Merge commit 'b679e14' into HEAD

14 files changed, 378 insertions, 336 deletions

diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 5634c82aa285..1edfe8bfc753 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -1,28 +1,37 @@
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
 export NIX_CFLAGS_COMPILE="-B@out@/bin/ $NIX_CFLAGS_COMPILE"
 
+# Export and assign separately in order that a failing $(..) will fail
+# the script.
+
 if [ -e @out@/nix-support/libc-cflags ]; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE"
+    export NIX_CFLAGS_COMPILE
+    NIX_CFLAGS_COMPILE="$(< @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/cc-cflags ]; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE"
+    export NIX_CFLAGS_COMPILE
+    NIX_CFLAGS_COMPILE="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/gnat-cflags ]; then
-    export NIX_GNATFLAGS_COMPILE="$(cat @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE"
+    export NIX_GNATFLAGS_COMPILE
+    NIX_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE"
 fi
 
 if [ -e @out@/nix-support/libc-ldflags ]; then
-    export NIX_LDFLAGS+=" $(cat @out@/nix-support/libc-ldflags)"
+    export NIX_LDFLAGS
+    NIX_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/cc-ldflags ]; then
-    export NIX_LDFLAGS+=" $(cat @out@/nix-support/cc-ldflags)"
+    export NIX_LDFLAGS
+    NIX_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/libc-ldflags-before ]; then
-    export NIX_LDFLAGS_BEFORE="$(cat @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE"
+    export NIX_LDFLAGS_BEFORE
+    NIX_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE"
 fi
 
 export NIX_CC_WRAPPER_FLAGS_SET=1
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index b98833b3513b..c91ff0a9d0bd 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -1,18 +1,32 @@
 hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
-hardeningFlags+=("${hardeningEnable[@]}")
+# Intentionally word-split in case 'hardeningEnable' is defined in Nix.
+hardeningFlags+=(${hardeningEnable[@]})
 hardeningCFlags=()
 hardeningLDFlags=()
-hardeningDisable=${hardeningDisable:-""}
 
-hardeningDisable+=" @hardening_unsupported_flags@"
+declare -A hardeningDisableMap
 
-if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: Value of '$hardeningDisable': $hardeningDisable >&2; fi
+# Intentionally word-split in case 'hardeningDisable' is defined in Nix. The
+# array expansion also prevents undefined variables from causing trouble with
+# `set -u`.
+for flag in ${hardeningDisable[@]} @hardening_unsupported_flags@
+do
+  hardeningDisableMap[$flag]=1
+done
 
-if [[ ! $hardeningDisable =~ "all" ]]; then
-  if [[ -n "$NIX_DEBUG" ]]; then echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2; fi
+if [[ -n "$NIX_DEBUG" ]]; then
+  printf 'HARDENING: disabled flags:' >&2
+  (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
+  echo >&2
+fi
+
+if [[ -z "${hardeningDisableMap[all]}" ]]; then
+  if [[ -n "$NIX_DEBUG" ]]; then
+    echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
+  fi
   for flag in "${hardeningFlags[@]}"
   do
-    if [[ ! "${hardeningDisable}" =~ "$flag" ]]; then
+    if [[ -z "${hardeningDisableMap[$flag]}" ]]; then
       case $flag in
         fortify)
           if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling fortify >&2; fi
@@ -20,7 +34,7 @@ if [[ ! $hardeningDisable =~ "all" ]]; then
           ;;
         stackprotector)
           if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling stackprotector >&2; fi
-          hardeningCFlags+=('-fstack-protector-strong' '--param ssp-buffer-size=4')
+          hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
           ;;
         pie)
           if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling CFlags -fPIE >&2; fi
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 99eb63f40edf..966556566077 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -1,7 +1,14 @@
-#! @shell@ -e
+#! @shell@
+set -e -o pipefail
+shopt -s nullglob
+
 path_backup="$PATH"
-if [ -n "@coreutils_bin@" ]; then
-  PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
+    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
 fi
 
 if [ -n "$NIX_CC_WRAPPER_START_HOOK" ]; then
@@ -19,16 +26,17 @@ source @out@/nix-support/utils.sh
 # For instance, figure out if linker flags should be passed.
 # GCC prints annoying warnings when they are not needed.
 dontLink=0
-getVersion=0
 nonFlagArgs=0
+# shellcheck disable=SC2193
 [[ "@prog@" = *++ ]] && isCpp=1 || isCpp=0
 cppInclude=1
 
 expandResponseParams "$@"
-n=0
-while [ $n -lt ${#params[*]} ]; do
+declare -i n=0
+nParams=${#params[@]}
+while [ "$n" -lt "$nParams" ]; do
     p=${params[n]}
-    p2=${params[$((n+1))]}
+    p2=${params[n+1]}
     if [ "$p" = -c ]; then
         dontLink=1
     elif [ "$p" = -S ]; then
@@ -55,10 +63,10 @@ while [ $n -lt ${#params[*]} ]; do
         nonFlagArgs=1
     elif [ "$p" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS+=" -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
-    n=$((n + 1))
+    n+=1
 done
 
 # If we pass a flag like -Wl, then gcc will call the linker unless it
@@ -71,26 +79,27 @@ if [ "$nonFlagArgs" = 0 ]; then
 fi
 
 # Optionally filter out paths not refering to the store.
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
+if [[ "$NIX_ENFORCE_PURITY" = 1 && -n "$NIX_STORE" ]]; then
     rest=()
-    n=0
-    while [ $n -lt ${#params[*]} ]; do
+    nParams=${#params[@]}
+    declare -i n=0
+    while [ "$n" -lt "$nParams" ]; do
         p=${params[n]}
-        p2=${params[$((n+1))]}
+        p2=${params[n+1]}
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "$p" = -L ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "$p" = -I ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         elif [ "$p" = -isystem ] && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
+            n+=1; skip "$p2"
         else
             rest+=("$p")
         fi
-        n=$((n + 1))
+        n+=1
     done
     params=("${rest[@]}")
 fi
@@ -99,11 +108,11 @@ fi
 # Clear march/mtune=native -- they bring impurity.
 if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
     rest=()
-    for i in "${params[@]}"; do
-        if [[ "$i" = -m*=native ]]; then
-            skip $i
+    for p in "${params[@]}"; do
+        if [[ "$p" = -m*=native ]]; then
+            skip "$p"
         else
-            rest+=("$i")
+            rest+=("$p")
         fi
     done
     params=("${rest[@]}")
@@ -116,23 +125,22 @@ if [[ "$isCpp" = 1 ]]; then
     NIX_CFLAGS_LINK+=" $NIX_CXXSTDLIB_LINK"
 fi
 
