Merge branch 'staging', discussion #8844

123 files changed, 1733 insertions, 771 deletions

diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 06ca29cd092d..ff1d388b6e23 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -56,7 +56,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "4.8.4";
+let version = "4.8.5";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -209,9 +209,11 @@ stdenv.mkDerivation ({
 
   builder = ../builder.sh;
 
+  outputs = [ "out" "info" ];
+
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "15c6gwm6dzsaagamxkak5smdkf1rdfbqqjs9jdbrp3lbg4ism02a";
+    sha256 = "08yggr18v373a1ihj0rg2vd6psnic42b518xcgp3r9k81xz1xyr2";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 1824931eee5c..14641faa5fec 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -56,7 +56,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "4.9.2";
+let version = "4.9.3";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -208,9 +208,11 @@ stdenv.mkDerivation ({
 
   builder = ../builder.sh;
 
+  outputs = [ "out" "info" ];
+
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "1pbjp4blk2ycaa6r3jmw4ky5f1s9ji3klbqgv8zs2sl5jn1cj810";
+    sha256 = "0zmnm00d2a1hsd41g34bhvxzvxisa2l584q3p447bd91lfjv4ci3";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index 323a87bc7746..5e6acea35dfc 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -57,7 +57,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "5.1.0";
+let version = "5.2.0";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -210,7 +210,7 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "1bd5vj4px3s8nlakbgrh38ynxq4s654m6nxz7lrj03mvkkwgvnmp";
+    sha256 = "1bccp8a106xwz3wkixn65ngxif112vn90qf95m6lzpgpnl25p0sz";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/ghc/7.0.4-binary.nix b/pkgs/development/compilers/ghc/7.0.4-binary.nix
index a1cdd6171eee..7a6f1b78fa49 100644
--- a/pkgs/development/compilers/ghc/7.0.4-binary.nix
+++ b/pkgs/development/compilers/ghc/7.0.4-binary.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     ./configure --prefix=$out \
       --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include \
-      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"}
+      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"}
   '';
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/7.0.4.nix b/pkgs/development/compilers/ghc/7.0.4.nix
index c28359af16fa..281e5ca66a2c 100644
--- a/pkgs/development/compilers/ghc/7.0.4.nix
+++ b/pkgs/development/compilers/ghc/7.0.4.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
diff --git a/pkgs/development/compilers/ghc/7.2.2.nix b/pkgs/development/compilers/ghc/7.2.2.nix
index 651cf200a8d0..7276f413967f 100644
--- a/pkgs/development/compilers/ghc/7.2.2.nix
+++ b/pkgs/development/compilers/ghc/7.2.2.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
diff --git a/pkgs/development/compilers/ghc/7.4.2-binary.nix b/pkgs/development/compilers/ghc/7.4.2-binary.nix
index 2b8d403701f6..25c9dd0a65a9 100644
--- a/pkgs/development/compilers/ghc/7.4.2-binary.nix
+++ b/pkgs/development/compilers/ghc/7.4.2-binary.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     ./configure --prefix=$out \
       --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include \
-      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"}
+      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"}
   '';
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/7.4.2.nix b/pkgs/development/compilers/ghc/7.4.2.nix
index 4e4a5f6024ea..b2abcb08ec3a 100644
--- a/pkgs/development/compilers/ghc/7.4.2.nix
+++ b/pkgs/development/compilers/ghc/7.4.2.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   # required, because otherwise all symbols from HSffi.o are stripped, and
diff --git a/pkgs/development/compilers/ghc/7.6.3.nix b/pkgs/development/compilers/ghc/7.6.3.nix
index 4eb6e425f354..366c0044a67a 100644
--- a/pkgs/development/compilers/ghc/7.6.3.nix
+++ b/pkgs/development/compilers/ghc/7.6.3.nix
@@ -52,7 +52,7 @@ in stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   postInstall = ''
diff --git a/pkgs/development/haskell-modules/gcc-clang-wrapper.sh b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
index d081be231a1c..d081be231a1c 100755
--- a/pkgs/development/haskell-modules/gcc-clang-wrapper.sh
+++ b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
diff --git a/pkgs/development/compilers/go/1.3.nix b/pkgs/development/compilers/go/1.3.nix
index 52a388aff1fe..65b80a7f3af2 100644
--- a/pkgs/development/compilers/go/1.3.nix
+++ b/pkgs/development/compilers/go/1.3.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation {
     sed -i 's,/lib/ld-linux.so.2,${loader386},' src/cmd/8l/asm.c
   '';
 
-  patches = [ ./cacert-1.2.patch ];
+  patches = [ ./cacert-1.2.patch ./R_386_GOT32.patch ];
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
index 12642eeace58..d42873ab975d 100644
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, bison, glibc, bash, coreutils, makeWrapper, tzdata, iana_etc, perl, Security, goPackages }:
+{ stdenv, lib, fetchurl, bison, glibc, bash, coreutils, makeWrapper, tzdata, iana_etc, perl, goPackages
+
+, Security }:
 
 let
   loader386 = "${glibc}/lib/ld-linux.so.2";
@@ -17,8 +19,9 @@ stdenv.mkDerivation rec {
 
   # perl is used for testing go vet
   buildInputs = [ bison bash makeWrapper perl ]
-             ++ lib.optionals stdenv.isLinux [ glibc ]
-             ++ lib.optionals stdenv.isDarwin [ Security ];
+             ++ lib.optionals stdenv.isLinux [ glibc ];
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
 
   # I'm not sure what go wants from its 'src', but the go installation manual
   # describes an installation keeping the src.
@@ -56,6 +59,13 @@ stdenv.mkDerivation rec {
     sed -i 's,/lib/ld-linux.so.3,${loaderArm},' src/cmd/5l/asm.c
     sed -i 's,/lib64/ld-linux-x86-64.so.2,${loaderAmd64},' src/cmd/6l/asm.c
     sed -i 's,/lib/ld-linux.so.2,${loader386},' src/cmd/8l/asm.c
+  '' + lib.optionalString stdenv.isDarwin ''
+    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
+    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
+    sed -i '/TestRead0/areturn' src/os/os_test.go
+    sed -i '/TestSystemRoots/areturn' src/crypto/x509/root_darwin_test.go
+
+    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/go/R_386_GOT32.patch b/pkgs/development/compilers/go/R_386_GOT32.patch
new file mode 100644
index 000000000000..c029d50168a3
--- /dev/null
+++ b/pkgs/development/compilers/go/R_386_GOT32.patch
@@ -0,0 +1,46 @@
+From 609d996fac7f68b34032572b7bde627f658b95f2 Mon Sep 17 00:00:00 2001
+From: Russ Cox <rsc@golang.org>
+Date: Mon, 6 Oct 2014 14:17:48 -0400
+Subject: [PATCH] cmd/8l: accept R_386_GOT32 in push instruction
+
+Fixes #8382.
+
+LGTM=iant
+R=iant
+CC=golang-codereviews
+https://golang.org/cl/149540045
+---
+ src/cmd/8l/asm.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/src/cmd/8l/asm.c b/src/cmd/8l/asm.c
+index c135dce..98c0424 100644
+--- a/src/cmd/8l/asm.c
++++ b/src/cmd/8l/asm.c
+@@ -117,13 +117,21 @@ adddynrel(LSym *s, Reloc *r)
+ 	case 256 + R_386_GOT32:
+ 		if(targ->type != SDYNIMPORT) {
+ 			// have symbol
+-			// turn MOVL of GOT entry into LEAL of symbol itself
+-			if(r->off < 2 || s->p[r->off-2] != 0x8b) {
+-				diag("unexpected GOT reloc for non-dynamic symbol %s", targ->name);
++			if(r->off >= 2 && s->p[r->off-2] == 0x8b) {
++				// turn MOVL of GOT entry into LEAL of symbol address, relative to GOT.
++				s->p[r->off-2] = 0x8d;
++				r->type = R_GOTOFF;
+ 				return;
+ 			}
+-			s->p[r->off-2] = 0x8d;
+-			r->type = R_GOTOFF;
++			if(r->off >= 2 && s->p[r->off-2] == 0xff && s->p[r->off-1] == 0xb3) {
++				// turn PUSHL of GOT entry into PUSHL of symbol itself.
++				// use unnecessary SS prefix to keep instruction same length.
++				s->p[r->off-2] = 0x36;
++				s->p[r->off-1] = 0x68;
++				r->type = R_ADDR;
++				return;
++			}
++			diag("unexpected GOT reloc for non-dynamic symbol %s", targ->name);
+ 			return;
+ 		}
+ 		addgotsym(ctxt, targ);
diff --git a/pkgs/development/compilers/llvm/3.6/default.nix b/pkgs/development/compilers/llvm/3.6/default.nix
index 3321e38949f1..d95ffe473262 100644
--- a/pkgs/development/compilers/llvm/3.6/default.nix
+++ b/pkgs/development/compilers/llvm/3.6/default.nix
@@ -1,6 +1,6 @@
 { pkgs, newScope, stdenv, isl, fetchurl, overrideCC, wrapCC }:
 let
-  callPackage = newScope (self // { inherit isl version fetch; });
+  callPackage = newScope (self // { inherit stdenv isl version fetch; });
 
   version = "3.6.1";
 
diff --git a/pkgs/development/compilers/llvm/3.6/llvm.nix b/pkgs/development/compilers/llvm/3.6/llvm.nix
index 1b7e9d86a030..2d6f29aacea0 100644
--- a/pkgs/development/compilers/llvm/3.6/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.6/llvm.nix
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
     mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ] ++ stdenv.lib.optional stdenv.isLinux valgrind;
+  buildInputs = [ perl groff cmake libxml2 python libffi ] /* ++ stdenv.lib.optional stdenv.isLinux valgrind */;
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/rustc/generic.nix b/pkgs/development/compilers/rustc/generic.nix
index f9e458738571..da72495ee7ad 100644
--- a/pkgs/development/compilers/rustc/generic.nix
+++ b/pkgs/development/compilers/rustc/generic.nix
@@ -84,6 +84,8 @@ stdenv.mkDerivation {
   inherit version;
   inherit meta;
 
+  __impureHostDeps = [ "/usr/lib/libedit.3.dylib" ];
+
   src = if isRelease then
       fetchzip {
         url = "http://static.rust-lang.org/dist/rustc-${version}-src.tar.gz";
@@ -107,16 +109,16 @@ stdenv.mkDerivation {
     installPhase = ''
       mkdir -p "$out"
       cp -r bin "$out/bin"
-    '' + (if stdenv.isLinux then ''
+    '' + stdenv.lib.optionalString stdenv.isLinux ''
       patchelf --interpreter "${stdenv.glibc}/lib/${stdenv.cc.dynamicLinker}" \
                --set-rpath "${stdenv.cc.cc}/lib/:${stdenv.cc.cc}/lib64/" \
                "$out/bin/rustc"
-    '' else "");
+    '';
   };
 
   configureFlags = configureFlags
-                ++ [ "--enable-local-rust" "--local-rust-root=$snapshot" ]
-                ++ stdenv.lib.optional (stdenv.cc ? clang) "--enable-clang";
+                ++ [ "--enable-local-rust" "--local-rust-root=$snapshot" "--enable-rpath" ]
+                ++ stdenv.lib.optional (stdenv.cc.cc ? isClang) "--enable-clang";
 
   inherit patches;
 
@@ -139,7 +141,8 @@ stdenv.mkDerivation {
       --replace "\$\$(subst  /,//," "\$\$(subst /,/,"
   '';
 
-  buildInputs = [ which file perl curl python27 makeWrapper git valgrind procps ];
+  buildInputs = [ which file perl curl python27 makeWrapper git ]
+    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ procps valgrind ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/compilers/sdcc/default.nix b/pkgs/development/compilers/sdcc/default.nix
index 0650fae917a6..a246a413f50d 100644
--- a/pkgs/development/compilers/sdcc/default.nix
+++ b/pkgs/development/compilers/sdcc/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, bison, flex, boost, gputils ? null }:
 
 stdenv.mkDerivation rec {
-  version = "3.4.0";
+  version = "3.5.0";
   name = "sdcc-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/sdcc/sdcc-src-${version}.tar.bz2";
-    sha256 = "1yavxffqdfhdyabdza936xxh9wq4cfwa385g26gjapsdp5ighsng";
+    sha256 = "1aazz0yynr694q0rich7r03qls0zvsjc00il14pb4i22c78phagq";
   };
 
   # TODO: remove this comment when gputils != null is tested
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index fd3e70eaed86..a59219786c98 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -186,21 +186,39 @@ self: super: {
 
   # cabal2nix likes to generate dependencies on hinotify when hfsevents is really required
   # on darwin: https://github.com/NixOS/cabal2nix/issues/146
-  hinotify = if pkgs.stdenv.isDarwin then super.hfsevents else super.hinotify;
+  hinotify = if pkgs.stdenv.isDarwin then self.hfsevents else super.hinotify;
+
+  # hfsevents needs CoreServices in scope
+  hfsevents = if pkgs.stdenv.isDarwin
+    then addBuildTool super.hfsevents pkgs.darwin.apple_sdk.frameworks.CoreServices
+    else super.hfsevents;
 
   # FSEvents API is very buggy and tests are unreliable. See
   # http://openradar.appspot.com/10207999 and similar issues
   fsnotify = if pkgs.stdenv.isDarwin then dontCheck super.fsnotify else super.fsnotify;
 
+  # the system-fileio tests use canonicalizePath, which fails in the sandbox
+  system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
+
   # Prevents needing to add security_tool as a build tool to all of x509-system's
   # dependencies.
-  # TODO: use pkgs.darwin.security_tool once we can build it
-  x509-system = let security_tool = "/usr";
-  in overrideCabal super.x509-system (drv: {
-    patchPhase = (drv.patchPhase or "") + pkgs.stdenv.lib.optionalString pkgs.stdenv.isDarwin ''
-      substituteInPlace System/X509/MacOS.hs --replace security ${security_tool}/bin/security
-    '';
-  });
+  x509-system = if pkgs.stdenv.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then let inherit (pkgs.darwin) security_tool;
+      in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
+        patchPhase = (drv.patchPhase or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security ${security_tool}/bin/security
+        '';
+      })
+    else super.x509-system;
+
+  double-conversion = if !pkgs.stdenv.isDarwin
+    then super.double-conversion
+    else overrideCabal super.double-conversion (drv:
+      {
+        patchPhase = ''
+          substituteInPlace double-conversion.cabal --replace stdc++ c++
+        '';
+      });
 
   # Does not compile: "fatal error: ieee-flpt.h: No such file or directory"
   base_4_8_0_0 = markBroken super.base_4_8_0_0;
@@ -862,6 +880,10 @@ self: super: {
   # https://github.com/yesodweb/serversession/issues/1
   serversession = dontCheck super.serversession;
 
+  yesod-bin = if pkgs.stdenv.isDarwin
+    then addBuildDepend super.yesod-bin pkgs.darwin.apple_sdk.frameworks.Cocoa
+    else super.yesod-bin;
+
   # https://github.com/commercialhaskell/stack/issues/408
   # https://github.com/commercialhaskell/stack/issues/409
   stack = overrideCabal super.stack (drv: { preCheck = "export HOME=$TMPDIR"; doCheck = false; });
diff --git a/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
index d7371c5b97b0..de0fdacb3f9d 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
@@ -44,10 +44,6 @@ self: super: {
   # Don't use jailbreak built with Cabal 1.22.x because of https://github.com/peti/jailbreak-cabal/issues/9.
   jailbreak-cabal = pkgs.haskell.packages.ghc784.jailbreak-cabal;
 
-  # GHC 7.10.x's Haddock binary cannot generate hoogle files.
-  # https://ghc.haskell.org/trac/ghc/ticket/9921
-  mkDerivation = drv: super.mkDerivation (drv // { doHoogle = false; });
-
   idris =
     let idris' = overrideCabal super.idris (drv: {
       # "idris" binary cannot find Idris library otherwise while building.
@@ -231,9 +227,6 @@ self: super: {
   seqid-streams_0_1_0 = markBroken super.seqid-streams_0_1_0;
   vector_0_10_9_3 = markBroken super.vector_0_10_9_3;
 
-  # https://github.com/purefn/hipbot/issues/1
-  hipbot = dontDistribute super.hipbot;
-
   # https://github.com/HugoDaniel/RFC3339/issues/14
   timerep = dontCheck super.timerep;
 
diff --git a/pkgs/development/interpreters/perl/5.16/default.nix b/pkgs/development/interpreters/perl/5.16/default.nix
index 9ed3aa54f517..568025edfd4c 100644
--- a/pkgs/development/interpreters/perl/5.16/default.nix
+++ b/pkgs/development/interpreters/perl/5.16/default.nix
@@ -24,6 +24,17 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isSunOS  ./ld-shared.patch
     ++ lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
 
+  # There's an annoying bug on sandboxed Darwin in Perl's Cwd.pm where it looks for pwd
+  # in /bin/pwd and /usr/bin/pwd and then falls back on just "pwd" if it can't get them
+  # while at the same time erasing the PATH environment variable so it unconditionally
+  # fails. The code in question is guarded by a check for Mac OS, but the patch below
+  # doesn't have any runtime effect on other platforms.
+  postPatch = ''
+    pwd="$(type -P pwd)"
+    substituteInPlace dist/Cwd/Cwd.pm \
+      --replace "pwd_cmd = 'pwd'" "pwd_cmd = '$pwd'"
+  '';
+
   # Build a thread-safe Perl with a dynamic libperls.o.  We need the
   # "installstyle" option to ensure that modules are put under
   # $out/lib/perl5 - this is the general default, but because $out
diff --git a/pkgs/development/interpreters/perl/5.20/default.nix b/pkgs/development/interpreters/perl/5.20/default.nix
index 0ad955d03630..e8eb3a70e374 100644
--- a/pkgs/development/interpreters/perl/5.20/default.nix
+++ b/pkgs/development/interpreters/perl/5.20/default.nix
@@ -31,10 +31,23 @@ stdenv.mkDerivation rec {
   patches =
     [ # Do not look in /usr etc. for dependencies.
       ./no-sys-dirs.patch
+      # Remove in 5.20.3
+      ./perl-5.20.2-gcc5_fixes-1.patch
     ]
     ++ optional stdenv.isSunOS ./ld-shared.patch
     ++ stdenv.lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
 
