit outputHash;
-  buildInputs = [git fetch-bower];
-}
+{ stdenv, lib, bower2nix }:
+let
+  bowerVersion = version:
+    let
+      components = lib.splitString "#" version;
+      hash = lib.last components;
+      ver = if builtins.length components == 1 then version else hash;
+    in ver;
+
+  fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
+    name = "${name}-${bowerVersion version}";
+    buildCommand = ''
+      fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
+      # In some cases, the result of fetchBower is different depending
+      # on the output directory (e.g. if the bower package contains
+      # symlinks). So use a local output directory before copying to
+      # $out.
+      cp -R out $out
+    '';
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    inherit outputHash;
+    buildInputs = [ bower2nix ];
+  };
+
+in fetchbower
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index 2c9d61504ed2..9352757ea806 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -118,7 +118,7 @@ url_to_name(){
     # basename removes the / and .git suffixes
     local base=$(basename "$url" .git)
 
-    if [[ $ref =~ [a-z0-9]+ ]]; then
+    if [[ $ref =~ ^[a-z0-9]+$ ]]; then
         echo "$base-${ref:0:7}"
     else
         echo $base
@@ -327,7 +327,12 @@ print_results() {
         echo "{"
         echo "  \"url\": \"$url\","
         echo "  \"rev\": \"$fullRev\","
-        echo "  \"$hashType\": \"$hash\""
+        echo -n "  \"$hashType\": \"$hash\""
+        if test -n "$fetchSubmodules"; then
+            echo ","
+            echo -n "  \"fetchSubmodules\": true"
+        fi
+        echo ""
         echo "}"
     fi
 }
diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix
index 474dbfaff4d0..b6719abed701 100644
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@@ -4,8 +4,7 @@ with lib;
 
 let
   cfg = {
-    stable  = grsecOptions.stable  or false;
-    testing = grsecOptions.testing or false;
+    kernelPatch = grsecOptions.kernelPatch;
     config = {
       mode = "auto";
       sysctl = false;
@@ -22,18 +21,13 @@ let
 
   vals = rec {
 
-    mkKernel = kernel: patch:
-      assert patch.kversion == kernel.version;
-        { inherit kernel patch;
-          inherit (patch) grversion revision;
+    mkKernel = patch:
+        {
+          inherit patch;
+          inherit (patch) kernel patches grversion revision;
         };
 
-    test-patch = with pkgs.kernelPatches; grsecurity_unstable;
-    stable-patch = with pkgs.kernelPatches; grsecurity_stable;
-
-    grKernel = if cfg.stable
-               then mkKernel pkgs.linux_3_14 stable-patch
-               else mkKernel pkgs.linux_4_3 test-patch;
+    grKernel = mkKernel cfg.kernelPatch;
 
     ## -- grsecurity configuration ---------------------------------------------
 
@@ -90,8 +84,8 @@ let
 
           # Disable restricting links under the testing kernel, as something
           # has changed causing it to fail miserably during boot.
-          restrictLinks = optionalString cfg.testing
-            "GRKERNSEC_LINK n";
+          #restrictLinks = optionalString cfg.testing
+          #  "GRKERNSEC_LINK n";
       in ''
         GRKERNSEC y
         ${grsecMainConfig}
@@ -109,7 +103,6 @@ let
         GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
         GRKERNSEC_DENYUSB ${boolToKernOpt cfg.config.denyUSB}
         GRKERNSEC_NO_RBAC ${boolToKernOpt cfg.config.disableRBAC}
-        ${restrictLinks}
 
