Merge branch 'staging', discussion #8844

263 files changed, 4761 insertions, 1509 deletions

diff --git a/pkgs/applications/editors/heme/default.nix b/pkgs/applications/editors/heme/default.nix
index 092b7ef68656..d377e5cb36f6 100644
--- a/pkgs/applications/editors/heme/default.nix
+++ b/pkgs/applications/editors/heme/default.nix
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile \
       --replace "/usr/local" "$out" \
       --replace "CFLAGS = " "CFLAGS = -I${ncurses}/include " \
-      --replace "LDFLAGS = " "LDFLAGS = -L${ncurses}/lib "
+      --replace "LDFLAGS = " "LDFLAGS = -L${ncurses}/lib " \
+      --replace "-lcurses" "-lncurses"
   '';
   preBuild = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/jedit/default.nix b/pkgs/applications/editors/jedit/default.nix
index 7dfb651d7d30..f66ce799d26b 100644
--- a/pkgs/applications/editors/jedit/default.nix
+++ b/pkgs/applications/editors/jedit/default.nix
@@ -3,8 +3,8 @@
 let
   version = "5.2.0";
   bsh = fetchurl {
-    url = http://www.beanshell.org/bsh-2.0b4.jar;
-    sha256 = "1di7hj2yms1m3wa8k70jpw0wzfnrgibpqnvdk33ahfaqi03mqfci";
+    url = http://www.beanshell.org/bsh-2.0b5.jar;
+    sha256 = "0p2sxrpzd0vsk11zf3kb5h12yl1nq4yypb5mpjrm8ww0cfaijck2";
   };
   bcpg = fetchurl {
     url = http://central.maven.org/maven2/org/bouncycastle/bcpg-jdk16/1.46/bcpg-jdk16-1.46.jar;
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 7a1ce7aa1f24..e1e920e2c496 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -1,4 +1,7 @@
-{ stdenv, fetchhg, ncurses, gettext, pkgconfig }:
+{ stdenv, fetchhg, ncurses, gettext, pkgconfig
+
+# apple frameworks
+, CoreServices, CoreData, Cocoa, Foundation, libobjc }:
 
 stdenv.mkDerivation rec {
   name = "vim-${version}";
@@ -11,9 +14,16 @@ stdenv.mkDerivation rec {
     sha256 = "1z0qarf6a2smab28g9dnxklhfayn85wx48bnddmyhb9kqzjgqgjc";
   };
 
+  # this makes maintainers very sad
+  # open source CF doesn't have anything NSArray-related, causing linking errors. the
+  # missing symbol is in system CoreFoundation.
+  NIX_LDFLAGS = stdenv.lib.optional stdenv.isDarwin
+    "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation";
+
   enableParallelBuilding = true;
 
-  buildInputs = [ ncurses pkgconfig ];
+  buildInputs = [ ncurses pkgconfig ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreData CoreServices Cocoa Foundation libobjc ];
   nativeBuildInputs = [ gettext ];
 
   configureFlags = [
diff --git a/pkgs/applications/graphics/xfig/builder.sh b/pkgs/applications/graphics/xfig/builder.sh
index bb1cd7f49c48..9d95eca01226 100644
--- a/pkgs/applications/graphics/xfig/builder.sh
+++ b/pkgs/applications/graphics/xfig/builder.sh
@@ -5,8 +5,7 @@ makeFlags="XAWLIB=-lXaw3d BINDIR=$out/bin XAPPLOADDIR=$out/etc/X11/app-defaults
 # We need chmod +wx on dirs, not just chmod +w
 dontMakeSourcesWritable=1
 postUnpack() {
-	find . -type d | xargs -n1 chmod +x
-	find . -type d | xargs -n1 chmod +x
+    find . -type d -exec chmod +x '{}' \;
 }
 
 preBuild() {
diff --git a/pkgs/applications/misc/3dfsb/default.nix b/pkgs/applications/misc/3dfsb/default.nix
index 96bcfbd6bfe6..fe173b21b571 100644
--- a/pkgs/applications/misc/3dfsb/default.nix
+++ b/pkgs/applications/misc/3dfsb/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   buildPhase = "sh ./compile.sh";
   dontStrip = true;
 
-  installPhase = "mkdir $out/bin/ && cp 3dfsb $out/bin/";
+  installPhase = "mkdir -p $out/bin/ && cp 3dfsb $out/bin/";
 
   preFixup = ''
     wrapProgram $out/bin/3dfsb \
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index fe6a3932af9a..787b5e805287 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python, pyqt5, sip_4_16, poppler_utils, pkgconfig, libpng
-, imagemagick, libjpeg, fontconfig, podofo, qt53, icu, sqlite
+, imagemagick, libjpeg, fontconfig, podofo, qt5, icu, sqlite
 , pil, makeWrapper, unrar, chmlib, pythonPackages, xz, libusb1, libmtp
 , xdg_utils
 }:
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ python pyqt5 sip_4_16 poppler_utils libpng imagemagick libjpeg
-      fontconfig podofo qt53 pil chmlib icu sqlite libusb1 libmtp xdg_utils
+      fontconfig podofo qt5.base pil chmlib icu sqlite libusb1 libmtp xdg_utils
       pythonPackages.mechanize pythonPackages.lxml pythonPackages.dateutil
       pythonPackages.cssutils pythonPackages.beautifulsoup pythonPackages.pillow
       pythonPackages.sqlite3 pythonPackages.netifaces pythonPackages.apsw
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index d554752e8a85..244464130bea 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -17,11 +17,11 @@ stdenv.mkDerivation {
     substituteInPlace src/redshift-gtk/redshift-gtk python \
       --replace "/usr/bin/env python3" "${python}/bin/${python.executable}"
   '';
-
+/*
   postInstall = ''
     wrapProgram "$out/bin/redshift-gtk" --prefix PYTHONPATH : $PYTHONPATH
   '';
-
+*/
   meta = with stdenv.lib; {
     inherit version;
     description = "Gradually change screen color temperature";
diff --git a/pkgs/applications/misc/xlsfonts/default.nix b/pkgs/applications/misc/xlsfonts/default.nix
deleted file mode 100644
index 7584ebf72fb1..000000000000
--- a/pkgs/applications/misc/xlsfonts/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-# This program used to come with xorg releases, but now I could only find it
-# at http://www.x.org/releases/individual/.
-# That is why this expression is not inside pkgs.xorg
-
-{stdenv, fetchurl, libX11, pkgconfig}:
-stdenv.mkDerivation rec {
-  name = "xlsfonts-1.0.4";
-
-  src = fetchurl {
-    url = "mirror://xorg/individual/app/${name}.tar.bz2";
-    sha256 = "1lhcx600z9v65nk93xaxfzi79bm4naynabb52gz1vy1bxj2r25r8";
-  };
-
-  buildInputs = [libX11 pkgconfig];
-
-  meta = {
-    homepage = http://www.x.org/;
-    description = "Lists the fonts available in the X server";
-    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/applications/networking/cluster/panamax/api/default.nix b/pkgs/applications/networking/cluster/panamax/api/default.nix
index a212ab5347c5..524433b45fbc 100644
--- a/pkgs/applications/networking/cluster/panamax/api/default.nix
+++ b/pkgs/applications/networking/cluster/panamax/api/default.nix
@@ -62,7 +62,6 @@ stdenv.mkDerivation rec {
       --prefix "PATH" : "$out/share/panamax-api/bin:${env.ruby}/bin:$PATH" \
       --prefix "HOME" : "$out/share/panamax-api" \
       --prefix "GEM_HOME" : "${env}/${env.ruby.gemPath}" \
-      --prefix "OPENSSL_X509_CERT_FILE" : "${cacert}/etc/ssl/certs/ca-bundle.crt" \
       --prefix "SSL_CERT_FILE" : "${cacert}/etc/ssl/certs/ca-bundle.crt" \
       --prefix "GEM_PATH" : "$out/share/panamax-api:${bundler}/${env.ruby.gemPath}"
   '';
diff --git a/pkgs/applications/networking/instant-messengers/tkabber/default.nix b/pkgs/applications/networking/instant-messengers/tkabber/default.nix
index 2b3703bc2799..d0cc333c71b6 100644
--- a/pkgs/applications/networking/instant-messengers/tkabber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tkabber/default.nix
@@ -43,7 +43,7 @@ in mkTkabber (main // {
   postPatch = ''
     substituteInPlace login.tcl --replace \
       "custom::defvar loginconf(sslcacertstore) \"\"" \
-      "custom::defvar loginconf(sslcacertstore) \$env(OPENSSL_X509_CERT_FILE)"
+      "custom::defvar loginconf(sslcacertstore) \$env(SSL_CERT_FILE)"
   '' + optionalString (theme != null) ''
     themePath="$out/share/doc/tkabber/examples/xrdb/${theme}.xrdb"
     sed -i '/^if.*load_default_xrdb/,/^}$/ {
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 8825e16b90f9..c39c5be1d4ca 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, ncurses, openssl, perl, python, aspell, gnutls
 , zlib, curl , pkgconfig, libgcrypt, ruby, lua5, tcl, guile
-, pythonPackages, cacert, cmake, makeWrapper
+, pythonPackages, cacert, cmake, makeWrapper, libobjc
 , extraBuildInputs ? [] }:
 
 stdenv.mkDerivation rec {
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
     [ ncurses perl python openssl aspell gnutls zlib curl pkgconfig
       libgcrypt ruby lua5 tcl guile pythonPackages.pycrypto makeWrapper
       cacert cmake ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ pythonPackages.pync libobjc ]
     ++ extraBuildInputs;
 
   NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix} -DCA_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt";
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index ebf90f8f59f9..def45c7e7565 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -28,8 +28,6 @@ stdenv.mkDerivation rec {
   ];
 
   preFixup = ''
-    rm $out/share/icons/hicolor/icon-theme.cache
-
     for f in "$out"/bin/*; do
       wrapProgram "$f" \
         --prefix PYTHONPATH : "$(toPythonPath $out):$(toPythonPath ${pygobject3})" \
diff --git a/pkgs/applications/version-management/git-and-tools/git/cert-path.patch b/pkgs/applications/version-management/git-and-tools/git/cert-path.patch
index 846752f5bfe3..7d5dca9abfeb 100644
--- a/pkgs/applications/version-management/git-and-tools/git/cert-path.patch
+++ b/pkgs/applications/version-management/git-and-tools/git/cert-path.patch
@@ -5,7 +5,7 @@ diff -ru -x '*~' git-1.9.2-orig/git-send-email.perl git-1.9.2/git-send-email.per
  		return;
  	}
  
-+	$smtp_ssl_cert_path //= $ENV{'OPENSSL_X509_CERT_FILE'};
++	$smtp_ssl_cert_path //= $ENV{'SSL_CERT_FILE'};
 +
  	if (!defined $smtp_ssl_cert_path) {
  		# use the OpenSSL defaults
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 2db8cf72350a..4d8b2fe27c60 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchurl, python, makeWrapper, docutils, unzip, hg-git, dulwich
-, guiSupport ? false, tk ? null, curses, cacert }:
+, guiSupport ? false, tk ? null, curses, cacert
+
+, ApplicationServices }:
 
 let
   version = "3.3.3";
@@ -19,6 +21,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ python makeWrapper docutils unzip ];
 
+  propagatedBuildInputs = stdenv.lib.optional stdenv.isDarwin ApplicationServices;
+
   makeFlags = "PREFIX=$(out)";
 
   postInstall = (stdenv.lib.optionalString guiSupport
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index ef400af73089..c28459018cae 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (rec {
     ${if httpServer then "--with-apxs=${apacheHttpd}/bin/apxs" else "--without-apxs"}
     ${if pythonBindings || perlBindings then "--with-swig=${swig}" else "--without-swig"}
     ${if javahlBindings then "--enable-javahl --with-jdk=${jdk}" else ""}
-    ${if stdenv.isDarwin then "--enable-keychain" else "--disable-keychain"}
+    --disable-keychain
     ${if saslSupport then "--with-sasl=${sasl}" else "--without-sasl"}
     ${if httpSupport then "--with-serf=${serf}" else "--without-serf"}
     --with-zlib=${zlib}
diff --git a/pkgs/applications/video/minitube/default.nix b/pkgs/applications/video/minitube/default.nix
new file mode 100644
index 000000000000..b9c4de0811de
--- /dev/null
+++ b/pkgs/applications/video/minitube/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, makeWrapper, phonon, phonon_backend_vlc, qt4
+# "Free" API key generated by nckx <tobias.geerinckx.rice@gmail.com>
+, withAPIKey ? "AIzaSyBtFgbln3bu1swQC-naMxMtKh384D3xJZE" }:
+
+let version = "2.4"; in
+stdenv.mkDerivation {
+  name = "minitube-${version}";
+
+  src = fetchFromGitHub {
+    sha256 = "0mm8v2vpspwxh2fqaykb381v6r9apywc1b0x8jkcbp7s43w10lp5";
+    rev = version;
+    repo = "minitube";
+    owner = "flaviotordini";
+  };
+
+  meta = with stdenv.lib; {
+    inherit version;
+    description = "Stand-alone YouTube video player";
+    longDescription = ''
+      Watch YouTube videos in a new way: you type a keyword, Minitube gives
+      you an endless video stream. Minitube is not about cloning the YouTube
+      website, it aims to create a new TV-like experience.
+    '';
+    homepage = http://flavio.tordini.org/minitube;
+    license = licenses.gpl3Plus;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ nckx ];
+  };
+
+  buildInputs = [ phonon phonon_backend_vlc qt4 ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  configurePhase = ''
+    qmake PREFIX=$out "DEFINES += APP_GOOGLE_API_KEY=${withAPIKey}"
+  '';
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/minitube \
+      --prefix QT_PLUGIN_PATH : "${phonon_backend_vlc}/lib/kde4/plugins"
+  '';
+}
diff --git a/pkgs/applications/window-managers/xcompmgr/default.nix b/pkgs/applications/window-managers/xcompmgr/default.nix
deleted file mode 100644
index 930b612f6914..000000000000
--- a/pkgs/applications/window-managers/xcompmgr/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, libXcomposite, libXfixes, libXdamage
-, libXrender, libXext }:
-stdenv.mkDerivation rec {
-  name = "xcompmgr-1.1.6";
-  src = fetchurl {
-    url = "mirror://xorg/individual/app/${name}.tar.bz2";
-    sha256 = "c98949d36793b30ed1ed47495c87a05fa245ac0fc2857d2abc54979124687c02";
-  };
-  buildInputs = [ pkgconfig libXcomposite libXfixes libXdamage libXrender libXext ];
-  meta = {
-    homepage = http://www.x.org/;
-    description = "A sample compositing manager for X servers";
-    longDescription = ''
-      A sample compositing manager for X servers supporting the XFIXES,
-      DAMAGE, RENDER, and COMPOSITE extensions.  It enables basic eye-candy
-      effects.
-    '';
-    license = "bsd";
-    maintainers = with stdenv.lib.maintainers; [ astsmtl ];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index c8af548a2ca4..ec024c72481d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -9,7 +9,6 @@
 , cc ? null, libc ? null, binutils ? null, coreutils ? null, shell ? stdenv.shell
 , zlib ? null, extraPackages ? []
 , dyld ? null # TODO: should this be a setup-hook on dyld?
-, setupHook ? ./setup-hook.sh
 , isGNU ? false, isClang ? false
 }:
 
@@ -227,7 +226,7 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      substituteAll ${setupHook} $out/nix-support/setup-hook.tmp
+      substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook.tmp
       cat $out/nix-support/setup-hook.tmp >> $out/nix-support/setup-hook
       rm $out/nix-support/setup-hook.tmp
 
diff --git a/pkgs/build-support/cc-wrapper/setup-hook-stdinc.sh b/pkgs/build-support/cc-wrapper/setup-hook-stdinc.sh
deleted file mode 100644
index 22e778b06904..000000000000
--- a/pkgs/build-support/cc-wrapper/setup-hook-stdinc.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-# This is an alternate setup hook for gcc-wrapper that uses the -I flag to
-# add include search paths instead of -isystem. We need this for some packages
-# because -isystem can change the search order specified by prior -I flags.
-# Changing the search order can point gcc to the wrong package's headers.
-# The -I flag will never change the order of prior flags.
-
-export NIX_CC=@out@
-
-addCVars () {
-    if [ -d $1/include ]; then
-        export NIX_CFLAGS_COMPILE+=" -I $1/include"
-    fi
-
-    if [ -d $1/lib64 -a ! -L $1/lib64 ]; then
-        export NIX_LDFLAGS+=" -L$1/lib64"
-    fi
-
-    if [ -d $1/lib ]; then
-        export NIX_LDFLAGS+=" -L$1/lib"
-    fi
-}
-
-envHooks+=(addCVars)
-
-# Note: these come *after* $out in the PATH (see setup.sh).
-
-if [ -n "@gcc@" ]; then
-    addToSearchPath PATH @gcc@/bin
-fi
-
-if [ -n "@binutils@" ]; then
-    addToSearchPath PATH @binutils@/bin
-fi
-
-if [ -n "@libc@" ]; then
-    addToSearchPath PATH @libc@/bin
-fi
-
-if [ -n "@coreutils@" ]; then
-    addToSearchPath PATH @coreutils@/bin
-fi
-
-export CC=gcc
-export CXX=g++
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 648afda6ebb9..3d0b2fdfe8ae 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -2,7 +2,7 @@ export NIX_CC=@out@
 
 addCVars () {
     if [ -d $1/include ]; then
-        export NIX_CFLAGS_COMPILE+=" -isystem $1/include"
+        export NIX_CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
     fi
 
     if [ -d $1/lib64 -a ! -L $1/lib64 ]; then
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index d9eeaa31359d..9203425b20ae 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -23,6 +23,7 @@ rec {
         passAsFile = [ "text" ];
         # Pointless to do this on a remote machine.
         preferLocalBuild = true;
+        allowSubstitutes = false;
       }
       ''
         n=$out${destination}
diff --git a/pkgs/data/fonts/dejavu-fonts/default.nix b/pkgs/data/fonts/dejavu-fonts/default.nix
index 88596bb4fd9b..21028ee0b32a 100644
--- a/pkgs/data/fonts/dejavu-fonts/default.nix
+++ b/pkgs/data/fonts/dejavu-fonts/default.nix
@@ -1,6 +1,6 @@
 {fetchurl, stdenv, fontforge, perl, fontconfig, FontTTF}:
 
-let version = "2.34" ; in
+let version = "2.35" ; in
 
 stdenv.mkDerivation rec {
   name = "dejavu-fonts-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/dejavu/dejavu-fonts-${version}.tar.bz2";
-    sha256 = "09wh9c9kk82i4kwy73fcqa0779bvf0ncikciqw2gxa9m2rkrxjmm";
+    sha256 = "1xdbi4llrq1qbkd73352ibrfqcbz93dww8hab216qz5szd95yvv4";
   };
   buildFlags = "full-ttf";
   preBuild = ''
diff --git a/pkgs/desktops/gnome-3/3.16/core/gnome-menus/default.nix b/pkgs/desktops/gnome-3/3.16/core/gnome-menus/default.nix
index 37d2ea1c0863..90209634fbf1 100644
--- a/pkgs/desktops/gnome-3/3.16/core/gnome-menus/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/gnome-menus/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0/ INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0";
 
-  preBuild = "patchShebangs ./scripts";
-
   buildInputs = [ intltool pkgconfig glib gobjectIntrospection ];
 
   meta = {
diff --git a/pkgs/desktops/gnome-3/3.16/core/gnome-user-share/default.nix b/pkgs/desktops/gnome-3/3.16/core/gnome-user-share/default.nix
index 2f158be4e0dd..2d563e1f7b55 100644
--- a/pkgs/desktops/gnome-3/3.16/core/gnome-user-share/default.nix
+++ b/pkgs/desktops/gnome-3/3.16/core/gnome-user-share/default.nix
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
   '';
 
   preFixup = ''
-    wrapProgram "$out/libexec/gnome-user-share" \
+    wrapProgram "$out/libexec/gnome-user-share-webdav" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
       --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
   '';
diff --git a/pkgs/desktops/xfce/core/exo.nix b/pkgs/desktops/xfce/core/exo.nix
index e4c7c3183521..f48a3e3808bd 100644
--- a/pkgs/desktops/xfce/core/exo.nix
+++ b/pkgs/desktops/xfce/core/exo.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   p_name  = "exo";
   ver_maj = "0.10";
-  ver_min = "4";
+  ver_min = "6";
 
   src = fetchurl {
     url = "mirror://xfce/src/xfce/${p_name}/${ver_maj}/${name}.tar.bz2";
-    sha256 = "cced5fdbc0b61a5d976210ff71ecdd81b89fcd15e5860a44f50da7b83fb2deaa";
+    sha256 = "1cc0e5a432e050a5e5aa64d126b988f4440da4f27474aaf42a4d8e13651d0752";
   };
   name = "${p_name}-${ver_maj}.${ver_min}";
 
diff --git a/pkgs/desktops/xfce/core/thunar.nix b/pkgs/desktops/xfce/core/thunar.nix
index abcfd656c502..6e4794544596 100644
--- a/pkgs/desktops/xfce/core/thunar.nix
+++ b/pkgs/desktops/xfce/core/thunar.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   p_name  = "thunar";
   ver_maj = "1.6";
-  ver_min = "6";
+  ver_min = "10";
 
   src = fetchurl {
     url = "mirror://xfce/src/xfce/${p_name}/${ver_maj}/Thunar-${ver_maj}.${ver_min}.tar.bz2";
-    sha256 = "1cl9v3rdzipyyxml3pyrzspxfmmssz5h5snpj18irq4an42539dr";
+    sha256 = "7e9d24067268900e5e44d3325e60a1a2b2f8f556ec238ec12574fbea15fdee8a";
   };
   name = "${p_name}-${ver_maj}.${ver_min}";
 
diff --git a/pkgs/desktops/xfce/core/xfdesktop.nix b/pkgs/desktops/xfce/core/xfdesktop.nix
index 45a89b93748d..4402e61a2fb6 100644
--- a/pkgs/desktops/xfce/core/xfdesktop.nix
+++ b/pkgs/desktops/xfce/core/xfdesktop.nix
@@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {
   p_name  = "xfdesktop";
   ver_maj = "4.12";
-  ver_min = "0";
+  ver_min = "2";
 
   src = fetchurl {
     url = "mirror://xfce/src/xfce/${p_name}/${ver_maj}/${name}.tar.bz2";
-    sha256 = "1ivzgg4792nid6wcgd1nq5vc3z0y5ip6ymq7ci5j2qkp663qnykf";
+    sha256 = "c9788883163b57bac39d12e5f8310c869d176454879defb78b67f8e9f1ad5225";
   };
   name = "${p_name}-${ver_maj}.${ver_min}";
 
diff --git a/pkgs/desktops/xfce/core/xfwm4.nix b/pkgs/desktops/xfce/core/xfwm4.nix
index cedf36d43ae1..dd18b1355f79 100644
--- a/pkgs/desktops/xfce/core/xfwm4.nix
+++ b/pkgs/desktops/xfce/core/xfwm4.nix
@@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {
   p_name  = "xfwm4";
   ver_maj = "4.12";
-  ver_min = "2";
+  ver_min = "3";
 
   src = fetchurl {
     url = "mirror://xfce/src/xfce/${p_name}/${ver_maj}/${name}.tar.bz2";
-    sha256 = "5bb5f72b41060d10bd3823f8b69abcd462bbd8853fdf9c82041450ae68e7d75a";
+    sha256 = "f4a988fbc4e0df7e8583c781d271559e56fd28696092f94ae052e9e6edb09eac";
   };
   name = "${p_name}-${ver_maj}.${ver_min}";
 
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 06ca29cd092d..ff1d388b6e23 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -56,7 +56,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "4.8.4";
+let version = "4.8.5";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -209,9 +209,11 @@ stdenv.mkDerivation ({
 
   builder = ../builder.sh;
 
+  outputs = [ "out" "info" ];
+
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "15c6gwm6dzsaagamxkak5smdkf1rdfbqqjs9jdbrp3lbg4ism02a";
+    sha256 = "08yggr18v373a1ihj0rg2vd6psnic42b518xcgp3r9k81xz1xyr2";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 1824931eee5c..14641faa5fec 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -56,7 +56,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "4.9.2";
+let version = "4.9.3";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -208,9 +208,11 @@ stdenv.mkDerivation ({
 
   builder = ../builder.sh;
 
+  outputs = [ "out" "info" ];
+
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "1pbjp4blk2ycaa6r3jmw4ky5f1s9ji3klbqgv8zs2sl5jn1cj810";
+    sha256 = "0zmnm00d2a1hsd41g34bhvxzvxisa2l584q3p447bd91lfjv4ci3";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index 323a87bc7746..5e6acea35dfc 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -57,7 +57,7 @@ assert langGo -> langCC;
 with stdenv.lib;
 with builtins;
 
-let version = "5.1.0";
+let version = "5.2.0";
 
     # Whether building a cross-compiler for GNU/Hurd.
     crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -210,7 +210,7 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
-    sha256 = "1bd5vj4px3s8nlakbgrh38ynxq4s654m6nxz7lrj03mvkkwgvnmp";
+    sha256 = "1bccp8a106xwz3wkixn65ngxif112vn90qf95m6lzpgpnl25p0sz";
   };
 
   inherit patches;
diff --git a/pkgs/development/compilers/ghc/7.0.4-binary.nix b/pkgs/development/compilers/ghc/7.0.4-binary.nix
index a1cdd6171eee..7a6f1b78fa49 100644
--- a/pkgs/development/compilers/ghc/7.0.4-binary.nix
+++ b/pkgs/development/compilers/ghc/7.0.4-binary.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     ./configure --prefix=$out \
       --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include \
-      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"}
+      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"}
   '';
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/7.0.4.nix b/pkgs/development/compilers/ghc/7.0.4.nix
index c28359af16fa..281e5ca66a2c 100644
--- a/pkgs/development/compilers/ghc/7.0.4.nix
+++ b/pkgs/development/compilers/ghc/7.0.4.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
diff --git a/pkgs/development/compilers/ghc/7.2.2.nix b/pkgs/development/compilers/ghc/7.2.2.nix
index 651cf200a8d0..7276f413967f 100644
--- a/pkgs/development/compilers/ghc/7.2.2.nix
+++ b/pkgs/development/compilers/ghc/7.2.2.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
diff --git a/pkgs/development/compilers/ghc/7.4.2-binary.nix b/pkgs/development/compilers/ghc/7.4.2-binary.nix
index 2b8d403701f6..25c9dd0a65a9 100644
--- a/pkgs/development/compilers/ghc/7.4.2-binary.nix
+++ b/pkgs/development/compilers/ghc/7.4.2-binary.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
   configurePhase = ''
     ./configure --prefix=$out \
       --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include \
-      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"}
+      ${stdenv.lib.optionalString stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"}
   '';
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/7.4.2.nix b/pkgs/development/compilers/ghc/7.4.2.nix
index 4e4a5f6024ea..b2abcb08ec3a 100644
--- a/pkgs/development/compilers/ghc/7.4.2.nix
+++ b/pkgs/development/compilers/ghc/7.4.2.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   # required, because otherwise all symbols from HSffi.o are stripped, and
diff --git a/pkgs/development/compilers/ghc/7.6.3.nix b/pkgs/development/compilers/ghc/7.6.3.nix
index 4eb6e425f354..366c0044a67a 100644
--- a/pkgs/development/compilers/ghc/7.6.3.nix
+++ b/pkgs/development/compilers/ghc/7.6.3.nix
@@ -52,7 +52,7 @@ in stdenv.mkDerivation rec {
     export NIX_LDFLAGS+=" -no_dtrace_dof"
   '';
 
-  configureFlags = if stdenv.isDarwin then "--with-gcc=${../../haskell-modules/gcc-clang-wrapper.sh}"
+  configureFlags = if stdenv.isDarwin then "--with-gcc=${./gcc-clang-wrapper.sh}"
                                       else "--with-gcc=${stdenv.cc}/bin/gcc";
 
   postInstall = ''
diff --git a/pkgs/development/haskell-modules/gcc-clang-wrapper.sh b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
index d081be231a1c..d081be231a1c 100755
--- a/pkgs/development/haskell-modules/gcc-clang-wrapper.sh
+++ b/pkgs/development/compilers/ghc/gcc-clang-wrapper.sh
diff --git a/pkgs/development/compilers/go/1.3.nix b/pkgs/development/compilers/go/1.3.nix
index 52a388aff1fe..65b80a7f3af2 100644
--- a/pkgs/development/compilers/go/1.3.nix
+++ b/pkgs/development/compilers/go/1.3.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation {
     sed -i 's,/lib/ld-linux.so.2,${loader386},' src/cmd/8l/asm.c
   '';
 
-  patches = [ ./cacert-1.2.patch ];
+  patches = [ ./cacert-1.2.patch ./R_386_GOT32.patch ];
 
   GOOS = if stdenv.isDarwin then "darwin" else "linux";
   GOARCH = if stdenv.isDarwin then "amd64"
diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
index 12642eeace58..d42873ab975d 100644
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchurl, bison, glibc, bash, coreutils, makeWrapper, tzdata, iana_etc, perl, Security, goPackages }:
+{ stdenv, lib, fetchurl, bison, glibc, bash, coreutils, makeWrapper, tzdata, iana_etc, perl, goPackages
+
+, Security }:
 
 let
   loader386 = "${glibc}/lib/ld-linux.so.2";
@@ -17,8 +19,9 @@ stdenv.mkDerivation rec {
 
   # perl is used for testing go vet
   buildInputs = [ bison bash makeWrapper perl ]
-             ++ lib.optionals stdenv.isLinux [ glibc ]
-             ++ lib.optionals stdenv.isDarwin [ Security ];
+             ++ lib.optionals stdenv.isLinux [ glibc ];
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
 
   # I'm not sure what go wants from its 'src', but the go installation manual
   # describes an installation keeping the src.
@@ -56,6 +59,13 @@ stdenv.mkDerivation rec {
     sed -i 's,/lib/ld-linux.so.3,${loaderArm},' src/cmd/5l/asm.c
     sed -i 's,/lib64/ld-linux-x86-64.so.2,${loaderAmd64},' src/cmd/6l/asm.c
     sed -i 's,/lib/ld-linux.so.2,${loader386},' src/cmd/8l/asm.c
+  '' + lib.optionalString stdenv.isDarwin ''
+    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
+    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
+    sed -i '/TestRead0/areturn' src/os/os_test.go
+    sed -i '/TestSystemRoots/areturn' src/crypto/x509/root_darwin_test.go
+
+    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
   '';
 
   patches = [
diff --git a/pkgs/development/compilers/go/R_386_GOT32.patch b/pkgs/development/compilers/go/R_386_GOT32.patch
new file mode 100644
index 000000000000..c029d50168a3
--- /dev/null
+++ b/pkgs/development/compilers/go/R_386_GOT32.patch
@@ -0,0 +1,46 @@
+From 609d996fac7f68b34032572b7bde627f658b95f2 Mon Sep 17 00:00:00 2001
+From: Russ Cox <rsc@golang.org>
+Date: Mon, 6 Oct 2014 14:17:48 -0400
+Subject: [PATCH] cmd/8l: accept R_386_GOT32 in push instruction
+
+Fixes #8382.
+
+LGTM=iant
+R=iant
+CC=golang-codereviews
+https://golang.org/cl/149540045
+---
+ src/cmd/8l/asm.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/src/cmd/8l/asm.c b/src/cmd/8l/asm.c
+index c135dce..98c0424 100644
+--- a/src/cmd/8l/asm.c
++++ b/src/cmd/8l/asm.c
+@@ -117,13 +117,21 @@ adddynrel(LSym *s, Reloc *r)
+ 	case 256 + R_386_GOT32:
+ 		if(targ->type != SDYNIMPORT) {
+ 			// have symbol
+-			// turn MOVL of GOT entry into LEAL of symbol itself
+-			if(r->off < 2 || s->p[r->off-2] != 0x8b) {
+-				diag("unexpected GOT reloc for non-dynamic symbol %s", targ->name);
++			if(r->off >= 2 && s->p[r->off-2] == 0x8b) {
++				// turn MOVL of GOT entry into LEAL of symbol address, relative to GOT.
++				s->p[r->off-2] = 0x8d;
++				r->type = R_GOTOFF;
+ 				return;
+ 			}
+-			s->p[r->off-2] = 0x8d;
+-			r->type = R_GOTOFF;
++			if(r->off >= 2 && s->p[r->off-2] == 0xff && s->p[r->off-1] == 0xb3) {
++				// turn PUSHL of GOT entry into PUSHL of symbol itself.
++				// use unnecessary SS prefix to keep instruction same length.
++				s->p[r->off-2] = 0x36;
++				s->p[r->off-1] = 0x68;
++				r->type = R_ADDR;
++				return;
++			}
++			diag("unexpected GOT reloc for non-dynamic symbol %s", targ->name);
+ 			return;
+ 		}
+ 		addgotsym(ctxt, targ);
diff --git a/pkgs/development/compilers/llvm/3.6/default.nix b/pkgs/development/compilers/llvm/3.6/default.nix
index 3321e38949f1..d95ffe473262 100644
--- a/pkgs/development/compilers/llvm/3.6/default.nix
+++ b/pkgs/development/compilers/llvm/3.6/default.nix
@@ -1,6 +1,6 @@
 { pkgs, newScope, stdenv, isl, fetchurl, overrideCC, wrapCC }:
 let
-  callPackage = newScope (self // { inherit isl version fetch; });
+  callPackage = newScope (self // { inherit stdenv isl version fetch; });
 
   version = "3.6.1";
 
diff --git a/pkgs/development/compilers/llvm/3.6/llvm.nix b/pkgs/development/compilers/llvm/3.6/llvm.nix
index 1b7e9d86a030..2d6f29aacea0 100644
--- a/pkgs/development/compilers/llvm/3.6/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.6/llvm.nix
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
     mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ] ++ stdenv.lib.optional stdenv.isLinux valgrind;
+  buildInputs = [ perl groff cmake libxml2 python libffi ] /* ++ stdenv.lib.optional stdenv.isLinux valgrind */;
 
   propagatedBuildInputs = [ ncurses zlib ];
 
diff --git a/pkgs/development/compilers/rustc/generic.nix b/pkgs/development/compilers/rustc/generic.nix
index f9e458738571..da72495ee7ad 100644
--- a/pkgs/development/compilers/rustc/generic.nix
+++ b/pkgs/development/compilers/rustc/generic.nix
@@ -84,6 +84,8 @@ stdenv.mkDerivation {
   inherit version;
   inherit meta;
 
+  __impureHostDeps = [ "/usr/lib/libedit.3.dylib" ];
+
   src = if isRelease then
       fetchzip {
         url = "http://static.rust-lang.org/dist/rustc-${version}-src.tar.gz";
@@ -107,16 +109,16 @@ stdenv.mkDerivation {
     installPhase = ''
       mkdir -p "$out"
       cp -r bin "$out/bin"
-    '' + (if stdenv.isLinux then ''
+    '' + stdenv.lib.optionalString stdenv.isLinux ''
       patchelf --interpreter "${stdenv.glibc}/lib/${stdenv.cc.dynamicLinker}" \
                --set-rpath "${stdenv.cc.cc}/lib/:${stdenv.cc.cc}/lib64/" \
                "$out/bin/rustc"
-    '' else "");
+    '';
   };
 
   configureFlags = configureFlags
-                ++ [ "--enable-local-rust" "--local-rust-root=$snapshot" ]
-                ++ stdenv.lib.optional (stdenv.cc ? clang) "--enable-clang";
+                ++ [ "--enable-local-rust" "--local-rust-root=$snapshot" "--enable-rpath" ]
+                ++ stdenv.lib.optional (stdenv.cc.cc ? isClang) "--enable-clang";
 
   inherit patches;
 
@@ -139,7 +141,8 @@ stdenv.mkDerivation {
       --replace "\$\$(subst  /,//," "\$\$(subst /,/,"
   '';
 
-  buildInputs = [ which file perl curl python27 makeWrapper git valgrind procps ];
+  buildInputs = [ which file perl curl python27 makeWrapper git ]
+    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ procps valgrind ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/compilers/sdcc/default.nix b/pkgs/development/compilers/sdcc/default.nix
index 0650fae917a6..a246a413f50d 100644
--- a/pkgs/development/compilers/sdcc/default.nix
+++ b/pkgs/development/compilers/sdcc/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, bison, flex, boost, gputils ? null }:
 
 stdenv.mkDerivation rec {
-  version = "3.4.0";
+  version = "3.5.0";
   name = "sdcc-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/sdcc/sdcc-src-${version}.tar.bz2";
-    sha256 = "1yavxffqdfhdyabdza936xxh9wq4cfwa385g26gjapsdp5ighsng";
+    sha256 = "1aazz0yynr694q0rich7r03qls0zvsjc00il14pb4i22c78phagq";
   };
 
   # TODO: remove this comment when gputils != null is tested
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index fd3e70eaed86..a59219786c98 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -186,21 +186,39 @@ self: super: {
 
   # cabal2nix likes to generate dependencies on hinotify when hfsevents is really required
   # on darwin: https://github.com/NixOS/cabal2nix/issues/146
-  hinotify = if pkgs.stdenv.isDarwin then super.hfsevents else super.hinotify;
+  hinotify = if pkgs.stdenv.isDarwin then self.hfsevents else super.hinotify;
+
+  # hfsevents needs CoreServices in scope
+  hfsevents = if pkgs.stdenv.isDarwin
+    then addBuildTool super.hfsevents pkgs.darwin.apple_sdk.frameworks.CoreServices
+    else super.hfsevents;
 
   # FSEvents API is very buggy and tests are unreliable. See
   # http://openradar.appspot.com/10207999 and similar issues
   fsnotify = if pkgs.stdenv.isDarwin then dontCheck super.fsnotify else super.fsnotify;
 
+  # the system-fileio tests use canonicalizePath, which fails in the sandbox
+  system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
+
   # Prevents needing to add security_tool as a build tool to all of x509-system's
   # dependencies.
-  # TODO: use pkgs.darwin.security_tool once we can build it
-  x509-system = let security_tool = "/usr";
-  in overrideCabal super.x509-system (drv: {
-    patchPhase = (drv.patchPhase or "") + pkgs.stdenv.lib.optionalString pkgs.stdenv.isDarwin ''
-      substituteInPlace System/X509/MacOS.hs --replace security ${security_tool}/bin/security
-    '';
-  });
+  x509-system = if pkgs.stdenv.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then let inherit (pkgs.darwin) security_tool;
+      in pkgs.lib.overrideDerivation (addBuildDepend super.x509-system security_tool) (drv: {
+        patchPhase = (drv.patchPhase or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security ${security_tool}/bin/security
+        '';
+      })
+    else super.x509-system;
+
+  double-conversion = if !pkgs.stdenv.isDarwin
+    then super.double-conversion
+    else overrideCabal super.double-conversion (drv:
+      {
+        patchPhase = ''
+          substituteInPlace double-conversion.cabal --replace stdc++ c++
+        '';
+      });
 
   # Does not compile: "fatal error: ieee-flpt.h: No such file or directory"
   base_4_8_0_0 = markBroken super.base_4_8_0_0;
@@ -862,6 +880,10 @@ self: super: {
   # https://github.com/yesodweb/serversession/issues/1
   serversession = dontCheck super.serversession;
 
+  yesod-bin = if pkgs.stdenv.isDarwin
+    then addBuildDepend super.yesod-bin pkgs.darwin.apple_sdk.frameworks.Cocoa
+    else super.yesod-bin;
+
   # https://github.com/commercialhaskell/stack/issues/408
   # https://github.com/commercialhaskell/stack/issues/409
   stack = overrideCabal super.stack (drv: { preCheck = "export HOME=$TMPDIR"; doCheck = false; });
diff --git a/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
index d7371c5b97b0..de0fdacb3f9d 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-7.10.x.nix
@@ -44,10 +44,6 @@ self: super: {
   # Don't use jailbreak built with Cabal 1.22.x because of https://github.com/peti/jailbreak-cabal/issues/9.
   jailbreak-cabal = pkgs.haskell.packages.ghc784.jailbreak-cabal;
 
-  # GHC 7.10.x's Haddock binary cannot generate hoogle files.
-  # https://ghc.haskell.org/trac/ghc/ticket/9921
-  mkDerivation = drv: super.mkDerivation (drv // { doHoogle = false; });
-
   idris =
     let idris' = overrideCabal super.idris (drv: {
       # "idris" binary cannot find Idris library otherwise while building.
@@ -231,9 +227,6 @@ self: super: {
   seqid-streams_0_1_0 = markBroken super.seqid-streams_0_1_0;
   vector_0_10_9_3 = markBroken super.vector_0_10_9_3;
 
-  # https://github.com/purefn/hipbot/issues/1
-  hipbot = dontDistribute super.hipbot;
-
   # https://github.com/HugoDaniel/RFC3339/issues/14
   timerep = dontCheck super.timerep;
 
diff --git a/pkgs/development/interpreters/perl/5.16/default.nix b/pkgs/development/interpreters/perl/5.16/default.nix
index 9ed3aa54f517..568025edfd4c 100644
--- a/pkgs/development/interpreters/perl/5.16/default.nix
+++ b/pkgs/development/interpreters/perl/5.16/default.nix
@@ -24,6 +24,17 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isSunOS  ./ld-shared.patch
     ++ lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
 
+  # There's an annoying bug on sandboxed Darwin in Perl's Cwd.pm where it looks for pwd
+  # in /bin/pwd and /usr/bin/pwd and then falls back on just "pwd" if it can't get them
+  # while at the same time erasing the PATH environment variable so it unconditionally
+  # fails. The code in question is guarded by a check for Mac OS, but the patch below
+  # doesn't have any runtime effect on other platforms.
+  postPatch = ''
+    pwd="$(type -P pwd)"
+    substituteInPlace dist/Cwd/Cwd.pm \
+      --replace "pwd_cmd = 'pwd'" "pwd_cmd = '$pwd'"
+  '';
+
   # Build a thread-safe Perl with a dynamic libperls.o.  We need the
   # "installstyle" option to ensure that modules are put under
   # $out/lib/perl5 - this is the general default, but because $out
diff --git a/pkgs/development/interpreters/perl/5.20/default.nix b/pkgs/development/interpreters/perl/5.20/default.nix
index 0ad955d03630..e8eb3a70e374 100644
--- a/pkgs/development/interpreters/perl/5.20/default.nix
+++ b/pkgs/development/interpreters/perl/5.20/default.nix
@@ -31,10 +31,23 @@ stdenv.mkDerivation rec {
   patches =
     [ # Do not look in /usr etc. for dependencies.
       ./no-sys-dirs.patch
+      # Remove in 5.20.3
+      ./perl-5.20.2-gcc5_fixes-1.patch
     ]
     ++ optional stdenv.isSunOS ./ld-shared.patch
     ++ stdenv.lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
 
