Merge commit '2e56ba' from staging into master

51 files changed, 137 insertions, 124 deletions

diff --git a/pkgs/development/compilers/go/1.7.nix b/pkgs/development/compilers/go/1.7.nix
index b1230da5a142..82ed9b53c60f 100644
--- a/pkgs/development/compilers/go/1.7.nix
+++ b/pkgs/development/compilers/go/1.7.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch ];
-  buildInputs = [ pcre ];
+  buildInputs = [ cacert pcre ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
   hardeningDisable = [ "all" ];
@@ -116,8 +116,6 @@ stdenv.mkDerivation rec {
       })
     ];
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.8.nix b/pkgs/development/compilers/go/1.8.nix
index 23fd3b0f2912..651eb79d75a7 100644
--- a/pkgs/development/compilers/go/1.8.nix
+++ b/pkgs/development/compilers/go/1.8.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -122,8 +122,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/go/1.9.nix b/pkgs/development/compilers/go/1.9.nix
index e908a8725e2a..aab7964148b4 100644
--- a/pkgs/development/compilers/go/1.9.nix
+++ b/pkgs/development/compilers/go/1.9.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   # perl is used for testing go vet
   nativeBuildInputs = [ perl which pkgconfig patch makeWrapper ]
     ++ optionals stdenv.isLinux [ procps ];
-  buildInputs = [ pcre ]
+  buildInputs = [ cacert pcre ]
     ++ optionals stdenv.isLinux [ stdenv.glibc.out stdenv.glibc.static ];
   propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ];
 
@@ -128,8 +128,6 @@ stdenv.mkDerivation rec {
     substituteInPlace "src/cmd/link/internal/ld/lib.go" --replace dsymutil ${llvm}/bin/llvm-dsymutil
   '';
 
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
            else if stdenv.system == "i686-linux" then "386"
diff --git a/pkgs/development/compilers/llvm/3.8/clang/default.nix b/pkgs/development/compilers/llvm/3.8/clang/default.nix
index 90b8ea2581e8..388c24e63364 100644
--- a/pkgs/development/compilers/llvm/3.8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/clang/default.nix
@@ -29,7 +29,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -38,6 +38,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -51,7 +54,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.8/default.nix b/pkgs/development/compilers/llvm/3.8/default.nix
index a660d4aea5fd..9e37f93dbddc 100644
--- a/pkgs/development/compilers/llvm/3.8/default.nix
+++ b/pkgs/development/compilers/llvm/3.8/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/3.9/clang/default.nix b/pkgs/development/compilers/llvm/3.9/clang/default.nix
index ec2ec27df363..f215aadc4d98 100644
--- a/pkgs/development/compilers/llvm/3.9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/clang/default.nix
@@ -31,7 +31,7 @@ let
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' lib/Driver/ToolChains.cpp
     '';
 
-    outputs = [ "out" "python" ];
+    outputs = [ "out" "lib" "python" ];
 
     # Clang expects to find LLVMgold in its own prefix
     # Clang expects to find sanitizer libraries in its own prefix
@@ -40,6 +40,9 @@ let
       ln -sv ${llvm}/lib/clang/${version}/lib $out/lib/clang/${version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
@@ -53,7 +56,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/3.9/default.nix b/pkgs/development/compilers/llvm/3.9/default.nix
index c58adc3f92da..a675bcceb1c9 100644
--- a/pkgs/development/compilers/llvm/3.9/default.nix
+++ b/pkgs/development/compilers/llvm/3.9/default.nix
@@ -22,6 +22,8 @@ let
       inherit clang-tools-extra_src stdenv;
     };
 