-LD=@ldPath@/ld
 source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE ${hardeningCFlags[@]})
+extraAfter=($NIX_CFLAGS_COMPILE "${hardeningCFlags[@]}")
 extraBefore=()
 
 if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_CFLAGS_LINK ${hardeningLDFlags[@]})
+    extraAfter+=($NIX_CFLAGS_LINK "${hardeningLDFlags[@]}")
 
     # Add the flags that should be passed to the linker (and prevent
     # `ld-wrapper' from adding NIX_LDFLAGS again).
     for i in $NIX_LDFLAGS_BEFORE; do
-        extraBefore=(${extraBefore[@]} "-Wl,$i")
+        extraBefore+=("-Wl,$i")
     done
     for i in $NIX_LDFLAGS; do
         if [ "${i:0:3}" = -L/ ]; then
@@ -155,18 +163,12 @@ fi
 
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
-  echo "original flags to @prog@:" >&2
-  for i in "${params[@]}"; do
-      echo "  $i" >&2
-  done
-  echo "extraBefore flags to @prog@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" "${params[@]}" >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
 if [ -n "$NIX_CC_WRAPPER_EXEC_HOOK" ]; then
@@ -174,4 +176,4 @@ if [ -n "$NIX_CC_WRAPPER_EXEC_HOOK" ]; then
 fi
 
 PATH="$path_backup"
-exec @prog@ ${extraBefore[@]} "${params[@]}" "${extraAfter[@]}"
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index 0d74527dd8ad..dd97a07bd19a 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -1,7 +1,13 @@
-#! @shell@ -e
+#! @shell@
+set -e -o pipefail
+shopt -s nullglob
+
 path_backup="$PATH"
+
+# phase separation makes this look useless
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
-  PATH="@coreutils_bin@/bin"
+    PATH="@coreutils_bin@/bin"
 fi
 
 if [ -n "$NIX_GNAT_WRAPPER_START_HOOK" ]; then
@@ -18,7 +24,6 @@ source @out@/nix-support/utils.sh
 # Figure out if linker flags should be passed.  GCC prints annoying
 # warnings when they are not needed.
 dontLink=0
-getVersion=0
 nonFlagArgs=0
 
 for i in "$@"; do
@@ -30,7 +35,7 @@ for i in "$@"; do
         nonFlagArgs=1
     elif [ "$i" = -m32 ]; then
         if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
-            NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
+            NIX_LDFLAGS+=" -dynamic-linker $(< @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
 done
@@ -47,24 +52,20 @@ fi
 
 # Optionally filter out paths not refering to the store.
 params=("$@")
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
+if [[ "$NIX_ENFORCE_PURITY" = 1 && -n "$NIX_STORE" ]]; then
     rest=()
-    n=0
-    while [ $n -lt ${#params[*]} ]; do
-        p=${params[n]}
-        p2=${params[$((n+1))]}
+    for p in "${params[@]}"; do
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:4}" = -aI/ ] && badPath "${p:3}"; then
-            skip $p
+            skip "${p:2}"
         elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
-            skip $p
+            skip "${p:2}"
         else
             rest+=("$p")
         fi
-        n=$((n + 1))
     done
     params=("${rest[@]}")
 fi
@@ -73,11 +74,11 @@ fi
 # Clear march/mtune=native -- they bring impurity.
 if [ "$NIX_ENFORCE_NO_NATIVE" = 1 ]; then
     rest=()
-    for i in "${params[@]}"; do
-        if [[ "$i" = -m*=native ]]; then
-            skip $i
+    for p in "${params[@]}"; do
+        if [[ "$p" = -m*=native ]]; then
+            skip "$p"
         else
-            rest+=("$i")
+            rest+=("$p")
         fi
     done
     params=("${rest[@]}")
@@ -88,30 +89,34 @@ fi
 extraAfter=($NIX_GNATFLAGS_COMPILE)
 extraBefore=()
 
-if [ "`basename $0`x" = "gnatmakex" ]; then
-  extraBefore=("--GNATBIND=@out@/bin/gnatbind --GNATLINK=@out@/bin/gnatlink ")
+if [ "$(basename "$0")x" = "gnatmakex" ]; then
+  extraBefore=("--GNATBIND=@out@/bin/gnatbind" "--GNATLINK=@out@/bin/gnatlink ")
 fi
 
-# Add the flags that should be passed to the linker (and prevent
-# `ld-wrapper' from adding NIX_LDFLAGS again).
-#for i in $NIX_LDFLAGS_BEFORE; do
-#    extraBefore=(${extraBefore[@]} "-largs $i")
-#done
+#if [ "$dontLink" != 1 ]; then
+#    # Add the flags that should be passed to the linker (and prevent
+#    # `ld-wrapper' from adding NIX_LDFLAGS again).
+#    for i in $NIX_LDFLAGS_BEFORE; do
+#        extraBefore+=("-largs" "$i")
+#    done
+#    for i in $NIX_LDFLAGS; do
+#        if [ "${i:0:3}" = -L/ ]; then
+#            extraAfter+=("$i")
+#        else
+#            extraAfter+=("-largs" "$i")
+#        fi
+#    done
+#    export NIX_LDFLAGS_SET=1
+#fi
 
