about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/rust.section.md10
-rw-r--r--doc/stdenv.xml24
-rw-r--r--lib/default.nix2
-rw-r--r--lib/strings.nix20
-rw-r--r--lib/systems/default.nix2
-rw-r--r--maintainers/scripts/nix-generate-from-cpan.nix2
-rw-r--r--nixos/lib/testing.nix4
-rw-r--r--nixos/modules/config/users-groups.nix4
-rw-r--r--nixos/modules/installer/tools/tools.nix2
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/programs/command-not-found/command-not-found.nix2
-rw-r--r--nixos/modules/services/desktops/gnome3/gnome-keyring.nix2
-rw-r--r--nixos/modules/services/network-filesystems/glusterfs.nix1
-rw-r--r--nixos/modules/services/search/elasticsearch-curator.nix5
-rw-r--r--nixos/modules/services/system/kerberos.nix64
-rw-r--r--nixos/modules/services/system/kerberos/default.nix80
-rw-r--r--nixos/modules/services/system/kerberos/heimdal.nix68
-rw-r--r--nixos/modules/services/system/kerberos/mit.nix68
-rw-r--r--nixos/modules/services/web-servers/lighttpd/collectd.nix2
-rw-r--r--nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix4
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix2
-rw-r--r--nixos/modules/system/etc/etc.nix2
-rw-r--r--nixos/modules/testing/service-runner.nix2
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/kerberos/default.nix5
-rw-r--r--nixos/tests/kerberos/heimdal.nix53
-rw-r--r--nixos/tests/kerberos/mit.nix45
-rw-r--r--pkgs/applications/altcoins/parity-ui/default.nix2
-rw-r--r--pkgs/applications/audio/abcde/default.nix4
-rw-r--r--pkgs/applications/audio/crip/default.nix5
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/audio/lollypop/default.nix4
-rw-r--r--pkgs/applications/audio/rhythmbox/default.nix3
-rw-r--r--pkgs/applications/editors/atom/default.nix3
-rw-r--r--pkgs/applications/editors/gnome-builder/default.nix6
-rw-r--r--pkgs/applications/graphics/feh/default.nix4
-rw-r--r--pkgs/applications/graphics/shotwell/default.nix4
-rw-r--r--pkgs/applications/graphics/shutter/default.nix6
-rw-r--r--pkgs/applications/misc/extract_url/default.nix17
-rw-r--r--pkgs/applications/misc/ikiwiki/default.nix25
-rw-r--r--pkgs/applications/misc/plank/default.nix4
-rw-r--r--pkgs/applications/misc/pmenu/default.nix4
-rw-r--r--pkgs/applications/misc/qdirstat/default.nix6
-rw-r--r--pkgs/applications/misc/rxvt_unicode/default.nix4
-rw-r--r--pkgs/applications/misc/slic3r/default.nix6
-rw-r--r--pkgs/applications/misc/slic3r/prusa3d.nix1
-rw-r--r--pkgs/applications/misc/terminator/default.nix4
-rw-r--r--pkgs/applications/misc/termite/default.nix4
-rw-r--r--pkgs/applications/misc/yarssr/default.nix12
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix8
-rw-r--r--pkgs/applications/networking/browsers/midori/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/w3m/default.nix26
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/franz/default.nix1
-rw-r--r--pkgs/applications/networking/instant-messengers/wavebox/default.nix1
-rw-r--r--pkgs/applications/networking/irc/weechat/wrapper.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/default.nix11
-rw-r--r--pkgs/applications/networking/newsreaders/pan/default.nix4
-rw-r--r--pkgs/applications/networking/sieve-connect/default.nix14
-rw-r--r--pkgs/applications/networking/tsung/default.nix6
-rw-r--r--pkgs/applications/office/mendeley/default.nix1
-rw-r--r--pkgs/applications/science/biology/N3/default.nix4
-rw-r--r--pkgs/applications/science/biology/conglomerate/default.nix6
-rw-r--r--pkgs/applications/science/biology/inormalize/default.nix4
-rw-r--r--pkgs/applications/science/biology/minc-tools/default.nix4
-rw-r--r--pkgs/applications/science/biology/minc-widgets/default.nix4
-rw-r--r--pkgs/applications/science/biology/mni_autoreg/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix65
-rw-r--r--pkgs/applications/version-management/git-and-tools/gitweb/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/grv/default.nix4
-rw-r--r--pkgs/applications/version-management/monotone/default.nix4
-rw-r--r--pkgs/applications/version-management/vcsh/default.nix10
-rw-r--r--pkgs/applications/video/pitivi/default.nix4
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix7
-rw-r--r--pkgs/build-support/writers/default.nix4
-rw-r--r--pkgs/data/misc/iana-etc/default.nix4
-rw-r--r--pkgs/desktops/deepin/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/apps/seahorse/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/default.nix7
-rw-r--r--pkgs/desktops/gnome-3/core/grilo-plugins/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/grilo/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/totem/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/tracker-miners/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/default.nix49
-rw-r--r--pkgs/desktops/gnome-3/misc/geary/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/misc/gitg/default.nix9
-rw-r--r--pkgs/desktops/mate/mate-terminal/default.nix6
-rw-r--r--pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix2
-rw-r--r--pkgs/desktops/xfce4-13/default.nix4
-rw-r--r--pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix8
-rw-r--r--pkgs/development/compilers/gcc/builder.sh5
-rw-r--r--pkgs/development/compilers/ghc/8.2.2-binary.nix2
-rw-r--r--pkgs/development/compilers/ghc/8.2.2.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.4.4.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.1.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.2.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.3.nix5
-rw-r--r--pkgs/development/compilers/ghc/head.nix5
-rw-r--r--pkgs/development/compilers/go/1.10.nix4
-rw-r--r--pkgs/development/compilers/go/1.11.nix4
-rw-r--r--pkgs/development/compilers/jetbrains-jdk/default.nix5
-rw-r--r--pkgs/development/compilers/julia/0004-hardened.patch25
-rw-r--r--pkgs/development/compilers/julia/default.nix7
-rw-r--r--pkgs/development/compilers/julia/shared.nix7
-rw-r--r--pkgs/development/compilers/llvm/3.5/llvm.nix6
-rw-r--r--pkgs/development/compilers/llvm/3.7/llvm.nix2
-rw-r--r--pkgs/development/compilers/llvm/3.8/llvm.nix4
-rw-r--r--pkgs/development/compilers/llvm/3.9/llvm.nix4
-rw-r--r--pkgs/development/compilers/llvm/4/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/4/llvm.nix8
-rw-r--r--pkgs/development/compilers/llvm/5/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/llvm.nix8
-rw-r--r--pkgs/development/compilers/llvm/6/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/llvm.nix67
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/llvm.nix59
-rw-r--r--pkgs/development/compilers/llvm/common.nix20
-rw-r--r--pkgs/development/compilers/nasm/default.nix4
-rw-r--r--pkgs/development/compilers/openjdk/11.nix9
-rw-r--r--pkgs/development/compilers/openjdk/8.nix9
-rw-r--r--pkgs/development/compilers/openjdk/bootstrap.nix8
-rw-r--r--pkgs/development/compilers/oraclejdk/jdk-linux-base.nix8
-rw-r--r--pkgs/development/compilers/rust/binaryBuild.nix4
