Merge branch 'staging'

Contains security fixes in X server and X libs.
On Hydra, the amount to rebuild on master is now higher than on staging;
the comparison looks OK.

54 files changed, 180 insertions, 221 deletions

diff --git a/pkgs/applications/altcoins/go-ethereum.nix b/pkgs/applications/altcoins/go-ethereum.nix
index 4a1c62535f9e..04e68b1f1282 100644
--- a/pkgs/applications/altcoins/go-ethereum.nix
+++ b/pkgs/applications/altcoins/go-ethereum.nix
@@ -19,14 +19,6 @@ buildGoPackage rec {
     sha256 = "11n77zlf8qixhx26sqf33v911716msi6h0z4ng8gxhzhznrn2nrd";
   };
 
-  # Fix cyclic referencing on Darwin
-  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
-    for file in $bin/bin/*; do
-      # Not all files are referencing $out/lib so consider this step non-critical
-      install_name_tool -delete_rpath $out/lib $file || true
-    done
-  '';
-
   meta = with stdenv.lib; {
     homepage = https://ethereum.github.io/go-ethereum/;
     description = "Official golang implementation of the Ethereum protocol";
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 8ada01d58f79..a6cd17878b0c 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, which, autoreconfHook, ncurses, perl
-, cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl, lmdb, libxslt, docbook_xsl }:
+, cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42 }:
 
 stdenv.mkDerivation rec {
   version = "20171013";
@@ -12,19 +12,12 @@ stdenv.mkDerivation rec {
     sha256 = "0zn8imqfa76bxpkpy111c4vn6vjarbxc8gqv6m18qkksk0ly26l1";
   };
 
-  nativeBuildInputs = [ autoreconfHook docbook_xsl libxslt.bin which ];
+  nativeBuildInputs = [ autoreconfHook docbook_xsl docbook_xml_dtd_42 libxslt.bin which ];
   buildInputs = [
     cyrus_sasl gss gpgme kerberos libidn ncurses
     notmuch openssl perl lmdb
   ];
 
-  postPatch = ''
-    for f in doc/*.xsl ; do
-      substituteInPlace $f \
-        --replace http://docbook.sourceforge.net/release/xsl/current ${docbook_xsl}/share/xml/docbook-xsl
-    done
-  '';
-
   configureFlags = [
     "--enable-debug"
     "--enable-gpgme"
diff --git a/pkgs/applications/networking/syncthing/inotify.nix b/pkgs/applications/networking/syncthing/inotify.nix
index c83d9a2fcd00..e33501a17158 100644
--- a/pkgs/applications/networking/syncthing/inotify.nix
+++ b/pkgs/applications/networking/syncthing/inotify.nix
@@ -25,8 +25,6 @@ buildGoPackage rec {
     substitute $src/etc/linux-systemd/user/syncthing-inotify.service \
                $bin/lib/systemd/user/syncthing-inotify.service \
                --replace /usr/bin/syncthing-inotify $bin/bin/syncthing-inotify
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/syncthing-inotify
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index 1522f348ca1a..a86a7f96e097 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -29,9 +29,7 @@ buildGoPackage rec {
 
   outputs = [ "bin" "out" "data" ];
 
-  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/gogs
-  '' + ''
+  postInstall = ''
     mkdir $data
     cp -R $src/{public,templates} $data
 
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 39a85a03199d..ebc1249dc11d 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -29,6 +29,9 @@ stdenv.mkDerivation rec {
     sha256 = "11b83qazc8h0iidyj1rprnnjdivj1lpphvpa08y53n42bfa36pn5";
   };
 
+  # Fixup build with icu-59
+  postPatch = "sed '1i#include <unicode/unistr.h>' -i src/utils.cpp";
+
   buildInputs = with stdenv.lib;
   [ pkgconfig intltool libX11 wxGTK fontconfig freetype mesa
     libass fftw ffms ffmpeg zlib icu boost boost.out libiconv
diff --git a/pkgs/build-support/cc-wrapper/ld-wrapper.sh b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
index bbab3c43d6f8..232e1245af07 100644
--- a/pkgs/build-support/cc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/ld-wrapper.sh
@@ -171,11 +171,13 @@ if [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ]; then
         done
     done
 
-    if [ -n "${NIX_COREFOUNDATION_RPATH:-}" ]; then
-      extraAfter+=(-rpath $NIX_COREFOUNDATION_RPATH)
-    fi
 fi
 
+# This is outside the DONT_SET_RPATH branch because it's more targeted and we
+# usually want it (on Darwin) even if DONT_SET_RPATH is set.
+if [ -n "${NIX_COREFOUNDATION_RPATH:-}" ]; then
+  extraAfter+=(-rpath $NIX_COREFOUNDATION_RPATH)
+fi
 
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix
index 7ff79488a89f..d4cb7bc889d3 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, findXMLCatalogs}:
 
 let
 
@@ -12,7 +12,7 @@ let
 in
 
 import ./generic.nix {
-  inherit stdenv fetchurl unzip;
+  inherit stdenv fetchurl unzip findXMLCatalogs;
   name = "docbook-xml-4.1.2";
   src = fetchurl {
     url = http://www.docbook.org/xml/4.1.2/docbkx412.zip;
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix
index 3875362dcb3d..d2cc69559b86 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, findXMLCatalogs}:
 
 import ./generic.nix {
-  inherit stdenv fetchurl unzip;
+  inherit stdenv fetchurl unzip findXMLCatalogs;
   name = "docbook-xml-4.2";
   src = fetchurl {
     url = http://www.docbook.org/xml/4.2/docbook-xml-4.2.zip;
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix
index 19ad49aa9280..e1f9337df941 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, findXMLCatalogs}:
 