+    libclang = self.clang-unwrapped.lib;
+
     clang = if stdenv.cc.isGNU then self.libstdcxxClang else self.libcxxClang;
 
     libstdcxxClang = ccWrapperFun {
diff --git a/pkgs/development/compilers/llvm/4/clang/default.nix b/pkgs/development/compilers/llvm/4/clang/default.nix
index 8d40ee3c8aa2..404b65c56ab7 100644
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@@ -49,7 +49,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -59,13 +59,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -79,7 +81,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/4/default.nix b/pkgs/development/compilers/llvm/4/default.nix
index 5a44cb868253..89cb181e405e 100644
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index b003d2f334ac..aaddd020a729 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -50,7 +50,7 @@ let
       sed -i '1s,^,find_package(Sphinx REQUIRED)\n,' docs/CMakeLists.txt
     '';
 
-    outputs = [ "out" "python" ]
+    outputs = [ "out" "lib" "python" ]
       ++ stdenv.lib.optional enableManpages "man";
 
     # Clang expects to find LLVMgold in its own prefix
@@ -60,13 +60,15 @@ let
       ln -sv ${llvm}/lib/clang/${release_version}/lib $out/lib/clang/${release_version}/
       ln -sv $out/bin/clang $out/bin/cpp
 
+      # Move libclang to 'lib' output
+      moveToOutput "lib/libclang.*" "$lib"
+
       mkdir -p $python/bin $python/share/clang/
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
-
       rm $out/bin/c-index-test
     ''
     + stdenv.lib.optionalString enableManpages ''
@@ -80,7 +82,6 @@ let
     enableParallelBuilding = true;
 
     passthru = {
-      lib = self; # compatibility with gcc, so that `stdenv.cc.cc.lib` works on both
       isClang = true;
       inherit llvm;
     } // stdenv.lib.optionalAttrs stdenv.isLinux {
diff --git a/pkgs/development/compilers/llvm/5/default.nix b/pkgs/development/compilers/llvm/5/default.nix
index a7e16c08ce96..26342095da79 100644
--- a/pkgs/development/compilers/llvm/5/default.nix
+++ b/pkgs/development/compilers/llvm/5/default.nix
@@ -34,6 +34,7 @@ let
     llvm = overrideManOutput llvm;
     clang-unwrapped = overrideManOutput clang-unwrapped;
 
+    libclang = self.clang-unwrapped.lib;
     llvm-manpages = lowPrio self.llvm.man;
     clang-manpages = lowPrio self.clang-unwrapped.man;
 
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index fb3001bbf17b..386ffa622944 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   passthru.rustc = rustc;
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ file curl python openssl cmake zlib makeWrapper libgit2 ]
+  buildInputs = [ cacert file curl python openssl cmake zlib makeWrapper libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation libiconv ];
 
   LIBGIT2_SYS_USE_PKG_CONFIG=1;
@@ -48,8 +48,6 @@ rustPlatform.buildRustPackage rec {
   '';
 
   checkPhase = ''
-    # Export SSL_CERT_FILE as without it one test fails with SSL verification error
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     # Disable cross compilation tests
     export CFG_DISABLE_CROSS_TESTS=1
     cargo test
diff --git a/pkgs/development/interpreters/erlang/R16B02-basho.nix b/pkgs/development/interpreters/erlang/R16B02-basho.nix
index 33c34f7fecc0..714924514edb 100644
--- a/pkgs/development/interpreters/erlang/R16B02-basho.nix
+++ b/pkgs/development/interpreters/erlang/R16B02-basho.nix
@@ -36,7 +36,7 @@ mkDerivation rec {
     tar xf "${manpages}" -C "$out/lib/erlang"
     for i in "$out"/lib/erlang/man/man[0-9]/*.[0-9]; do
       prefix="''${i%/*}"
-      ensureDir "$out/share/man/''${prefix##*/}"
+      mkdir -p "$out/share/man/''${prefix##*/}"
       ln -s "$i" "$out/share/man/''${prefix##*/}/''${i##*/}erl"
     done
   '';
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 9a01cdfe8749..b79900288c97 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -3,11 +3,15 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.6.0";
+  name = "boehm-gc-${version}";
+  version = "7.6.2";
 