-rw-r--r--pkgs/development/compilers/rust/bootstrap.nix1
-rw-r--r--pkgs/development/compilers/swift/default.nix9
-rw-r--r--pkgs/development/compilers/swift/patches/build-script-pax.patch33
-rw-r--r--pkgs/development/compilers/terra/default.nix4
-rw-r--r--pkgs/development/compilers/tinycc/default.nix4
-rw-r--r--pkgs/development/compilers/vala/default.nix12
-rw-r--r--pkgs/development/interpreters/erlang/generic-builder.nix3
-rw-r--r--pkgs/development/interpreters/perl/default.nix13
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/boot.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/2.7/default.nix2
-rw-r--r--pkgs/development/interpreters/python/cpython/3.5/default.nix1
-rw-r--r--pkgs/development/interpreters/python/cpython/3.6/default.nix1
-rw-r--r--pkgs/development/interpreters/python/cpython/3.7/default.nix52
-rw-r--r--pkgs/development/interpreters/python/wrap-python.nix2
-rw-r--r--pkgs/development/interpreters/python/wrap.sh8
-rw-r--r--pkgs/development/interpreters/ruby/default.nix11
-rw-r--r--pkgs/development/interpreters/spidermonkey/1.8.5.nix5
-rw-r--r--pkgs/development/interpreters/tcl/generic.nix16
-rw-r--r--pkgs/development/libraries/acl/default.nix10
-rw-r--r--pkgs/development/libraries/atkmm/default.nix20
-rw-r--r--pkgs/development/libraries/attr/default.nix12
-rw-r--r--pkgs/development/libraries/attr/fix-headers-musl.patch54
-rw-r--r--pkgs/development/libraries/clucene-core/2.x.nix8
-rw-r--r--pkgs/development/libraries/eigen/default.nix4
-rw-r--r--pkgs/development/libraries/folks/default.nix (renamed from pkgs/desktops/gnome-3/core/folks/default.nix)19
-rw-r--r--pkgs/development/libraries/freetype/default.nix3
-rw-r--r--pkgs/development/libraries/gcr/default.nix (renamed from pkgs/desktops/gnome-3/core/gcr/default.nix)10
-rw-r--r--pkgs/development/libraries/geocode-glib/default.nix (renamed from pkgs/desktops/gnome-3/core/geocode-glib/default.nix)9
-rw-r--r--pkgs/development/libraries/geocode-glib/installed-tests-path.patch (renamed from pkgs/desktops/gnome-3/core/geocode-glib/installed-tests-path.patch)0
-rw-r--r--pkgs/development/libraries/geoip/default.nix5
-rw-r--r--pkgs/development/libraries/gexiv2/default.nix (renamed from pkgs/desktops/gnome-3/misc/gexiv2/default.nix)24
-rw-r--r--pkgs/development/libraries/gfbgraph/default.nix (renamed from pkgs/desktops/gnome-3/misc/gfbgraph/default.nix)12
-rw-r--r--pkgs/development/libraries/git2/0.27.nix36
-rw-r--r--pkgs/development/libraries/git2/default.nix19
-rw-r--r--pkgs/development/libraries/glib/default.nix23
-rw-r--r--pkgs/development/libraries/glibmm/default.nix27
-rw-r--r--pkgs/development/libraries/gnome-menus/default.nix (renamed from pkgs/desktops/gnome-3/core/gnome-menus/default.nix)7
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix4
-rw-r--r--pkgs/development/libraries/gsound/default.nix (renamed from pkgs/desktops/gnome-3/core/gsound/default.nix)7
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix2
-rw-r--r--pkgs/development/libraries/gtk+/3.x.nix13
-rw-r--r--pkgs/development/libraries/gtkd/default.nix4
-rw-r--r--pkgs/development/libraries/gtkmm/3.x.nix20
-rw-r--r--pkgs/development/libraries/gvfs/default.nix2
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/hivex/default.nix7
-rw-r--r--pkgs/development/libraries/jansson/default.nix4
-rw-r--r--pkgs/development/libraries/kerberos/krb5.nix2
-rw-r--r--pkgs/development/libraries/libassuan/default.nix4
-rw-r--r--pkgs/development/libraries/libatomic_ops/default.nix4
-rw-r--r--pkgs/development/libraries/libcroco/default.nix (renamed from pkgs/desktops/gnome-3/core/libcroco/default.nix)7
-rw-r--r--pkgs/development/libraries/libgdata/default.nix (renamed from pkgs/desktops/gnome-3/core/libgdata/default.nix)18
-rw-r--r--pkgs/development/libraries/libgee/default.nix (renamed from pkgs/desktops/gnome-3/core/libgee/default.nix)9
-rw-r--r--pkgs/development/libraries/libgepub/default.nix (renamed from pkgs/desktops/gnome-3/core/libgepub/default.nix)7
-rw-r--r--pkgs/development/libraries/libgit2-glib/default.nix (renamed from pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix)13
-rw-r--r--pkgs/development/libraries/libgnomekbd/default.nix (renamed from pkgs/desktops/gnome-3/core/libgnomekbd/default.nix)6
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix4
-rw-r--r--pkgs/development/libraries/libgsf/default.nix15
-rw-r--r--pkgs/development/libraries/libguestfs/default.nix15
-rw-r--r--pkgs/development/libraries/libgweather/default.nix (renamed from pkgs/desktops/gnome-3/core/libgweather/default.nix)11
-rw-r--r--pkgs/development/libraries/libgxps/default.nix (renamed from pkgs/desktops/gnome-3/core/libgxps/default.nix)7
-rw-r--r--pkgs/development/libraries/libinput/default.nix40
-rw-r--r--pkgs/development/libraries/libmediaart/default.nix (renamed from pkgs/desktops/gnome-3/misc/libmediaart/default.nix)16
-rw-r--r--pkgs/development/libraries/libmilter/default.nix6
-rw-r--r--pkgs/development/libraries/libpeas/default.nix (renamed from pkgs/desktops/gnome-3/core/libpeas/default.nix)22
-rw-r--r--pkgs/development/libraries/libpfm/default.nix7
-rw-r--r--pkgs/development/libraries/librest/default.nix (renamed from pkgs/desktops/gnome-3/core/rest/default.nix)13
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libssh/default.nix4
-rw-r--r--pkgs/development/libraries/libwacom/default.nix4
-rw-r--r--pkgs/development/libraries/libzapojit/default.nix (renamed from pkgs/desktops/gnome-3/core/libzapojit/default.nix)14
-rw-r--r--pkgs/development/libraries/mesa/default.nix27
-rw-r--r--pkgs/development/libraries/ncurses/default.nix1
-rw-r--r--pkgs/development/libraries/nettle/default.nix4
-rw-r--r--pkgs/development/libraries/nss/default.nix4
-rw-r--r--pkgs/development/libraries/opendkim/default.nix6
-rw-r--r--pkgs/development/libraries/openjpeg/2.x.nix10
-rw-r--r--pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch55
-rw-r--r--pkgs/development/libraries/openjpeg/generic.nix4
-rw-r--r--pkgs/development/libraries/openldap/default.nix33
-rw-r--r--pkgs/development/libraries/pangomm/default.nix19
-rw-r--r--pkgs/development/libraries/polkit/default.nix7
-rw-r--r--pkgs/development/libraries/poppler/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.11/default.nix1
-rw-r--r--pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch48
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix146
-rw-r--r--pkgs/development/libraries/qt-5/5.12/fetch.sh2
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch13
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch70
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch30
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch102
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase.patch1096
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch33
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtscript.patch13
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtserialport.patch22