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
-  echo "original flags to @prog@:" >&2
-  for i in "${params[@]}"; do
-      echo "  $i" >&2
-  done
-  echo "extraBefore flags to @prog@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" "${params[@]}" >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
 if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
@@ -119,4 +124,4 @@ if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
 fi
 
 PATH="$path_backup"
-exec @prog@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
index c9958dbbb413..3c1a805c3fa3 100644
--- a/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnatlink-wrapper.sh
@@ -1,33 +1,37 @@
-#! @shell@ -e
+#! @shell@
+set -e -o pipefail
+shopt -s nullglob
 
 # Add the flags for the GNAT compiler proper.
-extraAfter="--GCC=@out@/bin/gcc"
+extraAfter=("--GCC=@out@/bin/gcc")
 extraBefore=()
 
-# Add the flags that should be passed to the linker (and prevent
-# `ld-wrapper' from adding NIX_LDFLAGS again).
+## Add the flags that should be passed to the linker (and prevent
+## `ld-wrapper' from adding NIX_LDFLAGS again).
 #for i in $NIX_LDFLAGS_BEFORE; do
-#    extraBefore=(${extraBefore[@]} "-largs $i")
+#    extraBefore+=("-largs" "$i")
 #done
+#for i in $NIX_LDFLAGS; do
+#    if [ "${i:0:3}" = -L/ ]; then
+#        extraAfter+=("$i")
+#    else
+#        extraAfter+=("-largs" "$i")
+#    fi
+#done
+#export NIX_LDFLAGS_SET=1
 
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
-  echo "original flags to @prog@:" >&2
-  for i in "$@"; do
-      echo "  $i" >&2
-  done
-  echo "extraBefore flags to @prog@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @prog@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" "$@" >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
 if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
     source "$NIX_GNAT_WRAPPER_EXEC_HOOK"
 fi
 
-exec @prog@ ${extraBefore[@]} "$@" ${extraAfter[@]}
+exec @prog@ "${extraBefore[@]}" "$@" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
index 263ea5408e9a..72c999ff8bc8 100755
--- a/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-solaris-wrapper.sh
@@ -1,40 +1,25 @@
 #!@shell@
+set -eu -o pipefail
+shopt -s nullglob
 
-set -e
-set -u
-
+declare -a args=("$@")
 # I've also tried adding -z direct and -z lazyload, but it gave too many problems with C++ exceptions :'(
 # Also made sure libgcc would not be lazy-loaded, as suggested here: https://www.illumos.org/issues/2534#note-3
 #   but still no success.
-cmd="@ld@ -z ignore"
-
-args=("$@");
+declare -a argsBefore=(-z ignore) argsAfter=()
 
 # This loop makes sure all -L arguments are before -l arguments, or ld may complain it cannot find a library.
 # GNU binutils does not have this problem:
 #   http://stackoverflow.com/questions/5817269/does-the-order-of-l-and-l-options-in-the-gnu-linker-matter
-i=0;
-while [[ $i -lt $# ]]; do
+while (( $# )); do
     case "${args[$i]}" in
-        -L)  cmd="$cmd ${args[$i]} ${args[($i+1)]}"; i=($i+1); ;;
-        -L*) cmd="$cmd ${args[$i]}" ;;
-        *)   ;;
+        -L)   argsBefore+=("$1" "$2"); shift ;;
+        -L?*) argsBefore+=("$1") ;;
+        *)    argsAfter+=("$1") ;;
     esac
-    i=($i+1);
-done
-
-i=0;
-while [[ $i -lt $# ]]; do
-    case "${args[$i]}" in
-        -L)  i=($i+1); ;;
-        -L*) ;;
-        *)   cmd="$cmd ${args[$i]}" ;;
-    esac
-    i=($i+1);
+    shift
 done
 
 # Trace:
 set -x
-exec $cmd
-
-exit 0
+exec "@ld@" "${argsBefore[@]}" "${argsAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index 72c0be304acb..6ee66b0e3f2b 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -1,8 +1,13 @@
-#! @shell@ -e
+#! @shell@
+set -e -o pipefail
 shopt -s nullglob
+
 path_backup="$PATH"
+
+# phase separation makes this look useless
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
-  PATH="@coreutils_bin@/bin"
+    PATH="@coreutils_bin@/bin"
 fi
 
 if [ -n "$NIX_LD_WRAPPER_START_HOOK" ]; then
@@ -18,14 +23,14 @@ source @out@/nix-support/utils.sh
 
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
-if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
-        -a \( -z "$NIX_IGNORE_LD_THROUGH_GCC" -o -z "$NIX_LDFLAGS_SET" \) ]; then
+if [[ "$NIX_ENFORCE_PURITY" = 1 && -n "$NIX_STORE"
+        && ( -z "$NIX_IGNORE_LD_THROUGH_GCC" || -z "$NIX_LDFLAGS_SET" ) ]]; then
     rest=()
     nParams=${#params[@]}
     declare -i n=0
-    while [ $n -lt $nParams ]; do
+    while [ "$n" -lt "$nParams" ]; do
         p=${params[n]}
-        p2=${params[$((n+1))]}
+        p2=${params[n+1]}
         if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
             skip "${p:2}"
         elif [ "$p" = -L ] && badPath "$p2"; then
@@ -49,18 +54,17 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
     params=("${rest[@]}")
 fi
 
-LD=@prog@
 source @out@/nix-support/add-hardening.sh
 
-extra=("${hardeningLDFlags[@]}")
+extraAfter=("${hardeningLDFlags[@]}")
 extraBefore=()
 
 if [ -z "$NIX_LDFLAGS_SET" ]; then
-    extra+=($NIX_LDFLAGS)
+    extraAfter+=($NIX_LDFLAGS)
     extraBefore+=($NIX_LDFLAGS_BEFORE)
 fi
 
-extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
+extraAfter+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
 
 declare -a libDirs
 declare -A libs
@@ -69,7 +73,7 @@ relocatable=
 # Find all -L... switches for rpath, and relocatable flags for build id.
 if [ "$NIX_DONT_SET_RPATH" != 1 ] || [ "$NIX_SET_BUILD_ID" = 1 ]; then
     prev=
-    for p in "${params[@]}" "${extra[@]}"; do
+    for p in "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"; do
         case "$prev" in
             -L)
                 libDirs+=("$p")
@@ -127,7 +131,7 @@ if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
                 libs["$file"]=
                 if [ ! "${rpaths[$dir]}" ]; then
                     rpaths["$dir"]=1
-                    extra+=(-rpath "$dir")
+                    extraAfter+=(-rpath "$dir")
                 fi
             fi
         done
@@ -138,16 +142,18 @@ fi
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
 if [ "$NIX_SET_BUILD_ID" = 1 ] && [ ! "$relocatable" ]; then
-    extra+=(--build-id)
+    extraAfter+=(--build-id)
 fi
 
 
 # Optionally print debug info.
 if [ -n "$NIX_DEBUG" ]; then
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}"  >&2
     echo "original flags to @prog@:" >&2
     printf "  %q\n" "${params[@]}" >&2
-    echo "extra flags to @prog@:" >&2
-    printf "  %q\n" "${extraBefore[@]}" "${extra[@]}" >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
 fi
 
 if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
@@ -155,4 +161,4 @@ if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
 fi
 
 PATH="$path_backup"
-exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extra[@]}"
+exec @prog@ "${extraBefore[@]}" "${params[@]}" "${extraAfter[@]}"
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 104b82425f29..2bf507ce8dff 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -1,45 +1,50 @@
 addCVars () {
-    if [ -d $1/include ]; then
+    if [[ -d "$1/include" ]]; then
         export NIX_CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
     fi
 
-    if [ -d $1/lib64 -a ! -L $1/lib64 ]; then
+    if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
         export NIX_LDFLAGS+=" -L$1/lib64"
     fi
 
-    if [ -d $1/lib ]; then
+    if [[ -d "$1/lib" ]]; then
         export NIX_LDFLAGS+=" -L$1/lib"
     fi
 
-    if test -d $1/Library/Frameworks; then
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -F$1/Library/Frameworks"
+    if [[ -d "$1/Library/Frameworks" ]]; then
+        export NIX_CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
     fi
 }
 
 envHooks+=(addCVars)
 
-# Note: these come *after* $out in the PATH (see setup.sh).
+# Note 1: these come *after* $out in the PATH (see setup.sh).
+# Note 2: phase separation makes this look useless to shellcheck.
 
+# shellcheck disable=SC2157
 if [ -n "@cc@" ]; then
     addToSearchPath _PATH @cc@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@binutils_bin@" ]; then
     addToSearchPath _PATH @binutils_bin@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@libc_bin@" ]; then
     addToSearchPath _PATH @libc_bin@/bin
 fi
 
+# shellcheck disable=SC2157
 if [ -n "@coreutils_bin@" ]; then
     addToSearchPath _PATH @coreutils_bin@/bin
 fi
 
-if [ -z "$crossConfig" ]; then
-  ENV_PREFIX=""
+if [ -z "${crossConfig:-}" ]; then
+    ENV_PREFIX=""
 else
-  ENV_PREFIX="BUILD_"
+    ENV_PREFIX="BUILD_"
 fi
 
 export NIX_${ENV_PREFIX}CC=@out@
diff --git a/pkgs/build-support/cc-wrapper/utils.sh b/pkgs/build-support/cc-wrapper/utils.sh
index 87e48da9c8d5..267044b2c4f3 100644
--- a/pkgs/build-support/cc-wrapper/utils.sh
+++ b/pkgs/build-support/cc-wrapper/utils.sh
@@ -24,11 +24,15 @@ badPath() {
 }
 
 expandResponseParams() {
-    params=("$@")
+    declare -g params=("$@")
     local arg
     for arg in "$@"; do
         if [[ "$arg" == @* ]]; then
+            # phase separation makes this look useless
+            # shellcheck disable=SC2157
             if [ -n "@expandResponseParams@" ]; then
+                # params is used by caller
+                #shellcheck disable=SC2034
                 readarray -d '' params < <("@expandResponseParams@" "$@")
                 return 0
             else
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
index 9891128a6231..79b8d5b73fa1 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh
@@ -39,7 +39,7 @@ wrapGAppsHook() {
     targetDirs=( "${prefix}/bin" "${prefix}/libexec" )
     for targetDir in "${targetDirs[@]}"; do
       if [[ -d "${targetDir}" ]]; then
-        find "${targetDir}" -type f -executable -print0 \
+        find -L "${targetDir}" -type f -executable -print0 \
           | while IFS= read -r -d '' file; do
           echo "Wrapping program ${file}"
           wrapProgram "${file}" "${gappsWrapperArgs[@]}"
diff --git a/pkgs/desktops/gnome-3/3.22/apps/polari/default.nix b/pkgs/desktops/gnome-3/3.22/apps/polari/default.nix
index a827831c801c..f14a1ef3c47d 100644
--- a/pkgs/desktops/gnome-3/3.22/apps/polari/default.nix
+++ b/pkgs/desktops/gnome-3/3.22/apps/polari/default.nix
@@ -1,15 +1,15 @@
 { stdenv, intltool, fetchurl, gdk_pixbuf, adwaita-icon-theme
 , telepathy_glib, gjs, itstool, telepathy_idle, libxml2
 , pkgconfig, gtk3, glib, librsvg, libsecret, libsoup
-, gnome3, wrapGAppsHook }:
+, gnome3, wrapGAppsHook, telepathy_logger }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
-  propagatedUserEnvPkgs = [ telepathy_idle ];
+  propagatedUserEnvPkgs = [ telepathy_idle telepathy_logger ];
 
-  buildInputs = [ pkgconfig gtk3 glib intltool itstool adwaita-icon-theme wrapGAppsHook
-                  telepathy_glib gjs gdk_pixbuf librsvg libxml2 libsecret libsoup ];
+  buildInputs = [ pkgconfig gtk3 glib intltool itstool adwaita-icon-theme wrapGAppsHook gnome3.gsettings_desktop_schemas
+                  telepathy_glib telepathy_logger gjs gdk_pixbuf librsvg libxml2 libsecret libsoup ];
 
   enableParallelBuilding = true;
 