+  # There's an annoying bug on sandboxed Darwin in Perl's Cwd.pm where it looks for pwd
+  # in /bin/pwd and /usr/bin/pwd and then falls back on just "pwd" if it can't get them
+  # while at the same time erasing the PATH environment variable so it unconditionally
+  # fails. The code in question is guarded by a check for Mac OS, but the patch below
+  # doesn't have any runtime effect on other platforms.
+  postPatch = stdenv.lib.optional (stdenv.isDarwin && !stdenv.cc.nativeLibc) ''
+    pwd="$(type -P pwd)"
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "pwd_cmd = 'pwd'" "pwd_cmd = '$pwd'"
+  '';
+
   # Build a thread-safe Perl with a dynamic libperls.o.  We need the
   # "installstyle" option to ensure that modules are put under
   # $out/lib/perl5 - this is the general default, but because $out
diff --git a/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch b/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch
new file mode 100644
index 000000000000..21f3ca8d7a54
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch
@@ -0,0 +1,127 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2015-04-17
+Initial Package Version: 5.20.2
+Upstream Status: Committed
+Origin: Petr Pisař and Tony Cook
+Description: Fixes Errno.pm and h2ph with gcc-5.
+
+1. cherry-picked because the change to $version will not apply, from
+commit 816b056ffb99ae54642320e20dc30a59fd1effef
+Author: Petr Písař <ppisar@redhat.com>
+Date:   Wed Feb 11 15:46:37 2015 +0100
+
+    Fix Errno.pm generation for gcc-5.0
+    
+    gcc-5.0 -E interleaves now line numbers with expended macros, so that
+    the generated errno.c will be preprocessed to
+    
+    EBFONT => [[
+               59
+                    ]]
+    
+    which is hard to parse in in line-based reader.
+    
+    So use -P option with gcc >= 5.0. Global -P usage would break makedepend,
+    global -ftrack-macro-expansion=0 would break lib/h2ph.t.
+    
+    RT#123784
+
+diff --git a/ext/Errno/Errno_pm.PL b/ext/Errno/Errno_pm.PL
+index 3dadfce..c6bfa06 100644
+--- a/ext/Errno/Errno_pm.PL
++++ b/ext/Errno/Errno_pm.PL
+@@ -215,20 +215,31 @@ sub write_errno_pm {
+     {	# BeOS (support now removed) did not enter this block
+     # invoke CPP and read the output
+ 
++	my $inhibit_linemarkers = '';
++	if ($Config{gccversion} =~ /\A(\d+)\./ and $1 >= 5) {
++	    # GCC 5.0 interleaves expanded macros with line numbers breaking
++	    # each line into multiple lines. RT#123784
++	    $inhibit_linemarkers = ' -P';
++	}
++
+ 	if ($^O eq 'VMS') {
+-	    my $cpp = "$Config{cppstdin} $Config{cppflags} $Config{cppminus}";
++	    my $cpp = "$Config{cppstdin} $Config{cppflags}" .
++		$inhibit_linemarkers . " $Config{cppminus}";
+ 	    $cpp =~ s/sys\$input//i;
+ 	    open(CPPO,"$cpp  errno.c |") or
+ 		die "Cannot exec $Config{cppstdin}";
+ 	} elsif ($IsMSWin32 || $^O eq 'NetWare') {
+-	    open(CPPO,"$Config{cpprun} $Config{cppflags} errno.c |") or
+-		die "Cannot run '$Config{cpprun} $Config{cppflags} errno.c'";
++	    my $cpp = "$Config{cpprun} $Config{cppflags}" .
++		$inhibit_linemarkers;
++	    open(CPPO,"$cpp errno.c |") or
++		die "Cannot run '$cpp errno.c'";
+ 	} elsif ($IsSymbian) {
+-            my $cpp = "gcc -E -I$ENV{SDK}\\epoc32\\include\\libc -";
++            my $cpp = "gcc -E -I$ENV{SDK}\\epoc32\\include\\libc" .
++		$inhibit_linemarkers ." -";
+ 	    open(CPPO,"$cpp < errno.c |")
+ 		or die "Cannot exec $cpp";
+         } else {
+-	    my $cpp = default_cpp();
++	    my $cpp = default_cpp() . $inhibit_linemarkers;
+ 	    open(CPPO,"$cpp < errno.c |")
+ 		or die "Cannot exec $cpp";
+ 	}
+
+commit 3bea78d24634e630b610f59957e7a019205a67b2
+Author: Tony Cook <tony@develop-help.com>
+Date:   Mon Feb 16 15:57:00 2015 +1100
+
+    h2ph: correct handling of hex constants for the preamble
+    
+    Previously they were treated as identifiers resulting in code
+    generated like C< &0xFFF >.
+    
+    We also try to prevent compile-time warnings from large hex integers,
+    the user isn't responsible for the generated code, so we delay those
+    warnings to run-time.
+
+diff --git a/utils/h2ph.PL b/utils/h2ph.PL
+index 9a8b14d..d082f22 100644
+--- a/utils/h2ph.PL
++++ b/utils/h2ph.PL
+@@ -769,7 +769,7 @@ sub inc_dirs
+ sub build_preamble_if_necessary
+ {
+     # Increment $VERSION every time this function is modified:
+-    my $VERSION     = 3;
++    my $VERSION     = 4;
+     my $preamble    = "$Dest_dir/_h2ph_pre.ph";
+ 
+     # Can we skip building the preamble file?
+@@ -788,6 +788,11 @@ sub build_preamble_if_necessary
+ 
+     open  PREAMBLE, ">$preamble" or die "Cannot open $preamble:  $!";
+ 	print PREAMBLE "# This file was created by h2ph version $VERSION\n";
++        # Prevent non-portable hex constants from warning.
++        #
++        # We still produce an overflow warning if we can't represent
++        # a hex constant as an integer.
++        print PREAMBLE "no warnings qw(portable);\n";
+ 
+ 	foreach (sort keys %define) {
+ 	    if ($opt_D) {
+@@ -814,6 +819,18 @@ DEFINE
+ 		# integer:
+ 		print PREAMBLE
+ 		    "unless (defined &$_) { sub $_() { $1 } }\n\n";
++            } elsif ($define{$_} =~ /^([+-]?0x[\da-f]+)U?L{0,2}$/i) {
++                # hex integer
++                # Special cased, since perl warns on hex integers
++                # that can't be represented in a UV.
++                #
++                # This way we get the warning at time of use, so the user
++                # only gets the warning if they happen to use this
++                # platform-specific definition.
++                my $code = $1;
++                $code = "hex('$code')" if length $code > 10;
++                print PREAMBLE
++                    "unless (defined &$_) { sub $_() { $code } }\n\n";
+ 	    } elsif ($define{$_} =~ /^\w+$/) {
+ 		my $def = $define{$_};
+ 		if ($isatype{$def}) {
diff --git a/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch b/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch
new file mode 100644
index 000000000000..231853fe51a6
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch
@@ -0,0 +1,11 @@
+--- a/hints/darwin.sh	2013-05-08 11:13:45.000000000 -0600
++++ b/hints/darwin.sh	2013-05-08 11:15:04.000000000 -0600
+@@ -129,7 +129,7 @@
+ 
+ # Avoid Apple's cpp precompiler, better for extensions
+ if [ "X`echo | ${cc} -no-cpp-precomp -E - 2>&1 >/dev/null`" = "X" ]; then
+-    cppflags="${cppflags} -no-cpp-precomp"
++    #cppflags="${cppflags} -no-cpp-precomp"
+ 
+     # This is necessary because perl's build system doesn't
+     # apply cppflags to cc compile lines as it should.
diff --git a/pkgs/development/interpreters/perl/5.22/default.nix b/pkgs/development/interpreters/perl/5.22/default.nix
new file mode 100644
index 000000000000..f9068de1c2cf
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/default.nix
@@ -0,0 +1,105 @@
+{ stdenv, fetchurl, enableThreading ? stdenv ? glibc }:
+
+# We can only compile perl with threading on platforms where we have a
+# real glibc in the stdenv.
+#
+# Instead of silently building an unthreaded perl if this is not the
+# case, we force callers to disableThreading explicitly, therefore
+# documenting the platforms where the perl is not threaded.
+#
+# In the case of stdenv linux boot stage1 it's not possible to use
+# threading because of the simpleness of the bootstrap glibc, so we
+# use enableThreading = false there.
+assert enableThreading -> (stdenv ? glibc);
+
+let
+
+  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
+
+in
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "perl-5.22.0";
+
+  src = fetchurl {
+    url = "mirror://cpan/src/5.0/${name}.tar.gz";
+    sha256 = "0g5bl8sdpzx9gx2g5jq3py4bj07z2ylk7s1qn0fvsss2yl3hhs8c";
+  };
+
+  patches =
+    [ # Do not look in /usr etc. for dependencies.
+      ./no-sys-dirs.patch
+    ]
+    ++ optional stdenv.isSunOS ./ld-shared.patch
+    ++ stdenv.lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ];
+
+  # Build a thread-safe Perl with a dynamic libperls.o.  We need the
+  # "installstyle" option to ensure that modules are put under
+  # $out/lib/perl5 - this is the general default, but because $out
+  # contains the string "perl", Configure would select $out/lib.
+  # Miniperl needs -lm. perl needs -lrt.
+  configureFlags =
+    [ "-de"
+      "-Dcc=cc"
+      "-Uinstallusrbinperl"
+      "-Dinstallstyle=lib/perl5"
+      "-Duseshrplib"
+      "-Dlocincpth=${libc}/include"
+      "-Dloclibpth=${libc}/lib"
+    ]
+    ++ optional enableThreading "-Dusethreads";
+
+  configureScript = "${stdenv.shell} ./Configure";
+
+  dontAddPrefix = true;
+
+  enableParallelBuilding = true;
+
+  preConfigure =
+    ''
+
+      configureFlags="$configureFlags -Dprefix=$out -Dman1dir=$out/share/man/man1 -Dman3dir=$out/share/man/man3"
+
+      ${optionalString stdenv.isArm ''
+        configureFlagsArray=(-Dldflags="-lm -lrt")
+      ''}
+    '' + optionalString stdenv.isDarwin ''
+      substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
+    '' + optionalString (!enableThreading) ''
+      # We need to do this because the bootstrap doesn't have a static libpthread
+      sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
+    '';
+
+  preBuild = optionalString (!(stdenv ? cc && stdenv.cc.nativeTools))
+    ''
+      # Make Cwd work on NixOS (where we don't have a /bin/pwd).
+      substituteInPlace dist/PathTools/Cwd.pm --replace "'/bin/pwd'" "'$(type -tP pwd)'"
+    '';
+
+  setupHook = ./setup-hook.sh;
+
+  passthru.libPrefix = "lib/perl5/site_perl";
+
+  preCheck = ''
+    # Try and setup a local hosts file
+    if [ -f "${libc}/lib/libnss_files.so" ]; then
+      mkdir $TMPDIR/fakelib
+      cp "${libc}/lib/libnss_files.so" $TMPDIR/fakelib
+      sed -i 's,/etc/hosts,/dev/fd/3,g' $TMPDIR/fakelib/libnss_files.so
+      export LD_LIBRARY_PATH=$TMPDIR/fakelib
+    fi
+  '';
+
+  postCheck = ''
+    unset LD_LIBRARY_PATH
+  '';
+
+  meta = {
+    homepage = https://www.perl.org/;
+    description = "The standard implementation of the Perl 5 programmming language";
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/interpreters/perl/5.22/ld-shared.patch b/pkgs/development/interpreters/perl/5.22/ld-shared.patch
new file mode 100644
index 000000000000..be45230c8a73
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/ld-shared.patch
@@ -0,0 +1,11 @@
+--- perl-5.16.2/hints/solaris_2.sh.orig	2013-02-14 19:29:49.453988140 +0000
++++ perl-5.16.2/hints/solaris_2.sh	2013-02-14 19:30:31.681631019 +0000
+@@ -568,7 +568,7 @@
+ #		    ccflags="$ccflags -Wa,`getconf XBS5_LP64_OFF64_CFLAGS 2>/dev/null`"
+ #		fi
+ 		ldflags="$ldflags -m64"
+-		lddlflags="$lddlflags -G -m64"
++		lddlflags="$lddlflags -shared -m64"
+ 		;;
+ 	    *)
+ 		getconfccflags="`getconf XBS5_LP64_OFF64_CFLAGS 2>/dev/null`"
diff --git a/pkgs/development/interpreters/perl/5.22/no-libutil.patch b/pkgs/development/interpreters/perl/5.22/no-libutil.patch
new file mode 100644
index 000000000000..68d44612bfe6
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/no-libutil.patch
@@ -0,0 +1,12 @@
+diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
+--- perl-5.14.2-orig/Configure	2011-09-26 11:44:34.000000000 +0200
++++ perl-5.14.2/Configure	2012-02-16 17:24:50.779839039 +0100
+@@ -1368,7 +1368,7 @@
+ : List of libraries we want.
+ : If anyone needs extra -lxxx, put those in a hint file.
+ libswanted="socket bind inet nsl nm ndbm gdbm dbm db malloc dl ld sun"
+-libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
++libswanted="$libswanted m crypt sec c cposix posix ucb bsd BSD"
+ : We probably want to search /usr/shlib before most other libraries.
+ : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
+ glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
diff --git a/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch b/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch
new file mode 100644
index 000000000000..1793273a76f9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch
@@ -0,0 +1,250 @@
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/Configure perl-5.20.0/Configure
+--- perl-5.20.0-orig/Configure	2014-05-26 15:34:18.000000000 +0200
++++ perl-5.20.0/Configure	2014-06-25 10:43:35.368285986 +0200
+@@ -106,15 +106,7 @@
+ fi
+ 
+ : Proper PATH setting
+-paths='/bin /usr/bin /usr/local/bin /usr/ucb /usr/local /usr/lbin'
+-paths="$paths /opt/bin /opt/local/bin /opt/local /opt/lbin"
+-paths="$paths /usr/5bin /etc /usr/gnu/bin /usr/new /usr/new/bin /usr/nbin"
+-paths="$paths /opt/gnu/bin /opt/new /opt/new/bin /opt/nbin"
+-paths="$paths /sys5.3/bin /sys5.3/usr/bin /bsd4.3/bin /bsd4.3/usr/ucb"
+-paths="$paths /bsd4.3/usr/bin /usr/bsd /bsd43/bin /opt/ansic/bin /usr/ccs/bin"
+-paths="$paths /etc /usr/lib /usr/ucblib /lib /usr/ccs/lib"
+-paths="$paths /sbin /usr/sbin /usr/libexec"
+-paths="$paths /system/gnu_library/bin"
++paths=''
+ 
+ for p in $paths
+ do
+@@ -1337,8 +1329,7 @@
+ archname=''
+ : Possible local include directories to search.
+ : Set locincpth to "" in a hint file to defeat local include searches.
+-locincpth="/usr/local/include /opt/local/include /usr/gnu/include"
+-locincpth="$locincpth /opt/gnu/include /usr/GNU/include /opt/GNU/include"
++locincpth=""
+ :
+ : no include file wanted by default
+ inclwanted=''
+@@ -1349,17 +1340,12 @@
+ 
+ libnames=''
+ : change the next line if compiling for Xenix/286 on Xenix/386
+-xlibpth='/usr/lib/386 /lib/386'
++xlibpth=''
+ : Possible local library directories to search.
+-loclibpth="/usr/local/lib /opt/local/lib /usr/gnu/lib"
+-loclibpth="$loclibpth /opt/gnu/lib /usr/GNU/lib /opt/GNU/lib"
++loclibpth=""
+ 
+ : general looking path for locating libraries
+-glibpth="/lib /usr/lib $xlibpth"
+-glibpth="$glibpth /usr/ccs/lib /usr/ucblib /usr/local/lib"
+-test -f /usr/shlib/libc.so && glibpth="/usr/shlib $glibpth"
+-test -f /shlib/libc.so     && glibpth="/shlib $glibpth"
+-test -d /usr/lib64         && glibpth="$glibpth /lib64 /usr/lib64 /usr/local/lib64"
++glibpth=""
+ 
+ : Private path used by Configure to find libraries.  Its value
+ : is prepended to libpth. This variable takes care of special
+@@ -1391,8 +1377,6 @@
+ libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
+ : We probably want to search /usr/shlib before most other libraries.
+ : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
+-glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
+-glibpth="/usr/shlib $glibpth"
+ : Do not use vfork unless overridden by a hint file.
+ usevfork=false
+ 
+@@ -2446,7 +2430,6 @@
+ zip
+ "
+ pth=`echo $PATH | sed -e "s/$p_/ /g"`
+-pth="$pth $sysroot/lib $sysroot/usr/lib"
+ for file in $loclist; do
+ 	eval xxx=\$$file
+ 	case "$xxx" in
+@@ -4936,7 +4919,7 @@
+ : Set private lib path
+ case "$plibpth" in
+ '') if ./mips; then
+-	plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib"
++	plibpth="$incpath/usr/lib"
+     fi;;
+ esac
+ case "$libpth" in
+@@ -8600,13 +8583,8 @@
+ echo " "
+ case "$sysman" in
+ '')
+-	syspath='/usr/share/man/man1 /usr/man/man1'
+-	syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1"
+-	syspath="$syspath /usr/man/u_man/man1"
+-	syspath="$syspath /usr/catman/u_man/man1 /usr/man/l_man/man1"
+-	syspath="$syspath /usr/local/man/u_man/man1 /usr/local/man/l_man/man1"
+-	syspath="$syspath /usr/man/man.L /local/man/man1 /usr/local/man/man1"
+-	sysman=`./loc . /usr/man/man1 $syspath`
++	syspath=''
++	sysman=''
+ 	;;
+ esac
+ if $test -d "$sysman"; then
+@@ -19900,9 +19878,10 @@
+ case "$full_ar" in
+ '') full_ar=$ar ;;
+ esac
++full_ar=ar
+ 
+ : Store the full pathname to the sed program for use in the C program
+-full_sed=$sed
++full_sed=sed
+ 
+ : see what type gids are declared as in the kernel
+ echo " "
+Only in perl-5.20.0/: Configure.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/ext/Errno/Errno_pm.PL perl-5.20.0/ext/Errno/Errno_pm.PL
+--- perl-5.20.0-orig/ext/Errno/Errno_pm.PL	2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/ext/Errno/Errno_pm.PL	2014-06-25 10:31:24.317970047 +0200
+@@ -126,11 +126,7 @@
+ 	if ($dep =~ /(\S+errno\.h)/) {
+ 	     $file{$1} = 1;
+ 	}
+-    } elsif ($^O eq 'linux' &&
+-	      $Config{gccversion} ne '' && 
+-	      $Config{gccversion} !~ /intel/i
+-	      # might be using, say, Intel's icc
+-	     ) {
++    } elsif (0) {
+     # When cross-compiling we may store a path for gcc's "sysroot" option:
+     my $sysroot = $Config{sysroot} || '';
+ 	# Some Linuxes have weird errno.hs which generate
+Only in perl-5.20.0/ext/Errno: Errno_pm.PL.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/freebsd.sh perl-5.20.0/hints/freebsd.sh
+--- perl-5.20.0-orig/hints/freebsd.sh	2014-01-31 22:55:51.000000000 +0100
++++ perl-5.20.0/hints/freebsd.sh	2014-06-25 10:25:53.263964680 +0200
+@@ -119,21 +119,21 @@
+         objformat=`/usr/bin/objformat`
+         if [ x$objformat = xaout ]; then
+             if [ -e /usr/lib/aout ]; then
+-                libpth="/usr/lib/aout /usr/local/lib /usr/lib"
+-                glibpth="/usr/lib/aout /usr/local/lib /usr/lib"
++                libpth=""
++                glibpth=""
+             fi
+             lddlflags='-Bshareable'
+         else
+-            libpth="/usr/lib /usr/local/lib"
+-            glibpth="/usr/lib /usr/local/lib"
++            libpth=""
++            glibpth=""
+             ldflags="-Wl,-E "
+             lddlflags="-shared "
+         fi
+         cccdlflags='-DPIC -fPIC'
+         ;;
+ *)
+-       libpth="/usr/lib /usr/local/lib"
+-       glibpth="/usr/lib /usr/local/lib"
++       libpth=""
++       glibpth=""
+        ldflags="-Wl,-E "
+         lddlflags="-shared "
+         cccdlflags='-DPIC -fPIC'
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/linux.sh perl-5.20.0/hints/linux.sh
+--- perl-5.20.0-orig/hints/linux.sh	2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/hints/linux.sh	2014-06-25 10:33:47.354883843 +0200
+@@ -150,25 +150,6 @@
+     ;;
+ esac
+ 
+-# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries
+-# (such as -lm) in /lib or /usr/lib.  So we have to ask gcc to tell us
+-# where to look.  We don't want gcc's own libraries, however, so we
+-# filter those out.
+-# This could be conditional on Unbuntu, but other distributions may
+-# follow suit, and this scheme seems to work even on rather old gcc's.
+-# This unconditionally uses gcc because even if the user is using another
+-# compiler, we still need to find the math library and friends, and I don't
+-# know how other compilers will cope with that situation.
+-# Morever, if the user has their own gcc earlier in $PATH than the system gcc,
+-# we don't want its libraries. So we try to prefer the system gcc
+-# Still, as an escape hatch, allow Configure command line overrides to
+-# plibpth to bypass this check.
+-if [ -x /usr/bin/gcc ] ; then
+-    gcc=/usr/bin/gcc
+-else
+-    gcc=gcc
+-fi
+-
+ case "$plibpth" in
+ '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries |
+ 	cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'`
+@@ -178,32 +159,6 @@
+     ;;
+ esac
+ 
+-case "$libc" in
+-'')
+-# If you have glibc, then report the version for ./myconfig bug reporting.
+-# (Configure doesn't need to know the specific version since it just uses
+-# gcc to load the library for all tests.)
+-# We don't use __GLIBC__ and  __GLIBC_MINOR__ because they
+-# are insufficiently precise to distinguish things like
+-# libc-2.0.6 and libc-2.0.7.
+-    for p in $plibpth
+-    do
+-        for trylib in libc.so.6 libc.so
+-        do
+-            if $test -e $p/$trylib; then
+-                libc=`ls -l $p/$trylib | awk '{print $NF}'`
+-                if $test "X$libc" != X; then
+-                    break
+-                fi
+-            fi
+-        done
+-        if $test "X$libc" != X; then
+-            break
+-        fi
+-    done
+-    ;;
+-esac
+-
+ # Are we using ELF?  Thanks to Kenneth Albanowski <kjahds@kjahds.com>
+ # for this test.
+ cat >try.c <<'EOM'
+@@ -367,33 +322,6 @@
+ 	;;
+ esac
+ 
+-# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than
+-# true libraries. The scripts cause binding against static
+-# version of -lgdbm which is a bad idea. So if we have 'nm'
+-# make sure it can read the file
+-# NI-S 2003/08/07
+-case "$nm" in
+-    '') ;;
+-    *)
+-    for p in $plibpth
+-    do
+-        if $test -r $p/libndbm.so; then
+-            if $nm $p/libndbm.so >/dev/null 2>&1 ; then
+-                echo 'Your shared -lndbm seems to be a real library.'
+-                _libndbm_real=1
+-                break
+-            fi
+-        fi
+-    done
+-    if $test "X$_libndbm_real" = X; then
+-        echo 'Your shared -lndbm is not a real library.'
+-        set `echo X "$libswanted "| sed -e 's/ ndbm / /'`
+-        shift
+-        libswanted="$*"
+-    fi
+-    ;;
+-esac
+-
+ # Linux on Synology.
+ if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then
+     # Tested on Synology DS213 and DS413
diff --git a/pkgs/development/interpreters/perl/5.22/setup-hook.sh b/pkgs/development/interpreters/perl/5.22/setup-hook.sh
new file mode 100644
index 000000000000..a8656b8531db
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/setup-hook.sh
@@ -0,0 +1,5 @@
+addPerlLibPath () {
+    addToSearchPath PERL5LIB $1/lib/perl5/site_perl
+}
+
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 33b5b0f9024b..10f40c4dd2f9 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -18,7 +18,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
 
   enableParallelBuilding = true;
 