   src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.6.0.tar.gz;
-    sha256 = "143x7g0d0k6250ai6m2x3l4y352mzizi4wbgrmahxscv2aqjhjm1";
+    urls = [
+      "http://www.hboehm.info/gc/gc_source/gc-${version}.tar.gz"
+      "https://github.com/ivmai/bdwgc/releases/download/v${version}/gc-${version}.tar.gz"
+    ];
+    sha256 = "07nli9hgdzc09qzw169sn7gchkrn5kqgyniv2rspcy1xaq2j04dx";
   };
 
   buildInputs = [ libatomic_ops ];
@@ -25,12 +29,6 @@ stdenv.mkDerivation rec {
   # Don't run the native `strip' when cross-compiling.
   dontStrip = hostPlatform != buildPlatform;
 
-  postInstall =
-    ''
-      mkdir -p $out/share/doc
-      mv $out/share/gc $out/share/doc/gc
-    '';
-
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/libraries/dleyna-core/setup-hook.sh b/pkgs/development/libraries/dleyna-core/setup-hook.sh
index 046a77d5a4dd..87b5c67dff58 100644
--- a/pkgs/development/libraries/dleyna-core/setup-hook.sh
+++ b/pkgs/development/libraries/dleyna-core/setup-hook.sh
@@ -5,5 +5,4 @@ addDleynaConnectorPath () {
     fi
 }
 
-envHooks+=(addDleynaConnectorPath)
-
+addEnvHooks "$targetOffset" addDleynaConnectorPath
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 7a602f5430eb..310aaa430daf 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.13";
+  name = "gdbm-1.14";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "0lx201q20dvc70f8a3c9s7s18z15inlxvbffph97ngvrgnyjq9cx";
+    sha256 = "02dakgrq93xwgln8qfv3vs5jyz5yvds5nyzkx6rhg9v585x478dd";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index fe3ef1f9e15d..5932ef6a44f9 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -4,4 +4,4 @@ gettextDataDirsHook() {
     fi
 }
 
-envHooks+=(gettextDataDirsHook)
+addEnvHooks "$hostOffset" gettextDataDirsHook
diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index 98341376fdf6..233845c6541f 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -11,7 +11,7 @@ addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 glibPreInstallPhase() {
   installFlagsArray+=("gsettingsschemadir=${!outputLib}/share/gsettings-schemas/$name/glib-2.0/schemas/")
 }
-preInstallPhases+=(glibPreInstallPhase)
+preInstallPhases+=" glibPreInstallPhase"
 
 glibPreFixupPhase() {
     # Move gschemas in case the install flag didn't help
@@ -22,5 +22,4 @@ glibPreFixupPhase() {
 
     addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name"
 }
-preFixupPhases+=(glibPreFixupPhase)
-
+preFixupPhases+=" glibPreFixupPhase"
diff --git a/pkgs/development/libraries/glibc/2.26-115to131.diff.gz b/pkgs/development/libraries/glibc/2.26-115to131.diff.gz
new file mode 100644
index 000000000000..3d866c567a79
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.26-115to131.diff.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index cfec3209b98a..f68970ae13e2 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -20,7 +20,7 @@
 
 let
   version = "2.26";
-  patchSuffix = "-115";
+  patchSuffix = "-131";
   sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5";
   cross = if buildPlatform != hostPlatform then hostPlatform else null;
 in
@@ -48,6 +48,9 @@ stdenv.mkDerivation ({
       */
       ./2.26-75.patch.gz
       ./2.26-75to115.diff.gz
+      # contains fix for CVE-2018-1000001 as the last commit:
+      # https://sourceware.org/git/?p=glibc.git;a=commit;h=fabef2edbc
+      ./2.26-115to131.diff.gz
 
       /* Have rpcgen(1) look for cpp(1) in $PATH.  */
       ./rpcgen-path.patch
@@ -73,7 +76,7 @@ stdenv.mkDerivation ({
         and we lose early mismatch detection on 2.6.32.
 