@@ -19,6 +19,5 @@ stdenv.mkDerivation rec {
     maintainers = gnome3.maintainers;
     license = licenses.gpl2;
     platforms = platforms.linux;
-    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 205faa845fee..0a2deab796bb 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,16 +1,26 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchpatch, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "expat-2.2.2";
+  name = "expat-2.2.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/expat/${name}.tar.bz2";
-    sha256 = "0ik0r39ala9c6hj4kxrk933klgwkzlkbrfhvhaykx8l1rwgr2xj3";
+    sha256 = "0pyfma0sv4vif17kfv7xh2l2hl6skgw266a9cwm00p7q0bxr065k";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers
   outputBin = "dev";
 
+  patches = [
+    (fetchpatch {
+      name = "fix-aarch-build.patch";
+      url = "https://github.com/libexpat/libexpat/commit/d98d4399174fd6f71d70e7bd89993a0e7346753d.patch";
+      sha256 = "0z89wb4mzyf7vvl6kbflk5w1z7yc39jwvs3mkznin5agj34x063w";
+      stripLen = 1;
+      excludes = [ "coverage.sh" ];
+    })
+  ];
+
   configureFlags = stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
 
   outputMan = "dev"; # tiny page for a dev tool
diff --git a/pkgs/development/libraries/qt-5/5.9/fetch.sh b/pkgs/development/libraries/qt-5/5.9/fetch.sh
index 60acf2cea9d2..2ae85bba391d 100644
--- a/pkgs/development/libraries/qt-5/5.9/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.9/fetch.sh
@@ -1,3 +1,2 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.9/5.9.0/submodules/ \
-            http://download.qt.io/community_releases/5.9/5.9.0-final/ \
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.9/5.9.1/submodules/ \
             -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-5/5.9/srcs.nix b/pkgs/development/libraries/qt-5/5.9/srcs.nix
index 021cd935a14c..247800b75780 100644
--- a/pkgs/development/libraries/qt-5/5.9/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.9/srcs.nix
@@ -3,331 +3,331 @@
 