+  # There's an annoying bug on sandboxed Darwin in Perl's Cwd.pm where it looks for pwd
+  # in /bin/pwd and /usr/bin/pwd and then falls back on just "pwd" if it can't get them
+  # while at the same time erasing the PATH environment variable so it unconditionally
+  # fails. The code in question is guarded by a check for Mac OS, but the patch below
+  # doesn't have any runtime effect on other platforms.
+  postPatch = stdenv.lib.optional (stdenv.isDarwin && !stdenv.cc.nativeLibc) ''
+    pwd="$(type -P pwd)"
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "pwd_cmd = 'pwd'" "pwd_cmd = '$pwd'"
+  '';
+
   # Build a thread-safe Perl with a dynamic libperls.o.  We need the
   # "installstyle" option to ensure that modules are put under
   # $out/lib/perl5 - this is the general default, but because $out
diff --git a/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch b/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch
new file mode 100644
index 000000000000..21f3ca8d7a54
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.20/perl-5.20.2-gcc5_fixes-1.patch
@@ -0,0 +1,127 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2015-04-17
+Initial Package Version: 5.20.2
+Upstream Status: Committed
+Origin: Petr Pisař and Tony Cook
+Description: Fixes Errno.pm and h2ph with gcc-5.
+
+1. cherry-picked because the change to $version will not apply, from
+commit 816b056ffb99ae54642320e20dc30a59fd1effef
+Author: Petr Písař <ppisar@redhat.com>
+Date:   Wed Feb 11 15:46:37 2015 +0100
+
+    Fix Errno.pm generation for gcc-5.0
+    
+    gcc-5.0 -E interleaves now line numbers with expended macros, so that
+    the generated errno.c will be preprocessed to
+    
+    EBFONT => [[
+               59
+                    ]]
+    
+    which is hard to parse in in line-based reader.
+    
+    So use -P option with gcc >= 5.0. Global -P usage would break makedepend,
+    global -ftrack-macro-expansion=0 would break lib/h2ph.t.
+    
+    RT#123784
+
+diff --git a/ext/Errno/Errno_pm.PL b/ext/Errno/Errno_pm.PL
+index 3dadfce..c6bfa06 100644
+--- a/ext/Errno/Errno_pm.PL
++++ b/ext/Errno/Errno_pm.PL
+@@ -215,20 +215,31 @@ sub write_errno_pm {
+     {	# BeOS (support now removed) did not enter this block
+     # invoke CPP and read the output
+ 
++	my $inhibit_linemarkers = '';
++	if ($Config{gccversion} =~ /\A(\d+)\./ and $1 >= 5) {
++	    # GCC 5.0 interleaves expanded macros with line numbers breaking
++	    # each line into multiple lines. RT#123784
++	    $inhibit_linemarkers = ' -P';
++	}
++
+ 	if ($^O eq 'VMS') {
+-	    my $cpp = "$Config{cppstdin} $Config{cppflags} $Config{cppminus}";
++	    my $cpp = "$Config{cppstdin} $Config{cppflags}" .
++		$inhibit_linemarkers . " $Config{cppminus}";
+ 	    $cpp =~ s/sys\$input//i;
+ 	    open(CPPO,"$cpp  errno.c |") or
+ 		die "Cannot exec $Config{cppstdin}";
+ 	} elsif ($IsMSWin32 || $^O eq 'NetWare') {
+-	    open(CPPO,"$Config{cpprun} $Config{cppflags} errno.c |") or
+-		die "Cannot run '$Config{cpprun} $Config{cppflags} errno.c'";
++	    my $cpp = "$Config{cpprun} $Config{cppflags}" .
++		$inhibit_linemarkers;
++	    open(CPPO,"$cpp errno.c |") or
++		die "Cannot run '$cpp errno.c'";
+ 	} elsif ($IsSymbian) {
+-            my $cpp = "gcc -E -I$ENV{SDK}\\epoc32\\include\\libc -";
++            my $cpp = "gcc -E -I$ENV{SDK}\\epoc32\\include\\libc" .
++		$inhibit_linemarkers ." -";
+ 	    open(CPPO,"$cpp < errno.c |")
+ 		or die "Cannot exec $cpp";
+         } else {
+-	    my $cpp = default_cpp();
++	    my $cpp = default_cpp() . $inhibit_linemarkers;
+ 	    open(CPPO,"$cpp < errno.c |")
+ 		or die "Cannot exec $cpp";
+ 	}
+
+commit 3bea78d24634e630b610f59957e7a019205a67b2
+Author: Tony Cook <tony@develop-help.com>
+Date:   Mon Feb 16 15:57:00 2015 +1100
+
+    h2ph: correct handling of hex constants for the preamble
+    
+    Previously they were treated as identifiers resulting in code
+    generated like C< &0xFFF >.
+    
+    We also try to prevent compile-time warnings from large hex integers,
+    the user isn't responsible for the generated code, so we delay those
+    warnings to run-time.
+
+diff --git a/utils/h2ph.PL b/utils/h2ph.PL
+index 9a8b14d..d082f22 100644
+--- a/utils/h2ph.PL
++++ b/utils/h2ph.PL
+@@ -769,7 +769,7 @@ sub inc_dirs
+ sub build_preamble_if_necessary
+ {
+     # Increment $VERSION every time this function is modified:
+-    my $VERSION     = 3;
++    my $VERSION     = 4;
+     my $preamble    = "$Dest_dir/_h2ph_pre.ph";
+ 
+     # Can we skip building the preamble file?
+@@ -788,6 +788,11 @@ sub build_preamble_if_necessary
+ 
+     open  PREAMBLE, ">$preamble" or die "Cannot open $preamble:  $!";
+ 	print PREAMBLE "# This file was created by h2ph version $VERSION\n";
++        # Prevent non-portable hex constants from warning.
++        #
++        # We still produce an overflow warning if we can't represent
++        # a hex constant as an integer.
++        print PREAMBLE "no warnings qw(portable);\n";
+ 
+ 	foreach (sort keys %define) {
+ 	    if ($opt_D) {
+@@ -814,6 +819,18 @@ DEFINE
+ 		# integer:
+ 		print PREAMBLE
+ 		    "unless (defined &$_) { sub $_() { $1 } }\n\n";
++            } elsif ($define{$_} =~ /^([+-]?0x[\da-f]+)U?L{0,2}$/i) {
++                # hex integer
++                # Special cased, since perl warns on hex integers
++                # that can't be represented in a UV.
++                #
++                # This way we get the warning at time of use, so the user
++                # only gets the warning if they happen to use this
++                # platform-specific definition.
++                my $code = $1;
++                $code = "hex('$code')" if length $code > 10;
++                print PREAMBLE
++                    "unless (defined &$_) { sub $_() { $code } }\n\n";
+ 	    } elsif ($define{$_} =~ /^\w+$/) {
+ 		my $def = $define{$_};
+ 		if ($isatype{$def}) {
diff --git a/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch b/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch
new file mode 100644
index 000000000000..231853fe51a6
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/cpp-precomp.patch
@@ -0,0 +1,11 @@
+--- a/hints/darwin.sh	2013-05-08 11:13:45.000000000 -0600
++++ b/hints/darwin.sh	2013-05-08 11:15:04.000000000 -0600
+@@ -129,7 +129,7 @@
+ 
+ # Avoid Apple's cpp precompiler, better for extensions
+ if [ "X`echo | ${cc} -no-cpp-precomp -E - 2>&1 >/dev/null`" = "X" ]; then
+-    cppflags="${cppflags} -no-cpp-precomp"
++    #cppflags="${cppflags} -no-cpp-precomp"
+ 
+     # This is necessary because perl's build system doesn't
+     # apply cppflags to cc compile lines as it should.
diff --git a/pkgs/development/interpreters/perl/5.22/default.nix b/pkgs/development/interpreters/perl/5.22/default.nix
new file mode 100644
index 000000000000..f9068de1c2cf
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/default.nix
@@ -0,0 +1,105 @@
+{ stdenv, fetchurl, enableThreading ? stdenv ? glibc }:
+
+# We can only compile perl with threading on platforms where we have a
+# real glibc in the stdenv.
+#
+# Instead of silently building an unthreaded perl if this is not the
+# case, we force callers to disableThreading explicitly, therefore
+# documenting the platforms where the perl is not threaded.
+#
+# In the case of stdenv linux boot stage1 it's not possible to use
+# threading because of the simpleness of the bootstrap glibc, so we
+# use enableThreading = false there.
+assert enableThreading -> (stdenv ? glibc);
+
+let
+
+  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
+
+in
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  name = "perl-5.22.0";
+
+  src = fetchurl {
+    url = "mirror://cpan/src/5.0/${name}.tar.gz";
+    sha256 = "0g5bl8sdpzx9gx2g5jq3py4bj07z2ylk7s1qn0fvsss2yl3hhs8c";
+  };
+
+  patches =
+    [ # Do not look in /usr etc. for dependencies.
+      ./no-sys-dirs.patch
+    ]
+    ++ optional stdenv.isSunOS ./ld-shared.patch
+    ++ stdenv.lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ];
+
+  # Build a thread-safe Perl with a dynamic libperls.o.  We need the
+  # "installstyle" option to ensure that modules are put under
+  # $out/lib/perl5 - this is the general default, but because $out
+  # contains the string "perl", Configure would select $out/lib.
+  # Miniperl needs -lm. perl needs -lrt.
+  configureFlags =
+    [ "-de"
+      "-Dcc=cc"
+      "-Uinstallusrbinperl"
+      "-Dinstallstyle=lib/perl5"
+      "-Duseshrplib"
+      "-Dlocincpth=${libc}/include"
+      "-Dloclibpth=${libc}/lib"
+    ]
+    ++ optional enableThreading "-Dusethreads";
+
+  configureScript = "${stdenv.shell} ./Configure";
+
+  dontAddPrefix = true;
+
+  enableParallelBuilding = true;
+
+  preConfigure =
+    ''
+
+      configureFlags="$configureFlags -Dprefix=$out -Dman1dir=$out/share/man/man1 -Dman3dir=$out/share/man/man3"
+
+      ${optionalString stdenv.isArm ''
+        configureFlagsArray=(-Dldflags="-lm -lrt")
+      ''}
+    '' + optionalString stdenv.isDarwin ''
+      substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
+    '' + optionalString (!enableThreading) ''
+      # We need to do this because the bootstrap doesn't have a static libpthread
+      sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
+    '';
+
+  preBuild = optionalString (!(stdenv ? cc && stdenv.cc.nativeTools))
+    ''
+      # Make Cwd work on NixOS (where we don't have a /bin/pwd).
+      substituteInPlace dist/PathTools/Cwd.pm --replace "'/bin/pwd'" "'$(type -tP pwd)'"
+    '';
+
+  setupHook = ./setup-hook.sh;
+
+  passthru.libPrefix = "lib/perl5/site_perl";
+
+  preCheck = ''
+    # Try and setup a local hosts file
+    if [ -f "${libc}/lib/libnss_files.so" ]; then
+      mkdir $TMPDIR/fakelib
+      cp "${libc}/lib/libnss_files.so" $TMPDIR/fakelib
+      sed -i 's,/etc/hosts,/dev/fd/3,g' $TMPDIR/fakelib/libnss_files.so
+      export LD_LIBRARY_PATH=$TMPDIR/fakelib
+    fi
+  '';
+
+  postCheck = ''
+    unset LD_LIBRARY_PATH
+  '';
+
+  meta = {
+    homepage = https://www.perl.org/;
+    description = "The standard implementation of the Perl 5 programmming language";
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/interpreters/perl/5.22/ld-shared.patch b/pkgs/development/interpreters/perl/5.22/ld-shared.patch
new file mode 100644
index 000000000000..be45230c8a73
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/ld-shared.patch
@@ -0,0 +1,11 @@
+--- perl-5.16.2/hints/solaris_2.sh.orig	2013-02-14 19:29:49.453988140 +0000
++++ perl-5.16.2/hints/solaris_2.sh	2013-02-14 19:30:31.681631019 +0000
+@@ -568,7 +568,7 @@
+ #		    ccflags="$ccflags -Wa,`getconf XBS5_LP64_OFF64_CFLAGS 2>/dev/null`"
+ #		fi
+ 		ldflags="$ldflags -m64"
+-		lddlflags="$lddlflags -G -m64"
++		lddlflags="$lddlflags -shared -m64"
+ 		;;
+ 	    *)
+ 		getconfccflags="`getconf XBS5_LP64_OFF64_CFLAGS 2>/dev/null`"
diff --git a/pkgs/development/interpreters/perl/5.22/no-libutil.patch b/pkgs/development/interpreters/perl/5.22/no-libutil.patch
new file mode 100644
index 000000000000..68d44612bfe6
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/no-libutil.patch
@@ -0,0 +1,12 @@
+diff -ru -x '*~' perl-5.14.2-orig/Configure perl-5.14.2/Configure
+--- perl-5.14.2-orig/Configure	2011-09-26 11:44:34.000000000 +0200
++++ perl-5.14.2/Configure	2012-02-16 17:24:50.779839039 +0100
+@@ -1368,7 +1368,7 @@
+ : List of libraries we want.
+ : If anyone needs extra -lxxx, put those in a hint file.
+ libswanted="socket bind inet nsl nm ndbm gdbm dbm db malloc dl ld sun"
+-libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
++libswanted="$libswanted m crypt sec c cposix posix ucb bsd BSD"
+ : We probably want to search /usr/shlib before most other libraries.
+ : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
+ glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
diff --git a/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch b/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch
new file mode 100644
index 000000000000..1793273a76f9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/no-sys-dirs.patch
@@ -0,0 +1,250 @@
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/Configure perl-5.20.0/Configure
+--- perl-5.20.0-orig/Configure	2014-05-26 15:34:18.000000000 +0200
++++ perl-5.20.0/Configure	2014-06-25 10:43:35.368285986 +0200
+@@ -106,15 +106,7 @@
+ fi
+ 
+ : Proper PATH setting
+-paths='/bin /usr/bin /usr/local/bin /usr/ucb /usr/local /usr/lbin'
+-paths="$paths /opt/bin /opt/local/bin /opt/local /opt/lbin"
+-paths="$paths /usr/5bin /etc /usr/gnu/bin /usr/new /usr/new/bin /usr/nbin"
+-paths="$paths /opt/gnu/bin /opt/new /opt/new/bin /opt/nbin"
+-paths="$paths /sys5.3/bin /sys5.3/usr/bin /bsd4.3/bin /bsd4.3/usr/ucb"
+-paths="$paths /bsd4.3/usr/bin /usr/bsd /bsd43/bin /opt/ansic/bin /usr/ccs/bin"
+-paths="$paths /etc /usr/lib /usr/ucblib /lib /usr/ccs/lib"
+-paths="$paths /sbin /usr/sbin /usr/libexec"
+-paths="$paths /system/gnu_library/bin"
++paths=''
+ 
+ for p in $paths
+ do
+@@ -1337,8 +1329,7 @@
+ archname=''
+ : Possible local include directories to search.
+ : Set locincpth to "" in a hint file to defeat local include searches.
+-locincpth="/usr/local/include /opt/local/include /usr/gnu/include"
+-locincpth="$locincpth /opt/gnu/include /usr/GNU/include /opt/GNU/include"
++locincpth=""
+ :
+ : no include file wanted by default
+ inclwanted=''
+@@ -1349,17 +1340,12 @@
+ 
+ libnames=''
+ : change the next line if compiling for Xenix/286 on Xenix/386
+-xlibpth='/usr/lib/386 /lib/386'
++xlibpth=''
+ : Possible local library directories to search.
+-loclibpth="/usr/local/lib /opt/local/lib /usr/gnu/lib"
+-loclibpth="$loclibpth /opt/gnu/lib /usr/GNU/lib /opt/GNU/lib"
++loclibpth=""
+ 
+ : general looking path for locating libraries
+-glibpth="/lib /usr/lib $xlibpth"
+-glibpth="$glibpth /usr/ccs/lib /usr/ucblib /usr/local/lib"
+-test -f /usr/shlib/libc.so && glibpth="/usr/shlib $glibpth"
+-test -f /shlib/libc.so     && glibpth="/shlib $glibpth"
+-test -d /usr/lib64         && glibpth="$glibpth /lib64 /usr/lib64 /usr/local/lib64"
++glibpth=""
+ 
+ : Private path used by Configure to find libraries.  Its value
+ : is prepended to libpth. This variable takes care of special
+@@ -1391,8 +1377,6 @@
+ libswanted="$libswanted m crypt sec util c cposix posix ucb bsd BSD"
+ : We probably want to search /usr/shlib before most other libraries.
+ : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
+-glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
+-glibpth="/usr/shlib $glibpth"
+ : Do not use vfork unless overridden by a hint file.
+ usevfork=false
+ 
+@@ -2446,7 +2430,6 @@
+ zip
+ "
+ pth=`echo $PATH | sed -e "s/$p_/ /g"`
+-pth="$pth $sysroot/lib $sysroot/usr/lib"
+ for file in $loclist; do
+ 	eval xxx=\$$file
+ 	case "$xxx" in
+@@ -4936,7 +4919,7 @@
+ : Set private lib path
+ case "$plibpth" in
+ '') if ./mips; then
+-	plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib"
++	plibpth="$incpath/usr/lib"
+     fi;;
+ esac
+ case "$libpth" in
+@@ -8600,13 +8583,8 @@
+ echo " "
+ case "$sysman" in
+ '')
+-	syspath='/usr/share/man/man1 /usr/man/man1'
+-	syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1"
+-	syspath="$syspath /usr/man/u_man/man1"
+-	syspath="$syspath /usr/catman/u_man/man1 /usr/man/l_man/man1"
+-	syspath="$syspath /usr/local/man/u_man/man1 /usr/local/man/l_man/man1"
+-	syspath="$syspath /usr/man/man.L /local/man/man1 /usr/local/man/man1"
+-	sysman=`./loc . /usr/man/man1 $syspath`
++	syspath=''
++	sysman=''
+ 	;;
+ esac
+ if $test -d "$sysman"; then
+@@ -19900,9 +19878,10 @@
+ case "$full_ar" in
+ '') full_ar=$ar ;;
+ esac
++full_ar=ar
+ 
+ : Store the full pathname to the sed program for use in the C program
+-full_sed=$sed
++full_sed=sed
+ 
+ : see what type gids are declared as in the kernel
+ echo " "
+Only in perl-5.20.0/: Configure.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/ext/Errno/Errno_pm.PL perl-5.20.0/ext/Errno/Errno_pm.PL
+--- perl-5.20.0-orig/ext/Errno/Errno_pm.PL	2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/ext/Errno/Errno_pm.PL	2014-06-25 10:31:24.317970047 +0200
+@@ -126,11 +126,7 @@
+ 	if ($dep =~ /(\S+errno\.h)/) {
+ 	     $file{$1} = 1;
+ 	}
+-    } elsif ($^O eq 'linux' &&
+-	      $Config{gccversion} ne '' && 
+-	      $Config{gccversion} !~ /intel/i
+-	      # might be using, say, Intel's icc
+-	     ) {
++    } elsif (0) {
+     # When cross-compiling we may store a path for gcc's "sysroot" option:
+     my $sysroot = $Config{sysroot} || '';
+ 	# Some Linuxes have weird errno.hs which generate
+Only in perl-5.20.0/ext/Errno: Errno_pm.PL.orig
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/freebsd.sh perl-5.20.0/hints/freebsd.sh
+--- perl-5.20.0-orig/hints/freebsd.sh	2014-01-31 22:55:51.000000000 +0100
++++ perl-5.20.0/hints/freebsd.sh	2014-06-25 10:25:53.263964680 +0200
+@@ -119,21 +119,21 @@
+         objformat=`/usr/bin/objformat`
+         if [ x$objformat = xaout ]; then
+             if [ -e /usr/lib/aout ]; then
+-                libpth="/usr/lib/aout /usr/local/lib /usr/lib"
+-                glibpth="/usr/lib/aout /usr/local/lib /usr/lib"
++                libpth=""
++                glibpth=""
+             fi
+             lddlflags='-Bshareable'
+         else
+-            libpth="/usr/lib /usr/local/lib"
+-            glibpth="/usr/lib /usr/local/lib"
++            libpth=""
++            glibpth=""
+             ldflags="-Wl,-E "
+             lddlflags="-shared "
+         fi
+         cccdlflags='-DPIC -fPIC'
+         ;;
+ *)
+-       libpth="/usr/lib /usr/local/lib"
+-       glibpth="/usr/lib /usr/local/lib"
++       libpth=""
++       glibpth=""
+        ldflags="-Wl,-E "
+         lddlflags="-shared "
+         cccdlflags='-DPIC -fPIC'
+diff -ru -x '*~' -x '*.rej' perl-5.20.0-orig/hints/linux.sh perl-5.20.0/hints/linux.sh
+--- perl-5.20.0-orig/hints/linux.sh	2014-05-26 15:34:20.000000000 +0200
++++ perl-5.20.0/hints/linux.sh	2014-06-25 10:33:47.354883843 +0200
+@@ -150,25 +150,6 @@
+     ;;
+ esac
+ 
+-# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries
+-# (such as -lm) in /lib or /usr/lib.  So we have to ask gcc to tell us
+-# where to look.  We don't want gcc's own libraries, however, so we
+-# filter those out.
+-# This could be conditional on Unbuntu, but other distributions may
+-# follow suit, and this scheme seems to work even on rather old gcc's.
+-# This unconditionally uses gcc because even if the user is using another
+-# compiler, we still need to find the math library and friends, and I don't
+-# know how other compilers will cope with that situation.
+-# Morever, if the user has their own gcc earlier in $PATH than the system gcc,
+-# we don't want its libraries. So we try to prefer the system gcc
+-# Still, as an escape hatch, allow Configure command line overrides to
+-# plibpth to bypass this check.
+-if [ -x /usr/bin/gcc ] ; then
+-    gcc=/usr/bin/gcc
+-else
+-    gcc=gcc
+-fi
+-
+ case "$plibpth" in
+ '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries |
+ 	cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'`
+@@ -178,32 +159,6 @@
+     ;;
+ esac
+ 
+-case "$libc" in
+-'')
+-# If you have glibc, then report the version for ./myconfig bug reporting.
+-# (Configure doesn't need to know the specific version since it just uses
+-# gcc to load the library for all tests.)
+-# We don't use __GLIBC__ and  __GLIBC_MINOR__ because they
+-# are insufficiently precise to distinguish things like
+-# libc-2.0.6 and libc-2.0.7.
+-    for p in $plibpth
+-    do
+-        for trylib in libc.so.6 libc.so
+-        do
+-            if $test -e $p/$trylib; then
+-                libc=`ls -l $p/$trylib | awk '{print $NF}'`
+-                if $test "X$libc" != X; then
+-                    break
+-                fi
+-            fi
+-        done
+-        if $test "X$libc" != X; then
+-            break
+-        fi
+-    done
+-    ;;
+-esac
+-
+ # Are we using ELF?  Thanks to Kenneth Albanowski <kjahds@kjahds.com>
+ # for this test.
+ cat >try.c <<'EOM'
+@@ -367,33 +322,6 @@
+ 	;;
+ esac
+ 
+-# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than
+-# true libraries. The scripts cause binding against static
+-# version of -lgdbm which is a bad idea. So if we have 'nm'
+-# make sure it can read the file
+-# NI-S 2003/08/07
+-case "$nm" in
+-    '') ;;
+-    *)
+-    for p in $plibpth
+-    do
+-        if $test -r $p/libndbm.so; then
+-            if $nm $p/libndbm.so >/dev/null 2>&1 ; then
+-                echo 'Your shared -lndbm seems to be a real library.'
+-                _libndbm_real=1
+-                break
+-            fi
+-        fi
+-    done
+-    if $test "X$_libndbm_real" = X; then
+-        echo 'Your shared -lndbm is not a real library.'
+-        set `echo X "$libswanted "| sed -e 's/ ndbm / /'`
+-        shift
+-        libswanted="$*"
+-    fi
+-    ;;
+-esac
+-
+ # Linux on Synology.
+ if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then
+     # Tested on Synology DS213 and DS413
diff --git a/pkgs/development/interpreters/perl/5.22/setup-hook.sh b/pkgs/development/interpreters/perl/5.22/setup-hook.sh
new file mode 100644
index 000000000000..a8656b8531db
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.22/setup-hook.sh
@@ -0,0 +1,5 @@
+addPerlLibPath () {
+    addToSearchPath PERL5LIB $1/lib/perl5/site_perl
+}
+
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 33b5b0f9024b..10f40c4dd2f9 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -18,7 +18,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
 
   enableParallelBuilding = true;
 
-  buildInputs = ["flex" "bison" "pkgconfig"];
+  buildInputs = [ flex bison pkgconfig ];
 
   flags = {
 
@@ -146,7 +146,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed)
 
     openssl = {
       configureFlags = ["--with-openssl=${openssl}"];
-      buildInputs = ["openssl"];
+      buildInputs = [openssl];
     };
 
     mbstring = {
diff --git a/pkgs/development/interpreters/pure/default.nix b/pkgs/development/interpreters/pure/default.nix
index 2860aceb383b..c471a3cdc0fb 100644
--- a/pkgs/development/interpreters/pure/default.nix
+++ b/pkgs/development/interpreters/pure/default.nix
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison flex makeWrapper ];
   propagatedBuildInputs = [ llvm gmp mpfr readline ];
 
+  postPatch = ''
+    for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
+      sed -i '1i\#include <stddef.h>' $f
+    done
+  '';
+
   configureFlags = [ "--enable-release" ];
   doCheck = true;
   checkPhase = ''
diff --git a/pkgs/development/interpreters/pypy/default.nix b/pkgs/development/interpreters/pypy/default.nix
index a453fd3e1a9e..143bab575347 100644
--- a/pkgs/development/interpreters/pypy/default.nix
+++ b/pkgs/development/interpreters/pypy/default.nix
@@ -49,16 +49,27 @@ let
         --replace "libraries=['curses']" "libraries=['ncurses']"
 
       # tkinter hints
-      substituteInPlace lib_pypy/_tkinter/tklib.py \
+      substituteInPlace lib_pypy/_tkinter/tklib_build.py \
         --replace "'/usr/include/tcl'" "'${tk}/include', '${tcl}/include'" \
-        --replace "linklibs=['tcl', 'tk']" "linklibs=['${tcl.libPrefix}', '${tk.libPrefix}']" \
+        --replace "linklibs = ['tcl' + _ver, 'tk' + _ver]" "linklibs=['${tcl.libPrefix}', '${tk.libPrefix}']" \
         --replace "libdirs = []" "libdirs = ['${tk}/lib', '${tcl}/lib']"
 
-      sed -i "s@libraries=\['sqlite3'\]\$@libraries=['sqlite3'], include_dirs=['${sqlite}/include'], library_dirs=['${sqlite}/lib']@" lib_pypy/_sqlite3.py
+      sed -i "s@libraries=\['sqlite3'\]\$@libraries=['sqlite3'], include_dirs=['${sqlite}/include'], library_dirs=['${sqlite}/lib']@" lib_pypy/_sqlite3_build.py
     '';
 
     setupHook = ./setup-hook.sh;
 
+    postBuild = ''
+      cd ./lib_pypy
+        ../pypy-c ./_audioop_build.py
+        ../pypy-c ./_curses_build.py
+        ../pypy-c ./_pwdgrp_build.py
+        ../pypy-c ./_sqlite3_build.py
+        ../pypy-c ./_syslog_build.py
+        ../pypy-c ./_tkinter/tklib_build.py
+      cd ..
+    '';
+
     doCheck = true;
     checkPhase = ''
        export TERMINFO="${ncurses}/share/terminfo/";
diff --git a/pkgs/development/interpreters/pypy/setup-hook.sh b/pkgs/development/interpreters/pypy/setup-hook.sh
index 057e619ebc89..c82179d9e87b 100644
--- a/pkgs/development/interpreters/pypy/setup-hook.sh
+++ b/pkgs/development/interpreters/pypy/setup-hook.sh
@@ -1,12 +1,12 @@
 addPythonPath() {
-    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.5/site-packages
+    addToSearchPathWithCustomDelimiter : PYTHONPATH $1/lib/pypy2.6/site-packages
 }
 
 toPythonPath() {
     local paths="$1"
     local result=
     for i in $paths; do
-        p="$i/lib/pypy2.5/site-packages"
+        p="$i/lib/pypy2.6/site-packages"
         result="${result}${result:+:}$p"
     done
     echo $result
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/2.7/default.nix
index 4ad4679bd6ea..195caa583ad4 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/2.7/default.nix
@@ -8,6 +8,8 @@
 , tcl ? null, tk ? null, x11 ? null, libX11 ? null, x11Support ? !stdenv.isCygwin
 , zlib ? null, zlibSupport ? true
 , expat, libffi
+
+, CF, configd
 }:
 
 assert zlibSupport -> zlib != null;
@@ -40,6 +42,8 @@ let
       # patch python to put zero timestamp into pyc
       # if DETERMINISTIC_BUILD env var is set
       ./deterministic-build.patch
+
+      ./properly-detect-curses.patch
     ] ++ optionals stdenv.isCygwin [
       ./2.5.2-ctypes-util-find_library.patch
       ./2.5.2-tkinter-x11.patch
@@ -62,6 +66,8 @@ let
       for i in Lib/plat-*/regen; do
         substituteInPlace $i --replace /usr/include/ ${stdenv.cc.libc}/include/
       done
+    '' + optionalString stdenv.isDarwin ''
+      substituteInPlace configure --replace '`/usr/bin/arch`' '"i386"'
     '';
 
   configureFlags = [
@@ -72,6 +78,8 @@ let
     "--with-system-ffi"
     "--with-system-expat"
     "ac_cv_func_bind_textdomain_codeset=yes"
+  ] ++ optionals stdenv.isDarwin [
+    "--disable-toolbox-glue"
   ];
 
   postConfigure = if stdenv.isCygwin then ''
@@ -86,7 +94,12 @@ let
         [ db gdbm ncurses sqlite readline
         ] ++ optionals x11Support [ tcl tk x11 libX11 ]
     )
-    ++ optional zlibSupport zlib;
+    ++ optional zlibSupport zlib
+
+    # depend on CF and configd only if purity is an issue
+    # the impure bootstrap compiler can't build CoreFoundation currently. it requires
+    # <mach-o/dyld.h> which is in our pure bootstrapTools, but not in the system headers.
+    ++ optionals (stdenv.isDarwin && !stdenv.cc.nativeLibc) [ CF configd ];
 
   # Build the basic Python interpreter without modules that have
   # external dependencies.
diff --git a/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch b/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch
new file mode 100644
index 000000000000..e2640bab0e9a
--- /dev/null
+++ b/pkgs/development/interpreters/python/2.7/properly-detect-curses.patch
@@ -0,0 +1,116 @@
+From 6dc83db69b5e29d25ba6d73646ea2e9a1097848a Mon Sep 17 00:00:00 2001
+From: Roumen Petrov <local@example.net>
+Date: Sun, 19 Feb 2012 16:13:24 +0200
+Subject: [PATCH] CROSS-properly detect WINDOW _flags for different ncurses versions
+
+---
+ Include/py_curses.h |    5 +++++
+ configure.ac        |   40 ++++++++++++++++++++++++++++++++++++++--
+ pyconfig.h.in       |    6 ++++++
+ 3 files changed, 49 insertions(+), 2 deletions(-)
+
+diff --git a/Include/py_curses.h b/Include/py_curses.h
+index f2c08f6..a9b5260 100644
+--- a/Include/py_curses.h
++++ b/Include/py_curses.h
+@@ -14,7 +14,9 @@
+ /* the following define is necessary for OS X 10.6; without it, the
+    Apple-supplied ncurses.h sets NCURSES_OPAQUE to 1, and then Python
+    can't get at the WINDOW flags field. */
++/* NOTE configure check if ncurses require such definition
+ #define NCURSES_OPAQUE 0
++*/
+ #endif /* __APPLE__ */
+ 
+ #ifdef __FreeBSD__
+@@ -57,9 +59,12 @@
+ #ifdef HAVE_NCURSES_H
+ /* configure was checking <curses.h>, but we will
+    use <ncurses.h>, which has all these features. */
++/* NOTE configure check for existence of flags
++ * Also flags are visible only if WINDOW structure is not opaque
+ #ifndef WINDOW_HAS_FLAGS
+ #define WINDOW_HAS_FLAGS 1
+ #endif
++*/
+ #ifndef MVWDELCH_IS_EXPRESSION
+ #define MVWDELCH_IS_EXPRESSION 1
+ #endif
+diff --git a/configure.ac b/configure.ac
+index 0a3a186..75f5142 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -4150,15 +4150,51 @@ then
+ fi
+ 
+ AC_MSG_CHECKING(whether WINDOW has _flags)
+-AC_CACHE_VAL(ac_cv_window_has_flags,
+ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <curses.h>]], [[
+   WINDOW *w;
+   w->_flags = 0;
+ ]])],
+ [ac_cv_window_has_flags=yes],
+-[ac_cv_window_has_flags=no]))
++[ac_cv_window_has_flags=no])
+ AC_MSG_RESULT($ac_cv_window_has_flags)
+ 
++py_curses_window_is_opaque=no
++if test no = $ac_cv_window_has_flags; then
++  AC_MSG_CHECKING([whether WINDOW has _flags in non-opaque structure])
++  AC_COMPILE_IFELSE([
++  AC_LANG_PROGRAM([[
++    #define NCURSES_OPAQUE 0
++    #include <curses.h>
++  ]],[[
++    WINDOW *w;
++    w->_flags = 0;
++  ]])],
++  [py_curses_window_is_opaque=yes])
++  AC_MSG_RESULT([$py_curses_window_is_opaque])
++fi
++if test yes = $py_curses_window_is_opaque; then
++  ac_cv_window_has_flags=yes
++  AC_DEFINE([NCURSES_OPAQUE], [0], [Define to 0 if you have WINDOW _flags in non-opaque structure.])
++fi
++
++py_curses_window_is_internal=no
++if test no = $ac_cv_window_has_flags; then
++  AC_MSG_CHECKING([whether WINDOW has _flags as internal structure])
++  AC_COMPILE_IFELSE([
++  AC_LANG_PROGRAM([[
++    #define NCURSES_INTERNALS 1
++    #include <curses.h>
++  ]],[[
++    WINDOW *w;
++    w->_flags = 0;
++  ]])],
++  [py_curses_window_is_internal=yes])
++  AC_MSG_RESULT([$py_curses_window_is_internal])
++fi
++if test yes = $py_curses_window_is_internal; then
++  ac_cv_window_has_flags=yes
++  AC_DEFINE([NCURSES_INTERNALS], [1], [Define to 1 if you have WINDOW _flags as internal structure.])
++fi
+ 
+ if test "$ac_cv_window_has_flags" = yes
+ then
+diff --git a/pyconfig.h.in b/pyconfig.h.in
+index 3ca3a4f..484c817 100644
+--- a/pyconfig.h.in
++++ b/pyconfig.h.in
+@@ -1130,6 +1130,12 @@
+ /* Define if mvwdelch in curses.h is an expression. */
+ #undef MVWDELCH_IS_EXPRESSION
+ 
++/* Define to 1 if you have WINDOW _flags as internal structure. */
++#undef NCURSES_INTERNALS
++
++/* Define to 0 if you have WINDOW _flags in non-opaque structure. */
++#undef NCURSES_OPAQUE
++
+ /* Define to the address where bug reports for this package should be sent. */
+ #undef PACKAGE_BUGREPORT
+ 
+-- 
+1.6.4
+
diff --git a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
index 70c0d9a1c9cc..1c4318e01686 100644
--- a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
+++ b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
@@ -6,6 +6,7 @@
 , groff, docSupport ? false
 , libyaml, yamlSupport ? true
 , ruby_1_9_3, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc
 }:
 
 let
@@ -44,7 +45,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/ruby/ruby-2.2.0.nix b/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
index b6375aa687d7..e22e64681a3a 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.2.0.nix
@@ -7,6 +7,7 @@
 , libyaml, yamlSupport ? true
 , libffi, fiddleSupport ? true
 , ruby_2_2_0, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc, libunwind
 }:
 
 let
@@ -47,7 +48,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc libunwind ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/ruby/ruby-2.2.2.nix b/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
index 0f0fa5245e47..9e015ce9d7b6 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.2.2.nix
@@ -7,6 +7,7 @@
 , libyaml, yamlSupport ? true
 , libffi, fiddleSupport ? true
 , ruby_2_2_2, autoreconfHook, bison, useRailsExpress ? true
+, libiconv, libobjc, libunwind
 }:
 
 let
@@ -47,7 +48,8 @@ stdenv.mkDerivation rec {
     # support is not enabled, so add readline to the build inputs if curses
     # support is disabled (if it's enabled, we already have it) and we're
     # running on darwin
-    ++ (op (!cursesSupport && stdenv.isDarwin) readline);
+    ++ (op (!cursesSupport && stdenv.isDarwin) readline)
+    ++ (ops stdenv.isDarwin [ libiconv libobjc libunwind ]);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/spidermonkey/17.0.nix b/pkgs/development/interpreters/spidermonkey/17.0.nix
index 74f0fe2b83a4..7573b546164b 100644
--- a/pkgs/development/interpreters/spidermonkey/17.0.nix
+++ b/pkgs/development/interpreters/spidermonkey/17.0.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip }:
+{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip, libffi, readline }:
 
 stdenv.mkDerivation rec {
   version = "17.0.0";
@@ -11,16 +11,26 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nspr ];
 
-  buildInputs = [ pkgconfig perl python zip ];
+  buildInputs = [ pkgconfig perl python zip libffi readline ];
 
   postUnpack = "sourceRoot=\${sourceRoot}/js/src";
 
+  postPatch = ''
+    # Fixes an issue with version detection under perl 5.22.x
+    sed -i 's/(defined\((@TEMPLATE_FILE)\))/\1/' config/milestone.pl
+  '';
+
   preConfigure = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${nspr}/include/nspr"
     export LIBXUL_DIST=$out
   '';
 
-  configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ];
+  configureFlags = [
+    "--enable-threadsafe"
+    "--with-system-nspr"
+    "--with-system-ffi"
+    "--enable-readline"
+  ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
   preBuild = "touch -- {.,shell,jsapi-tests}/{-lpthread,-ldl}";
@@ -39,6 +49,8 @@ stdenv.mkDerivation rec {
     paxmark mr jsapi-tests/jsapi-tests
   '';
 
+  postInstall = ''rm "$out"/lib/*.a''; # halve the output size
+
   meta = with stdenv.lib; {
     description = "Mozilla's JavaScript engine written in C/C++";
     homepage = https://developer.mozilla.org/en/SpiderMonkey;
diff --git a/pkgs/development/interpreters/spidermonkey/24.2.nix b/pkgs/development/interpreters/spidermonkey/24.2.nix
index 44fe4f60d53e..3a9bd8ad7a46 100644
--- a/pkgs/development/interpreters/spidermonkey/24.2.nix
+++ b/pkgs/development/interpreters/spidermonkey/24.2.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip }:
+{ stdenv, fetchurl, pkgconfig, nspr, perl, python, zip, libffi, readline }:
 
 stdenv.mkDerivation rec {
   version = "24.2.0";
@@ -11,7 +11,12 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nspr ];
 
-  buildInputs = [ pkgconfig perl python zip ];
+  buildInputs = [ pkgconfig perl python zip libffi readline ];
+
+  postPatch = ''
+    # Fixes an issue with version detection under perl 5.22.x
+    sed -i 's/(defined\((@TEMPLATE_FILE)\))/\1/' config/milestone.pl
+  '';
 
   postUnpack = "sourceRoot=\${sourceRoot}/js/src";
 
@@ -20,7 +25,12 @@ stdenv.mkDerivation rec {
     export LIBXUL_DIST=$out
   '';
 
-  configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ];
+  configureFlags = [
+    "--enable-threadsafe"
+    "--with-system-nspr"
+    "--with-system-ffi"
+    "--enable-readline"
+  ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
   preBuild = "touch -- {.,shell,jsapi-tests}/{-lpthread,-ldl}";
diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix
index 3e00b21ad43e..a62fc837dd0f 100644
--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@@ -14,6 +14,9 @@ assert x11Support -> (x11 != null && libXrandr != null);
 assert alsaSupport -> alsaLib != null;
 assert pulseaudioSupport -> libpulseaudio != null;
 
+let
+  inherit (stdenv.lib) optional optionals;
+in
 stdenv.mkDerivation rec {
   version = "1.2.15";
   name    = "SDL-${version}";
@@ -23,19 +26,19 @@ stdenv.mkDerivation rec {
     sha256 = "005d993xcac8236fpvd1iawkz4wqjybkpn8dbwaliqz5jfkidlyn";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   # Since `libpulse*.la' contain `-lgdbm', PulseAudio must be propagated.
-  propagatedNativeBuildInputs =
-    stdenv.lib.optionals x11Support [ x11 libXrandr ] ++
-    stdenv.lib.optional alsaSupport alsaLib ++
-    stdenv.lib.optional pulseaudioSupport libpulseaudio;
+  propagatedBuildInputs =
+    optionals x11Support [ x11 libXrandr ] ++
+    optional alsaSupport alsaLib ++
+    optional stdenv.isLinux libcap ++
+    optional openglSupport mesa ++
+    optional pulseaudioSupport libpulseaudio;
 
   buildInputs = let
     notMingw = !(stdenv ? cross) || stdenv.cross.libc != "msvcrt";
-  in stdenv.lib.optional stdenv.isLinux libcap
-    ++ (stdenv.lib.optional notMingw audiofile);
-
-  nativeBuildInputs = [ pkgconfig ] ++
-    stdenv.lib.optional openglSupport [ mesa ];
+  in optional notMingw audiofile;
 
   # XXX: By default, SDL wants to dlopen() PulseAudio, in which case
   # we must arrange to add it to its RPATH; however, `patchelf' seems
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index bfd5ff65563c..f5bd144a7172 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     stdenv.lib.optional pulseaudioSupport libpulseaudio;
 
   buildInputs = [ pkgconfig audiofile ] ++
-    stdenv.lib.optional openglSupport [ mesa ] ++
+    stdenv.lib.optional openglSupport mesa ++
     stdenv.lib.optional alsaSupport alsaLib;
 
   # https://bugzilla.libsdl.org/show_bug.cgi?id=1431
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index b562a2e5d3d2..940fc2bb6cc6 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -2,14 +2,14 @@
 , intltool, dbus_glib, at_spi2_core, libSM }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.12";
-  versionMinor = "1";
+  versionMajor = "2.16";
+  versionMinor = "0";
   moduleName   = "at-spi2-atk";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "5fa9c527bdec028e06797563cd52d49bcf06f638549df983424d88db89bb1336";
+    sha256 = "1y9gfz1iz3wpja7s000f0bmyyvc6im5fcdl6bxwbz0v3qdgc9vvq";
   };
 
   buildInputs = [ python pkgconfig popt atk libX11 libICE xlibs.libXtst libXi
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index 7128e4d3f2b8..a3632bc13fdf 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -2,14 +2,14 @@
 , libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.12";
+  versionMajor = "2.16";
   versionMinor = "0";
   moduleName   = "at-spi2-core";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "12gvsgdaxnxskndlhlmdkc50cfqgmzfc4n8la9944fz5k3fhwmfv";
+    sha256 = "1l3l39mw23zyjlcqidvkyqlr4gwbhplzw2hcv3qvn6p8ikxpf2qw";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/blitz/default.nix b/pkgs/development/libraries/blitz/default.nix
index a64a8bd59437..e6f59ca8efeb 100644
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   patches = [ ./blitz-gcc47.patch ./blitz-testsuite-stencil-et.patch ];
 
   buildInputs = [ pkgconfig gfortran texinfo ]
-    ++ optional (boost != null) boost
-    ;
+    ++ optional (boost != null) [ boost.lib ];
 
   configureFlags =
     [ "--enable-shared"
diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 5880ae772ceb..823e50e32272 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -27,7 +27,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   preInstall = ''
-    patchShebangs src/scripts
+    if [ -d src/scripts ]; then
+      patchShebangs src/scripts
+    fi
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/crypto++/default.nix b/pkgs/development/libraries/crypto++/default.nix
index 053937f1c56d..788d488659af 100644
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, unzip, libtool }:
+{ fetchurl, stdenv, unzip }:
 
 stdenv.mkDerivation rec {
   name = "crypto++-5.6.2";
@@ -8,45 +8,38 @@ stdenv.mkDerivation rec {
     sha256 = "0x1mqpz1v071cfrw4grbw7z734cxnpry1qh2b6rsmcx6nkyd5gsw";
   };
 
-  patches = (stdenv.lib.optional (stdenv.system != "i686-cygwin") ./dll.patch)
-            ++ (stdenv.lib.optional stdenv.isDarwin ./GNUmakefile.patch);
-
-  buildInputs = [ unzip libtool ];
-
-  # Unpack the thing in a subdirectory.
-  unpackPhase = ''
-    echo "unpacking Crypto++ to \`${name}' from \`$PWD'..."
-    mkdir "${name}" && (cd "${name}" && unzip "$src")
-    sourceRoot="$PWD/${name}"
-  '';
-
-  cxxflags = if stdenv.isi686 then "-march=i686" else
-             if stdenv.isx86_64 then "-march=nocona -fPIC" else
-             "";
-
-  configurePhase = ''
-    sed -i GNUmakefile \
-      -e 's|-march=native|${cxxflags}|g' \
-      -e 's|-mtune=native||g' \
-      -e '/^CXXFLAGS =/s|-g -O2|-O3|'
-  '';
-
-  # I add what 'enableParallelBuilding' would add to the make call,
-  # if we were using the generic build phase.
-  buildPhase = ''
-    make PREFIX="$out" all libcryptopp.so -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
-  '';
-
-  # TODO: Installing cryptotest.exe doesn't seem to be necessary. We run
-  # that binary during this build anyway to verify everything works.
-  installPhase = ''
-    mkdir "$out"
-    make install PREFIX="$out"
-  '';
+  patches = with stdenv;
+    lib.optional (system != "i686-cygwin") ./dll.patch
+    ++ lib.optional isDarwin ./GNUmakefile.patch;
+
+  buildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  configurePhase = let
+    marchflags =
+      if stdenv.isi686 then "-march=i686" else
+      if stdenv.isx86_64 then "-march=nocona -mtune=generic" else
+      "";
+    in
+    ''
+      sed -i GNUmakefile \
+        -e 's|-march=native|${marchflags} -fPIC|g' \
+        -e 's|-mtune=native||g' \
+        -e '/^CXXFLAGS =/s|-g ||'
+    '';
+
+  enableParallelBuilding = true;
+
+  makeFlags = "PREFIX=$(out)";
+  buildFlags = "libcryptopp.so";
 
   doCheck = true;
   checkPhase = "LD_LIBRARY_PATH=`pwd` make test";
 
+  # prefer -fPIC and .so to .a; cryptotest.exe seems superfluous
+  postInstall = ''rm "$out"/lib/*.a -r "$out/bin" '';
+
   meta = with stdenv.lib; {
     description = "Crypto++, a free C++ class library of cryptographic schemes";
     homepage = http://cryptopp.com/;
@@ -55,3 +48,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
   };
 }
+
diff --git a/pkgs/development/libraries/db/generic.nix b/pkgs/development/libraries/db/generic.nix
index 013a7fd35b9d..077bd4e03a32 100644
--- a/pkgs/development/libraries/db/generic.nix
+++ b/pkgs/development/libraries/db/generic.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     (if cxxSupport then "--enable-cxx" else "--disable-cxx")
     (if compat185 then "--enable-compat185" else "--disable-compat185")
+    "--enable-dbm"
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 84a18f2a0b54..d114cf17c4ef 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -7,8 +7,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.8.16";
-  sha256 = "01rba8mp8kqvmy6ibdmi806kjr3m14swnskqk02gyhykxxl54ybz";
+  version = "1.8.18";
+  sha256 = "1wn4k142m68d8yqd4i6dmx1ac0798yhkdnkk4mb72g3sfyffpwin";
 
   inherit (stdenv) lib;
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index da6a3ad1dffc..fafff05a032c 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -3,14 +3,14 @@
 
 let
   ver_maj = "2.31";
-  ver_min = "3";
+  ver_min = "4";
 in
 stdenv.mkDerivation rec {
   name = "gdk-pixbuf-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "ddd861747bb7c580acce7cfa3ce38c3f52a9516e66a6477988fd100c8fb9eabc";
+    sha256 = "05bslhk33qpssg66n2wys9khyzwkr4am0b23dym8n67qjds9gng5";
   };
 
   setupHook = ./setup-hook.sh;
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
     + stdenv.lib.optionalString (gobjectIntrospection != null) " --enable-introspection=yes"
     ;
 
-  doCheck = true;
+  # Seems to randomly fail sometimes with a bus error. FIXME
+  doCheck = !stdenv.isDarwin;
 
   postInstall = "rm -rf $out/share/gtk-doc";
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index 06e820633b84..ba7ab82f50b4 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -1,23 +1,15 @@
 findGdkPixbufLoaders() {
 
-	if [ -n "$out" ] && [ -z "$IN_NIX_SHELL" ]; then
-
-		# set pixbuf loaders.cache for this package
-
-		local loadersDir="$out/lib/gdk-pixbuf-loaders-2.0/$name"
-		mkdir -p "$loadersDir"
-		
-		if [ -f "$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" ]; then
-			cat "$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache" >> "$loadersDir/loaders.cache"
+	# choose the longest loaders.cache
+	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+	if [ -f "$loadersCache" ]; then
+		if [ -f "$GDK_PIXBUF_MODULE_FILE" ]; then
+			if [ $(cat "$loadersCache"|wc -l) -gt $(cat "$GDK_PIXBUF_MODULE_FILE"|wc -l) ]; then
+				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
+			fi
+		else
+			export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 		fi
-	
-		if [ -f "$1/lib/gdk-pixbuf/loaders.cache" ]; then
-			cat "$1/lib/gdk-pixbuf/loaders.cache" >> "$loadersDir/loaders.cache"
-		fi
-		
-		# note, this is not a search path
-		export GDK_PIXBUF_MODULE_FILE=$(readlink -e "$loadersDir/loaders.cache")
-
 	fi
 
 }
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 15f11f8a133d..f86a15cb0d61 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -19,7 +19,12 @@ stdenv.mkDerivation (rec {
             "--with-included-gettext"
             "--with-included-glib"
             "--with-included-libcroco"
-          ]);
+          ])
+     # avoid retaining reference to CF during stdenv bootstrap
+     ++ (stdenv.lib.optionals stdenv.isDarwin [
+        "gt_cv_func_CFPreferencesCopyAppValue=no"
+        "gt_cv_func_CFLocaleCopyCurrent=no"
+      ]);
 
   # On cross building, gettext supposes that the wchar.h from libc
   # does not fulfill gettext needs, so it tries to work with its
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 7d61bea64e11..5c76bc3186ba 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -40,7 +40,7 @@ let
   '';
 
   ver_maj = "2.44";
-  ver_min = "0";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "1fgmjv3yzxgbks31h42201x2izpw0sd84h8dfw0si3x00sqn5lzj";
+    sha256 = "01yabrfp64i11mrks3p1gcks99lw0zm7f5vhkc53sl4amyndw4c8";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index f173744e5ca6..ca7e326bd02e 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -11,6 +11,12 @@ make_glib_find_gsettings_schemas() {
 envHooks+=(make_glib_find_gsettings_schemas)
 
 glibPreFixupPhase() {
+    # Move gschemas in case the install flag didn't help
+    if [ -d "$out/share/glib-2.0/schemas" ]; then
+        mkdir -p "$out/share/gsettings-schemas/$name/glib-2.0"
+        mv "$out/share/glib-2.0/schemas" "$out/share/gsettings-schemas/$name/glib-2.0/"
+    fi
+
     addToSearchPath GSETTINGS_SCHEMAS_PATH "$out/share/gsettings-schemas/$name"
 }
 
diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index 39d84c4f6fec..02d24d21900b 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -21,7 +21,8 @@ stdenv.mkDerivation rec {
     then "ln -sf configfsf.guess config.guess"
     else ''echo "Darwin host is `./config.guess`."'';
 
-  configureFlags = if cxx then "--enable-cxx" else "--disable-cxx";
+  configureFlags = (if cxx then "--enable-cxx" else "--disable-cxx") +
+    stdenv.lib.optionalString stdenv.isDarwin " ac_cv_build=x86_64-apple-darwin13.4.0 ac_cv_host=x86_64-apple-darwin13.4.0";
 
   # The test t-lucnum_ui fails (on Linux/x86_64) when built with GCC 4.8.
   # Newer versions of GMP don't have that issue anymore.
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 0df1a4f8cd83..7b393067ff52 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, m4, cxx ? true, withStatic ? true }:
 
-with { inherit (stdenv.lib) optional; };
+with { inherit (stdenv.lib) optional optionalString; };
 
 stdenv.mkDerivation rec {
   name = "gmp-5.1.3";
@@ -28,6 +28,13 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.is64bit "--with-pic"
     ;
 
+  # The config.guess in GMP tries to runtime-detect various
+  # ARM optimization flags via /proc/cpuinfo (and is also
+  # broken on multicore CPUs). Avoid this impurity.
+  preConfigure = optionalString stdenv.isArm ''
+      configureFlagsArray+=("--build=$(./configfsf.guess)")
+    '';
+
   doCheck = true;
 
   dontDisableStatic = withStatic;
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index b7350c19960a..171611e12498 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, m4, cxx ? true, withStatic ? true }:
 
-with { inherit (stdenv.lib) optional; };
+with { inherit (stdenv.lib) optional optionalString; };
 
 stdenv.mkDerivation rec {
   name = "gmp-6.0.0a";
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.is64bit "--with-pic"
     ;
 
+  # The config.guess in GMP tries to runtime-detect various
+  # ARM optimization flags via /proc/cpuinfo (and is also
+  # broken on multicore CPUs). Avoid this impurity.
+  preConfigure = optionalString stdenv.isArm ''
+      configureFlagsArray+=("--build=$(./configfsf.guess)")
+    '';
+
   doCheck = true;
 
   dontDisableStatic = withStatic;
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 6f2361f1658a..07760933935a 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -7,15 +7,21 @@
 
 assert guileBindings -> guile != null;
 
+let
+  inherit (stdenv.lib) optional optionals optionalString;
+in
 stdenv.mkDerivation rec {
   name = "gnutls-${version}";
 
   inherit src patches;
 
-  configureFlags = [
+  configureFlags =
+    # FIXME: perhaps use $SSL_CERT_FILE instead
+    optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
+  ++ [
     "--disable-dependency-tracking"
     "--enable-fast-install"
-  ] ++ stdenv.lib.optional guileBindings
+  ] ++ optionals guileBindings
     [ "--enable-guile" "--with-guile-site-dir=\${out}/share/guile/site" ];
 
   # Build of the Guile bindings is not parallel-safe.  See
@@ -24,9 +30,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = !guileBindings;
 
   buildInputs = [ lzo lzip nettle libtasn1 libidn p11_kit zlib gmp ]
-    ++ stdenv.lib.optional stdenv.isLinux trousers
+    ++ optional stdenv.isLinux trousers
     ++ [ unbound ]
-    ++ stdenv.lib.optional guileBindings guile;
+    ++ optional guileBindings guile;
 
   nativeBuildInputs = [ perl pkgconfig autoreconfHook ];
 
@@ -35,7 +41,7 @@ stdenv.mkDerivation rec {
   doCheck = (!stdenv.isFreeBSD && !stdenv.isDarwin);
 
   # Fixup broken libtool and pkgconfig files
-  preFixup = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+  preFixup = optionalString (!stdenv.isDarwin) ''
     sed -e 's,-ltspi,-L${trousers}/lib -ltspi,' \
         -e 's,-lz,-L${zlib}/lib -lz,' \
         -e 's,-lgmp,-L${gmp}/lib -lgmp,' \
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 200c0d4e01de..50fddd9da9fd 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -5,7 +5,7 @@
 # In that case its about 6MB which could be separated
 
 let
-  ver_maj = "1.42";
+  ver_maj = "1.44";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${ver_maj}/${name}.tar.xz";
-    sha256 = "3ba2edfad4f71d4f0de16960b5d5f2511335fa646b2c49bbb93ce5942b3f95f7";
+    sha256 = "1b972qg2yb51sdavfvb6kc19akwc15c1bwnbg81vadxamql2q33g";
   };
 
   buildInputs = [ flex bison pkgconfig python ]
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index da4796fba896..011e4ecd48e3 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv }:
+{ fetchurl, fetchpatch, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "gsl-1.16";
@@ -8,9 +8,16 @@ stdenv.mkDerivation rec {
     sha256 = "0lrgipi0z6559jqh82yx8n4xgnxkhzj46v96dl77hahdp58jzg3k";
   };
 
-  # ToDo: there might be more impurities than FMA support check
-  patches = [ ./disable-fma.patch ]; # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
-  patchFlags = "-p0";
+  patches = [
+    # ToDo: there might be more impurities than FMA support check
+    ./disable-fma.patch # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
+
+    (fetchpatch {
+      name = "bug-39055.patch";
+      url = "http://git.savannah.gnu.org/cgit/gsl.git/patch/?id=9cc12d0377";
+      sha256 = "1bmrmihi28cly9g9pq54kkix2jy59y7cd7h5fw4v1c7h5rc2qvs8";
+    })
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/gsl/disable-fma.patch b/pkgs/development/libraries/gsl/disable-fma.patch
index d5c0d620863e..bb1eda9ccccd 100644
--- a/pkgs/development/libraries/gsl/disable-fma.patch
+++ b/pkgs/development/libraries/gsl/disable-fma.patch
@@ -1,5 +1,5 @@
---- configure.ac        2011-09-22 16:13:22 +0000
-+++ configure.ac        2011-11-26 23:55:24 +0000
+--- a/configure.ac        2011-09-22 16:13:22 +0000
++++ b/configure.ac        2011-11-26 23:55:24 +0000
 @@ -381,6 +381,28 @@
  AC_SUBST(HAVE_DARWIN_IEEE_INTERFACE)
  AC_SUBST(HAVE_DARWIN86_IEEE_INTERFACE)
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
index 59ee86da86d4..040cf20c4ea4 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation rec {
   };
 
   patchPhase = ''
-
     sed -i 's@/bin/echo@echo@g' configure
     sed -i -e 's/^   /\t/' docs/{libs,plugins}/Makefile.in
+
+    patch -p1 < ${./gcc-4.9.patch}
   '';
 