-  buildInputs = ["flex" "bison" "pkgconfig"];
+  buildInputs = [ flex bison pkgconfig ];
 
   flags = {
 
@@ -146,7 +146,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
 
     openssl = {
       configureFlags = ["--with-openssl=${openssl}"];
-      buildInputs = ["openssl"];
+      buildInputs = [openssl];
     };
 
     mbstring = {
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 2860aceb383b..c471a3cdc0fb 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison flex makeWrapper ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
 
+  postPatch = ''
+    for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
+      sed -i '1i\#include <stddef.h>' $f
+    done
+  '';
+
   configureFlags = [ "--enable-release" ];
   doCheck = true;
   checkPhase = ''
diff --git a/pkgs/development/interpreters/pypy/default.nix b/pkgs/development/interpreters/pypy/default.nix
index a453fd3e1a9e..143bab575347 100644
--- a/pkgs/development/interpreters/pypy/default.nix
+++ b/pkgs/development/interpreters/pypy/default.nix
@@ -49,16 +49,27 @@ let
         --replace "libraries=['curses']" "libraries=['ncurses']"
 
       # tkinter hints
-      substituteInPlace lib_pypy/_tkinter/tklib.py \
+      substituteInPlace lib_pypy/_tkinter/tklib_build.py \
         --replace "'/usr/include/tcl'" "'${tk}/include', '${tcl}/include'" \
-        --replace "linklibs=['tcl', 'tk']" "linklibs=['${tcl.libPrefix}', '${tk.libPrefix}']" \
+        --replace "linklibs = ['tcl' + _ver, 'tk' + _ver]" "linklibs=['${tcl.libPrefix}', '${tk.libPrefix}']" \
         --replace "libdirs = []" "libdirs = ['${tk}/lib', '${tcl}/lib']"
 
-      sed -i "s@libraries=\['sqlite3'\]\$@libraries=['sqlite3'], include_dirs=['${sqlite}/include'], library_dirs=['${sqlite}/lib']@" lib_pypy/_sqlite3.py
+      sed -i "s@libraries=\['sqlite3'\]\$@libraries=['sqlite3'], include_dirs=['${sqlite}/include'], library_dirs=['${sqlite}/lib']@" lib_pypy/_sqlite3_build.py
     '';
 
     setupHook = ./setup-hook.sh;
 
+    postBuild = ''
+      cd ./lib_pypy
+        ../pypy-c ./_audioop_build.py
+        ../pypy-c ./_curses_build.py
+        ../pypy-c ./_pwdgrp_build.py
+        ../pypy-c ./_sqlite3_build.py
+        ../pypy-c ./_syslog_build.py
+        ../pypy-c ./_tkinter/tklib_build.py
+      cd ..
+    '';
+
     doCheck = true;
     checkPhase = ''
        export TERMINFO="${ncurses}/share/terminfo/";
diff --git a/pkgs/development/interpreters/pypy/setup-hook.sh b/pkgs/development/interpreters/pypy/setup-hook.sh
index 057e619ebc89..c82179d9e87b 100644
--- a/pkgs/development/interpreters/pypy/setup-hook.sh
+++ b/pkgs/development/interpreters/pypy/setup-hook.sh
@@ -1,12 +1,12 @@
 addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.5/site-packages
+    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.6/site-packages
 }
 
 toPythonPath() {
     local paths="$1"
     local result=
     for i in $paths; do
-        p="$i/lib/pypy2.5/site-packages"
+        p="$i/lib/pypy2.6/site-packages"
         result="${result}${result:+:}$p"
     done
     echo $result
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/2.7/default.nix
index 4ad4679bd6ea..195caa583ad4 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/2.7/default.nix
@@ -8,6 +8,8 @@
 , tcl ? null, tk ? null, x11 ? null, libX11 ? null, x11Support ? !stdenv.isCygwin
 , zlib ? null, zlibSupport ? true
 , expat, libffi
+
+, CF, configd
 }:
 
 assert zlibSupport -> zlib != null;
@@ -40,6 +42,8 @@ let
       # patch python to put zero timestamp into pyc
       # if DETERMINISTIC_BUILD env var is set
       ./deterministic-build.patch
+
+      ./properly-detect-curses.patch
     ] ++ optionals stdenv.isCygwin [
       ./2.5.2-ctypes-util-find_library.patch
       ./2.5.2-tkinter-x11.patch
@@ -62,6 +66,8 @@ let
       for i in Lib/plat-*/regen; do
         substituteInPlace $i --replace /usr/include/ ${stdenv.cc.libc}/include/
       done
+    '' + optionalString stdenv.isDarwin ''
+      substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
     '';
 
   configureFlags = [
@@ -72,6 +78,8 @@ let
     "--with-system-ffi"
     "--with-system-expat"
     "ac_cv_func_bind_textdomain_codeset=yes"
+  ] ++ optionals stdenv.isDarwin [
+    "--disable-toolbox-glue"
   ];
 
   postConfigure = if stdenv.isCygwin then ''
@@ -86,7 +94,12 @@ let
         [ db gdbm ncurses sqlite readline
         ] ++ optionals x11Support [ tcl tk x11 libX11 ]
     )
-    ++ optional zlibSupport zlib;
+    ++ optional zlibSupport zlib
+
+    # depend on CF and configd only if purity is an issue
+    # the impure bootstrap compiler can't build CoreFoundation currently. it requires
+    # <mach-o/dyld.h> which is in our pure bootstrapTools, but not in the system headers.
+    ++ optionals (stdenv.isDarwin && !stdenv.cc.nativeLibc) [ CF configd ];
 
   # Build the basic Python interpreter without modules that have
   # external dependencies.
diff --git a/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch b/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch
new file mode 100644
index 000000000000..e2640bab0e9a
--- /dev/null
+++ b/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch
@@ -0,0 +1,116 @@
+From 6dc83db69b5e29d25ba6d73646ea2e9a1097848a Mon Sep 17 00:00:00 2001
+From: Roumen Petrov <local@example.net>
+Date: Sun, 19 Feb 2012 16:13:24 +0200
+Subject: [PATCH] CROSS-properly detect WINDOW _flags for different ncurses versions
+
+---
+ Include/py_curses.h |    5 +++++
+ configure.ac        |   40 ++++++++++++++++++++++++++++++++++++++--
+ pyconfig.h.in       |    6 ++++++
+ 3 files changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/Include/py_curses.h b/Include/py_curses.h
+index f2c08f6..a9b5260 100644
+--- a/Include/py_curses.h
++++ b/Include/py_curses.h
+@@ -14,7 +14,9 @@
+ /* the following define is necessary for OS X 10.6; without it, the
+    Apple-supplied ncurses.h sets NCURSES_OPAQUE to 1, and then Python
+    can't get at the WINDOW flags field. */
++/* NOTE configure check if ncurses require such definition
+ #define NCURSES_OPAQUE 0
++*/
+ #endif /* __APPLE__ */
+ 
+ #ifdef __FreeBSD__
+@@ -57,9 +59,12 @@
+ #ifdef HAVE_NCURSES_H
+ /* configure was checking <curses.h>, but we will
+    use <ncurses.h>, which has all these features. */
++/* NOTE configure check for existence of flags
++ * Also flags are visible only if WINDOW structure is not opaque
+ #ifndef WINDOW_HAS_FLAGS
+ #define WINDOW_HAS_FLAGS 1
+ #endif
++*/
+ #ifndef MVWDELCH_IS_EXPRESSION
+ #define MVWDELCH_IS_EXPRESSION 1
+ #endif
+diff --git a/configure.ac b/configure.ac
+index 0a3a186..75f5142 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -4150,15 +4150,51 @@ then
+ fi
+ 
+ AC_MSG_CHECKING(whether WINDOW has _flags)
+-AC_CACHE_VAL(ac_cv_window_has_flags,
+ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <curses.h>]], [[
+   WINDOW *w;
+   w->_flags = 0;
+ ]])],
+ [ac_cv_window_has_flags=yes],
+-[ac_cv_window_has_flags=no]))
++[ac_cv_window_has_flags=no])
+ AC_MSG_RESULT($ac_cv_window_has_flags)
+ 
++py_curses_window_is_opaque=no
++if test no = $ac_cv_window_has_flags; then
++  AC_MSG_CHECKING([whether WINDOW has _flags in non-opaque structure])
++  AC_COMPILE_IFELSE([
++  AC_LANG_PROGRAM([[
++    #define NCURSES_OPAQUE 0
++    #include <curses.h>
++  ]],[[
++    WINDOW *w;
++    w->_flags = 0;
++  ]])],
++  [py_curses_window_is_opaque=yes])
++  AC_MSG_RESULT([$py_curses_window_is_opaque])
++fi
++if test yes = $py_curses_window_is_opaque; then
++  ac_cv_window_has_flags=yes
++  AC_DEFINE([NCURSES_OPAQUE], [0], [Define to 0 if you have WINDOW _flags in non-opaque structure.])
++fi
++
++py_curses_window_is_internal=no
++if test no = $ac_cv_window_has_flags; then
++  AC_MSG_CHECKING([whether WINDOW has _flags as internal structure])
++  AC_COMPILE_IFELSE([
++  AC_LANG_PROGRAM([[
++    #define NCURSES_INTERNALS 1
++    #include <curses.h>
++  ]],[[
++    WINDOW *w;
++    w->_flags = 0;
++  ]])],
++  [py_curses_window_is_internal=yes])
++  AC_MSG_RESULT([$py_curses_window_is_internal])
++fi
++if test yes = $py_curses_window_is_internal; then
++  ac_cv_window_has_flags=yes
++  AC_DEFINE([NCURSES_INTERNALS], [1], [Define to 1 if you have WINDOW _flags as internal structure.])
++fi
+ 
+ if test "$ac_cv_window_has_flags" = yes
+ then
+diff --git a/pyconfig.h.in b/pyconfig.h.in
+index 3ca3a4f..484c817 100644
+--- a/pyconfig.h.in
++++ b/pyconfig.h.in
+@@ -1130,6 +1130,12 @@
+ /* Define if mvwdelch in curses.h is an expression. */
+ #undef MVWDELCH_IS_EXPRESSION
+ 
++/* Define to 1 if you have WINDOW _flags as internal structure. */
++#undef NCURSES_INTERNALS
++
++/* Define to 0 if you have WINDOW _flags in non-opaque structure. */
++#undef NCURSES_OPAQUE
++
+ /* Define to the address where bug reports for this package should be sent. */
+ #undef PACKAGE_BUGREPORT
+ 
+-- 
+1.6.4
+
diff --git a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
index 70c0d9a1c9cc..1c4318e01686 100644
--- a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
+++ b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
@@ -6,6 +6,7 @@
 , groff, docSupport ? false
 , libyaml, yamlSupport ? true
 , ruby_1_9_3, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc
 }:
 
 let
@@ -44,7 +45,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/ruby/ruby-2.2.0.nix b/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
index b6375aa687d7..e22e64681a3a 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
@@ -7,6 +7,7 @@
 , libyaml, yamlSupport ? true
 , libffi, fiddleSupport ? true
 , ruby_2_2_0, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc, libunwind
 }:
 
 let
@@ -47,7 +48,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc libunwind ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/ruby/ruby-2.2.2.nix b/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
index 0f0fa5245e47..9e015ce9d7b6 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
@@ -7,6 +7,7 @@
 , libyaml, yamlSupport ? true
 , libffi, fiddleSupport ? true
 , ruby_2_2_2, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc, libunwind
 }:
 
 let
@@ -47,7 +48,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc libunwind ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/spidermonkey/17.0.nix b/pkgs/development/interpreters/spidermonkey/17.0.nix
index 74f0fe2b83a4..7573b546164b 100644
--- a/pkgs/development/interpreters/spidermonkey/17.0.nix
+++ b/pkgs/development/interpreters/spidermonkey/17.0.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip }:
+{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip, libffi, readline }:
 
 stdenv.mkDerivation rec {
   version = "17.0.0";
@@ -11,16 +11,26 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nspr ];
 
-  buildInputs = [ pkgconfig perl python zip ];
+  buildInputs = [ pkgconfig perl python zip libffi readline ];
 
   postUnpack = "sourceRoot=\${sourceRoot}/js/src";
 
+  postPatch = ''
+    # Fixes an issue with version detection under perl 5.22.x
+    sed -i 's/(defined\((@TEMPLATE_FILE)\))/\1/' config/milestone.pl
+  '';
+
   preConfigure = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${nspr}/include/nspr"
     export LIBXUL_DIST=$out
   '';
 
-  configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ];
+  configureFlags = [
+    "--enable-threadsafe"
+    "--with-system-nspr"
+    "--with-system-ffi"
+    "--enable-readline"
+  ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
   preBuild = "touch -- {.,shell,jsapi-tests}/{-lpthread,-ldl}";
@@ -39,6 +49,8 @@ stdenv.mkDerivation rec {
     paxmark mr jsapi-tests/jsapi-tests
   '';
 
+  postInstall = ''rm "$out"/lib/*.a''; # halve the output size
+
   meta = with stdenv.lib; {
     description = "Mozilla's JavaScript engine written in C/C++";
     homepage = https://developer.mozilla.org/en/SpiderMonkey;
diff --git a/pkgs/development/interpreters/spidermonkey/24.2.nix b/pkgs/development/interpreters/spidermonkey/24.2.nix
index 44fe4f60d53e..3a9bd8ad7a46 100644
--- a/pkgs/development/interpreters/spidermonkey/24.2.nix
+++ b/pkgs/development/interpreters/spidermonkey/24.2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip }:
+{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip, libffi, readline }:
 
 stdenv.mkDerivation rec {
   version = "24.2.0";
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nspr ];
 
-  buildInputs = [ pkgconfig perl python zip ];
+  buildInputs = [ pkgconfig perl python zip libffi readline ];
+
+  postPatch = ''
+    # Fixes an issue with version detection under perl 5.22.x
+    sed -i 's/(defined\((@TEMPLATE_FILE)\))/\1/' config/milestone.pl
+  '';
 
   postUnpack = "sourceRoot=\${sourceRoot}/js/src";
 
@@ -20,7 +25,12 @@ stdenv.mkDerivation rec {
     export LIBXUL_DIST=$out
   '';
 
-  configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ];
+  configureFlags = [
+    "--enable-threadsafe"
+    "--with-system-nspr"
+    "--with-system-ffi"
+    "--enable-readline"
+  ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
   preBuild = "touch -- {.,shell,jsapi-tests}/{-lpthread,-ldl}";
diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix
index 3e00b21ad43e..a62fc837dd0f 100644
--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@@ -14,6 +14,9 @@ assert x11Support -> (x11 != null && libXrandr != null);
 assert alsaSupport -> alsaLib != null;
 assert pulseaudioSupport -> libpulseaudio != null;
 
+let
+  inherit (stdenv.lib) optional optionals;
+in
 stdenv.mkDerivation rec {
   version = "1.2.15";
   name    = "SDL-${version}";
@@ -23,19 +26,19 @@ stdenv.mkDerivation rec {
     sha256 = "005d993xcac8236fpvd1iawkz4wqjybkpn8dbwaliqz5jfkidlyn";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   # Since `libpulse*.la' contain `-lgdbm', PulseAudio must be propagated.
-  propagatedNativeBuildInputs =
-    stdenv.lib.optionals x11Support [ x11 libXrandr ] ++
-    stdenv.lib.optional alsaSupport alsaLib ++
-    stdenv.lib.optional pulseaudioSupport libpulseaudio;
+  propagatedBuildInputs =
+    optionals x11Support [ x11 libXrandr ] ++
+    optional alsaSupport alsaLib ++
+    optional stdenv.isLinux libcap ++
+    optional openglSupport mesa ++
+    optional pulseaudioSupport libpulseaudio;
 
   buildInputs = let
     notMingw = !(stdenv ? cross) || stdenv.cross.libc != "msvcrt";
-  in stdenv.lib.optional stdenv.isLinux libcap
-    ++ (stdenv.lib.optional notMingw audiofile);
-
-  nativeBuildInputs = [ pkgconfig ] ++
-    stdenv.lib.optional openglSupport [ mesa ];
+  in optional notMingw audiofile;
 
   # XXX: By default, SDL wants to dlopen() PulseAudio, in which case
   # we must arrange to add it to its RPATH; however, `patchelf' seems
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index bfd5ff65563c..f5bd144a7172 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional pulseaudioSupport libpulseaudio;
 
   buildInputs = [ pkgconfig audiofile ] ++
-    stdenv.lib.optional openglSupport [ mesa ] ++
+    stdenv.lib.optional openglSupport mesa ++
     stdenv.lib.optional alsaSupport alsaLib;
 
   # https://bugzilla.libsdl.org/show_bug.cgi?id=1431
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index b562a2e5d3d2..940fc2bb6cc6 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -2,14 +2,14 @@
 , intltool, dbus_glib, at_spi2_core, libSM }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.12";
-  versionMinor = "1";
+  versionMajor = "2.16";
+  versionMinor = "0";
   moduleName   = "at-spi2-atk";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "5fa9c527bdec028e06797563cd52d49bcf06f638549df983424d88db89bb1336";
+    sha256 = "1y9gfz1iz3wpja7s000f0bmyyvc6im5fcdl6bxwbz0v3qdgc9vvq";
   };
 
   buildInputs = [ python pkgconfig popt atk libX11 libICE xlibs.libXtst libXi
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index 7128e4d3f2b8..a3632bc13fdf 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -2,14 +2,14 @@
 , libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.12";
+  versionMajor = "2.16";
   versionMinor = "0";
   moduleName   = "at-spi2-core";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "12gvsgdaxnxskndlhlmdkc50cfqgmzfc4n8la9944fz5k3fhwmfv";
+    sha256 = "1l3l39mw23zyjlcqidvkyqlr4gwbhplzw2hcv3qvn6p8ikxpf2qw";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/blitz/default.nix b/pkgs/development/libraries/blitz/default.nix
index a64a8bd59437..e6f59ca8efeb 100644
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   patches = [ ./blitz-gcc47.patch ./blitz-testsuite-stencil-et.patch ];
 
   buildInputs = [ pkgconfig gfortran texinfo ]
-    ++ optional (boost != null) boost
-    ;
+    ++ optional (boost != null) [ boost.lib ];
 
   configureFlags =
     [ "--enable-shared"
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 5880ae772ceb..823e50e32272 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -27,7 +27,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   preInstall = ''
-    patchShebangs src/scripts
+    if [ -d src/scripts ]; then
+      patchShebangs src/scripts
+    fi
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/crypto++/default.nix b/pkgs/development/libraries/crypto++/default.nix
index 053937f1c56d..788d488659af 100644
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, unzip, libtool }:
+{ fetchurl, stdenv, unzip }:
 
 stdenv.mkDerivation rec {
   name = "crypto++-5.6.2";
@@ -8,45 +8,38 @@ stdenv.mkDerivation rec {
     sha256 = "0x1mqpz1v071cfrw4grbw7z734cxnpry1qh2b6rsmcx6nkyd5gsw";
   };
 