         ${cfg.config.kernelExtraConfig}
       '';
@@ -123,12 +116,14 @@ let
     grsecurityOverrider = args: grkern: {
       # Apparently as of gcc 4.6, gcc-plugin headers (which are needed by PaX plugins)
       # include libgmp headers, so we need these extra tweaks
-      buildInputs = args.buildInputs ++ [ pkgs.gmp ];
+      # As of gcc5 we also need libmpc
+      buildInputs = args.buildInputs ++ [ pkgs.gmp pkgs.libmpc pkgs.mpfr ];
       preConfigure = ''
+        extraIncludes="-I${pkgs.gmp.dev}/include -I${pkgs.libmpc}/include -I${pkgs.mpfr.dev}/include"
         ${args.preConfigure or ""}
-        sed -i 's|-I|-I${pkgs.gmp.dev}/include -I|' scripts/gcc-plugin.sh
-        sed -i 's|HOST_EXTRACFLAGS +=|HOST_EXTRACFLAGS += -I${pkgs.gmp.dev}/include|' tools/gcc/Makefile
-        sed -i 's|HOST_EXTRACXXFLAGS +=|HOST_EXTRACXXFLAGS += -I${pkgs.gmp.dev}/include|' tools/gcc/Makefile
+        sed -i "s|-I|$extraIncludes -I|" scripts/gcc-plugin.sh
+        sed -i "s|HOST_EXTRACFLAGS +=|HOST_EXTRACFLAGS += $extraIncludes|" tools/gcc/Makefile
+        sed -i "s|HOST_EXTRACXXFLAGS +=|HOST_EXTRACXXFLAGS += $extraIncludes|" tools/gcc/Makefile
         rm localversion-grsec
         echo ${localver grkern} > localversion-grsec
       '';
@@ -136,7 +131,7 @@ let
 
     mkGrsecKern = grkern:
       lowPrio (overrideDerivation (grkern.kernel.override (args: {
-        kernelPatches = args.kernelPatches ++ [ grkern.patch pkgs.kernelPatches.grsec_fix_path ];
+        kernelPatches = args.kernelPatches ++ [ grkern.patch  ] ++ grkern.patches;
         argsOverride = {
           modDirVersion = "${grkern.kernel.modDirVersion}${localver grkern}";
         };
diff --git a/pkgs/build-support/grsecurity/flavors.nix b/pkgs/build-support/grsecurity/flavors.nix
index 969ca579f5a6..1281d60aa328 100644
--- a/pkgs/build-support/grsecurity/flavors.nix
+++ b/pkgs/build-support/grsecurity/flavors.nix
@@ -1,26 +1,17 @@
 let
-  mkOpts = ver: prio: sys: virt: swvirt: hwvirt:
+  mkOpts = prio: sys: virt: swvirt: hwvirt:
     { config.priority               = prio;
       config.system                 = sys;
       config.virtualisationConfig   = virt;
       config.hardwareVirtualisation = hwvirt;
       config.virtualisationSoftware = swvirt;
-    } // builtins.listToAttrs [ { name = ver; value = true; } ];
+    };
 in
 {
-  # Stable kernels
-  linux_grsec_stable_desktop =
-    mkOpts "stable" "performance" "desktop" "host" "kvm" true;
-  linux_grsec_stable_server  =
-    mkOpts "stable" "security" "server" "host" "kvm" true;
-  linux_grsec_stable_server_xen =
-    mkOpts "stable" "security" "server" "guest" "xen" true;
-
-  # Testing kernels
-  linux_grsec_testing_desktop =
-    mkOpts "testing" "performance" "desktop" "host" "kvm" true;
-  linux_grsec_testing_server  =
-    mkOpts "testing" "security" "server" "host" "kvm" true;
-  linux_grsec_testing_server_xen =
-    mkOpts "testing" "security" "server" "guest" "xen" true;
+  desktop =
+    mkOpts "performance" "desktop" "host" "kvm" true;
+  server  =
+    mkOpts "security" "server" "host" "kvm" true;
+  server_xen =
+    mkOpts "security" "server" "guest" "xen" true;
 }
diff --git a/pkgs/build-support/ocaml/default.nix b/pkgs/build-support/ocaml/default.nix
index 87bfa6cea120..50f7627568d2 100644
--- a/pkgs/build-support/ocaml/default.nix
+++ b/pkgs/build-support/ocaml/default.nix
@@ -11,7 +11,7 @@
 let
   ocaml_version = (builtins.parseDrvName ocaml.name).version;
   defaultMeta = {
-    platforms = ocaml.meta.platforms;
+    platforms = ocaml.meta.platforms or [];
   };
 in
   assert minimumSupportedOcamlVersion != null ->
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 5150b4f0218a..7d0f88abb855 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -19,6 +19,12 @@ makeWrapper() {
             echo "export $varName=$value" >> $wrapper
         fi
 