 {
   qt3d = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qt3d-opensource-src-5.9.0.tar.xz";
-      sha256 = "1a8v70svsqxissj0rmna71f9g2w56w0zgk5s41m5acgvi9byzywy";
-      name = "qt3d-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qt3d-opensource-src-5.9.1.tar.xz";
+      sha256 = "15j9znfnxch1n6fwz9ngi30msdzh0wlpykl53cs8g2fp2awfa7sg";
+      name = "qt3d-opensource-src-5.9.1.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtactiveqt-opensource-src-5.9.0.tar.xz";
-      sha256 = "0d8n4q3r54kkb340ap802cc97jznhffzx1m7h2775q0h2nzvmiyp";
-      name = "qtactiveqt-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtactiveqt-opensource-src-5.9.1.tar.xz";
+      sha256 = "07zq60xg7nnlny7qgj6dk1ibg3fzhbdh78gpd0s6x1n822iyislg";
+      name = "qtactiveqt-opensource-src-5.9.1.tar.xz";
     };
   };
   qtandroidextras = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtandroidextras-opensource-src-5.9.0.tar.xz";
-      sha256 = "0xq3nd8nlbmd617lq60nb2lxblc84lk8wh14n18b3q81nsvc2yln";
-      name = "qtandroidextras-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtandroidextras-opensource-src-5.9.1.tar.xz";
+      sha256 = "0nq879jsa2z1l5q3n0hhiv15mzfm5c6s7zfblcc10sgim90p5mjj";
+      name = "qtandroidextras-opensource-src-5.9.1.tar.xz";
     };
   };
   qtbase = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtbase-opensource-src-5.9.0.tar.xz";
-      sha256 = "0v19spxa4sfq0a35nab9n8n2s3jd0443px0k45zhhg103apv4zi6";
-      name = "qtbase-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtbase-opensource-src-5.9.1.tar.xz";
+      sha256 = "1ikm896jzyfyjv2qv8n3fd81sxb4y24zkygx36865ygzyvlj36mw";
+      name = "qtbase-opensource-src-5.9.1.tar.xz";
     };
   };
   qtcanvas3d = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtcanvas3d-opensource-src-5.9.0.tar.xz";
-      sha256 = "1jrv79rhpqyp4ip5fnf40plqcq9byl1fy8287ghq4jfhpm9bq5yq";
-      name = "qtcanvas3d-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtcanvas3d-opensource-src-5.9.1.tar.xz";
+      sha256 = "10fy8wqfw2yhha6lyky5g1a72137aj8pji7mk0wjnggh629z12sb";
+      name = "qtcanvas3d-opensource-src-5.9.1.tar.xz";
     };
   };
   qtcharts = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtcharts-opensource-src-5.9.0.tar.xz";
-      sha256 = "17m86csjymvcnprk8m4y6hx1qhlk9811rhqwwkqdymyyswx6xs3l";
-      name = "qtcharts-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtcharts-opensource-src-5.9.1.tar.xz";
+      sha256 = "180df5v7i1ki8hc3lgi6jcfdyz7f19pb73dvfkw402wa2gfcna3k";
+      name = "qtcharts-opensource-src-5.9.1.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtconnectivity-opensource-src-5.9.0.tar.xz";
-      sha256 = "0k52acsywr849nw86dfjqcv1lqgnq01akqrm0qjs7ysm1ayg8mcp";
-      name = "qtconnectivity-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtconnectivity-opensource-src-5.9.1.tar.xz";
+      sha256 = "1mbzmqix0388iq20a1ljd1pgdq259rm1xzp9kx8gigqpamqqnqs0";
+      name = "qtconnectivity-opensource-src-5.9.1.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtdatavis3d-opensource-src-5.9.0.tar.xz";
-      sha256 = "1wvilla48jlw6zv2hc32ra0bs8p13s68sqbgr91bzbn7h7qaysv9";
-      name = "qtdatavis3d-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtdatavis3d-opensource-src-5.9.1.tar.xz";
+      sha256 = "14d1q07winh6n1bkc616dapwfnsfkcjyg5zngdqjdj9mza8ang13";
+      name = "qtdatavis3d-opensource-src-5.9.1.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtdeclarative-opensource-src-5.9.0.tar.xz";
-      sha256 = "1g9yz7q2laqs80m4i6zngxrq3pd7z5khr2f48glma8cmiw4p56rw";
-      name = "qtdeclarative-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtdeclarative-opensource-src-5.9.1.tar.xz";
+      sha256 = "1zwlxrgraxhlsdkwsai3pjbz7f3a6rsnsg2mjrpay6cz3af6rznj";
+      name = "qtdeclarative-opensource-src-5.9.1.tar.xz";
     };
   };
   qtdoc = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtdoc-opensource-src-5.9.0.tar.xz";
-      sha256 = "1k67i67npcjyr89hlnljjxw5jkh49ql8yzw9m9b4gld7nk9dr4kr";
-      name = "qtdoc-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtdoc-opensource-src-5.9.1.tar.xz";
+      sha256 = "1d2kk9wzm2261ap87nyf743a4662gll03gz5yh5qi7k620lk372x";
+      name = "qtdoc-opensource-src-5.9.1.tar.xz";
     };
   };
   qtgamepad = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtgamepad-opensource-src-5.9.0.tar.xz";
-      sha256 = "0lpj2qspidx6s2568m5v40j2zdnrl8zwjdp40zg4y2q6hy2gg597";
-      name = "qtgamepad-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtgamepad-opensource-src-5.9.1.tar.xz";
+      sha256 = "055w4649zi93q1sl32ngqwgnl2vxw1idnm040s9gjgjb67gi81zi";
+      name = "qtgamepad-opensource-src-5.9.1.tar.xz";
     };
   };
   qtgraphicaleffects = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtgraphicaleffects-opensource-src-5.9.0.tar.xz";
-      sha256 = "1cz4ykwlm1c0hbv4d8y07bwyz87nkz5l9ss3f65vadm8zcabqw55";
-      name = "qtgraphicaleffects-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtgraphicaleffects-opensource-src-5.9.1.tar.xz";
+      sha256 = "1zsr3a5dsmpvrb5h4m4h42wqmkvkks3d8mmyrx4k0mfr6s7c71jz";
+      name = "qtgraphicaleffects-opensource-src-5.9.1.tar.xz";
     };
   };
   qtimageformats = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtimageformats-opensource-src-5.9.0.tar.xz";
-      sha256 = "10alm3kz3md835hf5hx7322bak9pp9igi2knvymxsjqr8x87jq94";
-      name = "qtimageformats-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtimageformats-opensource-src-5.9.1.tar.xz";
+      sha256 = "0iwa3dys5rv706cpxwhmgircv783pmlyl1yrsc5i0rha643y7zkr";
+      name = "qtimageformats-opensource-src-5.9.1.tar.xz";
     };
   };
   qtlocation = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtlocation-opensource-src-5.9.0.tar.xz";
-      sha256 = "1xia1y1pjill9m880rgmsl2zshcg1nvwkyfdb2lz8g8x9fj0pvp3";
-      name = "qtlocation-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtlocation-opensource-src-5.9.1.tar.xz";
+      sha256 = "058mgvlaml9rkfhkpr1n3avhi12zlva131sqhbwj4lwwyqfkri2b";
+      name = "qtlocation-opensource-src-5.9.1.tar.xz";