   # TODO : v4l, libvisual
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch
new file mode 100644
index 000000000000..fd9f6ea240d2
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/gcc-4.9.patch
@@ -0,0 +1,38 @@
+https://bugzilla.gnome.org/show_bug.cgi?id=670690
+
+From 9bd5a7ae5435469c3557a3d70e762791cb3dc5c7 Mon Sep 17 00:00:00 2001
+From: Antoine Jacoutot <ajacoutot@gnome.org>
+Date: Mon, 20 Jan 2014 15:44:09 +0100
+Subject: [PATCH] audioresample: fix build on BSD
+
+On i386, EMMINTRIN is defined but not usable without sse so check for
+__SSE__ and __SSE2__ as well.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=670690
+---
+ gst/audioresample/resample.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gst/audioresample/resample.c b/gst/audioresample/resample.c
+index 98d006c..481fa01 100644
+--- a/gst/audioresample/resample.c
++++ b/gst/audioresample/resample.c
+@@ -77,13 +77,13 @@
+ #define EXPORT G_GNUC_INTERNAL
+ 
+ #ifdef _USE_SSE
+-#ifndef HAVE_XMMINTRIN_H
++#if !defined(__SSE__) || !defined(HAVE_XMMINTRIN_H)
+ #undef _USE_SSE
+ #endif
+ #endif
+ 
+ #ifdef _USE_SSE2
+-#ifndef HAVE_EMMINTRIN_H
++#if !defined(__SSE2__) || !defined(HAVE_XMMINTRIN_H)
+ #undef _USE_SSE2
+ #endif
+ #endif
+-- 
+1.8.5.3
+
diff --git a/pkgs/development/libraries/gtk+/2.x.nix b/pkgs/development/libraries/gtk+/2.x.nix
index 774193cc06c8..fec9d16cf959 100644
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@@ -8,11 +8,11 @@ assert xineramaSupport -> xlibs.libXinerama != null;
 assert cupsSupport -> cups != null;
 
 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.27";
+  name = "gtk+-2.24.28";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "1x14rnjvqslpa1q19fp1qalz5sxds72amsgjk8m7769rwk511jr0";
+    sha256 = "0mj6xn40py9r9lvzg633fal81xfwfm89d9mvz7jk4lmwk0g49imj";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 252e52ee3b98..f83986187270 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -10,7 +10,7 @@ assert cupsSupport -> cups != null;
 
 let
   ver_maj = "3.16";
-  ver_min = "2";
+  ver_min = "5";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "1yhwg2l72l3khfkprydcjlpxjrg11ccqfc80sjl56llz3jk66fd0";
+    sha256 = "0cdwykh4086f7fl4dkybgpyxyb1jcmxbfin2az42z5pb4z8rjz5q";
   };
 
   nativeBuildInputs = [ pkgconfig gettext gobjectIntrospection perl ];
diff --git a/pkgs/development/libraries/icu/default.nix b/pkgs/development/libraries/icu/default.nix
index e95cb7ad0974..909f4e936a94 100644
--- a/pkgs/development/libraries/icu/default.nix
+++ b/pkgs/development/libraries/icu/default.nix
@@ -32,6 +32,11 @@ stdenv.mkDerivation {
   configureFlags = "--disable-debug" +
     stdenv.lib.optionalString stdenv.isDarwin " --enable-rpath";
 
+  # remove dependency on bootstrap-tools in early stdenv build
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
+  '';
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/isl/default.nix b/pkgs/development/libraries/isl/0.15.0.nix
index 9518a0c0e657..eca3372ad4d0 100644
--- a/pkgs/development/libraries/isl/default.nix
+++ b/pkgs/development/libraries/isl/0.15.0.nix
@@ -1,19 +1,17 @@
 { stdenv, fetchurl, gmp }:
 
 stdenv.mkDerivation rec {
-  name = "isl-0.14";
+  name = "isl-0.15";
 
   src = fetchurl {
-    url = "http://isl.gforge.inria.fr/${name}.tar.bz2";
-    sha256 = "0dlg4b85nw4w534525h0fvb7yhb8i4am8kskhmm0ym7qabzh4g3y";
+    url = "http://isl.gforge.inria.fr/${name}.tar.xz";
+    sha256 = "1m922l5bz69lvkcxrib7lvjqwfqsr8rpbzgmb2aq07bp76460jhh";
   };
 
   buildInputs = [ gmp ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
-
   meta = {
     homepage = http://www.kotnet.org/~skimo/isl/;
     license = stdenv.lib.licenses.lgpl21;
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index c90a24816481..8bb1d40b2a90 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -20,23 +20,25 @@ stdenv.mkDerivation rec {
     export sourceRoot=${src.name}
   '';
 
-  nativeBuildInputs = [
-    # cmake can be built with the system jsoncpp, or its own bundled version.
-    # Obviously we cannot build it against the system jsoncpp that doesn't yet exist, so
-    # we make a bootstrapping build with the bundled version.
-    (cmake.override { jsoncpp = null; })
-    python
-  ];
+  # Hack to be able to run the test, broken because we use
+  # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
+  preBuild = ''
+    export LD_LIBRARY_PATH="`pwd`/src/lib_json:$LD_LIBRARY_PATH"
+  '';
+
+  nativeBuildInputs = [ cmake python ];
 
   cmakeFlags = [
-    "-DJSONCPP_WITH_CMAKE_PACKAGE=1"
+    "-DJSONCPP_LIB_BUILD_SHARED=ON"
+    "-DJSONCPP_LIB_BUILD_STATIC=OFF"
+    "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
   ];
 
   meta = {
     inherit version;
     homepage = https://github.com/open-source-parsers/jsoncpp;
     description = "A simple API to manipulate JSON data in C++";
-    maintainers = with stdenv.lib.maintainers; [ ttuegel ];
+    maintainers = with stdenv.lib.maintainers; [ ttuegel page ];
     license = stdenv.lib.licenses.mit;
     branch = "1.6";
   };
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/development/libraries/kerberos/heimdal.nix
index 320e161d3da8..159b53b76500 100644
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@@ -1,54 +1,83 @@
-{ stdenv, fetchurl, pkgconfig, flex, yacc, readline, openldap, libcap_ng
-, sqlite, db, ncurses, openssl, cyrus_sasl
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, python, perl, yacc, flex
+, texinfo, perlPackages
+, openldap, libcap_ng, sqlite, openssl, db, libedit, pam
+
+# Extra Args
+, type ? ""
 }:
 
+let
+  libOnly = type == "lib";
+in
+with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "heimdal-1.5.3";
-
-  src = fetchurl {
-    urls = [
-      "http://www.h5l.org/dist/src/${name}.tar.gz"
-      "http://ftp.pdc.kth.se/pub/heimdal/src/${name}.tar.gz"
-    ];
-    sha256 = "19gypf9vzfrs2bw231qljfl4cqc1riyg0ai0xmm1nd1wngnpphma";
+  name = "${type}heimdal-2015-06-17";
+
+  src = fetchFromGitHub {
+    owner = "heimdal";
+    repo = "heimdal";
+    rev = "be63a2914adcbea7d42d56e674ee6edb4883ebaf";
+    sha256 = "147gv49gmy94y6f0x1vx523qni0frgcp3r7fill0r06rkfgfzc0j";
   };
 
+  nativeBuildInputs = [ autoreconfHook pkgconfig python perl yacc flex ]
+    ++ (with perlPackages; [ JSON ])
+    ++ optional (!libOnly) texinfo;
+  buildInputs = [ libcap_ng sqlite openssl db libedit ]
+    ++ optionals (!libOnly) [ openldap pam ];
+
   ## ugly, X should be made an option
   configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
     "--enable-hdb-openldap-module"
     "--with-capng"
-    "--with-openldap=${openldap}"
     "--with-sqlite3=${sqlite}"
-    "--with-openssl-lib=${openssl}/lib"
+    "--with-berkeley-db=${db}"
+    "--with-libedit=${libedit}"
+    "--with-openssl=${openssl}"
     "--without-x"
+  ] ++ optionals (!libOnly) [
+    "--with-openldap=${openldap}"
   ];
 
-  preConfigure = ''
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -pthread"
+  buildPhase = optionalString libOnly ''
+    (cd include; make -j $NIX_BUILD_CORES)
+    (cd lib; make -j $NIX_BUILD_CORES)
+    (cd tools; make -j $NIX_BUILD_CORES)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
+  '';
+
+  installPhase = optionalString libOnly ''
+    (cd include; make -j $NIX_BUILD_CORES install)
+    (cd lib; make -j $NIX_BUILD_CORES install)
+    (cd tools; make -j $NIX_BUILD_CORES install)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
+    rm -rf $out/{libexec,sbin,share}
+    find $out/bin -type f | grep -v 'krb5-config' | xargs rm
   '';
 
   # We need to build hcrypt for applications like samba
   postBuild = ''
-    (cd lib/hcrypto; make)
-    (cd include/hcrypto; make)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES)
   '';
 
   postInstall = ''
     # Install hcrypto
-    (cd lib/hcrypto; make install)
-    (cd include/hcrypto; make install)
+    (cd include/hcrypto; make -j $NIX_BUILD_CORES install)
+    (cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
 
-    # dont succeed with --libexec=$out/sbin, so
+    # Doesn't succeed with --libexec=$out/sbin, so
     mv "$out/libexec/"* $out/sbin/
     rmdir $out/libexec
   '';
 
-  buildInputs = [
-    pkgconfig flex yacc readline openldap libcap_ng sqlite db ncurses
-    cyrus_sasl openssl
-  ];
+  enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "an implementation of Kerberos 5 (and some more stuff) largely written in Sweden";
     license = licenses.bsd3;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 41c570ee554e..2e5e48891b82 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -1,41 +1,61 @@
-{ stdenv, fetchurl, pkgconfig, perl, ncurses, yacc, openssl, openldap, bootstrap_cmds }:
+{ stdenv, fetchurl, pkgconfig, perl, yacc, bootstrap_cmds
+, openssl, openldap, libedit
+
+# Extra Arguments
+, type ? ""
+}:
 
 let
-  pname = "krb5";
-  version = "1.13.1";
-  name = "${pname}-${version}";
-  webpage = http://web.mit.edu/kerberos/;
+  libOnly = type == "lib";
 in
-
-stdenv.mkDerivation (rec {
-  inherit name;
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "${type}krb5-${version}";
+  version = "1.13.2";
 
   src = fetchurl {
-    url = "${webpage}dist/krb5/1.13/${name}-signed.tar";
-    sha256 = "0gk6jvr64rf6l4xcyxn8i3fr5d1j7dhqvwyv3vw2qdkzz7yjkxjd";
+    url = "${meta.homepage}dist/krb5/1.13/krb5-${version}-signed.tar";
+    sha256 = "1qbdzyrws7d0q4filsibh28z54pd5l987jr0ygv43iq9085w6a75";
   };
 
-  buildInputs = [ pkgconfig perl ncurses yacc openssl openldap ]
+  nativeBuildInputs = [ pkgconfig perl yacc ]
     # Provides the mig command used by the build scripts
-    ++ stdenv.lib.optional stdenv.isDarwin bootstrap_cmds ;
+    ++ stdenv.lib.optional stdenv.isDarwin bootstrap_cmds;
+  buildInputs = [ openssl ]
+    ++ optionals (!libOnly) [ openldap libedit ];
 
   unpackPhase = ''
     tar -xf $src
-    tar -xzf ${name}.tar.gz
-    cd ${name}/src
+    tar -xzf krb5-${version}.tar.gz
+    cd krb5-${version}/src
   '';
 
-  configureFlags = [ "--with-tcl=no" ];
+  buildPhase = optionalString libOnly ''
+    (cd util; make -j $NIX_BUILD_CORES)
+    (cd include; make -j $NIX_BUILD_CORES)
+    (cd lib; make -j $NIX_BUILD_CORES)
+    (cd build-tools; make -j $NIX_BUILD_CORES)
+  '';
+
+  installPhase = optionalString libOnly ''
+    mkdir -p $out/{bin,include/{gssapi,gssrpc,kadm5,krb5},lib/pkgconfig,sbin,share/{et,man/man1}}
+    (cd util; make -j $NIX_BUILD_CORES install)
+    (cd include; make -j $NIX_BUILD_CORES install)
+    (cd lib; make -j $NIX_BUILD_CORES install)
+    (cd build-tools; make -j $NIX_BUILD_CORES install)
+    rm -rf $out/{sbin,share}
+    find $out/bin -type f | grep -v 'krb5-config' | xargs rm
+  '';
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "MIT Kerberos 5";
-    homepage = webpage;
-    license = "MPL";
+    homepage = http://web.mit.edu/kerberos/;
+    license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ wkennington ];
   };
 
   passthru.implementation = "krb5";
-})
+}
diff --git a/pkgs/development/libraries/lame/default.nix b/pkgs/development/libraries/lame/default.nix
index 562e292791ab..f4ea47e633f9 100644
--- a/pkgs/development/libraries/lame/default.nix
+++ b/pkgs/development/libraries/lame/default.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
     sha256 = "1zr3kadv35ii6liia0bpfgxpag27xcivp571ybckpbz4b10nnd14";
   };
 
+  patches = [ ./gcc-4.9.patch ];
+
   nativeBuildInputs = [ ]
     ++ optional nasmSupport nasm;
 
diff --git a/pkgs/development/libraries/lame/gcc-4.9.patch b/pkgs/development/libraries/lame/gcc-4.9.patch
new file mode 100644
index 000000000000..59f8e00e4a8e
--- /dev/null
+++ b/pkgs/development/libraries/lame/gcc-4.9.patch
@@ -0,0 +1,33 @@
+fix sse optimizations build on 32-bit with gcc 4.9
+http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=351af417bae0d09bd5a3753d1237f03adf591933
+
+xmm_quantize_sub.c: In function 'init_xrpow_core_sse':
+xmm_quantize_sub.c:65:18: warning: SSE vector return without SSE enabled changes the ABI [-W
+psabi]
+     const __m128 vec_fabs_mask = _mm_loadu_ps(&fabs_mask._float[0]);
+                  ^
+In file included from xmm_quantize_sub.c:37:0:
+/usr/lib/gcc/i686-w64-mingw32/4.9.0/include/xmmintrin.h:933:1: error: inlining failed in call to always_inline '_mm_loadu_ps': target specific option mismatch
+ _mm_loadu_ps (float const *__P)
+ ^
+xmm_quantize_sub.c:65:18: error: called from here
+     const __m128 vec_fabs_mask = _mm_loadu_ps(&fabs_mask._float[0]);
+                  ^
+--- lame/libmp3lame/vector/xmm_quantize_sub.c.orig	2014-06-08 12:16:19.455468042 -0700
++++ lame/libmp3lame/vector/xmm_quantize_sub.c	2014-06-08 12:16:09.592356980 -0700
+@@ -35,6 +35,7 @@
+ #ifdef HAVE_XMMINTRIN_H
+ 
+ #include <xmmintrin.h>
++#pragma GCC target("sse")
+ 
+ typedef union {
+     int32_t _i_32[4]; /* unions are initialized by its first member */
+@@ -124,6 +125,7 @@
+ }
+ 
+ 
++#pragma GCC target("sse2")
+ void
+ fht_SSE2(FLOAT * fz, int n)
+ {
diff --git a/pkgs/development/libraries/libarchive/CVE-2015-1197.patch b/pkgs/development/libraries/libarchive/CVE-2015-1197.patch
new file mode 100644
index 000000000000..cb7be5f18cdb
--- /dev/null
+++ b/pkgs/development/libraries/libarchive/CVE-2015-1197.patch
@@ -0,0 +1,143 @@
+From 59357157706d47c365b2227739e17daba3607526 Mon Sep 17 00:00:00 2001
+From: Alessandro Ghedini <alessandro@ghedini.me>
+Date: Sun, 1 Mar 2015 12:07:45 +0100
+Subject: [PATCH] Add ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS option
+
+This fixes a directory traversal in the cpio tool.
+---
+ cpio/bsdcpio.1                           |  3 ++-
+ cpio/cpio.c                              |  2 ++
+ libarchive/archive.h                     |  2 ++
+ libarchive/archive_write_disk.3          |  3 +++
+ libarchive/archive_write_disk_posix.c    | 14 +++++++++++---
+ libarchive/test/test_write_disk_secure.c | 23 +++++++++++++++++++++++
+ 6 files changed, 43 insertions(+), 4 deletions(-)
+
+diff --git a/cpio/bsdcpio.1 b/cpio/bsdcpio.1
+index f966aa0..e52546e 100644
+--- a/cpio/bsdcpio.1
++++ b/cpio/bsdcpio.1
+@@ -156,7 +156,8 @@ See above for description.
+ .It Fl Fl insecure
+ (i and p mode only)
+ Disable security checks during extraction or copying.
+-This allows extraction via symbolic links and path names containing
++This allows extraction via symbolic links, absolute paths,
++and path names containing
+ .Sq ..
+ in the name.
+ .It Fl J , Fl Fl xz
+diff --git a/cpio/cpio.c b/cpio/cpio.c
+index 0acde11..b267e9b 100644
+--- a/cpio/cpio.c
++++ b/cpio/cpio.c
+@@ -171,6 +171,7 @@ main(int argc, char *argv[])
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_NO_OVERWRITE_NEWER;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
++	cpio->extract_flags |= ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_PERM;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_FFLAGS;
+ 	cpio->extract_flags |= ARCHIVE_EXTRACT_ACL;
+@@ -256,6 +257,7 @@ main(int argc, char *argv[])
+ 		case OPTION_INSECURE:
+ 			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ 			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NODOTDOT;
++			cpio->extract_flags &= ~ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS;
+ 			break;
+ 		case 'L': /* GNU cpio */
+ 			cpio->option_follow_links = 1;
+diff --git a/libarchive/archive.h b/libarchive/archive.h
+index 1f0fc38..ef635ac 100644
+--- a/libarchive/archive.h
++++ b/libarchive/archive.h
+@@ -649,6 +649,8 @@ __LA_DECL int archive_read_set_passphrase_callback(struct archive *,
+ /* Default: Do not use HFS+ compression if it was not compressed. */
+ /* This has no effect except on Mac OS v10.6 or later. */
+ #define	ARCHIVE_EXTRACT_HFS_COMPRESSION_FORCED	(0x8000)
++/* Default: Do not reject entries with absolute paths */
++#define ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS (0x10000)
+ 
+ __LA_DECL int archive_read_extract(struct archive *, struct archive_entry *,
+ 		     int flags);
+diff --git a/libarchive/archive_write_disk.3 b/libarchive/archive_write_disk.3
+index fa925cc..a2e7afa 100644
+--- a/libarchive/archive_write_disk.3
++++ b/libarchive/archive_write_disk.3
+@@ -177,6 +177,9 @@ The default is to not refuse such paths.
+ Note that paths ending in
+ .Pa ..
+ always cause an error, regardless of this flag.
++.It Cm ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
++Refuse to extract an absolute path.
++The default is to not refuse such paths.
+ .It Cm ARCHIVE_EXTRACT_SPARSE
+ Scan data for blocks of NUL bytes and try to recreate them with holes.
+ This results in sparse files, independent of whether the archive format
+diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c
+index ab3bdac..c1290eb 100644
+--- a/libarchive/archive_write_disk_posix.c
++++ b/libarchive/archive_write_disk_posix.c
+@@ -2509,8 +2509,9 @@ cleanup_pathname_win(struct archive_write_disk *a)
+ /*
+  * Canonicalize the pathname.  In particular, this strips duplicate
+  * '/' characters, '.' elements, and trailing '/'.  It also raises an
+- * error for an empty path, a trailing '..' or (if _SECURE_NODOTDOT is
+- * set) any '..' in the path.
++ * error for an empty path, a trailing '..', (if _SECURE_NODOTDOT is
++ * set) any '..' in the path or (if ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS
++ * is set) if the path is absolute.
+  */
+ static int
+ cleanup_pathname(struct archive_write_disk *a)
+@@ -2529,8 +2530,15 @@ cleanup_pathname(struct archive_write_disk *a)
+ 	cleanup_pathname_win(a);
+ #endif
+ 	/* Skip leading '/'. */
+-	if (*src == '/')
++	if (*src == '/') {
++		if (a->flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS) {
++			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
++			                  "Path is absolute");
++			return (ARCHIVE_FAILED);
++		}
++
+ 		separator = *src++;
++	}
+ 
+ 	/* Scan the pathname one element at a time. */
+ 	for (;;) {
+diff --git a/libarchive/test/test_write_disk_secure.c b/libarchive/test/test_write_disk_secure.c
+index 31c5bfd..2c94206 100644
+--- a/libarchive/test/test_write_disk_secure.c
++++ b/libarchive/test/test_write_disk_secure.c
+@@ -178,6 +178,29 @@ DEFINE_TEST(test_write_disk_secure)
+ 	assert(S_ISDIR(st.st_mode));
+ 	archive_entry_free(ae);
+ 
++	/*
++	 * Without security checks, we should be able to
++	 * extract an absolute path.
++	 */
++	assert((ae = archive_entry_new()) != NULL);
++	archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	archive_entry_set_mode(ae, S_IFREG | 0777);
++	assert(0 == archive_write_header(a, ae));
++	assert(0 == archive_write_finish_entry(a));
++	assertFileExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	assert(0 == unlink("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp"));
++
++	/* But with security checks enabled, this should fail. */
++	assert(archive_entry_clear(ae) != NULL);
++	archive_entry_copy_pathname(ae, "/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++	archive_entry_set_mode(ae, S_IFREG | 0777);
++	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS);
++	failure("Extracting an absolute path should fail here.");
++	assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
++	archive_entry_free(ae);
++	assert(0 == archive_write_finish_entry(a));
++	assertFileNotExists("/tmp/libarchive_test-test_write_disk_secure-absolute_path.tmp");
++
+ 	assertEqualInt(ARCHIVE_OK, archive_write_free(a));
+ 
+ 	/* Test the entries on disk. */
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 076d22402772..60777614881d 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./CVE-2013-0211.patch # https://github.com/libarchive/libarchive/commit/22531545
+    ./CVE-2015-1197.patch # https://github.com/NixOS/nixpkgs/issues/6799
   ];
 
   buildInputs = [ sharutils libxml2 zlib bzip2 openssl xz ] ++
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index c41e2e0a70b5..16d9d8c75a46 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, fetchsvn, python, llvm, clang }:
+{ stdenv, fetchFromGitHub, python, llvm, clang }:
 
 stdenv.mkDerivation {
   name = "libclc-2015-03-27";
 
-  src = fetchsvn {
-    url = "http://llvm.org/svn/llvm-project/libclc/trunk";
-    rev = "233456";
-    sha256 = "0g56kgffc1qr9rzhcjr4w8kljcicg0q828s9b4bmfzjvywd7hhr0";
+  src = fetchFromGitHub {
+    owner = "llvm-mirror";
+    repo = "libclc";
+    rev = "0a2d1619921545b52303be5608b64dc46f381e97";
+    sha256 = "0hgm013c0vlfqfbbf4cdajl01hhk1mhsfk4h4bfza1san97l0vcc";
   };
 
   buildInputs = [ python llvm clang ];
@@ -22,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     homepage = http://libclc.llvm.org/;
-    description = "implementation of the library requirements of the OpenCL C programming language";
+    description = "Implementation of the library requirements of the OpenCL C programming language";
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 5ffdd9303e0c..b223bd962e7e 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, udev }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.60";
+  name = "libdrm-2.4.61";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "12cqnmssi6mbr93n29mm84k8wix5nx6zs82k7wcmj7z3r335ymwr";
+    sha256 = "8b549092c8961a393a7e1d9a1bccddcea8e2af67c0d7d7c67babb9fc3b47699c";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index dc2f5842b285..5adef716eb0f 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ] else null;
 
   postInstall = ''
-    sed -i ${stdenv.lib.optionalString (stdenv.isDarwin && stdenv.cc.nativeTools) "''"} s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
+    sed -i s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
   '';
 
   configureFlags = [ "--enable-widec" ];
diff --git a/pkgs/development/libraries/libev/default.nix b/pkgs/development/libraries/libev/default.nix
index c9b48d724dd1..d27df16eb944 100644
--- a/pkgs/development/libraries/libev/default.nix
+++ b/pkgs/development/libraries/libev/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1jyw7qbl0spxqa0dccj9x1jsw7cj7szff43cq4acmklnra4mzz48";
   };
 
+  patches = [ ./noreturn.patch ];
+
   # Version 4.19 is not valid C11 (which Clang default to)
   # Check if this is still necessary on upgrade
   NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-std=c99" else null;
diff --git a/pkgs/development/libraries/libev/noreturn.patch b/pkgs/development/libraries/libev/noreturn.patch
new file mode 100644
index 000000000000..85e2eaee6b47
--- /dev/null
+++ b/pkgs/development/libraries/libev/noreturn.patch
@@ -0,0 +1,13 @@
+diff --git a/ev.c b/ev.c
+index 6f36c6d..b8a1c5f 100644
+--- a/ev.c
++++ b/ev.c
+@@ -1026,7 +1026,7 @@ ecb_inline uint64_t ecb_rotr64 (uint64_t x, unsigned int count) { return (x << (
+   #define ecb_unreachable() __builtin_unreachable ()
+ #else
+   /* this seems to work fine, but gcc always emits a warning for it :/ */
+-  ecb_inline void ecb_unreachable (void) ecb_noreturn;
++  ecb_inline ecb_noreturn void ecb_unreachable (void);
+   ecb_inline void ecb_unreachable (void) { }
+ #endif
+ 
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 668ac138be83..824b909f1d91 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, dejagnu }:
+{ fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "libffi-3.2.1";
@@ -10,15 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = if stdenv.isCygwin then [ ./3.2.1-cygwin.patch ] else null;
 
-  buildInputs = stdenv.lib.optional doCheck dejagnu;
-
   configureFlags = [
     "--with-gcc-arch=generic" # no detection of -march= or -mtune=
     "--enable-pax_emutramp"
   ];
 
-  doCheck = stdenv.isLinux; # until we solve dejagnu problems on darwin and expect on BSD
-
   dontStrip = stdenv ? cross; # Don't run the native `strip' when cross-compiling.
 
   # Install headers in the right place.
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index 44aa546fe00d..4c781da63083 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "libidn-1.30";
+  name = "libidn-1.31";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/${name}.tar.gz";
-    sha256 = "0lxh5r1z8gsk4jxx3rv8aasjv8p53j4y04kvfn2w30a0syagrf9r";
+    sha256 = "026z12mczlag443ms9n954h36pi3m7iva9jfw8y4ispsj772zpxg";
   };
 
   doCheck = ! stdenv.isDarwin;
diff --git a/pkgs/development/libraries/libnatspec/default.nix b/pkgs/development/libraries/libnatspec/default.nix
index 985745c38986..7dafe3434f9f 100644
--- a/pkgs/development/libraries/libnatspec/default.nix
+++ b/pkgs/development/libraries/libnatspec/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation (rec {
     maintainers = [ stdenv.lib.maintainers.urkud ];
   };
 } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-  NIX_CFLAGS_COMPILE = "-I${libiconv}/include";
-
-  NIX_CFLAGS_LINK = "-L${libiconv}/lib -liconv";
+  NIX_LDFLAGS = "-liconv";
+  propagatedBuildInputs = [ libiconv ];
 })
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 9589298ecd50..4c22c988c790 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   # The loaders.cache can be used by setting GDK_PIXBUF_MODULE_FILE to
   # point to this file in a wrapper.
   postConfigure = ''
-    GDK_PIXBUF=$out/lib/gdk-pixbuf
+    GDK_PIXBUF=$out/lib/gdk-pixbuf-2.0/2.10.0
     mkdir -p $GDK_PIXBUF/loaders
     sed -e "s#gdk_pixbuf_moduledir = .*#gdk_pixbuf_moduledir = $GDK_PIXBUF/loaders#" \
         -i gdk-pixbuf-loader/Makefile
@@ -43,4 +43,11 @@ stdenv.mkDerivation rec {
     sed -e "s#\$(GDK_PIXBUF_QUERYLOADERS)#GDK_PIXBUF_MODULEDIR=$GDK_PIXBUF/loaders \$(GDK_PIXBUF_QUERYLOADERS)#" \
          -i gdk-pixbuf-loader/Makefile
   '';
+
+  # Merge gdkpixbuf and librsvg loaders
+  postInstall = ''
+    mv $GDK_PIXBUF/loaders.cache $GDK_PIXBUF/loaders.cache.tmp
+    cat ${gdk_pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache.tmp > $GDK_PIXBUF/loaders.cache
+    rm $GDK_PIXBUF/loaders.cache.tmp
+  '';
 }
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index 7ed9794011cd..739148cb9a69 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,12 +1,7 @@
-{ stdenv, fetchurl, fetchsvn, pkgconfig, zlib, libjpeg, xz }:
+{ stdenv, fetchurl, pkgconfig, zlib, libjpeg, xz }:
 
 let
-  version = "4.0.3";
-  patchDir = fetchsvn {
-    url = svn://svn.archlinux.org/packages/libtiff/trunk;
-    rev = "198247";
-    sha256 = "0a47l0zkc1zz7wxg64cyjv9z1djdvfyxgmwd03znlsac4zijkcy4";
-  };
+  version = "4.0.4beta";
 in
 stdenv.mkDerivation rec {
   name = "libtiff-${version}";
@@ -19,19 +14,6 @@ stdenv.mkDerivation rec {
     sha256 = "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa";
   };
 
-  patchPhase = ''
-    for p in ${patchDir}/*-{2013-4244,2012-4447,2012-4564,2013-1960,2013-1961,libjpeg-turbo}.patch; do
-      patch -p1 < "$p"
-    done
-    (
-    cd tools
-    for p in ${patchDir}/*-CVE-{2013-4231,2013-4232}.patch; do
-      patch -p0 < "$p"
-    done
-    )
-    patch -p0 < ${patchDir}/${if stdenv.isDarwin then "tiff-4.0.3" else "*"}-tiff2pdf-colors.patch
-  ''; # ^ sh on darwin seems not to expand globs in redirects, and I don't want to rebuild all again elsewhere
-
   nativeBuildInputs = [ pkgconfig ];
 
   propagatedBuildInputs = [ zlib libjpeg xz ]; #TODO: opengl support (bogus configure detection)
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index 5fb9d5460ac7..75d6bdb4cc6a 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, udev ? null }:
+{ stdenv, fetchurl, pkgconfig, udev ? null, libobjc, IOKit }:
 
 stdenv.mkDerivation rec {
   name = "libusb-1.0.19";
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ pkgconfig ];
-  propagatedBuildInputs = stdenv.lib.optional stdenv.isLinux udev;
+  propagatedBuildInputs =
+    stdenv.lib.optional stdenv.isLinux udev ++
+    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 08a969033db8..5ef7b3e6a276 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:
+{ stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig
+
+, ApplicationServices, CoreServices }:
 
 let
   stable = "stable";
@@ -59,7 +61,8 @@ let
   mkWithAutotools = stability: version: sha256: stdenv.mkDerivation {
     name = mkName stability version;
     src = mkSrc version sha256;
-    buildInputs = [ automake autoconf libtool pkgconfig ];
+    buildInputs = [ automake autoconf libtool pkgconfig ]
+      ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
     preConfigure = ''
       LIBTOOLIZE=libtoolize ./autogen.sh
     '';
diff --git a/pkgs/development/libraries/libxcomp/default.nix b/pkgs/development/libraries/libxcomp/default.nix
index 1f1f95b3bb6b..b922778de0ed 100644
--- a/pkgs/development/libraries/libxcomp/default.nix
+++ b/pkgs/development/libraries/libxcomp/default.nix
@@ -26,11 +26,4 @@ stdenv.mkDerivation {
   '';
 
   enableParallelBuilding = true;
-
-  postInstall = ''
-    mkdir $out/lib
-    cp libXcomp.so* $out/lib
-    mkdir $out/include
-    cp NX.h $out/include
-  '';
 }
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index ae8ff907f256..c37aea46eed5 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -22,13 +22,6 @@ stdenv.mkDerivation rec {
     "DESTDIR=\${out}"
   ];
 
-  postInstall = ''
-    rm $out/lib/lib{mbedtls.so.8,polarssl.{a,so}}
-    ln -s libmbedtls.so $out/lib/libmbedtls.so.8
-    ln -s libmbedtls.so $out/lib/libpolarssl.so
-    ln -s libmbedtls.a $out/lib/libpolarssl.a
-  '';
-
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 8364cab7623c..be2544091e26 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, intltool, flex, bison, autoreconfHook, substituteAll
 , python, libxml2Python, file, expat, makedepend, pythonPackages
 , libdrm, xorg, wayland, udev, llvmPackages, libffi, libomxil-bellagio
-, libvdpau, libelf, libva, libclc
+, libvdpau, libelf, libva
 , grsecEnabled
 , enableTextureFloats ? false # Texture floats are patented, see docs/patents.txt
 , enableExtraFeatures ? false # not maintained
@@ -23,10 +23,9 @@ else
 */
 
 let
-  version = "10.5.6";
+  version = "10.6.1";
   # this is the default search path for DRI drivers
   driverLink = "/run/opengl-driver" + stdenv.lib.optionalString stdenv.isi686 "-32";
-  clang = if llvmPackages ? clang-unwrapped then llvmPackages.clang-unwrapped else llvmPackages.clang;
 in
 with { inherit (stdenv.lib) optional optionals optionalString; };
 
@@ -38,7 +37,7 @@ stdenv.mkDerivation {
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "15d5icr7q0nq1a7718fsj4s1l29aa4qdxvmkgmjadxz5pm9ph0b6";
+    sha256 = "6c80a2b647e57c85dc36e609d9aed17f878f0d8e0cf9ace86d14cf604101e1eb";
   };
 
   prePatch = "patchShebangs .";
@@ -63,7 +62,6 @@ stdenv.mkDerivation {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-clang-libdir=${clang}/lib"
     "--with-dri-driverdir=$(drivers)/lib/dri"
     "--with-dri-searchpath=${driverLink}/lib/dri"
 
@@ -81,13 +79,11 @@ stdenv.mkDerivation {
     ++ [
     "--enable-xvmc"
     "--enable-vdpau"
-    "--enable-omx"
-    "--enable-va"
+    #"--enable-omx"
+    #"--enable-va"
 
     # TODO: Figure out how to enable opencl without having a runtime dependency on clang
     "--disable-opencl"
-    #"--enable-opencl"
-    #"--enable-opencl-icd"
 
     "--with-gallium-drivers=svga,i915,ilo,r300,r600,radeonsi,nouveau,freedreno,swrast"
     "--enable-shared-glapi"
@@ -111,8 +107,7 @@ stdenv.mkDerivation {
     autoreconfHook intltool expat libxml2Python llvmPackages.llvm
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence
-    libffi wayland libvdpau libelf libXvMC libomxil-bellagio libva
-    libclc clang
+    libffi wayland libvdpau libelf libXvMC /* libomxil-bellagio libva */
   ] ++ optional stdenv.isLinux udev;
 
   enableParallelBuilding = true;
@@ -132,9 +127,6 @@ stdenv.mkDerivation {
       `#$out/lib/libXvMC*` \
       $out/lib/gbm $out/lib/libgbm* \
   '' + ''
-      $out/lib/gallium-pipe \
-      $out/lib/libdricore* \
-      $out/lib/libgallium* \
       $out/lib/vdpau \
       $out/lib/libxatracker*
 
@@ -149,18 +141,6 @@ stdenv.mkDerivation {
       $out/lib/pkgconfig/osmesa.pc
 
   '' + /* now fix references in .la files */ ''
-    sed "/^libdir=/s,$out,$drivers," -i \
-  '' + optionalString enableExtraFeatures ''
-      `#$drivers/lib/libXvMC*.la` \
-  '' + ''
-      $drivers/lib/gallium-pipe/*.la \
-      $drivers/lib/libgallium.la \
-      $drivers/lib/vdpau/*.la \
-      $drivers/lib/libdricore*.la
-
-    sed "s,$out\(/lib/\(libdricore[0-9\.]*\|libgallium\).la\),$drivers\1,g" \
-      -i $drivers/lib/*.la $drivers/lib/*/*.la
-
     sed "/^libdir=/s,$out,$osmesa," -i \
       $osmesa/lib/libOSMesa*.la
 
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 9df56212ad2c..c505d89a6d8f 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -1,31 +1,14 @@
-{ stdenv, fetchurl
+{ lib, stdenv, fetchurl
 
-# Optional Dependencies
-, gpm ? null
+, mouseSupport ? false
+, unicode ? true
+
+, gpm
 
 # Extra Options
 , abiVersion ? "5"
-, unicode ? true
 }:
 
-let
-  mkFlag = trueStr: falseStr: cond: name: val:
-    if cond == null then null else
-      "--${if cond != false then trueStr else falseStr}${name}${if val != null && cond != false then "=${val}" else ""}";
-  mkEnable = mkFlag "enable-" "disable-";
-  mkWith = mkFlag "with-" "without-";
-  mkOther = mkFlag "" "" true;
-
-  shouldUsePkg = pkg_: let
-    pkg = (builtins.tryEval pkg_).value;
-  in if stdenv.lib.any (x: x == stdenv.system) (pkg.meta.platforms or [])
-    then pkg
-    else null;
-
-  buildShared = !stdenv.isDarwin;
-
-  optGpm = shouldUsePkg gpm;
-in
 stdenv.mkDerivation rec {
   name = "ncurses-5.9";
 
@@ -34,54 +17,23 @@ stdenv.mkDerivation rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   };
 
-  patches = [ ./clang.patch ];
-
-  buildInputs = [ optGpm ];
+  # gcc-5.patch should be removed after 5.9
+  patches = [ ./clang.patch ./gcc-5.patch ];
 
   configureFlags = [
-    (mkWith   true        "abi-version" abiVersion)
-    (mkWith   true        "cxx"         null)
-    (mkWith   true        "cxx-binding" null)
-    (mkWith   false       "ada"         null)
-    (mkWith   true        "manpages"    null)
-    (mkWith   true        "progs"       null)
-    (mkWith   doCheck     "tests"       null)
-    (mkWith   true        "curses-h"    null)
-    (mkEnable true        "pc-files"    null)
-    (mkWith   buildShared "shared"      null)
-    (mkWith   true        "normal"      null)
-    (mkWith   false       "debug"       null)
-    (mkWith   false       "termlib"     null)
-    (mkWith   false       "ticlib"      null)
-    (mkWith   optGpm      "gpm"         null)
-    (mkEnable true        "overwrite"   null)
-    (mkEnable true        "database"    null)
-    (mkWith   true        "xterm-new"   null)
-    (mkEnable true        "symlinks"    null)
-    (mkEnable unicode     "widec"       null)
-    (mkEnable true        "ext-colors"  null)
-    (mkEnable true        "ext-mouse"   null)
-  ] ++ stdenv.lib.optionals stdenv.isCygwin [
-    "--enable-sp-funcs"
-    "--enable-term-driver"
-    "--enable-const"
-    "--enable-ext-colors"
-    "--enable-ext-mouse"
-    "--enable-reentrant"
-    "--enable-colorfgbg"
-    "--enable-tcap-names"
-  ];
-
-  # PKG_CONFIG_LIBDIR is where the *.pc files will be installed. If this
-  # directory doesn't exist, the configure script will disable installation of
-  # *.pc files. The configure script usually (on LSB distros) pick $(path of
-  # pkg-config)/../lib/pkgconfig. On NixOS that path doesn't exist and is not
-  # the place we want to put *.pc files from other packages anyway. So we must
-  # tell it explicitly where to install with PKG_CONFIG_LIBDIR.
+    "--with-shared"
+    "--without-debug"
+    "--enable-pc-files"
+    "--enable-symlinks"
+  ] ++ lib.optional unicode "--enable-widec";
+
+  buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;
+
   preConfigure = ''
+    configureFlagsArray+=("--includedir=$out/include")
     export PKG_CONFIG_LIBDIR="$out/lib/pkgconfig"
     mkdir -p "$PKG_CONFIG_LIBDIR"
-  '' + stdenv.lib.optionalString stdenv.isCygwin ''
+  '' + lib.optionalString stdenv.isCygwin ''
     sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure
   '';
 
@@ -94,49 +46,47 @@ stdenv.mkDerivation rec {
   # When building a wide-character (Unicode) build, create backward
   # compatibility links from the the "normal" libraries to the
   # wide-character libraries (e.g. libncurses.so to libncursesw.so).
-  postInstall = if unicode then (''
-    # Create a non-abi versioned config
-    cfg=$(basename $out/bin/ncurses*-config)
-    ln -svf $cfg $out/bin/ncursesw-config
-    ln -svf $cfg $out/bin/ncurses-config
-
-    # Allow for end users who #include <ncurses?w/*.h>
-    ln -svf . $out/include/ncursesw
-    ln -svf . $out/include/ncurses
-
-    # Create non-unicode compatability
-    libs="$(find $out/lib -name \*w.a | sed 's,.*lib\(.*\)w.a.*,\1,g')"
-    for lib in $libs; do
-      if [ -e "$out/lib/lib''${lib}w.so" ]; then
-        ln -svf lib''${lib}w.so $out/lib/lib$lib.so
-        ln -svf lib''${lib}w.so.${abiVersion} $out/lib/lib$lib.so.${abiVersion}
-      fi
-      ln -svf lib''${lib}w.a $out/lib/lib$lib.a
-      ln -svf ''${lib}w.pc $out/lib/pkgconfig/$lib.pc
-    done
+  postInstall = ''
+    # Determine what suffixes our libraries have
+    suffix="$(awk -F': ' 'f{print $3; f=0} /default library suffix/{f=1}' config.log)"
+    libs="$(ls $out/lib/pkgconfig | tr ' ' '\n' | sed "s,\(.*\)$suffix\.pc,\1,g")"
+    suffixes="$(echo "$suffix" | awk '{for (i=1; i < length($0); i++) {x=substr($0, i+1, length($0)-i); print x}}')"
 
-    # Create curses compatability
-    ln -svf libncursesw.so $out/lib/libcursesw.so
-    ln -svf libncursesw.so $out/lib/libcurses.so
-  '' + stdenv.lib.optionalString stdenv.isCygwin ''
-    for lib in $libs; do
-      if test -e $out/lib/lib''${lib}w.dll.a; then
-          ln -svf lib''${lib}w.dll.a $out/lib/lib$lib.dll.a
-      fi
-    done
-  '') else ''
-    # Create a non-abi versioned config
+    # Get the path to the config util
     cfg=$(basename $out/bin/ncurses*-config)
-    ln -svf $cfg $out/bin/ncurses-config
 
-    # Allow for end users who #include <ncurses/*.h>
-    ln -svf . $out/include/ncurses
+    # symlink the full suffixed include directory
+    ln -svf . $out/include/ncurses$suffix
+
+    for newsuffix in $suffixes ""; do
+      # Create a non-abi versioned config util links
+      ln -svf $cfg $out/bin/ncurses$newsuffix-config
+
+      # Allow for end users who #include <ncurses?w/*.h>
+      ln -svf . $out/include/ncurses$newsuffix
+
+      for lib in $libs; do
+        for dylibtype in so dll dylib; do
+          if [ -e "$out/lib/lib''${lib}$suffix.$dylibtype" ]; then
+            ln -svf lib''${lib}$suffix.$dylibtype $out/lib/lib$lib$newsuffix.$dylibtype
+            ln -svf lib''${lib}$suffix.$dylibtype.${abiVersion} $out/lib/lib$lib$newsuffix.$dylibtype.${abiVersion}
+          fi
+        done
+        for statictype in a dll.a la; do
+          if [ -e "$out/lib/lib''${lib}$suffix.$statictype" ]; then
+            ln -svf lib''${lib}$suffix.$statictype $out/lib/lib$lib$newsuffix.$statictype
+          fi
+        done
+        ln -svf ''${lib}$suffix.pc $out/lib/pkgconfig/$lib$newsuffix.pc
+      done
+    done
+  '';
 
-    # Create curses compatability
-    ln -svf libncurses.so $out/lib/libcurses.so
+  preFixup = ''
+    rm $out/lib/*.a
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "Free software emulation of curses in SVR4 and more";
 
     longDescription = ''
@@ -155,13 +105,13 @@ stdenv.mkDerivation rec {
 
     homepage = http://www.gnu.org/software/ncurses/;
 
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ wkennington ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.wkennington ];
   };
 
   passthru = {
-    ldflags = if unicode then "-lncursesw" else "-lncurses";
+    ldflags = "-lncurses";
     inherit unicode abiVersion;
   };
 }
diff --git a/pkgs/development/libraries/ncurses/gcc-5.patch b/pkgs/development/libraries/ncurses/gcc-5.patch
new file mode 100644
index 000000000000..2448229b88e1
--- /dev/null
+++ b/pkgs/development/libraries/ncurses/gcc-5.patch
@@ -0,0 +1,46 @@
+https://bugs.gentoo.org/545114
+
+extracted from the upstream change (which had many unrelated commits in one)
+
+From 97bb4678dc03e753290b39bbff30ba2825df9517 Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Sun, 7 Dec 2014 03:10:09 +0000
+Subject: [PATCH] ncurses 5.9 - patch 20141206
+
++ modify MKlib_gen.sh to work around change in development version of
+  gcc introduced here:
+	  https://gcc.gnu.org/ml/gcc-patches/2014-06/msg02185.html
+	  https://gcc.gnu.org/ml/gcc-patches/2014-07/msg00236.html
+  (reports by Marcus Shawcroft, Maohui Lei).
+
+diff --git a/ncurses/base/MKlib_gen.sh b/ncurses/base/MKlib_gen.sh
+index d8cc3c9..b91398c 100755
+--- a/ncurses/base/MKlib_gen.sh
++++ b/ncurses/base/MKlib_gen.sh
+@@ -474,11 +474,22 @@ sed -n -f $ED1 \
+ 	-e 's/gen_$//' \
+ 	-e 's/  / /g' >>$TMP
+ 
++cat >$ED1 <<EOF
++s/  / /g
++s/^ //
++s/ $//
++s/P_NCURSES_BOOL/NCURSES_BOOL/g
++EOF
++
++# A patch discussed here:
++#	https://gcc.gnu.org/ml/gcc-patches/2014-06/msg02185.html
++# introduces spurious #line markers.  Work around that by ignoring the system's
++# attempt to define "bool" and using our own symbol here.
++sed -e 's/bool/P_NCURSES_BOOL/g' $TMP > $ED2
++cat $ED2 >$TMP
++
+ $preprocessor $TMP 2>/dev/null \
+-| sed \
+-	-e 's/  / /g' \
+-	-e 's/^ //' \
+-	-e 's/_Bool/NCURSES_BOOL/g' \
++| sed -f $ED1 \
+ | $AWK -f $AW2 \
+ | sed -f $ED3 \
+ | sed \
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index bc8c599a901f..e5e4f1cfff33 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -34,12 +34,12 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}nghttp2-${version}";
-  version = "0.7.14";
+  version = "1.0.2";
 
   # Don't use fetchFromGitHub since this needs a bootstrap curl
   src = fetchurl {
     url = "http://pub.wak.io/nixos/tarballs/nghttp2-${version}.tar.bz2";
-    sha256 = "000d50yzyysbr9ldhvnbpzn35vplqm08dnmh55wc5zk273gy383f";
+    sha256 = "633dd6d5d1f29a4d802d6c9e5b9eeb0b9104f35652396f26999a27515b6c1c14";
   };
 
   # Configure script searches for a symbol which does not exist in jemalloc on Darwin
diff --git a/pkgs/development/libraries/openssl/1.0.2.x.nix b/pkgs/development/libraries/openssl/1.0.2.x.nix
index e5237515f200..28254cb390d4 100644
--- a/pkgs/development/libraries/openssl/1.0.2.x.nix
+++ b/pkgs/development/libraries/openssl/1.0.2.x.nix
@@ -1,57 +1,27 @@
 { stdenv, fetchurl, perl
 , withCryptodev ? false, cryptodevHeaders }:
 
+with stdenv.lib;
 let
-  name = "openssl-1.0.2c";
-
-  opensslCrossSystem = stdenv.lib.attrByPath [ "openssl" "system" ]
+  opensslCrossSystem = attrByPath [ "openssl" "system" ]
     (throw "openssl needs its platform name cross building" null)
     stdenv.cross;
-
-  patchesCross = isCross: let
-    isDarwin = stdenv.isDarwin || (isCross && stdenv.cross.libc == "libSystem");
-  in
-    [ # Allow the location of the X509 certificate file (the CA
-      # bundle) to be set through the environment variable
-      # ‘OPENSSL_X509_CERT_FILE’.  This is necessary because the
-      # default location ($out/ssl/cert.pem) doesn't exist, and
-      # hardcoding something like /etc/ssl/cert.pem is impure and
-      # cannot be overriden per-process.  For security, the
-      # environment variable is ignored for setuid binaries.
-      # FIXME: drop this patch; it really isn't necessary, because
-      # OpenSSL already supports a ‘SSL_CERT_FILE’ variable.
-      ./cert-file.patch
-    ]
-
-    ++ stdenv.lib.optionals (isCross && opensslCrossSystem == "hurd-x86")
-         [ ./cert-file-path-max.patch # merge with `cert-file.patch' eventually
-           ./gnu.patch                # submitted upstream
-         ]
-
-    ++ stdenv.lib.optionals (stdenv.system == "x86_64-kfreebsd-gnu")
-        [ ./gnu.patch
-          ./kfreebsd-gnu.patch
-        ];
-
-  extraPatches = stdenv.lib.optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 in
-
-stdenv.mkDerivation {
-  inherit name;
+stdenv.mkDerivation rec {
+  name = "openssl-1.0.2d";
 
   src = fetchurl {
     urls = [
       "http://www.openssl.org/source/${name}.tar.gz"
       "http://openssl.linux-mirror.org/source/${name}.tar.gz"
     ];
-    sha256 = "10vasdg52qiyqvgbp14n9z7ghglmhzvag9qpiz2nfqssycvvlf00";
+    sha1 = "d01d17b44663e8ffa6a33a5a30053779d9593c3d";
   };
 