         On major glibc updates we should check that the patched kernel supports
-        all the required features.  ATM it's verified up to glibc-2.26-115.
+        all the required features.  ATM it's verified up to glibc-2.26-131.
         # HOWTO: check glibc sources for changes in kernel requirements
         git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
         # get kernel sources (update the URL)
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 2414931e76aa..73fa1f311bff 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -27,8 +27,6 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  checkPhase = "meson test";
-
   meta = with stdenv.lib; {
     homepage = http://live.gnome.org/JsonGlib;
     description = "A library providing (de)serialization support for the JavaScript Object Notation (JSON) format";
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index eedc0993d736..3aae754be405 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.0";
+  version = "7.6.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 ="03ylfr29g9zc0r6b6axz3i68alj5qmxgzknxwam3jlx0sz8hcb4f";
+    sha256 ="1rif2hjscq5mh639nsnjhb90c01gnmy1sbmj6x6hsn1xmpnj95r1";
   };
 
   nativeBuildInputs = stdenv.lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index db4c0c7738de..a0f7807786ea 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
 
   doCheck = testsSupport;
 
-  checkPhase = "meson test";
-
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
     homepage    = http://www.freedesktop.org/wiki/Software/libinput;
diff --git a/pkgs/development/python-modules/aniso8601/default.nix b/pkgs/development/python-modules/aniso8601/default.nix
index 6e61e84a5d53..ba60922856ef 100644
--- a/pkgs/development/python-modules/aniso8601/default.nix
+++ b/pkgs/development/python-modules/aniso8601/default.nix
@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "aniso8601";
-  version = "1.3.0";
+  version = "2.0.0";
   name = "${pname}-${version}";
 
   meta = with stdenv.lib; {
@@ -16,6 +16,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3b5246f5601b6ae5671911bc4ee5b3e3fe94752e8afab5ce074d8b1232952f1";
+    sha256 = "085786415d3550e89785ffbedaa9bb37d41de0707a1268bdbba11249064b71d1";
   };
 }
diff --git a/pkgs/development/python-modules/argon2_cffi/default.nix b/pkgs/development/python-modules/argon2_cffi/default.nix
index 80985f868c7a..f46efd9f496e 100644
--- a/pkgs/development/python-modules/argon2_cffi/default.nix
+++ b/pkgs/development/python-modules/argon2_cffi/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "argon2_cffi";
-  version = "16.3.0";
+  version = "18.1.0";
   name    = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ap3il3j1pjyprrhpfyhc21izpmhzhfb5s69vlzc65zvd1nj99cr";
+    sha256 = "7e4b75611b73f53012117ad21cdde7a17b32d1e99ff6799f22d827eb83a2a59b";
   };
 
   propagatedBuildInputs = [ cffi six ];
diff --git a/pkgs/development/python-modules/backports_lzma/default.nix b/pkgs/development/python-modules/backports_lzma/default.nix
index 9b622eb6b065..6f7a45a4fe88 100644
--- a/pkgs/development/python-modules/backports_lzma/default.nix
+++ b/pkgs/development/python-modules/backports_lzma/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "backports.lzma";
-  version = "0.0.8";
+  version = "0.0.9";
 
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "200584ad5079d8ca6b1bfe14890c7be58666ab0128d8ca26cfb2669b476085f3";
+    sha256 = "9ba5d94214a79900ee297a594b8e154cd8e4a54d26eb06243c0e2f3ad5286539";
   };
 
   buildInputs = [ lzma ];
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index 1a20639c2dea..88209ad3fd1b 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -9,9 +9,9 @@ let
   };
   setuptools_source = fetchPypi {
     pname = "setuptools";
-    version = "38.2.5";
+    version = "38.4.0";
     format = "wheel";
-    sha256 = "bcf0d4f3e2f7890e658db11e218b8643afffb905a0e2f2a7d5a6a3e949bb87e6";
+    sha256 = "155c2ec9fdcc00c3973d966b416e1cf3a1e7ce75f4c09fb760b23f94b935926e";
   };
 