-  patches = (stdenv.lib.optional (stdenv.system != "i686-cygwin") ./dll.patch)
-            ++ (stdenv.lib.optional stdenv.isDarwin ./GNUmakefile.patch);
-
-  buildInputs = [ unzip libtool ];
-
-  # Unpack the thing in a subdirectory.
-  unpackPhase = ''
-    echo "unpacking Crypto++ to \`${name}' from \`$PWD'..."
-    mkdir "${name}" && (cd "${name}" && unzip "$src")
-    sourceRoot="$PWD/${name}"
-  '';
-
-  cxxflags = if stdenv.isi686 then "-march=i686" else
-             if stdenv.isx86_64 then "-march=nocona -fPIC" else
-             "";
-
-  configurePhase = ''
-    sed -i GNUmakefile \
-      -e 's|-march=native|${cxxflags}|g' \
-      -e 's|-mtune=native||g' \
-      -e '/^CXXFLAGS =/s|-g -O2|-O3|'
-  '';
-
-  # I add what 'enableParallelBuilding' would add to the make call,
-  # if we were using the generic build phase.
-  buildPhase = ''
-    make PREFIX="$out" all libcryptopp.so -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
-  '';
-
-  # TODO: Installing cryptotest.exe doesn't seem to be necessary. We run
-  # that binary during this build anyway to verify everything works.
-  installPhase = ''
-    mkdir "$out"
-    make install PREFIX="$out"
-  '';
+  patches = with stdenv;
+    lib.optional (system != "i686-cygwin") ./dll.patch
+    ++ lib.optional isDarwin ./GNUmakefile.patch;
+
+  buildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  configurePhase = let
+    marchflags =
+      if stdenv.isi686 then "-march=i686" else
+      if stdenv.isx86_64 then "-march=nocona -mtune=generic" else
+      "";
+    in
+    ''
+      sed -i GNUmakefile \
+        -e 's|-march=native|${marchflags} -fPIC|g' \
+        -e 's|-mtune=native||g' \
+        -e '/^CXXFLAGS =/s|-g ||'
+    '';
+
+  enableParallelBuilding = true;
+
+  makeFlags = "PREFIX=$(out)";
+  buildFlags = "libcryptopp.so";
 
   doCheck = true;
   checkPhase = "LD_LIBRARY_PATH=`pwd` make test";
 
+  # prefer -fPIC and .so to .a; cryptotest.exe seems superfluous
+  postInstall = ''rm "$out"/lib/*.a -r "$out/bin" '';
+
   meta = with stdenv.lib; {
     description = "Crypto++, a free C++ class library of cryptographic schemes";
     homepage = http://cryptopp.com/;
@@ -55,3 +48,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
   };
 }
+
diff --git a/pkgs/development/libraries/db/generic.nix b/pkgs/development/libraries/db/generic.nix
index 013a7fd35b9d..077bd4e03a32 100644
--- a/pkgs/development/libraries/db/generic.nix
+++ b/pkgs/development/libraries/db/generic.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     (if cxxSupport then "--enable-cxx" else "--disable-cxx")
     (if compat185 then "--enable-compat185" else "--disable-compat185")
+    "--enable-dbm"
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 84a18f2a0b54..d114cf17c4ef 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -7,8 +7,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.8.16";
-  sha256 = "01rba8mp8kqvmy6ibdmi806kjr3m14swnskqk02gyhykxxl54ybz";
+  version = "1.8.18";
+  sha256 = "1wn4k142m68d8yqd4i6dmx1ac0798yhkdnkk4mb72g3sfyffpwin";
 
   inherit (stdenv) lib;
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index da6a3ad1dffc..fafff05a032c 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -3,14 +3,14 @@
 
 let
   ver_maj = "2.31";
-  ver_min = "3";
+  ver_min = "4";
 in
 stdenv.mkDerivation rec {
   name = "gdk-pixbuf-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "ddd861747bb7c580acce7cfa3ce38c3f52a9516e66a6477988fd100c8fb9eabc";
+    sha256 = "05bslhk33qpssg66n2wys9khyzwkr4am0b23dym8n67qjds9gng5";
   };
 
   setupHook = ./setup-hook.sh;
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
     + stdenv.lib.optionalString (gobjectIntrospection != null) " --enable-introspection=yes"
     ;
 
-  doCheck = true;
+  # Seems to randomly fail sometimes with a bus error. FIXME
+  doCheck = !stdenv.isDarwin;
 
   postInstall = "rm -rf $out/share/gtk-doc";
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index 06e820633b84..ba7ab82f50b4 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -1,23 +1,15 @@
 findGdkPixbufLoaders() {
 
-	if [ -n "$out" ] && [ -z "$IN_NIX_SHELL" ]; then
-
-		# set pixbuf loaders.cache for this package
-
-		local loadersDir="$out/lib/gdk-pixbuf-loaders-2.0/$name"
-		mkdir -p "$loadersDir"
-		
-		if [ -f "$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" ]; then
-			cat "$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" >> "$loadersDir/loaders.cache"
+	# choose the longest loaders.cache
+	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+	if [ -f "$loadersCache" ]; then
+		if [ -f "$GDK_PIXBUF_MODULE_FILE" ]; then
+			if [ $(cat "$loadersCache"|wc -l) -gt $(cat "$GDK_PIXBUF_MODULE_FILE"|wc -l) ]; then
+				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+			fi
+		else
+			export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 		fi
-	
-		if [ -f "$1/lib/gdk-pixbuf/loaders.cache" ]; then
-			cat "$1/lib/gdk-pixbuf/loaders.cache" >> "$loadersDir/loaders.cache"
-		fi
-		
-		# note, this is not a search path
-		export GDK_PIXBUF_MODULE_FILE=$(readlink -e "$loadersDir/loaders.cache")
-
 	fi
 
 }
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 15f11f8a133d..f86a15cb0d61 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -19,7 +19,12 @@ stdenv.mkDerivation (rec {
             "--with-included-gettext"
             "--with-included-glib"
             "--with-included-libcroco"
-          ]);
+          ])
+     # avoid retaining reference to CF during stdenv bootstrap
+     ++ (stdenv.lib.optionals stdenv.isDarwin [
+        "gt_cv_func_CFPreferencesCopyAppValue=no"
+        "gt_cv_func_CFLocaleCopyCurrent=no"
+      ]);
 
   # On cross building, gettext supposes that the wchar.h from libc
   # does not fulfill gettext needs, so it tries to work with its
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 7d61bea64e11..5c76bc3186ba 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -40,7 +40,7 @@ let
   '';
 
   ver_maj = "2.44";
-  ver_min = "0";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "1fgmjv3yzxgbks31h42201x2izpw0sd84h8dfw0si3x00sqn5lzj";
+    sha256 = "01yabrfp64i11mrks3p1gcks99lw0zm7f5vhkc53sl4amyndw4c8";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index f173744e5ca6..ca7e326bd02e 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -11,6 +11,12 @@ make_glib_find_gsettings_schemas() {
 envHooks+=(make_glib_find_gsettings_schemas)
 
 glibPreFixupPhase() {
+    # Move gschemas in case the install flag didn't help
+    if [ -d "$out/share/glib-2.0/schemas" ]; then
+        mkdir -p "$out/share/gsettings-schemas/$name/glib-2.0"
+        mv "$out/share/glib-2.0/schemas" "$out/share/gsettings-schemas/$name/glib-2.0/"
+    fi
+
     addToSearchPath GSETTINGS_SCHEMAS_PATH "$out/share/gsettings-schemas/$name"
 }
 
diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index 39d84c4f6fec..02d24d21900b 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -21,7 +21,8 @@ stdenv.mkDerivation rec {
     then "ln -sf configfsf.guess config.guess"
     else ''echo "Darwin host is `./config.guess`."'';
 
-  configureFlags = if cxx then "--enable-cxx" else "--disable-cxx";
+  configureFlags = (if cxx then "--enable-cxx" else "--disable-cxx") +
+    stdenv.lib.optionalString stdenv.isDarwin " ac_cv_build=x86_64-apple-darwin13.4.0 ac_cv_host=x86_64-apple-darwin13.4.0";
 
   # The test t-lucnum_ui fails (on Linux/x86_64) when built with GCC 4.8.
   # Newer versions of GMP don't have that issue anymore.
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 0df1a4f8cd83..7b393067ff52 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, m4, cxx ? true, withStatic ? true }:
 
-with { inherit (stdenv.lib) optional; };
+with { inherit (stdenv.lib) optional optionalString; };
 
 stdenv.mkDerivation rec {
   name = "gmp-5.1.3";
@@ -28,6 +28,13 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.is64bit "--with-pic"
     ;
 
+  # The config.guess in GMP tries to runtime-detect various
+  # ARM optimization flags via /proc/cpuinfo (and is also
+  # broken on multicore CPUs). Avoid this impurity.
+  preConfigure = optionalString stdenv.isArm ''
+      configureFlagsArray+=("--build=$(./configfsf.guess)")
+    '';
+
   doCheck = true;
 
   dontDisableStatic = withStatic;
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index b7350c19960a..171611e12498 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, m4, cxx ? true, withStatic ? true }:
 
-with { inherit (stdenv.lib) optional; };
+with { inherit (stdenv.lib) optional optionalString; };
 
 stdenv.mkDerivation rec {
   name = "gmp-6.0.0a";
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.is64bit "--with-pic"
     ;
 
+  # The config.guess in GMP tries to runtime-detect various
+  # ARM optimization flags via /proc/cpuinfo (and is also
+  # broken on multicore CPUs). Avoid this impurity.
+  preConfigure = optionalString stdenv.isArm ''
+      configureFlagsArray+=("--build=$(./configfsf.guess)")
+    '';
+
   doCheck = true;
 
   dontDisableStatic = withStatic;
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 6f2361f1658a..07760933935a 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -7,15 +7,21 @@
 
 assert guileBindings -> guile != null;
 
+let
+  inherit (stdenv.lib) optional optionals optionalString;
+in
 stdenv.mkDerivation rec {
   name = "gnutls-${version}";
 
   inherit src patches;
 
-  configureFlags = [
+  configureFlags =
+    # FIXME: perhaps use $SSL_CERT_FILE instead
+    optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
+  ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
-  ] ++ stdenv.lib.optional guileBindings
+  ] ++ optionals guileBindings
     [ "--enable-guile" "--with-guile-site-dir=\${out}/share/guile/site" ];
 
   # Build of the Guile bindings is not parallel-safe.  See
@@ -24,9 +30,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = !guileBindings;
 
   buildInputs = [ lzo lzip nettle libtasn1 libidn p11_kit zlib gmp ]
-    ++ stdenv.lib.optional stdenv.isLinux trousers
+    ++ optional stdenv.isLinux trousers
     ++ [ unbound ]
-    ++ stdenv.lib.optional guileBindings guile;
+    ++ optional guileBindings guile;
 
   nativeBuildInputs = [ perl pkgconfig autoreconfHook ];
 
@@ -35,7 +41,7 @@ stdenv.mkDerivation rec {
   doCheck = (!stdenv.isFreeBSD && !stdenv.isDarwin);
 
   # Fixup broken libtool and pkgconfig files
-  preFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+  preFixup = optionalString (!stdenv.isDarwin) ''
     sed -e 's,-ltspi,-L${trousers}/lib -ltspi,' \
         -e 's,-lz,-L${zlib}/lib -lz,' \
         -e 's,-lgmp,-L${gmp}/lib -lgmp,' \
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 200c0d4e01de..50fddd9da9fd 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -5,7 +5,7 @@
 # In that case its about 6MB which could be separated
 
 let
-  ver_maj = "1.42";
+  ver_maj = "1.44";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${ver_maj}/${name}.tar.xz";
-    sha256 = "3ba2edfad4f71d4f0de16960b5d5f2511335fa646b2c49bbb93ce5942b3f95f7";
+    sha256 = "1b972qg2yb51sdavfvb6kc19akwc15c1bwnbg81vadxamql2q33g";
   };
 
   buildInputs = [ flex bison pkgconfig python ]
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index da4796fba896..011e4ecd48e3 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv }:
+{ fetchurl, fetchpatch, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "gsl-1.16";
@@ -8,9 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0lrgipi0z6559jqh82yx8n4xgnxkhzj46v96dl77hahdp58jzg3k";
   };
 
-  # ToDo: there might be more impurities than FMA support check
-  patches = [ ./disable-fma.patch ]; # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
-  patchFlags = "-p0";
+  patches = [
+    # ToDo: there might be more impurities than FMA support check
+    ./disable-fma.patch # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
+
+    (fetchpatch {
+      name = "bug-39055.patch";
+      url = "http://git.savannah.gnu.org/cgit/gsl.git/patch/?id=9cc12d0377";
+      sha256 = "1bmrmihi28cly9g9pq54kkix2jy59y7cd7h5fw4v1c7h5rc2qvs8";
+    })
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/gsl/disable-fma.patch b/pkgs/development/libraries/gsl/disable-fma.patch
index d5c0d620863e..bb1eda9ccccd 100644
--- a/pkgs/development/libraries/gsl/disable-fma.patch
+++ b/pkgs/development/libraries/gsl/disable-fma.patch
@@ -1,5 +1,5 @@
---- configure.ac        2011-09-22 16:13:22 +0000
-+++ configure.ac        2011-11-26 23:55:24 +0000
+--- a/configure.ac        2011-09-22 16:13:22 +0000
++++ b/configure.ac        2011-11-26 23:55:24 +0000
 @@ -381,6 +381,28 @@
  AC_SUBST(HAVE_DARWIN_IEEE_INTERFACE)
  AC_SUBST(HAVE_DARWIN86_IEEE_INTERFACE)
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
index 59ee86da86d4..040cf20c4ea4 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation rec {
   };
 
   patchPhase = ''
-
     sed -i 's@/bin/echo@echo@g' configure
     sed -i -e 's/^   /\t/' docs/{libs,plugins}/Makefile.in
+
+    patch -p1 < ${./gcc-4.9.patch}
   '';
 
   # TODO : v4l, libvisual
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch
new file mode 100644
index 000000000000..fd9f6ea240d2
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch
@@ -0,0 +1,38 @@
+https://bugzilla.gnome.org/show_bug.cgi?id=670690
+
+From 9bd5a7ae5435469c3557a3d70e762791cb3dc5c7 Mon Sep 17 00:00:00 2001
+From: Antoine Jacoutot <ajacoutot@gnome.org>
+Date: Mon, 20 Jan 2014 15:44:09 +0100
+Subject: [PATCH] audioresample: fix build on BSD
+
+On i386, EMMINTRIN is defined but not usable without sse so check for
+__SSE__ and __SSE2__ as well.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=670690
+---
+ gst/audioresample/resample.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gst/audioresample/resample.c b/gst/audioresample/resample.c
+index 98d006c..481fa01 100644
+--- a/gst/audioresample/resample.c
++++ b/gst/audioresample/resample.c
+@@ -77,13 +77,13 @@
+ #define EXPORT G_GNUC_INTERNAL
+ 
+ #ifdef _USE_SSE
+-#ifndef HAVE_XMMINTRIN_H
++#if !defined(__SSE__) || !defined(HAVE_XMMINTRIN_H)
+ #undef _USE_SSE
+ #endif
+ #endif
+ 
+ #ifdef _USE_SSE2
+-#ifndef HAVE_EMMINTRIN_H
++#if !defined(__SSE2__) || !defined(HAVE_XMMINTRIN_H)
+ #undef _USE_SSE2
+ #endif
+ #endif
+-- 
+1.8.5.3
+
diff --git a/pkgs/development/libraries/gtk+/2.x.nix b/pkgs/development/libraries/gtk+/2.x.nix
index 774193cc06c8..fec9d16cf959 100644
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@@ -8,11 +8,11 @@ assert xineramaSupport -> xlibs.libXinerama != null;
 assert cupsSupport -> cups != null;
 
 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.27";
+  name = "gtk+-2.24.28";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "1x14rnjvqslpa1q19fp1qalz5sxds72amsgjk8m7769rwk511jr0";
+    sha256 = "0mj6xn40py9r9lvzg633fal81xfwfm89d9mvz7jk4lmwk0g49imj";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 252e52ee3b98..f83986187270 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -10,7 +10,7 @@ assert cupsSupport -> cups != null;
 
 let
   ver_maj = "3.16";
-  ver_min = "2";
+  ver_min = "5";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "1yhwg2l72l3khfkprydcjlpxjrg11ccqfc80sjl56llz3jk66fd0";
+    sha256 = "0cdwykh4086f7fl4dkybgpyxyb1jcmxbfin2az42z5pb4z8rjz5q";
   };
 
   nativeBuildInputs = [ pkgconfig gettext gobjectIntrospection perl ];
diff --git a/pkgs/development/libraries/icu/default.nix b/pkgs/development/libraries/icu/default.nix
index e95cb7ad0974..909f4e936a94 100644
--- a/pkgs/development/libraries/icu/default.nix
+++ b/pkgs/development/libraries/icu/default.nix
@@ -32,6 +32,11 @@ stdenv.mkDerivation {
   configureFlags = "--disable-debug" +
     stdenv.lib.optionalString stdenv.isDarwin " --enable-rpath";
 
+  # remove dependency on bootstrap-tools in early stdenv build
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
+  '';
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/isl/default.nix b/pkgs/development/libraries/isl/0.15.0.nix
index 9518a0c0e657..eca3372ad4d0 100644
--- a/pkgs/development/libraries/isl/default.nix
+++ b/pkgs/development/libraries/isl/0.15.0.nix
@@ -1,19 +1,17 @@
 { stdenv, fetchurl, gmp }:
 
 stdenv.mkDerivation rec {
-  name = "isl-0.14";
+  name = "isl-0.15";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.bz2";
-    sha256 = "0dlg4b85nw4w534525h0fvb7yhb8i4am8kskhmm0ym7qabzh4g3y";
+    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    sha256 = "1m922l5bz69lvkcxrib7lvjqwfqsr8rpbzgmb2aq07bp76460jhh";
   };
 
   buildInputs = [ gmp ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
-
   meta = {
     homepage = http://www.kotnet.org/~skimo/isl/;
     license = stdenv.lib.licenses.lgpl21;
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index c90a24816481..8bb1d40b2a90 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -20,23 +20,25 @@ stdenv.mkDerivation rec {
     export sourceRoot=${src.name}
   '';
 
-  nativeBuildInputs = [
-    # cmake can be built with the system jsoncpp, or its own bundled version.
-    # Obviously we cannot build it against the system jsoncpp that doesn't yet exist, so
-    # we make a bootstrapping build with the bundled version.
-    (cmake.override { jsoncpp = null; })
-    python
-  ];
+  # Hack to be able to run the test, broken because we use
+  # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
+  preBuild = ''
+    export LD_LIBRARY_PATH="`pwd`/src/lib_json:$LD_LIBRARY_PATH"
+  '';
+
+  nativeBuildInputs = [ cmake python ];
 
   cmakeFlags = [
-    "-DJSONCPP_WITH_CMAKE_PACKAGE=1"
+    "-DJSONCPP_LIB_BUILD_SHARED=ON"
+    "-DJSONCPP_LIB_BUILD_STATIC=OFF"
+    "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
   ];
 
   meta = {
     inherit version;
     homepage = https://github.com/open-source-parsers/jsoncpp;
     description = "A simple API to manipulate JSON data in C++";
-    maintainers = with stdenv.lib.maintainers; [ ttuegel ];
+    maintainers = with stdenv.lib.maintainers; [ ttuegel page ];
     license = stdenv.lib.licenses.mit;
     branch = "1.6";
   };
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/development/libraries/kerberos/heimdal.nix
index 320e161d3da8..159b53b76500 100644
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@@ -1,54 +1,83 @@
-{ stdenv, fetchurl, pkgconfig, flex, yacc, readline, openldap, libcap_ng
-, sqlite, db, ncurses, openssl, cyrus_sasl
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, python, perl, yacc, flex
+, texinfo, perlPackages
+, openldap, libcap_ng, sqlite, openssl, db, libedit, pam
+
+# Extra Args
+, type ? ""
 }:
 
+let
+  libOnly = type == "lib";
+in
+with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "heimdal-1.5.3";
-
-  src = fetchurl {
-    urls = [
-      "http://www.h5l.org/dist/src/${name}.tar.gz"
-      "http://ftp.pdc.kth.se/pub/heimdal/src/${name}.tar.gz"
-    ];
-    sha256 = "19gypf9vzfrs2bw231qljfl4cqc1riyg0ai0xmm1nd1wngnpphma";
+  name = "${type}heimdal-2015-06-17";
+
+  src = fetchFromGitHub {
+    owner = "heimdal";
+    repo = "heimdal";
+    rev = "be63a2914adcbea7d42d56e674ee6edb4883ebaf";
+    sha256 = "147gv49gmy94y6f0x1vx523qni0frgcp3r7fill0r06rkfgfzc0j";
   };
 