-  patches = (patchesCross false) ++ extraPatches;
-
-  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+  patches = optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
   # On x86_64-darwin, "./config" misdetects the system as
   # "darwin-i386-cc".  So specify the system type explicitly.
@@ -60,46 +30,48 @@ stdenv.mkDerivation {
     else if stdenv.system == "x86_64-solaris" then "./Configure solaris64-x86_64-gcc"
     else "./config";
 
-  configureFlags = "shared --libdir=lib --openssldir=etc/ssl" +
-    stdenv.lib.optionalString withCryptodev " -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS";
-
-  # CYGXXX: used to be set for cygwin with optionalString. Not needed
-  # anymore but kept to prevent rebuild.
-  preBuild = "";
+  configureFlags = [
+    "shared"
+    "--libdir=lib"
+    "--openssldir=etc/ssl"
+  ] ++ stdenv.lib.optionals withCryptodev [
+    "-DHAVE_CRYPTODEV"
+    "-DUSE_CRYPTODEV_DIGESTS"
+  ];
 
-  makeFlags = "MANDIR=$(out)/share/man";
+  makeFlags = [
+    "MANDIR=$(out)/share/man"
+  ];
 
   # Parallel building is broken in OpenSSL.
   enableParallelBuilding = false;
 
-  postInstall =
-    ''
-      # If we're building dynamic libraries, then don't install static
-      # libraries.
-      if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib)" ]; then
-          rm $out/lib/*.a
-      fi
-    ''; # */
+  postInstall = ''
+    # If we're building dynamic libraries, then don't install static
+    # libraries.
+    if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
+        rm "$out/lib/"*.a
+    fi
+
+    # remove dependency on Perl at runtime
+    rm -r $out/etc/ssl/misc $out/bin/c_rehash
+  '';
+
+  postFixup = ''
+    # Check to make sure we don't depend on perl
+    if grep -r '${perl}' $out; then
+      echo "Found an erroneous dependency on perl ^^^" >&2
+      exit 1
+    fi
+  '';
 
   crossAttrs = {
-    patches = patchesCross true;
-
     preConfigure=''
       # It's configure does not like --build or --host
-      export configureFlags="--libdir=lib --cross-compile-prefix=${stdenv.cross.config}- shared ${opensslCrossSystem}"
+      export configureFlags="${concatStringsSep " " (configureFlags ++ [ opensslCrossSystem ])}"
     '';
 
-    postInstall = ''
-      # Openssl installs readonly files, which otherwise we can't strip.
-      # This could at some stdenv hash change be put out of crossAttrs, too
-      chmod -R +w $out
-
-      # Remove references to perl, to avoid depending on it at runtime
-      rm $out/bin/c_rehash $out/ssl/misc/CA.pl $out/ssl/misc/tsget
-    '';
     configureScript = "./Configure";
-  } // stdenv.lib.optionalAttrs (opensslCrossSystem == "darwin64-x86_64-cc") {
-    CC = "gcc";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/openssl/cert-file-path-max.patch b/pkgs/development/libraries/openssl/cert-file-path-max.patch
deleted file mode 100644
index 50621c5cb820..000000000000
--- a/pkgs/development/libraries/openssl/cert-file-path-max.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-This patch, to be applied after `cert-file.patch', fixes compilation
-on GNU/Hurd where `PATH_MAX' is not defined.
-
-diff -ubB --show-c-function openssl-1.0.0e/crypto/x509/x509_def.c.orig openssl-1.0.0e/crypto/x509/x509_def.c
---- openssl-1.0.0e/crypto/x509/x509_def.c.orig	2012-01-06 00:08:48.000000000 +0100
-+++ openssl-1.0.0e/crypto/x509/x509_def.c	2012-01-06 00:11:29.000000000 +0100
-@@ -58,6 +58,7 @@
- 
- #include <stdio.h>
- #include <stdlib.h>
-+#include <string.h>
- #include <limits.h>
- #include <unistd.h>
- #include <sys/types.h>
-@@ -76,14 +77,16 @@ const char *X509_get_default_cert_dir(vo
- 
- const char *X509_get_default_cert_file(void)
- 	{
--	static char buf[PATH_MAX] = X509_CERT_FILE;
-+	static char *buf;
- 	static int init = 0;
- 	if (!init) {
- 	    init = 1;
- 	    char * s = getenv("OPENSSL_X509_CERT_FILE");
- 	    if (s && getuid() == geteuid()) {
--		strncpy(buf, s, sizeof(buf));
--		buf[sizeof(buf) - 1] = 0;
-+	         buf = strdup(s);
-+	    }
-+	    if (!s) {
-+	         buf = strdup(X509_CERT_FILE);
- 	    }
- 	}
- 	return buf;
diff --git a/pkgs/development/libraries/openssl/cert-file.patch b/pkgs/development/libraries/openssl/cert-file.patch
deleted file mode 100644
index e6e661112015..000000000000
--- a/pkgs/development/libraries/openssl/cert-file.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-diff -ru openssl-1.0.1m-orig/crypto/x509/x509_def.c openssl-1.0.1m/crypto/x509/x509_def.c
---- openssl-1.0.1m-orig/crypto/x509/x509_def.c	2015-03-19 14:19:00.000000000 +0100
-+++ openssl-1.0.1m/crypto/x509/x509_def.c	2015-03-19 15:50:44.676683616 +0100
-@@ -57,6 +57,10 @@
-  */
- 
- #include <stdio.h>
-+#include <stdlib.h>
-+#include <limits.h>
-+#include <unistd.h>
-+#include <sys/types.h>
- #include "cryptlib.h"
- #include <openssl/crypto.h>
- #include <openssl/x509.h>
-@@ -78,7 +82,23 @@
- 
- const char *X509_get_default_cert_file(void)
- {
--    return (X509_CERT_FILE);
-+    static char buf[PATH_MAX] = X509_CERT_FILE;
-+    static int init = 0;
-+    if (!init) {
-+        init = 1;
-+        char * s = getenv("OPENSSL_X509_CERT_FILE");
-+        if (s) {
-+#ifndef OPENSSL_SYS_WINDOWS
-+            if (getuid() == geteuid()) {
-+#endif
-+                strncpy(buf, s, sizeof(buf));
-+                buf[sizeof(buf) - 1] = 0;
-+#ifndef OPENSSL_SYS_WINDOWS
-+            }
-+#endif
-+        }
-+    }
-+    return buf;
- }
- 
- const char *X509_get_default_cert_dir_env(void)
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 7f428fd584b9..b9224dad110a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -1,59 +1,28 @@
 { stdenv, fetchurl, perl
 , withCryptodev ? false, cryptodevHeaders }:
 
+with stdenv.lib;
 let
-  name = "openssl-1.0.1m";
-
-  opensslCrossSystem = stdenv.lib.attrByPath [ "openssl" "system" ]
+  opensslCrossSystem = attrByPath [ "openssl" "system" ]
     (throw "openssl needs its platform name cross building" null)
     stdenv.cross;
-
-  patchesCross = isCross: let
-    isDarwin = stdenv.isDarwin || (isCross && stdenv.cross.libc == "libSystem");
-  in
-    [ # Allow the location of the X509 certificate file (the CA
-      # bundle) to be set through the environment variable
-      # ‘OPENSSL_X509_CERT_FILE’.  This is necessary because the
-      # default location ($out/ssl/cert.pem) doesn't exist, and
-      # hardcoding something like /etc/ssl/cert.pem is impure and
-      # cannot be overriden per-process.  For security, the
-      # environment variable is ignored for setuid binaries.
-      # FIXME: drop this patch; it really isn't necessary, because
-      # OpenSSL already supports a ‘SSL_CERT_FILE’ variable.
-      ./cert-file.patch
-    ]
-
-    ++ stdenv.lib.optionals (isCross && opensslCrossSystem == "hurd-x86")
-         [ ./cert-file-path-max.patch # merge with `cert-file.patch' eventually
-           ./gnu.patch                # submitted upstream
-         ]
-
-    ++ stdenv.lib.optionals (stdenv.system == "x86_64-kfreebsd-gnu")
-        [ ./gnu.patch
-          ./kfreebsd-gnu.patch
-        ]
-
-    ++ stdenv.lib.optional isDarwin ./darwin-arch.patch;
-
-  extraPatches = stdenv.lib.optional stdenv.isCygwin ./1.0.1-cygwin64.patch;
 in
-
-stdenv.mkDerivation {
-  inherit name;
+stdenv.mkDerivation rec {
+  name = "openssl-1.0.1p";
 
   src = fetchurl {
     urls = [
       "http://www.openssl.org/source/${name}.tar.gz"
       "http://openssl.linux-mirror.org/source/${name}.tar.gz"
     ];
-    sha256 = "0x7gvyybmqm4lv62mlhlm80f1rn7il2qh8224rahqv0i15xhnpq9";
+    sha1 = "9d1977cc89242cd11471269ece2ed4650947c046";
   };
 
-  patches = (patchesCross false) ++ extraPatches;
-
-  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
+  patches = optional stdenv.isCygwin ./1.0.1-cygwin64.patch
+    ++ optional (stdenv.isDarwin || (stdenv ? cross && stdenv.cross.libc == "libSystem")) ./darwin-arch.patch;
 
   nativeBuildInputs = [ perl ];
+  buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
   # On x86_64-darwin, "./config" misdetects the system as
   # "darwin-i386-cc".  So specify the system type explicitly.
@@ -62,46 +31,48 @@ stdenv.mkDerivation {
     else if stdenv.system == "x86_64-solaris" then "./Configure solaris64-x86_64-gcc"
     else "./config";
 
-  configureFlags = "shared --libdir=lib --openssldir=etc/ssl" +
-    stdenv.lib.optionalString withCryptodev " -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS";
-
-  # CYGXXX: used to be set for cygwin with optionalString. Not needed
-  # anymore but kept to prevent rebuild.
-  preBuild = "";
+  configureFlags = [
+    "shared"
+    "--libdir=lib"
+    "--openssldir=etc/ssl"
+  ] ++ stdenv.lib.optionals withCryptodev [
+    "-DHAVE_CRYPTODEV"
+    "-DUSE_CRYPTODEV_DIGESTS"
+  ];
 
-  makeFlags = "MANDIR=$(out)/share/man";
+  makeFlags = [
+    "MANDIR=$(out)/share/man"
+  ];
 
   # Parallel building is broken in OpenSSL.
   enableParallelBuilding = false;
 
-  postInstall =
-    ''
-      # If we're building dynamic libraries, then don't install static
-      # libraries.
-      if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib)" ]; then
-          rm $out/lib/*.a
-      fi
-    ''; # */
+  postInstall = ''
+    # If we're building dynamic libraries, then don't install static
+    # libraries.
+    if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
+        rm "$out/lib/"*.a
+    fi
+
+    # remove dependency on Perl at runtime
+    rm -r $out/etc/ssl/misc $out/bin/c_rehash
+  '';
+
+  postFixup = ''
+    # Check to make sure we don't depend on perl
+    if grep -r '${perl}' $out; then
+      echo "Found an erroneous dependency on perl ^^^" >&2
+      exit 1
+    fi
+  '';
 
   crossAttrs = {
-    patches = patchesCross true;
-
     preConfigure=''
       # It's configure does not like --build or --host
-      export configureFlags="--libdir=lib --cross-compile-prefix=${stdenv.cross.config}- shared ${opensslCrossSystem}"
+      export configureFlags="${concatStringsSep " " (configureFlags ++ [ opensslCrossSystem ])}"
     '';
 
-    postInstall = ''
-      # Openssl installs readonly files, which otherwise we can't strip.
-      # This could at some stdenv hash change be put out of crossAttrs, too
-      chmod -R +w $out
-
-      # Remove references to perl, to avoid depending on it at runtime
-      rm $out/bin/c_rehash $out/ssl/misc/CA.pl $out/ssl/misc/tsget
-    '';
     configureScript = "./Configure";
-  } // stdenv.lib.optionalAttrs (opensslCrossSystem == "darwin64-x86_64-cc") {
-    CC = "gcc";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/openssl/gnu.patch b/pkgs/development/libraries/openssl/gnu.patch
deleted file mode 100644
index 3cc6d049c944..000000000000
--- a/pkgs/development/libraries/openssl/gnu.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-Patch to fix compilation on GNU/Hurd and GNU/kFreeBSD.
-
---- openssl-1.0.0e/Configure	2012-01-06 00:39:49.000000000 +0100
-+++ openssl-1.0.0e/Configure	2012-01-06 00:39:51.000000000 +0100
-@@ -563,7 +563,7 @@ my %table=(
- "newsos4-gcc","gcc:-O -DB_ENDIAN::(unknown):NEWS4:-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::",
- 
- ##### GNU Hurd
--"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
-+"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- 
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
-
---- openssl-1.0.0e/crypto/dso/dso_dlfcn.c	2012-01-06 00:05:47.000000000 +0100
-+++ openssl-1.0.0e/crypto/dso/dso_dlfcn.c	2012-01-06 00:21:05.000000000 +0100
-@@ -60,7 +60,7 @@
-    that handle _GNU_SOURCE and other similar macros.  Defining it later
-    is simply too late, because those headers are protected from re-
-    inclusion.  */
--#ifdef __linux
-+#if defined __linux || defined __GNU__ || defined __GLIBC__
- # ifndef _GNU_SOURCE
- #  define _GNU_SOURCE	/* make sure dladdr is declared */
- # endif
diff --git a/pkgs/development/libraries/openssl/hurd-target.patch b/pkgs/development/libraries/openssl/hurd-target.patch
deleted file mode 100644
index 399a37a69ed9..000000000000
--- a/pkgs/development/libraries/openssl/hurd-target.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur openssl-1.0.0d-orig/Configure openssl-1.0.0d/Configure
---- openssl-1.0.0d-orig/Configure	2010-11-30 17:19:26.000000000 -0500
-+++ openssl-1.0.0d/Configure	2011-11-16 13:52:57.614416683 -0500
-@@ -563,7 +563,7 @@
- "newsos4-gcc","gcc:-O -DB_ENDIAN::(unknown):NEWS4:-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::",
- 
- ##### GNU Hurd
--"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
-+"hurd-x86","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -mtune=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- 
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
diff --git a/pkgs/development/libraries/openssl/kfreebsd-gnu.patch b/pkgs/development/libraries/openssl/kfreebsd-gnu.patch
deleted file mode 100644
index 66cedf746ba5..000000000000
--- a/pkgs/development/libraries/openssl/kfreebsd-gnu.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Allow compilation on GNU/kFreeBSD.  Ideally, there'd be a single way to process
-all glibc-based system, but the build system is soooo broken.
-
---- openssl-1.0.0i/config
-+++ openssl-1.0.0i/config
-@@ -170,6 +170,10 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
- 	echo "${MACHINE}-whatever-linux1"; exit 0
- 	;;
- 
-+    GNU/kFreeBSD*)
-+    	echo "kfreebsd-gnu"; exit 0;
-+    	;;
-+
-     GNU*)
- 	echo "hurd-x86"; exit 0;
- 	;;
-@@ -810,6 +814,7 @@ case "$GUESSOS" in
-   beos-*) OUT="$GUESSOS" ;;
-   x86pc-*-qnx6) OUT="QNX6-i386" ;;
-   *-*-qnx6) OUT="QNX6" ;;
-+  kfreebsd-gnu) OUT="kfreebsd-gnu";;
-   *) OUT=`echo $GUESSOS | awk -F- '{print $3}'`;;
- esac
- 
-
---- openssl-1.0.0i/Configure
-+++ openssl-1.0.0i/Configure
-@@ -565,6 +565,9 @@ my %table=(
- ##### GNU Hurd
- "hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
- 
-+##### GNU/kFreeBSD on x86_64, copied from "linux-x86_64"
-+"kfreebsd-gnu",	"gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+
- ##### OS/2 EMX
- "OS2-EMX", "gcc::::::::",
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index d50c0c5d69c5..74d7706ec59f 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   postInstall = glib.flattenInclude;
 
-  patches = stdenv.lib.optional stdenv.cc.isClang ./fix-clang36.patch;
+  patches = stdenv.lib.optional stdenv.isDarwin ./fix-clang36.patch;
 
   meta = {
     homepage = http://pixman.org;
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 7fe16cec56b9..cdeaa0cb1d96 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -15,11 +15,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "polkit-0.112";
+  name = "polkit-0.113";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/polkit/releases/${name}.tar.gz";
-    sha256 = "1xkary7yirdcjdva950nqyhmsz48qhrdsr78zciahj27p8yg95fn";
+    sha256 = "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71";
   };
 
   buildInputs =
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs .
   '' + stdenv.lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd-login autoconfigured, but system does not appear to use systemd/s/.*/:/' -i configure
+    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
   ''
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index a65cbeed3fd3..e4d1bae636cf 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -17,7 +17,7 @@ with stdenv.lib;
 
 let
   v_maj = "4.8";
-  v_min = "6";
+  v_min = "7";
   vers = "${v_maj}.${v_min}";
 in
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "http://download.qt-project.org/official_releases/qt/"
       + "${v_maj}/${vers}/qt-everywhere-opensource-src-${vers}.tar.gz";
-    sha256 = "0b036iqgmbbv37dgwwfihw3mihjbnw3kb5kaisdy0qi8nn8xs54b";
+    sha256 = "183fca7n7439nlhxyg1z7aky0izgbyll3iwakw4gwivy16aj5272";
   };
 
   # The version property must be kept because it will be included into the QtSDK package name
@@ -126,8 +126,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ perl pkgconfig which ];
 
-  # occasional build problems if one has too many cores (like on Hydra)
-  # @vcunat has been unable to find a *reliable* fix
   enableParallelBuilding = false;
 
   NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin
diff --git a/pkgs/development/libraries/qt-5/5.4/setup-hook.sh b/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
index 82d4ed5af921..940b9d4e7a1f 100644
--- a/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/5.4/setup-hook.sh
@@ -20,9 +20,11 @@ addQtModule() {
             fi
         fi
 
-        if [[ -n $qtSubmodule ]] && [[ -d "$1/lib" ]]; then
+        if [[ -d "$1/lib" ]]; then
             @lndir@/bin/lndir -silent "$1/lib" "$qtOut/lib"
-            find "$1/lib" -printf 'lib/%P\n' >> "$qtOut/nix-support/qt-inputs"
+            if [[ -n $qtSubmodule ]]; then
+                find "$1/lib" -printf 'lib/%P\n' >> "$qtOut/nix-support/qt-inputs"
+            fi
         fi
     fi
 }
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 7759aa799815..004e5e57de44 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
   # Environment vars used for building certain configurations
   PORTABLE = "1";
   USE_SSE = "1";
+  CMAKE_CXX_FLAGS = "-std=gnu++11";
   JEMALLOC_LIB = stdenv.lib.optionalString (malloc == jemalloc) "-ljemalloc";
 
   buildFlags = [
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 16d2298279b4..9736d6514047 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -8,18 +8,18 @@ assert expat != null;
 
 stdenv.mkDerivation rec {
   name = "wayland-${version}";
-  version = "1.7.0";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "http://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "173w0pqzk2m7hjlg15bymrx7ynxgq1ciadg03hzybxwnvfi4gsmx";
+    sha256 = "1j3gfzn8i0xhk3j34mwb2srrscjxfyi279jhyq80mz943j6r6z7i";
   };
 
-  configureFlags = "--with-scanner";
+  configureFlags = "--with-scanner --disable-documentation";
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ libffi docbook_xsl doxygen graphviz libxslt xmlto expat ];
+  buildInputs = [ libffi /* docbook_xsl doxygen graphviz libxslt xmlto */ expat ];
 
   meta = {
     description = "Reference implementation of the wayland protocol";
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 419a2584ca84..93474d14344e 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -13,6 +13,13 @@ stdenv.mkDerivation (rec {
     sha256 = "039agw5rqvqny92cpkrfn243x2gd4xn13hs3xi6isk55d2vqqr9n";
   };
 
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure \
+      --replace '/usr/bin/libtool' 'ar' \
+      --replace 'AR="libtool"' 'AR="ar"' \
+      --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
+  '';
+
   configureFlags = if static then "" else "--shared";
 
   preConfigure = ''
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index fbdcec06d0dd..985e7946b6b4 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
 
 buildPerlPackage rec {
-  name = "DBD-SQLite-1.44";
+  name = "DBD-SQLite-1.48";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/${name}.tar.gz";
-    sha256 = "10r7wv5x4vzn9zbk3c7mhbx6kz76xxd9p357592c0wamj458qlml";
+    sha256 = "19hf0fc4dlnpmxsxx3jjbh2z6d2jafgdlqhwz4irkp2cbl7j75xk";
   };
 
   propagatedBuildInputs = [ DBI ];
diff --git a/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch b/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
index c0fa85ecce87..4a4b49a829d2 100644
--- a/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
+++ b/pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
@@ -1,4 +1,4 @@
-Use $OPENSSL_X509_CERT_FILE to get the CA certificates.
+Use $SSL_CERT_FILE to get the CA certificates.
 
 diff -ru -x '*~' LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm LWP-Protocol-https-6.02/lib/LWP/Protocol/https.pm
 --- LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm	2011-03-27 13:54:01.000000000 +0200
@@ -7,8 +7,8 @@ diff -ru -x '*~' LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm LWP-Prot
      }
      if ($ssl_opts{SSL_verify_mode}) {
  	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
-+            if (defined $ENV{'OPENSSL_X509_CERT_FILE'}) {
-+                $ssl_opts{SSL_ca_file} = $ENV{'OPENSSL_X509_CERT_FILE'};
++            if (defined $ENV{'SSL_CERT_FILE'}) {
++                $ssl_opts{SSL_ca_file} = $ENV{'SSL_CERT_FILE'};
 +            }
 +        }
 +	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
diff --git a/pkgs/development/pure-modules/stldict/default.nix b/pkgs/development/pure-modules/stldict/default.nix
index abfc0d0fdefc..4ade515faa88 100644
--- a/pkgs/development/pure-modules/stldict/default.nix
+++ b/pkgs/development/pure-modules/stldict/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "5b894ae6dc574c7022258e2732bea649c82c959ec4d0be13fb5a3e8ba8488f28";
   };
 
+  postPatch = ''
+    for f in hashdict.cc orddict.cc; do
+      sed -i '1i\#include <stddef.h>' $f
+    done
+  '';
+
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
   makeFlags = "libdir=$(out)/lib prefix=$(out)/";
diff --git a/pkgs/development/pure-modules/stllib/default.nix b/pkgs/development/pure-modules/stllib/default.nix
index 3be7bccf2a42..02c96d975ec4 100644
--- a/pkgs/development/pure-modules/stllib/default.nix
+++ b/pkgs/development/pure-modules/stllib/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
     sha256 = "1d550764fc2f8ba6ddbd1fbd3da2d6965b69e2c992747265d9ebe4f16aa5e455";
   };
 
+  postPatch = ''
+    for f in pure-stlmap/{stlmap.cpp,stlmmap.cpp,stlhmap.cpp}; do
+      sed -i '1i\#include <cstddef>' $f
+    done
+  '';
+
   buildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ pure ];
   makeFlags = "libdir=$(out)/lib prefix=$(out)/";
diff --git a/pkgs/development/python-modules/gyp/no-darwin-cflags.patch b/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
index 353cc133b537..798d0f0b16d0 100644
--- a/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
+++ b/pkgs/development/python-modules/gyp/no-darwin-cflags.patch
@@ -22,19 +22,6 @@ Index: gyp/pylib/gyp/xcode_emulation.py
      self._Appendf(cflags, 'GCC_OPTIMIZATION_LEVEL', '-O%s', default='s')
  
      if self._Test('GCC_GENERATE_DEBUGGING_SYMBOLS', 'YES', default='YES'):
-@@ -519,12 +513,6 @@
-     if self._Test('GCC_SYMBOLS_PRIVATE_EXTERN', 'YES', default='NO'):
-       cflags.append('-fvisibility=hidden')
- 
--    if self._Test('GCC_TREAT_WARNINGS_AS_ERRORS', 'YES', default='NO'):
--      cflags.append('-Werror')
--
--    if self._Test('GCC_WARN_ABOUT_MISSING_NEWLINE', 'YES', default='NO'):
--      cflags.append('-Wnewline-eof')
--
-     # In Xcode, this is only activated when GCC_COMPILER_VERSION is clang or
-     # llvm-gcc. It also requires a fairly recent libtool, and
-     # if the system clang isn't used, DYLD_LIBRARY_PATH needs to contain the
 @@ -553,7 +541,6 @@
        # TODO: Supporting fat binaries will be annoying.
        self._WarnUnimplemented('ARCHS')
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 477d6f4b3a19..f6030bb9526e 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     ''
       dst=$out/lib/${python.libPrefix}/site-packages
       mkdir -p $dst
-      PYTHONPATH="$dst:$PYTHONPATH"
+      export PYTHONPATH="$dst:$PYTHONPATH"
       ${python}/bin/${python.executable} setup.py install --prefix=$out --install-lib=$out/lib/${python.libPrefix}/site-packages
       wrapPythonPrograms
     '';
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 8cdf231729f4..112950b690d6 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, bzip2, curl, expat, jsoncpp, libarchive, xz, zlib
+, bzip2, curl, expat, libarchive, xz, zlib
 , useNcurses ? false, ncurses, useQt4 ? false, qt4
 , wantPS ? false, ps ? null
 }:
@@ -40,7 +40,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ bzip2 curl expat libarchive xz zlib ]
-    ++ optional (jsoncpp != null && !stdenv.isCygwin) jsoncpp
     ++ optional useNcurses ncurses
     ++ optional useQt4 qt4;
 
@@ -49,12 +48,11 @@ stdenv.mkDerivation rec {
   CMAKE_PREFIX_PATH = stdenv.lib.concatStringsSep ":" buildInputs;
 
   configureFlags =
-    [
-      "--docdir=/share/doc/${name}"
+    [ "--docdir=/share/doc/${name}"
       "--mandir=/share/man"
+      "--no-system-jsoncpp"
     ]
     ++ optional (!stdenv.isCygwin) "--system-libs"
-    ++ optional (jsoncpp == null || stdenv.isCygwin) "--no-system-jsoncpp"
     ++ optional useQt4 "--qt-gui"
     ++ ["--"]
     ++ optional (!useNcurses) "-DBUILD_CursesDialog=OFF";
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix b/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
index 600f6f5759d9..9ac201070182 100644
--- a/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/4.1/default.nix
@@ -17,6 +17,9 @@ stdenv.mkDerivation {
     # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
     # included Makefiles, don't look in /usr/include and friends.
     ./impure-dirs.patch
+
+    # Don't segfault if we can't get a tty name.
+    ./no-tty-name.patch
   ];
 
   meta = {
diff --git a/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch b/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
new file mode 100644
index 000000000000..a84d7ab49d04
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnumake/4.1/no-tty-name.patch
@@ -0,0 +1,53 @@
+From 292da6f6867b75a5af7ddbb639a1feae022f438f Mon Sep 17 00:00:00 2001
+From: Paul Smith <psmith@gnu.org>
+Date: Mon, 20 Oct 2014 05:54:56 +0000
+Subject: * main.c (main): [SV 43434] Handle NULL returns from ttyname().
+
+---
+diff --git main.c main.c
+index b2d169c..0cdb8a8 100644
+--- main.c
++++ main.c
+@@ -1429,13 +1429,18 @@ main (int argc, char **argv, char **envp)
+ #ifdef HAVE_ISATTY
+     if (isatty (fileno (stdout)))
+       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMOUT")))
+-        define_variable_cname ("MAKE_TERMOUT", TTYNAME (fileno (stdout)),
+-                               o_default, 0)->export = v_export;
+-
++        {
++          const char *tty = TTYNAME (fileno (stdout));
++          define_variable_cname ("MAKE_TERMOUT", tty ? tty : DEFAULT_TTYNAME,
++                                 o_default, 0)->export = v_export;
++        }
+     if (isatty (fileno (stderr)))
+       if (! lookup_variable (STRING_SIZE_TUPLE ("MAKE_TERMERR")))
+-        define_variable_cname ("MAKE_TERMERR", TTYNAME (fileno (stderr)),
+-                               o_default, 0)->export = v_export;
++        {
++          const char *tty = TTYNAME (fileno (stderr));
++          define_variable_cname ("MAKE_TERMERR", tty ? tty : DEFAULT_TTYNAME,
++                                 o_default, 0)->export = v_export;
++        }
+ #endif
+ 
+   /* Reset in case the switches changed our minds.  */
+diff --git makeint.h makeint.h
+index 6223936..2009f41 100644
+--- makeint.h
++++ makeint.h
+@@ -436,10 +436,11 @@ extern struct rlimit stack_limit;
+ /* The number of bytes needed to represent the largest integer as a string.  */
+ #define INTSTR_LENGTH         CSTRLEN ("18446744073709551616")
+ 
++#define DEFAULT_TTYNAME "true"
+ #ifdef HAVE_TTYNAME
+ # define TTYNAME(_f) ttyname (_f)
+ #else
+-# define TTYNAME(_f) "true"
++# define TTYNAME(_f) DEFAULT_TTYNAME
+ #endif
+ 
+ 
+--
+cgit v0.9.0.2
diff --git a/pkgs/development/tools/build-managers/gnustep/make/default.nix b/pkgs/development/tools/build-managers/gnustep/make/default.nix
new file mode 100644
index 000000000000..7fa9aad72dbe
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnustep/make/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "make-${version}";
+  version = "1.0";
+
+  src = fetchurl {
+    url = "http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-make-2.6.6.tar.gz";
+    sha256 = "07cqr8x17bia9w6clbmiv7ay6r9nplrjz2cyzinv4w7zfpc19vxw";
+  };
+
+  patchPhase = ''
+    substituteInPlace GNUmakefile.in \
+      --replace which type \
+      --replace 'tooldir = $(DESTDIR)' 'tooldir = ' \
+      --replace 'makedir = $(DESTDIR)' 'makedir = ' \
+      --replace 'mandir  = $(DESTDIR)' 'mandir  = '
+
+    substituteInPlace FilesystemLayouts/apple \
+      --replace /usr/local ""
+  '';
+
+  installFlags = "DESTDIR=$(out)";
+
+  postInstall = ''
+    mkdir -p $out/nix-support
+    cat >$out/nix-support/setup-hook <<EOF
+      . $out/Library/GNUstep/Makefiles/GNUstep.sh
+    EOF
+  '';
+}
diff --git a/pkgs/development/tools/build-managers/gnustep/xcode/default.nix b/pkgs/development/tools/build-managers/gnustep/xcode/default.nix
new file mode 100644
index 000000000000..4f31c6df6d88
--- /dev/null
+++ b/pkgs/development/tools/build-managers/gnustep/xcode/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchgit, gnustep-make, Foundation, libobjc }:
+
+stdenv.mkDerivation rec {
+  name = "xcode-${version}";
+  version = "1.0";
+
+  makeFlags = "messages=yes";
+
+  installFlags = "DESTDIR=$(out)";
+
+  __impureHostDeps = [
+    "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+    "/usr/lib/libextension.dylib"
+  ];
+
+  buildInputs = [ gnustep-make Foundation libobjc ];
+
+  src = fetchgit {
+    url = "https://github.com/gnustep/xcode";
+    rev = "cc5016794e44f9998674120a5e4625aa09ca455a";
+    sha256 = "85420f3f61091b2e4548cf5e99d886cb9c72cf07b8b9fae3eebc87e7b6b7e54a";
+  };
+}
diff --git a/pkgs/development/tools/chefdk/default.nix b/pkgs/development/tools/chefdk/default.nix
index ee49423a8b17..043ee8adf421 100644
--- a/pkgs/development/tools/chefdk/default.nix
+++ b/pkgs/development/tools/chefdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, bundlerEnv, ruby, perl }:
+{ stdenv, lib, bundlerEnv, ruby, perl, autoconf }:
 
 bundlerEnv {
   name = "chefdk-0.4.0";
@@ -8,7 +8,7 @@ bundlerEnv {
   lockfile = ./Gemfile.lock;
   gemset = ./gemset.nix;
 
-  buildInputs = [ perl ];
+  buildInputs = [ perl autoconf ];
 
   meta = with lib; {
     description = "A streamlined development and deployment workflow for Chef platform";
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index f740c60c4877..61824eb607be 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -2,8 +2,6 @@
 , cross ? null, gold ? true, bison ? null
 }:
 
-assert !stdenv.isDarwin;
-
 let basename = "binutils-2.23.1"; in
 
 with { inherit (stdenv.lib) optional optionals optionalString; };
@@ -56,10 +54,12 @@ stdenv.mkDerivation rec {
 
   # As binutils takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = "-static-libgcc";
+  NIX_CFLAGS_COMPILE = if stdenv.isDarwin
+    then "-Wno-string-plus-int -Wno-deprecated-declarations"
+    else "-static-libgcc";
 
   configureFlags =
-    [ "--enable-shared" "--enable-deterministic-archives" ]
+    [ "--enable-shared" "--enable-deterministic-archives" "--disable-werror" ]
     ++ optional (stdenv.system == "mips64el-linux") "--enable-fix-loongson2f-nop"
     ++ optional (cross != null) "--target=${cross.config}"
     ++ optionals gold [ "--enable-gold" "--enable-plugins" ]
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 79dbb533d034..2f811d9ae82f 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, gettext, LocaleGettext, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.46.6";
+  name = "help2man-1.47.1";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "1brccgnjf09f2zg70s6gv6gn68mi59kp3zf50wvxp79n72ngapv1";
+    sha256 = "01ib718afwc28bmh1n0p5h7245vs3rrfm7bj1sq4avmh1kv2d6y5";
   };
 
   buildInputs = [ makeWrapper perl gettext LocaleGettext ];
diff --git a/pkgs/development/tools/misc/pkgconfig/default.nix b/pkgs/development/tools/misc/pkgconfig/default.nix
index f01b52cbba71..f1471d51e1fa 100644
--- a/pkgs/development/tools/misc/pkgconfig/default.nix
+++ b/pkgs/development/tools/misc/pkgconfig/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (rec {
     sha256 = "0igqq5m204w71m11y0nipbdf5apx87hwfll6axs12hn4dqfb6vkb";
   };
 
-  buildInputs = stdenv.lib.optional stdenv.isCygwin libiconv;
+  buildInputs = stdenv.lib.optional (stdenv.isCygwin || stdenv.isDarwin) libiconv;
 
   configureFlags = [ "--with-internal-glib" ];
 
diff --git a/pkgs/development/tools/profiling/oprofile/default.nix b/pkgs/development/tools/profiling/oprofile/default.nix
index 6c7b2a4d9ae1..561fea6ef7b0 100644
--- a/pkgs/development/tools/profiling/oprofile/default.nix
+++ b/pkgs/development/tools/profiling/oprofile/default.nix
@@ -1,26 +1,18 @@
-{ stdenv, fetchurl, binutils, popt, makeWrapper, gawk, which, gnugrep, zlib
-, pkgconfig
+{ stdenv, fetchurl, binutils, popt, zlib, pkgconfig
 , withGUI ? false , qt4 ? null}:
 
 # libX11 is needed because the Qt build stuff automatically adds `-lX11'.
 assert withGUI -> qt4 != null;
 
 stdenv.mkDerivation rec {
-  name = "oprofile-0.9.9";
+  name = "oprofile-1.0.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/oprofile/${name}.tar.gz";
-    sha256 = "15vm24jhw4xfd55pfw1rlpzfsh4bl1vyjsajs78bi9xbv8038lhy";
+    sha256 = "0nn4wfvwy4nii25y6lwlrnzx9ah4nz0r93yk7hswiy6wxjs10wc4";
   };
 
-  patchPhase = ''
-    sed -i "utils/opcontrol" \
-        -e "s|OPCONTROL=.*$|OPCONTROL=\"$out/bin/opcontrol\"|g ;
-            s|OPDIR=.*$|OPDIR=\"$out/bin\"|g ;
-            s|^PATH=.*$||g"
-  '';
-
-  buildInputs = [ binutils zlib popt makeWrapper gawk which gnugrep pkgconfig ]
+  buildInputs = [ binutils zlib popt pkgconfig ]
     ++ stdenv.lib.optionals withGUI [ qt4 ];
 
   configureFlags = [
@@ -28,11 +20,6 @@ stdenv.mkDerivation rec {
     ]
     ++ stdenv.lib.optional withGUI "--with-qt-dir=${qt4} --enable-gui=qt4";
 
-  postInstall = ''
-    wrapProgram "$out/bin/opcontrol"					\
-       --prefix PATH : "$out/bin:${gawk}/bin:${which}/bin:${gnugrep}/bin"
-  '';
-
   meta = {
     description = "System-wide profiler for Linux";
     longDescription = ''
diff --git a/pkgs/development/web/nodejs/default.nix b/pkgs/development/web/nodejs/default.nix
index 4c7aa967872c..574f0514105e 100644
--- a/pkgs/development/web/nodejs/default.nix
+++ b/pkgs/development/web/nodejs/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, openssl, python, zlib, libuv, v8, utillinux, http-parser
-, pkgconfig, runCommand, which, unstableVersion ? false
+, pkgconfig, runCommand, which, libtool, unstableVersion ? false
 }:
 
 # nodejs 0.12 can't be built on armv5tel. Armv6 with FPU, minimum I think.
@@ -7,11 +7,6 @@
 assert stdenv.system != "armv5tel-linux";
 
 let
-  dtrace = runCommand "dtrace-native" {} ''
-    mkdir -p $out/bin
-    ln -sv /usr/sbin/dtrace $out/bin
-  '';
-
   version = "0.12.7";
 
   deps = {
@@ -39,20 +34,21 @@ in stdenv.mkDerivation {
     sha256 = "17gk29zbw58l0sjjfw86acp39pkiblnq0gsq1jdrd70w0pgn8gdj";
   };
 
-  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps);
+  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++ [ "--without-dtrace" ];
 
   prePatch = ''
-    sed -e 's|^#!/usr/bin/env python$|#!${python}/bin/python|g' -i configure
+    patchShebangs .
   '';
 
-  patches = if stdenv.isDarwin then [ ./no-xcode.patch ] else null;
-
+  patches = stdenv.lib.optional stdenv.isDarwin ./no-xcode.patch;
 
   buildInputs = [ python which ]
     ++ (optional stdenv.isLinux utillinux)
-    ++ optionals stdenv.isDarwin [ pkgconfig openssl dtrace ];
+    ++ optionals stdenv.isDarwin [ pkgconfig openssl libtool ];
   setupHook = ./setup-hook.sh;
 
+  enableParallelBuilding = true;
+
   passthru.interpreterName = "nodejs";
 
   meta = {
diff --git a/pkgs/development/web/nodejs/v0_10.nix b/pkgs/development/web/nodejs/v0_10.nix
index 739a0ff9389b..eaa3c6386cb5 100644
--- a/pkgs/development/web/nodejs/v0_10.nix
+++ b/pkgs/development/web/nodejs/v0_10.nix
@@ -1,13 +1,11 @@
 { stdenv, fetchurl, openssl, python, zlib, v8, utillinux, http-parser, c-ares
-, pkgconfig, runCommand, which
+, pkgconfig, runCommand, which, libtool
+
+# apple frameworks
+, CoreServices, ApplicationServices, Carbon, Foundation
 }:
 
 let
-  dtrace = runCommand "dtrace-native" {} ''
-    mkdir -p $out/bin
-    ln -sv /usr/sbin/dtrace $out/bin
-  '';
-
   version = "0.10.38";
 
   # !!! Should we also do shared libuv?
@@ -37,21 +35,23 @@ in stdenv.mkDerivation {
     sha256 = "12xpa9jzry5g0j41908498qqs8v0q6miqkv6mggyzas8bvnshgai";
   };
 
-  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps);
+  configureFlags = concatMap sharedConfigureFlags (builtins.attrNames deps) ++
+    stdenv.lib.optional stdenv.isDarwin "--without-dtrace";
 
   prePatch = ''
-    sed -e 's|^#!/usr/bin/env python$|#!${python}/bin/python|g' -i configure
+    patchShebangs .
   '';
 
-  patches = if stdenv.isDarwin then [ ./no-xcode.patch ] else null;
+  patches = stdenv.lib.optional stdenv.isDarwin ./no-xcode.patch;
 
-  postPatch = if stdenv.isDarwin then ''
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     (cd tools/gyp; patch -Np1 -i ${../../python-modules/gyp/no-darwin-cflags.patch})
-  '' else null;
+  '';
 
   buildInputs = [ python which ]
     ++ (optional stdenv.isLinux utillinux)
-    ++ optionals stdenv.isDarwin [ pkgconfig openssl dtrace ];
+    ++ optionals stdenv.isDarwin [ pkgconfig openssl libtool CoreServices ApplicationServices Foundation ];
+  propagatedBuildInputs = optionals stdenv.isDarwin [ Carbon ];
   setupHook = ./setup-hook.sh;
 
   passthru.interpreterName = "nodejs-0.10";
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 67f74be9e1cd..e23801b22204 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   makeFlags = ["prefix=$(out)" "gamesdir=$(out)/bin"];
   preInstall = ''
     mkdir -p "$out"/{bin,share/doc/sgtpuzzles}
-    cp puzzles.txt LICENCE README "$out/share/doc/sgtpuzzles"
+    cp gamedesc.txt LICENCE README "$out/share/doc/sgtpuzzles"
     cp LICENCE "$out/share/doc/sgtpuzzles/LICENSE"
   '';
   preConfigure = ''
diff --git a/pkgs/games/xconq/default.nix b/pkgs/games/xconq/default.nix
index 413ecccc76ef..53c3ec7dec85 100644
--- a/pkgs/games/xconq/default.nix
+++ b/pkgs/games/xconq/default.nix
@@ -1,73 +1,49 @@
-x@{builderDefsPackage
-  , rpm, cpio, xproto, libX11, libXmu, libXaw, libXt, tcl, tk, libXext
-  , fontconfig
-  , makeWrapper
-  , ...}:
-builderDefsPackage
-(a :  
-let 
-  helperArgNames = ["stdenv" "fetchurl" "builderDefsPackage"] ++ 
-    [];
-
-  buildInputs = map (n: builtins.getAttr n x)
-    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
-  sourceInfo = rec {
-    baseName="xconq";
-    version="7.5.0-0pre.0.20050612";
-    name="${baseName}-${version}";
-    extension="src.rpm";
-    project="${baseName}";
-    url="mirror://sourceforge/project/${project}/${baseName}/${name}/${baseName}-${version}.${extension}";
-    hash="0i41dz95af2pzmmjz0sc1n0wdxy7gjqlfcl503hw1xd5zza2lw2j";
-  };
-in
-rec {
-  src = a.fetchurl {
-    url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
+{ stdenv, fetchurl, cpio, xproto, libX11, libXmu, libXaw, libXt, tcl, tk
+, libXext, fontconfig, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "${baseName}-${version}";
+  baseName="xconq";
+  version = "7.5.0-0pre.0.20050612";
+  
+  src = fetchurl {
+    url = "mirror://sourceforge/project/${baseName}/${baseName}/${name}/${name}.tar.gz";
+    sha256 = "1za78yx57mgwcmmi33wx3533yz1x093dnqis8q2qmqivxav51lca";
   };
 
-  inherit (sourceInfo) name version;
-  inherit buildInputs;
+  buildInputs = [ cpio xproto libX11 libXmu libXaw libXt tcl tk libXext
+    fontconfig makeWrapper ];
 
-  /* doConfigure should be removed if not needed */
-  phaseNames = ["addInputs" "doUnpack" "fixMakefiles" "fixCfiles" "fixTCLfiles" 
-    "doConfigure" "doMakeInstall" "doWrap"];
-      
-  doWrap = a.makeManyWrappers ''$out/bin/*'' ''--prefix TCLLIBPATH ' ' "${tk}/lib"'';
+  configureFlags = [
+    "--enable-alternate-scoresdir=scores"
+    "--with-tclconfig=${tcl}/lib"
+    "--with-tkconfig=${tk}/lib"
+  ];
 
-  fixMakefiles = a.fullDepEntry ''
+  patchPhase = ''
+    # Fix Makefiles
     find . -name 'Makefile.in' -exec sed -re 's@^        ( *)(cd|[&][&])@	\1\2@' -i '{}' ';'
     find . -name 'Makefile.in' -exec sed -e '/chown/d; /chgrp/d' -i '{}' ';'
     sed -e '/^			* *[$][(]tcltkdir[)]\/[*][.][*]/d' -i tcltk/Makefile.in
-  '' ["minInit" "doUnpack"];
 
-  fixCfiles = a.fullDepEntry ''
+    # Fix C files
     sed -re 's@[(]int[)]color@(long)color@' -i tcltk/tkmap.c
     sed -re '/unitp = view_unit[(]uview[)]/aelse *unitp = NULL\;' -i tcltk/tkmap.c
-  '' ["minInit" "doUnpack"];
 
-  fixTCLfiles = a.fullDepEntry ''
+    # Fix TCL files
     sed -re 's@MediumBlue@LightBlue@g' -i tcltk/tkconq.tcl
-  '' ["minInit" "doUnpack"];
+  '';
 