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtwebkit.patch12
-rw-r--r--pkgs/development/libraries/qt-5/5.12/srcs.nix325
-rw-r--r--pkgs/development/libraries/qt-5/5.6/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch46
-rw-r--r--pkgs/development/libraries/qt-5/5.9/default.nix1
-rw-r--r--pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch48
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix8
-rw-r--r--pkgs/development/libraries/tdb/default.nix26
-rw-r--r--pkgs/development/libraries/totem-pl-parser/default.nix (renamed from pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix)8
-rw-r--r--pkgs/development/libraries/vte/2.90.nix (renamed from pkgs/desktops/gnome-3/core/vte/2.90.nix)4
-rw-r--r--pkgs/development/libraries/vte/default.nix (renamed from pkgs/desktops/gnome-3/core/vte/default.nix)12
-rw-r--r--pkgs/development/libraries/vte/ng.nix (renamed from pkgs/desktops/gnome-3/core/vte/ng.nix)4
-rw-r--r--pkgs/development/libraries/wayland/default.nix17
-rw-r--r--pkgs/development/libraries/wildmidi/default.nix4
-rw-r--r--pkgs/development/libraries/x265/default.nix5
-rw-r--r--pkgs/development/libraries/zeromq/4.x.nix4
-rw-r--r--pkgs/development/perl-modules/DBD-SQLite/default.nix4
-rw-r--r--pkgs/development/python-modules/certifi/default.nix6
-rw-r--r--pkgs/development/python-modules/elasticsearch-curator/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix6
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix6
-rw-r--r--pkgs/development/python-modules/pygobject/3.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix4
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix48
-rw-r--r--pkgs/development/tools/analysis/valgrind/default.nix8
-rw-r--r--pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch2
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/fix-rpath.patch35
-rw-r--r--pkgs/development/tools/build-managers/meson/gir-fallback-path.patch2
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix10
-rw-r--r--pkgs/development/tools/misc/binutils/dtneeded.patch12
-rw-r--r--pkgs/development/tools/misc/binutils/pt-pax-flags.patch233
-rw-r--r--pkgs/development/tools/misc/creduce/default.nix5
-rw-r--r--pkgs/development/tools/misc/csmith/default.nix4
-rw-r--r--pkgs/development/tools/misc/dejagnu/default.nix4
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/help2man/default.nix9
-rw-r--r--pkgs/development/tools/misc/icon-naming-utils/default.nix6
-rw-r--r--pkgs/development/tools/sslmate/default.nix6
-rw-r--r--pkgs/development/tools/xcbuild/default.nix2
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix1
-rw-r--r--pkgs/development/web/wml/default.nix4
-rw-r--r--pkgs/misc/cups/cups-clean-dirty.patch13
-rw-r--r--pkgs/misc/cups/default.nix14
-rw-r--r--pkgs/misc/cups/filters.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix5
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix12
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix23
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix10
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix16
-rw-r--r--pkgs/os-specific/linux/iptables/netinet-headers-collision.patch11
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix4
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix5
-rw-r--r--pkgs/os-specific/linux/sysvinit/default.nix6
-rw-r--r--pkgs/servers/bird/default.nix9
-rw-r--r--pkgs/servers/foswiki/default.nix4
-rw-r--r--pkgs/servers/http/nginx/generic.nix19
-rw-r--r--pkgs/servers/mail/dkimproxy/default.nix6
-rw-r--r--pkgs/servers/mail/dovecot/default.nix17
-rw-r--r--pkgs/servers/mail/dspam/default.nix6
-rw-r--r--pkgs/servers/mail/postfix/default.nix9
-rw-r--r--pkgs/servers/mail/postgrey/default.nix8
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix10
-rw-r--r--pkgs/servers/memcached/default.nix4
-rw-r--r--pkgs/servers/monitoring/munin/default.nix17
-rw-r--r--pkgs/servers/monitoring/net-snmp/default.nix3
-rw-r--r--pkgs/servers/monitoring/plugins/labs_consol_de.nix12
-rw-r--r--pkgs/servers/openxpki/default.nix36
-rw-r--r--pkgs/servers/slimserver/default.nix10
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix7
-rw-r--r--pkgs/stdenv/cross/default.nix3
-rw-r--r--pkgs/stdenv/generic/default.nix3
-rw-r--r--pkgs/stdenv/generic/setup.sh4
-rw-r--r--pkgs/stdenv/linux/default.nix10
-rw-r--r--pkgs/tools/backup/store-backup/default.nix2
-rw-r--r--pkgs/tools/backup/znapzend/default.nix5
-rw-r--r--pkgs/tools/filesystems/file-rename/default.nix2
-rw-r--r--pkgs/tools/graphics/fgallery/default.nix6
-rw-r--r--pkgs/tools/misc/arp-scan/default.nix2
-rw-r--r--pkgs/tools/misc/cloc/default.nix10
-rw-r--r--pkgs/tools/misc/coreutils/default.nix15
-rw-r--r--pkgs/tools/misc/debian-devscripts/default.nix10
-rw-r--r--pkgs/tools/misc/grub/2.0x.nix2
-rw-r--r--pkgs/tools/misc/grub/trusted.nix4
-rw-r--r--pkgs/tools/misc/moreutils/default.nix4
-rw-r--r--pkgs/tools/misc/rrdtool/default.nix4
-rw-r--r--pkgs/tools/networking/curl/default.nix9
-rw-r--r--pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch54
-rw-r--r--pkgs/tools/networking/infiniband-diags/default.nix4
-rw-r--r--pkgs/tools/networking/mosh/default.nix8
-rw-r--r--pkgs/tools/networking/network-manager/applet.nix4
-rw-r--r--pkgs/tools/networking/slimrat/default.nix6
-rw-r--r--pkgs/tools/networking/smokeping/default.nix13
-rw-r--r--pkgs/tools/networking/swaks/default.nix2
-rw-r--r--pkgs/tools/networking/swec/default.nix13
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rw-r--r--pkgs/tools/networking/wget/default.nix10
-rw-r--r--pkgs/tools/package-management/apt/default.nix7
-rw-r--r--pkgs/tools/security/diceware/default.nix4
-rw-r--r--pkgs/tools/security/gnupg/22.nix4
-rw-r--r--pkgs/tools/security/john/default.nix2
-rw-r--r--pkgs/tools/security/kpcli/default.nix2
-rw-r--r--pkgs/tools/security/monkeysphere/default.nix2
-rw-r--r--pkgs/tools/security/pcsctools/default.nix11
-rw-r--r--pkgs/tools/security/signing-party/default.nix16
-rw-r--r--pkgs/tools/system/logcheck/default.nix11
-rw-r--r--pkgs/tools/text/mb2md/default.nix6
-rw-r--r--pkgs/tools/text/namazu/default.nix11
-rw-r--r--pkgs/tools/text/popfile/default.nix1
-rw-r--r--pkgs/tools/text/schema2ldif/default.nix6
-rw-r--r--pkgs/tools/typesetting/biber/default.nix4
-rw-r--r--pkgs/tools/typesetting/docbook2odf/default.nix6
-rw-r--r--pkgs/tools/typesetting/docbook2x/default.nix14
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix39
-rw-r--r--pkgs/tools/typesetting/xmlto/default.nix4
-rw-r--r--pkgs/tools/virtualization/nixos-container/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix252
-rw-r--r--pkgs/top-level/darwin-packages.nix1
-rw-r--r--pkgs/top-level/perl-packages.nix174
-rw-r--r--pkgs/top-level/python-packages.nix4
348 files changed, 3628 insertions, 2298 deletions
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 4549bbd1686b..14b36f55f52f 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -303,11 +303,15 @@ with import <nixpkgs> {};
 