+  nativeBuildInputs = [ autoreconfHook pkgconfig python perl yacc flex ]
+    ++ (with perlPackages; [ JSON ])
+    ++ optional (!libOnly) texinfo;
+  buildInputs = [ libcap_ng sqlite openssl db libedit ]
+    ++ optionals (!libOnly) [ openldap pam ];
+
   ## ugly, X should be made an option
   configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
     "--enable-hdb-openldap-module"
     "--with-capng"
-    "--with-openldap=${openldap}"
     "--with-sqlite3=${sqlite}"
-    "--with-openssl-lib=${openssl}/lib"
+    "--with-berkeley-db=${db}"
+    "--with-libedit=${libedit}"
+    "--with-openssl=${openssl}"
     "--without-x"
+  ] ++ optionals (!libOnly) [
+    "--with-openldap=${openldap}"
   ];
 
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -pthread"
+  buildPhase = optionalString libOnly ''
+    (cd include; make -j $NIX_BUILD_CORES)
+    (cd lib; make -j $NIX_BUILD_CORES)
+    (cd tools; make -j $NIX_BUILD_CORES)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
+  '';
+
+  installPhase = optionalString libOnly ''
+    (cd include; make -j $NIX_BUILD_CORES install)
+    (cd lib; make -j $NIX_BUILD_CORES install)
+    (cd tools; make -j $NIX_BUILD_CORES install)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
+    rm -rf $out/{libexec,sbin,share}
+    find $out/bin -type f | grep -v 'krb5-config' | xargs rm
   '';
 
   # We need to build hcrypt for applications like samba
   postBuild = ''
-    (cd lib/hcrypto; make)
-    (cd include/hcrypto; make)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
   '';
 
   postInstall = ''
     # Install hcrypto
-    (cd lib/hcrypto; make install)
-    (cd include/hcrypto; make install)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
 
-    # dont succeed with --libexec=$out/sbin, so
+    # Doesn't succeed with --libexec=$out/sbin, so
     mv "$out/libexec/"* $out/sbin/
     rmdir $out/libexec
   '';
 
-  buildInputs = [
-    pkgconfig flex yacc readline openldap libcap_ng sqlite db ncurses
-    cyrus_sasl openssl
-  ];
+  enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "an implementation of Kerberos 5 (and some more stuff) largely written in Sweden";
     license = licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 41c570ee554e..2e5e48891b82 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -1,41 +1,61 @@
-{ stdenv, fetchurl, pkgconfig, perl, ncurses, yacc, openssl, openldap, bootstrap_cmds }:
+{ stdenv, fetchurl, pkgconfig, perl, yacc, bootstrap_cmds
+, openssl, openldap, libedit
+
+# Extra Arguments
+, type ? ""
+}:
 
 let
-  pname = "krb5";
-  version = "1.13.1";
-  name = "${pname}-${version}";
-  webpage = http://web.mit.edu/kerberos/;
+  libOnly = type == "lib";
 in
-
-stdenv.mkDerivation (rec {
-  inherit name;
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "${type}krb5-${version}";
+  version = "1.13.2";
 
   src = fetchurl {
-    url = "${webpage}dist/krb5/1.13/${name}-signed.tar";
-    sha256 = "0gk6jvr64rf6l4xcyxn8i3fr5d1j7dhqvwyv3vw2qdkzz7yjkxjd";
+    url = "${meta.homepage}dist/krb5/1.13/krb5-${version}-signed.tar";
+    sha256 = "1qbdzyrws7d0q4filsibh28z54pd5l987jr0ygv43iq9085w6a75";
   };
 
-  buildInputs = [ pkgconfig perl ncurses yacc openssl openldap ]
+  nativeBuildInputs = [ pkgconfig perl yacc ]
     # Provides the mig command used by the build scripts
-    ++ stdenv.lib.optional stdenv.isDarwin bootstrap_cmds ;
+    ++ stdenv.lib.optional stdenv.isDarwin bootstrap_cmds;
+  buildInputs = [ openssl ]
+    ++ optionals (!libOnly) [ openldap libedit ];
 
   unpackPhase = ''
     tar -xf $src
-    tar -xzf ${name}.tar.gz
-    cd ${name}/src
+    tar -xzf krb5-${version}.tar.gz
+    cd krb5-${version}/src
   '';
 
-  configureFlags = [ "--with-tcl=no" ];
+  buildPhase = optionalString libOnly ''
+    (cd util; make -j $NIX_BUILD_CORES)
+    (cd include; make -j $NIX_BUILD_CORES)
+    (cd lib; make -j $NIX_BUILD_CORES)
+    (cd build-tools; make -j $NIX_BUILD_CORES)
+  '';
+
+  installPhase = optionalString libOnly ''
+    mkdir -p $out/{bin,include/{gssapi,gssrpc,kadm5,krb5},lib/pkgconfig,sbin,share/{et,man/man1}}
+    (cd util; make -j $NIX_BUILD_CORES install)
+    (cd include; make -j $NIX_BUILD_CORES install)
+    (cd lib; make -j $NIX_BUILD_CORES install)
+    (cd build-tools; make -j $NIX_BUILD_CORES install)
+    rm -rf $out/{sbin,share}
+    find $out/bin -type f | grep -v 'krb5-config' | xargs rm
+  '';
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "MIT Kerberos 5";
-    homepage = webpage;
-    license = "MPL";
+    homepage = http://web.mit.edu/kerberos/;
+    license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ wkennington ];
   };
 
   passthru.implementation = "krb5";
-})
+}
diff --git a/pkgs/development/libraries/lame/default.nix b/pkgs/development/libraries/lame/default.nix
index 562e292791ab..f4ea47e633f9 100644
--- a/pkgs/development/libraries/lame/default.nix
+++ b/pkgs/development/libraries/lame/default.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zr3kadv35ii6liia0bpfgxpag27xcivp571ybckpbz4b10nnd14";
   };
 
+  patches = [ ./gcc-4.9.patch ];
+
   nativeBuildInputs = [ ]
     ++ optional nasmSupport nasm;
 
diff --git a/pkgs/development/libraries/lame/gcc-4.9.patch b/pkgs/development/libraries/lame/gcc-4.9.patch
new file mode 100644
index 000000000000..59f8e00e4a8e
--- /dev/null
+++ b/pkgs/development/libraries/lame/gcc-4.9.patch
@@ -0,0 +1,33 @@
+fix sse optimizations build on 32-bit with gcc 4.9
+http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=351af417bae0d09bd5a3753d1237f03adf591933
+
+xmm_quantize_sub.c: In function 'init_xrpow_core_sse':
+xmm_quantize_sub.c:65:18: warning: SSE vector return without SSE enabled changes the ABI [-W
+psabi]
+     const __m128 vec_fabs_mask = _mm_loadu_ps(&fabs_mask._float[0]);
+                  ^
+In file included from xmm_quantize_sub.c:37:0:
+/usr/lib/gcc/i686-w64-mingw32/4.9.0/include/xmmintrin.h:933:1: error: inlining failed in call to always_inline '_mm_loadu_ps': target specific option mismatch
+ _mm_loadu_ps (float const *__P)
+ ^
+xmm_quantize_sub.c:65:18: error: called from here
+     const __m128 vec_fabs_mask = _mm_loadu_ps(&fabs_mask._float[0]);
+                  ^
+--- lame/libmp3lame/vector/xmm_quantize_sub.c.orig	2014-06-08 12:16:19.455468042 -0700
++++ lame/libmp3lame/vector/xmm_quantize_sub.c	2014-06-08 12:16:09.592356980 -0700
+@@ -35,6 +35,7 @@
+ #ifdef HAVE_XMMINTRIN_H
+ 
+ #include <xmmintrin.h>
++#pragma GCC target("sse")
+ 
+ typedef union {
+     int32_t _i_32[4]; /* unions are initialized by its first member */
+@@ -124,6 +125,7 @@
+ }
+ 
+ 
++#pragma GCC target("sse2")
+ void
+ fht_SSE2(FLOAT * fz, int n)
+ {
diff --git a/pkgs/development/libraries/libarchive/CVE-2015-1197.patch b/pkgs/development/libraries/libarchive/CVE-2015-1197.patch
new file mode 100644
index 000000000000..cb7be5f18cdb
--- /dev/null
+++ b/pkgs/development/libraries/libarchive/CVE-2015-1197.patch
@@ -0,0 +1,143 @@
+From 59357157706d47c365b2227739e17daba3607526 Mon Sep 17 00:00:00 2001
+From: Alessandro Ghedini <alessandro@ghedini.me>
+Date: Sun, 1 Mar 2015 12:07:45 +0100
+Subject: [PATCH] Add ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS option
+
+This fixes a directory traversal in the cpio tool.
+---
+ cpio/bsdcpio.1                           |  3 ++-
+ cpio/cpio.c                              |  2 ++
+ libarchive/archive.h                     |  2 ++
+ libarchive/archive_write_disk.3          |  3 +++
+ libarchive/archive_write_disk_posix.c    | 14 +++++++++++---
+ libarchive/test/test_write_disk_secure.c | 23 +++++++++++++++++++++++
+ 6 files changed, 43 insertions(+), 4 deletions(-)
+
+diff --git a/cpio/bsdcpio.1 b/cpio/bsdcpio.1
+index f966aa0..e52546e 100644
+--- a/cpio/bsdcpio.1
++++ b/cpio/bsdcpio.1
+@@ -156,7 +156,8 @@ See above for description.
+ .It Fl Fl insecure
+ (i and p mode only)
+ Disable security checks during extraction or copying.
+-This allows extraction via symbolic links and path names containing
++This allows extraction via symbolic links, absolute paths,
++and path names containing
+ .Sq ..
+ in the name.
+ .It Fl J , Fl Fl xz
+diff --git a/cpio/cpio.c b/cpio/cpio.c
+index 0acde11..b267e9b 100644
+--- a/cpio/cpio.c
++++ b/cpio/cpio.c
+@@ -171,6 +171,7 @@ main(int argc, char *argv[])
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_NO_OVERWRITE_NEWER;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
++	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_PERM;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_FFLAGS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_ACL;
+@@ -256,6 +257,7 @@ main(int argc, char *argv[])
+ 		case OPTION_INSECURE:
+ 			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ 			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NODOTDOT;
++			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
+ 			break;
+ 		case 'L': /* GNU cpio */
+ 			cpio->option_follow_links = 1;
+diff --git a/libarchive/archive.h b/libarchive/archive.h
+index 1f0fc38..ef635ac 100644
+--- a/libarchive/archive.h
++++ b/libarchive/archive.h
+@@ -649,6 +649,8 @@ __LA_DECL int archive_read_set_passphrase_callback(struct archive *,
+ /* Default: Do not use HFS+ compression if it was not compressed. */
+ /* This has no effect except on Mac OS v10.6 or later. */
+ #define	ARCHIVE_EXTRACT_HFS_COMPRESSION_FORCED	(0x8000)
++/* Default: Do not reject entries with absolute paths */
++#define ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS (0x10000)
+ 
+ __LA_DECL int archive_read_extract(struct archive *, struct archive_entry *,
+ 		     int flags);
+diff --git a/libarchive/archive_write_disk.3 b/libarchive/archive_write_disk.3
+index fa925cc..a2e7afa 100644
+--- a/libarchive/archive_write_disk.3
++++ b/libarchive/archive_write_disk.3
+@@ -177,6 +177,9 @@ The default is to not refuse such paths.
+ Note that paths ending in
+ .Pa ..
+ always cause an error, regardless of this flag.
++.It Cm ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
++Refuse to extract an absolute path.
++The default is to not refuse such paths.
+ .It Cm ARCHIVE_EXTRACT_SPARSE
+ Scan data for blocks of NUL bytes and try to recreate them with holes.
+ This results in sparse files, independent of whether the archive format
+diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c
+index ab3bdac..c1290eb 100644
+--- a/libarchive/archive_write_disk_posix.c
++++ b/libarchive/archive_write_disk_posix.c
+@@ -2509,8 +2509,9 @@ cleanup_pathname_win(struct archive_write_disk *a)
+ /*
+  * Canonicalize the pathname.  In particular, this strips duplicate
+  * '/' characters, '.' elements, and trailing '/'.  It also raises an
+- * error for an empty path, a trailing '..' or (if _SECURE_NODOTDOT is
+- * set) any '..' in the path.
++ * error for an empty path, a trailing '..', (if _SECURE_NODOTDOT is
++ * set) any '..' in the path or (if ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
++ * is set) if the path is absolute.
+  */
+ static int
+ cleanup_pathname(struct archive_write_disk *a)
+@@ -2529,8 +2530,15 @@ cleanup_pathname(struct archive_write_disk *a)
+ 	cleanup_pathname_win(a);
+ #endif
+ 	/* Skip leading '/'. */
+-	if (*src == '/')
++	if (*src == '/') {
++		if (a->flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS) {
++			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
++			                  "Path is absolute");
++			return (ARCHIVE_FAILED);
++		}
++
+ 		separator = *src++;
++	}
+ 
+ 	/* Scan the pathname one element at a time. */
+ 	for (;;) {
+diff --git a/libarchive/test/test_write_disk_secure.c b/libarchive/test/test_write_disk_secure.c
+index 31c5bfd..2c94206 100644
+--- a/libarchive/test/test_write_disk_secure.c
++++ b/libarchive/test/test_write_disk_secure.c
+@@ -178,6 +178,29 @@ DEFINE_TEST(test_write_disk_secure)
+ 	assert(S_ISDIR(st.st_mode));
+ 	archive_entry_free(ae);
+ 
++	/*
++	 * Without security checks, we should be able to
++	 * extract an absolute path.
++	 */
++	assert((ae = archive_entry_new()) != NULL);
++	archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	archive_entry_set_mode(ae, S_IFREG | 0777);
++	assert(0 == archive_write_header(a, ae));
++	assert(0 == archive_write_finish_entry(a));
++	assertFileExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	assert(0 == unlink("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp"));
++
++	/* But with security checks enabled, this should fail. */
++	assert(archive_entry_clear(ae) != NULL);
++	archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	archive_entry_set_mode(ae, S_IFREG | 0777);
++	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS);
++	failure("Extracting an absolute path should fail here.");
++	assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
++	archive_entry_free(ae);
++	assert(0 == archive_write_finish_entry(a));
++	assertFileNotExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++
+ 	assertEqualInt(ARCHIVE_OK, archive_write_free(a));
+ 
+ 	/* Test the entries on disk. */
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 076d22402772..60777614881d 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./CVE-2013-0211.patch # https://github.com/libarchive/libarchive/commit/22531545
+    ./CVE-2015-1197.patch # https://github.com/NixOS/nixpkgs/issues/6799
   ];
 
   buildInputs = [ sharutils libxml2 zlib bzip2 openssl xz ] ++
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index c41e2e0a70b5..16d9d8c75a46 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, fetchsvn, python, llvm, clang }:
+{ stdenv, fetchFromGitHub, python, llvm, clang }:
 
 stdenv.mkDerivation {
   name = "libclc-2015-03-27";
 
-  src = fetchsvn {
-    url = "http://llvm.org/svn/llvm-project/libclc/trunk";
-    rev = "233456";
-    sha256 = "0g56kgffc1qr9rzhcjr4w8kljcicg0q828s9b4bmfzjvywd7hhr0";
+  src = fetchFromGitHub {
+    owner = "llvm-mirror";
+    repo = "libclc";
+    rev = "0a2d1619921545b52303be5608b64dc46f381e97";
+    sha256 = "0hgm013c0vlfqfbbf4cdajl01hhk1mhsfk4h4bfza1san97l0vcc";
   };
 
   buildInputs = [ python llvm clang ];
@@ -22,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     homepage = http://libclc.llvm.org/;
-    description = "implementation of the library requirements of the OpenCL C programming language";
+    description = "Implementation of the library requirements of the OpenCL C programming language";
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 5ffdd9303e0c..b223bd962e7e 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, udev }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.60";
+  name = "libdrm-2.4.61";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "12cqnmssi6mbr93n29mm84k8wix5nx6zs82k7wcmj7z3r335ymwr";
+    sha256 = "8b549092c8961a393a7e1d9a1bccddcea8e2af67c0d7d7c67babb9fc3b47699c";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index dc2f5842b285..5adef716eb0f 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ] else null;
 
   postInstall = ''
-    sed -i ${stdenv.lib.optionalString (stdenv.isDarwin && stdenv.cc.nativeTools) "''"} s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
+    sed -i s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
   '';
 
   configureFlags = [ "--enable-widec" ];
diff --git a/pkgs/development/libraries/libev/default.nix b/pkgs/development/libraries/libev/default.nix
index c9b48d724dd1..d27df16eb944 100644
--- a/pkgs/development/libraries/libev/default.nix
+++ b/pkgs/development/libraries/libev/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jyw7qbl0spxqa0dccj9x1jsw7cj7szff43cq4acmklnra4mzz48";
   };
 
+  patches = [ ./noreturn.patch ];
+
   # Version 4.19 is not valid C11 (which Clang default to)
   # Check if this is still necessary on upgrade
   NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-std=c99" else null;
diff --git a/pkgs/development/libraries/libev/noreturn.patch b/pkgs/development/libraries/libev/noreturn.patch
new file mode 100644
index 000000000000..85e2eaee6b47
--- /dev/null
+++ b/pkgs/development/libraries/libev/noreturn.patch
@@ -0,0 +1,13 @@
+diff --git a/ev.c b/ev.c
+index 6f36c6d..b8a1c5f 100644
+--- a/ev.c
++++ b/ev.c
+@@ -1026,7 +1026,7 @@ ecb_inline uint64_t ecb_rotr64 (uint64_t x, unsigned int count) { return (x << (
+   #define ecb_unreachable() __builtin_unreachable ()
+ #else
+   /* this seems to work fine, but gcc always emits a warning for it :/ */
+-  ecb_inline void ecb_unreachable (void) ecb_noreturn;
++  ecb_inline ecb_noreturn void ecb_unreachable (void);
+   ecb_inline void ecb_unreachable (void) { }
+ #endif
+ 
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 668ac138be83..824b909f1d91 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, dejagnu }:
+{ fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "libffi-3.2.1";
@@ -10,15 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = if stdenv.isCygwin then [ ./3.2.1-cygwin.patch ] else null;
 
-  buildInputs = stdenv.lib.optional doCheck dejagnu;
-
   configureFlags = [
     "--with-gcc-arch=generic" # no detection of -march= or -mtune=
     "--enable-pax_emutramp"
   ];
 
-  doCheck = stdenv.isLinux; # until we solve dejagnu problems on darwin and expect on BSD
-
   dontStrip = stdenv ? cross; # Don't run the native `strip' when cross-compiling.
 