 import ./generic.nix {
-  inherit stdenv fetchurl unzip;
+  inherit stdenv fetchurl unzip findXMLCatalogs;
   name = "docbook-xml-4.3";
   src = fetchurl {
     url = http://www.docbook.org/xml/4.3/docbook-xml-4.3.zip;
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix
index 98a1853e4942..1a9d622affc6 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, findXMLCatalogs}:
 
 import ./generic.nix {
-  inherit stdenv fetchurl unzip;
+  inherit stdenv fetchurl unzip findXMLCatalogs;
   name = "docbook-xml-4.4";
   src = fetchurl {
     url = http://www.docbook.org/xml/4.4/docbook-xml-4.4.zip;
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix
index 669536962a12..301b400ac7e1 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, unzip}:
+{stdenv, fetchurl, unzip, findXMLCatalogs}:
 
 import ./generic.nix {
-  inherit stdenv fetchurl unzip;
+  inherit stdenv fetchurl unzip findXMLCatalogs;
   name = "docbook-xml-4.5";
   src = fetchurl {
     url = http://www.docbook.org/xml/4.5/docbook-xml-4.5.zip;
diff --git a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix
index fc3c4c3c8410..373778d43de6 100644
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, src, name, postInstall ? "true", meta ? {} }:
+{ stdenv, fetchurl, unzip, src, name, postInstall ? "true", meta ? {}, findXMLCatalogs }:
 
 assert unzip != null;
 
@@ -6,6 +6,7 @@ stdenv.mkDerivation {
   inherit src name postInstall;
   builder = ./builder.sh;
   buildInputs = [unzip];
+  propagatedBuildInputs = [ findXMLCatalogs ];
 
   meta = meta // {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
index a955f5cf8a48..7bae913ed5e6 100644
--- a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
+++ b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, findXMLCatalogs }:
 
 let
 
@@ -10,6 +10,8 @@ let
       inherit sha256;
     };
 
+    propagatedBuildInputs = [ findXMLCatalogs ];
+
     dontBuild = true;
 
     installPhase = ''
diff --git a/pkgs/desktops/gnome-3/core/libgee/default.nix b/pkgs/desktops/gnome-3/core/libgee/default.nix
index 4d59a3f20133..04d9098764f6 100644
--- a/pkgs/desktops/gnome-3/core/libgee/default.nix
+++ b/pkgs/desktops/gnome-3/core/libgee/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, autoconf, vala_0_32, pkgconfig, glib, gobjectIntrospection, gnome3 }:
+{ stdenv, fetchurl, autoconf, vala, pkgconfig, glib, gobjectIntrospection, gnome3 }:
 let
-  ver_maj = "0.18";
+  ver_maj = "0.20";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -8,15 +8,15 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libgee/${ver_maj}/${name}.tar.xz";
-    sha256 = "16a34js81w9m2bw4qd8csm4pcgr3zq5z87867j4b8wfh6zwrxnaa";
+    sha256 = "1fy24dr8imrjlmsqj1syn0gi139gba6hwk3j5vd6sr3pxniqnc11";
   };
 
   doCheck = true;
 
   patches = [ ./fix_introspection_paths.patch ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf vala_0_32 glib gobjectIntrospection ];
+  nativeBuildInputs = [ pkgconfig autoconf vala pkgconfig gobjectIntrospection ];
+  buildInputs = [ glib ];
 
   meta = with stdenv.lib; {
     description = "Utility library providing GObject-based interfaces and classes for commonly used data structures";
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index fcb36fb8ded2..10e5f97c38fb 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -366,10 +366,7 @@ let
 
   california = callPackage ./misc/california { };
 
-  geary = callPackage ./misc/geary {
-    # https://bugzilla.gnome.org/show_bug.cgi?id=728002
-    webkitgtk = pkgs.webkitgtk24x-gtk3;
-  };
+  geary = callPackage ./misc/geary { };
 
   gfbgraph = callPackage ./misc/gfbgraph { };
 
diff --git a/pkgs/desktops/gnome-3/misc/geary/default.nix b/pkgs/desktops/gnome-3/misc/geary/default.nix
index 498ced47a089..6243d1b1d5f1 100644
--- a/pkgs/desktops/gnome-3/misc/geary/default.nix
+++ b/pkgs/desktops/gnome-3/misc/geary/default.nix
@@ -1,41 +1,34 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gtk3, vala_0_32
-, makeWrapper, gdk_pixbuf, cmake, desktop_file_utils
+{ stdenv, fetchurl, intltool, pkgconfig, gtk3, vala_0_38, enchant
+, wrapGAppsHook, gdk_pixbuf, cmake, desktop_file_utils
 , libnotify, libcanberra_gtk3, libsecret, gmime
 , libpthreadstubs, sqlite
 , gnome3, librsvg, gnome_doc_utils, webkitgtk }:
 
 let
-  majorVersion = "0.11";
+  majorVersion = "0.12";
 in
 stdenv.mkDerivation rec {
-  name = "geary-${majorVersion}.3";
+  name = "geary-${majorVersion}.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/geary/${majorVersion}/${name}.tar.xz";
-    sha256 = "1r42ijxafach5lv8ibs6y0l5k4nacjg427dnma8fj00xr1sri7j1";
+    sha256 = "0ii4qaqfqx90kvqwg0g9jahygkir4mb03ja55fa55yyx6cq0kwff";
   };
 