 stdenv.mkDerivation {
   name = "rust-env";
-  buildInputs = [
+  nativeBuildInputs = [
     rustc cargo
 
-    # Example Additional Dependencies
-    pkgconfig openssl
+    # Example Build-time Additional Dependencies
+    pkgconfig
+  ];
+  buildInputs = [
+    # Example Run-time Additional Dependencies
+    openssl
   ];
 
   # Set Environment Variables
diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 1c18fab86696..564471bbbbc6 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -2435,30 +2435,6 @@ addEnvHooks "$hostOffset" myBashFunction
     </varlistentry>
     <varlistentry>
      <term>
-      paxctl
-     </term>
-     <listitem>
-      <para>
-       Defines the <varname>paxmark</varname> helper for setting per-executable
-       PaX flags on Linux (where it is available by default; on all other
-       platforms, <varname>paxmark</varname> is a no-op). For example, to
-       disable secure memory protections on the executable
-       <replaceable>foo</replaceable>
-<programlisting>
-      postFixup = ''
-        paxmark m $out/bin/<replaceable>foo</replaceable>
-      '';
-    </programlisting>
-       The <literal>m</literal> flag is the most common flag and is typically
-       required for applications that employ JIT compilation or otherwise need
-       to execute code generated at run-time. Disabling PaX protections should
-       be considered a last resort: if possible, problematic features should be
-       disabled or patched to work with PaX.
-      </para>
-     </listitem>
-    </varlistentry>
-    <varlistentry>
-     <term>
       autoPatchelfHook
      </term>
      <listitem>
diff --git a/lib/default.nix b/lib/default.nix
index 916f6e05190b..025df167c605 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -80,7 +80,7 @@ let
     inherit (strings) concatStrings concatMapStrings concatImapStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep makeSearchPath makeSearchPathOutput
-      makeLibraryPath makeBinPath makePerlPath makeFullPerlPath optionalString
+      makeLibraryPath makeBinPath optionalString
       hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
diff --git a/lib/strings.nix b/lib/strings.nix
index 48420a367815..47c881cfbc7c 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -162,26 +162,6 @@ rec {
   */
   makeBinPath = makeSearchPathOutput "bin" "bin";
 