   # Install headers in the right place.
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index 44aa546fe00d..4c781da63083 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "libidn-1.30";
+  name = "libidn-1.31";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${name}.tar.gz";
-    sha256 = "0lxh5r1z8gsk4jxx3rv8aasjv8p53j4y04kvfn2w30a0syagrf9r";
+    sha256 = "026z12mczlag443ms9n954h36pi3m7iva9jfw8y4ispsj772zpxg";
   };
 
   doCheck = ! stdenv.isDarwin;
diff --git a/pkgs/development/libraries/libnatspec/default.nix b/pkgs/development/libraries/libnatspec/default.nix
index 985745c38986..7dafe3434f9f 100644
--- a/pkgs/development/libraries/libnatspec/default.nix
+++ b/pkgs/development/libraries/libnatspec/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation (rec {
     maintainers = [ stdenv.lib.maintainers.urkud ];
   };
 } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-  NIX_CFLAGS_COMPILE = "-I${libiconv}/include";
-
-  NIX_CFLAGS_LINK = "-L${libiconv}/lib -liconv";
+  NIX_LDFLAGS = "-liconv";
+  propagatedBuildInputs = [ libiconv ];
 })
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 9589298ecd50..4c22c988c790 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   # The loaders.cache can be used by setting GDK_PIXBUF_MODULE_FILE to
   # point to this file in a wrapper.
   postConfigure = ''
-    GDK_PIXBUF=$out/lib/gdk-pixbuf
+    GDK_PIXBUF=$out/lib/gdk-pixbuf-2.0/2.10.0
     mkdir -p $GDK_PIXBUF/loaders
     sed -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
         -i gdk-pixbuf-loader/Makefile
@@ -43,4 +43,11 @@ stdenv.mkDerivation rec {
     sed -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#" \
          -i gdk-pixbuf-loader/Makefile
   '';
+
+  # Merge gdkpixbuf and librsvg loaders
+  postInstall = ''
+    mv $GDK_PIXBUF/loaders.cache $GDK_PIXBUF/loaders.cache.tmp
+    cat ${gdk_pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache.tmp > $GDK_PIXBUF/loaders.cache
+    rm $GDK_PIXBUF/loaders.cache.tmp
+  '';
 }
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 7ed9794011cd..739148cb9a69 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,12 +1,7 @@
-{ stdenv, fetchurl, fetchsvn, pkgconfig, zlib, libjpeg, xz }:
+{ stdenv, fetchurl, pkgconfig, zlib, libjpeg, xz }:
 
 let
-  version = "4.0.3";
-  patchDir = fetchsvn {
-    url = svn://svn.archlinux.org/packages/libtiff/trunk;
-    rev = "198247";
-    sha256 = "0a47l0zkc1zz7wxg64cyjv9z1djdvfyxgmwd03znlsac4zijkcy4";
-  };
+  version = "4.0.4beta";
 in
 stdenv.mkDerivation rec {
   name = "libtiff-${version}";
@@ -19,19 +14,6 @@ stdenv.mkDerivation rec {
     sha256 = "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa";
   };
 
-  patchPhase = ''
-    for p in ${patchDir}/*-{2013-4244,2012-4447,2012-4564,2013-1960,2013-1961,libjpeg-turbo}.patch; do
-      patch -p1 < "$p"
-    done
-    (
-    cd tools
-    for p in ${patchDir}/*-CVE-{2013-4231,2013-4232}.patch; do
-      patch -p0 < "$p"
-    done
-    )
-    patch -p0 < ${patchDir}/${if stdenv.isDarwin then "tiff-4.0.3" else "*"}-tiff2pdf-colors.patch
-  ''; # ^ sh on darwin seems not to expand globs in redirects, and I don't want to rebuild all again elsewhere
-
   nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ zlib libjpeg xz ]; #TODO: opengl support (bogus configure detection)
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index 5fb9d5460ac7..75d6bdb4cc6a 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, udev ? null }:
+{ stdenv, fetchurl, pkgconfig, udev ? null, libobjc, IOKit }:
 
 stdenv.mkDerivation rec {
   name = "libusb-1.0.19";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ pkgconfig ];
-  propagatedBuildInputs = stdenv.lib.optional stdenv.isLinux udev;
+  propagatedBuildInputs =
+    stdenv.lib.optional stdenv.isLinux udev ++
+    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 08a969033db8..5ef7b3e6a276 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:
+{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
+
+, ApplicationServices, CoreServices }:
 
 let
   stable = "stable";
@@ -59,7 +61,8 @@ let
   mkWithAutotools = stability: version: sha256: stdenv.mkDerivation {
     name = mkName stability version;
     src = mkSrc version sha256;
-    buildInputs = [ automake autoconf libtool pkgconfig ];
+    buildInputs = [ automake autoconf libtool pkgconfig ]
+      ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
     preConfigure = ''
       LIBTOOLIZE=libtoolize ./autogen.sh
     '';
diff --git a/pkgs/development/libraries/libxcomp/default.nix b/pkgs/development/libraries/libxcomp/default.nix
index 1f1f95b3bb6b..b922778de0ed 100644
--- a/pkgs/development/libraries/libxcomp/default.nix
+++ b/pkgs/development/libraries/libxcomp/default.nix
@@ -26,11 +26,4 @@ stdenv.mkDerivation {
   '';
 
   enableParallelBuilding = true;
-
-  postInstall = ''
-    mkdir $out/lib
-    cp libXcomp.so* $out/lib
-    mkdir $out/include
-    cp NX.h $out/include
-  '';
 }
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index ae8ff907f256..c37aea46eed5 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -22,13 +22,6 @@ stdenv.mkDerivation rec {
     "DESTDIR=\${out}"
   ];
 
-  postInstall = ''
-    rm $out/lib/lib{mbedtls.so.8,polarssl.{a,so}}
-    ln -s libmbedtls.so $out/lib/libmbedtls.so.8
-    ln -s libmbedtls.so $out/lib/libpolarssl.so
-    ln -s libmbedtls.a $out/lib/libpolarssl.a
-  '';
-
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 8364cab7623c..be2544091e26 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, intltool, flex, bison, autoreconfHook, substituteAll
 , python, libxml2Python, file, expat, makedepend, pythonPackages
 , libdrm, xorg, wayland, udev, llvmPackages, libffi, libomxil-bellagio
-, libvdpau, libelf, libva, libclc
+, libvdpau, libelf, libva
 , grsecEnabled
 , enableTextureFloats ? false # Texture floats are patented, see docs/patents.txt
 , enableExtraFeatures ? false # not maintained
@@ -23,10 +23,9 @@ else
 */
 
 let
-  version = "10.5.6";
+  version = "10.6.1";
   # this is the default search path for DRI drivers
   driverLink = "/run/opengl-driver" + stdenv.lib.optionalString stdenv.isi686 "-32";
-  clang = if llvmPackages ? clang-unwrapped then llvmPackages.clang-unwrapped else llvmPackages.clang;
 in
 with { inherit (stdenv.lib) optional optionals optionalString; };
 
@@ -38,7 +37,7 @@ stdenv.mkDerivation {
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "15d5icr7q0nq1a7718fsj4s1l29aa4qdxvmkgmjadxz5pm9ph0b6";
+    sha256 = "6c80a2b647e57c85dc36e609d9aed17f878f0d8e0cf9ace86d14cf604101e1eb";
   };
 
   prePatch = "patchShebangs .";
@@ -63,7 +62,6 @@ stdenv.mkDerivation {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-clang-libdir=${clang}/lib"
     "--with-dri-driverdir=$(drivers)/lib/dri"
     "--with-dri-searchpath=${driverLink}/lib/dri"
 
@@ -81,13 +79,11 @@ stdenv.mkDerivation {
     ++ [
     "--enable-xvmc"
     "--enable-vdpau"
-    "--enable-omx"
-    "--enable-va"
+    #"--enable-omx"
+    #"--enable-va"
 
     # TODO: Figure out how to enable opencl without having a runtime dependency on clang
     "--disable-opencl"
-    #"--enable-opencl"
-    #"--enable-opencl-icd"
 
     "--with-gallium-drivers=svga,i915,ilo,r300,r600,radeonsi,nouveau,freedreno,swrast"
     "--enable-shared-glapi"
@@ -111,8 +107,7 @@ stdenv.mkDerivation {
     autoreconfHook intltool expat libxml2Python llvmPackages.llvm
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence
-    libffi wayland libvdpau libelf libXvMC libomxil-bellagio libva
-    libclc clang
+    libffi wayland libvdpau libelf libXvMC /* libomxil-bellagio libva */
   ] ++ optional stdenv.isLinux udev;
 
   enableParallelBuilding = true;
@@ -132,9 +127,6 @@ stdenv.mkDerivation {
       `#$out/lib/libXvMC*` \
       $out/lib/gbm $out/lib/libgbm* \
   '' + ''
-      $out/lib/gallium-pipe \
-      $out/lib/libdricore* \
-      $out/lib/libgallium* \
       $out/lib/vdpau \
       $out/lib/libxatracker*
 
@@ -149,18 +141,6 @@ stdenv.mkDerivation {
       $out/lib/pkgconfig/osmesa.pc
 
   '' + /* now fix references in .la files */ ''
-    sed "/^libdir=/s,$out,$drivers," -i \
-  '' + optionalString enableExtraFeatures ''
-      `#$drivers/lib/libXvMC*.la` \
-  '' + ''
-      $drivers/lib/gallium-pipe/*.la \
-      $drivers/lib/libgallium.la \
-      $drivers/lib/vdpau/*.la \
-      $drivers/lib/libdricore*.la
-
-    sed "s,$out\(/lib/\(libdricore[0-9\.]*\|libgallium\).la\),$drivers\1,g" \
-      -i $drivers/lib/*.la $drivers/lib/*/*.la
-
     sed "/^libdir=/s,$out,$osmesa," -i \
       $osmesa/lib/libOSMesa*.la
 
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 9df56212ad2c..c505d89a6d8f 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -1,31 +1,14 @@
-{ stdenv, fetchurl
+{ lib, stdenv, fetchurl
 
-# Optional Dependencies
-, gpm ? null
+, mouseSupport ? false
+, unicode ? true
+
+, gpm
 
 # Extra Options
 , abiVersion ? "5"
-, unicode ? true
 }:
 
-let
-  mkFlag = trueStr: falseStr: cond: name: val:
-    if cond == null then null else
-      "--${if cond != false then trueStr else falseStr}${name}${if val != null && cond != false then "=${val}" else ""}";
-  mkEnable = mkFlag "enable-" "disable-";
-  mkWith = mkFlag "with-" "without-";
-  mkOther = mkFlag "" "" true;
-
-  shouldUsePkg = pkg_: let
-    pkg = (builtins.tryEval pkg_).value;
-  in if stdenv.lib.any (x: x == stdenv.system) (pkg.meta.platforms or [])
-    then pkg
-    else null;
-
-  buildShared = !stdenv.isDarwin;
-
-  optGpm = shouldUsePkg gpm;
-in
 stdenv.mkDerivation rec {
   name = "ncurses-5.9";
 
@@ -34,54 +17,23 @@ stdenv.mkDerivation rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   };
 
-  patches = [ ./clang.patch ];
-
-  buildInputs = [ optGpm ];
+  # gcc-5.patch should be removed after 5.9
+  patches = [ ./clang.patch ./gcc-5.patch ];
 
   configureFlags = [
-    (mkWith   true        "abi-version" abiVersion)
-    (mkWith   true        "cxx"         null)
-    (mkWith   true        "cxx-binding" null)
-    (mkWith   false       "ada"         null)
-    (mkWith   true        "manpages"    null)
-    (mkWith   true        "progs"       null)
-    (mkWith   doCheck     "tests"       null)
-    (mkWith   true        "curses-h"    null)
-    (mkEnable true        "pc-files"    null)
-    (mkWith   buildShared "shared"      null)
-    (mkWith   true        "normal"      null)
-    (mkWith   false       "debug"       null)
-    (mkWith   false       "termlib"     null)
-    (mkWith   false       "ticlib"      null)
-    (mkWith   optGpm      "gpm"         null)
-    (mkEnable true        "overwrite"   null)
-    (mkEnable true        "database"    null)
-    (mkWith   true        "xterm-new"   null)
-    (mkEnable true        "symlinks"    null)
-    (mkEnable unicode     "widec"       null)
-    (mkEnable true        "ext-colors"  null)
-    (mkEnable true        "ext-mouse"   null)
-  ] ++ stdenv.lib.optionals stdenv.isCygwin [
-    "--enable-sp-funcs"
-    "--enable-term-driver"
-    "--enable-const"
-    "--enable-ext-colors"
-    "--enable-ext-mouse"
-    "--enable-reentrant"
-    "--enable-colorfgbg"
-    "--enable-tcap-names"
-  ];
-
-  # PKG_CONFIG_LIBDIR is where the *.pc files will be installed. If this
-  # directory doesn't exist, the configure script will disable installation of
-  # *.pc files. The configure script usually (on LSB distros) pick $(path of
-  # pkg-config)/../lib/pkgconfig. On NixOS that path doesn't exist and is not
-  # the place we want to put *.pc files from other packages anyway. So we must
-  # tell it explicitly where to install with PKG_CONFIG_LIBDIR.
+    "--with-shared"
+    "--without-debug"
+    "--enable-pc-files"
+    "--enable-symlinks"
+  ] ++ lib.optional unicode "--enable-widec";
+
+  buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;
+
   preConfigure = ''
+    configureFlagsArray+=("--includedir=$out/include")
     export PKG_CONFIG_LIBDIR="$out/lib/pkgconfig"
     mkdir -p "$PKG_CONFIG_LIBDIR"
-  '' + stdenv.lib.optionalString stdenv.isCygwin ''
+  '' + lib.optionalString stdenv.isCygwin ''
     sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure
   '';
 
@@ -94,49 +46,47 @@ stdenv.mkDerivation rec {
   # When building a wide-character (Unicode) build, create backward
   # compatibility links from the the "normal" libraries to the
   # wide-character libraries (e.g. libncurses.so to libncursesw.so).
-  postInstall = if unicode then (''
-    # Create a non-abi versioned config
-    cfg=$(basename $out/bin/ncurses*-config)
-    ln -svf $cfg $out/bin/ncursesw-config
-    ln -svf $cfg $out/bin/ncurses-config
-
-    # Allow for end users who #include <ncurses?w/*.h>
-    ln -svf . $out/include/ncursesw
-    ln -svf . $out/include/ncurses
-
-    # Create non-unicode compatability
-    libs="$(find $out/lib -name \*w.a | sed 's,.*lib\(.*\)w.a.*,\1,g')"
-    for lib in $libs; do
-      if [ -e "$out/lib/lib''${lib}w.so" ]; then
-        ln -svf lib''${lib}w.so $out/lib/lib$lib.so
-        ln -svf lib''${lib}w.so.${abiVersion} $out/lib/lib$lib.so.${abiVersion}
-      fi
-      ln -svf lib''${lib}w.a $out/lib/lib$lib.a
-      ln -svf ''${lib}w.pc $out/lib/pkgconfig/$lib.pc
-    done
+  postInstall = ''
+    # Determine what suffixes our libraries have
+    suffix="$(awk -F': ' 'f{print $3; f=0} /default library suffix/{f=1}' config.log)"
+    libs="$(ls $out/lib/pkgconfig | tr ' ' '\n' | sed "s,\(.*\)$suffix\.pc,\1,g")"
+    suffixes="$(echo "$suffix" | awk '{for (i=1; i < length($0); i++) {x=substr($0, i+1, length($0)-i); print x}}')"
 
-    # Create curses compatability
-    ln -svf libncursesw.so $out/lib/libcursesw.so
-    ln -svf libncursesw.so $out/lib/libcurses.so
-  '' + stdenv.lib.optionalString stdenv.isCygwin ''
-    for lib in $libs; do
-      if test -e $out/lib/lib''${lib}w.dll.a; then
-          ln -svf lib''${lib}w.dll.a $out/lib/lib$lib.dll.a
-      fi
-    done
-  '') else ''
-    # Create a non-abi versioned config
+    # Get the path to the config util
     cfg=$(basename $out/bin/ncurses*-config)
-    ln -svf $cfg $out/bin/ncurses-config
 
-    # Allow for end users who #include <ncurses/*.h>
-    ln -svf . $out/include/ncurses
+    # symlink the full suffixed include directory
+    ln -svf . $out/include/ncurses$suffix
+
+    for newsuffix in $suffixes ""; do
+      # Create a non-abi versioned config util links
+      ln -svf $cfg $out/bin/ncurses$newsuffix-config
+
+      # Allow for end users who #include <ncurses?w/*.h>
+      ln -svf . $out/include/ncurses$newsuffix
+
+      for lib in $libs; do
+        for dylibtype in so dll dylib; do
+          if [ -e "$out/lib/lib''${lib}$suffix.$dylibtype" ]; then
+            ln -svf lib''${lib}$suffix.$dylibtype $out/lib/lib$lib$newsuffix.$dylibtype
+            ln -svf lib''${lib}$suffix.$dylibtype.${abiVersion} $out/lib/lib$lib$newsuffix.$dylibtype.${abiVersion}
+          fi
+        done
+        for statictype in a dll.a la; do
+          if [ -e "$out/lib/lib''${lib}$suffix.$statictype" ]; then
+            ln -svf lib''${lib}$suffix.$statictype $out/lib/lib$lib$newsuffix.$statictype
+          fi
+        done
+        ln -svf ''${lib}$suffix.pc $out/lib/pkgconfig/$lib$newsuffix.pc
+      done
+    done
+  '';
 
-    # Create curses compatability
-    ln -svf libncurses.so $out/lib/libcurses.so
+  preFixup = ''
+    rm $out/lib/*.a
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "Free software emulation of curses in SVR4 and more";
 
     longDescription = ''
@@ -155,13 +105,13 @@ stdenv.mkDerivation rec {
 
     homepage = http://www.gnu.org/software/ncurses/;
 
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ wkennington ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.wkennington ];
   };
 
   passthru = {
-    ldflags = if unicode then "-lncursesw" else "-lncurses";
+    ldflags = "-lncurses";
     inherit unicode abiVersion;
   };
 }
diff --git a/pkgs/development/libraries/ncurses/gcc-5.patch b/pkgs/development/libraries/ncurses/gcc-5.patch
new file mode 100644
index 000000000000..2448229b88e1
--- /dev/null
+++ b/pkgs/development/libraries/ncurses/gcc-5.patch
@@ -0,0 +1,46 @@
+https://bugs.gentoo.org/545114
+
+extracted from the upstream change (which had many unrelated commits in one)
+
+From 97bb4678dc03e753290b39bbff30ba2825df9517 Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Sun, 7 Dec 2014 03:10:09 +0000
+Subject: [PATCH] ncurses 5.9 - patch 20141206
+
++ modify MKlib_gen.sh to work around change in development version of
+  gcc introduced here:
+	  https://gcc.gnu.org/ml/gcc-patches/2014-06/msg02185.html
+	  https://gcc.gnu.org/ml/gcc-patches/2014-07/msg00236.html
+  (reports by Marcus Shawcroft, Maohui Lei).
+
+diff --git a/ncurses/base/MKlib_gen.sh b/ncurses/base/MKlib_gen.sh
+index d8cc3c9..b91398c 100755
+--- a/ncurses/base/MKlib_gen.sh
++++ b/ncurses/base/MKlib_gen.sh
+@@ -474,11 +474,22 @@ sed -n -f $ED1 \
+ 	-e 's/gen_$//' \
+ 	-e 's/  / /g' >>$TMP
+ 
++cat >$ED1 <<EOF
++s/  / /g
++s/^ //
++s/ $//
++s/P_NCURSES_BOOL/NCURSES_BOOL/g
++EOF
++
++# A patch discussed here:
++#	https://gcc.gnu.org/ml/gcc-patches/2014-06/msg02185.html
++# introduces spurious #line markers.  Work around that by ignoring the system's
++# attempt to define "bool" and using our own symbol here.
++sed -e 's/bool/P_NCURSES_BOOL/g' $TMP > $ED2
++cat $ED2 >$TMP
++
+ $preprocessor $TMP 2>/dev/null \
+-| sed \
+-	-e 's/  / /g' \
+-	-e 's/^ //' \
+-	-e 's/_Bool/NCURSES_BOOL/g' \
++| sed -f $ED1 \
+ | $AWK -f $AW2 \
+ | sed -f $ED3 \
+ | sed \
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index bc8c599a901f..e5e4f1cfff33 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -34,12 +34,12 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}nghttp2-${version}";
-  version = "0.7.14";
+  version = "1.0.2";
 
   # Don't use fetchFromGitHub since this needs a bootstrap curl
   src = fetchurl {
     url = "http://pub.wak.io/nixos/tarballs/nghttp2-${version}.tar.bz2";
-    sha256 = "000d50yzyysbr9ldhvnbpzn35vplqm08dnmh55wc5zk273gy383f";
+    sha256 = "633dd6d5d1f29a4d802d6c9e5b9eeb0b9104f35652396f26999a27515b6c1c14";
   };
 
   # Configure script searches for a symbol which does not exist in jemalloc on Darwin
diff --git a/pkgs/development/libraries/openssl/1.0.2.x.nix b/pkgs/development/libraries/openssl/1.0.2.x.nix
index e5237515f200..28254cb390d4 100644
--- a/pkgs/development/libraries/openssl/1.0.2.x.nix
+++ b/pkgs/development/libraries/openssl/1.0.2.x.nix
@@ -1,57 +1,27 @@
 { stdenv, fetchurl, perl
 , withCryptodev ? false, cryptodevHeaders }:
 
+with stdenv.lib;
 let
-  name = "openssl-1.0.2c";
-
-  opensslCrossSystem = stdenv.lib.attrByPath [ "openssl" "system" ]
+  opensslCrossSystem = attrByPath [ "openssl" "system" ]
     (throw "openssl needs its platform name cross building" null)
     stdenv.cross;
-
-  patchesCross = isCross: let
-    isDarwin = stdenv.isDarwin || (isCross && stdenv.cross.libc == "libSystem");
-  in
-    [ # Allow the location of the X509 certificate file (the CA
-      # bundle) to be set through the environment variable
-      # ‘OPENSSL_X509_CERT_FILE’.  This is necessary because the
-      # default location ($out/ssl/cert.pem) doesn't exist, and
-      # hardcoding something like /etc/ssl/cert.pem is impure and
-      # cannot be overriden per-process.  For security, the
-      # environment variable is ignored for setuid binaries.
-      # FIXME: drop this patch; it really isn't necessary, because
-      # OpenSSL already supports a ‘SSL_CERT_FILE’ variable.
-      ./cert-file.patch
-    ]
-
-    ++ stdenv.lib.optionals (isCross && opensslCrossSystem == "hurd-x86")
-         [ ./cert-file-path-max.patch # merge with `cert-file.patch' eventually
-           ./gnu.patch                # submitted upstream
-         ]
-
-    ++ stdenv.lib.optionals (stdenv.system == "x86_64-kfreebsd-gnu")
-        [ ./gnu.patch
-          ./kfreebsd-gnu.patch
-        ];
-
-  extraPatches = stdenv.lib.optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 in
-
-stdenv.mkDerivation {
-  inherit name;
+stdenv.mkDerivation rec {
+  name = "openssl-1.0.2d";
 
   src = fetchurl {
     urls = [
       "http://www.openssl.org/source/${name}.tar.gz"
       "http://openssl.linux-mirror.org/source/${name}.tar.gz"
     ];
-    sha256 = "10vasdg52qiyqvgbp14n9z7ghglmhzvag9qpiz2nfqssycvvlf00";
+    sha1 = "d01d17b44663e8ffa6a33a5a30053779d9593c3d";
   };
 