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ intltool gtk3 makeWrapper cmake desktop_file_utils gnome_doc_utils
-                  vala_0_32 webkitgtk libnotify libcanberra_gtk3 gnome3.libgee libsecret gmime sqlite
+  nativeBuildInputs = [ vala_0_38 intltool pkgconfig wrapGAppsHook cmake desktop_file_utils gnome_doc_utils ];
+  buildInputs = [ gtk3 enchant webkitgtk libnotify libcanberra_gtk3 gnome3.libgee libsecret gmime sqlite
                   libpthreadstubs gnome3.gsettings_desktop_schemas gnome3.gcr
                   gdk_pixbuf librsvg gnome3.defaultIconTheme ];
 
   preConfigure = ''
-    substituteInPlace src/CMakeLists.txt --replace '`pkg-config --variable=girdir gobject-introspection-1.0`' '${webkitgtk}/share/gir-1.0'
-  '';
-
-  postInstall = ''
-    mkdir -p $out/share/gsettings-schemas/${name}/
-    mv $out/share/glib-2.0 $out/share/gsettings-schemas/${name}
+    substituteInPlace src/CMakeLists.txt --replace '`''${PKG_CONFIG_EXECUTABLE} --variable=girdir gobject-introspection-1.0`' '${webkitgtk.dev}/share/gir-1.0'
   '';
 
   preFixup = ''
-    wrapProgram "$out/bin/geary" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gnome3.gnome_themes_standard}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"
+    # Add geary to path for geary-attach
+    gappsWrapperArgs+=(--prefix PATH : "$out/bin")
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
index 0be3af192b42..94f39183345f 100644
--- a/pkgs/development/compilers/llvm/3.5/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -33,6 +33,12 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ ncurses zlib ];
 
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
+      --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
+  '';
+
   # hacky fix: created binaries need to be run before installation
   preBuild = ''
     mkdir -p $out/
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index 558bdcc5ce6a..f8b8948e749e 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -44,7 +44,11 @@ in stdenv.mkDerivation rec {
   # 10.9. This is a temporary measure until nixpkgs darwin support is
   # updated.
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
-        sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
+    sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
+
+    substituteInPlace CMakeLists.txt \
+      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
+      --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   '';
 
   # hacky fix: created binaries need to be run before installation
@@ -75,7 +79,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postInstall = stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
-    install_name_tool -id $out/lib/libLLVM.dylib $out/lib/libLLVM.dylib
     ln -s $out/lib/libLLVM.dylib $out/lib/libLLVM-${version}.dylib
   '';
 
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 5f90e508c5e2..809c49ac24a2 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -82,6 +82,10 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+
+    substituteInPlace CMakeLists.txt \
+      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + stdenv.lib.optionalString (enableSharedLibraries) ''
@@ -130,8 +134,6 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-release.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
-    install_name_tool -id $lib/lib/libLLVM.dylib $lib/lib/libLLVM.dylib
-    install_name_tool -change @rpath/libLLVM.dylib $lib/lib/libLLVM.dylib $out/bin/llvm-config
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${version}.dylib
   '';
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 20ab9b44b65c..e90603ffefae 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -58,6 +58,10 @@ in stdenv.mkDerivation rec {
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + stdenv.lib.optionalString (enableSharedLibraries) ''
@@ -121,8 +125,6 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
-    install_name_tool -id $lib/lib/libLLVM.dylib $lib/lib/libLLVM.dylib
-    install_name_tool -change @rpath/libLLVM.dylib $lib/lib/libLLVM.dylib $out/bin/llvm-config
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   '';
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index 946c04a2ab4e..011eab5678c1 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -58,6 +58,10 @@ in stdenv.mkDerivation rec {
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace ./projects/compiler-rt/cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
+
+    substituteInPlace cmake/modules/AddLLVM.cmake \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
   + stdenv.lib.optionalString (enableSharedLibraries) ''
@@ -129,8 +133,6 @@ in stdenv.mkDerivation rec {
   + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
-    install_name_tool -id $lib/lib/libLLVM.dylib $lib/lib/libLLVM.dylib
-    install_name_tool -change @rpath/libLLVM.dylib $lib/lib/libLLVM.dylib $out/bin/llvm-config
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${release_version}.dylib
   '';
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 17a5c65376b2..aa2af9a2ebc3 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.10.22";
-  sha256 = "15vv9gz5i4f5l7h0d045qz5iyvl89hjk2k83lb4vbizd7qg41cg2";
+  version = "1.10.24";
+  sha256 = "06ydmrg76l1kwl3190d72zpiy3qxy248x6gskxbj9qiqfsr4w63i";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";
diff --git a/pkgs/development/libraries/drumstick/default.nix b/pkgs/development/libraries/drumstick/default.nix
index 7ec72afc2bff..a46c6bab6479 100644
--- a/pkgs/development/libraries/drumstick/default.nix
+++ b/pkgs/development/libraries/drumstick/default.nix
@@ -15,25 +15,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Prevent the manpage builds from attempting to access the Internet.
-  prePatch = ''
-    substituteInPlace cmake_admin/CreateManpages.cmake --replace \
-      http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-      ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl
-
-    for xml in doc/*.xml.in; do
-      substituteInPlace "$xml" --replace \
-        http://www.docbook.org/xml/4.5/docbookx.dtd \
-        ${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd
-    done
-  '';
-
   #Temporarily remove drumstick-piano; Gives segment fault. Submitted ticket
   postInstall = ''
     rm $out/bin/drumstick-vpiano
     '';
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig docbook_xsl docbook_xml_dtd_45 docbook_xml_dtd_45 ];
   buildInputs = [
     alsaLib doxygen fluidsynth qt5.qtbase qt5.qtsvg
   ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 39140eaf5196..b82fd5f1e299 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -43,7 +43,7 @@ let
   '';
 
   ver_maj = "2.54";
-  ver_min = "0";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "fe22998ff0394ec31e6e5511c379b74011bee61a4421bca7fcab223dfbe0fc6a";
+    sha256 = "50c01b1419324f10fbf9b9709ec2164b18586968bdce7540583bf32302cf47a3";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index f5d75177963a..1d0930d8d03c 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "21";
+  ver_min = "24";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "1bd3c1a85cfb4db112cabb5379abb05a1a94fe43052d309d573493fca00e6b87";
+    sha256 = "cbb16e4cfc928ab8f5f22f7290616f95f6ebc8c97cc724a2007b07ced833592b";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index c62d31a1e26a..4903d8e66dfe 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1minzvsyz5hgm6ixpj8ysa6jsv7vm8qc8nx390jxdsk0v9ljd983";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "bin" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libpthreadstubs libpciaccess valgrind-light ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   preConfigure = stdenv.lib.optionalString stdenv.isDarwin
     "echo : \\\${ac_cv_func_clock_gettime=\'yes\'} > config.cache";
 