   # TODO: Shouldn't be necessary anymore for pip > 9.0.1!
diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 83b1c893719d..9c5a2b2110ce 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -23,6 +23,12 @@ buildPythonPackage rec {
   checkInputs = [ nose ];
   propagatedBuildInputs = [ toolz ];
 
+  # File as accidentally included in release
+  # See https://github.com/pytoolz/cytoolz/issues/116#issuecomment-355770073
+  postPatch = ''
+    rm cytoolz/tests/test_curried_doctests.py
+  '';
+
   # Disable failing test https://github.com/pytoolz/cytoolz/issues/97
   checkPhase = ''
     NOSE_EXCLUDE=test_curried_exceptions nosetests -v $out/${python.sitePackages}
diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index c90fb61ce03a..f819a234146b 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -4,11 +4,11 @@
 buildPythonPackage rec {
   pname = "daphne";
   name = "${pname}-${version}";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1xmmjp21m1w88ljsgnkf6cbzw5nxamh9cfmfgzxffpn4cdmvn96i";
+    sha256 = "302725f223853b05688f28c361e050f8db9568b1ce27340c76272c26b49e6d72";
   };
 
   buildInputs = [ hypothesis ];
diff --git a/pkgs/development/python-modules/datashape/default.nix b/pkgs/development/python-modules/datashape/default.nix
index 81ead8431695..9177e9f0ff48 100644
--- a/pkgs/development/python-modules/datashape/default.nix
+++ b/pkgs/development/python-modules/datashape/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pytest
 , mock
 , numpy
@@ -8,14 +8,24 @@
 , dateutil
 }:
 
-buildPythonPackage rec {
+let
+  # Fetcher function looks similar to fetchPypi.
+  # Allows for easier overriding, without having to know
+  # how the source is actually fetched.
+  fetcher = {pname, version, sha256}: fetchFromGitHub {
+    owner = "blaze";
+    repo = pname;
+    rev = version;
+    inherit sha256;
+  };
+
+in buildPythonPackage rec {
   pname = "datashape";
-  version = "0.5.2";
-  name = "${pname}-${version}";
+  version = "0.5.4";
 
-  src = fetchPypi {
+  src = fetcher {
     inherit pname version;
-    sha256 = "2356ea690c3cf003c1468a243a9063144235de45b080b3652de4f3d44e57d783";
+    sha256 = "0rhlj2kjj1vx5m73wnc5518rd6cs1zsbgpsvzk893n516k69shcf";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/dyn/default.nix b/pkgs/development/python-modules/dyn/default.nix
index 881f51b69aa0..efb9cab8048d 100644
--- a/pkgs/development/python-modules/dyn/default.nix
+++ b/pkgs/development/python-modules/dyn/default.nix
@@ -3,12 +3,12 @@
 
 buildPythonPackage rec {
   pname = "dyn";
-  version = "1.8.0";
+  version = "1.8.1";
   name  = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4ab3cd9a1478674cf2d2aa6740fb0ddf77daaa9ab3e35e5d2bc92f60301f8523";
+    sha256 = "e112149d48b4500c18b3cfb6e0e6e780bb5aa0e56ff87cac412280200b9ec8bf";
   };
 
   buildInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index a22e1581b68d..5d617ba9369b 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "2.0.14";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ee355eb66e4c2e5d95689e1253515aad5b3177c274abdd00a57d5ab1aa6d071a";
+    sha256 = "b3ad481724adfb2280773edd95ce501e497e88fa4489c6e41e637ab3fd9a456c";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index eeb51fb58434..3fe7dc751c86 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ea1336f0d1158c4e00e96a94df84b75f6bbff9816abb6cc68cbdc9442a9ac55";
+    sha256 = "6ce5fd3093ddc09a152981d5c477ac645eda19dfcc819e45d8c57da6b743bd53";
   };
 
   propagatedBuildInputs = [ six protobuf ]
diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index e88b7f937a55..42d7752eda3b 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ca30cf1786047925ebacd6f6faa3a993efaa004b584f7d83bc8b807f7cd3f6bb";
+    sha256 = "462790d46b244f0a631ea5e3cd5cdbad6874d5d24cc0ff512deb7c16cdf8653d";
   };
 
   checkInputs = [ ipykernel ipython mock pytest ];
@@ -29,10 +29,6 @@ buildPythonPackage rec {
     py.test
   '';
 