-  configureFlags = [
-    "--enable-alternate-scoresdir=scores"
-    "--with-tclconfig=${tcl}/lib"
-    "--with-tkconfig=${tk}/lib"
-  ];
+  postInstall = ''
+    for file in $out/bin/*; do
+      wrapProgram $file --prefix TCLLIBPATH ' ' "${tk}/lib"
+    done
+  '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A programmable turn-based strategy game";
-    maintainers = with a.lib.maintainers;
-    [
-      raskin
-    ];
-    platforms = with a.lib.platforms;
-      linux;
-    license = a.lib.licenses.gpl2;
-  };
-  passthru = {
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
   };
-}) x
-
+}
diff --git a/pkgs/os-specific/darwin/adv_cmds/ps.nix b/pkgs/os-specific/darwin/adv_cmds/ps.nix
deleted file mode 100644
index c3d3d1588627..000000000000
--- a/pkgs/os-specific/darwin/adv_cmds/ps.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "ps-${version}";
-  version = "153";
-
-  src = fetchurl {
-    url    = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-${version}.tar.gz";
-    sha256 = "174v6a4zkcm2pafzgdm6kvs48z5f911zl7k49hv7kjq6gm58w99v";
-  };
-
-  buildPhase = ''
-    cd ps
-    cc -Os -Wall -I. -c -o fmt.o fmt.c
-    cc -Os -Wall -I. -c -o keyword.o keyword.c
-    cc -Os -Wall -I. -c -o nlist.o nlist.c
-    cc -Os -Wall -I. -c -o print.o print.c
-    cc -Os -Wall -I. -c -o ps.o ps.c
-    cc -Os -Wall -I. -c -o tasks.o tasks.c
-    cc -o ps fmt.o keyword.o nlist.o print.o ps.o tasks.o
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share/man/man1
-
-    cp ps   $out/bin/ps
-    cp ps.1 $out/share/man/man1
-  '';
-
-
-  meta = {
-    platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
-  };
-}
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
new file mode 100644
index 000000000000..33d0e5eb385e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -0,0 +1,152 @@
+{ stdenv, fetchurl, xar, gzip, cpio, CF }:
+
+let
+  # sadly needs to be exported because security_tool needs it
+  sdk = stdenv.mkDerivation rec {
+    version = "10.9";
+    name    = "MacOS_SDK-${version}";
+
+    src = fetchurl {
+      url    = "http://swcdn.apple.com/content/downloads/27/02/031-06182/xxog8vxu8i6af781ivf4uhy6yt1lslex34/DevSDK_OSX109.pkg";
+      sha256 = "16b7aplha5573yl1d44nl2yxzp0w2hafihbyh7930wrcvba69iy4";
+    };
+
+    buildInputs = [ xar gzip cpio ];
+
+    phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+    unpackPhase = ''
+      xar -x -f $src
+    '';
+
+    installPhase = ''
+      start="$(pwd)"
+      mkdir -p $out
+      cd $out
+      cat $start/Payload | gzip -d | cpio -idm
+
+      mv usr/* .
+      rmdir usr
+
+      mv System/* .
+      rmdir System
+
+      cd Library/Frameworks/QuartzCore.framework/Versions/A/Headers
+      for file in CI*.h; do
+        rm $file
+        ln -s ../Frameworks/CoreImage.framework/Versions/A/Headers/$file
+      done
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Apple SDK ${version}";
+      maintainers = with maintainers; [ copumpkin ];
+      platforms   = platforms.darwin;
+    };
+  };
+
+  framework = name: deps: stdenv.mkDerivation {
+    name = "apple-framework-${name}";
+
+    phases = [ "installPhase" "fixupPhase" ];
+
+    installPhase = ''
+      linkFramework() {
+        local path="$1"
+        local dest="$out/Library/Frameworks/$path"
+        local name="$(basename "$path" .framework)"
+        local current="$(readlink "/System/Library/Frameworks/$path/Versions/Current")"
+
+        mkdir -p "$dest"
+        pushd "$dest" >/dev/null
+
+        ln -s "${sdk}/Library/Frameworks/$path/Versions/$current/Headers"
+        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/$name"
+        ln -s -L "/System/Library/Frameworks/$path/Versions/$current/Resources"
+
+        if [ -f "/System/Library/Frameworks/$path/module.map" ]; then
+          ln -s "/System/Library/Frameworks/$path/module.map"
+        fi
+
+        pushd "${sdk}/Library/Frameworks/$path/Versions/$current" >/dev/null
+        local children=$(echo Frameworks/*.framework)
+        popd >/dev/null
+
+        for child in $children; do
+          childpath="$path/Versions/$current/$child"
+          linkFramework "$childpath"
+        done
+
+        if [ -d "$dest/Versions/$current" ]; then
+          mv $dest/Versions/$current/* .
+        fi
+
+        popd >/dev/null
+      }
+
+      linkFramework "${name}.framework"
+    '';
+
+    propagatedBuildInputs = deps;
+
+    # Not going to bother being more precise than this...
+    __propagatedImpureHostDeps = (import ./impure-deps.nix).${name};
+
+    meta = with stdenv.lib; {
+      description = "Apple SDK framework ${name}";
+      maintainers = with maintainers; [ copumpkin ];
+      platforms   = platforms.darwin;
+    };
+  };
+in rec {
+  libs = {
+    xpc = stdenv.mkDerivation {
+      name   = "apple-lib-xpc";
+      phases = [ "installPhase" "fixupPhase" ];
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        ln -s "${sdk}/include/xpc"
+        popd >/dev/null
+      '';
+    };
+
+    Xplugin = stdenv.mkDerivation {
+      name   = "apple-lib-Xplugin";
+      phases = [ "installPhase" "fixupPhase" ];
+
+      # Not enough
+      __propagatedImpureHostDeps = [ "/usr/lib/libXplugin.1.dylib" ];
+
+      propagatedBuildInputs = with frameworks; [
+        OpenGL ApplicationServices Carbon IOKit CoreFoundation CoreGraphics CoreServices CoreText
+      ];
+
+      installPhase = ''
+        mkdir -p $out/include $out/lib
+        ln -s "${sdk}/include/Xplugin.h" $out/include/Xplugin.h
+        ln -s "/usr/lib/libXplugin.1.dylib" $out/lib/libXplugin.dylib
+      '';
+    };
+
+    utmp = stdenv.mkDerivation {
+      name   = "apple-lib-utmp";
+      phases = [ "installPhase" "fixupPhase" ];
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        ln -s "${sdk}/include/utmp.h"
+        ln -s "${sdk}/include/utmpx.h"
+        popd >/dev/null
+      '';
+    };
+  };
+
+  frameworks = (stdenv.lib.mapAttrs framework (import ./frameworks.nix { inherit frameworks libs; })) // {
+    CoreFoundation = CF;
+  };
+
+  inherit sdk;
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
new file mode 100644
index 000000000000..9da2dd74c711
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -0,0 +1,119 @@
+# Current as of 10.9
+# Epic weird knot-tying happening here.
+# TODO: clean up the process for generating this and include it
+
+{ frameworks, libs }:
+
+with frameworks; with libs; {
+  AGL                     = [ Carbon OpenGL ];
+  AVFoundation            = [ ApplicationServices CoreGraphics ];
+  AVKit                   = [];
+  Accounts                = [];
+  AddressBook             = [ Carbon CoreFoundation ];
+  AppKit                  = [ AudioToolbox QuartzCore ];
+  AppKitScripting         = [];
+  AppleScriptKit          = [];
+  AppleScriptObjC         = [];
+  AppleShareClientCore    = [ CoreServices ];
+  AudioToolbox            = [ AudioUnit CoreAudio CoreFoundation CoreMIDI ];
+  AudioUnit               = [ Carbon CoreAudio CoreFoundation ];
+  AudioVideoBridging      = [ Foundation ];
+  Automator               = [];
+  CFNetwork               = [ CoreFoundation ];
+  CalendarStore           = [];
+  Cocoa                   = [];
+  Collaboration           = [];
+  CoreAudio               = [ CoreFoundation IOKit ];
+  CoreAudioKit            = [ AudioUnit ];
+  CoreData                = [];
+  CoreGraphics            = [ Accelerate CoreFoundation IOKit IOSurface SystemConfiguration ];
+  CoreLocation            = [];
+  CoreMIDI                = [ CoreFoundation ];
+  CoreMIDIServer          = [];
+  CoreMedia               = [ ApplicationServices AudioToolbox CoreAudio CoreFoundation CoreGraphics CoreVideo ];
+  CoreMediaIO             = [ CoreFoundation CoreMedia ];
+  CoreText                = [ CoreFoundation CoreGraphics ];
+  CoreVideo               = [ ApplicationServices CoreFoundation CoreGraphics IOSurface OpenGL ];
+  CoreWLAN                = [ SecurityFoundation ];
+  DVComponentGlue         = [ CoreServices QuickTime ];
+  DVDPlayback             = [];
+  DirectoryService        = [ CoreFoundation ];
+  DiscRecording           = [ CoreFoundation CoreServices IOKit ];
+  DiscRecordingUI         = [];
+  DiskArbitration         = [ CoreFoundation IOKit ];
+  DrawSprocket            = [ Carbon ];
+  EventKit                = [];
+  ExceptionHandling       = [];
+  FWAUserLib              = [];
+  ForceFeedback           = [ CoreFoundation IOKit ];
+  Foundation              = [ CoreFoundation Security ApplicationServices AppKit SystemConfiguration ];
+  GLKit                   = [ CoreFoundation ];
+  GLUT                    = [ GL OpenGL ];
+  GSS                     = [];
+  GameController          = [];
+  GameKit                 = [ Foundation ];
+  ICADevices              = [ Carbon CoreFoundation IOBluetooth ];
+  IMServicePlugIn         = [];
+  IOBluetoothUI           = [ IOBluetooth ];
+  IOKit                   = [ CoreFoundation ];
+  IOSurface               = [ CoreFoundation IOKit xpc ];
+  ImageCaptureCore        = [];
+  ImageIO                 = [ CoreFoundation CoreGraphics ];
+  InputMethodKit          = [ Carbon ];
+  InstallerPlugins        = [];
+  InstantMessage          = [];
+  JavaFrameEmbedding      = [];
+  JavaScriptCore          = [ CoreFoundation ];
+  Kerberos                = [];
+  Kernel                  = [ CoreFoundation IOKit ];
+  LDAP                    = [];
+  LatentSemanticMapping   = [ Carbon CoreFoundation ];
+  MapKit                  = [];
+  MediaAccessibility      = [ CoreFoundation CoreGraphics CoreText QuartzCore ];
+  MediaToolbox            = [ AudioToolbox CoreFoundation CoreMedia ];
+  NetFS                   = [ CoreFoundation ];
+  OSAKit                  = [ Carbon ];
+  OpenAL                  = [];
+  OpenCL                  = [ IOSurface OpenGL ];
+  OpenGL                  = [];
+  PCSC                    = [ CoreData ];
+  PreferencePanes         = [];
+  PubSub                  = [];
+  Python                  = [ ApplicationServices ];
+  QTKit                   = [ QuickTime ];
+  QuickLook               = [ ApplicationServices CoreFoundation ];
+  QuickTime               = [ ApplicationServices AudioUnit Carbon CoreAudio CoreServices OpenGL QuartzCore ];
+  Ruby                    = [];
+  RubyCocoa               = [];
+  SceneKit                = [];
+  ScreenSaver             = [];
+  Scripting               = [];
+  ScriptingBridge         = [];
+  Security                = [ CoreFoundation IOKit ];
+  SecurityFoundation      = [];
+  SecurityInterface       = [ Security ];
+  ServiceManagement       = [ CoreFoundation Security ];
+  Social                  = [];
+  SpriteKit               = [];
+  StoreKit                = [];
+  SyncServices            = [];
+  SystemConfiguration     = [ CoreFoundation Security ];
+  TWAIN                   = [ Carbon ];
+  Tcl                     = [];
+  Tk                      = [ ApplicationServices Carbon X11 ];
+  VideoDecodeAcceleration = [ CoreFoundation CoreVideo ];
+  VideoToolbox            = [ CoreFoundation CoreMedia CoreVideo ];
+  WebKit                  = [ ApplicationServices Carbon JavaScriptCore OpenGL X11 ];
+
+  # Umbrellas
+  Accelerate          = [ CoreWLAN IOBluetooth ];
+  ApplicationServices = [ CoreFoundation CoreServices CoreText ImageIO ];
+  Carbon              = [ ApplicationServices CoreFoundation CoreServices IOKit Security QuartzCore ];
+  CoreBluetooth       = [];
+  CoreServices        = [ CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration Security NetFS OpenDirectory ServiceManagement ];
+  IOBluetooth         = [ IOKit ];
+  JavaVM              = [];
+  OpenDirectory       = [];
+  Quartz              = [ QuickLook ];
+  QuartzCore          = [ ApplicationServices CoreFoundation CoreVideo OpenCL ];
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix b/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix
new file mode 100644
index 000000000000..e2fdef60001f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix
@@ -0,0 +1,199 @@
+rec {
+  CFNetwork = [
+    "/System/Library/Frameworks/CFNetwork.framework"
+    "/usr/lib/libsqlite3.dylib"
+    "/usr/lib/libxml2.2.dylib"
+  ];
+  IOKit = [
+    "/System/Library/Frameworks/IOKit.framework"
+  ];
+  DiskArbitration = [
+    "/System/Library/Frameworks/DiskArbitration.framework"
+  ];
+  Security = [
+    "/System/Library/Frameworks/Security.framework"
+    "/usr/lib/libbsm.0.dylib"
+    "/usr/lib/libbz2.1.0.dylib"
+    "/usr/lib/libpam.2.dylib"
+    "/usr/lib/libxar.1.dylib"
+    "/usr/lib/libxml2.2.dylib"
+    "/usr/lib/libsqlite3.dylib"
+  ];
+  GSS = [
+    "/System/Library/Frameworks/GSS.framework"
+  ];
+  Kerberos = [
+    "/System/Library/Frameworks/Kerberos.framework"
+  ];
+  CoreServices = [
+    "/System/Library/Frameworks/CoreServices.framework"
+    "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
+    "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
+    "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
+    "/usr/lib/libmecabra.dylib"
+    "/usr/lib/libcmph.dylib"
+    "/usr/lib/libiconv.2.dylib"
+    "/usr/lib/libxslt.1.dylib"
+  ] ++ Foundation;
+  IOSurface = [
+    "/System/Library/Frameworks/IOSurface.framework"
+  ];
+  CoreGraphics = [
+    "/System/Library/Frameworks/CoreGraphics.framework"
+    "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
+    "/usr/lib/libbsm.0.dylib"
+    "/usr/lib/libz.1.dylib"
+  ];
+  CoreText = [
+    "/System/Library/Frameworks/CoreText.framework"
+  ];
+  ImageIO = [
+    "/System/Library/Frameworks/ImageIO.framework"
+  ];
+  ApplicationServices = [
+    "/System/Library/Frameworks/ApplicationServices.framework"
+    "/usr/lib/libcups.2.dylib"
+    "/usr/lib/libresolv.9.dylib"
+  ] ++ AudioToolbox;
+  OpenGL = [
+    "/System/Library/Frameworks/OpenGL.framework"
+  ];
+  CoreVideo = [
+    "/System/Library/Frameworks/CoreVideo.framework"
+  ];
+  QuartzCore = [
+    "/System/Library/Frameworks/QuartzCore.framework"
+    "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
+  ];
+  PCSC = [
+    "/System/Library/Frameworks/PCSC.framework"
+  ];
+  AppKit = [
+    "/System/Library/Frameworks/AppKit.framework"
+    "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
+    "/System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG"
+    "/System/Library/PrivateFrameworks/AppleVPA.framework/Versions/A/AppleVPA"
+    "/System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup"
+    "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
+    "/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth"
+    "/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication"
+    "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
+    "/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi"
+    "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
+    "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
+    "/System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols"
+    "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
+    "/System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore"
+    "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
+    "/System/Library/PrivateFrameworks/Heimdal.framework/Heimdal"
+    "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/Current"
+    "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal"
+    "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
+    "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
+    "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
+    "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
+    "/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis"
+    "/System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices"
+    "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
+    "/System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore"
+    "/System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication"
+    "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
+    "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+    "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
+    "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
+    "/usr/lib/libCRFSuite.dylib"
+    "/usr/lib/libOpenScriptingUtil.dylib"
+    "/usr/lib/libarchive.2.dylib"
+    "/usr/lib/libbsm.0.dylib"
+    "/usr/lib/libbz2.1.0.dylib"
+    "/usr/lib/libc++.1.dylib"
+    "/usr/lib/libc++abi.dylib"
+    "/usr/lib/libcmph.dylib"
+    "/usr/lib/libcups.2.dylib"
+    "/usr/lib/libextension.dylib"
+    "/usr/lib/libheimdal-asn1.dylib"
+    "/usr/lib/libiconv.2.dylib"
+    "/usr/lib/libicucore.A.dylib"
+    "/usr/lib/liblangid.dylib"
+    "/usr/lib/liblzma.5.dylib"
+    "/usr/lib/libmecabra.dylib"
+    "/usr/lib/libpam.2.dylib"
+    "/usr/lib/libresolv.9.dylib"
+    "/usr/lib/libsqlite3.dylib"
+    "/usr/lib/libxar.1.dylib"
+    "/usr/lib/libxml2.2.dylib"
+    "/usr/lib/libxslt.1.dylib"
+    "/usr/lib/libz.1.dylib"
+  ];
+  Foundation = [
+    "/System/Library/Frameworks/Foundation.framework"
+    "/usr/lib/libextension.dylib"
+    "/usr/lib/libarchive.2.dylib"
+    "/usr/lib/liblzma.5.dylib"
+    "/usr/lib/liblangid.dylib"
+    "/usr/lib/libCRFSuite.dylib"
+  ];
+  CoreData = [
+    "/System/Library/Frameworks/CoreData.framework"
+  ];
+  Cocoa = [
+    "/System/Library/Frameworks/Cocoa.framework"
+    "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+    "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A"
+  ];
+  Carbon = [
+    "/System/Library/Frameworks/Carbon.framework"
+    "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
+    "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
+    "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
+    "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
+    "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
+    "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
+    "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
+    "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
+  ];
+  CoreAudio = [
+    "/System/Library/Frameworks/CoreAudio.framework"
+  ];
+  AudioUnit = [
+    "/System/Library/Frameworks/AudioUnit.framework"
+  ];
+  CoreMIDI = [
+    "/System/Library/Frameworks/CoreMIDI.framework"
+  ];
+  AudioToolbox = [
+    "/System/Library/Frameworks/AudioToolbox.framework"
+  ];
+  SystemConfiguration = [
+    "/System/Library/Frameworks/SystemConfiguration.framework"
+  ];
+  NetFS = [
+    "/System/Library/Frameworks/NetFS.framework"
+    "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
+    "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
+  ];
+  Accelerate = [
+    "/System/Library/Frameworks/Accelerate.framework"
+  ];
+  OpenDirectory = [
+    "/System/Library/Frameworks/OpenDirectory.framework"
+  ];
+  ServiceManagement = [
+    "/System/Library/Frameworks/ServiceManagement.framework"
+  ];
+  OpenCL = [
+    "/System/Library/Frameworks/OpenCL.framework"
+  ];
+  CoreWLAN = [
+    "/System/Library/Frameworks/CoreWLAN.framework"
+  ];
+  IOBluetooth = [
+    "/System/Library/Frameworks/IOBluetooth.framework"
+  ] ++ AudioUnit ++ CoreBluetooth;
+  CoreBluetooth = [
+    "/System/Library/Frameworks/CoreBluetooth.framework"
+  ];
+  SecurityFoundation = [
+    "/System/Library/Frameworks/SecurityFoundation.framework"
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/cf-bridging.patch b/pkgs/os-specific/darwin/apple-source-releases/CF/cf-bridging.patch
new file mode 100644
index 000000000000..068a6311a9cb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/cf-bridging.patch
@@ -0,0 +1,39 @@
+diff --git a/CFBase.h b/CFBase.h
+index ffddd2b..e5a926b 100644
+--- a/CFBase.h
++++ b/CFBase.h
+@@ -249,6 +249,33 @@ CF_EXTERN_C_BEGIN
+ #endif
+ #endif
+ 
++#if __has_attribute(objc_bridge) && __has_feature(objc_bridge_id) && __has_feature(objc_bridge_id_on_typedefs)
++
++#ifdef __OBJC__
++@class NSArray;
++@class NSAttributedString;
++@class NSString;
++@class NSNull;
++@class NSCharacterSet;
++@class NSData;
++@class NSDate;
++@class NSTimeZone;
++@class NSDictionary;
++@class NSError;
++@class NSLocale;
++@class NSNumber;
++@class NSSet;
++@class NSURL;
++#endif
++
++#define CF_BRIDGED_TYPE(T)		__attribute__((objc_bridge(T)))
++#define CF_BRIDGED_MUTABLE_TYPE(T)	__attribute__((objc_bridge_mutable(T)))
++#define CF_RELATED_TYPE(T,C,I)		__attribute__((objc_bridge_related(T,C,I)))
++#else
++#define CF_BRIDGED_TYPE(T)
++#define CF_BRIDGED_MUTABLE_TYPE(T)
++#define CF_RELATED_TYPE(T,C,I)
++#endif
+ 
+ CF_EXPORT double kCFCoreFoundationVersionNumber;
+ 
+
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
index 3d4ac89e0a7e..f919dde7f69a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
@@ -3,7 +3,16 @@
 appleDerivation {
   buildInputs = [ dyld icu libdispatch launchd libclosure ];
 
-  patches = [ ./add-cf-initialize.patch ./add-cfmachport.patch ];
+  patches = [ ./add-cf-initialize.patch ./add-cfmachport.patch ./cf-bridging.patch ];
+
+  # CFAttributedString.h is in the SDK only, not on opensource.apple.com or github
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/CoreFoundation.framework"
+    "/usr/lib/libc++.1.dylib"
+    "/usr/lib/libc++abi.dylib"
+    "/usr/lib/libicucore.A.dylib"
+    "/usr/lib/libz.1.dylib"
+  ];
 
   preBuild = ''
     substituteInPlace Makefile \
@@ -35,6 +44,9 @@ appleDerivation {
   '';
 
   postInstall = ''
+    # gross! convince apple to release this as part of CF
+    cp /System/Library/Frameworks/CoreFoundation.framework/Headers/CFAttributedString.h "$out/System/Library/Frameworks/CoreFoundation.framework/Headers"
+
     mv $out/System/* $out
     rmdir $out/System
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index db467254f171..4bc3a7a7fa42 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -2,10 +2,8 @@
 
 appleDerivation {
   # Will override the name until we provide all of adv_cmds
-  name = "ps-${version}";
-
   buildPhase = ''
-    cd ps
+    pushd ps
     cc -Os -Wall -I. -c -o fmt.o fmt.c
     cc -Os -Wall -I. -c -o keyword.o keyword.c
     cc -Os -Wall -I. -c -o nlist.o nlist.c
@@ -13,13 +11,20 @@ appleDerivation {
     cc -Os -Wall -I. -c -o ps.o ps.c
     cc -Os -Wall -I. -c -o tasks.o tasks.c
     cc -o ps fmt.o keyword.o nlist.o print.o ps.o tasks.o
+    popd
+
+    pushd locale
+    c++ -o locale locale.cc
+    popd
   '';
 
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
 
-    cp ps   $out/bin/ps
-    cp ps.1 $out/share/man/man1
+    cp ps/ps   $out/bin/ps
+    cp ps/ps.1 $out/share/man/man1
+    cp locale/locale   $out/bin/locale
+    cp locale/locale.1 $out/share/man/man1
   '';
 
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
index 3427081bfaa8..8687f3fe532e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -1,6 +1,8 @@
 { stdenv, appleDerivation, launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
 
 appleDerivation {
+  meta.broken = stdenv.cc.nativeLibc;
+
   buildInputs = [ launchd bootstrap_cmds xnu ppp IOKit eap8021x ];
 
   propagatedBuildInputs = [ Security ];
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 1d89577012c9..f29a2b5b9111 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -6,19 +6,24 @@ let
     inherit sha256;
   };
 
+  appleDerivation_ = name: version: sha256: attrs: stdenv.mkDerivation ({
+    inherit version;
+    name = "${name}-${version}";
+  } // (if attrs ? srcs then {} else {
+    src  = fetchApple version sha256 name;
+  }) // attrs);
+
   applePackage = namePath: version: sha256:
     let
       name = builtins.elemAt (stdenv.lib.splitString "/" namePath) 0;
-
-      appleDerivation = attrs: stdenv.mkDerivation ({
-        inherit version;
-        name = "${name}-${version}";
-      } // (if attrs ? srcs then {} else {
-        src  = fetchApple version sha256 name;
-      }) // attrs);
+      appleDerivation = appleDerivation_ name version sha256;
       callPackage = pkgs.newScope (packages // pkgs.darwin // { inherit appleDerivation name version; });
     in callPackage (./. + builtins.toPath "/${namePath}");
 
+  libsecPackage = pkgs.callPackage ./libsecurity_generic {
+    inherit applePackage appleDerivation_;
+  };
+
   IOKitSpecs = {
     IOAudioFamily                        = fetchApple "197.4.2"    "1dmrczdmbdkvnhjbv233wx4xczgpf5wjrhr83aizrwpks5avkxbr";
     IOFireWireFamily                     = fetchApple "455.4.0"    "034n2v6z7lf1cx3sp3309z4sn8mkchjcrsf177iag46yzlzcjgfl";
@@ -66,11 +71,12 @@ let
     libdispatch     = applePackage "libdispatch"       "339.92.1"    "1lc5033cmkwxy3r26gh9plimxshxfcbgw6i0j7mgjlnpk86iy5bk" {};
     libiconv        = applePackage "libiconv"          "41"          "0sni1gx6i2h7r4r4hhwbxdir45cp039m4wi74izh4l0pfw7gywad" {};
     Libinfo         = applePackage "Libinfo"           "449.1.3"     "1ix6f7xwjnq9bqgv8w27k4j64bqn1mfhh91nc7ciiv55axpdb9hq" {};
-    Libm            = applePackage "Libm"              "2026"        "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
+    Libm            = applePackage "Libm"              "2026"        "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {}; # This is from 10.7 !! :(
     Libnotify       = applePackage "Libnotify"         "121.20.1"    "164rx4za5z74s0mk9x0m1815r1m9kfal8dz3bfaw7figyjd6nqad" {};
     libpthread      = applePackage "libpthread"        "105.1.4"     "09vwwahcvmxvx2xl0890gkp91n61dld29j73y2pa597bqkag2qpg" {};
     libresolv       = applePackage "libresolv"         "54"          "028mp2smd744ryxwl8cqz4njv8h540sdw3an1yl7yxqcs04r0p4b" {};
     Libsystem       = applePackage "Libsystem"         "1197.1.1"    "1yfj2qdrf9vrzs7p9m4wlb7zzxcrim1gw43x4lvz4qydpp5kg2rh" {};
+    libutil         = applePackage "libutil"           "38"          "12gsvmj342n5d81kqwba68bmz3zf2757442g1sz2y5xmcapa3g5f" {};
     libunwind       = applePackage "libunwind"         "35.3"        "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
     mDNSResponder   = applePackage "mDNSResponder"     "522.92.1"    "1cp87qda1s7brriv413i71yggm8yqfwv64vknrnqv24fcb8hzbmy" {};
     objc4           = applePackage "objc4"             "551.1"       "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg" {};
@@ -79,5 +85,27 @@ let
     removefile      = applePackage "removefile"        "33"          "0ycvp7cnv40952a1jyhm258p6gg5xzh30x86z5gb204x80knw30y" {};
     Security        = applePackage "Security"          "55471.14.18" "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
     xnu             = applePackage "xnu"               "2422.115.4"  "1ssw5fzvgix20bw6y13c39ib0zs7ykpig3irlwbaccpjpci5jl0s" {};
+
+    libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "55003"    "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
+    libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "55000"    "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
+    libsecurity_apple_file_dl  = libsecPackage "libsecurity_apple_file_dl"  "55000"    "1dfqani3n135i3iqmafc1k9awmz6s0a78zifhk15rx5a8ps870bl" {};
+    libsecurity_apple_x509_cl  = libsecPackage "libsecurity_apple_x509_cl"  "55004"    "1gji2i080560s08k1nigsla1zdmi6slyv97xaj5vqxjpxb0g1xf5" {};
+    libsecurity_apple_x509_tp  = libsecPackage "libsecurity_apple_x509_tp"  "55009.3"  "1bsms3nvi62wbvjviwjhjhzhylad8g6vmvlj3ngd0wyd0ywxrs46" {};
+    libsecurity_asn1           = libsecPackage "libsecurity_asn1"           "55000.2"  "0i8aakjxdfj0lqcgqmbip32g7r4h57xhs8w0sxfvfl45q22s782w" {};
+    libsecurity_cdsa_client    = libsecPackage "libsecurity_cdsa_client"    "55000"    "127jxnypkycy8zqwicfv333h11318m00gd37jnswbrpg44xd1wdy" {};
+    libsecurity_cdsa_plugin    = libsecPackage "libsecurity_cdsa_plugin"    "55001"    "0ifmx85rs51i7zjm015s8kc2dqyrlvbr39lw9xzxgd2ds33i4lfj" {};
+    libsecurity_cdsa_utilities = libsecPackage "libsecurity_cdsa_utilities" "55006"    "1kzsl0prvfa8a0m3j3pcxq06aix1csgayd3lzx27iqg84c8mhzan" {};
+    libsecurity_cdsa_utils     = libsecPackage "libsecurity_cdsa_utils"     "55000"    "0q55jizav6n0lkj7lcmcr2mjdhnbnnn525fa9ipwgvzbspihw0g6" {};
+    libsecurity_codesigning    = libsecPackage "libsecurity_codesigning"    "55037.15" "0vf5nj2g383b4hknlp51qll5pm8z4qbf56dnc16n3wm8gj82iasy" {};
+    libsecurity_cssm           = libsecPackage "libsecurity_cssm"           "55005.5"  "0l6ia533bhr8kqp2wa712bnzzzisif3kbn7h3bzzf4nps4wmwzn4" {};
+    libsecurity_filedb         = libsecPackage "libsecurity_filedb"         "55016.1"  "1r0ik95xapdl6l2lhd079vpq41jjgshz2hqb8490gpy5wyc49cxb" {};
+    libsecurity_keychain       = libsecPackage "libsecurity_keychain"       "55050.9"  "15wf2slcgyns61kk7jndgm9h22vidyphh9x15x8viyprra9bkhja" {};
+    libsecurity_mds            = libsecPackage "libsecurity_mds"            "55000"    "0vin5hnzvkx2rdzaaj2gxmx38amxlyh6j24a8gc22y09d74p5lzs" {};
+    libsecurity_ocspd          = libsecPackage "libsecurity_ocspd"          "55010"    "1bxzpihc6w0ji4x8810a4lfkq83787yhjl60xm24bv1prhqcm73b" {};
+    libsecurity_pkcs12         = libsecPackage "libsecurity_pkcs12"         "55000"    "1yq8p2sp39q40fxshb256b7jn9lvmpymgpm8yz9kqrf980xddgsg" {};
+    libsecurity_sd_cspdl       = libsecPackage "libsecurity_sd_cspdl"       "55003"    "10v76xycfnvz1n0zqfbwn3yh4w880lbssqhkn23iim3ihxgm5pbd" {};
+    libsecurity_utilities      = libsecPackage "libsecurity_utilities"      "55030.3"  "0ayycfy9jm0n0c7ih9f3m69ynh8hs80v8yicq47aa1h9wclbxg8r" {};
+    libsecurityd               = libsecPackage "libsecurityd"               "55004"    "1ywm2qj8l7rhaxy5biwxsyavd0d09d4bzchm03nlvwl313p2747x" {};
+    security_dotmac_tp         = libsecPackage "security_dotmac_tp"         "55107.1"  "1l4fi9qhrghj0pkvywi8da22bh06c5bv3l40a621b5g258na50pl" {};
   };
 in packages
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
index 1c61297c7d5f..2003bb6e55e4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
@@ -1,9 +1,14 @@
-{ stdenv, appleDerivation }:
+{ stdenv, appleDerivation, libdispatch, Libsystem }:
 
 appleDerivation {
+  # these are included in the pure libc
+  buildInputs = stdenv.lib.optionals stdenv.cc.nativeLibc [ libdispatch Libsystem ];
+
   buildPhase = ''
     cp ${./auto_dtrace.h} ./auto_dtrace.h
 
+    substituteInPlace ThreadLocalCollector.h --replace SubZone.h Subzone.h
+
     substituteInPlace auto_zone.cpp \
       --replace "#include <msgtracer_client.h>" ''$'#include <asl.h>\nstatic void msgtracer_log_with_keys(...) { };'
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
new file mode 100644
index 000000000000..ca263228fde8
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_csp
+
+security_apple_csp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_csp_HEADER_FILES_DIR = lib
+
+security_apple_csp_CC_FILES = $(wildcard lib/*.cpp)
+security_apple_csp_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
new file mode 100644
index 000000000000..add46454cbe7
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
@@ -0,0 +1,31 @@
+{ appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_utilities, osx_private_sdk, stdenv }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurity_cdsa_plugin
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+  ];
+  NIX_CFLAGS_COMPILE = "-Iopen_ssl";
+  patchPhase = ''
+    for file in lib/BlockCryptor.h lib/RSA_DSA_signature.h lib/castContext.h \
+      lib/RawSigner.h lib/MD2Object.h lib/HMACSHA1.h lib/bfContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '"CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h"' \
+        '"${apple_sdk.sdk}/include/MacTypes.h"'
+    done
+
+    for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
+      substituteInPlace ''$file --replace \
+        '/usr/local/include/CommonCrypto/CommonCryptorSPI.h' \
+        '${osx_private_sdk}/usr/include/CommonCrypto/CommonCryptorSPI.h'
+    done
+    
+    substituteInPlace lib/opensshWrap.cpp --replace RSA_DSA_Keys.h RSA_DSA_keys.h
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/pbkdf2.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/ConditionalMacros.h>' \
+      '"${stdenv.libc}/include/ConditionalMacros.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
new file mode 100644
index 000000000000..a0d48cf49650
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_cspdl
+
+security_apple_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_cspdl_HEADER_FILES_DIR = lib
+
+security_apple_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
new file mode 100644
index 000000000000..b80d4c8aad28
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_cspdl/default.nix
@@ -0,0 +1,16 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
new file mode 100644
index 000000000000..f52829c644da
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_file_dl
+
+security_apple_file_dl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_file_dl_HEADER_FILES_DIR = lib
+
+security_apple_file_dl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
new file mode 100644
index 000000000000..0eb2ee10fd84
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_file_dl/default.nix
@@ -0,0 +1,17 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
new file mode 100644
index 000000000000..c7c9c3d4e795
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_cl
+
+security_apple_x509_cl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_cl_HEADER_FILES_DIR = lib
+
+security_apple_x509_cl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
new file mode 100644
index 000000000000..d2f15e19ccf0
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_cl/default.nix
@@ -0,0 +1,18 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_utilities, libsecurityd, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
new file mode 100644
index 000000000000..083a8a85d17d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_apple_x509_tp
+
+security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_apple_x509_tp_HEADER_FILES_DIR = lib
+
+security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
new file mode 100644
index 000000000000..6410c134f89a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/default.nix
@@ -0,0 +1,19 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_keychain, libsecurity_ocspd, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_filedb
+    libsecurity_asn1
+    libsecurity_ocspd
+  ];
+  patchPhase = ''
+    for file in lib/*; do
+      sed -i 's/#include <\(.*\)>/#include "\1"/' ''$file
+    done
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
new file mode 100644
index 000000000000..1c3c4f0b25bf
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_asn1
+
+security_asn1_C_FILES = $(wildcard lib/*.c)
+security_asn1_CC_FILES = $(wildcard lib/*.cpp)
+
+security_asn1_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_asn1_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
new file mode 100644
index 000000000000..ab11d893d198
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_asn1/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk }:
+appleDerivation {
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
+  propagatedBuildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
new file mode 100644
index 000000000000..91fb6bb679e5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_client
+
+security_cdsa_client_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_client_HEADER_FILES_DIR = lib
+
+security_cdsa_client_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
new file mode 100644
index 000000000000..2ecad568bf7e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_client/default.nix
@@ -0,0 +1,8 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
new file mode 100644
index 000000000000..9e1260f9b9c4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_plugin
+
+security_cdsa_plugin_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_plugin_HEADER_FILES_DIR = lib
+
+security_cdsa_plugin_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
new file mode 100644
index 000000000000..b0c35f0e30c3
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_plugin/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_cssm, libsecurity_utilities, osx_private_sdk, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    perl
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cssm.src}
+    cp libsecurity_cssm*/lib/cssm{dli,aci,cli,cspi,tpi}.h lib
+  '';
+  preBuild = ''
+    perl lib/generator.pl lib lib/generator.cfg lib lib || exit 1
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
new file mode 100644
index 000000000000..24bc1fe7e3af
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utilities
+
+security_cdsa_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utilities_HEADER_FILES_DIR = lib
+
+security_cdsa_utilities_CC_FILES = $(wildcard lib/*.cpp) lib/Schema.cpp lib/KeySchema.cpp
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
new file mode 100644
index 000000000000..6f2436f21496
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/default.nix
@@ -0,0 +1,13 @@
+{ CommonCrypto, appleDerivation, libsecurity_codesigning, libsecurity_utilities, m4, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    m4
+  ];
+  patchPhase = ''
+    patch -p1 < ${./handletemplates.patch}
+    unpackFile ${libsecurity_codesigning.src}
+    mv libsecurity_codesigning*/lib security_codesigning
+  '';
+  NIX_CFLAGS_COMPILE = "-I${CommonCrypto}/include/CommonCrypto";
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
new file mode 100644
index 000000000000..e5a703b2a08f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utilities/handletemplates.patch
@@ -0,0 +1,19 @@
+--- a/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
++++ b/lib/handletemplates.h  1969-12-31 16:00:01.000000000 -0800
+@@ -32,6 +32,7 @@
+ #include <security_utilities/threading.h>
+ #include <security_utilities/globalizer.h>
+ #include <security_cdsa_utilities/cssmerrors.h>
++#include <vector>
+ 
+ #if __GNUC__ > 2
+ #include <ext/hash_map>
+@@ -129,7 +130,7 @@
+     // @@@  Remove when 4003540 is fixed
+     template <class Subtype>
+     static void findAllRefs(std::vector<_Handle> &refs) {
+-        state().findAllRefs<Subtype>(refs);
++        state().template findAllRefs<Subtype>(refs);
+     }
+     
+ protected:
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
new file mode 100644
index 000000000000..7b5b7dc186a1
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/GNUmakefile
@@ -0,0 +1,13 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cdsa_utils
+
+security_cdsa_utils_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cdsa_utils_HEADER_FILES_DIR = lib
+
+security_cdsa_utils_CC_FILES = $(wildcard lib/*.cpp)
+
+lib/%.cpp: lib/%.m4
+	m4 $< > $@
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
new file mode 100644
index 000000000000..d9b594bc47ca
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cdsa_utils/default.nix
@@ -0,0 +1,8 @@
+{ Security, appleDerivation, apple_sdk, cppcheck, libsecurity_cdsa_utilities, libsecurity_utilities, m4, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    m4
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
new file mode 100644
index 000000000000..e923b962c263
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_codesigning
+
+security_codesigning_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_codesigning_HEADER_FILES_DIR = lib
+
+security_codesigning_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
new file mode 100644
index 000000000000..c5ba9cc8d7ef
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -0,0 +1,7 @@
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+  ];
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
new file mode 100644
index 000000000000..c7835aaa9b02
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_cssm
+
+security_cssm_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_cssm_HEADER_FILES_DIR = lib
+
+security_cssm_CC_FILES = $(wildcard lib/*.cpp)
+security_cssm_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
new file mode 100644
index 000000000000..053dea134c72
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_cssm/default.nix
@@ -0,0 +1,14 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_codesigning, libsecurity_utilities, perl }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_client
+    perl
+    libsecurity_cdsa_plugin
+  ];
+  preBuild = ''
+    mkdir derived_src
+    perl lib/generator.pl lib lib/generator.cfg derived_src
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
new file mode 100644
index 000000000000..4359810c56b3
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_filedb
+
+security_filedb_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_filedb_HEADER_FILES_DIR = lib
+
+security_filedb_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
new file mode 100644
index 000000000000..86cc2a390db6
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -0,0 +1,13 @@
+{ appleDerivation, apple_sdk, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurity_cdsa_plugin
+  ];
+  patchPhase = ''
+    cp ${osx_private_sdk}/usr/local/include/sandbox_private.h .
+    substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${apple_sdk.sdk}/include/sandbox.h"'
+    substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
new file mode 100644
index 000000000000..a94b9b455ef9
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -0,0 +1,58 @@
+{ appleDerivation_, applePackage, pkgs, stdenv }:
+name: version: sha256: args: let
+  n = stdenv.lib.removePrefix "lib" name;
+  makeFile = ../. + builtins.toPath "/${name}/GNUmakefile";
+  appleDerivation = appleDerivation_ name version sha256;
+  in applePackage name version sha256 (args // {
+    appleDerivation = a:
+    appleDerivation (stdenv.lib.mergeAttrsConcatenateValues {
+      __impureHostDeps = import ./impure_deps.nix;
+
+      patchPhase = ''
+        # allows including <Security/some-private-header.h>
+        ln -s ${pkgs.darwin.osx_private_sdk}/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+
+        grep -Rl MacErrors.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+            '"${pkgs.darwin.apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+        done || true # grep returns 1 if it can't find the string
+        
+        grep -Rl MacTypes.h . | while read file; do
+          substituteInPlace "''$file" --replace \
+            '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+            '"${pkgs.darwin.apple_sdk.sdk}/include/MacTypes.h"'
+        done || true # grep returns 1 if it can't find the string
+      '';
+      preBuild = ''
+        ln -s lib ${n}
+        makeFlagsArray=(-j''$NIX_BUILD_CORES)
+      '';
+      buildInputs = [
+        pkgs.gnustep-make
+      ];
+      makeFlags = [
+        "-f${makeFile}"
+        "MAKEFILE_NAME=${makeFile}"
+        "GNUSTEP_ABSOLUTE_INSTALL_PATHS=yes"
+        "LIB_LINK_INSTALL_DIR=\$(out)/lib"
+      ];
+      installFlags = [
+        "${n}_INSTALL_DIR=\$(out)/lib"
+        "${n}_HEADER_FILES_INSTALL_DIR=\$(out)/include/${n}"
+        "GNUSTEP_HEADERS="
+      ];
+      NIX_CFLAGS_COMPILE = [
+        "-isystem lib"
+        "-iframework ${pkgs.darwin.Security}/Library/Frameworks"
+        "-I."
+        "-Wno-deprecated-declarations"
+      ];
+      NIX_LDFLAGS = with pkgs.darwin; with apple_sdk.frameworks; [
+        "-L${libobjc}/lib"
+        "-F${Foundation}/Library/Frameworks"
+        "-F${AppKit}/Library/Frameworks"
+        "-no_dtrace_dof"
+      ];
+    } a);
+  })
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
new file mode 100644
index 000000000000..7725b9f3d1a2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/impure_deps.nix
@@ -0,0 +1,129 @@
+# generated using a ruby script
+[
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib"
+  "/System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib"
+  "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD"
+  "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis"
+  "/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox"
+  "/System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit"
+  "/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink"
+  "/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition"
+  "/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio"
+  "/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth"
+  "/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData"
+  "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
+  "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices"
+  "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit"
+  "/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText"
+  "/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo"
+  "/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN"
+  "/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration"
+  "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation"
+  "/System/Library/Frameworks/GSS.framework/Versions/A/GSS"
+  "/System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth"
+  "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit"
+  "/System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib"
+  "/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib"
+  "/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos"
+  "/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS"
+  "/System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory"
+  "/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib"
+  "/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/Frameworks/CoreImage.framework/Versions/A/CoreImage"
+  "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore"
+  "/System/Library/Frameworks/Security.framework/Versions/A/Security"
+  "/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation"
+  "/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement"
+  "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration"
+  "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211"
+  "/System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG"
+  "/System/Library/PrivateFrameworks/AppleVPA.framework/Versions/A/AppleVPA"
+  "/System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup"
+  "/System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary"
+  "/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth"
+  "/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication"
+  "/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI"
+  "/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi"
+  "/System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport"
+  "/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore"
+  "/System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols"
+  "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv"
+  "/System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore"
+  "/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage"
+  "/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal"
+  "/System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices"
+  "/System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling"
+  "/System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport"
+  "/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth"
+  "/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis"
+  "/System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices"
+  "/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing"
+  "/System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore"
+  "/System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication"
+  "/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC"
+  "/System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation"
+  "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Ubiquity"
+  "/System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport"
+  "/usr/lib/libCRFSuite.dylib"
+  "/usr/lib/libOpenScriptingUtil.dylib"
+  "/usr/lib/libarchive.2.dylib"
+  "/usr/lib/libbsm.0.dylib"
+  "/usr/lib/libbz2.1.0.dylib"
+  "/usr/lib/libc++.1.dylib"
+  "/usr/lib/libc++abi.dylib"
+  "/usr/lib/libcmph.dylib"
+  "/usr/lib/libcups.2.dylib"
+  "/usr/lib/libextension.dylib"
+  "/usr/lib/libheimdal-asn1.dylib"
+  "/usr/lib/libiconv.2.dylib"
+  "/usr/lib/libicucore.A.dylib"
+  "/usr/lib/liblangid.dylib"
+  "/usr/lib/liblzma.5.dylib"
+  "/usr/lib/libmecabra.dylib"
+  "/usr/lib/libpam.2.dylib"
+  "/usr/lib/libresolv.9.dylib"
+  "/usr/lib/libsqlite3.dylib"
+  "/usr/lib/libxar.1.dylib"
+  "/usr/lib/libxml2.2.dylib"
+  "/usr/lib/libxslt.1.dylib"
+  "/usr/lib/libz.1.dylib"
+]
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
new file mode 100644
index 000000000000..8830006f00e5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_keychain
+
+security_keychain_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_keychain_HEADER_FILES_DIR = lib
+
+security_keychain_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
new file mode 100644
index 000000000000..de97950b765e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -0,0 +1,47 @@
+{ CF, Security, appleDerivation, apple_sdk, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_ocspd, libsecurity_pkcs12, libsecurity_utilities, libsecurityd, openssl, osx_private_sdk, security_dotmac_tp }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurity_cdsa_utilities
+    libsecurityd
+    CF
+    libsecurity_asn1
+    libsecurity_pkcs12
+    libsecurity_cdsa_utils
+    openssl
+    libsecurity_ocspd
+    security_dotmac_tp
+  ];
+  patchPhase = ''
+    substituteInPlace lib/Keychains.cpp --replace DLDbListCFPref.h DLDBListCFPref.h
+    
+    substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
+    
+    cp ${osx_private_sdk}/usr/include/xpc/private.h xpc
+    cp ${apple_sdk.sdk}/include/xpc/*.h xpc
+    cp ${osx_private_sdk}/usr/local/include/sandbox_private.h lib/sandbox.h
+    
+    substituteInPlace lib/SecItemPriv.h \
+      --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
+      --replace "extern CFTypeRef kSecAttrIsSensitive" "extern const CFTypeRef kSecAttrIsSensitive" \
+      --replace "extern CFTypeRef kSecAttrIsExtractable" "extern const CFTypeRef kSecAttrIsExtractable"
+    
+    substituteInPlace lib/Keychains.cpp --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+    
+    substituteInPlace lib/CertificateValues.cpp --replace \
+      '#include <Security/SecCertificatePriv.h>' ""
+    
+    substituteInPlace lib/DLDBListCFPref.cpp --replace \
+      'dispatch_once_t AppSandboxChecked;' ''$'namespace Security {\ndispatch_once_t AppSandboxChecked;' \
+      --replace 'return mLoginDLDbIdentifier;' 'return mLoginDLDbIdentifier; }' \
+      --replace '_xpc_runtime_is_app_sandboxed()' 'false'
+      # hope that doesn't hurt anything
+
+    substituteInPlace lib/KCEventNotifier.h --replace \
+      'CoreFoundation/CFNotificationCenter.h' \
+      '${apple_sdk.sdk}/Library/Frameworks/CoreFoundation.framework/Versions/A/Headers/CFNotificationCenter.h'
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
new file mode 100644
index 000000000000..119a43621fbb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_mds
+
+security_mds_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_mds_HEADER_FILES_DIR = lib
+
+security_mds_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
new file mode 100644
index 000000000000..cd691f71e95f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_mds/default.nix
@@ -0,0 +1,11 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_filedb, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_cdsa_utilities
+    libsecurity_filedb
+    libsecurity_utilities
+    libsecurity_cdsa_client
+    libsecurityd
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
new file mode 100644
index 000000000000..140c5a909a66
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_ocspd
+
+security_ocspd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_ocspd_HEADER_FILES_DIR = lib
+
+security_ocspd_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
new file mode 100644
index 000000000000..25701442d2b7
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_ocspd/default.nix
@@ -0,0 +1,20 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    bootstrap_cmds
+  ];
+  postUnpack = ''
+    pushd libsecurity*
+    ls -lah
+    mkdir -p lib
+    cp common/* lib
+    cp client/* lib
+    popd
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=. || exit 1
+    cp derived_src/* lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
new file mode 100644
index 000000000000..b2af7e72c41b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_pkcs12
+
+security_pkcs12_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_pkcs12_HEADER_FILES_DIR = lib
+
+security_pkcs12_CC_FILES = $(wildcard lib/*.cpp)
+security_pkcs12_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
new file mode 100644
index 000000000000..f84c2d8963fc
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_pkcs12/default.nix
@@ -0,0 +1,15 @@
+{ appleDerivation, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_utils, libsecurity_keychain, osx_private_sdk }:
+appleDerivation {
+  patchPhase = ''
+    substituteInPlace lib/pkcsoids.h --replace '#error' '#warning'
+  '';
+  preBuild = ''
+    unpackFile ${libsecurity_keychain.src}
+    mv libsecurity_keychain*/lib security_keychain
+  '';
+  buildInputs = [
+    libsecurity_asn1
+    libsecurity_cdsa_utils
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
new file mode 100644
index 000000000000..47a1c609d066
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/GNUmakefile
@@ -0,0 +1,10 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_sd_cspdl
+
+security_sd_cspdl_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_sd_cspdl_HEADER_FILES_DIR = lib
+
+security_sd_cspdl_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
new file mode 100644
index 000000000000..224910916615
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_sd_cspdl/default.nix
@@ -0,0 +1,10 @@
+{ appleDerivation, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_utilities, libsecurityd }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_plugin
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libsecurityd
+    libsecurity_cdsa_client
+  ];
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
new file mode 100644
index 000000000000..d3ba09142c96
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_utilities
+
+security_utilities_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_utilities_HEADER_FILES_DIR = lib
+
+security_utilities_C_FILES = $(wildcard lib/*.c)
+security_utilities_CC_FILES = $(wildcard lib/*.cpp)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
new file mode 100644
index 000000000000..8cc74e2210f9
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -0,0 +1,23 @@
+{ IOKit, appleDerivation, apple_sdk, libauto, libobjc, libsecurity_codesigning, osx_private_sdk, sqlite, stdenv }:
+appleDerivation {
+  buildInputs = [
+    libauto
+    libobjc
+    IOKit
+    sqlite
+    apple_sdk.frameworks.PCSC
+  ];
+  patchPhase = ''
+    substituteInPlace lib/errors.h --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
+      '"MacTypes.h"'
+    substituteInPlace lib/debugging.cpp --replace PATH_MAX 1024
+    substituteInPlace lib/superblob.h --replace 'result->at' 'result->template at'
+    substituteInPlace lib/ccaudit.cpp --replace '<bsm/libbsm.h>' '"bsm/libbsm.h"'
+    
+    cp ${osx_private_sdk}/usr/include/security_utilities/utilities_dtrace.h lib
+    cp -R ${osx_private_sdk}/usr/local/include/bsm lib
+  '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
+    substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
new file mode 100644
index 000000000000..6058043e79f5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/GNUmakefile
@@ -0,0 +1,11 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = securityd
+
+securityd_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+securityd_HEADER_FILES_DIR = lib
+
+securityd_CC_FILES = $(wildcard lib/*.cpp)
+securityd_C_FILES = $(wildcard lib/*.c)
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
new file mode 100644
index 000000000000..d311f6783374
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/default.nix
@@ -0,0 +1,23 @@
+{ appleDerivation, bootstrap_cmds, libsecurity_cdsa_client, libsecurity_cdsa_utilities, libsecurity_utilities, osx_private_sdk }:
+appleDerivation {
+  buildInputs = [
+    libsecurity_cdsa_utilities
+    libsecurity_utilities
+    bootstrap_cmds
+  ];
+  patchPhase = ''
+    unpackFile ${libsecurity_cdsa_client.src}
+    mv libsecurity_cdsa_client*/lib security_cdsa_client
+    ln -s lib securityd_client
+    
+    patch -p1 < ${./xdr-arity.patch}
+  '';
+  preBuild = ''
+    make -f mig/mig.mk SRCROOT=. BUILT_PRODUCTS_DIR=.
+    cp derived_src/* lib
+    rm lib/ucspClientC.c
+  '';
+  postInstall = ''
+    ln -s ''$out/include/securityd ''$out/include/securityd_client
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
new file mode 100644
index 000000000000..5d0328629f19
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurityd/xdr-arity.patch
@@ -0,0 +1,79 @@
+diff --git a/lib/sec_xdr.c b/lib/sec_xdr.c
+index fe5f038..6239b6c 100644
+--- a/lib/sec_xdr.c
++++ b/lib/sec_xdr.c
+@@ -223,7 +223,7 @@ bool_t copyin(void *data, xdrproc_t proc, void** copy, u_int *size)
+     sec_xdrmem_create(&xdr, (char *)xdr_data, length, XDR_ENCODE);
+ 
+     // cast to void* - function can go both ways (xdr->x_op) 
+-    if (proc(&xdr, data)) {
++    if (proc(&xdr, data, 0)) {
+         *copy = xdr_data;
+         if (size) *size = length;
+         return (TRUE);
+@@ -261,7 +261,7 @@ bool_t copyout(const void *copy, u_int size, xdrproc_t proc, void **data, u_int
+     if (!sec_xdr_arena_init(&arena, &xdr, length_out ? length_out : length_required, length_out ? *data : NULL))
+         return (FALSE);
+ 
+-    if (proc(&xdr, data))
++    if (proc(&xdr, data, 0))
+     {
+         *length = length_required;
+         return (TRUE);
+@@ -284,7 +284,7 @@ bool_t copyout_chunked(const void *copy, u_int size, xdrproc_t proc, void **data
+ 
+     void *data_out = NULL;
+ 
+-    if (proc(&xdr, &data_out))
++    if (proc(&xdr, &data_out, 0))
+     {
+         *data = data_out;
+         return (TRUE);
+diff --git a/lib/sec_xdr_array.c b/lib/sec_xdr_array.c
+index 152a71b..e5ec1ad 100644
+--- a/lib/sec_xdr_array.c
++++ b/lib/sec_xdr_array.c
+@@ -147,7 +147,7 @@ sec_xdr_array(XDR *xdrs, uint8_t **addrp, u_int *sizep, u_int maxsize, u_int els
+     for (i = 0; (i < c) && stat; i++) {
+         if ((xdrs->x_op == XDR_DECODE) && sizeof_alloc)
+             memset(obj, 0, elsize);
+-        stat = (*elproc)(xdrs, target);
++        stat = (*elproc)(xdrs, target, 0);
+         if ((xdrs->x_op == XDR_ENCODE) || !sizeof_alloc)
+             target += elsize;
+     }
+diff --git a/lib/sec_xdr_reference.c b/lib/sec_xdr_reference.c
+index a66fb37..ab5b4c4 100644
+--- a/lib/sec_xdr_reference.c
++++ b/lib/sec_xdr_reference.c
+@@ -121,7 +121,7 @@ sec_xdr_reference(XDR *xdrs, uint8_t **pp, u_int size, xdrproc_t proc)
+                 break;
+             }
+ 
+-    stat = (*proc)(xdrs, loc);
++    stat = (*proc)(xdrs, loc, 0);
+ 
+     if (xdrs->x_op == XDR_FREE) {
+         sec_mem_free(xdrs, loc, size);
+diff --git a/lib/sec_xdr_sizeof.c b/lib/sec_xdr_sizeof.c
+index a18bcd0..8c33dbc 100644
+--- a/lib/sec_xdr_sizeof.c
++++ b/lib/sec_xdr_sizeof.c
+@@ -190,7 +190,7 @@ sec_xdr_sizeof_in(func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (x.x_private)
+         free(x.x_private);
+     return (stat == TRUE ? (unsigned) x.x_handy: 0);
+@@ -210,7 +210,7 @@ sec_xdr_sizeof_out(copy, size, func, data)
+ 
+     sec_xdr_arena_allocator_t size_alloc;
+     sec_xdr_arena_init_size_alloc(&size_alloc, &x);
+-    stat = func(&x, data);
++    stat = func(&x, data, 0);
+     if (size_alloc.data)
+         free(size_alloc.data);
+     return (stat == TRUE ? (unsigned long)size_alloc.offset : 0);
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
new file mode 100644
index 000000000000..6f6a50bd57a2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/GNUmakefile
@@ -0,0 +1,8 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+LIBRARY_NAME = security_dotmac_tp
+
+security_dotmac_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
+security_dotmac_tp_HEADER_FILES_DIR = lib
+
+include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
new file mode 100644
index 000000000000..bfbfb945957e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_dotmac_tp/default.nix
@@ -0,0 +1,4 @@
+{ appleDerivation }:
+
+appleDerivation {
+}
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
new file mode 100644
index 000000000000..abe4aa67b143
--- /dev/null
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, binutils-raw, cctools }:
+
+stdenv.mkDerivation {
+  name = "cctools-binutils-darwin";
+  buildCommand = ''
+    mkdir -p $out/bin $out/include
+
+    ln -s ${binutils-raw}/bin/c++filt $out/bin/c++filt
+
+    # We specifically need:
+    # - ld: binutils doesn't provide it on darwin
+    # - as: as above
+    # - ar: the binutils one prodices .a files that the cctools ld doesn't like
+    # - ranlib: for compatibility with ar
+    # - dsymutil: soon going away once it goes into LLVM (this one is fake anyway)
+    # - otool: we use it for some of our name mangling
+    # - install_name_tool: we use it to rewrite stuff in our bootstrap tools
+    # - strip: the binutils one seems to break mach-o files
+    # - lipo: gcc build assumes it exists
+    # - nm: the gnu one doesn't understand many new load commands
+    for i in ar ranlib as dsymutil install_name_tool ld strip otool lipo nm strings size; do
+      ln -sf "${cctools}/bin/$i" "$out/bin/$i"
+    done
+
+    for i in ${binutils-raw}/include/*.h; do
+      ln -s "$i" "$out/include/$(basename $i)"
+    done
+
+    for i in ${cctools}/include/*; do
+      ln -s "$i" "$out/include/$(basename $i)"
+    done
+
+    # FIXME: this will give us incorrect man pages for bits of cctools
+    ln -s ${binutils-raw}/share $out/share
+    ln -s ${binutils-raw}/lib $out/lib
+
+    ln -s ${cctools}/libexec $out/libexec
+  '';
+}
diff --git a/pkgs/os-specific/darwin/osx-private-sdk/default.nix b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
index 85e1dc50f359..febcb6b5d0cd 100644
--- a/pkgs/os-specific/darwin/osx-private-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
@@ -1,34 +1,16 @@
-{ stdenv, fetchFromGitHub, python, osx_sdk }:
+{ stdenv, fetchzip }:
 