-  configureFlags = [ ]
+  configureFlags = [ "--enable-install-test-programs" ]
     ++ stdenv.lib.optionals (stdenv.isArm || stdenv.isAarch64) [ "--enable-tegra-experimental-api" "--enable-etnaviv-experimental-api" ]
     ++ stdenv.lib.optional stdenv.isDarwin "-C";
 
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 94a9aa37ad9c..c4a6a246b909 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -5,12 +5,12 @@
 assert zlib != null;
 
 let
-  version = "1.6.31";
-  patchVersion = "1.6.31";
-  sha256 = "0hcbxv9qf4f9q7brrk0ndag526glr8lii43grssv45j9w0nn0ai3";
+  version = "1.6.34";
+  patchVersion = "1.6.34";
+  sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "0f10ih658j514vpvsli0pk378vcmjn78g52cssyg92r4k1r19rla";
+    sha256 = "1ha4npf9mfrzp0srg8a5amks5ww84xzfpjbsj8k3yjjpai798qg6";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 50d588dad79b..8dea502a4ff4 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.14.1";
+  version = "1.15.0";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "1121qvnvpcabq1bl2k41jq8r2hn2x123csiaf7s9vrq66bbxgfdx";
+    sha256 = "092hxqjvbb6d03h3msc38359w2kixba1ansyrsbyqq8iqiqwnkw0";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/mapnik/default.nix b/pkgs/development/libraries/mapnik/default.nix
index 96dbc094b55c..0546bdc6359b 100644
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip
+{ stdenv, fetchzip, fetchpatch
 , boost, cairo, freetype, gdal, harfbuzz, icu, libjpeg, libpng, libtiff
 , libwebp, libxml2, proj, python2, scons, sqlite, zlib
 
@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
     sha256 = "189wsd6l6awblkiha666l1sdyp7ifmnfsa87y0j37rvym6w4r065";
   };
 
+  patches = [(fetchpatch {
+    name = "icu-59.diff";
+    url = https://github.com/mapnik/mapnik/commit/9e58c890430d.diff;
+    sha256 = "0h546qq8g19gw9s4979hla9vkq5kcwh3q45ryajyjhmlr2z9fi6p";
+  })];
+
   # a distinct dev output makes python-mapnik fail
   outputs = [ "out" ];
 
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 96d226785cab..0fde0192726b 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchurl, fetchpatch, lib
 , pkgconfig, intltool, autoreconfHook, substituteAll
-, file, expat, libdrm, xorg, wayland, openssl
+, file, expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva
-, libelf, libvdpau, valgrind-light
+, libelf, libvdpau, valgrind-light, python2
 , grsecEnabled ? false
-, enableRadv ? false
+, enableRadv ? true
 # Texture floats are patented, see docs/patents.txt, so we don't enable them for full Mesa.
 # It's overridden for mesa_drivers.
 , enableTextureFloats ? false
@@ -36,7 +36,7 @@ let
     then ["nouveau" "freedreno" "vc4" "etnaviv" "imx"]
     else if stdenv.isAarch64
     then ["nouveau" "vc4" ]
-    else ["i915" "r300" "r600" "radeonsi" "nouveau"];
+    else ["svga" "i915" "r300" "r600" "radeonsi" "nouveau"];
   defaultDriDrivers =
     if (stdenv.isArm || stdenv.isAarch64)
     then ["nouveau"]
@@ -51,8 +51,7 @@ let gallium_ = galliumDrivers; dri_ = driDrivers; vulkan_ = vulkanDrivers; in
 
 let
   galliumDrivers =
-    ["svga"]
-    ++ (if gallium_ == null
+    (if gallium_ == null
           then defaultGalliumDrivers
           else gallium_)
     ++ ["swrast"];
@@ -67,7 +66,7 @@ let
 in
 
 let
-  version = "17.1.10";
+  version = "17.2.2";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +81,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "cbc0d681cc4df47d8deb5a36f45b420978128522fd665b2cd4c7096316f11bdb";
+    sha256 = "10jplvxg7rlbp7569w08z0igwlsjjfb7q3n07zgfr8d5sr224lng";
   };
 
   prePatch = "patchShebangs .";
@@ -150,9 +149,9 @@ stdenv.mkDerivation {
     expat llvmPackages.llvm
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence
-    libffi wayland libvdpau libelf libXvMC
+    libffi wayland wayland-protocols libvdpau libelf libXvMC
     libomxil-bellagio libva libpthreadstubs openssl/*or another sha1 provider*/
-    valgrind-light
+    valgrind-light python2
   ];
 
 
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 0cb9078aede5..94428ecc174d 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -17,7 +17,7 @@ with stdenv.lib;
 let
   os = stdenv.lib.optionalString;
   majorVersion = "3.9";
-  minorVersion = "2";
+  minorVersion = "4";
   version = "${majorVersion}.${minorVersion}";
 in
 