+        if test "$p" = "--unset"; then
+            varName=${params[$((n + 1))]}
+            n=$((n + 1))
+            echo "unset $varName" >> "$wrapper"
+        fi
+
         if test "$p" = "--run"; then
             command=${params[$((n + 1))]}
             n=$((n + 1))
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index 37753d9ce406..518be9647334 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -1,5 +1,6 @@
-export NIX_LDFLAGS+=" --build-id"
-export NIX_CFLAGS_COMPILE+=" -ggdb"
+export NIX_SET_BUILD_ID=1
+export NIX_LDFLAGS+=" --compress-debug-sections=zlib"
+export NIX_CFLAGS_COMPILE+=" -ggdb -Wa,--compress-debug-sections"
 dontStrip=1
 
 fixupOutputHooks+=(_separateDebugInfo)
@@ -25,18 +26,10 @@ _separateDebugInfo() {
         # Extract the debug info.
         header "separating debug info from $i (build ID $id)"
         mkdir -p "$dst/${id:0:2}"
-        objcopy --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug" --compress-debug-sections
+        objcopy --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
         strip --strip-debug "$i"
 
         # Also a create a symlink <original-name>.debug.
         ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
     done < <(find "$prefix" -type f -print0)
 }
-
-# - We might prefer to compress the debug info during link-time already,
-#   but our ld doesn't support --compress-debug-sections=zlib (yet).
-# - Debug info may cause problems due to excessive memory usage during linking.
-#   Using -Wa,--compress-debug-sections should help with that;
-#   further interesting information: https://gcc.gnu.org/wiki/DebugFission
-# - Another related tool: https://fedoraproject.org/wiki/Features/DwarfCompressor
-
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
index 9e0cd22c1198..3cad1838d260 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@@ -11,7 +11,7 @@ envHooks+=(find_gio_modules)
 # Note: $gappsWrapperArgs still gets defined even if $dontWrapGApps is set.
 wrapGAppsHook() {
   # guard against running multiple times (e.g. due to propagation)
-  [ -z "$wrapGAppsHookHasRun" ] || return
+  [ -z "$wrapGAppsHookHasRun" ] || return 0
   wrapGAppsHookHasRun=1
 
   if [ -n "$GDK_PIXBUF_MODULE_FILE" ]; then
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 93b8b1cbc428..fef91e1d89dc 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -48,7 +48,10 @@ rec {
 
   # Create a forest of symlinks to the files in `paths'.
   symlinkJoin = name: paths:
-    runCommand name { inherit paths; }
+    runCommand name
+      { inherit paths;
+        preferLocalBuild = true; allowSubstitutes = false;
+      }
       ''
         mkdir -p $out
         for i in $paths; do
diff --git a/pkgs/build-support/vm/windows/cygwin-iso/default.nix b/pkgs/build-support/vm/windows/cygwin-iso/default.nix
index b560a850a306..625071c9c33c 100644
--- a/pkgs/build-support/vm/windows/cygwin-iso/default.nix
+++ b/pkgs/build-support/vm/windows/cygwin-iso/default.nix
@@ -16,7 +16,7 @@ let
     sha256 = "1slyj4qha7x649ggwdski9spmyrbs04z2d46vgk8krllg0kppnjv";
   };
 
-  cygwinCross = (import ../../../../top-level/all-packages.nix {
+  cygwinCross = (import ../../../../.. {
     inherit (stdenv) system;
     crossSystem = {
       libc = "msvcrt";