-
-  /* Construct a perl search path (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makePerlPath [ pkgs.perlPackages.libnet ]
-       => "/nix/store/n0m1fk9c960d8wlrs62sncnadygqqc6y-perl-Net-SMTP-1.25/lib/perl5/site_perl"
-  */
-  # FIXME(zimbatm): this should be moved in perl-specific code
-  makePerlPath = makeSearchPathOutput "lib" "lib/perl5/site_perl";
-
-  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
-
-     Example:
-       pkgs = import <nixpkgs> { }
-       makeFullPerlPath [ pkgs.perlPackages.CGI ]
-       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
-  */
-  makeFullPerlPath = deps: makePerlPath (lib.misc.closePropagation deps);
-
   /* Depending on the boolean `cond', return either the given string
      or the empty string. Useful to concatenate against a bigger string.
 
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 25df5e174069..9b25052ab88d 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -98,7 +98,7 @@ rec {
       in
         if final.parsed.kernel.name == pkgs.stdenv.hostPlatform.parsed.kernel.name &&
            (final.parsed.cpu.name == pkgs.stdenv.hostPlatform.parsed.cpu.name ||
-            (final.platform.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
+            (final.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
         then pkgs.runtimeShell
         else if final.isWindows
         then "${wine}/bin/${wine-name}"
diff --git a/maintainers/scripts/nix-generate-from-cpan.nix b/maintainers/scripts/nix-generate-from-cpan.nix
index ec406ac1a703..5c4cf0f6c558 100644
--- a/maintainers/scripts/nix-generate-from-cpan.nix
+++ b/maintainers/scripts/nix-generate-from-cpan.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "nix-generate-from-cpan-3";
 
   buildInputs = with perlPackages; [
-    makeWrapper perl CPANMeta GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
+    makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
   ];
 
   phases = [ "installPhase" ];
diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
index c0b4041d7e30..e68563ef48d2 100644
--- a/nixos/lib/testing.nix
+++ b/nixos/lib/testing.nix
@@ -34,14 +34,14 @@ in rec {
         cp ${./test-driver/test-driver.pl} $out/bin/nixos-test-driver
         chmod u+x $out/bin/nixos-test-driver
 
-        libDir=$out/lib/perl5/site_perl
+        libDir=$out/${perl.libPrefix}
         mkdir -p $libDir
         cp ${./test-driver/Machine.pm} $libDir/Machine.pm
         cp ${./test-driver/Logger.pm} $libDir/Logger.pm
 
         wrapProgram $out/bin/nixos-test-driver \
           --prefix PATH : "${lib.makeBinPath [ qemu_test vde2 netpbm coreutils ]}" \
-          --prefix PERL5LIB : "${with perlPackages; lib.makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/lib/perl5/site_perl"
+          --prefix PERL5LIB : "${with perlPackages; makePerlPath [ TermReadLineGnu XMLWriter IOTty FileSlurp ]}:$out/${perl.libPrefix}"
       '';
   };
 
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 137ee243813d..c3f228c9bcc4 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -534,8 +534,8 @@ in {
         install -m 0755 -d /home
 
         ${pkgs.perl}/bin/perl -w \
-          -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl \
-          -I${pkgs.perlPackages.JSON}/lib/perl5/site_perl \
+          -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} \
+          -I${pkgs.perlPackages.JSON}/${pkgs.perl.libPrefix} \
           ${./update-users-groups.pl} ${spec}
       '';
 
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index af0a3a2fcc88..00c4d5018bf5 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -37,7 +37,7 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     path = [ pkgs.btrfs-progs ];
-    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
+    perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}";
     inherit (config.system.nixos) release;
   };
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 4a392b6f5c9c..1ae96f427ad8 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -695,7 +695,7 @@
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
   ./services/system/localtime.nix
-  ./services/system/kerberos.nix
+  ./services/system/kerberos/default.nix
   ./services/system/nscd.nix
   ./services/system/saslauthd.nix
   ./services/system/uptimed.nix
diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix
index bbe7165c62fb..656c255fcb18 100644
--- a/nixos/modules/programs/command-not-found/command-not-found.nix
+++ b/nixos/modules/programs/command-not-found/command-not-found.nix
@@ -16,7 +16,7 @@ let
     isExecutable = true;
     inherit (pkgs) perl;
     inherit (cfg) dbPath;
-    perlFlags = concatStrings (map (path: "-I ${path}/lib/perl5/site_perl ")
+    perlFlags = concatStrings (map (path: "-I ${path}/${pkgs.perl.libPrefix} ")
       [ pkgs.perlPackages.DBI pkgs.perlPackages.DBDSQLite pkgs.perlPackages.StringShellQuote ]);
   };
 
diff --git a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
index aa1165ab3bba..5ea4350be5b4 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
@@ -33,7 +33,7 @@ with lib;
 
     environment.systemPackages = [ pkgs.gnome3.gnome-keyring ];
 
-    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gnome3.gcr ];
+    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];
 