@@ -28,8 +28,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.9/cmake-3.9.2-SHA-256.txt
-    sha256 = "954a5801a456ee48e76f01107c9a4961677dd0f3e115275bbd18410dc22ba3c1";
+    # from https://cmake.org/files/v3.9/cmake-3.9.4-SHA-256.txt
+    sha256 = "b5d86f12ae0072db520fdbdad67405f799eb728b610ed66043c20a92b4906ca1";
   };
 
   prePatch = optionalString (!useSharedLibraries) ''
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 114913403577..77ff46d94722 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,12 +1,12 @@
 { lib, python3Packages }:
 python3Packages.buildPythonApplication rec {
-  version = "0.42.1";
+  version = "0.43.0";
   pname = "meson";
   name = "${pname}-${version}";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1phf1xpwm8m85qiiirkqhrf5aigx7ajaw0l59d6lzadf1fmgfx5v";
+    sha256 = "0qn5hyzvam3rimn7g3671s1igj7fbkwdnf5nc8jr4d5swy25mq61";
   };
 
   postFixup = ''
diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index 0d9d19c8b939..ed6c7f4fefb6 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -53,10 +53,6 @@ buildGoPackage rec {
     go generate github.com/drone/drone/store/datastore/ddl
   '';
 
-  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/drone
-  '';
-
   src = fetchFromGitHub {
     owner = "drone";
     repo = "drone";
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index 506684088343..5f31a2dfb7c6 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, perl, python, libxml2Python, libxslt, which
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, perl, python, libxml2Python, libxslt, which
 , docbook_xml_dtd_43, docbook_xsl, gnome_doc_utils, dblatex, gettext, itstool }:
 
 stdenv.mkDerivation rec {
@@ -10,29 +10,20 @@ stdenv.mkDerivation rec {
     sha256 = "0hpxcij9xx9ny3gs9p0iz4r8zslw8wqymbyababiyl7603a6x90y";
   };
 
-  outputDevdoc = "out";
-
-  # maybe there is a better way to pass the needed dtd and xsl files
-  # "-//OASIS//DTD DocBook XML V4.1.2//EN" and "http://docbook.sourceforge.net/release/xsl/current/html/chunk.xsl"
-  preConfigure = ''
-    mkdir -p $out/nix-support
-    cat > $out/nix-support/catalog.xml << EOF
-    <?xml version="1.0"?>
-    <!DOCTYPE catalog PUBLIC "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN" "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd">
-    <catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
-      <nextCatalog  catalog="${docbook_xsl}/xml/xsl/docbook/catalog.xml" />
-      <nextCatalog  catalog="${docbook_xml_dtd_43}/xml/dtd/docbook/catalog.xml" />
-    </catalog>
-    EOF
+  patches = [
+    ./respect-xml-catalog-files-var.patch
+  ];
 
-    configureFlags="--with-xml-catalog=$out/nix-support/catalog.xml --disable-scrollkeeper";
-  '';
+  outputDevdoc = "out";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs =
    [ pkgconfig perl python libxml2Python libxslt docbook_xml_dtd_43 docbook_xsl
      gnome_doc_utils dblatex gettext which itstool
    ];
 
+  configureFlags = "--disable-scrollkeeper";
+
   meta = with stdenv.lib; {
     homepage = https://www.gtk.org/gtk-doc;
     description = "Tools to extract documentation embedded in GTK+ and GNOME source code";
diff --git a/pkgs/development/tools/documentation/gtk-doc/respect-xml-catalog-files-var.patch b/pkgs/development/tools/documentation/gtk-doc/respect-xml-catalog-files-var.patch
new file mode 100644
index 000000000000..78c57306b797
--- /dev/null
+++ b/pkgs/development/tools/documentation/gtk-doc/respect-xml-catalog-files-var.patch
@@ -0,0 +1,28 @@
+diff --git a/m4/gtkdoc_jh_check_xml_catalog.m4 b/m4/gtkdoc_jh_check_xml_catalog.m4
+index 618c1c9..1842a0d 100644
+--- a/m4/gtkdoc_jh_check_xml_catalog.m4
++++ b/m4/gtkdoc_jh_check_xml_catalog.m4
+@@ -10,7 +10,21 @@ AC_DEFUN([JH_CHECK_XML_CATALOG],
+ 		AC_MSG_RESULT([found])
+ 		ifelse([$3],,,[$3])
+ 	else
+-		AC_MSG_RESULT([not found])
+-		ifelse([$4],,[AC_MSG_ERROR([could not find ifelse([$2],,[$1],[$2]) in XML catalog])],[$4])
++		jh_check_xml_catalog_saved_ifs="$IFS"
++		IFS=' '
++		for f in $XML_CATALOG_FILES; do
++			if [[ -f "$f" ]] && \
++				AC_RUN_LOG([$XMLCATALOG --noout "$f" "$1" >&2]); then
++				jh_found_xmlcatalog=true
++				AC_MSG_RESULT([found])
++				ifelse([$3],,,[$3])
++				break
++			fi
++		done
++		IFS="$jh_check_xml_catalog_saved_ifs"
++		if ! $jh_found_xmlcatalog; then
++			AC_MSG_RESULT([not found])
++			ifelse([$4],,[AC_MSG_ERROR([could not find ifelse([$2],,[$1],[$2]) in XML catalog])],[$4])
++		fi
+ 	fi
+ ])
diff --git a/pkgs/development/tools/textql/default.nix b/pkgs/development/tools/textql/default.nix
index bd1dbb3f90a1..eb626d0aa586 100644
--- a/pkgs/development/tools/textql/default.nix
+++ b/pkgs/development/tools/textql/default.nix
@@ -16,10 +16,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/textql
-  '';
-
   meta = with stdenv.lib; {
     description = "Execute SQL against structured text like CSV or TSV";
     homepage = https://github.com/dinedal/textql;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index caef875ac136..3d7e59f15547 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -113,7 +113,6 @@ appleDerivation rec {
     install_name_tool \
       -id $out/lib/libresolv.9.dylib \
       -change "$resolv_libSystem" $out/lib/libSystem.dylib \
-      -delete_rpath ${libresolv}/lib \
       $out/lib/libresolv.9.dylib
     ln -s libresolv.9.dylib $out/lib/libresolv.dylib
   '';
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index c09fc0f7dc41..8aa1cec9e12f 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -80,10 +80,6 @@ stdenv.mkDerivation rec {
     # Drop examples, since they contain non-ASCII characters that break docbook2x :(
     sed -i 's/ Example: .*$//' doc/config_settings.xml
 