     };
   };
   qtmacextras = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtmacextras-opensource-src-5.9.0.tar.xz";
-      sha256 = "1przk4dbyjdy18a5x1c4m04v40d70nkgwc569zjccpbqz0a0agbx";
-      name = "qtmacextras-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtmacextras-opensource-src-5.9.1.tar.xz";
+      sha256 = "0096g9l2hwsiwlzfjkw7rhkdnyvb5gzjzyjjg9kqfnsagbwscv11";
+      name = "qtmacextras-opensource-src-5.9.1.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtmultimedia-opensource-src-5.9.0.tar.xz";
-      sha256 = "1vk0vlp9wapj1pip5v0v0sxynlig38m3a1qbjhid3rm27f971cqb";
-      name = "qtmultimedia-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtmultimedia-opensource-src-5.9.1.tar.xz";
+      sha256 = "1r76zvbv6wwb7lgw9jwlx382iyw34i1amxaypb5bg3j1niqvx3z4";
+      name = "qtmultimedia-opensource-src-5.9.1.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtnetworkauth-opensource-src-5.9.0.tar.xz";
-      sha256 = "157byylzir8cr5y407qpjmz9ag0b0qaz99n99nl2xjxkyll8ph0g";
-      name = "qtnetworkauth-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtnetworkauth-opensource-src-5.9.1.tar.xz";
+      sha256 = "1fgax3p7lqcz29z2n1qxnfpkj3wxq1x9bfx61q6nss1fs74pxzra";
+      name = "qtnetworkauth-opensource-src-5.9.1.tar.xz";
     };
   };
   qtpurchasing = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtpurchasing-opensource-src-5.9.0.tar.xz";
-      sha256 = "0xcka24qjdydqhf7fhn2i2ycn3zsi4vzqv9s77wzmaksrazwb13q";
-      name = "qtpurchasing-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtpurchasing-opensource-src-5.9.1.tar.xz";
+      sha256 = "0b1hlaq6rb7d6b6h8kqd26klcpzf9vcdjrv610kdj0drb00jg3ss";
+      name = "qtpurchasing-opensource-src-5.9.1.tar.xz";
     };
   };
   qtquickcontrols = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtquickcontrols-opensource-src-5.9.0.tar.xz";
-      sha256 = "1zjl2wp5407y8iabwi30j4jpxh2j4y0ijb5jvvpdq583nbzgyg8p";
-      name = "qtquickcontrols-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtquickcontrols-opensource-src-5.9.1.tar.xz";
+      sha256 = "0bpc465q822phw3dcbddn70wj1fjlc2hxskkp1z9gl7r23hx03jj";
+      name = "qtquickcontrols-opensource-src-5.9.1.tar.xz";
     };
   };
   qtquickcontrols2 = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtquickcontrols2-opensource-src-5.9.0.tar.xz";
-      sha256 = "170xgk4jw1b1rpq8838dc5sb0dyv1jap3yfgg5hymrjzrk0nzaq9";
-      name = "qtquickcontrols2-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtquickcontrols2-opensource-src-5.9.1.tar.xz";
+      sha256 = "1zq86kqz85wm3n84jcxkxw5x1mrhkqzldkigf8xm3l8j24rf0fr0";
+      name = "qtquickcontrols2-opensource-src-5.9.1.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtremoteobjects-opensource-src-5.9.0.tar.xz";
-      sha256 = "0f8dv7sswzck0l2md1zl44cbvi54mm6iiz4qh2hh3vqwyj9k5xyr";
-      name = "qtremoteobjects-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtremoteobjects-opensource-src-5.9.1.tar.xz";
+      sha256 = "10kwq0fgmi6zsqhb6s1nkcydpyl8d8flzdpgmyj50c4h2xhg2km0";
+      name = "qtremoteobjects-opensource-src-5.9.1.tar.xz";
     };
   };
   qtscript = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtscript-opensource-src-5.9.0.tar.xz";
-      sha256 = "0r697ap324l8lnbqbhrrqzsl9k4nmk6lcijxlaqn3ksxgfzbcciw";
-      name = "qtscript-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtscript-opensource-src-5.9.1.tar.xz";
+      sha256 = "13qq2mjfhqdcvkmzrgxg1gr5kww1ygbwb7r71xxl6rjzbn30hshp";
+      name = "qtscript-opensource-src-5.9.1.tar.xz";
     };
   };
   qtscxml = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtscxml-opensource-src-5.9.0.tar.xz";
-      sha256 = "0f2jnhl30ij6y4wzlvgjsqgpaywq4g0wc4yjw8s888vcfl062nb4";
-      name = "qtscxml-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtscxml-opensource-src-5.9.1.tar.xz";
+      sha256 = "1m3b6wg5hqasdfc5igpj9bq3czql5kkvvn3rx1ig508kdlh5i5s0";
+      name = "qtscxml-opensource-src-5.9.1.tar.xz";
     };
   };
   qtsensors = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtsensors-opensource-src-5.9.0.tar.xz";
-      sha256 = "0jdaw0i6rirs66x4cjh8l24fsyp020x1mv1psyf3ffbkdq1pngjx";
-      name = "qtsensors-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtsensors-opensource-src-5.9.1.tar.xz";
+      sha256 = "1772x7r6y9xv2sv0w2dfz2yhagsq5bpa9kdpzg0qikccmabr7was";
+      name = "qtsensors-opensource-src-5.9.1.tar.xz";
     };
   };
   qtserialbus = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtserialbus-opensource-src-5.9.0.tar.xz";
-      sha256 = "1zw32ha5hz7zsdp8m2dk58kivxd66vkzijbnhi8jvzjp4nf0pm1f";
-      name = "qtserialbus-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtserialbus-opensource-src-5.9.1.tar.xz";
+      sha256 = "1hzk377c3zl4dm5hxwvpxg2w096m160448y9df6v6l8xpzpzxafa";
+      name = "qtserialbus-opensource-src-5.9.1.tar.xz";
     };
   };
   qtserialport = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtserialport-opensource-src-5.9.0.tar.xz";
-      sha256 = "0zwxfbyn5rg6vyrgpi5c3n852vd32m37ghzyj4l50ljndlz2w0l0";
-      name = "qtserialport-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtserialport-opensource-src-5.9.1.tar.xz";
+      sha256 = "0sbsc7n701kxl16r247a907zg2afmbx1xlml5jkc6a9956zqbzp1";
+      name = "qtserialport-opensource-src-5.9.1.tar.xz";
     };
   };
   qtspeech = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtspeech-opensource-src-5.9.0.tar.xz";
-      sha256 = "0da7q3j49hn9j2wy0ny4ym4nxy33yi8p62v9vrq9r9lb4xqjipcl";
-      name = "qtspeech-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtspeech-opensource-src-5.9.1.tar.xz";
+      sha256 = "00daxkf8iwf6n9rhkkv3isv5qa8wijwzb0zy1f6zlm3vcc8fz75c";
+      name = "qtspeech-opensource-src-5.9.1.tar.xz";
     };
   };
   qtsvg = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtsvg-opensource-src-5.9.0.tar.xz";
-      sha256 = "0zpy53vb0ckaj71ffl450qv9kipl8gwwcbbras8kbg6bpl8srl8g";
-      name = "qtsvg-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtsvg-opensource-src-5.9.1.tar.xz";