-  patches = [
-    ./wheel_workaround.patch
-  ];
-
   # Circular dependency with ipykernel
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch b/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
deleted file mode 100644
index 926fcb26448b..000000000000
--- a/pkgs/development/python-modules/jupyter_client/wheel_workaround.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 95d4774..ee72cbc 100644
---- a/setup.py
-+++ b/setup.py
-@@ -86,7 +86,7 @@ setup_args = dict(
-     extras_require   = {
-         'test': ['ipykernel', 'ipython', 'mock'],
-         'test:python_version == "3.3"': ['pytest<3.3.0'],
--        'test:python_version >= "3.4" or python_version == "2.7"': ['pytest'],
-+        'test:(python_version >= "3.4" or python_version == "2.7")': ['pytest'],
-     },
-     cmdclass         = {
-         'bdist_egg': bdist_egg if 'bdist_egg' in sys.argv else bdist_egg_disabled,
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 4be9c911f71a..034748255277 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -1,14 +1,17 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPyPy,
-  nose, olefile,
-  freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11}:
+{ stdenv, buildPythonPackage, fetchPypi, isPyPy
+, olefile
+, freetype, libjpeg, zlib, libtiff, libwebp, tcl, lcms2, tk, libX11
+, pytestrunner
+, pytest
+}:
 buildPythonPackage rec {
   pname = "Pillow";
-  version = "4.3.0";
+  version = "5.0.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a97c715d44efd5b4aa8d739b8fad88b93ed79f1b33fc2822d5802043f3b1b527";
+    sha256 = "12f29d6c23424f704c66b5b68c02fe0b571504459605cfe36ab8158359b0e1bb";
   };
 
   doCheck = !stdenv.isDarwin && !isPyPy;
@@ -21,8 +24,10 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ olefile ];
 
+  checkInputs = [ pytest pytestrunner ];
+
   buildInputs = [
-    freetype libjpeg zlib libtiff libwebp tcl nose lcms2 ]
+    freetype libjpeg zlib libtiff libwebp tcl lcms2 ]
     ++ stdenv.lib.optionals (isPyPy) [ tk libX11 ];
 
   # NOTE: we use LCMS_ROOT as WEBP root since there is not other setting for webp.
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index b9d07a3fa9b9..6221e08ae574 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.4.2";
+  version = "5.4.3";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "00a1f9ff8d1e035fba7bfdd6977fa8ea7937afdb4477339e5df3dba78194fe11";
+    sha256 = "e2467e9312c2fa191687b89ff4bc2ad8843be4af6fb4dc95a7cc5f7d7a327b18";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/pwntools/default.nix b/pkgs/development/python-modules/pwntools/default.nix
index a186c3995488..b98930dfe594 100644
--- a/pkgs/development/python-modules/pwntools/default.nix
+++ b/pkgs/development/python-modules/pwntools/default.nix
@@ -5,13 +5,13 @@
 , requests, tox, pandoc, unicorn, intervaltree }:
 
 buildPythonPackage rec {
-  version = "3.10.0";
+  version = "3.11.0";
   pname = "pwntools";
   name = pname + "-" + version;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1l8hb30mwxqd1y7r5ihd7kzmjm2mz6m5aiphd3hwzmxkmxbxj8zk";
+    sha256 = "609b3f0ba47c975f4dbedd3da2af4c5ca1b3a2aa13fb99240531b6a68edb87be";
   };
 
   propagatedBuildInputs = [ Mako packaging pysocks pygments ROPGadget capstone paramiko pip psutil pyelftools pypandoc pyserial dateutil requests tox pandoc unicorn intervaltree ];
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index d45fe7deb124..91e22baa4ad1 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -2,7 +2,7 @@
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k
 }:
 buildPythonPackage rec {
-  version = "3.3.1";
+  version = "3.3.2";
   pname = "pytest";
 