   };
 
diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix
index eb7f060c7da0..00875c6c4a18 100644
--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@@ -201,7 +201,6 @@ in
 
       serviceConfig = {
         Type="simple";
-        Environment="PYTHONPATH=${glusterfs}/usr/lib/python2.7/site-packages";
         PIDFile="/run/glustereventsd.pid";
         ExecStart="${glusterfs}/sbin/glustereventsd --pid-file /run/glustereventsd.pid";
         ExecReload="/bin/kill -SIGUSR2 $MAINPID";
diff --git a/nixos/modules/services/search/elasticsearch-curator.nix b/nixos/modules/services/search/elasticsearch-curator.nix
index 43785c392fee..8cb1275284a3 100644
--- a/nixos/modules/services/search/elasticsearch-curator.nix
+++ b/nixos/modules/services/search/elasticsearch-curator.nix
@@ -82,11 +82,12 @@ in {
   };
 
   config = mkIf cfg.enable {
-
     systemd.services.elasticsearch-curator = {
       startAt = cfg.interval;
       serviceConfig = {
-        ExecStart = ''${pkgs.python36Packages.elasticsearch-curator}/bin/curator --config ${curatorConfig} ${curatorAction}'';
+        ExecStart =
+          "${pkgs.python3Packages.elasticsearch-curator}/bin/curator" +
+          " --config ${curatorConfig} ${curatorAction}";
       };
     };
   };
diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix
deleted file mode 100644
index e2c45ed64ac0..000000000000
--- a/nixos/modules/services/system/kerberos.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{pkgs, config, lib, ...}:
-
-let
-
-  inherit (lib) mkOption mkIf;
-
-  inherit (pkgs) heimdalFull;
-
-  stateDir = "/var/heimdal";
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.kerberos_server = {
-
-      enable = mkOption {
-        default = false;
-        description = ''
-          Enable the kerberos authentification server.
-        '';
-      };
-
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf config.services.kerberos_server.enable {
-
-    environment.systemPackages = [ heimdalFull ];
-
-    services.xinetd.enable = true;
-    services.xinetd.services = lib.singleton
-      { name = "kerberos-adm";
-        flags = "REUSE NAMEINARGS";
-        protocol = "tcp";
-        user = "root";
-        server = "${pkgs.tcp_wrappers}/bin/tcpd";
-        serverArgs = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
-      };
-
-    systemd.services.kdc = {
-      description = "Key Distribution Center daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      script = "${heimdalFull}/libexec/heimdal/kdc";
-    };
-
-    systemd.services.kpasswdd = {
-      description = "Kerberos Password Changing daemon";
-      wantedBy = [ "multi-user.target" ];
-      script = "${heimdalFull}/libexec/heimdal/kpasswdd";
-    };
-  };
-
-}
diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix
new file mode 100644
index 000000000000..26ac85de402f
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/default.nix
@@ -0,0 +1,80 @@
+{pkgs, config, lib, ...}:
+
+let
+  inherit (lib) mkOption mkIf types length attrNames;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+
+  aclEntry = {
+    options = {
+      principal = mkOption {
+        type = types.str;
+        description = "Which principal the rule applies to";
+      };
+      access = mkOption {
+        type = types.either
+          (types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
+          (types.enum ["all"]);
+        default = "all";
+        description = "The changes the principal is allowed to make.";
+      };
+      target = mkOption {
+        type = types.str;
+        default = "*";
+        description = "The principals that 'access' applies to.";
+      };
+    };
+  };
+
+  realm = {
+    options = {
+      acl = mkOption {
+        type = types.listOf (types.submodule aclEntry);
+        default = [
+          { principal = "*/admin"; access = "all"; }
+          { principal = "admin"; access = "all"; }
+        ];
+        description = ''
+          The privileges granted to a user.
+        '';
+      };
+    };
+  };
+in
+
+{
+  imports = [
+    ./mit.nix
+    ./heimdal.nix
+  ];
+
+  ###### interface
+  options = {
+    services.kerberos_server = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Enable the kerberos authentification server.
+        '';
+      };
+
+      realms = mkOption {
+        type = types.attrsOf (types.submodule realm);
+        description = ''
+          The realm(s) to serve keys for.
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ kerberos ];
+    assertions = [{
+      assertion = length (attrNames cfg.realms) <= 1;
+      message = "Only one realm per server is currently supported.";
+    }];
+  };
+}
diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix
new file mode 100644
index 000000000000..d0f470f836ed
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@@ -0,0 +1,68 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs
+    mapAttrsToList attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/heimdal";
+  aclFiles = mapAttrs
+    (name: {acl, ...}: pkgs.writeText "${name}.acl" (concatMapStrings ((
+      {principal, access, target, ...} :
+      "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
+    )) acl)) cfg.realms;
+
+  kdcConfigs = mapAttrsToList (name: value: ''
+    database = {
+      dbname = ${stateDir}/heimdal
+      acl_file = ${value}
+    }
+  '') aclFiles;
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [kdc]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+in
+
+{
+  # No documentation about correct triggers, so guessing at them.
+
+  config = mkIf (cfg.enable && kerberos == pkgs.heimdalFull) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart =
+        "${kerberos}/libexec/heimdal/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    systemd.services.kpasswdd = {
+      description = "Kerberos Password Changing daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/libexec/heimdal/kpasswdd";
+      restartTriggers = [ kdcConfFile ];
+    };
+
+    environment.etc = {
+      # Can be set via the --config-file option to KDC
+      "heimdal-kdc/kdc.conf".source = kdcConfFile;
+    };
+  };
+}
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
new file mode 100644
index 000000000000..a53d9dd0c6b5
--- /dev/null
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -0,0 +1,68 @@
+{ pkgs, config, lib, ... } :
+
+let
+  inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList
+    mapAttrs mapAttrsToList attrValues;
+  cfg = config.services.kerberos_server;
+  kerberos = config.krb5.kerberos;
+  stateDir = "/var/lib/krb5kdc";
+  PIDFile = "/run/kdc.pid";
+  aclMap = {
+    add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
+    all = "*";
+  };
+  aclFiles = mapAttrs
+    (name: {acl, ...}: (pkgs.writeText "${name}.acl" (concatMapStrings (
+      {principal, access, target, ...} :
+      let access_code = map (a: aclMap.${a}) (toList access); in
+      "${principal} ${concatStrings access_code} ${target}\n"
+    ) acl))) cfg.realms;
+  kdcConfigs = mapAttrsToList (name: value: ''
+    ${name} = {
+      acl_file = ${value}
+    }
+  '') aclFiles;
+  kdcConfFile = pkgs.writeText "kdc.conf" ''
+    [realms]
+    ${concatStringsSep "\n" kdcConfigs}
+  '';
+  env = {
+    # What Debian uses, could possibly link directly to Nix store?
+    KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
+  };
+in
+
+{
+  config = mkIf (cfg.enable && kerberos == pkgs.krb5Full) {
+    systemd.services.kadmind = {
+      description = "Kerberos Administration Daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig.ExecStart = "${kerberos}/bin/kadmind -nofork";
+      restartTriggers = [ kdcConfFile ];
+      environment = env;
+    };
+
+    systemd.services.kdc = {
+      description = "Key Distribution Center daemon";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+      '';
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = PIDFile;
+        ExecStart = "${kerberos}/bin/krb5kdc -P ${PIDFile}";
+      };
+      restartTriggers = [ kdcConfFile ];
+      environment = env;
+    };
+
+    environment.etc = {
+      "krb5kdc/kdc.conf".source = kdcConfFile;
+    };
+    environment.variables = env;
+  };
+}
diff --git a/nixos/modules/services/web-servers/lighttpd/collectd.nix b/nixos/modules/services/web-servers/lighttpd/collectd.nix
index 35b5edced68b..e70c980d5243 100644
--- a/nixos/modules/services/web-servers/lighttpd/collectd.nix
+++ b/nixos/modules/services/web-servers/lighttpd/collectd.nix
@@ -48,7 +48,7 @@ in
           "/collectd" => "${cfg.collectionCgi}"
         )
         setenv.add-environment = (
-          "PERL5LIB" => "${with pkgs; lib.makePerlPath [ perlPackages.CGI perlPackages.HTMLParser perlPackages.URI rrdtool ]}",
+          "PERL5LIB" => "${with pkgs.perlPackages; makePerlPath [ CGI HTMLParser URI pkgs.rrdtool ]}",
           "COLLECTION_CONF" => "${collectionConf}"
         )
       }
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
index 576a07c1d272..9ac6b6b12242 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix
@@ -3,6 +3,6 @@
 pkgs.substituteAll {
   src = ./extlinux-conf-builder.sh;
   isExecutable = true;
-  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
-  inherit (pkgs) bash;
+  path = [pkgs.buildPackages.coreutils pkgs.buildPackages.gnused pkgs.buildPackages.gnugrep];
+  inherit (pkgs.buildPackages) bash;
 }
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 3a33b3f65d36..a1537ad3cedc 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -586,7 +586,7 @@ in
         in pkgs.writeScript "install-grub.sh" (''
         #!${pkgs.runtimeShell}
         set -e
-        export PERL5LIB=${makePerlPath (with pkgs.perlPackages; [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ])}
+        export PERL5LIB=${with pkgs.perlPackages; makePerlPath [ FileSlurp XMLLibXML XMLSAX XMLSAXBase ListCompare ]}
         ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"}
       '' + flip concatMapStrings cfg.mirroredBoots (args: ''
         ${pkgs.perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 7d43ba07ca57..57ade2880962 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -154,7 +154,7 @@ in
       ''
         # Set up the statically computed bits of /etc.
         echo "setting up /etc..."
-        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl ${./setup-etc.pl} ${etc}/etc
+        ${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix} ${./setup-etc.pl} ${etc}/etc
       '';
 