-  patches = (patchesCross false) ++ extraPatches;
-
-  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+  patches = optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
   # On x86_64-darwin, "./config" misdetects the system as
   # "darwin-i386-cc".  So specify the system type explicitly.
@@ -60,46 +30,48 @@ stdenv.mkDerivation {
     else if stdenv.system == "x86_64-solaris" then "./Configure solaris64-x86_64-gcc"
     else "./config";
 
-  configureFlags = "shared --libdir=lib --openssldir=etc/ssl" +
-    stdenv.lib.optionalString withCryptodev " -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS";
-
-  # CYGXXX: used to be set for cygwin with optionalString. Not needed
-  # anymore but kept to prevent rebuild.
-  preBuild = "";
+  configureFlags = [
+    "shared"
+    "--libdir=lib"
+    "--openssldir=etc/ssl"
+  ] ++ stdenv.lib.optionals withCryptodev [
+    "-DHAVE_CRYPTODEV"
+    "-DUSE_CRYPTODEV_DIGESTS"
+  ];
 
-  makeFlags = "MANDIR=$(out)/share/man";
+  makeFlags = [
+    "MANDIR=$(out)/share/man"
+  ];
 
   # Parallel building is broken in OpenSSL.
   enableParallelBuilding = false;
 
-  postInstall =
-    ''
-      # If we're building dynamic libraries, then don't install static
-      # libraries.
-      if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib)" ]; then
-          rm $out/lib/*.a
-      fi
-    ''; # */
+  postInstall = ''
+    # If we're building dynamic libraries, then don't install static
+    # libraries.
+    if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
+        rm "$out/lib/"*.a
+    fi
+
+    # remove dependency on Perl at runtime
+    rm -r $out/etc/ssl/misc $out/bin/c_rehash
+  '';
+
+  postFixup = ''
+    # Check to make sure we don't depend on perl
+    if grep -r '${perl}' $out; then
+      echo "Found an erroneous dependency on perl ^^^" >&2
+      exit 1
+    fi
+  '';
 
   crossAttrs = {
-    patches = patchesCross true;
-
     preConfigure=''
       # It's configure does not like --build or --host
-      export configureFlags="--libdir=lib --cross-compile-prefix=${stdenv.cross.config}- shared ${opensslCrossSystem}"
+      export configureFlags="${concatStringsSep " " (configureFlags ++ [ opensslCrossSystem ])}"
     '';
 
-    postInstall = ''
-      # Openssl installs readonly files, which otherwise we can't strip.
-      # This could at some stdenv hash change be put out of crossAttrs, too
-      chmod -R +w $out
-
-      # Remove references to perl, to avoid depending on it at runtime
-      rm $out/bin/c_rehash $out/ssl/misc/CA.pl $out/ssl/misc/tsget
-    '';
     configureScript = "./Configure";
-  } // stdenv.lib.optionalAttrs (opensslCrossSystem == "darwin64-x86_64-cc") {
-    CC = "gcc";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/openssl/cert-file-path-max.patch b/pkgs/development/libraries/openssl/cert-file-path-max.patch
deleted file mode 100644
index 50621c5cb820..000000000000
--- a/pkgs/development/libraries/openssl/cert-file-path-max.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-This patch, to be applied after `cert-file.patch', fixes compilation
-on GNU/Hurd where `PATH_MAX' is not defined.
-
-diff -ubB --show-c-function openssl-1.0.0e/crypto/x509/x509_def.c.orig openssl-1.0.0e/crypto/x509/x509_def.c
---- openssl-1.0.0e/crypto/x509/x509_def.c.orig	2012-01-06 00:08:48.000000000 +0100
-+++ openssl-1.0.0e/crypto/x509/x509_def.c	2012-01-06 00:11:29.000000000 +0100
-@@ -58,6 +58,7 @@
- 
- #include <stdio.h>
- #include <stdlib.h>
-+#include <string.h>
- #include <limits.h>
- #include <unistd.h>
- #include <sys/types.h>
-@@ -76,14 +77,16 @@ const char *X509_get_default_cert_dir(vo
- 
- const char *X509_get_default_cert_file(void)
- 	{
--	static char buf[PATH_MAX] = X509_CERT_FILE;
-+	static char *buf;
- 	static int init = 0;
- 	if (!init) {
- 	    init = 1;
- 	    char * s = getenv("OPENSSL_X509_CERT_FILE");
- 	    if (s && getuid() == geteuid()) {
--		strncpy(buf, s, sizeof(buf));
--		buf[sizeof(buf) - 1] = 0;
-+	         buf = strdup(s);
-+	    }
-+	    if (!s) {
-+	         buf = strdup(X509_CERT_FILE);
- 	    }
- 	}
- 	return buf;
diff --git a/pkgs/development/libraries/openssl/cert-file.patch b/pkgs/development/libraries/openssl/cert-file.patch
deleted file mode 100644
index e6e661112015..000000000000
--- a/pkgs/development/libraries/openssl/cert-file.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-diff -ru openssl-1.0.1m-orig/crypto/x509/x509_def.c openssl-1.0.1m/crypto/x509/x509_def.c
---- openssl-1.0.1m-orig/crypto/x509/x509_def.c	2015-03-19 14:19:00.000000000 +0100
-+++ openssl-1.0.1m/crypto/x509/x509_def.c	2015-03-19 15:50:44.676683616 +0100
-@@ -57,6 +57,10 @@
-  */
- 
- #include <stdio.h>
-+#include <stdlib.h>
-+#include <limits.h>
-+#include <unistd.h>
-+#include <sys/types.h>
- #include "cryptlib.h"
- #include <openssl/crypto.h>
- #include <openssl/x509.h>
-@@ -78,7 +82,23 @@
- 
- const char *X509_get_default_cert_file(void)
- {
--    return (X509_CERT_FILE);
-+    static char buf[PATH_MAX] = X509_CERT_FILE;
-+    static int init = 0;
-+    if (!init) {
-+        init = 1;
-+        char * s = getenv("OPENSSL_X509_CERT_FILE");
-+        if (s) {
-+#ifndef OPENSSL_SYS_WINDOWS
-+            if (getuid() == geteuid()) {
-+#endif
-+                strncpy(buf, s, sizeof(buf));
-+                buf[sizeof(buf) - 1] = 0;
-+#ifndef OPENSSL_SYS_WINDOWS
-+            }
-+#endif
-+        }
-+    }
-+    return buf;
- }
- 
- const char *X509_get_default_cert_dir_env(void)
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 7f428fd584b9..b9224dad110a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -1,59 +1,28 @@
 { stdenv, fetchurl, perl
 , withCryptodev ? false, cryptodevHeaders }:
 
+with stdenv.lib;
 let
-  name = "openssl-1.0.1m";
-
-  opensslCrossSystem = stdenv.lib.attrByPath [ "openssl" "system" ]
+  opensslCrossSystem = attrByPath [ "openssl" "system" ]
     (throw "openssl needs its platform name cross building" null)
     stdenv.cross;
-
-  patchesCross = isCross: let
-    isDarwin = stdenv.isDarwin || (isCross && stdenv.cross.libc == "libSystem");
-  in
-    [ # Allow the location of the X509 certificate file (the CA
-      # bundle) to be set through the environment variable
-      # ‘OPENSSL_X509_CERT_FILE’.  This is necessary because the
-      # default location ($out/ssl/cert.pem) doesn't exist, and
-      # hardcoding something like /etc/ssl/cert.pem is impure and
-      # cannot be overriden per-process.  For security, the
-      # environment variable is ignored for setuid binaries.
-      # FIXME: drop this patch; it really isn't necessary, because
-      # OpenSSL already supports a ‘SSL_CERT_FILE’ variable.
-      ./cert-file.patch
-    ]
-
-    ++ stdenv.lib.optionals (isCross && opensslCrossSystem == "hurd-x86")
-         [ ./cert-file-path-max.patch # merge with `cert-file.patch' eventually
-           ./gnu.patch                # submitted upstream
-         ]
-
-    ++ stdenv.lib.optionals (stdenv.system == "x86_64-kfreebsd-gnu")
-        [ ./gnu.patch
-          ./kfreebsd-gnu.patch
-        ]
-
-    ++ stdenv.lib.optional isDarwin ./darwin-arch.patch;
-
-  extraPatches = stdenv.lib.optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 in
-
-stdenv.mkDerivation {
-  inherit name;
+stdenv.mkDerivation rec {
+  name = "openssl-1.0.1p";
 
   src = fetchurl {
     urls = [
       "http://www.openssl.org/source/${name}.tar.gz"
       "http://openssl.linux-mirror.org/source/${name}.tar.gz"
     ];
-    sha256 = "0x7gvyybmqm4lv62mlhlm80f1rn7il2qh8224rahqv0i15xhnpq9";
+    sha1 = "9d1977cc89242cd11471269ece2ed4650947c046";
   };
 
-  patches = (patchesCross false) ++ extraPatches;
-
-  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+  patches = optional stdenv.isCygwin ./1.0.1-cygwin64.patch
+    ++ optional (stdenv.isDarwin || (stdenv ? cross && stdenv.cross.libc == "libSystem")) ./darwin-arch.patch;
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
   # On x86_64-darwin, "./config" misdetects the system as
   # "darwin-i386-cc".  So specify the system type explicitly.
@@ -62,46 +31,48 @@ stdenv.mkDerivation {
     else if stdenv.system == "x86_64-solaris" then "./Configure solaris64-x86_64-gcc"
     else "./config";
 
-  configureFlags = "shared --libdir=lib --openssldir=etc/ssl" +
-    stdenv.lib.optionalString withCryptodev " -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS";
-
-  # CYGXXX: used to be set for cygwin with optionalString. Not needed
-  # anymore but kept to prevent rebuild.
-  preBuild = "";
+  configureFlags = [
+    "shared"
+    "--libdir=lib"
+    "--openssldir=etc/ssl"
+  ] ++ stdenv.lib.optionals withCryptodev [
+    "-DHAVE_CRYPTODEV"
+    "-DUSE_CRYPTODEV_DIGESTS"
+  ];
 
-  makeFlags = "MANDIR=$(out)/share/man";
+  makeFlags = [
+    "MANDIR=$(out)/share/man"
+  ];
 
   # Parallel building is broken in OpenSSL.
   enableParallelBuilding = false;
 
-  postInstall =
-    ''
-      # If we're building dynamic libraries, then don't install static
-      # libraries.
-      if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib)" ]; then
-          rm $out/lib/*.a
-      fi
-    ''; # */
+  postInstall = ''
+    # If we're building dynamic libraries, then don't install static
+    # libraries.
+    if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
+        rm "$out/lib/"*.a
+    fi
+
+    # remove dependency on Perl at runtime
+    rm -r $out/etc/ssl/misc $out/bin/c_rehash
+  '';
+
+  postFixup = ''
+    # Check to make sure we don't depend on perl
+    if grep -r '${perl}' $out; then
+      echo "Found an erroneous dependency on perl ^^^" >&2
+      exit 1
+    fi
+  '';
 
   crossAttrs = {
-    patches = patchesCross true;
-
     preConfigure=''
       # It's configure does not like --build or --host
-      export configureFlags="--libdir=lib --cross-compile-prefix=${stdenv.cross.config}- shared ${opensslCrossSystem}"
+      export configureFlags="${concatStringsSep " " (configureFlags ++ [ opensslCrossSystem ])}"
     '';
 
-    postInstall = ''
-      # Openssl installs readonly files, which otherwise we can't strip.
-      # This could at some stdenv hash change be put out of crossAttrs, too
-      chmod -R +w $out
-
-      # Remove references to perl, to avoid depending on it at runtime
-      rm $out/bin/c_rehash $out/ssl/misc/CA.pl $out/ssl/misc/tsget
-    '';
     configureScript = "./Configure";
-  } // stdenv.lib.optionalAttrs (opensslCrossSystem == "darwin64-x86_64-cc") {
-    CC = "gcc";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/openssl/gnu.patch b/pkgs/development/libraries/openssl/gnu.patch
deleted file mode 100644
index 3cc6d049c944..000000000000
--- a/pkgs/development/libraries/openssl/gnu.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-Patch to fix compilation on GNU/Hurd and GNU/kFreeBSD.
-
---- openssl-1.0.0e/Configure	2012-01-06 00:39:49.000000000 +0100
-+++ openssl-1.0.0e/Configure	2012-01-06 00:39:51.000000000 +0100
-@@ -563,7 +563,7 @@ my %table=(
- "newsos4-gcc","gcc:-O -DB_ENDIAN::(unknown):NEWS4:-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::",
- 
- ##### GNU Hurd
--"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
-+"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- 
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
-
---- openssl-1.0.0e/crypto/dso/dso_dlfcn.c	2012-01-06 00:05:47.000000000 +0100
-+++ openssl-1.0.0e/crypto/dso/dso_dlfcn.c	2012-01-06 00:21:05.000000000 +0100
-@@ -60,7 +60,7 @@
-    that handle _GNU_SOURCE and other similar macros.  Defining it later
-    is simply too late, because those headers are protected from re-
-    inclusion.  */
--#ifdef __linux
-+#if defined __linux || defined __GNU__ || defined __GLIBC__
- # ifndef _GNU_SOURCE
- #  define _GNU_SOURCE	/* make sure dladdr is declared */
- # endif
diff --git a/pkgs/development/libraries/openssl/hurd-target.patch b/pkgs/development/libraries/openssl/hurd-target.patch
deleted file mode 100644
index 399a37a69ed9..000000000000
--- a/pkgs/development/libraries/openssl/hurd-target.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur openssl-1.0.0d-orig/Configure openssl-1.0.0d/Configure
---- openssl-1.0.0d-orig/Configure	2010-11-30 17:19:26.000000000 -0500
-+++ openssl-1.0.0d/Configure	2011-11-16 13:52:57.614416683 -0500
-@@ -563,7 +563,7 @@
- "newsos4-gcc","gcc:-O -DB_ENDIAN::(unknown):NEWS4:-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::",
- 
- ##### GNU Hurd
--"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
-+"hurd-x86","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -mtune=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- 
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
diff --git a/pkgs/development/libraries/openssl/kfreebsd-gnu.patch b/pkgs/development/libraries/openssl/kfreebsd-gnu.patch
deleted file mode 100644
index 66cedf746ba5..000000000000
--- a/pkgs/development/libraries/openssl/kfreebsd-gnu.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Allow compilation on GNU/kFreeBSD.  Ideally, there'd be a single way to process
-all glibc-based system, but the build system is soooo broken.
-
---- openssl-1.0.0i/config
-+++ openssl-1.0.0i/config
-@@ -170,6 +170,10 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
- 	echo "${MACHINE}-whatever-linux1"; exit 0
- 	;;
- 
-+    GNU/kFreeBSD*)
-+    	echo "kfreebsd-gnu"; exit 0;
-+    	;;
-+
-     GNU*)
- 	echo "hurd-x86"; exit 0;
- 	;;
-@@ -810,6 +814,7 @@ case "$GUESSOS" in
-   beos-*) OUT="$GUESSOS" ;;
-   x86pc-*-qnx6) OUT="QNX6-i386" ;;
-   *-*-qnx6) OUT="QNX6" ;;
-+  kfreebsd-gnu) OUT="kfreebsd-gnu";;
-   *) OUT=`echo $GUESSOS | awk -F- '{print $3}'`;;
- esac
- 
-
---- openssl-1.0.0i/Configure
-+++ openssl-1.0.0i/Configure
-@@ -565,6 +565,9 @@ my %table=(
- ##### GNU Hurd
- "hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
- 
-+##### GNU/kFreeBSD on x86_64, copied from "linux-x86_64"
-+"kfreebsd-gnu",	"gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index d50c0c5d69c5..74d7706ec59f 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   postInstall = glib.flattenInclude;
 
-  patches = stdenv.lib.optional stdenv.cc.isClang ./fix-clang36.patch;
+  patches = stdenv.lib.optional stdenv.isDarwin ./fix-clang36.patch;
 
   meta = {
     homepage = http://pixman.org;
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 7fe16cec56b9..cdeaa0cb1d96 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -15,11 +15,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "polkit-0.112";
+  name = "polkit-0.113";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/polkit/releases/${name}.tar.gz";
-    sha256 = "1xkary7yirdcjdva950nqyhmsz48qhrdsr78zciahj27p8yg95fn";
+    sha256 = "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71";
   };
 
   buildInputs =
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs .
   '' + stdenv.lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd-login autoconfigured, but system does not appear to use systemd/s/.*/:/' -i configure
+    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
   ''
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index a65cbeed3fd3..e4d1bae636cf 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -17,7 +17,7 @@ with stdenv.lib;
 
 let
   v_maj = "4.8";
-  v_min = "6";
+  v_min = "7";
   vers = "${v_maj}.${v_min}";
 in
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "http://download.qt-project.org/official_releases/qt/"
       + "${v_maj}/${vers}/qt-everywhere-opensource-src-${vers}.tar.gz";
-    sha256 = "0b036iqgmbbv37dgwwfihw3mihjbnw3kb5kaisdy0qi8nn8xs54b";
+    sha256 = "183fca7n7439nlhxyg1z7aky0izgbyll3iwakw4gwivy16aj5272";
   };
 
   # The version property must be kept because it will be included into the QtSDK package name
@@ -126,8 +126,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ perl pkgconfig which ];
 
-  # occasional build problems if one has too many cores (like on Hydra)
-  # @vcunat has been unable to find a *reliable* fix
   enableParallelBuilding = false;
 
   NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin
diff --git a/pkgs/development/libraries/qt-5/5.4/setup-hook.sh b/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
index 82d4ed5af921..940b9d4e7a1f 100644
--- a/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
@@ -20,9 +20,11 @@ addQtModule() {
             fi
         fi
 
-        if [[ -n $qtSubmodule ]] && [[ -d "$1/lib" ]]; then
+        if [[ -d "$1/lib" ]]; then
             @lndir@/bin/lndir -silent "$1/lib" "$qtOut/lib"
-            find "$1/lib" -printf 'lib/%P\n' >> "$qtOut/nix-support/qt-inputs"
+            if [[ -n $qtSubmodule ]]; then
+                find "$1/lib" -printf 'lib/%P\n' >> "$qtOut/nix-support/qt-inputs"
+            fi
         fi
     fi
 }
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 7759aa799815..004e5e57de44 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
   # Environment vars used for building certain configurations
   PORTABLE = "1";
   USE_SSE = "1";
+  CMAKE_CXX_FLAGS = "-std=gnu++11";
   JEMALLOC_LIB = stdenv.lib.optionalString (malloc == jemalloc) "-ljemalloc";
 
   buildFlags = [
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 16d2298279b4..9736d6514047 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -8,18 +8,18 @@ assert expat != null;
 
 stdenv.mkDerivation rec {
   name = "wayland-${version}";
-  version = "1.7.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "http://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "173w0pqzk2m7hjlg15bymrx7ynxgq1ciadg03hzybxwnvfi4gsmx";
+    sha256 = "1j3gfzn8i0xhk3j34mwb2srrscjxfyi279jhyq80mz943j6r6z7i";
   };
 
-  configureFlags = "--with-scanner";
+  configureFlags = "--with-scanner --disable-documentation";
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ libffi docbook_xsl doxygen graphviz libxslt xmlto expat ];
+  buildInputs = [ libffi /* docbook_xsl doxygen graphviz libxslt xmlto */ expat ];
 
   meta = {
     description = "Reference implementation of the wayland protocol";
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 419a2584ca84..93474d14344e 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -13,6 +13,13 @@ stdenv.mkDerivation (rec {
     sha256 = "039agw5rqvqny92cpkrfn243x2gd4xn13hs3xi6isk55d2vqqr9n";
   };
 