-let
-  sdkVersion = "10.9";
-in stdenv.mkDerivation {
-  name = "PrivateMacOSX${sdkVersion}.sdk";
-
-  src = fetchFromGitHub {
-    owner  = "copumpkin";
-    repo   = "OSXPrivateSDK";
-    rev    = "bde9cba13e6ae62a8e4e0f405008ea719526e7ad";
-    sha256 = "1vj3fxwp32irxjk987p7a223sm5bl5rrlajcvgy69k0wb0fp0krc";
-  };
-
-  buildInputs = [ python ];
-
-  configurePhase = "true";
-
-  buildPhase = ''
-    python PrivateSDK.py -i ${osx_sdk}/Developer/SDKs/MacOSX${sdkVersion}.sdk -o PrivateMacOSX${sdkVersion}.sdk
-  '';
-
-  installPhase = ''
-    mkdir -p $out/Developer/SDKs/
-    mv PrivateMacOSX${sdkVersion}.sdk $out/Developer/SDKs
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A private Mac OS ${sdkVersion} SDK, suitable for building many of Apple's open source releases";
-    maintainers = with maintainers; [ copumpkin ];
-    platforms   = platforms.darwin;
-    license     = licenses.unfree;
-  };
+let full = stdenv.lib.overrideDerivation (fetchzip {
+  url = "https://github.com/samdmarshall/OSXPrivateSDK/tarball/69bf3c7f7140ed6ab2b6684b427bd457209858fe";
+  name = "osx-private-sdk-10.9";
+  sha256 = "1agl4kyry6m7yz3sql5mrbvmd1xkmb4nbq976phcpk19inans1zm";
+}) (drv: {
+  postFetch = ''
+    unpackFile() {
+      tar xzf "$1"
+    }
+  '' + drv.postFetch;
+}); in {
+  outPath = "${full}/PrivateSDK10.9";
+  passthru.sdk10 = "${full}/PrivateSDK10.10";
 }
diff --git a/pkgs/os-specific/darwin/osx-sdk/default.nix b/pkgs/os-specific/darwin/osx-sdk/default.nix
index 612bf003743c..875479b4f29d 100644
--- a/pkgs/os-specific/darwin/osx-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-sdk/default.nix
@@ -2,7 +2,7 @@
 
 let
   version = "10.9";
-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
   name = "MacOSX10.9.sdk";
 
   src = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.9.sdk";
@@ -23,4 +23,4 @@ in stdenv.mkDerivation {
     platforms   = platforms.darwin;
     license     = licenses.unfree;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/os-specific/darwin/security-tool/GNUmakefile b/pkgs/os-specific/darwin/security-tool/GNUmakefile
new file mode 100644
index 000000000000..ae25f6a67c02
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/GNUmakefile
@@ -0,0 +1,14 @@
+include $(GNUSTEP_MAKEFILES)/common.make
+
+TOOL_NAME = security
+security_C_FILES = $(wildcard *.c)
+security_CC_FILES = $(wildcard *.cpp)
+
+security_LDFLAGS = \
+	-lsecurity_cdsa_utilities -lsecurity_cdsa_utils -lsecurity_keychain -lsecurity_cssm \
+	-lsecurity_cdsa_client -lsecurity_utilities -lsecurity_asn1 -lsecurity_mds \
+	-lsecurity_cdsa_plugin -lsecurity_pkcs12 -lsecurity_apple_csp -lsecurity_apple_cspdl \
+	-lsecurity_apple_file_dl -lsecurity_apple_x509_cl -lsecurity_apple_x509_tp \
+	-lsecurity_sd_cspdl -lsecurity_filedb -lsecurityd -framework Security -framework PCSC
+
+include $(GNUSTEP_MAKEFILES)/tool.make
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
index 49d61f392c5e..7cff4fc3eef4 100644
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -1,30 +1,90 @@
-{ stdenv, fetchurl, osx_private_sdk }:
+{ CoreServices, Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk, fetchurl, gnustep-make, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl, libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb, libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl, libsecurity_utilities, libsecurityd, osx_private_sdk, stdenv }:
 
 stdenv.mkDerivation rec {
-	version = "55115";
-  name    = "SecurityTool-${version}";
+  version = "55115";
+  name = "SecurityTool-${version}";
 
   src = fetchurl {
     url = "http://opensource.apple.com/tarballs/SecurityTool/SecurityTool-${version}.tar.gz";
     sha256 = "0apcz4vy2z5645jhrs60wj3w27mncjjqv42h5lln36g6qs2n9113";
   };
 
-  configurePhase = "";
+  patchPhase = ''
+    # copied from libsecurity_generic
+    ln -s ${osx_private_sdk}/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
 
-  # Someday we shall purge this impurity!
-  buildPhase = ''
-    /usr/bin/xcodebuild SDKROOT=${osx_private_sdk}/Developer/SDKs/PrivateMacOSX10.9.sdk/
+    substituteInPlace cmsutil.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
+    substituteInPlace createFVMaster.c --replace \
+      '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
+      '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
   '';
 
-  installPhase = ''
-    mkdir -p $out/bin/
-    cp build/Release/security $out/bin
+  postUnpack = ''
+    unpackFile ${Security.src}
+    cp Security-*/utilities/src/fileIo.c SecurityTool*
+    cp Security-*/utilities/src/fileIo.h SecurityTool*
+  '';
+
+  preBuild = ''
+    makeFlagsArray=(-j''$NIX_BUILD_CORES)
+  '';
+
+  NIX_LDFLAGS = "-no_dtrace_dof";
+
+  makeFlags = "-f ${./GNUmakefile} MAKEFILE_NAME=${./GNUmakefile}";
+
+  installFlags = [
+    "security_INSTALL_DIR=\$(out)/bin"
+  ];
+
+  propagatedBuildInputs = [ GSS Kerberos Security PCSC Foundation ];
+
+  __propagatedImpureHostDeps = [ "/System/Library/Keychains" ];
+
+  buildInputs = [
+    gnustep-make
+    libsecurity_asn1
+    libsecurity_utilities
+    libsecurity_cdsa_utilities
+    libobjc
+    libsecurity_cdsa_client
+    libsecurity_keychain
+    libsecurity_cssm
+    libsecurity_cdsa_utils
+    libsecurity_mds
+    libsecurity_cdsa_plugin
+    libsecurity_apple_csp
+    libsecurity_apple_cspdl
+    libsecurity_apple_file_dl
+    libsecurity_apple_x509_cl
+    libsecurity_apple_x509_tp
+    libsecurity_pkcs12
+    libsecurity_sd_cspdl
+    libsecurity_filedb
+    libsecurityd
+    makeWrapper
+  ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-F${Security}/Library/Frameworks"
+    "-F${PCSC}/Library/Frameworks"
+    "-Wno-deprecated-declarations"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/security --set DYLD_INSERT_LIBRARIES /usr/lib/libsqlite3.dylib
   '';
 
   meta = with stdenv.lib; {
     description = "Command line interface to Mac OS X keychains and Security framework";
-    maintainers = with maintainers; [ copumpkin ];
-    platforms   = platforms.darwin;
-    license     = licenses.apsl20;
+    maintainers = with maintainers; [
+      copumpkin
+      joelteon
+    ];
+    platforms = platforms.darwin;
+    license = licenses.apsl20;
   };
-}
\ No newline at end of file
+}
+
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 1932fc9d11f7..1db5967aab54 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -26,6 +26,12 @@ stdenv.mkDerivation {
     "hwdb_bin=/var/lib/udev/hwdb.bin"
     "udevrulesdir=/etc/udev/rules.d"
     ];
+
+  preInstall = ''
+    # Disable install-exec-hook target as it conflicts with our move-sbin setup-hook
+    sed -i 's;$(MAKE) $(AM_MAKEFLAGS) install-exec-hook;$(MAKE) $(AM_MAKEFLAGS);g' src/udev/Makefile
+  '';
+
   installFlags =
     [
     "localstatedir=$(TMPDIR)/var"
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index f26c72bd6e5b..483cdef079de 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -1,16 +1,18 @@
 { stdenv, fetchurl, zlib }:
 
+let version = "2.0.10"; in
 stdenv.mkDerivation rec {
-  name = "kexec-tools-2.0.9";
+  name = "kexec-tools-${version}";
 
   src = fetchurl {
     url = "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz";
-    sha256 = "0wag8pxn13i0j91x2bszpmi5i88xnndcmqz1w5a0jdbnxff4mqwa";
+    sha256 = "18x134nj37j1rshn5hxbyhdcv9kk5sfshs72alkip1icf54l2gp2";
   };
 
   buildInputs = [ zlib ];
 
   meta = with stdenv.lib; {
+    inherit version;
     homepage = http://horms.net/projects/kexec/kexec-tools;
     description = "Tools related to the kexec Linux feature";
     platforms = with platforms; linux;
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f18cc6fa6130..bde6686ff0a9 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     ''
       # FIXME: patch this in systemd properly (and send upstream).
       # FIXME: use sulogin from util-linux once updated.
-      for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.m4.in src/journal/cat.c src/core/shutdown.c src/nspawn/nspawn.c; do
+      for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/core/shutdown.c src/nspawn/nspawn.c; do
         test -e $i
         substituteInPlace $i \
           --replace /usr/bin/getent ${stdenv.glibc}/bin/getent \
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 710a01ed03d2..158ff2299b18 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -12,7 +12,6 @@ stdenv.mkDerivation rec {
 
   postInstall =
     ''
-      rm $out/sbin/update-usbids.sh
       substituteInPlace $out/bin/lsusb.py \
         --replace /usr/share/usb.ids ${hwdata}/data/hwdata/usb.ids
     '';
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 8f8ed2541af3..ccfe396bf554 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -107,10 +107,6 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    # Copy the wpa_priv binary which is not installed
-    mkdir -p $out/bin
-    cp -v wpa_priv $out/bin
-
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
@@ -119,6 +115,7 @@ stdenv.mkDerivation rec {
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/etc/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
+    rm $out/share/man/man8/wpa_priv.8
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 1f89e959c4bf..1cdf7ad2ed00 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     export SAMBA_LIBS="$(find $out -type f -name \*.so -exec dirname {} \; | sort | uniq)"
-    read -r -d "" SCRIPT << EOF
+    read -r -d "" SCRIPT << EOF || true
     [ -z "\$SAMBA_LIBS" ] && exit 1;
     BIN='{}';
     OLD_LIBS="\$(patchelf --print-rpath "\$BIN" 2>/dev/null | tr ':' '\n')";
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index cad03cbd1ffc..27383721cebb 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -49,9 +49,10 @@ stdenv.mkDerivation rec {
     "-DWITH_PARTITION_STORAGE_ENGINE=1"
     "-DWITHOUT_EXAMPLE_STORAGE_ENGINE=1"
     "-DWITHOUT_FEDERATED_STORAGE_ENGINE=1"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "-DWITHOUT_OQGRAPH_STORAGE_ENGINE=1";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "-DWITHOUT_OQGRAPH_STORAGE_ENGINE=1"
+    "-DWITHOUT_TOKUDB=1"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index 6ba50d245075..f5b8803a98a3 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -9,8 +9,10 @@ postInstall() {
     if test -n "$origPostInstall"; then eval "$origPostInstall"; fi
 
     local r p requires
+    set +o pipefail
     requires=$(grep "Requires:" $out/lib/pkgconfig/*.pc | \
         sed "s/Requires://" | sed "s/,/ /g")
+    set -o pipefail
 
     echo "propagating requisites $requires"
 
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index b7e5eef6d56b..f0fdb67f30e2 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -545,11 +545,11 @@ let
   }) // {inherit ;};
 
   kbproto = (mkDerivation "kbproto" {
-    name = "kbproto-1.0.6";
+    name = "kbproto-1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/kbproto-1.0.6.tar.bz2;
-      sha256 = "0yal11hhpiisy3w8wmacsdzzzcnc3xwnswxz8k7zri40xc5aqz03";
+      url = mirror://xorg/individual/proto/kbproto-1.0.7.tar.bz2;
+      sha256 = "0mxqj1pzhjpz9495vrjnpi10kv2n1s4vs7di0sh3yvipfq5j30pq";
     };
     buildInputs = [pkgconfig ];
   }) // {inherit ;};
@@ -565,11 +565,11 @@ let
   }) // {inherit applewmproto libX11 libXext xextproto ;};
 
   libFS = (mkDerivation "libFS" {
-    name = "libFS-1.0.6";
+    name = "libFS-1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libFS-1.0.6.tar.bz2;
-      sha256 = "1mxfsvj9m3pn8cdkcn4kg190zp665mf4pv0083g6xykvsgxzq1wh";
+      url = mirror://xorg/individual/lib/libFS-1.0.7.tar.bz2;
+      sha256 = "1wy4km3qwwajbyl8y9pka0zwizn7d9pfiyjgzba02x3a083lr79f";
     };
     buildInputs = [pkgconfig fontsproto xproto xtrans ];
   }) // {inherit fontsproto xproto xtrans ;};
@@ -635,11 +635,11 @@ let
   }) // {inherit xproto ;};
 
   libXaw = (mkDerivation "libXaw" {
-    name = "libXaw-1.0.12";
+    name = "libXaw-1.0.13";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXaw-1.0.12.tar.bz2;
-      sha256 = "1xnv7jy86j9vhmw74frkzcraynqbw1p1s79jasargsgwfi433z4n";
+      url = mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2;
+      sha256 = "1kdhxplwrn43d9jp3v54llp05kwx210lrsdvqb6944jp29rhdy4f";
     };
     buildInputs = [pkgconfig libX11 libXext xextproto libXmu libXpm xproto libXt ];
   }) // {inherit libX11 libXext xextproto libXmu libXpm xproto libXt ;};
@@ -774,22 +774,32 @@ let
     buildInputs = [pkgconfig libX11 libXext xextproto xproto libXt ];
   }) // {inherit libX11 libXext xextproto xproto libXt ;};
 
+  libXpresent = (mkDerivation "libXpresent" {
+    name = "libXpresent-1.0.0";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2;
+      sha256 = "12kvvar3ihf6sw49h6ywfdiwmb8i1gh8wasg1zhzp6hs2hay06n1";
+    };
+    buildInputs = [pkgconfig presentproto libX11 xextproto xproto ];
+  }) // {inherit presentproto libX11 xextproto xproto ;};
+
   libXrandr = (mkDerivation "libXrandr" {
-    name = "libXrandr-1.4.2";
+    name = "libXrandr-1.5.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXrandr-1.4.2.tar.bz2;
-      sha256 = "1b95p3l84ppv6j7dbbmg0zrz6k8xdwvnag1l6ajm3gk9qwdb79ya";
+      url = mirror://xorg/individual/lib/libXrandr-1.5.0.tar.bz2;
+      sha256 = "0n6ycs1arf4wb1cal9il6v7vbxbf21qhs9sbfl8xndgwnxclk1kg";
     };
     buildInputs = [pkgconfig randrproto renderproto libX11 libXext xextproto xproto libXrender ];
   }) // {inherit randrproto renderproto libX11 libXext xextproto xproto libXrender ;};
 
   libXrender = (mkDerivation "libXrender" {
-    name = "libXrender-0.9.8";
+    name = "libXrender-0.9.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXrender-0.9.8.tar.bz2;
-      sha256 = "0qpwyjhbpp734vnhca992pjh4w7ijslidkzx1pcwbbk000pv050x";
+      url = mirror://xorg/individual/lib/libXrender-0.9.9.tar.bz2;
+      sha256 = "06myx7044qqdswxndsmd82fpp670klnizkgzdm194h51h1wyabzw";
     };
     buildInputs = [pkgconfig renderproto libX11 xproto ];
   }) // {inherit renderproto libX11 xproto ;};
@@ -805,11 +815,11 @@ let
   }) // {inherit resourceproto libX11 libXext xextproto xproto ;};
 
   libXt = (mkDerivation "libXt" {
-    name = "libXt-1.1.4";
+    name = "libXt-1.1.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXt-1.1.4.tar.bz2;
-      sha256 = "0myxwbx9ylam5x3ia5b5f4x8azcqdm420h9ad1r4hrgmi2lrffl4";
+      url = mirror://xorg/individual/lib/libXt-1.1.5.tar.bz2;
+      sha256 = "06lz6i7rbrp19kgikpaz4c97fw7n31k2h2aiikczs482g2zbdvj6";
     };
     buildInputs = [pkgconfig libICE kbproto libSM libX11 xproto ];
   }) // {inherit libICE kbproto libSM libX11 xproto ;};
@@ -885,21 +895,21 @@ let
   }) // {inherit dmxproto libX11 libXext xextproto ;};
 
   libfontenc = (mkDerivation "libfontenc" {
-    name = "libfontenc-1.1.2";
+    name = "libfontenc-1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libfontenc-1.1.2.tar.bz2;
-      sha256 = "0qign0ivqk166l9yfd51gw9lbhgs718bcrmvc40yicjr6gnyz959";
+      url = mirror://xorg/individual/lib/libfontenc-1.1.3.tar.bz2;
+      sha256 = "08gxmrhgw97mv0pvkfmd46zzxrn6zdw4g27073zl55gwwqq8jn3h";
     };
     buildInputs = [pkgconfig xproto zlib ];
   }) // {inherit xproto zlib ;};
 
   libpciaccess = (mkDerivation "libpciaccess" {
-    name = "libpciaccess-0.13.3";
+    name = "libpciaccess-0.13.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libpciaccess-0.13.3.tar.bz2;
-      sha256 = "1qy2i776jb7912dxqylv59p41sa0hw8lmn7asd3ywvp0wk56rmvc";
+      url = mirror://xorg/individual/lib/libpciaccess-0.13.4.tar.bz2;
+      sha256 = "1krgryi9ngjr66242v0v5mczihgv0y7rrvx0563arr318mjn9y07";
     };
     buildInputs = [pkgconfig zlib ];
   }) // {inherit zlib ;};
@@ -925,11 +935,11 @@ let
   }) // {inherit libxslt libpthreadstubs python libXau xcbproto libXdmcp ;};
 
   libxkbfile = (mkDerivation "libxkbfile" {
-    name = "libxkbfile-1.0.8";
+    name = "libxkbfile-1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/libxkbfile-1.0.8.tar.bz2;
-      sha256 = "0flg5arw6n3njagmsi4i4l0zl5bfx866a1h9ydc3bi1pqlclxaca";
+      url = mirror://xorg/individual/lib/libxkbfile-1.0.9.tar.bz2;
+      sha256 = "0smimr14zvail7ar68n7spvpblpdnih3jxrva7cpa6cn602px0ai";
     };
     buildInputs = [pkgconfig kbproto libX11 ];
   }) // {inherit kbproto libX11 ;};
@@ -1015,11 +1025,11 @@ let
   }) // {inherit libXau ;};
 
   randrproto = (mkDerivation "randrproto" {
-    name = "randrproto-1.4.1";
+    name = "randrproto-1.5.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/proto/randrproto-1.4.1.tar.bz2;
-      sha256 = "1p7155hsp48b0sjm4rc67wz6y1nxqrq69vyw0sjxh8h6pcpcngal";
+      url = mirror://xorg/individual/proto/randrproto-1.5.0.tar.bz2;
+      sha256 = "0s4496z61y5q45q20gldwpf788b9nsa8hb13gnck1mwwwwrmarsc";
     };
     buildInputs = [pkgconfig ];
   }) // {inherit ;};
@@ -1075,31 +1085,31 @@ let
   }) // {inherit xproto ;};
 
   setxkbmap = (mkDerivation "setxkbmap" {
-    name = "setxkbmap-1.3.0";
+    name = "setxkbmap-1.3.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/setxkbmap-1.3.0.tar.bz2;
-      sha256 = "1inygpvlgc6vr5h9laxw9lnvafnccl3fy0g5n9ll28iq3yfmqc1x";
+      url = mirror://xorg/individual/app/setxkbmap-1.3.1.tar.bz2;
+      sha256 = "1qfk097vjysqb72pq89h0la3462kbb2dh1d11qzs2fr67ybb7pd9";
     };
     buildInputs = [pkgconfig libX11 libxkbfile ];
   }) // {inherit libX11 libxkbfile ;};
 
   smproxy = (mkDerivation "smproxy" {
-    name = "smproxy-1.0.5";
+    name = "smproxy-1.0.6";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/smproxy-1.0.5.tar.bz2;
-      sha256 = "02fn5wa1gs2jap6sr9j9yk6zsvz82j8l61pf74iyqwa99q4wnb67";
+      url = mirror://xorg/individual/app/smproxy-1.0.6.tar.bz2;
+      sha256 = "0rkjyzmsdqmlrkx8gy2j4q6iksk58hcc92xzdprkf8kml9ar3wbc";
     };
     buildInputs = [pkgconfig libICE libSM libXmu libXt ];
   }) // {inherit libICE libSM libXmu libXt ;};
 
   twm = (mkDerivation "twm" {
-    name = "twm-1.0.8";
+    name = "twm-1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/twm-1.0.8.tar.bz2;
-      sha256 = "0i1ff8h2gh1ab311da5dlhl0nrma0qbrk403ymzi4cnnacikaq3n";
+      url = mirror://xorg/individual/app/twm-1.0.9.tar.bz2;
+      sha256 = "02iicvhkp3i7q5rliyymiq9bppjr0pzfs6rgb78kppryqdx1cxf5";
     };
     buildInputs = [pkgconfig libICE libSM libX11 libXext libXmu xproto libXt ];
   }) // {inherit libICE libSM libX11 libXext libXmu xproto libXt ;};
@@ -1135,14 +1145,14 @@ let
   }) // {inherit ;};
 
   x11perf = (mkDerivation "x11perf" {
-    name = "x11perf-1.5.4";
+    name = "x11perf-1.6.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/x11perf-1.5.4.tar.bz2;
-      sha256 = "111iwpxhnxjiq44w96zf0kszg5zpgv1g3ayx18v4nhdzl9bqivi4";
+      url = mirror://xorg/individual/app/x11perf-1.6.0.tar.bz2;
+      sha256 = "0lb716yfdb8f11h4cz93d1bapqdxf1xplsb21kbp4xclq7g9hw78";
     };
-    buildInputs = [pkgconfig libX11 libXext libXft libXmu libXrender ];
-  }) // {inherit libX11 libXext libXft libXmu libXrender ;};
+    buildInputs = [pkgconfig libX11 libXext libXft libXmu xproto libXrender ];
+  }) // {inherit libX11 libXext libXft libXmu xproto libXrender ;};
 
   xauth = (mkDerivation "xauth" {
     name = "xauth-1.0.9";
@@ -1204,6 +1214,16 @@ let
     buildInputs = [pkgconfig gperf m4 libxcb xcbutilimage xcbutilrenderutil xproto ];
   }) // {inherit gperf m4 libxcb xcbutilimage xcbutilrenderutil xproto ;};
 
+  xcbutilerrors = (mkDerivation "xcbutilerrors" {
+    name = "xcb-util-errors-1.0";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = http://xcb.freedesktop.org/dist/xcb-util-errors-1.0.tar.bz2;
+      sha256 = "158rm913dg3hxrrhyvvxr8bcm0pjy5jws70dhy2s12w1krv829k8";
+    };
+    buildInputs = [pkgconfig gperf m4 libxcb xcbproto xproto ];
+  }) // {inherit gperf m4 libxcb xcbproto xproto ;};
+
   xcbutilimage = (mkDerivation "xcbutilimage" {
     name = "xcb-util-image-0.4.0";
     builder = ./builder.sh;
@@ -1265,15 +1285,25 @@ let
   }) // {inherit ;};
 
   xcmsdb = (mkDerivation "xcmsdb" {
-    name = "xcmsdb-1.0.4";
+    name = "xcmsdb-1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xcmsdb-1.0.4.tar.bz2;
-      sha256 = "03ms731l3kvaldq7ycbd30j6134b61i3gbll4b2gl022wyzbjq74";
+      url = mirror://xorg/individual/app/xcmsdb-1.0.5.tar.bz2;
+      sha256 = "1ik7gzlp2igz183x70883000ygp99r20x3aah6xhaslbpdhm6n75";
     };
     buildInputs = [pkgconfig libX11 ];
   }) // {inherit libX11 ;};
 
+  xcompmgr = (mkDerivation "xcompmgr" {
+    name = "xcompmgr-1.1.7";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = mirror://xorg/individual/app/xcompmgr-1.1.7.tar.bz2;
+      sha256 = "14k89mz13jxgp4h2pz0yq0fbkw1lsfcb3acv8vkknc9i4ld9n168";
+    };
+    buildInputs = [pkgconfig libXcomposite libXdamage libXext libXfixes libXrender ];
+  }) // {inherit libXcomposite libXdamage libXext libXfixes libXrender ;};
+
   xcursorgen = (mkDerivation "xcursorgen" {
     name = "xcursorgen-1.0.6";
     builder = ./builder.sh;
@@ -1305,31 +1335,31 @@ let
   }) // {inherit libX11 libXau libXaw libXdmcp libXext libXft libXinerama libXmu libXpm libXt ;};
 
   xdpyinfo = (mkDerivation "xdpyinfo" {
-    name = "xdpyinfo-1.3.1";
+    name = "xdpyinfo-1.3.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xdpyinfo-1.3.1.tar.bz2;
-      sha256 = "154b29zlrq33lmni883jgwyrb2kx7z8h52jx1s3ys5x5d582iydf";
+      url = mirror://xorg/individual/app/xdpyinfo-1.3.2.tar.bz2;
+      sha256 = "0ldgrj4w2fa8jng4b3f3biaj0wyn8zvya88pnk70d7k12pcqw8rh";
     };
     buildInputs = [pkgconfig libdmx libX11 libxcb libXcomposite libXext libXi libXinerama xproto libXrender libXtst libXxf86dga libXxf86misc libXxf86vm ];
   }) // {inherit libdmx libX11 libxcb libXcomposite libXext libXi libXinerama xproto libXrender libXtst libXxf86dga libXxf86misc libXxf86vm ;};
 
   xdriinfo = (mkDerivation "xdriinfo" {
-    name = "xdriinfo-1.0.4";
+    name = "xdriinfo-1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xdriinfo-1.0.4.tar.bz2;
-      sha256 = "076bjix941znyjmh3j5jjsnhp2gv2iq53d0ks29mvvv87cyy9iim";
+      url = mirror://xorg/individual/app/xdriinfo-1.0.5.tar.bz2;
+      sha256 = "0681d0y8liqakkpz7mmsf689jcxrvs5291r20qi78mc9xxk3gfjc";
     };
     buildInputs = [pkgconfig glproto libX11 ];
   }) // {inherit glproto libX11 ;};
 
   xev = (mkDerivation "xev" {
-    name = "xev-1.2.1";
+    name = "xev-1.2.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xev-1.2.1.tar.bz2;
-      sha256 = "0hv296mysglcgkx6lj1wxc23kshb2kix1a8yqppxj5vz16mpzw8i";
+      url = mirror://xorg/individual/app/xev-1.2.2.tar.bz2;
+      sha256 = "0krivhrxpq6719103r541xpi3i3a0y15f7ypc4lnrx8sdhmfcjnr";
     };
     buildInputs = [pkgconfig libX11 xproto libXrandr ];
   }) // {inherit libX11 xproto libXrandr ;};
@@ -1405,21 +1435,21 @@ let
   }) // {inherit inputproto kbproto xorgserver xproto ;};
 
   xf86inputkeyboard = (mkDerivation "xf86inputkeyboard" {
-    name = "xf86-input-keyboard-1.8.0";
+    name = "xf86-input-keyboard-1.8.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-input-keyboard-1.8.0.tar.bz2;
-      sha256 = "0nyb61w30z32djrllgr2s1i13di3vsl6hg4pqjhxdal71971ria1";
+      url = mirror://xorg/individual/driver/xf86-input-keyboard-1.8.1.tar.bz2;
+      sha256 = "04d27kwqq03fc26an6051hs3i0bff8albhnngzyd59wxpwwzzj0s";
     };
     buildInputs = [pkgconfig inputproto xorgserver xproto ];
   }) // {inherit inputproto xorgserver xproto ;};
 
   xf86inputlibinput = (mkDerivation "xf86inputlibinput" {
-    name = "xf86-input-libinput-0.8.0";
+    name = "xf86-input-libinput-0.10.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-input-libinput-0.8.0.tar.bz2;
-      sha256 = "0fm4vrkw7azipbnwvc2l18g65z77pllsznaajd8q3zpg9ycb0li1";
+      url = mirror://xorg/individual/driver/xf86-input-libinput-0.10.0.tar.bz2;
+      sha256 = "1w1v83qlr7n4iqgd7grmhx0gbz1fhsnpk88j4a136dk4xmc069x4";
     };
     buildInputs = [pkgconfig inputproto xorgserver xproto ];
   }) // {inherit inputproto xorgserver xproto ;};
@@ -1455,11 +1485,11 @@ let
   }) // {inherit inputproto randrproto xorgserver xproto ;};
 
   xf86inputvoid = (mkDerivation "xf86inputvoid" {
-    name = "xf86-input-void-1.4.0";
+    name = "xf86-input-void-1.4.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-input-void-1.4.0.tar.bz2;
-      sha256 = "01bmk324fq48wydvy1qrnxbw6qz0fjd0i80g0n4cqr1c4mjmif9a";
+      url = mirror://xorg/individual/driver/xf86-input-void-1.4.1.tar.bz2;
+      sha256 = "171k8b8s42s3w73l7ln9jqwk88w4l7r1km2blx1vy898c854yvpr";
     };
     buildInputs = [pkgconfig xorgserver xproto ];
   }) // {inherit xorgserver xproto ;};
@@ -1505,11 +1535,11 @@ let
   }) // {inherit fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ;};
 
   xf86videocirrus = (mkDerivation "xf86videocirrus" {
-    name = "xf86-video-cirrus-1.5.2";
+    name = "xf86-video-cirrus-1.5.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-cirrus-1.5.2.tar.bz2;
-      sha256 = "1mycqgjp18b6adqj2h90vp324xh8ysyi5migfmjc914vbnkf2q9k";
+      url = mirror://xorg/individual/driver/xf86-video-cirrus-1.5.3.tar.bz2;
+      sha256 = "1asifc6ld2g9kap15vfhvsvyl69lj7pw3d9ra9mi4najllh7pj7d";
     };
     buildInputs = [pkgconfig fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ];
   }) // {inherit fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ;};
@@ -1535,11 +1565,11 @@ let
   }) // {inherit fontsproto libpciaccess randrproto renderproto videoproto xorgserver xproto ;};
 
   xf86videogeode = (mkDerivation "xf86videogeode" {
-    name = "xf86-video-geode-2.11.16";
+    name = "xf86-video-geode-2.11.17";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-geode-2.11.16.tar.bz2;
-      sha256 = "19y13xl7yfrgyis92rmxi0ld95ajgr5il0n9j1dridwzw9aizz1q";
+      url = mirror://xorg/individual/driver/xf86-video-geode-2.11.17.tar.bz2;
+      sha256 = "0h9w6cfj7s86rg72c6qci8f733hg4g7paan5fwmmj7p74ckd9d07";
     };
     buildInputs = [pkgconfig fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ];
   }) // {inherit fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ;};
@@ -1595,11 +1625,11 @@ let
   }) // {inherit dri2proto dri3proto fontsproto libdrm libpng udev libpciaccess presentproto randrproto renderproto libX11 xcbutil libxcb libXcursor libXdamage libXext xextproto xf86driproto libXfixes xorgserver xproto libXrandr libXrender libxshmfence libXtst libXvMC ;};
 
   xf86videomach64 = (mkDerivation "xf86videomach64" {
-    name = "xf86-video-mach64-6.9.4";
+    name = "xf86-video-mach64-6.9.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-mach64-6.9.4.tar.bz2;
-      sha256 = "0pl582vnc6hdxqhf5c0qdyanjqxb4crnhqlmxxml5a60syw0iwcp";
+      url = mirror://xorg/individual/driver/xf86-video-mach64-6.9.5.tar.bz2;
+      sha256 = "07xlf5nsjm0x18ij5gyy4lf8hwpl10i8chi3skpqjh84drdri61y";
     };
     buildInputs = [pkgconfig fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ];
   }) // {inherit fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ;};
@@ -1625,11 +1655,11 @@ let
   }) // {inherit fontsproto libdrm udev libpciaccess randrproto libX11 xextproto xorgserver xproto ;};
 
   xf86videoneomagic = (mkDerivation "xf86videoneomagic" {
-    name = "xf86-video-neomagic-1.2.8";
+    name = "xf86-video-neomagic-1.2.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-neomagic-1.2.8.tar.bz2;
-      sha256 = "0x48sxs1p3kmwk3pq1j7vl93y59gdmgkq1x5xbnh0yal0angdash";
+      url = mirror://xorg/individual/driver/xf86-video-neomagic-1.2.9.tar.bz2;
+      sha256 = "1whb2kgyqaxdjim27ya404acz50izgmafwnb6y9m89q5n6b97y3j";
     };
     buildInputs = [pkgconfig fontsproto libpciaccess xorgserver xproto ];
   }) // {inherit fontsproto libpciaccess xorgserver xproto ;};
@@ -1685,31 +1715,31 @@ let
   }) // {inherit fontsproto libdrm udev libpciaccess randrproto renderproto videoproto xf86dgaproto xorgserver xproto ;};
 
   xf86videor128 = (mkDerivation "xf86videor128" {
-    name = "xf86-video-r128-6.9.2";
+    name = "xf86-video-r128-6.10.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-r128-6.9.2.tar.bz2;
-      sha256 = "1q3fsc603k2yinphx5rrcl5356qkpywwz8axlw277l2231gjjbcb";
+      url = mirror://xorg/individual/driver/xf86-video-r128-6.10.0.tar.bz2;
+      sha256 = "0g9m1n5184h05mq14vb6k288zm6g81a9m048id00l8v8f6h33mc0";
     };
     buildInputs = [pkgconfig fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xf86miscproto xorgserver xproto ];
   }) // {inherit fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xf86miscproto xorgserver xproto ;};
 
   xf86videosavage = (mkDerivation "xf86videosavage" {
-    name = "xf86-video-savage-2.3.7";
+    name = "xf86-video-savage-2.3.8";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-savage-2.3.7.tar.bz2;
-      sha256 = "0i2aqp68rfkrz9c1p6d7ny9x7bjrlnby7q56zf01fb12r42l4784";
+      url = mirror://xorg/individual/driver/xf86-video-savage-2.3.8.tar.bz2;
+      sha256 = "0qzshncynjdmyhavhqw4x5ha3gwbygi0zbsy158fpg1jcnla9kpx";
     };
     buildInputs = [pkgconfig fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ];
   }) // {inherit fontsproto libdrm libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ;};
 
   xf86videosiliconmotion = (mkDerivation "xf86videosiliconmotion" {
-    name = "xf86-video-siliconmotion-1.7.7";
+    name = "xf86-video-siliconmotion-1.7.8";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.7.tar.bz2;
-      sha256 = "1an321kqvsxq0z35acwl99lc8hpdkayw0q180744ypcl8ffvbf47";
+      url = mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.8.tar.bz2;
+      sha256 = "1sqv0y31mi4zmh9yaxqpzg7p8y2z01j6qys433hb8n4yznllkm79";
     };
     buildInputs = [pkgconfig fontsproto libpciaccess videoproto xextproto xorgserver xproto ];
   }) // {inherit fontsproto libpciaccess videoproto xextproto xorgserver xproto ;};
@@ -1845,21 +1875,31 @@ let
   }) // {inherit libXfont xproto xtrans ;};
 
   xgamma = (mkDerivation "xgamma" {
-    name = "xgamma-1.0.5";
+    name = "xgamma-1.0.6";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = mirror://xorg/individual/app/xgamma-1.0.6.tar.bz2;
+      sha256 = "1lr2nb1fhg5fk2fchqxdxyl739602ggwhmgl2wiv5c8qbidw7w8f";
+    };
+    buildInputs = [pkgconfig libX11 xproto libXxf86vm ];
+  }) // {inherit libX11 xproto libXxf86vm ;};
+
+  xgc = (mkDerivation "xgc" {
+    name = "xgc-1.0.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xgamma-1.0.5.tar.bz2;
-      sha256 = "0463sawps86jnxn121ramsz4sicy3az5wa5wsq4rqm8dm3za48p3";
+      url = mirror://xorg/individual/app/xgc-1.0.5.tar.bz2;
+      sha256 = "0pigvjd3i9fchmj1inqy151aafz3dr0vq1h2zizdb2imvadqv0hl";
     };
-    buildInputs = [pkgconfig libX11 libXxf86vm ];
-  }) // {inherit libX11 libXxf86vm ;};
+    buildInputs = [pkgconfig libXaw libXt ];
+  }) // {inherit libXaw libXt ;};
 
   xhost = (mkDerivation "xhost" {
-    name = "xhost-1.0.6";
+    name = "xhost-1.0.7";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xhost-1.0.6.tar.bz2;
-      sha256 = "1hlxm0is9nks1cx033s1733kkib9ivx2bxa3pb9yayqavwibkxd6";
+      url = mirror://xorg/individual/app/xhost-1.0.7.tar.bz2;
+      sha256 = "16n26xw6l01zq31d4qvsaz50misvizhn7iihzdn5f7s72pp1krlk";
     };
     buildInputs = [pkgconfig libX11 libXau libXmu xproto ];
   }) // {inherit libX11 libXau libXmu xproto ;};
@@ -1905,24 +1945,24 @@ let
   }) // {inherit libX11 libxkbfile xproto ;};
 
   xkbevd = (mkDerivation "xkbevd" {
-    name = "xkbevd-1.1.3";
+    name = "xkbevd-1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xkbevd-1.1.3.tar.bz2;
-      sha256 = "05h1xcnbalndbrryyqs8wzy9h3wz655vc0ymhlk2q4aik17licjm";
+      url = mirror://xorg/individual/app/xkbevd-1.1.4.tar.bz2;
+      sha256 = "0sprjx8i86ljk0l7ldzbz2xlk8916z5zh78cafjv8k1a63js4c14";
     };
     buildInputs = [pkgconfig libX11 libxkbfile ];
   }) // {inherit libX11 libxkbfile ;};
 
   xkbprint = (mkDerivation "xkbprint" {
-    name = "xkbprint-1.0.3";
+    name = "xkbprint-1.0.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xkbprint-1.0.3.tar.bz2;
-      sha256 = "1h4jb3gjrbjp79h5gcgkjvdxykcy2bmq03smpls820c8wnw6v17s";
+      url = mirror://xorg/individual/app/xkbprint-1.0.4.tar.bz2;
+      sha256 = "04iyv5z8aqhabv7wcpvbvq0ji0jrz1666vw6gvxkvl7szswalgqb";
     };
-    buildInputs = [pkgconfig libX11 libxkbfile ];
-  }) // {inherit libX11 libxkbfile ;};
+    buildInputs = [pkgconfig libX11 libxkbfile xproto ];
+  }) // {inherit libX11 libxkbfile xproto ;};
 
   xkbutils = (mkDerivation "xkbutils" {
     name = "xkbutils-1.0.4";
@@ -1955,11 +1995,11 @@ let
   }) // {inherit libX11 libXmu xproto ;};
 
   xlsatoms = (mkDerivation "xlsatoms" {
-    name = "xlsatoms-1.1.1";
+    name = "xlsatoms-1.1.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xlsatoms-1.1.1.tar.bz2;
-      sha256 = "1y9nfl8s7njxbnci8c20j986xixharasgg40vdw92y593j6dk2rv";
+      url = mirror://xorg/individual/app/xlsatoms-1.1.2.tar.bz2;
+      sha256 = "196yjik910xsr7dwy8daa0amr0r22ynfs360z0ndp9mx7mydrra7";
     };
     buildInputs = [pkgconfig libxcb ];
   }) // {inherit libxcb ;};
@@ -1974,6 +2014,26 @@ let
     buildInputs = [pkgconfig libxcb ];
   }) // {inherit libxcb ;};
 
+  xlsfonts = (mkDerivation "xlsfonts" {
+    name = "xlsfonts-1.0.5";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = mirror://xorg/individual/app/xlsfonts-1.0.5.tar.bz2;
+      sha256 = "1yi774g6r1kafsbnxbkrwyndd3i60362ck1fps9ywz076pn5naa0";
+    };
+    buildInputs = [pkgconfig libX11 xproto ];
+  }) // {inherit libX11 xproto ;};
+
+  xmag = (mkDerivation "xmag" {
+    name = "xmag-1.0.6";
+    builder = ./builder.sh;
+    src = fetchurl {
+      url = mirror://xorg/individual/app/xmag-1.0.6.tar.bz2;
+      sha256 = "0qg12ifbbk9n8fh4jmyb625cknn8ssj86chd6zwdiqjin8ivr8l7";
+    };
+    buildInputs = [pkgconfig libX11 libXaw libXmu libXt ];
+  }) // {inherit libX11 libXaw libXmu libXt ;};
+
   xmessage = (mkDerivation "xmessage" {
     name = "xmessage-1.0.4";
     builder = ./builder.sh;
@@ -1985,11 +2045,11 @@ let
   }) // {inherit libXaw libXt ;};
 
   xmodmap = (mkDerivation "xmodmap" {
-    name = "xmodmap-1.0.8";
+    name = "xmodmap-1.0.9";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xmodmap-1.0.8.tar.bz2;
-      sha256 = "1hwzm54m4ng09ls9i4bq0x84zbyhamgzasgrvhxxp8jqk34f7qpg";
+      url = mirror://xorg/individual/app/xmodmap-1.0.9.tar.bz2;
+      sha256 = "0y649an3jqfq9klkp9y5gj20xb78fw6g193f5mnzpl0hbz6fbc5p";
     };
     buildInputs = [pkgconfig libX11 xproto ];
   }) // {inherit libX11 xproto ;};
@@ -2005,24 +2065,24 @@ let
   }) // {inherit ;};
 
   xorgdocs = (mkDerivation "xorgdocs" {
-    name = "xorg-docs-1.7";
+    name = "xorg-docs-1.7.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/xorg-docs-1.7.tar.bz2;
-      sha256 = "0prphdba6kgr1bxk7r07wxxx6x6pqjw6prr5qclypsb5sf5r3cdr";
+      url = mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2;
+      sha256 = "0jrc4jmb4raqawx0j9jmhgasr0k6sxv0bm2hrxjh9hb26iy6gf14";
     };
     buildInputs = [pkgconfig ];
   }) // {inherit ;};
 
   xorgserver = (mkDerivation "xorgserver" {
-    name = "xorg-server-1.16.4";
+    name = "xorg-server-1.17.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/xserver/xorg-server-1.16.4.tar.bz2;
-      sha256 = "0wf8xykcjhvpk9ppjcixvf60p6kkyrpmfj0z29d93a8kjb6f3dmb";
+      url = mirror://xorg/individual/xserver/xorg-server-1.17.2.tar.bz2;
+      sha256 = "14vr4mm0x94a9bd3sfx9mdh8qhvk48zcml3i8q1wbwi84xhj04gn";
     };
-    buildInputs = [pkgconfig dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt ];
-  }) // {inherit dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt ;};
+    buildInputs = [pkgconfig dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt xcbutilrenderutil];
+  }) // {inherit dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt xcbutilrenderutil;};
 
   xorgsgmldoctools = (mkDerivation "xorgsgmldoctools" {
     name = "xorg-sgml-doctools-1.11";
@@ -2125,11 +2185,11 @@ let
   }) // {inherit ;};
 
   xvinfo = (mkDerivation "xvinfo" {
-    name = "xvinfo-1.1.2";
+    name = "xvinfo-1.1.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xvinfo-1.1.2.tar.bz2;
-      sha256 = "1qsh7fszi727l3vwlaf9pb7bpikdv15smrx5qhlgg3kqzl7xklzf";
+      url = mirror://xorg/individual/app/xvinfo-1.1.3.tar.bz2;
+      sha256 = "1sz5wqhxd1fqsfi1w5advdlwzkizf2fgl12hdpk66f7mv9l8pflz";
     };
     buildInputs = [pkgconfig libX11 xproto libXv ];
   }) // {inherit libX11 xproto libXv ;};
diff --git a/pkgs/servers/x11/xorg/extra.list b/pkgs/servers/x11/xorg/extra.list
index f0bf8bf73782..8a445a69c69c 100644
--- a/pkgs/servers/x11/xorg/extra.list
+++ b/pkgs/servers/x11/xorg/extra.list
@@ -7,3 +7,4 @@ http://xcb.freedesktop.org/dist/xcb-util-image-0.4.0.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2
+http://xcb.freedesktop.org/dist/xcb-util-errors-1.0.tar.bz2
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index b5b58ab320c4..0fc70fb6e172 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -173,6 +173,9 @@ in
     patchPhase = "sed -i '/USE_GETTEXT_TRUE/d' sxpm/Makefile.in cxpm/Makefile.in";
   };
 