   };
diff --git a/nixos/modules/testing/service-runner.nix b/nixos/modules/testing/service-runner.nix
index 25490d671152..5ead75788e5c 100644
--- a/nixos/modules/testing/service-runner.nix
+++ b/nixos/modules/testing/service-runner.nix
@@ -6,7 +6,7 @@ let
 
   makeScript = name: service: pkgs.writeScript "${name}-runner"
     ''
-      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl
+      #! ${pkgs.perl}/bin/perl -w -I${pkgs.perlPackages.FileSlurp}/${pkgs.perl.libPrefix}
 
       use File::Slurp;
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 860262eeb6cd..38fa9ffad3cd 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -109,6 +109,7 @@ in
   ipv6 = handleTest ./ipv6.nix {};
   jenkins = handleTest ./jenkins.nix {};
   #kafka = handleTest ./kafka.nix {}; # broken since openjdk: 8u181 -> 8u192
+  kerberos = handleTest tests/kerberos/default.nix {};
   kernel-latest = handleTest ./kernel-latest.nix {};
   kernel-lts = handleTest ./kernel-lts.nix {};
   keymap = handleTest ./keymap.nix {};
diff --git a/nixos/tests/kerberos/default.nix b/nixos/tests/kerberos/default.nix
new file mode 100644
index 000000000000..ae8bdb8bbc82
--- /dev/null
+++ b/nixos/tests/kerberos/default.nix
@@ -0,0 +1,5 @@
+{ system ? builtins.currentSystem }:
+{
+  mit = import ./mit.nix { inherit system; };
+  heimdal = import ./heimdal.nix { inherit system; };
+}
diff --git a/nixos/tests/kerberos/heimdal.nix b/nixos/tests/kerberos/heimdal.nix
new file mode 100644
index 000000000000..a0551b131e91
--- /dev/null
+++ b/nixos/tests/kerberos/heimdal.nix
@@ -0,0 +1,53 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-heimdal";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.heimdalFull;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kadmin -l init --realm-max-ticket-life='8 day' \\
+       --realm-max-renewable-life='10 day' FOO.BAR"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+    $machine->waitForUnit("kpasswdd.service");
+
+    $machine->succeed(
+      "kadmin -l add --password=admin_pw --use-defaults admin"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=admin.keytab admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -K admin.keytab add --password=alice_pw --use-defaults \\
+       alice"
+    );
+    $machine->succeed(
+      "kadmin -l ext_keytab --keytab=alice.keytab alice"
+    );
+    $machine->succeed("kinit -kt alice.keytab alice");
+  '';
+})
diff --git a/nixos/tests/kerberos/mit.nix b/nixos/tests/kerberos/mit.nix
new file mode 100644
index 000000000000..6da3a384aa99
--- /dev/null
+++ b/nixos/tests/kerberos/mit.nix
@@ -0,0 +1,45 @@
+import ../make-test.nix ({pkgs, ...}: {
+  name = "kerberos_server-mit";
+  machine = { config, libs, pkgs, ...}:
+  { services.kerberos_server =
+    { enable = true;
+      realms = {
+        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
+      };
+    };
+    krb5 = {
+      enable = true;
+      kerberos = pkgs.krb5Full;
+      libdefaults = {
+        default_realm = "FOO.BAR";
+      };
+      realms = {
+        "FOO.BAR" = {
+          admin_server = "machine";
+          kdc = "machine";
+        };
+      };
+    };
+    users.extraUsers.alice = { isNormalUser = true; };
+  };
+
+  testScript = ''
+    $machine->start;
+
+    $machine->succeed(
+      "kdb5_util create -s -r FOO.BAR -P master_key"
+    );
+
+    $machine->succeed("systemctl restart kadmind.service kdc.service");
+    $machine->waitForUnit("kadmind.service");
+    $machine->waitForUnit("kdc.service");
+
+    $machine->succeed(
+      "kadmin.local add_principal -pw admin_pw admin"
+    );
+    $machine->succeed(
+      "kadmin -p admin -w admin_pw addprinc -pw alice_pw alice"
+    );
+    $machine->succeed("echo alice_pw | sudo -u alice kinit");
+  '';
+})
diff --git a/pkgs/applications/altcoins/parity-ui/default.nix b/pkgs/applications/altcoins/parity-ui/default.nix
index ec2e571e3f0b..c59b2ccb8ac3 100644
--- a/pkgs/applications/altcoins/parity-ui/default.nix
+++ b/pkgs/applications/altcoins/parity-ui/default.nix
@@ -34,8 +34,6 @@ in stdenv.mkDerivation rec {
 