   preCheck = ''
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cf8436dc59d8695346fcd3ab296de46425ecab00d64096cebe79fb51ecb2eb93";
+    sha256 = "53548280ede7818f4dc2ad96608b9f08ae2cc2ca3874f2ceb6f97e3583f25bc4";
   };
 
   checkInputs = [ hypothesis ];
diff --git a/pkgs/development/python-modules/python-stdnum/default.nix b/pkgs/development/python-modules/python-stdnum/default.nix
index a78b1ffbee26..44a6b522a4ee 100644
--- a/pkgs/development/python-modules/python-stdnum/default.nix
+++ b/pkgs/development/python-modules/python-stdnum/default.nix
@@ -1,14 +1,14 @@
 { lib, fetchurl, buildPythonPackage, isPy3k }:
 
 buildPythonPackage rec {
-  version = "1.7";
+  version = "1.8.1";
   pname = "python-stdnum";
   name = "${pname}-${version}";
   # Failing tests and dependency issue on Py3k
   disabled = isPy3k;
   src = fetchurl {
     url = "mirror://pypi/p/python-stdnum/${name}.tar.gz";
-    sha256 = "987c25e1047e8742131bcf29dac7a406987adb1463465749e2daaba8cb19d264";
+    sha256 = "d7162fdb29337aebed65700cc7297016f6cd32cae4ad7aed8f7e7531f0217943";
   };
   meta = {
     homepage = http://arthurdejong.org/python-stdnum/;
diff --git a/pkgs/development/python-modules/ropper/default.nix b/pkgs/development/python-modules/ropper/default.nix
index 62ef3f8db19e..b35145872dd1 100644
--- a/pkgs/development/python-modules/ropper/default.nix
+++ b/pkgs/development/python-modules/ropper/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonApplication rec {
   pname = "ropper";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2183feedfe8b01a27301eee07383b481ece01b2319bdba3afebe33e19ca14aa3";
+    sha256 = "77d9b03083d0a098261a1d2856cd330ea3db520511a78472e421a00526aa220c";
   };
   # XXX tests rely on user-writeable /dev/shm to obtain process locks and return PermissionError otherwise
   # workaround: sudo chmod 777 /dev/shm
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index b185be62a693..5535a80fd4a9 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,13 +8,13 @@
 # Should use buildPythonPackage here somehow
 stdenv.mkDerivation rec {
   pname = "setuptools";
-  version = "38.2.5";
+  version = "38.4.0";
   name = "${python.libPrefix}-${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b080f276cc868670540b2c03cee06cc14d2faf9da7bec0f15058d1b402c94507";
+    sha256 = "6501fc32f505ec5b3ed36ec65ba48f1b975f52cf2ea101c7b73a08583fd12f75";
   };
 
   buildInputs = [ python wrapPython unzip ];
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index e89abbd595a9..dd7fdc173e5e 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.1.12";
+  version = "1.2";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "86a1078ceb1e79f891633c7e4c7b07949fd9135a0e4c0738abd5111e2e6b96c0";
+    sha256 = "18ac6392a710f0cc106c28c4e27e43e8f1b25cb46fb8b6714836212607c07b10";
   };
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/texttable/default.nix b/pkgs/development/python-modules/texttable/default.nix
index 38cffcee2963..fc97297c0106 100644
--- a/pkgs/development/python-modules/texttable/default.nix
+++ b/pkgs/development/python-modules/texttable/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "texttable";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "44674d1d470a9fc264c4d1eba44b74463ca0066d7b954453dd5a4f8057779c9c";
+    sha256 = "c89dc0148ae29645917aab7e970a30d1af565b3ca276cef8ab1a60469f0d8100";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index bc39745945d9..db513d1c6140 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tornado";
-  version = "4.5.2";
+  version = "4.5.3";
   name = "${pname}-${version}";
 