+  libXpresent = attrs: attrs
+    // { buildInputs = with xorg; attrs.buildInputs ++ [ libXext libXfixes libXrandr ]; };
+
   setxkbmap = attrs: attrs // {
     postInstall =
       ''
diff --git a/pkgs/servers/x11/xorg/tarballs-7.7.list b/pkgs/servers/x11/xorg/tarballs-7.7.list
index f02dd1e89f03..932d4f1236f2 100644
--- a/pkgs/servers/x11/xorg/tarballs-7.7.list
+++ b/pkgs/servers/x11/xorg/tarballs-7.7.list
@@ -49,19 +49,19 @@ mirror://xorg/X11R7.7/src/everything/font-xfree86-type1-1.0.4.tar.bz2
 mirror://xorg/individual/proto/glproto-1.4.17.tar.bz2
 mirror://xorg/individual/app/iceauth-1.0.7.tar.bz2
 mirror://xorg/individual/proto/inputproto-2.3.1.tar.bz2
-mirror://xorg/X11R7.7/src/everything/kbproto-1.0.6.tar.bz2
+mirror://xorg/individual/proto/kbproto-1.0.7.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libAppleWM-1.4.1.tar.bz2
 mirror://xorg/individual/lib/libdmx-1.1.3.tar.bz2
 mirror://xorg/individual/lib/libxshmfence-1.2.tar.bz2
-mirror://xorg/individual/lib/libfontenc-1.1.2.tar.bz2
-mirror://xorg/individual/lib/libFS-1.0.6.tar.bz2
+mirror://xorg/individual/lib/libfontenc-1.1.3.tar.bz2
+mirror://xorg/individual/lib/libFS-1.0.7.tar.bz2
 mirror://xorg/individual/lib/libICE-1.0.9.tar.bz2
-mirror://xorg/individual/lib/libpciaccess-0.13.3.tar.bz2
+mirror://xorg/individual/lib/libpciaccess-0.13.4.tar.bz2
 mirror://xorg/individual/lib/libSM-1.2.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libX11-1.6.3.tar.bz2
 mirror://xorg/individual/lib/libXau-1.0.8.tar.bz2
-mirror://xorg/individual/lib/libXaw-1.0.12.tar.bz2
+mirror://xorg/individual/lib/libXaw-1.0.13.tar.bz2
 mirror://xorg/individual/lib/libXcomposite-0.4.4.tar.bz2
 mirror://xorg/individual/lib/libXcursor-1.1.14.tar.bz2
 mirror://xorg/individual/lib/libXdamage-1.1.4.tar.bz2
@@ -72,14 +72,15 @@ mirror://xorg/individual/lib/libXfont-1.5.1.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.2.tar.bz2
 mirror://xorg/individual/lib/libXi-1.7.4.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.3.tar.bz2
-mirror://xorg/X11R7.7/src/everything/libxkbfile-1.0.8.tar.bz2
+mirror://xorg/individual/lib/libxkbfile-1.0.9.tar.bz2
 mirror://xorg/individual/lib/libXmu-1.1.2.tar.bz2
 mirror://xorg/individual/lib/libXpm-3.5.11.tar.bz2
-mirror://xorg/individual/lib/libXrandr-1.4.2.tar.bz2
-mirror://xorg/individual/lib/libXrender-0.9.8.tar.bz2
+mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
+mirror://xorg/individual/lib/libXrandr-1.5.0.tar.bz2
+mirror://xorg/individual/lib/libXrender-0.9.9.tar.bz2
 mirror://xorg/individual/lib/libXres-1.0.7.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libXScrnSaver-1.2.2.tar.bz2
-mirror://xorg/individual/lib/libXt-1.1.4.tar.bz2
+mirror://xorg/individual/lib/libXt-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.2.tar.bz2
 mirror://xorg/individual/lib/libXv-1.0.10.tar.bz2
 mirror://xorg/individual/lib/libXvMC-1.0.9.tar.bz2
@@ -89,65 +90,67 @@ mirror://xorg/X11R7.7/src/everything/luit-1.1.1.tar.bz2
 mirror://xorg/individual/util/makedepend-1.0.5.tar.bz2
 mirror://xorg/X11R7.7/src/everything/mkfontdir-1.0.7.tar.bz2
 mirror://xorg/individual/app/mkfontscale-1.1.2.tar.bz2
-mirror://xorg/individual/proto/randrproto-1.4.1.tar.bz2
+mirror://xorg/individual/proto/randrproto-1.5.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/recordproto-1.14.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/renderproto-0.11.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/resourceproto-1.2.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/scrnsaverproto-1.2.2.tar.bz2
 mirror://xorg/individual/app/sessreg-1.1.0.tar.bz2
-mirror://xorg/X11R7.7/src/everything/setxkbmap-1.3.0.tar.bz2
-mirror://xorg/X11R7.7/src/everything/smproxy-1.0.5.tar.bz2
+mirror://xorg/individual/app/setxkbmap-1.3.1.tar.bz2
+mirror://xorg/individual/app/smproxy-1.0.6.tar.bz2
+mirror://xorg/individual/app/twm-1.0.9.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.0.tar.bz2
 mirror://xorg/individual/proto/videoproto-2.3.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/windowswmproto-1.0.4.tar.bz2
-mirror://xorg/X11R7.7/src/everything/x11perf-1.5.4.tar.bz2
+mirror://xorg/individual/app/x11perf-1.6.0.tar.bz2
 mirror://xorg/individual/app/xauth-1.0.9.tar.bz2
 mirror://xorg/individual/app/xbacklight-1.2.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xbitmaps-1.1.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xcmiscproto-1.2.2.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xcmsdb-1.0.4.tar.bz2
+mirror://xorg/individual/app/xcmsdb-1.0.5.tar.bz2
+mirror://xorg/individual/app/xcompmgr-1.1.7.tar.bz2
 mirror://xorg/individual/app/xcursorgen-1.0.6.tar.bz2
 mirror://xorg/individual/data/xcursor-themes-1.0.4.tar.bz2
-mirror://xorg/individual/app/xdpyinfo-1.3.1.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xdriinfo-1.0.4.tar.bz2
-mirror://xorg/individual/app/xev-1.2.1.tar.bz2
+mirror://xorg/individual/app/xdpyinfo-1.3.2.tar.bz2
+mirror://xorg/individual/app/xdriinfo-1.0.5.tar.bz2
+mirror://xorg/individual/app/xev-1.2.2.tar.bz2
 mirror://xorg/individual/proto/xextproto-7.3.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86bigfontproto-1.2.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86dgaproto-2.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86driproto-2.1.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-evdev-2.9.2.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.2.tar.bz2
-mirror://xorg/individual/driver/xf86-input-keyboard-1.8.0.tar.bz2
-mirror://xorg/individual/driver/xf86-input-libinput-0.8.0.tar.bz2
+mirror://xorg/individual/driver/xf86-input-keyboard-1.8.1.tar.bz2
+mirror://xorg/individual/driver/xf86-input-libinput-0.10.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-mouse-1.9.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-synaptics-1.8.2.tar.bz2
 mirror://xorg/individual/driver/xf86-input-vmmouse-13.0.0.tar.bz2
-mirror://xorg/individual/driver/xf86-input-void-1.4.0.tar.bz2
+mirror://xorg/individual/driver/xf86-input-void-1.4.1.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ark-0.7.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ast-0.98.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ati-7.5.0.tar.bz2
 mirror://xorg/individual/driver/glamor-egl-0.6.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-nouveau-1.0.11.tar.bz2
-mirror://xorg/individual/driver/xf86-video-cirrus-1.5.2.tar.bz2
+mirror://xorg/individual/driver/xf86-video-cirrus-1.5.3.tar.bz2
 mirror://xorg/individual/driver/xf86-video-dummy-0.3.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-fbdev-0.4.4.tar.bz2
-mirror://xorg/individual/driver/xf86-video-geode-2.11.16.tar.bz2
+mirror://xorg/individual/driver/xf86-video-geode-2.11.17.tar.bz2
 mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-glint-1.2.8.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i128-1.3.6.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i740-1.3.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2
-mirror://xorg/individual/driver/xf86-video-mach64-6.9.4.tar.bz2
+mirror://xorg/individual/driver/xf86-video-mach64-6.9.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mga-1.6.4.tar.bz2
 mirror://xorg/individual/driver/xf86-video-modesetting-0.9.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-qxl-0.1.3.tar.bz2
-mirror://xorg/individual/driver/xf86-video-neomagic-1.2.8.tar.bz2
+mirror://xorg/individual/driver/xf86-video-neomagic-1.2.9.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86-video-newport-0.2.4.tar.bz2
 mirror://xorg/individual/driver/xf86-video-nv-2.1.20.tar.bz2
 mirror://xorg/individual/driver/xf86-video-openchrome-0.3.3.tar.bz2
-mirror://xorg/individual/driver/xf86-video-r128-6.9.2.tar.bz2
-mirror://xorg/individual/driver/xf86-video-savage-2.3.7.tar.bz2
-mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.7.tar.bz2
+mirror://xorg/individual/driver/xf86-video-r128-6.10.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-savage-2.3.8.tar.bz2
+mirror://xorg/individual/driver/xf86-video-siliconmotion-1.7.8.tar.bz2
 mirror://xorg/individual/driver/xf86-video-sis-0.10.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-suncg6-1.1.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-sunffb-1.2.2.tar.bz2
@@ -160,19 +163,22 @@ mirror://xorg/individual/driver/xf86-video-vmware-13.1.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.5.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xf86vidmodeproto-2.3.1.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xgamma-1.0.5.tar.bz2
-mirror://xorg/individual/app/xhost-1.0.6.tar.bz2
+mirror://xorg/individual/app/xgamma-1.0.6.tar.bz2
+mirror://xorg/individual/app/xgc-1.0.5.tar.bz2
+mirror://xorg/individual/app/xhost-1.0.7.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xineramaproto-1.2.1.tar.bz2
 mirror://xorg/individual/app/xinput-1.6.1.tar.bz2
 mirror://xorg/individual/app/xkbcomp-1.3.0.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xkbevd-1.1.3.tar.bz2
+mirror://xorg/individual/app/xkbevd-1.1.4.tar.bz2
 mirror://xorg/individual/app/xkbutils-1.0.4.tar.bz2
 mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.11.tar.bz2
 mirror://xorg/individual/app/xkill-1.0.4.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xlsatoms-1.1.1.tar.bz2
+mirror://xorg/individual/app/xlsatoms-1.1.2.tar.bz2
 mirror://xorg/individual/app/xlsclients-1.1.3.tar.bz2
-mirror://xorg/individual/app/xmodmap-1.0.8.tar.bz2
-mirror://xorg/X11R7.7/src/everything/xorg-docs-1.7.tar.bz2
+mirror://xorg/individual/app/xlsfonts-1.0.5.tar.bz2
+mirror://xorg/individual/app/xmag-1.0.6.tar.bz2
+mirror://xorg/individual/app/xmodmap-1.0.9.tar.bz2
+mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
 mirror://xorg/individual/xserver/xorg-server-1.16.4.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xpr-1.0.4.tar.bz2
@@ -184,8 +190,8 @@ mirror://xorg/individual/app/xrefresh-1.0.5.tar.bz2
 mirror://xorg/individual/app/xset-1.2.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xsetroot-1.1.0.tar.bz2
 mirror://xorg/individual/lib/xtrans-1.3.5.tar.bz2
-mirror://xorg/individual/app/xvinfo-1.1.2.tar.bz2
+mirror://xorg/individual/app/xvinfo-1.1.3.tar.bz2
 mirror://xorg/individual/app/xwd-1.0.6.tar.bz2
 mirror://xorg/individual/app/xwininfo-1.1.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xwud-1.0.4.tar.bz2
-mirror://xorg/individual/app/xkbprint-1.0.3.tar.bz2
+mirror://xorg/individual/app/xkbprint-1.0.4.tar.bz2
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index f43a9c671604..729fcc2e3447 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -20,7 +20,7 @@ overrideDerivation xorgserver (oldAttrs: {
     "--with-default-font-path="
     "--with-xkb-bin-directory=${xkbcomp}/bin"
     "--with-xkb-path=${xkeyboard_config}/etc/X11/xkb"
-    "--with-xkb-output=$out/share/X11/xkb/compiled"
+    "--with-xkb-output=$(out)/share/X11/xkb/compiled"
   ];
 
   postInstall = ''
diff --git a/pkgs/shells/bash/bash-4.3-patches.nix b/pkgs/shells/bash/bash-4.3-patches.nix
index 49360bd9a026..cd085f787006 100644
--- a/pkgs/shells/bash/bash-4.3-patches.nix
+++ b/pkgs/shells/bash/bash-4.3-patches.nix
@@ -34,4 +34,10 @@ patch: [
 (patch "031" "07d62bl3z7qa8v6kgk47vzzazw563mlk9zhrsr4xsbqgvmcrylnd")
 (patch "032" "0jjgapfq4qhmndfrw8c3q3lva8xjdhlbd9cc631v41b0kb95g4w8")
 (patch "033" "05ma5rlxiadnfh925p4y7s0vvk917kmsdb1mfdx05gizl63pfapv")
+(patch "034" "12gq9whkq3naa3iy7c7x5pfpvrg7d0kwqld8609zxphhy424ysgi")
+(patch "035" "1qy1jflmbazjykq766gwabkaiswnx7pwa66whqiny0w02zjqa39p")
+(patch "036" "0z6jbyy70lfdm6d3x0sbazbqdxb3xnpn9bmz7madpvrnbd284pxc")
+(patch "037" "04sqr8zkl6s5fccfvb775ppn3ldij5imria9swc39aq0fkfp1w9k")
+(patch "038" "0rv3g14mpgv8br267bf7rmgqlgwnc4v6g3g8y0sjba571i8amgmd")
+(patch "039" "1v3l3vkc3g2b6fjycqwlakr8xhiw6bmw6q0zd6bi0m0m4bnxr55b")
 ]
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ac396ecdf12b..9ad2c8504d1a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -31,7 +31,7 @@ rec {
       shell        = "/bin/bash";
       initialPath  = [ bootstrapTools ];
       fetchurlBoot = fetchurl;
-      cc           = "/no-such-path";
+      cc           = null;
     };
   };
 
@@ -106,7 +106,7 @@ rec {
       inherit system config;
       inherit (stage1.stdenv) shell fetchurlBoot preHook cc;
 
-      initialPath = [ stage1.pkgs.xz ] ++ stage1.stdenv.initialPath;
+      initialPath = [ stage1.pkgs.xz stage1.pkgs.gnused ] ++ stage1.stdenv.initialPath;
     };
     pkgs = allPackages {
       inherit system platform;
diff --git a/pkgs/stdenv/darwin/trivial-bootstrap.sh b/pkgs/stdenv/darwin/trivial-bootstrap.sh
index 0915b378d4f0..487f14886587 100644
--- a/pkgs/stdenv/darwin/trivial-bootstrap.sh
+++ b/pkgs/stdenv/darwin/trivial-bootstrap.sh
@@ -12,6 +12,7 @@ cd $out/bin
 ln -s $mkdir
 ln -s /bin/sh
 ln -s /bin/cp
+ln -s /bin/dd
 ln -s /bin/mv
 ln -s /bin/rm
 ln -s /bin/ls
@@ -63,4 +64,4 @@ ln -s /usr/bin/which
 ln -s /usr/bin/install
 ln -s /usr/bin/basename
 ln -s /usr/bin/dirname
-ln -s /usr/bin/readlink
\ No newline at end of file
+ln -s /usr/bin/readlink
diff --git a/pkgs/stdenv/default.nix b/pkgs/stdenv/default.nix
index 545a3d748eb1..71bdc3e8f829 100644
--- a/pkgs/stdenv/default.nix
+++ b/pkgs/stdenv/default.nix
@@ -39,6 +39,12 @@ rec {
   # Darwin standard environment.
   stdenvDarwin = (import ./darwin { inherit system allPackages platform config;}).stdenvDarwin;
 
+  # Pure Darwin standard environment. Allows building with the sandbox enabled. To use,
+  # you can add this to your nixpkgs config:
+  #
+  #   replaceStdenv = {pkgs}: pkgs.allStdenvs.stdenvDarwinPure
+  stdenvDarwinPure = (import ./pure-darwin { inherit system allPackages platform config;}).stage5;
+
   # Select the appropriate stdenv for the platform `system'.
   stdenv =
     if system == "i686-linux" then stdenvLinux else
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 863acc31a615..fe7bec54ba02 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -10,6 +10,8 @@ let lib = import ../../../lib; in lib.makeOverridable (
 , setupScript ? ./setup.sh
 
 , extraBuildInputs ? []
+, __stdenvImpureHostDeps ? []
+, __extraImpureHostDeps ? []
 }:
 
 let
@@ -19,6 +21,8 @@ let
   whitelist = config.whitelistedLicenses or [];
   blacklist = config.blacklistedLicenses or [];
 
+  ifDarwin = attrs: if system == "x86_64-darwin" then attrs else {};
+
   onlyLicenses = list:
     lib.lists.all (license:
       let l = lib.licenses.${license.shortName or "BROKEN"} or false; in
@@ -130,8 +134,23 @@ let
       assert licenseAllowed attrs;
 
       lib.addPassthru (derivation (
-        (removeAttrs attrs ["meta" "passthru" "crossAttrs" "pos"])
-        //
+        (removeAttrs attrs
+          ["meta" "passthru" "crossAttrs" "pos"
+           "__impureHostDeps" "__propagatedImpureHostDeps"])
+        // (let
+          buildInputs = attrs.buildInputs or [];
+          nativeBuildInputs = attrs.nativeBuildInputs or [];
+          propagatedBuildInputs = attrs.propagatedBuildInputs or [];
+          propagatedNativeBuildInputs = attrs.propagatedNativeBuildInputs or [];
+          crossConfig = attrs.crossConfig or null;
+
+          __impureHostDeps = attrs.__impureHostDeps or [];
+          __propagatedImpureHostDeps = attrs.__propagatedImpureHostDeps or [];
+
+          # TODO: remove lib.unique once nix has a list canonicalization primitive
+          computedImpureHostDeps           = lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or []) (extraBuildInputs ++ buildInputs ++ nativeBuildInputs));
+          computedPropagatedImpureHostDeps = lib.unique (lib.concatMap (input: input.__propagatedImpureHostDeps or []) (propagatedBuildInputs ++ propagatedNativeBuildInputs));
+        in
         {
           builder = attrs.realBuilder or shell;
           args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
@@ -147,7 +166,15 @@ let
           nativeBuildInputs = nativeBuildInputs ++ (if crossConfig == null then buildInputs else []);
           propagatedNativeBuildInputs = propagatedNativeBuildInputs ++
             (if crossConfig == null then propagatedBuildInputs else []);
-        })) (
+        } // ifDarwin {
+          __impureHostDeps = computedImpureHostDeps ++ computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps ++ __impureHostDeps ++ __extraImpureHostDeps ++ [
+            "/dev/zero"
+            "/dev/random"
+            "/dev/urandom"
+            "/bin/sh"
+          ];
+          __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
+        }))) (
       {
         # The meta attribute is passed in the resulting attribute set,
         # but it's not part of the actual derivation, i.e., it's not
@@ -179,6 +206,9 @@ let
       setup = setupScript;
 
       inherit preHook initialPath shell defaultNativeBuildInputs;
+    }
+    // ifDarwin {
+      __impureHostDeps = __stdenvImpureHostDeps;
     })
 
     // rec {
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 75be719c2b95..75cc86934806 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -19,7 +19,7 @@ runHook() {
     if [[ "$hookName" =~ Hook$ ]]; then var+=s; else var+=Hooks; fi
     eval "local -a dummy=(\"\${$var[@]}\")"
     for hook in "_callImplicitHook 0 $hookName" "${dummy[@]}"; do
-        if ! _eval "$hook" "$@"; then return 1; fi
+        _eval "$hook" "$@"
     done
     return 0
 }
@@ -73,6 +73,35 @@ _eval() {
 
 
 ######################################################################
+# Logging.
+
+nestingLevel=0
+
+startNest() {
+    nestingLevel=$(($nestingLevel + 1))
+    echo -en "\033[$1p"
+}
+
+stopNest() {
+    nestingLevel=$(($nestingLevel - 1))
+    echo -en "\033[q"
+}
+
+header() {
+    startNest "$2"
+    echo "$1"
+}
+
+# Make sure that even when we exit abnormally, the original nesting
+# level is properly restored.
+closeNest() {
+    while [ $nestingLevel -gt 0 ]; do
+        stopNest
+    done
+}
+
+
+######################################################################
 # Error handling.
 
 exitHandler() {
@@ -193,7 +222,7 @@ runHook addInputsHook
 
 # Recursively find all build inputs.
 findInputs() {
-    local pkg=$1
+    local pkg="$1"
     local var=$2
     local propagatedBuildInputsFile=$3
 
@@ -205,17 +234,22 @@ findInputs() {
 
     eval $var="'${!var} $pkg '"
 
-    if [ -f $pkg ]; then
-        source $pkg
+    if ! [ -e "$pkg" ]; then
+        echo "build input $pkg does not exist" >&2
+        exit 1
+    fi
+
+    if [ -f "$pkg" ]; then
+        source "$pkg"
     fi
 
-    if [ -f $pkg/nix-support/setup-hook ]; then
-        source $pkg/nix-support/setup-hook
+    if [ -f "$pkg/nix-support/setup-hook" ]; then
+        source "$pkg/nix-support/setup-hook"
     fi
 
-    if [ -f $pkg/nix-support/$propagatedBuildInputsFile ]; then
-        for i in $(cat $pkg/nix-support/$propagatedBuildInputsFile); do
-            findInputs $i $var $propagatedBuildInputsFile
+    if [ -f "$pkg/nix-support/$propagatedBuildInputsFile" ]; then
+        for i in $(cat "$pkg/nix-support/$propagatedBuildInputsFile"); do
+            findInputs "$i" $var $propagatedBuildInputsFile
         done
     fi
 }
@@ -409,32 +443,6 @@ substituteAllInPlace() {
 # What follows is the generic builder.
 
 
-nestingLevel=0
-
-startNest() {
-    nestingLevel=$(($nestingLevel + 1))
-    echo -en "\033[$1p"
-}
-
-stopNest() {
-    nestingLevel=$(($nestingLevel - 1))
-    echo -en "\033[q"
-}
-
-header() {
-    startNest "$2"
-    echo "$1"
-}
-
-# Make sure that even when we exit abnormally, the original nesting
-# level is properly restored.
-closeNest() {
-    while [ $nestingLevel -gt 0 ]; do
-        stopNest
-    done
-}
-
-
 # This function is useful for debugging broken Nix builds.  It dumps
 # all environment variables to a file `env-vars' in the build
 # directory.  If the build fails and the `-K' option is used, you can
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 722d40bf7fbe..12fc3fed5a5a 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -86,7 +86,7 @@ rec {
         };
 
         cc = if isNull gccPlain
-             then "/no-such-path"
+             then null
              else lib.makeOverridable (import ../../build-support/cc-wrapper) {
           nativeTools = false;
           nativeLibc = false;
@@ -202,7 +202,7 @@ rec {
     coreutils = bootstrapTools;
     name = "bootstrap-gcc-wrapper";
 
-    overrides = pkgs: {
+    overrides = pkgs: rec {
       inherit (stage2.pkgs) binutils glibc perl patchelf linuxHeaders;
       # Link GCC statically against GMP etc.  This makes sense because
       # these builds of the libraries are only used by GCC, so it
@@ -210,9 +210,15 @@ rec {
       gmp = pkgs.gmp.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
       mpfr = pkgs.mpfr.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
       libmpc = pkgs.libmpc.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
-      isl = pkgs.isl.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
-      cloog = pkgs.cloog.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
-      gccPlain = pkgs.gcc.cc;
+      isl_0_11 = pkgs.isl_0_11.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
+      cloog_0_18_0 = pkgs.cloog_0_18_0.override {
+        stdenv = pkgs.makeStaticLibraries pkgs.stdenv;
+        isl = isl_0_11;
+      };
+      gccPlain = pkgs.gcc.cc.override {
+        isl = isl_0_11;
+        cloog = cloog_0_18_0;
+      };
     };
     extraBuildInputs = [ stage2.pkgs.patchelf stage2.pkgs.paxctl ];
   };
diff --git a/pkgs/stdenv/native/default.nix b/pkgs/stdenv/native/default.nix
index 5390907928de..bd90d580d3f5 100644
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@@ -98,7 +98,7 @@ rec {
 
 
   stdenvBoot0 = makeStdenv {
-    cc = "/no-such-path";
+    cc = null;
     fetchurl = null;
   };
 
diff --git a/pkgs/stdenv/pure-darwin/default.nix b/pkgs/stdenv/pure-darwin/default.nix
new file mode 100644
index 000000000000..92c6f321d36b
--- /dev/null
+++ b/pkgs/stdenv/pure-darwin/default.nix
@@ -0,0 +1,299 @@
+{ system      ? builtins.currentSystem
+, allPackages ? import ../../top-level/all-packages.nix
+, platform    ? null
+, config      ? {}
+}:
+
+let
+  # libSystem and its transitive dependencies. Get used to this; it's a recurring theme in darwin land
+  libSystemClosure = [
+    "/usr/lib/libSystem.dylib"
+    "/usr/lib/libSystem.B.dylib"
+    "/usr/lib/libobjc.A.dylib"
+    "/usr/lib/libobjc.dylib"
+    "/usr/lib/libauto.dylib"
+    "/usr/lib/libc++abi.dylib"
+    "/usr/lib/libc++.1.dylib"
+    "/usr/lib/libDiagnosticMessagesClient.dylib"
+    "/usr/lib/system"
+  ];
+
+  fetch = { file, sha256 }: derivation ((import <nix/fetchurl.nix> {
+    url = "https://dl.dropboxusercontent.com/u/2857322/${file}";
+    inherit sha256;
+    executable = true;
+  }).drvAttrs // {
+    __impureHostDeps = libSystemClosure;
+  });
+
+  bootstrapFiles = {
+    sh    = fetch { file = "sh";    sha256 = "1qakpg37vl61jnkplz13m3g1csqr85cg8ybp6jwiv6apmg26isnm"; };
+    bzip2 = fetch { file = "bzip2"; sha256 = "1gxa67255q9v00j1vn1mzyrnbwys2g1102cx02vpcyvvrl4vqxr0"; };
+    mkdir = fetch { file = "mkdir"; sha256 = "1yfl8w65ksji7fggrbvqxw8lp0gm02qilk11n9axj2jxay53ngvg"; };
+    cpio  = fetch { file = "cpio";  sha256 = "0nssyg19smgcblwq1mfcw4djbd85md84d2f093qcqkbigdjg484b"; };
+  };
+  tarball = fetch { file = "bootstrap-tools.9.cpio.bz2"; sha256 = "0fd79k7gy3z3sba5w4f4lnrcpiwff31vw02480x1pdry8bbgbf2j"; };
+in rec {
+  allPackages = import ../../top-level/all-packages.nix;
+
+  commonPreHook = ''
+    export NIX_ENFORCE_PURITY=1
+    export NIX_IGNORE_LD_THROUGH_GCC=1
+    stripAllFlags=" " # the Darwin "strip" command doesn't know "-s"
+    export MACOSX_DEPLOYMENT_TARGET=10.7
+    export SDKROOT=
+    export CMAKE_OSX_ARCHITECTURES=x86_64
+  '';
+
+  # The one dependency of /bin/sh :(
+  binShClosure = [ "/usr/lib/libncurses.5.4.dylib" ];
+
+  bootstrapTools = derivation rec {
+    inherit system tarball;
+
+    name    = "bootstrap-tools";
+    builder = bootstrapFiles.sh; # Not a filename! Attribute 'sh' on bootstrapFiles
+    args    = [ ./unpack-bootstrap-tools.sh ];
+
+    inherit (bootstrapFiles) mkdir bzip2 cpio;
+
+    __impureHostDeps  = binShClosure ++ libSystemClosure;
+  };
+
+  stageFun = step: last: {shell             ? "${bootstrapTools}/bin/sh",
+                          overrides         ? (pkgs: {}),
+                          extraPreHook      ? "",
+                          extraBuildInputs  ? with last.pkgs; [ xz darwin.CF libcxx ],
+                          extraInitialPath  ? [],
+                          allowedRequisites ? null}:
+    let
+      thisStdenv = import ../generic {
+        inherit system config shell extraBuildInputs allowedRequisites;
+
+        name = "stdenv-darwin-boot-${toString step}";
+
+        cc = if isNull last then "/dev/null" else import ../../build-support/cc-wrapper {
+          inherit shell;
+          inherit (last) stdenv;
+          inherit (last.pkgs.darwin) dyld;
+
+          nativeTools  = true;
+          nativePrefix = bootstrapTools;
+          nativeLibc   = false;
+          libc         = last.pkgs.darwin.Libsystem;
+          cc           = { name = "clang-9.9.9"; outPath = bootstrapTools; };
+        };
+
+        preHook = stage0.stdenv.lib.optionalString (shell == "${bootstrapTools}/bin/sh") ''
+          # Don't patch #!/interpreter because it leads to retained
+          # dependencies on the bootstrapTools in the final stdenv.
+          dontPatchShebangs=1
+        '' + ''
+          ${commonPreHook}
+          ${extraPreHook}
+        '';
+        initialPath  = extraInitialPath ++ [ bootstrapTools ];
+        fetchurlBoot = import ../../build-support/fetchurl {
+          stdenv = stage0.stdenv;
+          curl   = bootstrapTools;
+        };
+
+        # The stdenvs themselves don't use mkDerivation, so I need to specify this here
+        __stdenvImpureHostDeps = binShClosure ++ libSystemClosure;
+        __extraImpureHostDeps  = binShClosure ++ libSystemClosure;
+
+        extraAttrs = { inherit platform; };
+        overrides  = pkgs: (overrides pkgs) // { fetchurl = thisStdenv.fetchurlBoot; };
+      };
+
+      thisPkgs = allPackages {
+        inherit system platform;
+        bootStdenv = thisStdenv;
+      };
+    in { stdenv = thisStdenv; pkgs = thisPkgs; };
+
+  stage0 = stageFun 0 null {
+    overrides = orig: with stage0; rec {
+      darwin = orig.darwin // {
+        Libsystem = stdenv.mkDerivation {
+          name = "bootstrap-Libsystem";
+          buildCommand = ''
+            mkdir -p $out
+            ln -s ${bootstrapTools}/lib $out/lib
+            ln -s ${bootstrapTools}/include-Libsystem $out/include
+          '';
+        };
+        dyld = bootstrapTools;
+      };
+
+      libcxx = stdenv.mkDerivation {
+        name = "bootstrap-libcxx";
+        phases = [ "installPhase" "fixupPhase" ];
+        installPhase = ''
+          mkdir -p $out/lib $out/include
+          ln -s ${bootstrapTools}/lib/libc++.dylib $out/lib/libc++.dylib
+          ln -s ${bootstrapTools}/include/c++      $out/include/c++
+        '';
+        setupHook = ../../development/compilers/llvm/3.5/libc++/setup-hook.sh;
+      };
+
+      libcxxabi = stdenv.mkDerivation {
+        name = "bootstrap-libcxxabi";
+        buildCommand = ''
+          mkdir -p $out/lib
+          ln -s ${bootstrapTools}/lib/libc++abi.dylib $out/lib/libc++abi.dylib
+        '';
+      };
+
+    };
+
+    extraBuildInputs = [];
+  };
+
+  persistent0 = _: {};
+
+  stage1 = with stage0; stageFun 1 stage0 {
+    extraPreHook = "export NIX_CFLAGS_COMPILE+=\" -F${bootstrapTools}/Library/Frameworks\"";
+    extraBuildInputs = [ pkgs.libcxx ];
+
+    allowedRequisites =
+      [ bootstrapTools ] ++ (with pkgs; [ libcxx libcxxabi ]) ++ [ pkgs.darwin.Libsystem ];
+
+    overrides = persistent0;
+  };
+
+  persistent1 = orig: with stage1.pkgs; {
+    inherit
+      zlib patchutils m4 scons flex perl bison unifdef unzip openssl icu python
+      libxml2 gettext sharutils gmp libarchive ncurses pkg-config libedit groff
+      openssh sqlite sed serf openldap db cyrus-sasl expat apr-util subversion xz
+      findfreetype libssh curl cmake autoconf automake libtool ed cpio coreutils;
+
+    darwin = orig.darwin // {
+      inherit (darwin)
+        dyld Libsystem xnu configd libdispatch libclosure launchd;
+    };
+  };
+
+  stage2 = with stage1; stageFun 2 stage1 {
+    allowedRequisites =
+      [ bootstrapTools ] ++
+      (with pkgs; [ xz libcxx libcxxabi icu ]) ++
+      (with pkgs.darwin; [ dyld Libsystem CF ]);
+
+    overrides = persistent1;
+  };
+
+  persistent2 = orig: with stage2.pkgs; {
+    inherit
+      patchutils m4 scons flex perl bison unifdef unzip openssl python
+      gettext sharutils libarchive pkg-config groff bash subversion
+      openssh sqlite sed serf openldap db cyrus-sasl expat apr-util
+      findfreetype libssh curl cmake autoconf automake libtool cpio
+      libcxx libcxxabi;
+
+    darwin = orig.darwin // {
+      inherit (darwin)
+        dyld Libsystem xnu configd libdispatch libclosure launchd libiconv;
+    };
+  };
+
+  stage3 = with stage2; stageFun 3 stage2 {
+    shell = "${pkgs.bash}/bin/bash";
+
+    # We have a valid shell here (this one has no bootstrap-tools runtime deps) so stageFun
+    # enables patchShebangs above. Unfortunately, patchShebangs ignores our $SHELL setting
+    # and instead goes by $PATH, which happens to contain bootstrapTools. So it goes and
+    # patches our shebangs back to point at bootstrapTools. This makes sure bash comes first.
+    extraInitialPath = [ pkgs.bash ];
+
+    allowedRequisites =
+      [ bootstrapTools ] ++
+      (with pkgs; [ icu bash libcxx libcxxabi ]) ++
+      (with pkgs.darwin; [ dyld Libsystem ]);
+
+    overrides = persistent2;
+  };
+
+  persistent3 = orig: with stage3.pkgs; {
+    inherit
+      gnumake gzip gnused bzip2 gawk ed xz patch bash
+      libcxxabi libcxx ncurses libffi zlib llvm gmp pcre gnugrep
+      coreutils findutils diffutils patchutils;
+
+    llvmPackages = orig.llvmPackages // {
+      inherit (llvmPackages) llvm clang-unwrapped;
+    };
+
+    darwin = orig.darwin // {
+      inherit (darwin) dyld Libsystem libiconv;
+    };
+  };
+
+  stage4 = with stage3; stageFun 4 stage3 {
+    shell = "${pkgs.bash}/bin/bash";
+    extraInitialPath = [ pkgs.bash ];
+    overrides = persistent3;
+  };
+
+  persistent4 = orig: with stage4.pkgs; {
+    inherit
+      gnumake gzip gnused bzip2 gawk ed xz patch bash
+      libcxxabi libcxx ncurses libffi zlib icu llvm gmp pcre gnugrep
+      coreutils findutils diffutils patchutils binutils binutils-raw;
+
+    llvmPackages = orig.llvmPackages // {
+      inherit (llvmPackages) llvm clang-unwrapped;
+    };
+
+    darwin = orig.darwin // {
+      inherit (darwin) dyld Libsystem cctools CF libiconv;
+    };
+  };
+
+  stage5 = with stage4; import ../generic rec {
+    inherit system config;
+    inherit (stdenv) fetchurlBoot;
+
+    name = "stdenv-darwin";
+
+    preHook = commonPreHook;
+
+    __stdenvImpureHostDeps = binShClosure ++ libSystemClosure;
+    __extraImpureHostDeps  = binShClosure ++ libSystemClosure;
+
+    initialPath = import ../common-path.nix { inherit pkgs; };
+    shell       = "${pkgs.bash}/bin/bash";
+
+    cc = import ../../build-support/cc-wrapper {
+      inherit stdenv shell;
+      nativeTools = false;
+      nativeLibc  = false;
+      inherit (pkgs) coreutils binutils;
+      inherit (pkgs.darwin) dyld;
+      cc   = pkgs.llvmPackages.clang-unwrapped;
+      libc = pkgs.darwin.Libsystem;
+    };
+
+    extraBuildInputs = with pkgs; [ darwin.CF libcxx ];
+
+    extraAttrs = {
+      inherit platform bootstrapTools;
+      libc         = pkgs.darwin.Libsystem;
+      shellPackage = pkgs.bash;
+    };
+
+    allowedRequisites = (with pkgs; [
+      xz libcxx libcxxabi icu gmp gnumake findutils bzip2 llvm zlib libffi
+      coreutils ed diffutils gnutar gzip ncurses gnused bash gawk
+      gnugrep llvmPackages.clang-unwrapped patch pcre binutils-raw binutils gettext
+    ]) ++ (with pkgs.darwin; [
+      dyld Libsystem CF cctools libiconv
+    ]);
+
+    overrides = orig: persistent4 orig // {
+      clang = cc;
+      inherit cc;
+    };
+  };
+}
diff --git a/pkgs/stdenv/pure-darwin/make-bootstrap-tools.nix b/pkgs/stdenv/pure-darwin/make-bootstrap-tools.nix
new file mode 100644
index 000000000000..433638dd1bde
--- /dev/null
+++ b/pkgs/stdenv/pure-darwin/make-bootstrap-tools.nix
@@ -0,0 +1,286 @@
+{system ? builtins.currentSystem}:
+
+with import ../../top-level/all-packages.nix {inherit system;};
+
+rec {
+  # We want coreutils without ACL support.
+  coreutils_ = coreutils.override (orig: {
+    aclSupport = false;
+  });
+
+  build = stdenv.mkDerivation {
+    name = "build";
+
+    buildInputs = [nukeReferences cpio];
+
+    buildCommand = ''
+      mkdir -p $out/bin $out/lib
+
+      # Our (fake) loader
+      cp -d ${darwin.dyld}/lib/dyld $out/lib/
+
+      # C standard library stuff
+      cp -d ${darwin.Libsystem}/lib/*.o $out/lib/
+      cp -d ${darwin.Libsystem}/lib/*.dylib $out/lib/
+      cp -d ${darwin.Libsystem}/lib/system/*.dylib $out/lib/
+
+      # Resolv is actually a link to another package, so let's copy it properly
+      rm $out/lib/libresolv.9.dylib
+      cp -L ${darwin.Libsystem}/lib/libresolv.9.dylib $out/lib
+
+      cp -rL ${darwin.Libsystem}/include $out
+      chmod -R u+w $out/include
+      cp -rL ${icu}/include*             $out/include
+      cp -rL ${libiconv}/include/*       $out/include
+      cp -rL ${gnugrep.pcre}/include/*   $out/include
+      mv $out/include $out/include-Libsystem
+
+      # Copy coreutils, bash, etc.
+      cp ${coreutils_}/bin/* $out/bin
+      (cd $out/bin && rm vdir dir sha*sum pinky factor pathchk runcon shuf who whoami shred users)
+
+      cp ${bash}/bin/bash $out/bin
+      cp ${findutils}/bin/find $out/bin
+      cp ${findutils}/bin/xargs $out/bin
+      cp -d ${diffutils}/bin/* $out/bin
+      cp -d ${gnused}/bin/* $out/bin
+      cp -d ${gnugrep}/bin/grep $out/bin
+      cp ${gawk}/bin/gawk $out/bin
+      cp -d ${gawk}/bin/awk $out/bin
+      cp ${gnutar}/bin/tar $out/bin
+      cp ${gzip}/bin/gzip $out/bin
+      cp ${bzip2}/bin/bzip2 $out/bin
+      cp -d ${gnumake}/bin/* $out/bin
+      cp -d ${patch}/bin/* $out/bin
+      cp -d ${xz}/bin/xz $out/bin
+
+      # This used to be in-nixpkgs, but now is in the bundle
+      # because I can't be bothered to make it partially static
+      cp ${curl}/bin/curl $out/bin
+      cp -d ${curl}/lib/libcurl*.dylib $out/lib
+      cp -d ${libssh2}/lib/libssh*.dylib $out/lib
+      cp -d ${openssl}/lib/*.dylib $out/lib
+
+      cp -d ${gnugrep.pcre}/lib/libpcre*.dylib $out/lib
+      cp -d ${libiconv}/lib/libiconv*.dylib $out/lib
+      cp -d ${gettext}/lib/libintl*.dylib $out/lib
+      chmod +x $out/lib/libintl*.dylib
+
+      # Copy what we need of clang
+      cp -d ${llvmPackages.clang-unwrapped}/bin/clang $out/bin
+      cp -d ${llvmPackages.clang-unwrapped}/bin/clang++ $out/bin
+      cp -d ${llvmPackages.clang-unwrapped}/bin/clang-3.6 $out/bin
+
+      cp -rL ${llvmPackages.clang-unwrapped}/lib/clang $out/lib
+
+      cp -d ${libcxx}/lib/libc++*.dylib $out/lib
+      cp -d ${libcxxabi}/lib/libc++abi*.dylib $out/lib
+
+      mkdir $out/include
+      cp -rd ${libcxx}/include/c++     $out/include
+
+      cp -d ${icu}/lib/libicu*.dylib $out/lib
+      cp -d ${zlib}/lib/libz.*       $out/lib
+      cp -d ${gmpxx}/lib/libgmp*.*   $out/lib
+      cp -d ${xz}/lib/liblzma*.*     $out/lib
+
+      # Copy binutils.
+      for i in as ld ar ranlib nm strip otool install_name_tool dsymutil; do
+        cp ${darwin.cctools}/bin/$i $out/bin
+      done
+
+      cp -rd ${pkgs.darwin.CF}/Library $out
+
+      chmod -R u+w $out
+
+      nuke-refs $out/bin/*
+
+      rpathify() {
+        local libs=$(${darwin.cctools}/bin/otool -L "$1" | tail -n +2 | grep -o "$NIX_STORE.*-\S*") || true
+        for lib in $libs; do
+          ${darwin.cctools}/bin/install_name_tool -change $lib "@rpath/$(basename $lib)" "$1"
+        done
+      }
+
+      fix_dyld() {
+        # This is clearly a hack. Once we have an install_name_tool-alike that can patch dyld, this will be nicer.
+        ${perl}/bin/perl -i -0777 -pe 's/\/nix\/store\/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-dyld-239\.4\/lib\/dyld/\/usr\/lib\/dyld\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/sg' "$1"
+      }
+
+      # Strip executables even further
+      for i in $out/bin/*; do
+        if test -x $i -a ! -L $i; then
+          chmod +w $i
+
+          fix_dyld $i
+          strip $i || true
+        fi
+      done
+
+      for i in $out/bin/* $out/lib/*.dylib $out/lib/clang/3.5.0/lib/darwin/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
+        if test -x $i -a ! -L $i; then
+          echo "Adding rpath to $i"
+          rpathify $i
+        fi
+      done
+
+      nuke-refs $out/lib/*
+      nuke-refs $out/lib/clang/3.5.0/lib/darwin/*
+      nuke-refs $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
+
+      mkdir $out/.pack
+      mv $out/* $out/.pack
+      mv $out/.pack $out/pack
+
+      mkdir $out/on-server
+      (cd $out/pack && (find | cpio -o -H newc)) | bzip2 > $out/on-server/bootstrap-tools.cpio.bz2
+
+      mkdir $out/in-nixpkgs
+      cp ${stdenv.shell} $out/in-nixpkgs/sh
+      cp ${cpio}/bin/cpio $out/in-nixpkgs
+      cp ${coreutils_}/bin/mkdir $out/in-nixpkgs
+      cp ${bzip2}/bin/bzip2 $out/in-nixpkgs
+
+      chmod u+w $out/in-nixpkgs/*
+      strip $out/in-nixpkgs/*
+      nuke-refs $out/in-nixpkgs/*
+
+      for i in $out/in-nixpkgs/*; do
+        fix_dyld $i
+      done
+    '';
+
+    allowedReferences = [];
+  };
+
+  host = stdenv.mkDerivation {
+    name = "host";
+
+    buildCommand = ''
+      mkdir -p $out/nix-support
+
+      for i in "${build}/on-server/"*; do
+        echo "file binary-dist $i" >> $out/nix-support/hydra-build-products
+      done
+
+      echo "darwin-bootstrap-tools-$(date +%Y.%m.%d)" >> $out/nix-support/hydra-release-name
+    '';
+
+    allowedReferences = [ build ];
+  };
+
+  unpack = stdenv.mkDerivation {
+    name = "unpack";
+
+    # This is by necessity a near-duplicate of unpack-bootstrap-tools.sh. If we refer to it directly,
+    # we can't make any changes to it due to our testing stdenv depending on it. Think of this as the
+    # unpack-bootstrap-tools.sh for the next round of bootstrap tools.
+    # TODO: think through alternate designs, such as hosting this script as an output of the process.
+    buildCommand = ''
+      # Unpack the bootstrap tools tarball.
+      echo Unpacking the bootstrap tools...
+      $mkdir $out
+      $bzip2 -d < $tarball | (cd $out && $cpio -i)
+
+      # Set the ELF interpreter / RPATH in the bootstrap binaries.
+      echo Patching the tools...
+
+      export PATH=$out/bin
+
+      for i in $out/bin/*; do
+        if ! test -L $i; then
+          echo patching $i
+          install_name_tool -add_rpath $out/lib $i || true
+        fi
+      done
+
+      for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
+        if ! test -L $i; then
+          echo patching $i
+
+          id=$(otool -D "$i" | tail -n 1)
+          install_name_tool -id "$(dirname $i)/$(basename $id)" $i
+
+          libs=$(otool -L "$i" | tail -n +2 | grep -v Libsystem | cat)
+          if [ -n "$libs" ]; then
+            install_name_tool -add_rpath $out/lib $i
+          fi
+        fi
+      done
+
+      ln -s bash $out/bin/sh
+      ln -s bzip2 $out/bin/bunzip2
+
+      cat >$out/bin/dsymutil << EOF
+      #!$out/bin/sh
+      EOF
+    '';
+
+    tarball = "${build}/on-server/bootstrap-tools.cpio.bz2";
+
+    mkdir = "${build}/in-nixpkgs/mkdir";
+    bzip2 = "${build}/in-nixpkgs/bzip2";
+    cpio  = "${build}/in-nixpkgs/cpio";
+
+    allowedReferences = [ "out" ];
+  };
+
+  test = stdenv.mkDerivation {
+    name = "test";
+
+    realBuilder = "${unpack}/bin/bash";
+
+    buildCommand = ''
+      export PATH=${unpack}/bin
+      ls -l
+      mkdir $out
+      mkdir $out/bin
+      sed --version
+      find --version
+      diff --version
+      patch --version
+      make --version
+      awk --version
+      grep --version
+      clang --version
+      xz --version
+
+      # The grep will return a nonzero exit code if there is no match, and we want to assert that we have
+      # an SSL-capable curl
+      curl --version | grep SSL
+
+      ${build}/in-nixpkgs/sh -c 'echo Hello World'
+
+      export flags="-idirafter ${unpack}/include-Libsystem --sysroot=${unpack} -L${unpack}/lib"
+
+      export CPP="clang -E $flags"
+      export CC="clang $flags -Wl,-rpath,${unpack}/lib -Wl,-v"
+      export CXX="clang++ $flags --stdlib=libc++ -lc++abi -isystem${unpack}/include/c++/v1 -Wl,-rpath,${unpack}/lib -Wl,-v"
+
+      echo '#include <stdio.h>' >> foo.c
+      echo '#include <float.h>' >> foo.c
+      echo '#include <limits.h>' >> foo.c
+      echo 'int main() { printf("Hello World\n"); return 0; }' >> foo.c
+      $CC -o $out/bin/foo foo.c
+      $out/bin/foo
+
+      echo '#include <CoreFoundation/CoreFoundation.h>' >> bar.c
+      echo 'int main() { CFShow(CFSTR("Hullo")); return 0; }' >> bar.c
+      $CC -F${unpack}/Library/Frameworks -framework CoreFoundation -o $out/bin/bar bar.c
+      $out/bin/bar
+
+      echo '#include <iostream>' >> bar.cc
+      echo 'int main() { std::cout << "Hello World\n"; }' >> bar.cc
+      $CXX -v -o $out/bin/bar bar.cc
+      $out/bin/bar
+
+      tar xvf ${hello.src}
+      cd hello-*
+      ./configure --prefix=$out
+      make
+      make install
+
+      $out/bin/hello
+    '';
+  };
+}
diff --git a/pkgs/stdenv/pure-darwin/trivial-bootstrap.sh b/pkgs/stdenv/pure-darwin/trivial-bootstrap.sh
new file mode 100644
index 000000000000..0915b378d4f0
--- /dev/null
+++ b/pkgs/stdenv/pure-darwin/trivial-bootstrap.sh
@@ -0,0 +1,66 @@
+
+# Building bootstrap tools
+echo Building the trivial bootstrap environment...
+$mkdir -p $out/bin
+
+$ln -s $ln $out/bin/ln
+
+PATH=$out/bin/
+
+cd $out/bin
+
+ln -s $mkdir
+ln -s /bin/sh
+ln -s /bin/cp
+ln -s /bin/mv
+ln -s /bin/rm
+ln -s /bin/ls
+ln -s /bin/ps
+ln -s /bin/cat
+ln -s /bin/bash
+ln -s /bin/echo
+ln -s /bin/expr
+ln -s /bin/test
+ln -s /bin/date
+ln -s /bin/chmod
+ln -s /bin/rmdir
+ln -s /bin/sleep
+ln -s /bin/hostname
+
+ln -s /usr/bin/id
+ln -s /usr/bin/od
+ln -s /usr/bin/tr
+ln -s /usr/bin/wc
+ln -s /usr/bin/cut
+ln -s /usr/bin/cmp
+ln -s /usr/bin/sed
+ln -s /usr/bin/tar
+ln -s /usr/bin/xar
+ln -s /usr/bin/awk
+ln -s /usr/bin/env
+ln -s /usr/bin/tee
+ln -s /usr/bin/comm
+ln -s /usr/bin/cpio
+ln -s /usr/bin/curl
+ln -s /usr/bin/find
+ln -s /usr/bin/grep
+ln -s /usr/bin/gzip
+ln -s /usr/bin/head
+ln -s /usr/bin/tail
+ln -s /usr/bin/sort
+ln -s /usr/bin/uniq
+ln -s /usr/bin/less
+ln -s /usr/bin/true
+ln -s /usr/bin/diff
+ln -s /usr/bin/egrep
+ln -s /usr/bin/fgrep
+ln -s /usr/bin/patch
+ln -s /usr/bin/uname
+ln -s /usr/bin/touch
+ln -s /usr/bin/split
+ln -s /usr/bin/xargs
+ln -s /usr/bin/which
+ln -s /usr/bin/install
+ln -s /usr/bin/basename
+ln -s /usr/bin/dirname
+ln -s /usr/bin/readlink
\ No newline at end of file
diff --git a/pkgs/stdenv/pure-darwin/unpack-bootstrap-tools.sh b/pkgs/stdenv/pure-darwin/unpack-bootstrap-tools.sh
new file mode 100644
index 000000000000..8033c7004d93
--- /dev/null
+++ b/pkgs/stdenv/pure-darwin/unpack-bootstrap-tools.sh
@@ -0,0 +1,54 @@
+set -e
+
+# Unpack the bootstrap tools tarball.
+echo Unpacking the bootstrap tools...
+$mkdir $out
+$bzip2 -d < $tarball | (cd $out && $cpio -i)
+
+# Set the ELF interpreter / RPATH in the bootstrap binaries.
+echo Patching the tools...
+
+export PATH=$out/bin
+
+for i in $out/bin/*; do
+  if ! test -L $i; then
+    echo patching $i
+    install_name_tool -add_rpath $out/lib $i || true
+  fi
+done
+
+for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
+  if ! test -L $i; then
+    echo patching $i
+
+    id=$(otool -D "$i" | tail -n 1)
+    install_name_tool -id "$(dirname $i)/$(basename $id)" $i
+
+    libs=$(otool -L "$i" | tail -n +2 | grep -v libSystem | cat)
+    if [ -n "$libs" ]; then
+      install_name_tool -add_rpath $out/lib $i
+    fi
+  fi
+done
+
+ln -s bash $out/bin/sh
+ln -s bzip2 $out/bin/bunzip2
+
+# Provide a gunzip script.
+cat > $out/bin/gunzip <<EOF
+#!$out/bin/sh
+exec $out/bin/gzip -d "\$@"
+EOF
+chmod +x $out/bin/gunzip
+
+# Provide fgrep/egrep.
+echo "#! $out/bin/sh" > $out/bin/egrep
+echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
+echo "#! $out/bin/sh" > $out/bin/fgrep
+echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
+
+cat >$out/bin/dsymutil << EOF
+#!$out/bin/sh
+EOF
+
+chmod +x $out/bin/egrep $out/bin/fgrep $out/bin/dsymutil
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 24b9096d27c6..6f306a868911 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchgit, file, libxslt, docbook_xml_dtd_412, docbook_xsl, xmlto
+{ stdenv, fetchzip, file, libxslt, docbook_xml_dtd_412, docbook_xsl, xmlto
 , w3m, which, gnugrep, gnused, coreutils }:
 
 stdenv.mkDerivation rec {
   name = "xdg-utils-1.1.0-rc3p7";
 