+      sha256 = "1rg2q4snh2g4n93zmk995swwkl0ab1jr9ka9xpj56ddifkw99wlr";
+      name = "qtsvg-opensource-src-5.9.1.tar.xz";
     };
   };
   qttools = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qttools-opensource-src-5.9.0.tar.xz";
-      sha256 = "1vl5lapnbaam51pfw89pshh6rxqwfrbpj0j8gdhzdngr6n79dzk4";
-      name = "qttools-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qttools-opensource-src-5.9.1.tar.xz";
+      sha256 = "1s50kh3sg5wc5gqhwwznnibh7jcnfginnmkv66w62mm74k7mdsy4";
+      name = "qttools-opensource-src-5.9.1.tar.xz";
     };
   };
   qttranslations = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qttranslations-opensource-src-5.9.0.tar.xz";
-      sha256 = "0xsgvk8j7zl4infgmrkhdmjkizcihddqn9sc5g1dv2d94gc83jaw";
-      name = "qttranslations-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qttranslations-opensource-src-5.9.1.tar.xz";
+      sha256 = "0sdjiqli15fmkbqvhhgjfavff906sg56jx5xf8bg6xzd2j5544ja";
+      name = "qttranslations-opensource-src-5.9.1.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtvirtualkeyboard-opensource-src-5.9.0.tar.xz";
-      sha256 = "0xks7n70631p5ij7vbww5ihni6iscx9hkdw8c97nnzb1bvvaqx19";
-      name = "qtvirtualkeyboard-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtvirtualkeyboard-opensource-src-5.9.1.tar.xz";
+      sha256 = "0k79sqa8bg6gkbsk16320gnila1iiwpnl3vx03rysm5bqdnnlx3b";
+      name = "qtvirtualkeyboard-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwayland = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwayland-opensource-src-5.9.0.tar.xz";
-      sha256 = "0zlxlxrc15x69jwhcc6h0xi4mfchbb3pf27y3zy22yi3ynv2p04v";
-      name = "qtwayland-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwayland-opensource-src-5.9.1.tar.xz";
+      sha256 = "1yizvbmh26mx1ffq0qaci02g2wihy68ld0y7r3z8nx3v5acb236g";
+      name = "qtwayland-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwebchannel-opensource-src-5.9.0.tar.xz";
-      sha256 = "1fg1g2h9s9v6lg10ix59pzws35fyh3hh5x2005pyp84xdg47mvqj";
-      name = "qtwebchannel-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebchannel-opensource-src-5.9.1.tar.xz";
+      sha256 = "003h09mla82f2znb8jjigx13ivc68ikgv7w04594yy7qdmd5yhl0";
+      name = "qtwebchannel-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebengine = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwebengine-opensource-src-5.9.0.tar.xz";
-      sha256 = "085qq852kwb8rqw12w96647vfvsgqvw33wc4xn3cb2gwn1wsbm1f";
-      name = "qtwebengine-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebengine-opensource-src-5.9.1.tar.xz";
+      sha256 = "00b4d18m54pbxa1hm6ijh2mrd4wmrs7lkplys8b4liw8j7mpx8zn";
+      name = "qtwebengine-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebkit = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/community_releases/5.9/5.9.0-final/qtwebkit-opensource-src-5.9.0.tar.xz";
-      sha256 = "012fd8khiasfn8wx5ci310y94ap3y90a011f66cajm80fhxikbcd";
-      name = "qtwebkit-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebkit-opensource-src-5.9.1.tar.xz";
+      sha256 = "1ksjn1vjbfhdm4y4rg08ag4krk87ahp7qcdcpwll42l0rnz61998";
+      name = "qtwebkit-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebkit-examples = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/community_releases/5.9/5.9.0-final/qtwebkit-examples-opensource-src-5.9.0.tar.xz";
-      sha256 = "0zj700z90k4sss1b5zg4rlg5pkq79q72pql1d6zglrgp505s9a7x";
-      name = "qtwebkit-examples-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebkit-examples-opensource-src-5.9.1.tar.xz";
+      sha256 = "1l2l7ycgqql6rf4gx6sjhsqjapdhvy6vxaxssax3l938nkk4vkp4";
+      name = "qtwebkit-examples-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwebsockets-opensource-src-5.9.0.tar.xz";
-      sha256 = "1ml60p50hr3f68l0fiyqg2pf6n37flzxafzasis42jm4m757m5v2";
-      name = "qtwebsockets-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebsockets-opensource-src-5.9.1.tar.xz";
+      sha256 = "0r1lya2jj3wfci82zfn0vk6vr8sk9k7xiphnkb0panhb8di769q1";
+      name = "qtwebsockets-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwebview = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwebview-opensource-src-5.9.0.tar.xz";
-      sha256 = "0ayjsdyymg9hrryn2y0c796cbwdf4hdpjdwjqkib57rblh5g39qw";
-      name = "qtwebview-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwebview-opensource-src-5.9.1.tar.xz";
+      sha256 = "0qmxrh4y3i9n8x6yhrlnahcn75cc2xwlc8mi4g8n2d83c3x7pxyn";
+      name = "qtwebview-opensource-src-5.9.1.tar.xz";
     };
   };
   qtwinextras = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtwinextras-opensource-src-5.9.0.tar.xz";
-      sha256 = "12xh6wqjn1wmvy7rzay6a0wyc31lgv1zida87kr67dbwblmax03j";
-      name = "qtwinextras-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtwinextras-opensource-src-5.9.1.tar.xz";
+      sha256 = "1x7f944f3g2ml3mm594qv6jlvl5dzzsxq86yinp7av0lhnyrxk0s";
+      name = "qtwinextras-opensource-src-5.9.1.tar.xz";
     };
   };
   qtx11extras = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtx11extras-opensource-src-5.9.0.tar.xz";
-      sha256 = "0smzs29zqi77s1038ddkj3wzcchajqrjymwa5jgva7n2dn2x40wy";
-      name = "qtx11extras-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtx11extras-opensource-src-5.9.1.tar.xz";
+      sha256 = "00fn3bps48gjyw0pdqvvl9scknxdpmacby6hvdrdccc3jll0wgd6";
+      name = "qtx11extras-opensource-src-5.9.1.tar.xz";
     };
   };
   qtxmlpatterns = {
-    version = "5.9.0";
+    version = "5.9.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.9/5.9.0/submodules/qtxmlpatterns-opensource-src-5.9.0.tar.xz";
-      sha256 = "1f2mly7ddw4hpr3x0lpdahcikivwhiwa3238yrg4gz2c3lxj5y21";
-      name = "qtxmlpatterns-opensource-src-5.9.0.tar.xz";
+      url = "${mirror}/official_releases/qt/5.9/5.9.1/submodules/qtxmlpatterns-opensource-src-5.9.1.tar.xz";
+      sha256 = "094wwap2fsl23cys6rxh2ciw0gxbbiqbshnn4qs1n6xdjrj6i15m";
+      name = "qtxmlpatterns-opensource-src-5.9.1.tar.xz";
     };
   };
 }