-    substituteInPlace cmake/Docbook.cmake \
-      --replace "http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl" "${docbook_xsl}/xml/xsl/docbook/html/docbook.xsl"
-    substituteInPlace doc/docs.xml \
-      --replace "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" "${docbook_xml_dtd_44}/xml/dtd/docbook/docbookx.dtd"
     substituteInPlace cmake/Conky.cmake --replace "#set(RELEASE true)" "set(RELEASE true)"
   '';
 
@@ -91,7 +87,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib cmake libXinerama ]
-    ++ optionals docsSupport        [ docbook2x libxslt man less ]
+    ++ optionals docsSupport        [ docbook2x docbook_xsl docbook_xml_dtd_44 libxslt man less ]
     ++ optional  ncursesSupport     ncurses
     ++ optional  x11Support         xlibsWrapper
     ++ optional  xdamageSupport     libXdamage
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 20b64907c22b..6f14e713139a 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -12,14 +12,13 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig docbook_xsl ];
   buildInputs = [ protobuf protobufc asciidoc xmlto libpaper libnl libcap python ];
 
   patchPhase = ''
     chmod +w ./scripts/gen-offsets.sh
     substituteInPlace ./scripts/gen-offsets.sh --replace hexdump ${utillinux}/bin/hexdump
     substituteInPlace ./Documentation/Makefile --replace "2>/dev/null" ""
-    substituteInPlace ./Documentation/Makefile --replace "--skip-validation" "--skip-validation -x ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
     substituteInPlace ./criu/Makefile --replace "-I/usr/include/libnl3" "-I${libnl.dev}/include/libnl3"
     substituteInPlace ./Makefile --replace "tar-name := $(shell git tag -l v$(CRIU_VERSION))" "tar-name = 2.0" # --replace "-Werror" ""
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index 728e7034a199..d2ad5d0bd8e8 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -21,10 +21,6 @@ buildGoPackage rec {
     buildFlagsArray+=("-ldflags" "-X github.com/hashicorp/consul/version.GitDescribe=v${version} -X github.com/hashicorp/consul/version.Version=${version} -X github.com/hashicorp/consul/version.VersionPrerelease=")
   '';
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/consul
-  '';
-
   meta = with stdenv.lib; {
     description = "Tool for service discovery, monitoring and configuration";
     homepage = https://www.consul.io/;
diff --git a/pkgs/servers/dgraph/default.nix b/pkgs/servers/dgraph/default.nix
index 06aef0babd39..5056df06e598 100644
--- a/pkgs/servers/dgraph/default.nix
+++ b/pkgs/servers/dgraph/default.nix
@@ -31,14 +31,6 @@ buildGoPackage rec {
       -X github.com/dgraph-io/dgraph/cmd/dgraph/main.uiDir=$dashboard/src/assets/"
   '';
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    # Somehow on Darwin, $out/lib (which doesn't exist) ends up in RPATH.
-    # Removing it fixes cycle between $out and $bin
-    install_name_tool -delete_rpath $out/lib $bin/bin/dgraph
-    install_name_tool -delete_rpath $out/lib $bin/bin/dgraphloader
-    install_name_tool -delete_rpath $out/lib $bin/bin/bulkloader
-  '';
- 
   meta = {
     homepage = "https://dgraph.io/";
     description = "Fast, Distributed Graph DB";
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter.nix b/pkgs/servers/monitoring/prometheus/node-exporter.nix
index 611543ee87e2..2d2fb26324c4 100644
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@@ -14,10 +14,6 @@ buildGoPackage rec {
     sha256 = "0rm43jjqv7crfahl973swi4warqmqnmv740cg800yvzvnlp37kl4";
   };
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/node_exporter
-  '';
-
   # FIXME: megacli test fails
   doCheck = false;
 
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 786192f6a0ae..b2b238997b9d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -860,11 +860,11 @@ let
   }) // {inherit libfontenc fontsproto freetype xproto xtrans zlib ;};
 
   libXfont2 = (mkDerivation "libXfont2" {
-    name = "libXfont2-2.0.1";
+    name = "libXfont2-2.0.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXfont2-2.0.1.tar.bz2;
-      sha256 = "0znvwk36nhmyqpmhbm9mzisgixp1mp5qkfald8x1n5yxbm3vpyz9";
+      url = mirror://xorg/individual/lib/libXfont2-2.0.2.tar.bz2;
+      sha256 = "04f1lswh1ridkycgaivf1hrr77l5ap8smbfr2rqjrm7phwxqs24l";
     };
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ libfontenc fontsproto freetype xproto xtrans zlib ];
@@ -980,11 +980,11 @@ let
   }) // {inherit renderproto libX11 xproto ;};
 
   libXres = (mkDerivation "libXres" {
-    name = "libXres-1.0.7";
+    name = "libXres-1.2.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXres-1.0.7.tar.bz2;
-      sha256 = "1rd0bzn67cpb2qkc946gch2183r4bdjfhs6cpqbipy47m9a91296";
+      url = mirror://xorg/individual/lib/libXres-1.2.0.tar.bz2;
+      sha256 = "1m0jr0lbz9ixpp9ihk68349q0i7ry2379lnfzdy4mrl86ijc2xgz";
     };
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ resourceproto libX11 libXext xextproto xproto ];
@@ -2456,11 +2456,11 @@ let
   }) // {inherit inputproto libX11 libXaw xproto libXt ;};
 