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure \
+      --replace '/usr/bin/libtool' 'ar' \
+      --replace 'AR="libtool"' 'AR="ar"' \
+      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+  '';
+
   configureFlags = if static then "" else "--shared";
 
   preConfigure = ''
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index fbdcec06d0dd..985e7946b6b4 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
 
 buildPerlPackage rec {
-  name = "DBD-SQLite-1.44";
+  name = "DBD-SQLite-1.48";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/${name}.tar.gz";
-    sha256 = "10r7wv5x4vzn9zbk3c7mhbx6kz76xxd9p357592c0wamj458qlml";
+    sha256 = "19hf0fc4dlnpmxsxx3jjbh2z6d2jafgdlqhwz4irkp2cbl7j75xk";
   };
 
   propagatedBuildInputs = [ DBI ];
diff --git a/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch b/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
index c0fa85ecce87..4a4b49a829d2 100644
--- a/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
+++ b/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
@@ -1,4 +1,4 @@
-Use $OPENSSL_X509_CERT_FILE to get the CA certificates.
+Use $SSL_CERT_FILE to get the CA certificates.
 
 diff -ru -x '*~' LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm LWP-Protocol-https-6.02/lib/LWP/Protocol/https.pm
 --- LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm	2011-03-27 13:54:01.000000000 +0200
@@ -7,8 +7,8 @@ diff -ru -x '*~' LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm LWP-Prot
      }
      if ($ssl_opts{SSL_verify_mode}) {
  	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
-+            if (defined $ENV{'OPENSSL_X509_CERT_FILE'}) {
-+                $ssl_opts{SSL_ca_file} = $ENV{'OPENSSL_X509_CERT_FILE'};
++            if (defined $ENV{'SSL_CERT_FILE'}) {
++                $ssl_opts{SSL_ca_file} = $ENV{'SSL_CERT_FILE'};
 +            }
 +        }
 +	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
diff --git a/pkgs/development/pure-modules/stldict/default.nix b/pkgs/development/pure-modules/stldict/default.nix
index abfc0d0fdefc..4ade515faa88 100644
--- a/pkgs/development/pure-modules/stldict/default.nix
+++ b/pkgs/development/pure-modules/stldict/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "5b894ae6dc574c7022258e2732bea649c82c959ec4d0be13fb5a3e8ba8488f28";
   };
 
+  postPatch = ''
+    for f in hashdict.cc orddict.cc; do
+      sed -i '1i\#include <stddef.h>' $f
+    done
+  '';
+
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
   makeFlags = "libdir=$(out)/lib prefix=$(out)/";
diff --git a/pkgs/development/pure-modules/stllib/default.nix b/pkgs/development/pure-modules/stllib/default.nix
index 3be7bccf2a42..02c96d975ec4 100644
--- a/pkgs/development/pure-modules/stllib/default.nix
+++ b/pkgs/development/pure-modules/stllib/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "1d550764fc2f8ba6ddbd1fbd3da2d6965b69e2c992747265d9ebe4f16aa5e455";
   };
 
+  postPatch = ''
+    for f in pure-stlmap/{stlmap.cpp,stlmmap.cpp,stlhmap.cpp}; do
+      sed -i '1i\#include <cstddef>' $f
+    done
+  '';
+
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
   makeFlags = "libdir=$(out)/lib prefix=$(out)/";
diff --git a/pkgs/development/python-modules/gyp/no-darwin-cflags.patch b/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
index 353cc133b537..798d0f0b16d0 100644
--- a/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
+++ b/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
@@ -22,19 +22,6 @@ Index: gyp/pylib/gyp/xcode_emulation.py
      self._Appendf(cflags, 'GCC_OPTIMIZATION_LEVEL', '-O%s', default='s')
  
      if self._Test('GCC_GENERATE_DEBUGGING_SYMBOLS', 'YES', default='YES'):
-@@ -519,12 +513,6 @@
-     if self._Test('GCC_SYMBOLS_PRIVATE_EXTERN', 'YES', default='NO'):
-       cflags.append('-fvisibility=hidden')
- 
--    if self._Test('GCC_TREAT_WARNINGS_AS_ERRORS', 'YES', default='NO'):
--      cflags.append('-Werror')
--
--    if self._Test('GCC_WARN_ABOUT_MISSING_NEWLINE', 'YES', default='NO'):
--      cflags.append('-Wnewline-eof')
--
-     # In Xcode, this is only activated when GCC_COMPILER_VERSION is clang or
-     # llvm-gcc. It also requires a fairly recent libtool, and
-     # if the system clang isn't used, DYLD_LIBRARY_PATH needs to contain the
 @@ -553,7 +541,6 @@
        # TODO: Supporting fat binaries will be annoying.
        self._WarnUnimplemented('ARCHS')
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 477d6f4b3a19..f6030bb9526e 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     ''
       dst=$out/lib/${python.libPrefix}/site-packages
       mkdir -p $dst
-      PYTHONPATH="$dst:$PYTHONPATH"
+      export PYTHONPATH="$dst:$PYTHONPATH"
       ${python}/bin/${python.executable} setup.py install --prefix=$out --install-lib=$out/lib/${python.libPrefix}/site-packages
       wrapPythonPrograms
     '';
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 8cdf231729f4..112950b690d6 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, bzip2, curl, expat, jsoncpp, libarchive, xz, zlib
+, bzip2, curl, expat, libarchive, xz, zlib
 , useNcurses ? false, ncurses, useQt4 ? false, qt4
 , wantPS ? false, ps ? null
 }:
@@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ bzip2 curl expat libarchive xz zlib ]
-    ++ optional (jsoncpp != null && !stdenv.isCygwin) jsoncpp
     ++ optional useNcurses ncurses
     ++ optional useQt4 qt4;
 
@@ -49,12 +48,11 @@ stdenv.mkDerivation rec {
   CMAKE_PREFIX_PATH = stdenv.lib.concatStringsSep ":" buildInputs;
 
   configureFlags =
-    [
-      "--docdir=/share/doc/${name}"
+    [ "--docdir=/share/doc/${name}"
       "--mandir=/share/man"
+      "--no-system-jsoncpp"
     ]
     ++ optional (!stdenv.isCygwin) "--system-libs"
-    ++ optional (jsoncpp == null || stdenv.isCygwin) "--no-system-jsoncpp"
     ++ optional useQt4 "--qt-gui"
     ++ ["--"]
     ++ optional (!useNcurses) "-DBUILD_CursesDialog=OFF";
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix b/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
index 600f6f5759d9..9ac201070182 100644
--- a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
@@ -17,6 +17,9 @@ stdenv.mkDerivation {
     # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
     # included Makefiles, don't look in /usr/include and friends.
     ./impure-dirs.patch
+
+    # Don't segfault if we can't get a tty name.
+    ./no-tty-name.patch
   ];
 
   meta = {
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch b/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
new file mode 100644
index 000000000000..a84d7ab49d04
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
@@ -0,0 +1,53 @@
+From 292da6f6867b75a5af7ddbb639a1feae022f438f Mon Sep 17 00:00:00 2001
+From: Paul Smith <psmith@gnu.org>
+Date: Mon, 20 Oct 2014 05:54:56 +0000
+Subject: * main.c (main): [SV 43434] Handle NULL returns from ttyname().
+
+---
+diff --git main.c main.c
+index b2d169c..0cdb8a8 100644
+--- main.c
++++ main.c
+@@ -1429,13 +1429,18 @@ main (int argc, char **argv, char **envp)
+ #ifdef HAVE_ISATTY
+     if (isatty (fileno (stdout)))
+       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMOUT")))
+-        define_variable_cname ("MAKE_TERMOUT", TTYNAME (fileno (stdout)),
+-                               o_default, 0)->export = v_export;
+-
++        {
++          const char *tty = TTYNAME (fileno (stdout));
++          define_variable_cname ("MAKE_TERMOUT", tty ? tty : DEFAULT_TTYNAME,
++                                 o_default, 0)->export = v_export;
++        }
+     if (isatty (fileno (stderr)))
+       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMERR")))
+-        define_variable_cname ("MAKE_TERMERR", TTYNAME (fileno (stderr)),
+-                               o_default, 0)->export = v_export;
++        {
++          const char *tty = TTYNAME (fileno (stderr));
++          define_variable_cname ("MAKE_TERMERR", tty ? tty : DEFAULT_TTYNAME,
++                                 o_default, 0)->export = v_export;
++        }
+ #endif
+ 
+   /* Reset in case the switches changed our minds.  */
+diff --git makeint.h makeint.h
+index 6223936..2009f41 100644
+--- makeint.h
++++ makeint.h
+@@ -436,10 +436,11 @@ extern struct rlimit stack_limit;
+ /* The number of bytes needed to represent the largest integer as a string.  */
+ #define INTSTR_LENGTH         CSTRLEN ("18446744073709551616")
+ 
++#define DEFAULT_TTYNAME "true"
+ #ifdef HAVE_TTYNAME
+ # define TTYNAME(_f) ttyname (_f)
+ #else
+-# define TTYNAME(_f) "true"
++# define TTYNAME(_f) DEFAULT_TTYNAME
+ #endif
+ 
+ 
+--
+cgit v0.9.0.2
diff --git a/pkgs/development/tools/build-managers/gnustep/make/default.nix b/pkgs/development/tools/build-managers/gnustep/make/default.nix
new file mode 100644
index 000000000000..7fa9aad72dbe
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnustep/make/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "make-${version}";
+  version = "1.0";
+
+  src = fetchurl {
+    url = "http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-make-2.6.6.tar.gz";
+    sha256 = "07cqr8x17bia9w6clbmiv7ay6r9nplrjz2cyzinv4w7zfpc19vxw";
+  };
+
+  patchPhase = ''
+    substituteInPlace GNUmakefile.in \
+      --replace which type \
+      --replace 'tooldir = $(DESTDIR)' 'tooldir = ' \
+      --replace 'makedir = $(DESTDIR)' 'makedir = ' \
+      --replace 'mandir  = $(DESTDIR)' 'mandir  = '
+
+    substituteInPlace FilesystemLayouts/apple \
+      --replace /usr/local ""
+  '';
+
+  installFlags = "DESTDIR=$(out)";
+
+  postInstall = ''
+    mkdir -p $out/nix-support
+    cat >$out/nix-support/setup-hook <<EOF
+      . $out/Library/GNUstep/Makefiles/GNUstep.sh
+    EOF
+  '';
+}
diff --git a/pkgs/development/tools/build-managers/gnustep/xcode/default.nix b/pkgs/development/tools/build-managers/gnustep/xcode/default.nix
new file mode 100644
index 000000000000..4f31c6df6d88
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnustep/xcode/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchgit, gnustep-make, Foundation, libobjc }:
+
+stdenv.mkDerivation rec {
+  name = "xcode-${version}";
+  version = "1.0";
+
+  makeFlags = "messages=yes";
+
+  installFlags = "DESTDIR=$(out)";
+
+  __impureHostDeps = [
+    "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+    "/usr/lib/libextension.dylib"
+  ];
+
+  buildInputs = [ gnustep-make Foundation libobjc ];
+
+  src = fetchgit {
+    url = "https://github.com/gnustep/xcode";
+    rev = "cc5016794e44f9998674120a5e4625aa09ca455a";
+    sha256 = "85420f3f61091b2e4548cf5e99d886cb9c72cf07b8b9fae3eebc87e7b6b7e54a";
+  };
+}
diff --git a/pkgs/development/tools/chefdk/default.nix b/pkgs/development/tools/chefdk/default.nix
index ee49423a8b17..043ee8adf421 100644
--- a/pkgs/development/tools/chefdk/default.nix
+++ b/pkgs/development/tools/chefdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, bundlerEnv, ruby, perl }:
+{ stdenv, lib, bundlerEnv, ruby, perl, autoconf }:
 
 bundlerEnv {
   name = "chefdk-0.4.0";
@@ -8,7 +8,7 @@ bundlerEnv {
   lockfile = ./Gemfile.lock;
   gemset = ./gemset.nix;
 
-  buildInputs = [ perl ];
+  buildInputs = [ perl autoconf ];
 
   meta = with lib; {
     description = "A streamlined development and deployment workflow for Chef platform";
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index f740c60c4877..61824eb607be 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -2,8 +2,6 @@
 , cross ? null, gold ? true, bison ? null
 }:
 
-assert !stdenv.isDarwin;
-
 let basename = "binutils-2.23.1"; in
 
 with { inherit (stdenv.lib) optional optionals optionalString; };
@@ -56,10 +54,12 @@ stdenv.mkDerivation rec {
 
   # As binutils takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = "-static-libgcc";
+  NIX_CFLAGS_COMPILE = if stdenv.isDarwin
+    then "-Wno-string-plus-int -Wno-deprecated-declarations"
+    else "-static-libgcc";
 
   configureFlags =
-    [ "--enable-shared" "--enable-deterministic-archives" ]
+    [ "--enable-shared" "--enable-deterministic-archives" "--disable-werror" ]
     ++ optional (stdenv.system == "mips64el-linux") "--enable-fix-loongson2f-nop"
     ++ optional (cross != null) "--target=${cross.config}"
     ++ optionals gold [ "--enable-gold" "--enable-plugins" ]
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 79dbb533d034..2f811d9ae82f 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, gettext, LocaleGettext, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.46.6";
+  name = "help2man-1.47.1";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "1brccgnjf09f2zg70s6gv6gn68mi59kp3zf50wvxp79n72ngapv1";
+    sha256 = "01ib718afwc28bmh1n0p5h7245vs3rrfm7bj1sq4avmh1kv2d6y5";
   };
 
   buildInputs = [ makeWrapper perl gettext LocaleGettext ];
diff --git a/pkgs/development/tools/misc/pkgconfig/default.nix b/pkgs/development/tools/misc/pkgconfig/default.nix
index f01b52cbba71..f1471d51e1fa 100644
--- a/pkgs/development/tools/misc/pkgconfig/default.nix
+++ b/pkgs/development/tools/misc/pkgconfig/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (rec {
     sha256 = "0igqq5m204w71m11y0nipbdf5apx87hwfll6axs12hn4dqfb6vkb";
   };
 
-  buildInputs = stdenv.lib.optional stdenv.isCygwin libiconv;
+  buildInputs = stdenv.lib.optional (stdenv.isCygwin || stdenv.isDarwin) libiconv;
 
   configureFlags = [ "--with-internal-glib" ];
 
diff --git a/pkgs/development/tools/profiling/oprofile/default.nix b/pkgs/development/tools/profiling/oprofile/default.nix
index 6c7b2a4d9ae1..561fea6ef7b0 100644
--- a/pkgs/development/tools/profiling/oprofile/default.nix
+++ b/pkgs/development/tools/profiling/oprofile/default.nix
@@ -1,26 +1,18 @@
-{ stdenv, fetchurl, binutils, popt, makeWrapper, gawk, which, gnugrep, zlib
-, pkgconfig
+{ stdenv, fetchurl, binutils, popt, zlib, pkgconfig
 , withGUI ? false , qt4 ? null}:
 
 # libX11 is needed because the Qt build stuff automatically adds `-lX11'.
 assert withGUI -> qt4 != null;
 
 stdenv.mkDerivation rec {
-  name = "oprofile-0.9.9";
+  name = "oprofile-1.0.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/oprofile/${name}.tar.gz";
-    sha256 = "15vm24jhw4xfd55pfw1rlpzfsh4bl1vyjsajs78bi9xbv8038lhy";
+    sha256 = "0nn4wfvwy4nii25y6lwlrnzx9ah4nz0r93yk7hswiy6wxjs10wc4";
   };
 
-  patchPhase = ''
-    sed -i "utils/opcontrol" \
-        -e "s|OPCONTROL=.*$|OPCONTROL=\"$out/bin/opcontrol\"|g ;
-            s|OPDIR=.*$|OPDIR=\"$out/bin\"|g ;
-            s|^PATH=.*$||g"
-  '';
-
-  buildInputs = [ binutils zlib popt makeWrapper gawk which gnugrep pkgconfig ]
+  buildInputs = [ binutils zlib popt pkgconfig ]
     ++ stdenv.lib.optionals withGUI [ qt4 ];
 
   configureFlags = [
@@ -28,11 +20,6 @@ stdenv.mkDerivation rec {
     ]
     ++ stdenv.lib.optional withGUI "--with-qt-dir=${qt4} --enable-gui=qt4";
 
-  postInstall = ''
-    wrapProgram "$out/bin/opcontrol"					\
-       --prefix PATH : "$out/bin:${gawk}/bin:${which}/bin:${gnugrep}/bin"
-  '';
-
   meta = {
     description = "System-wide profiler for Linux";
     longDescription = ''
diff --git a/pkgs/development/web/nodejs/default.nix b/pkgs/development/web/nodejs/default.nix
index 4c7aa967872c..574f0514105e 100644
--- a/pkgs/development/web/nodejs/default.nix
+++ b/pkgs/development/web/nodejs/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, python, zlib, libuv, v8, utillinux, http-parser
-, pkgconfig, runCommand, which, unstableVersion ? false
+, pkgconfig, runCommand, which, libtool, unstableVersion ? false
 }:
 
 # nodejs 0.12 can't be built on armv5tel. Armv6 with FPU, minimum I think.
@@ -7,11 +7,6 @@
 assert stdenv.system != "armv5tel-linux";
 
 let
-  dtrace = runCommand "dtrace-native" {} ''
-    mkdir -p $out/bin
-    ln -sv /usr/sbin/dtrace $out/bin
-  '';
-
   version = "0.12.7";
 
   deps = {
@@ -39,20 +34,21 @@ in stdenv.mkDerivation {
     sha256 = "17gk29zbw58l0sjjfw86acp39pkiblnq0gsq1jdrd70w0pgn8gdj";
   };
 
-  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps);
+  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++ [ "--without-dtrace" ];
 
   prePatch = ''
-    sed -e 's|^#!/usr/bin/env python$|#!${python}/bin/python|g' -i configure
+    patchShebangs .
   '';
 
-  patches = if stdenv.isDarwin then [ ./no-xcode.patch ] else null;
-
+  patches = stdenv.lib.optional stdenv.isDarwin ./no-xcode.patch;
 
   buildInputs = [ python which ]
     ++ (optional stdenv.isLinux utillinux)
-    ++ optionals stdenv.isDarwin [ pkgconfig openssl dtrace ];
+    ++ optionals stdenv.isDarwin [ pkgconfig openssl libtool ];
   setupHook = ./setup-hook.sh;
 
+  enableParallelBuilding = true;
+
   passthru.interpreterName = "nodejs";
 
   meta = {
diff --git a/pkgs/development/web/nodejs/v0_10.nix b/pkgs/development/web/nodejs/v0_10.nix
index 739a0ff9389b..eaa3c6386cb5 100644
--- a/pkgs/development/web/nodejs/v0_10.nix
+++ b/pkgs/development/web/nodejs/v0_10.nix
@@ -1,13 +1,11 @@
 { stdenv, fetchurl, openssl, python, zlib, v8, utillinux, http-parser, c-ares
-, pkgconfig, runCommand, which
+, pkgconfig, runCommand, which, libtool
+
+# apple frameworks
+, CoreServices, ApplicationServices, Carbon, Foundation
 }:
 
 let
-  dtrace = runCommand "dtrace-native" {} ''
-    mkdir -p $out/bin
-    ln -sv /usr/sbin/dtrace $out/bin
-  '';
-
   version = "0.10.38";
 
   # !!! Should we also do shared libuv?
@@ -37,21 +35,23 @@ in stdenv.mkDerivation {
     sha256 = "12xpa9jzry5g0j41908498qqs8v0q6miqkv6mggyzas8bvnshgai";
   };
 
-  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps);
+  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++
+    stdenv.lib.optional stdenv.isDarwin "--without-dtrace";
 
   prePatch = ''
-    sed -e 's|^#!/usr/bin/env python$|#!${python}/bin/python|g' -i configure
+    patchShebangs .
   '';
 
-  patches = if stdenv.isDarwin then [ ./no-xcode.patch ] else null;
+  patches = stdenv.lib.optional stdenv.isDarwin ./no-xcode.patch;
 
-  postPatch = if stdenv.isDarwin then ''
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     (cd tools/gyp; patch -Np1 -i ${../../python-modules/gyp/no-darwin-cflags.patch})
-  '' else null;
+  '';
 
   buildInputs = [ python which ]
     ++ (optional stdenv.isLinux utillinux)
-    ++ optionals stdenv.isDarwin [ pkgconfig openssl dtrace ];
+    ++ optionals stdenv.isDarwin [ pkgconfig openssl libtool CoreServices ApplicationServices Foundation ];
+  propagatedBuildInputs = optionals stdenv.isDarwin [ Carbon ];
   setupHook = ./setup-hook.sh;
 
   passthru.interpreterName = "nodejs-0.10";