-  src = fetchgit {
-    url = "http://anongit.freedesktop.org/git/xdg/xdg-utils.git";
-    rev = "e8ee3b18d16e41b95148111b920a0c8beed3ac6c";
-    sha256 = "0qy9h7vh6sw7wmadjvasw4sdhb9fvv7bn32ifgasdx7ag3r3939w";
+  src = fetchzip {
+    name = "${name}.tar.gz";
+    url = "http://cgit.freedesktop.org/xdg/xdg-utils/snapshot/e8ee3b18d16e4.tar.gz";
+    sha256 = "1hz6rv45blcii1a8n1j45rg8vzm98vh4fvlca3zmay1kp57yr4jl";
   };
 
   # just needed when built from git
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 00be39677689..71b43bf2de9a 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optional stdenv.isDarwin ./gnutar-1.28-darwin.patch;
 
+  # avoid retaining reference to CF during stdenv bootstrap
+  configureFlags = stdenv.lib.optionals stdenv.isDarwin [
+    "gt_cv_func_CFPreferencesCopyAppValue=no"
+    "gt_cv_func_CFLocaleCopyCurrent=no"
+  ];
+
   # gnutar tries to call into gettext between `fork` and `exec`,
   # which is not safe on darwin.
   # see http://article.gmane.org/gmane.os.macosx.fink.devel/21882
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 146f9bea87a0..a7135346d2fc 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -8,12 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "1mallg1gprimlggdisfzdmh1xi676jsfdlfyvanlcw72ny8fsj3g";
   };
 
-  preConfigure =
-    ''
-       # Fix for building on Glibc 2.16.  Won't be needed once the
-       # gnulib in sharutils is updated.
-       sed -i ${stdenv.lib.optionalString ((stdenv.isFreeBSD || stdenv.isOpenBSD || stdenv.isDarwin) && stdenv.cc.nativeTools) "''"} '/gets is a security hole/d' lib/stdio.in.h
-    '';
+  preConfigure = ''
+     # Fix for building on Glibc 2.16.  Won't be needed once the
+     # gnulib in sharutils is updated.
+     sed -i ${stdenv.lib.optionalString ((stdenv.isFreeBSD || stdenv.isOpenBSD) && stdenv.cc.nativeTools) "''"} '/gets is a security hole/d' lib/stdio.in.h
+  '';
 
   # GNU Gettext is needed on non-GNU platforms.
   buildInputs = [ gettext coreutils ];
diff --git a/pkgs/tools/backup/bareos/default.nix b/pkgs/tools/backup/bareos/default.nix
index 016e3c5d51e8..32702a4e16d2 100644
--- a/pkgs/tools/backup/bareos/default.nix
+++ b/pkgs/tools/backup/bareos/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, nettools, gettext, libtool
+{ stdenv, fetchFromGitHub, pkgconfig, nettools, gettext, libtool, flex
 , readline ? null, openssl ? null, python ? null, ncurses ? null
 , sqlite ? null, postgresql ? null, libmysql ? null, zlib ? null, lzo ? null
 , acl ? null, glusterfs ? null, libceph ? null, libcap ? null
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    pkgconfig nettools gettext readline openssl python
+    pkgconfig nettools gettext readline openssl python flex
     ncurses sqlite postgresql libmysql zlib lzo acl glusterfs libceph libcap
   ];
 
@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
     "sysconfdir=\${out}/etc"
     "working_dir=\${TMPDIR}"
     "log_dir=\${TMPDIR}"
+    "sbindir=\${out}/bin"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/filesystems/bcache-tools/default.nix b/pkgs/tools/filesystems/bcache-tools/default.nix
index a4b1363d841d..14d8d282c81c 100644
--- a/pkgs/tools/filesystems/bcache-tools/default.nix
+++ b/pkgs/tools/filesystems/bcache-tools/default.nix
@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
         -i Makefile
   '';
 
-  patches = [ ./bcache-udev-modern.patch ];
+  patches = [
+    ./bcache-udev-modern.patch
+    ./fix-static.patch
+  ];
 
   preBuild = ''
     export makeFlags="$makeFlags PREFIX=\"$out\" UDEVLIBDIR=\"$out/lib/udev/\"";
diff --git a/pkgs/tools/filesystems/bcache-tools/fix-static.patch b/pkgs/tools/filesystems/bcache-tools/fix-static.patch
new file mode 100644
index 000000000000..e5dd2df5299d
--- /dev/null
+++ b/pkgs/tools/filesystems/bcache-tools/fix-static.patch
@@ -0,0 +1,22 @@
+diff --git a/bcache.c b/bcache.c
+index 8f37445..79806d8 100644
+--- a/bcache.c
++++ b/bcache.c
+@@ -26,7 +26,7 @@
+  * x^7 + x^4 + x + 1
+ */
+ 
+-static const uint64_t crc_table[256] = {
++const uint64_t crc_table[256] = {
+ 	0x0000000000000000ULL, 0x42F0E1EBA9EA3693ULL, 0x85E1C3D753D46D26ULL,
+ 	0xC711223CFA3E5BB5ULL, 0x493366450E42ECDFULL, 0x0BC387AEA7A8DA4CULL,
+ 	0xCCD2A5925D9681F9ULL, 0x8E224479F47CB76AULL, 0x9266CC8A1C85D9BEULL,
+@@ -115,7 +115,7 @@ static const uint64_t crc_table[256] = {
+ 	0x9AFCE626CE85B507ULL
+ };
+ 
+-inline uint64_t crc64(const void *_data, size_t len)
++uint64_t crc64(const void *_data, size_t len)
+ {
+ 	uint64_t crc = 0xFFFFFFFFFFFFFFFFULL;
+ 	const unsigned char *data = _data;
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c65ed30dd71b..c9d8f0ad6029 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -12,11 +12,11 @@ with { inherit (stdenv.lib) optional optionals optionalString optionalAttrs; };
 
 let
   self = stdenv.mkDerivation rec {
-    name = "coreutils-8.23";
+    name = "coreutils-8.24";
 
     src = fetchurl {
       url = "mirror://gnu/coreutils/${name}.tar.xz";
-      sha256 = "0bdq6yggyl7nkc2pbl6pxhhyx15nyqhz3ds6rfn448n6rxdwlhzc";
+      sha256 = "0w11jw3fb5sslf0f72kxy7llxgk1ia3a6bcw0c9kmvxrlj355mx2";
     };
 
     patches = if stdenv.isCygwin then [ ./coreutils-8.23-4.cygwin.patch ] else null;
@@ -24,6 +24,7 @@ let
     # The test tends to fail on btrfs and maybe other unusual filesystems.
     postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
       sed '2i echo Skipping dd sparse test && exit 0' -i ./tests/dd/sparse.sh
+      sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     '';
 
     nativeBuildInputs = [ perl ];
@@ -33,7 +34,7 @@ let
       ++ optionals selinuxSupport [ libselinux libsepol ];
 
     crossAttrs = {
-      buildInputs = [ gmp ]
+      buildInputs = [ gmp.crossDrv ]
         ++ optional aclSupport acl.crossDrv
         ++ optionals selinuxSupport [ libselinux.crossDrv libsepol.crossDrv ]
         ++ optional (stdenv.ccCross.libc ? libiconv)
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 26df6b3b22a2..e3dc7bcb5337 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "file-5.22";
+  name = "file-5.23";
 
   buildInputs = [ zlib ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "ftp://ftp.astron.com/pub/file/${name}.tar.gz"
       "http://distfiles.macports.org/file/${name}.tar.gz"
     ];
-    sha256 = "02zw14hw3gqlw91w2f2snbirvyrp7r83irvnnkjcb25q9kjaiqy4";
+    sha256 = "0z0mwqayrrf3w734rjp9rysf0y8az191ff7fxjsxyb1y2kzv72ic";
   };
 
   meta = {
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 188b573efeca..16d53c9f436a 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [coreutils];
 
-  patches = [ ./findutils-path.patch ./change_echo_path.patch ];
+  patches = [ ./findutils-path.patch ./change_echo_path.patch ./disable-test-canonicalize.patch ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/misc/findutils/disable-test-canonicalize.patch b/pkgs/tools/misc/findutils/disable-test-canonicalize.patch
new file mode 100644
index 000000000000..3a8d42eb5607
--- /dev/null
+++ b/pkgs/tools/misc/findutils/disable-test-canonicalize.patch
@@ -0,0 +1,12 @@
+diff -ruN findutils-4.4.2/tests/test-canonicalize.sh findutils-4.4.2_edited/tests/test-canonicalize.sh
+--- findutils-4.4.2/tests/test-canonicalize.sh	2008-12-23 12:50:15.000000000 +0000
++++ findutils-4.4.2_edited/tests/test-canonicalize.sh	2015-06-14 10:51:19.000000000 +0000
+@@ -1,5 +1,8 @@
+ #!/bin/sh
+ 
++# skipped because user might not have directory listing permission for all parents of TMPDIR
++exit 77
++
+ tmpfiles=""
+ trap 'rm -fr $tmpfiles' 1 2 3 15
+ 
diff --git a/pkgs/tools/misc/pipelight/default.nix b/pkgs/tools/misc/pipelight/default.nix
index cb130c8e9178..89459eb281bc 100644
--- a/pkgs/tools/misc/pipelight/default.nix
+++ b/pkgs/tools/misc/pipelight/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchgit, autoconf, automake, wineStaging, perl, xlibs
-  , gnupg, gcc48_multi, mesa, curl, bash, cacert, cabextract, utillinux, attr
+  , gnupg, gcc_multi, mesa, curl, bash, cacert, cabextract, utillinux, attr
   }:
 
 let
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1i440rf22fmd2w86dlm1mpi3nb7410rfczc0yldnhgsvp5p3sm5f";
   };
 
-  buildInputs = [ wine_custom xlibs.libX11 gcc48_multi mesa curl ];
+  buildInputs = [ wine_custom xlibs.libX11 gcc_multi mesa curl ];
   propagatedbuildInputs = [ curl cabextract ];
 
   patches = [ ./pipelight.patch ];
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 28f28c9a4f93..6901c74cc48a 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -16,11 +16,11 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.42.1";
+  name = "curl-7.43.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "11y8racpj6m4j9w7wa9sifmqvdgf22nk901sfkbxzhhy75rmk472";
+    sha256 = "1ycdhp47v8z6y64s7ihi5jl28dzc5w8wqn0wrhy4hc152ahm99ms";
   };
 
   # Zlib and OpenSSL must be propagated because `libcurl.la' contains
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 7277b2a1fe72..196bcd024d95 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -10,20 +10,19 @@ stdenv.mkDerivation rec {
     sha256 = "0dzv5xf9qxc2bp4cyifmaghh3h464wbm73xiwcrvckf1ynqbgxv7";
   };
 
-  preConfigure = stdenv.lib.optionalString doCheck
-    '' for i in "doc/texi2pod.pl" "util/rmold.pl"
-       do
-         sed -i "$i" -e 's|/usr/bin.*perl|${perl}/bin/perl|g'
-       done
-
-       # Work around lack of DNS resolution in chroots.
-       for i in "tests/"*.pm "tests/"*.px
-       do
-         sed -i "$i" -e's/localhost/127.0.0.1/g'
-       done
-    '' + stdenv.lib.optionalString stdenv.isDarwin ''
-       export LIBS="-liconv -lintl"
-    '';
+  preConfigure = ''
+    for i in "doc/texi2pod.pl" "util/rmold.pl"; do
+      sed -i "$i" -e 's|/usr/bin.*perl|${perl}/bin/perl|g'
+    done
+  '' + stdenv.lib.optionalString doCheck ''
+    # Work around lack of DNS resolution in chroots.
+    for i in "tests/"*.pm "tests/"*.px
+    do
+      sed -i "$i" -e's/localhost/127.0.0.1/g'
+    done
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
+    export LIBS="-liconv -lintl"
+  '';
 
   nativeBuildInputs = [ gettext pkgconfig ];
   buildInputs = [ libidn libiconv libpsl ]
diff --git a/pkgs/tools/security/crackxls/default.nix b/pkgs/tools/security/crackxls/default.nix
index 48210c11ad90..c8ea45a39dbe 100644
--- a/pkgs/tools/security/crackxls/default.nix
+++ b/pkgs/tools/security/crackxls/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase =
   ''
-    mkdir $out/bin
+    mkdir -p $out/bin
     cp crackxls2003 $out/bin/
   '';
 
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 6c87d8062eca..7b8e2fe27616 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libcap gtk2 ncurses qt4 ];
 
+  prePatch = ''
+    substituteInPlace pinentry/pinentry-curses.c --replace ncursesw ncurses
+  '';
+
   # configure cannot find moc on its own
   preConfigure = stdenv.lib.optionalString (qt4 != null) ''
     export QTDIR="${qt4}"
diff --git a/pkgs/tools/security/sbsigntool/default.nix b/pkgs/tools/security/sbsigntool/default.nix
index 1571720a0b9b..4cc5e2505d13 100644
--- a/pkgs/tools/security/sbsigntool/default.nix
+++ b/pkgs/tools/security/sbsigntool/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./autoconf.patch ];
 
+  prePatch = "patchShebangs .";
+
   buildInputs = [ autoconf automake utillinux openssl libuuid gnu-efi binutils pkgconfig help2man ];
 
   configurePhase = ''
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index c6eb7ba11019..001a50458e29 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, libsigsegv, readline, readlineSupport ? false }:
+{ stdenv, fetchurl, libsigsegv, readline, readlineSupport ? false
+, locale ? null }:
 
 stdenv.mkDerivation rec {
   name = "gawk-4.1.3";
@@ -8,10 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "09d6pmx6h3i2glafm0jd1v1iyrs03vcyv2rkz12jisii3vlmbkz3";
   };
 
-  doCheck = !stdenv.isCygwin; # XXX: `test-dup2' segfaults on Cygwin 6.1
+  doCheck = !(
+       stdenv.isCygwin # XXX: `test-dup2' segfaults on Cygwin 6.1
+    || stdenv.isDarwin # XXX: `locale' segfaults
+  );
 
   buildInputs = stdenv.lib.optional (stdenv.system != "x86_64-cygwin") libsigsegv
-    ++ stdenv.lib.optional readlineSupport readline;
+    ++ stdenv.lib.optional readlineSupport readline
+    ++ stdenv.lib.optional stdenv.isDarwin locale;
 
   configureFlags = stdenv.lib.optional (stdenv.system != "x86_64-cygwin") "--with-libsigsegv-prefix=${libsigsegv}"
     ++ stdenv.lib.optional readlineSupport "--with-readline=${readline}"
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 90beca862c03..b0421a8ed0d4 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1998v2kcs288d3y7kfxpvl369nqi06zbbvjzafyvyl3pr7bajj1s";
   };
 
+  enableParallelBuilding = false;
+
   buildInputs = [ ghostscript ];
   nativeBuildInputs = [ perl ];
 
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index bf95125b208a..004a93f6ebdd 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -1,6 +1,5 @@
-# XXX: this may need -liconv on non-glibc systems.. 
-
-{ stdenv, fetchFromGitHub, python, perl, autoconf, automake, libtool, intltool, flex, texinfo }:
+{ stdenv, fetchFromGitHub, python, perl, autoconf, automake, libtool, intltool, flex,
+texinfo, libiconv }:
 
 stdenv.mkDerivation rec {
   name = "recode-3.7-2fd838565";
@@ -12,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "06vyjqaraamcc5vka66mlvxj27ihccqc74aymv2wn8nphr2rhh03";
   };
 
-  nativeBuildInputs = [ python perl autoconf automake libtool intltool flex texinfo ];
+  nativeBuildInputs = [ python perl autoconf automake libtool intltool flex texinfo
+  libiconv ];
 
   preConfigure = ''
     # fix build with new automake, https://bugs.gentoo.org/show_bug.cgi?id=419455
diff --git a/pkgs/tools/typesetting/tex/tetex/default.nix b/pkgs/tools/typesetting/tex/tetex/default.nix
index 24ab02e97d75..ab3d49c6b117 100644
--- a/pkgs/tools/typesetting/tex/tetex/default.nix
+++ b/pkgs/tools/typesetting/tex/tetex/default.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation {
     mkdir -p $out/share/texmf
     mkdir -p $out/share/texmf-dist
     gunzip < $texmf | (cd $out/share/texmf-dist && tar xvf -)
+
+    substituteInPlace ./tetex-src-3.0/configure --replace /usr/bin/install $(type -P install)
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 21735bd27e8e..14d256c277a5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -256,7 +256,7 @@ let
   # just the plain stdenv.
   stdenv_32bit = lowPrio (
     if system == "x86_64-linux" then
-      overrideCC stdenv gcc48_multi
+      overrideCC stdenv gcc_multi
     else
       stdenv);
 
@@ -1151,7 +1151,10 @@ let
     inherit (perlPackages) perl AlgorithmDiff RegexpCommon;
   };
 
-  cloog = callPackage ../development/libraries/cloog { };
+  cloog = callPackage ../development/libraries/cloog {
+    isl = isl_0_14;
+  };
+
   cloog_0_18_0 = callPackage ../development/libraries/cloog/0.18.0.nix {
     isl = isl_0_11;
   };
@@ -1164,11 +1167,9 @@ let
 
   cool-retro-term = callPackage ../applications/misc/cool-retro-term { };
 
-  coreutils = callPackage ../tools/misc/coreutils
-    {
-      # TODO: Add ACL support for cross-Linux.
-      aclSupport = crossSystem == null && stdenv.isLinux;
-    };
+  coreutils = callPackage ../tools/misc/coreutils {
+    aclSupport = stdenv.isLinux;
+  };
 
   cpio = callPackage ../tools/archivers/cpio { };
 
@@ -1565,7 +1566,9 @@ let
 
   garmintools = callPackage ../development/libraries/garmintools {};
 
-  gawk = callPackage ../tools/text/gawk { };
+  gawk = callPackage ../tools/text/gawk {
+    locale = darwin.adv_cmds;
+  };
 
   gawkInteractive = appendToName "interactive"
     (gawk.override { readlineSupport = true; });
@@ -1909,10 +1912,11 @@ let
 
   ised = callPackage ../tools/misc/ised {};
 
-  isl = callPackage ../development/libraries/isl { };
+  isl = isl_0_15;
   isl_0_11 = callPackage ../development/libraries/isl/0.11.1.nix { };
   isl_0_12 = callPackage ../development/libraries/isl/0.12.2.nix { };
   isl_0_14 = callPackage ../development/libraries/isl/0.14.1.nix { };
+  isl_0_15 = callPackage ../development/libraries/isl/0.15.0.nix { };
 
   isync = callPackage ../tools/networking/isync { };
 
@@ -2008,9 +2012,15 @@ let
 
   ninka = callPackage ../development/tools/misc/ninka { };
 
-  nodejs-0_12 = callPackage ../development/web/nodejs { libuv = libuvVersions.v1_6_1; };
+  nodejs-0_12 = callPackage ../development/web/nodejs {
+    libuv = libuvVersions.v1_6_1;
+    libtool = darwin.cctools;
+  };
   nodejs-unstable = callPackage ../development/web/nodejs { libuv = libuvVersions.v1_2_0; unstableVersion = true; };
-  nodejs-0_10 = callPackage ../development/web/nodejs/v0_10.nix { };
+  nodejs-0_10 = callPackage ../development/web/nodejs/v0_10.nix {
+    libtool = darwin.cctools;
+    inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices Carbon Foundation;
+  };
 
   nodejs = if stdenv.system == "armv5tel-linux" then
     nodejs-0_10
@@ -3669,41 +3679,39 @@ let
 
   gambit = callPackage ../development/compilers/gambit { };
 
-  gcc       = gcc48;
-  gcc_multi = gcc48_multi;
+  gcc = gcc49;
 
-  gccApple = throw "gccApple is no longer supported";
+  gcc_multi =
+    if system == "x86_64-linux" then lowPrio (
+      wrapCCWith (import ../build-support/cc-wrapper) glibc_multi (gcc.cc.override {
+        stdenv = overrideCC stdenv (wrapCCWith (import ../build-support/cc-wrapper) glibc_multi gcc.cc);
+        profiledCompiler = false;
+        enableMultilib = true;
+      }))
+    else throw "Multilib gcc not supported on ‘${system}’";
 
-  gcc48_realCross = lib.addMetaAttrs { hydraPlatforms = []; }
-    (callPackage ../development/compilers/gcc/4.8 {
-      inherit noSysDirs;
-      binutilsCross = binutilsCross;
-      libcCross = libcCross;
-      profiledCompiler = false;
-      enableMultilib = false;
-      crossStageStatic = false;
-      cross = assert crossSystem != null; crossSystem;
-    });
+  gcc_debug = lowPrio (wrapCC (gcc.cc.override {
+    stripped = false;
+  }));
 
-  gcc_realCross = gcc48_realCross;
+  gccApple = throw "gccApple is no longer supported";
 
   gccCrossStageStatic = let
-      libcCross1 =
-        if stdenv.cross.libc == "msvcrt" then windows.mingw_w64_headers
-        else if stdenv.cross.libc == "libSystem" then darwin.xcode
-        else null;
-    in
-      wrapGCCCross {
-      gcc = forceNativeDrv (lib.addMetaAttrs { hydraPlatforms = []; } (
-        gcc_realCross.override {
-          crossStageStatic = true;
-          langCC = false;
-          libcCross = libcCross1;
-          enableShared = false;
-        }));
+    libcCross1 =
+      if stdenv.cross.libc == "msvcrt" then windows.mingw_w64_headers
+      else if stdenv.cross.libc == "libSystem" then darwin.xcode
+      else null;
+    in wrapGCCCross {
+      gcc = forceNativeDrv (gcc.cc.override {
+        cross = crossSystem;
+        crossStageStatic = true;
+        langCC = false;
+        libcCross = libcCross1;
+        enableShared = false;
+      });
       libc = libcCross1;
       binutils = binutilsCross;
-      cross = assert crossSystem != null; crossSystem;
+      cross = crossSystem;
   };
 
   # Only needed for mingw builds
@@ -3715,21 +3723,17 @@ let
   };
 
   gccCrossStageFinal = wrapGCCCross {
-    gcc = forceNativeDrv (gcc_realCross.override {
-      libpthreadCross =
-        # FIXME: Don't explicitly refer to `i586-pc-gnu'.
-        if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-        then gnu.libpthreadCross
-        else null;
+    gcc = forceNativeDrv (gcc.cc.override {
+      cross = crossSystem;
+      crossStageStatic = false;
 
       # XXX: We have troubles cross-compiling libstdc++ on MinGW (see
       # <http://hydra.nixos.org/build/4268232>), so don't even try.
-      langCC = (crossSystem == null
-                || crossSystem.config != "i686-pc-mingw32");
-     });
+      langCC = crossSystem.config != "i686-pc-mingw32";
+    });
     libc = libcCross;
     binutils = binutilsCross;
-    cross = assert crossSystem != null; crossSystem;
+    cross = crossSystem;
   };
 
   gcc44 = lowPrio (wrapCC (makeOverridable (import ../development/compilers/gcc/4.4) {
@@ -3756,10 +3760,6 @@ let
     # be passed.
     cross = null;
     libcCross = if crossSystem != null then libcCross else null;
-    libpthreadCross =
-      if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-      then gnu.libpthreadCross
-      else null;
   }));
 
   gcc46 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/4.6 {
@@ -3777,10 +3777,6 @@ let
     # be passed.
     cross = null;
     libcCross = if crossSystem != null then libcCross else null;
-    libpthreadCross =
-      if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-      then gnu.libpthreadCross
-      else null;
     texinfo = texinfo413;
   }));
 
@@ -3795,28 +3791,8 @@ let
     # be passed.
     cross = null;
     libcCross = if crossSystem != null then libcCross else null;
-    libpthreadCross =
-      if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-      then gnu.libpthreadCross
-      else null;
-  }));
-
-  gcc48_multi =
-    if system == "x86_64-linux" then lowPrio (
-      wrapCCWith (import ../build-support/cc-wrapper) glibc_multi (gcc48.cc.override {
-        stdenv = overrideCC stdenv (wrapCCWith (import ../build-support/cc-wrapper) glibc_multi gcc.cc);
-        profiledCompiler = false;
-        enableMultilib = true;
-      }))
-    else throw "Multilib gcc not supported on ‘${system}’";
-
-  gcc48_debug = lowPrio (wrapCC (callPackage ../development/compilers/gcc/4.8 {
-    stripped = false;
 
-    inherit noSysDirs;
-    cross = null;
-    libcCross = null;
-    binutilsCross = null;
+    isl = isl_0_14;
   }));
 
   gcc49 = lowPrio (wrapCC (callPackage ../development/compilers/gcc/4.9 {
@@ -3830,10 +3806,6 @@ let
     # be passed.
     cross = null;
     libcCross = if crossSystem != null then libcCross else null;
-    libpthreadCross =
-      if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-      then gnu.libpthreadCross
-      else null;
 
     isl = isl_0_11;
 
@@ -3851,10 +3823,6 @@ let
     # be passed.
     cross = null;
     libcCross = if crossSystem != null then libcCross else null;
-    libpthreadCross =
-      if crossSystem != null && crossSystem.config == "i586-pc-gnu"
-      then gnu.libpthreadCross
-      else null;
 
     isl = isl_0_14;
   }));
@@ -4006,7 +3974,9 @@ let
 
   go_1_3 = callPackage ../development/compilers/go/1.3.nix { };
 
-  go_1_4 = callPackage ../development/compilers/go/1.4.nix { inherit (darwin) Security; };
+  go_1_4 = callPackage ../development/compilers/go/1.4.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   go = go_1_4;
 
@@ -4773,12 +4743,13 @@ let
     nativePrefix = stdenv.cc.nativePrefix or "";
     cc = baseCC;
     libc = libc;
+    dyld = if stdenv.isDarwin then darwin.dyld else null;
     isGNU = baseCC.isGNU or false;
     isClang = baseCC.isClang or false;
     inherit stdenv binutils coreutils zlib;
   };
 
-  wrapCC = wrapCCWith (makeOverridable (import ../build-support/cc-wrapper)) glibc;
+  wrapCC = wrapCCWith (makeOverridable (import ../build-support/cc-wrapper)) stdenv.cc.libc;
   # legacy version, used for gnat bootstrapping
   wrapGCC-old = baseGCC: (makeOverridable (import ../build-support/gcc-wrapper-old)) {
     nativeTools = stdenv.cc.nativeTools or false;
@@ -4799,28 +4770,6 @@ let
       inherit stdenv gcc binutils libc shell name cross;
     });
 
-  /* Alternative GCC wrapper that uses the standard -I include flag instead of
-   * -isystem. The -isystem flag can change the search order specified by prior
-   * -I flags. For KDE 5 packages, we don't want to interfere with the include
-   * search path order specified by the build system. Some packages depend on
-   * Qt 4 and Qt 5 simultaneously; because the two Qt versions provide headers
-   * with the same filenames, we must respect the search order specified by the
-   * build system so that the Qt 4 components find the Qt 4 headers and the Qt 5
-   * components find the Qt 5 headers.
-   */
-  wrapGCCStdInc = glibc: baseGCC: (import ../build-support/cc-wrapper) {
-    nativeTools = stdenv.cc.nativeTools or false;
-    nativeLibc = stdenv.cc.nativeLibc or false;
-    nativePrefix = stdenv.cc.nativePrefix or "";
-    cc = baseGCC;
-    libc = glibc;
-    isGNU = true;
-    inherit stdenv binutils coreutils zlib;
-    setupHook = ../build-support/cc-wrapper/setup-hook-stdinc.sh;
-  };
-
-  gccStdInc = wrapGCCStdInc glibc gcc.cc;
-
   # prolog
   yap = callPackage ../development/compilers/yap { };
 
@@ -4988,6 +4937,11 @@ let
     fetchurl = fetchurlBoot;
   };
 
+  perl522 = callPackage ../development/interpreters/perl/5.22 {
+    fetchurl = fetchurlBoot;
+  };
+
+  # Make perl522 the default once gnulib is updated to support it.
   perl = perl520;
 
   php = php56;
@@ -5037,6 +4991,7 @@ let
   };
   python27 = callPackage ../development/interpreters/python/2.7 {
     self = python27;
+    inherit (darwin) CF configd;
   };
   python32 = callPackage ../development/interpreters/python/3.2 {
     self = python32;
@@ -5102,15 +5057,21 @@ let
   bundlerEnv = callPackage ../development/interpreters/ruby/bundler-env { };
 
   ruby_1_8_7 = callPackage ../development/interpreters/ruby/ruby-1.8.7.nix { };
-  ruby_1_9_3 = callPackage ../development/interpreters/ruby/ruby-1.9.3.nix { };
+  ruby_1_9_3 = callPackage ../development/interpreters/ruby/ruby-1.9.3.nix {
+    inherit (darwin) libobjc;
+  };
   ruby_2_0_0 = callPackage ../development/interpreters/ruby/ruby-2.0.0.nix { };
   ruby_2_1_0 = callPackage ../development/interpreters/ruby/ruby-2.1.0.nix { };
   ruby_2_1_1 = callPackage ../development/interpreters/ruby/ruby-2.1.1.nix { };
   ruby_2_1_2 = callPackage ../development/interpreters/ruby/ruby-2.1.2.nix { };
   ruby_2_1_3 = callPackage ../development/interpreters/ruby/ruby-2.1.3.nix { };
   ruby_2_1_6 = callPackage ../development/interpreters/ruby/ruby-2.1.6.nix { };
-  ruby_2_2_0 = callPackage ../development/interpreters/ruby/ruby-2.2.0.nix { };
-  ruby_2_2_2 = callPackage ../development/interpreters/ruby/ruby-2.2.2.nix { };
+  ruby_2_2_0 = callPackage ../development/interpreters/ruby/ruby-2.2.0.nix {
+    inherit (darwin) libobjc libunwind;
+  };
+  ruby_2_2_2 = callPackage ../development/interpreters/ruby/ruby-2.2.2.nix {
+    inherit (darwin) libobjc libunwind;
+  };
 
   # Ruby aliases
   ruby = ruby_2_2;
@@ -5291,23 +5252,20 @@ let
 
   bin_replace_string = callPackage ../development/tools/misc/bin_replace_string { };
 
-  binutils = if stdenv.isDarwin
-    then import ../build-support/native-darwin-cctools-wrapper {inherit stdenv;}
-    else callPackage ../development/tools/misc/binutils {
-      inherit noSysDirs;
-    };
+  binutils = if stdenv.isDarwin then darwin.binutils else binutils-raw;
+
+  binutils-raw = callPackage ../development/tools/misc/binutils { inherit noSysDirs; };
 
   binutils_nogold = lowPrio (callPackage ../development/tools/misc/binutils {
     inherit noSysDirs;
     gold = false;
   });
 
-  binutilsCross =
-    if crossSystem != null && crossSystem.libc == "libSystem" then darwin.cctools_cross
-    else lowPrio (forceNativeDrv (import ../development/tools/misc/binutils {
-      inherit stdenv fetchurl zlib bison;
+  binutilsCross = assert crossSystem != null; lowPrio (forceNativeDrv (
+    if crossSystem.libc == "libSystem" then darwin.cctools_cross
+    else binutils.override {
       noSysDirs = true;
-      cross = assert crossSystem != null; crossSystem;
+      cross = crossSystem;
     }));
 
   bison2 = callPackage ../development/tools/parsing/bison/2.x.nix { };
@@ -5394,12 +5352,12 @@ let
 
   cmake-2_8 = callPackage ../development/tools/build-managers/cmake/2.8.nix {
     wantPS = stdenv.isDarwin;
-    ps     = if stdenv.isDarwin then darwin.ps else null;
+    ps     = if stdenv.isDarwin then darwin.adv_cmds else null;
   };
 
   cmake = callPackage ../development/tools/build-managers/cmake {
     wantPS = stdenv.isDarwin;
-    ps     = if stdenv.isDarwin then darwin.ps else null;
+    ps     = if stdenv.isDarwin then darwin.adv_cmds else null;
   };
 
   cmakeCurses = cmake.override { useNcurses = true; };
@@ -6301,22 +6259,13 @@ let
     withGd = true;
   };
 
-  glibcCross = forceNativeDrv (makeOverridable (import ../development/libraries/glibc)
-    (let crossGNU = crossSystem != null && crossSystem.config == "i586-pc-gnu";
-     in {
-       inherit stdenv fetchurl;
-       gccCross = gccCrossStageStatic;
-       kernelHeaders = if crossGNU then gnu.hurdHeaders else linuxHeadersCross;
-       installLocales = config.glibc.locales or false;
-     }
-     // lib.optionalAttrs crossGNU {
-        inherit (gnu) machHeaders hurdHeaders libpthreadHeaders mig;
-        inherit fetchgit;
-      }));
-
+  glibcCross = forceNativeDrv (glibc.override {
+    gccCross = gccCrossStageStatic;
+    kernelHeaders = linuxHeadersCross;
+  });
 
   # We can choose:
-  libcCrossChooser = name : if name == "glibc" then glibcCross
+  libcCrossChooser = name: if name == "glibc" then glibcCross
     else if name == "uclibc" then uclibcCross
     else if name == "msvcrt" then windows.mingw_w64
     else if name == "libSystem" then darwin.xcode
@@ -6527,17 +6476,12 @@ let
 
   hamlib = callPackage ../development/libraries/hamlib { };
 
-  # TODO : Add MIT Kerberos and let admin choose.
-  # TODO : Fix kerberos on Darwin
-  kerberos = if stdenv.isDarwin then null else libheimdal;
+  # TODO : Let admin choose.
+  # We are using mit-krb5 because it is better maintained
+  kerberos = libkrb5;
 
-  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
-    openldap = openldap.override {
-      cyrus_sasl = cyrus_sasl.override { kerberos = null; };
-    };
-    cyrus_sasl = cyrus_sasl.override { kerberos = null; };
-  };
-  libheimdal = heimdal;
+  heimdalFull = callPackage ../development/libraries/kerberos/heimdal.nix { };
+  libheimdal = heimdalFull.override { type = "lib"; };
 
   harfbuzz = callPackage ../development/libraries/harfbuzz { };
   harfbuzz-icu = callPackage ../development/libraries/harfbuzz {
@@ -6669,13 +6613,10 @@ let
 
   kinetic-cpp-client = callPackage ../development/libraries/kinetic-cpp-client { };
 
-  krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
-    openldap = openldap.override {
-      cyrus_sasl = cyrus_sasl.override { kerberos = null; };
-    };
+  krb5Full = callPackage ../development/libraries/kerberos/krb5.nix {
     inherit (darwin) bootstrap_cmds;
   };
-  libkrb5 = krb5;
+  libkrb5 = krb5Full.override { type = "lib"; };
 
   LASzip = callPackage ../development/libraries/LASzip { };
 
@@ -7074,7 +7015,13 @@ let
   # glibc provides libiconv so systems with glibc don't need to build libiconv
   # separately, but we also provide libiconvReal, which will always be a
   # standalone libiconv, just in case you want it
-  libiconv = if stdenv.isGlibc then stdenv.cc.libc else libiconvReal;
+  libiconv = if crossSystem != null then
+    (if crossSystem.libc == "glibc" then libcCross
+      else if crossSystem.libc == "libSystem" then darwin.libiconv
+      else libiconvReal)
+    else if stdenv.isGlibc then stdenv.cc.libc
+    else if stdenv.isDarwin then darwin.libiconv
+    else libiconvReal;
 
   libiconvReal = callPackage ../development/libraries/libiconv {
     fetchurl = fetchurlBoot;
@@ -7365,7 +7312,9 @@ let
 
   libusb = callPackage ../development/libraries/libusb {};
 
-  libusb1 = callPackage ../development/libraries/libusb1 { };
+  libusb1 = callPackage ../development/libraries/libusb1 {
+    inherit (darwin) libobjc IOKit;
+  };
 
   libusbmuxd = callPackage ../development/libraries/libusbmuxd { };
 
@@ -7377,6 +7326,7 @@ let
 
   libuvVersions = recurseIntoAttrs (callPackage ../development/libraries/libuv {
     automake = automake113x; # fails with 14
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
   });
 
   libuv = libuvVersions.v1_6_1;
@@ -7526,7 +7476,6 @@ let
     # makes it slower, but during runtime we link against just mesa_drivers
     # through /run/opengl-driver*, which is overriden according to config.grsecurity
     grsecEnabled = true;
-    libva = libva.override { mesa = null; };
     llvmPackages = llvmPackages_36;
   });
   mesa_glu =  mesaDarwinOr (callPackage ../development/libraries/mesa-glu { });
@@ -8020,9 +7969,9 @@ let
 
   SDL = callPackage ../development/libraries/SDL {
     openglSupport = mesaSupported;
-    alsaSupport = (!stdenv.isDarwin);
-    x11Support = true;
-    pulseaudioSupport = (!stdenv.isDarwin);
+    alsaSupport = stdenv.isLinux;
+    x11Support = !stdenv.isCygwin;
+    pulseaudioSupport = stdenv.isLinux;
   };
 
   SDL_gfx = callPackage ../development/libraries/SDL_gfx { };
@@ -8041,8 +7990,8 @@ let
 
   SDL2 = callPackage ../development/libraries/SDL2 {
     openglSupport = mesaSupported;
-    alsaSupport = (!stdenv.isDarwin);
-    x11Support = (!stdenv.isDarwin);
+    alsaSupport = stdenv.isLinux;
+    x11Support = !stdenv.isCygwin;
     pulseaudioSupport = false; # better go through ALSA
   };
 
@@ -8282,6 +8231,7 @@ let
 
   v8_3_16_14 = callPackage ../development/libraries/v8/3.16.14.nix {
     inherit (pythonPackages) gyp;
+    stdenv = overrideCC stdenv gcc48;
   };
 
   v8_3_24_10 = callPackage ../development/libraries/v8/3.24.10.nix {
@@ -9426,7 +9376,7 @@ let
       xctoolchain = xcode.toolchain;
     };
 
-    cctools = (callPackage ../os-specific/darwin/cctools/port.nix {}).native;
+    cctools = (callPackage ../os-specific/darwin/cctools/port.nix { inherit libobjc; }).native;
 
     maloader = callPackage ../os-specific/darwin/maloader {
       inherit opencflite;
@@ -9437,18 +9387,28 @@ let
     xcode = callPackage ../os-specific/darwin/xcode {};
 
     osx_sdk = callPackage ../os-specific/darwin/osx-sdk {};
-    osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk { inherit osx_sdk; };
+    osx_private_sdk = callPackage ../os-specific/darwin/osx-private-sdk {};
 
-    ps = callPackage ../os-specific/darwin/adv_cmds/ps.nix {};
+    security_tool = (newScope (darwin.apple_sdk.frameworks // darwin)) ../os-specific/darwin/security-tool { };
 
-    security_tool = callPackage ../os-specific/darwin/security-tool { inherit osx_private_sdk; };
+    binutils = callPackage ../os-specific/darwin/binutils { inherit cctools; };
 
     cmdline_sdk   = cmdline.sdk;
     cmdline_tools = cmdline.tools;
 
+    apple_sdk = callPackage ../os-specific/darwin/apple-sdk {
+      inherit (darwin) CF;
+    };
+
     libobjc = apple-source-releases.objc4;
   };
 
+  gnustep-make = callPackage ../development/tools/build-managers/gnustep/make {};
+  gnustep-xcode = callPackage ../development/tools/build-managers/gnustep/xcode {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
+    inherit (darwin) libobjc;
+  };
+
   devicemapper = lvm2;
 
   disk_indicator = callPackage ../os-specific/linux/disk-indicator { };
@@ -11439,7 +11399,7 @@ let
   freepv = callPackage ../applications/graphics/freepv { };
 
   xfontsel = callPackage ../applications/misc/xfontsel { };
-  xlsfonts = callPackage ../applications/misc/xlsfonts { };
+  inherit (xorg) xlsfonts;
 
   freerdp = callPackage ../applications/networking/remote/freerdp {
     ffmpeg = ffmpeg_1;
@@ -11987,6 +11947,7 @@ let
 
   mercurial = callPackage ../applications/version-management/mercurial {
     inherit (pythonPackages) curses docutils hg-git dulwich;
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
     guiSupport = false; # use mercurialFull to get hgk GUI
   };
 
@@ -12017,6 +11978,8 @@ let
 
   minidjvu = callPackage ../applications/graphics/minidjvu { };
 
+  minitube = callPackage ../applications/video/minitube { };
+
   mimms = callPackage ../applications/audio/mimms {};
 
   mirage = callPackage ../applications/graphics/mirage {};
@@ -12946,7 +12909,10 @@ let
     flup = pythonPackages.flup;
   };
 
-  vim = callPackage ../applications/editors/vim { };
+  vim = callPackage ../applications/editors/vim {
+    inherit (darwin.apple_sdk.frameworks) CoreServices Cocoa Foundation CoreData;
+    inherit (darwin) libobjc;
+  };
 
   macvim = callPackage ../applications/editors/vim/macvim.nix { stdenv = clangStdenv; };
 
@@ -13065,7 +13031,9 @@ let
     graphicsSupport = false;
   };
 
-  weechat = callPackage ../applications/networking/irc/weechat { };
+  weechat = callPackage ../applications/networking/irc/weechat {
+    inherit (darwin) libobjc;
+  };
 
   westonLite = callPackage ../applications/window-managers/weston {
     pango = null;
@@ -13267,7 +13235,7 @@ let
 
   xchm = callPackage ../applications/misc/xchm { };
 
-  xcompmgr = callPackage ../applications/window-managers/xcompmgr { };
+  inherit (xorg) xcompmgr;
 
   compton = callPackage ../applications/window-managers/compton { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2d7ea1ee9d66..97b98605cc24 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2566,11 +2566,11 @@ let self = _self // overrides; _self = with self; {
     inherit (pkgs) db;
   };
 
-  DBI = buildPerlPackage {
-    name = "DBI-1.631";
+  DBI = buildPerlPackage rec {
+    name = "DBI-1.633";
     src = fetchurl {
-      url = mirror://cpan/authors/id/T/TI/TIMB/DBI-1.631.tar.gz;
-      sha256 = "04fmrnchhwi7jx4niaiv93vmi343hdm3xj04w9zr2m9hhqh782np";
+      url = "mirror://cpan/authors/id/T/TI/TIMB/${name}.tar.gz";
+      sha256 = "1rsyrzmykl7fxpvxmrjmy3dh9szp639fqdhbccqvywpnr7fbmhg2";
     };
     meta = {
       homepage = http://dbi.perl.org/;
@@ -4026,12 +4026,13 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  FontTTF = buildPerlPackage {
-    name = "Font-TTF-0.48";
+  FontTTF = buildPerlPackage rec {
+    name = "Font-TTF-1.05";
     src = fetchurl {
-      url = mirror://cpan/authors/id/M/MH/MHOSKEN/Font-TTF-0.48.tar.gz;
-      sha256 = "0lhz7v8ihaj35y6kr7jb971hgc4iqh1nz3qbfkignb9i8b1dw97r";
+      url = "mirror://cpan/authors/id/M/MH/MHOSKEN/${name}.tar.gz";
+      sha256 = "0l7vxag0v3hf7w1kjyjv02zqrjzhg6xczcv60z00l3z0fr78xi16";
     };
+    propagatedBuildInputs = [ IOString ];
   };
 
   ForksSuper = buildPerlPackage {
@@ -4831,10 +4832,10 @@ let self = _self // overrides; _self = with self; {
   };
 
   IOTty = buildPerlPackage rec {
-    name = "IO-Tty-1.10";
+    name = "IO-Tty-1.12";
     src = fetchurl {
       url = "mirror://cpan/authors/id/T/TO/TODDR/${name}.tar.gz";
-      sha256 = "1cgqyv1zg8857inlnfczrrgpqr0r6mmqv29b7jlmxv47s4df59ii";
+      sha256 = "0399anjy3bc0w8xzsc3qx5vcyqryc9gc52lc7wh7i49hsdq8gvx2";
     };
   };
 
@@ -5372,11 +5373,11 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  LWP = buildPerlPackage {
-    name = "libwww-perl-6.05";
+  LWP = buildPerlPackage rec {
+    name = "libwww-perl-6.13";
     src = fetchurl {
-      url = mirror://cpan/authors/id/G/GA/GAAS/libwww-perl-6.05.tar.gz;
-      sha256 = "08wgwyz7748pv5cyngxia0xl6nragfnhrp4p9s78xhgfyygpj9bv";
+      url = "mirror://cpan/authors/id/E/ET/ETHER/${name}.tar.gz";
+      sha256 = "1cpqjl59viw50bnbdyn8xzrwzg7g54b2rszw0fifacqrppp17gaz";
     };
     propagatedBuildInputs = [ EncodeLocale FileListing HTMLParser HTTPCookies HTTPDaemon HTTPDate HTTPNegotiate HTTPMessage LWPMediaTypes NetHTTP URI WWWRobotRules ];
     doCheck = false; # tries to start a daemon
@@ -8994,10 +8995,10 @@ let self = _self // overrides; _self = with self; {
   };
 
   TermReadLineGnu = buildPerlPackage rec {
-    name = "Term-ReadLine-Gnu-1.24";
+    name = "Term-ReadLine-Gnu-1.26";
     src = fetchurl {
       url = "mirror://cpan/authors/id/H/HA/HAYASHI/${name}.tar.gz";
-      sha256 = "0dp18pgn8vl4dh6rgzcp1kzk4j6wjrrxd6sfcrrywy7jg4b7ikfc";
+      sha256 = "1s2dvjbh501c04s5hpf17mwirslmhqmsymg3ri4hcvh5yvp7bw7q";
     };
     buildInputs = [ pkgs.readline pkgs.ncurses ];
     NIX_CFLAGS_LINK = "-lreadline";
@@ -10655,10 +10656,10 @@ let self = _self // overrides; _self = with self; {
   };
 
   XMLLibXML = buildPerlPackage rec {
-    name = "XML-LibXML-2.0115";
+    name = "XML-LibXML-2.0121";
     src = fetchurl {
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/${name}.tar.gz";
-      sha256 = "0d6l6idl2920x9xi097fvzfdn9i0s8qa9ksw4bz2w1wh3zsn07zm";
+      sha256 = "1j8d3kmkdlzvyx3khvrcrvp798h50i6zc5i3zm04d81prc8i0hzc";
     };
     SKIP_SAX_INSTALL = 1;
     buildInputs = [ pkgs.libxml2 ];
@@ -10793,10 +10794,10 @@ let self = _self // overrides; _self = with self; {
   };
 
   XMLWriter = buildPerlPackage rec {
-    name = "XML-Writer-0.624";
+    name = "XML-Writer-0.625";
     src = fetchurl {
       url = "mirror://cpan/authors/id/J/JO/JOSEPHW/${name}.tar.gz";
-      sha256 = "0yyz0dh9b4clailbxyi90dfrqpyc6py77rmmz6qmkx7ynlpyxk46";
+      sha256 = "1gjzs570i67ywbv967g8ylb5sg59clwmyrl2yix3jl70dhn55070";
     };
   };
 
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index fe06043a8596..03259dde82d9 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -15,22 +15,25 @@ let self = with self; {
   };
 
   memcached = buildPecl {
-    name = "memcached-2.1.0";
+    name = "memcached-2.2.0";
 
-    sha256 = "1by4zhkq4mbk9ja6s0vlavv5ng8aw5apn3a1in84fkz7bc0l0jdw";
+    sha256 = "0n4z2mp4rvrbmxq079zdsrhjxjkmhz6mzi7mlcipz02cdl7n1f8p";
 
     configureFlags = [
       "--with-zlib-dir=${pkgs.zlib}"
       "--with-libmemcached-dir=${pkgs.libmemcached}"
     ];
 
-    buildInputs = [ pkgs.cyrus_sasl ];
+    buildInputs = with pkgs; [ pkgconfig cyrus_sasl ];
   };
 
   xdebug = buildPecl {
-    name = "xdebug-2.2.5";
+    name = "xdebug-2.3.1";
 
-    sha256 = "0vss35da615709kdvqji8pblckfvmabmj2njjjz6h8zzvj9gximd";
+    sha256 = "0k567i6w7cw14m13s7ip0946pvy5ii16cjwjcinnviw9c24na0xm";
+
+    doCheck = true;
+    checkTarget = "test";
   };
 
   zendopcache = buildPecl {
@@ -54,13 +57,16 @@ let self = with self; {
   xcache = buildPecl rec {
     name = "xcache-${version}";
 
-    version = "3.1.0";
+    version = "3.2.0";
 
     src = pkgs.fetchurl {
       url = "http://xcache.lighttpd.net/pub/Releases/${version}/${name}.tar.bz2";
-      sha256 = "1saysvzwkfmcyg53za4j7qnranxd6871spjzfpclhdlqm043xbw6";
+      sha256 = "1gbcpw64da9ynjxv70jybwf9y88idm01kb16j87vfagpsp5s64kx";
     };
 
+    doCheck = true;
+    checkTarget = "test";
+
     configureFlags = [
       "--enable-xcache"
       "--enable-xcache-coverager"
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a2191a362cab..ad08df9a8742 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5980,6 +5980,12 @@ let
       sha256 = "0cds7yvwdlqmd590i59vzxaviwxk4js6dkhnmdxb3p1xac7wmq9s";
     };
 
+    patchPhase = ''
+      pushd libev
+      patch -p1 < ${../development/libraries/libev/noreturn.patch}
+      popd
+    '';
+
     buildInputs = with self; [ pkgs.libev ];
     propagatedBuildInputs = optionals (!isPyPy) [ self.greenlet ];