   xkeyboardconfig = (mkDerivation "xkeyboardconfig" {
-    name = "xkeyboard-config-2.21";
+    name = "xkeyboard-config-2.22";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.21.tar.bz2;
-      sha256 = "1iffxpchy6dfgbby23nfsqqk17h9lfddlmjnhwagqag1z94p1h9h";
+      url = mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.22.tar.bz2;
+      sha256 = "1garmbyfjp0han04l2l90zzwlfbdgdxl6r1qnic36i5wkycckbny";
     };
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ libX11 xproto ];
@@ -2576,11 +2576,11 @@ let
   }) // {inherit ;};
 
   xorgserver = (mkDerivation "xorgserver" {
-    name = "xorg-server-1.19.4";
+    name = "xorg-server-1.19.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/xserver/xorg-server-1.19.4.tar.bz2;
-      sha256 = "1a690fzv5l5ks45g9zhlzdskdq8q73mcbpb9a3wz3shxm778lxda";
+      url = mirror://xorg/individual/xserver/xorg-server-1.19.5.tar.bz2;
+      sha256 = "0iql4pgsgpyqcrd3256pv227cdadvz01ych61n0d41ixp67gmzqq";
     };
     nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ dri2proto dri3proto renderproto openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ];
diff --git a/pkgs/servers/x11/xorg/tarballs-7.7.list b/pkgs/servers/x11/xorg/tarballs-7.7.list
index 6cd4e082e8df..42cee12843c2 100644
--- a/pkgs/servers/x11/xorg/tarballs-7.7.list
+++ b/pkgs/servers/x11/xorg/tarballs-7.7.list
@@ -69,7 +69,7 @@ mirror://xorg/individual/lib/libXdmcp-1.1.2.tar.bz2
 mirror://xorg/individual/lib/libXext-1.3.3.tar.bz2
 mirror://xorg/individual/lib/libXfixes-5.0.2.tar.bz2
 mirror://xorg/individual/lib/libXfont-1.5.2.tar.bz2
-mirror://xorg/individual/lib/libXfont2-2.0.1.tar.bz2
+mirror://xorg/individual/lib/libXfont2-2.0.2.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.2.tar.bz2
 mirror://xorg/individual/lib/libXi-1.7.9.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.3.tar.bz2
@@ -79,7 +79,7 @@ mirror://xorg/individual/lib/libXpm-3.5.12.tar.bz2
 mirror://xorg/individual/lib/libXpresent-1.0.0.tar.bz2
 mirror://xorg/individual/lib/libXrandr-1.5.1.tar.bz2
 mirror://xorg/individual/lib/libXrender-0.9.10.tar.bz2
-mirror://xorg/individual/lib/libXres-1.0.7.tar.bz2
+mirror://xorg/individual/lib/libXres-1.2.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libXScrnSaver-1.2.2.tar.bz2
 mirror://xorg/individual/lib/libXt-1.1.5.tar.bz2
 mirror://xorg/individual/lib/libXtst-1.2.3.tar.bz2
@@ -177,7 +177,7 @@ mirror://xorg/individual/app/xinput-1.6.2.tar.bz2
 mirror://xorg/individual/app/xkbcomp-1.4.0.tar.bz2
 mirror://xorg/individual/app/xkbevd-1.1.4.tar.bz2
 mirror://xorg/individual/app/xkbutils-1.0.4.tar.bz2
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.21.tar.bz2
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.22.tar.bz2
 mirror://xorg/individual/app/xkill-1.0.4.tar.bz2
 mirror://xorg/individual/app/xlsatoms-1.1.2.tar.bz2
 mirror://xorg/individual/app/xlsclients-1.1.3.tar.bz2
@@ -185,7 +185,7 @@ mirror://xorg/individual/app/xlsfonts-1.0.5.tar.bz2
 mirror://xorg/individual/app/xmag-1.0.6.tar.bz2
 mirror://xorg/individual/app/xmodmap-1.0.9.tar.bz2
 mirror://xorg/individual/doc/xorg-docs-1.7.1.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.19.4.tar.bz2
+mirror://xorg/individual/xserver/xorg-server-1.19.5.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xpr-1.0.4.tar.bz2
 mirror://xorg/individual/app/xprop-1.2.2.tar.bz2
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index 8a7d49710125..a598d57808c4 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -4,10 +4,6 @@ buildGoPackage rec {
   name = "elvish-${version}";
   version = "0.10";
 
-  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/elvish
-  '';
-
   goPackagePath = "github.com/elves/elvish";
 
   src = fetchFromGitHub {
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 31de28fdc0c2..d5885193b9bc 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -81,7 +81,20 @@ let
 
       setup = setupScript;
 
-      inherit preHook initialPath shell
+      # We pretty much never need rpaths on Darwin, since all library path references
+      # are absolute unless we go out of our way to make them relative (like with CF)
+      # TODO: This really wants to be in stdenv/darwin but we don't have hostPlatform
+      # there (yet?) so it goes here until then.
+      preHook = preHook+ lib.optionalString buildPlatform.isDarwin ''
+        export NIX_BUILD_DONT_SET_RPATH=1
+      '' + lib.optionalString hostPlatform.isDarwin ''
+        export NIX_DONT_SET_RPATH=1
+        export NIX_NO_SELF_RPATH=1
+      '' + lib.optionalString targetPlatform.isDarwin ''
+        export NIX_TARGET_DONT_SET_RPATH=1
+      '';
+
+      inherit initialPath shell
         defaultNativeBuildInputs defaultBuildInputs;
     }
     // lib.optionalAttrs buildPlatform.isDarwin {
diff --git a/pkgs/tools/filesystems/go-mtpfs/default.nix b/pkgs/tools/filesystems/go-mtpfs/default.nix
index f46dd74b2660..028aef6024b1 100644
--- a/pkgs/tools/filesystems/go-mtpfs/default.nix
+++ b/pkgs/tools/filesystems/go-mtpfs/default.nix
@@ -16,9 +16,5 @@ buildGoPackage rec {
     sha256 = "1jcqp9n8fd9psfsnhfj6w97yp0zmyxplsig8pyp2gqzh4lnb5fqm";
   };
 