   propagatedBuildInputs = [ backports_abc backports_ssl_match_hostname certifi singledispatch ];
@@ -23,6 +23,6 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fb8e494cd46c674d86fac5885a3ff87b0e283937a47d74eb3c02a48c9e89ad0";
+    sha256 = "6d14e47eab0e15799cf3cdcc86b0b98279da68522caace2bd7ce644287685f0a";
   };
 }
diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index b441ad8052c0..0af8c47e35cb 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -9,11 +9,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "typeguard";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0l3pih5ca469v7if255h5rqymirsw46bi6s7p885jxhq1gv6cfpk";
+    sha256 = "40b22d18d2215b76b3ddda2564acfbddfa6e702968637fbd969187c2a6fb99da";
   };
 
   buildInputs = [ setuptools_scm ];
diff --git a/pkgs/development/python-modules/unidecode/default.nix b/pkgs/development/python-modules/unidecode/default.nix
index 9b81a28f085e..3cffe3804900 100644
--- a/pkgs/development/python-modules/unidecode/default.nix
+++ b/pkgs/development/python-modules/unidecode/default.nix
@@ -3,11 +3,11 @@
 buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "Unidecode";
-  version = "0.04.21";
+  version = "1.0.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0lfhp9c5xrbpjvbpr12ji52g1lx04404bzzdg6pvabhzisw6l2i8";
+    sha256 = "8c33dd588e0c9bc22a76eaa0c715a5434851f726131bd44a6c26471746efabf5";
   };
 
   LC_ALL="en_US.UTF-8";
diff --git a/pkgs/development/python-modules/zeep/default.nix b/pkgs/development/python-modules/zeep/default.nix
index e00d6c7e24ba..64b2874ef627 100644
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -25,13 +25,13 @@
 
 let
   pname = "zeep";
-  version = "2.4.0";
+  version = "2.5.0";
 in buildPythonPackage {
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8631e2735c5f2219eb18ca4f0615ae482455628518508f69c3690dbfb8238aee";
+    sha256 = "4f9db52c7d269813fc6251da4cb050869158858aeea75a055b4550f19e52ac84";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index a435ee65e52c..b7b411a7decf 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -3,7 +3,7 @@
 { R, pkgs, overrides }:
 
 let
-  inherit (pkgs) fetchurl stdenv lib;
+  inherit (pkgs) cacert fetchurl stdenv lib;
 
   buildRPackage = pkgs.callPackage ./generic-builder.nix {
     inherit R;
@@ -912,9 +912,7 @@ let
     });
 
     geojsonio = old.geojsonio.overrideDerivation (attrs: {
-      preConfigure = ''
-        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        '';
+      buildInputs = [ cacert ] ++ attrs.buildInputs;
     });
 
     rstan = old.rstan.overrideDerivation (attrs: {
diff --git a/pkgs/development/tools/build-managers/cmake/setup-hook.sh b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
index a92d54b3f144..a0f1cf00814c 100755
--- a/pkgs/development/tools/build-managers/cmake/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/cmake/setup-hook.sh
@@ -43,7 +43,7 @@ cmakeConfigurePhase() {
     # libraries are in a system path or in the same directory as the
     # executable. This flag makes the shared library accessible from its
     # nix/store directory.
-    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=$prefix/lib $cmakeFlags"
+    cmakeFlags="-DCMAKE_INSTALL_NAME_DIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_LIBDIR=${!outputLib}/lib $cmakeFlags"
     cmakeFlags="-DCMAKE_INSTALL_INCLUDEDIR=${!outputDev}/include $cmakeFlags"
 
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 25e2e69ef315..8f96e6146be0 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -25,3 +25,15 @@ if [ -z "$dontUseMesonConfigure" -a -z "$configurePhase" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
 fi
+
+mesonCheckPhase() {
+    runHook preCheck
+
+    meson test
+
+    runHook postCheck
+}
+
+if [ -z "$dontUseMesonCheck" -a -z "$checkPhase" ]; then
+    checkPhase=mesonCheckPhase
+fi