-  preFixup = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath "$out/lib" $bin/bin/go-mtpfs
-  '';
-
   goDeps = ./deps.nix;
 }
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index cfad499a432b..f36a6d51b360 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -25,8 +25,6 @@ buildGoPackage rec {
     make install DESTDIR=$bin
     mkdir -p $bin/share/fish/vendor_conf.d
     echo "eval ($bin/bin/direnv hook fish)" > $bin/share/fish/vendor_conf.d/direnv.fish
-  '' + stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/direnv
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
index 1de87e07e049..e3a147b20b17 100644
--- a/pkgs/tools/networking/assh/default.nix
+++ b/pkgs/tools/networking/assh/default.nix
@@ -9,9 +9,7 @@ buildGoPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/assh
-  '' + ''
+  postInstall = ''
     wrapProgram "$bin/bin/assh" \
       --prefix PATH : ${openssh}/bin
   '';
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index fe7327e7d855..8077fb1d93d0 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
-    doxygen Po4a w3m
+    doxygen Po4a w3m docbook_xml_dtd_45
   ] ++ lib.optionals withNLS [
     gettext
   ];
@@ -44,15 +44,6 @@ stdenv.mkDerivation rec {
       -DWITH_DOC=${if withDocs then "ON" else "OFF"}
       -DUSE_NLS=${if withNLS then "ON" else "OFF"}
     )
-
-    for f in doc/*; do
-      if [[ -f "$f" ]]; then
-        substituteInPlace "$f" \
-          --replace \
-            "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
-            "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
-      fi
-    done
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 049867afcd72..7f095a3225bb 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -16,10 +16,6 @@ buildGoPackage rec {
     sha256 = "1zgvriyir2ga0p4ah9ia1sbl9ydnrnw5ggq4c1ya8gcfgn8vzdsf";
   };
 
-  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib $bin/bin/keybase
-  '';
-
   buildFlags = [ "-tags production" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/sudolikeaboss/default.nix b/pkgs/tools/security/sudolikeaboss/default.nix
index 066fef39a82a..15f767415890 100644
--- a/pkgs/tools/security/sudolikeaboss/default.nix
+++ b/pkgs/tools/security/sudolikeaboss/default.nix
@@ -22,10 +22,6 @@ buildGoPackage rec {
     fixDarwinDylibNames
   ];
 
-  postInstall = ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sudolikeaboss
-  '';
-
   meta = with stdenv.lib; {
     inherit version;
     inherit (src.meta) homepage;
diff --git a/pkgs/tools/text/sift/default.nix b/pkgs/tools/text/sift/default.nix
index 1e688942a49e..fd4cef27ba17 100644
--- a/pkgs/tools/text/sift/default.nix
+++ b/pkgs/tools/text/sift/default.nix
@@ -16,10 +16,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -delete_rpath $out/lib -add_rpath $bin $bin/bin/sift
-  '';
-
   meta = with lib; {
     description = "sift is a fast and powerful alternative to grep";
     homepage = https://sift-tool.org;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6b595c943114..66248545aa81 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8662,7 +8662,7 @@ with pkgs;
   icu58 = callPackage ../development/libraries/icu/58.nix { };
   icu59 = callPackage ../development/libraries/icu/59.nix { };
 
-  icu = icu58;
+  icu = icu59;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -9819,8 +9819,8 @@ with pkgs;
     # through /run/opengl-driver*, which is overriden according to config.grsecurity
     # grsecEnabled = true; # no more support in nixpkgs ATM
 
-    # llvm-4.0.0 won't pass tests on aarch64
-    llvmPackages = if system == "aarch64-linux" then llvmPackages_39 else llvmPackages_4;
+    # llvm-4.0.0 and 5.0.0 won't pass tests on aarch64
+    llvmPackages = if system == "aarch64-linux" then llvmPackages_39 else llvmPackages_5;
   });
 
   mesa_glu =  mesaDarwinOr (callPackage ../development/libraries/mesa-glu { });
@@ -10852,6 +10852,7 @@ with pkgs;
   v8 = callPackage ../development/libraries/v8 {
     inherit (python2Packages) python gyp;
     cctools = darwin.cctools;
+    icu = icu58; # v8-5.4.232 fails against icu4c-59.1
   };
 
   v8_static = lowPrio (self.v8.override { static = true; });
@@ -11479,7 +11480,7 @@ with pkgs;
   fingerd_bsd = callPackage ../servers/fingerd/bsd-fingerd { };
 
   firebird = callPackage ../servers/firebird { icu = null; stdenv = overrideCC stdenv gcc5; };
-  firebirdSuper = callPackage ../servers/firebird { superServer = true; stdenv = overrideCC stdenv gcc5; };
+  firebirdSuper = callPackage ../servers/firebird { icu = icu58; superServer = true; stdenv = overrideCC stdenv gcc5; };
 
   fleet = callPackage ../servers/fleet { };
 
@@ -15360,6 +15361,7 @@ with pkgs;
     harfbuzz = harfbuzz.override {
       withIcu = true; withGraphite2 = true;
     };
+    icu = icu58;
     # checking whether g++ supports C++14 or C++11... configure: error: no
     stdenv = overrideCC stdenv gcc5;
   });
@@ -19095,7 +19097,9 @@ with pkgs;
   };
   openlilylib-fonts = callPackage ../misc/lilypond/fonts.nix { };
 
-  mailcore2 = callPackage ../development/libraries/mailcore2 { };
+  mailcore2 = callPackage ../development/libraries/mailcore2 {
+    icu = icu58;
+  };
 
   martyr = callPackage ../development/libraries/martyr { };