     find $out/share/parity-ui -name "*.node" -exec patchelf --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" {} \;
 
-    paxmark m $out/share/parity-ui/parity-ui
-
     mkdir -p $out/bin
     ln -s $out/share/parity-ui/parity-ui $out/bin/parity-ui
   '';
diff --git a/pkgs/applications/audio/abcde/default.nix b/pkgs/applications/audio/abcde/default.nix
index 58e8ecc4fcab..240729811352 100644
--- a/pkgs/applications/audio/abcde/default.nix
+++ b/pkgs/applications/audio/abcde/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, libcdio-paranoia, cddiscid, wget, which, vorbis-tools, id3v2, eyeD3
 , lame, flac, glyr
-, perl, MusicBrainz, MusicBrainzDiscID
+, perlPackages
 , makeWrapper }:
 
 let version = "2.9.2";
@@ -29,7 +29,7 @@ in
 
     nativeBuildInputs = [ makeWrapper ];
 
-    buildInputs = [ perl MusicBrainz MusicBrainzDiscID ];
+    buildInputs = with perlPackages; [ perl MusicBrainz MusicBrainzDiscID ];
 
     installFlags = [ "sysconfdir=$(out)/etc" ];
 
diff --git a/pkgs/applications/audio/crip/default.nix b/pkgs/applications/audio/crip/default.nix
index 0383af06795e..f7bf919c2212 100644
--- a/pkgs/applications/audio/crip/default.nix
+++ b/pkgs/applications/audio/crip/default.nix
@@ -2,7 +2,6 @@
 , fetchurl
 , makeWrapper
 
-, perl
 , perlPackages
 
 , cdparanoia
@@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pk9152wll6fmkj1pki3fz3ijlf06jyk32v31yarwvdkwrk7s9xz";
   };
 
-  buildInputs = [ perl perlPackages.CDDB_get ];
+  buildInputs = [ perlPackages.perl perlPackages.CDDB_get ];
   nativeBuildInputs = [ makeWrapper ];
 
   toolDeps = makeBinPath [
@@ -53,7 +52,7 @@ stdenv.mkDerivation rec {
         --replace '$editor = "vim";' '$editor = "${nano}/bin/nano";'
 
       wrapProgram $out/bin/$script \
-        --set PERL5LIB "${makePerlPath [ perlPackages.CDDB_get ]}" \
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.CDDB_get ]}" \
         --set PATH "${toolDeps}"
     done
   '';
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index d40544a0fa40..3eb5806aa4c1 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -11,8 +11,8 @@ let
       sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
     };
     "2" = {
-      fluidsynthVersion = "2.0.1";
-      sha256 = "1mqyym5qkh8xd1rqj3yhfxbw5dxjcrljb6nkfqzvcarlv4h6rjn7";
+      fluidsynthVersion = "2.0.2";
+      sha256 = "02vs5sfsyh1dl7wlcvgs4w3x0qcmsl7vi000qgp99ynwh3wjb274";
     };
   };
 in
diff --git a/pkgs/applications/audio/lollypop/default.nix b/pkgs/applications/audio/lollypop/default.nix
index 61586c6b2127..5bc6e7174656 100644
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit, meson, ninja, pkgconfig
 , python3, gtk3, gst_all_1, libsecret, libsoup
-, appstream-glib, desktop-file-utils, gnome3
+, appstream-glib, desktop-file-utils, totem-pl-parser
 , gobject-introspection, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec  {
@@ -28,7 +28,6 @@ python3.pkgs.buildPythonApplication rec  {
   ];
 
   buildInputs = with gst_all_1; [
-    gnome3.totem-pl-parser
     gst-libav
     gst-plugins-bad
     gst-plugins-base
@@ -38,6 +37,7 @@ python3.pkgs.buildPythonApplication rec  {
     gtk3
     libsecret
     libsoup
+    totem-pl-parser
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index 968c5edae63a..e540016ac81c 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -6,6 +6,7 @@
 , intltool
 , libsoup
 , gnome3
+, totem-pl-parser
 , tdb
 , json-glib
 , itstool
@@ -48,7 +49,7 @@ in stdenv.mkDerivation rec {
 
     gtk3
     gnome3.libpeas
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.defaultIconTheme
 
     gst_all_1.gstreamer
diff --git a/pkgs/applications/editors/atom/default.nix b/pkgs/applications/editors/atom/default.nix
index 710c3ca335a6..13dc9e1285b1 100644
--- a/pkgs/applications/editors/atom/default.nix
+++ b/pkgs/applications/editors/atom/default.nix
@@ -70,9 +70,6 @@ let
       ln -s ${pkgs.git}/bin/git $dugite/git/libexec/git-core/git
 
       find $share -name "*.node" -exec patchelf --set-rpath "${atomEnv.libPath}:$share" {} \;
-
-      paxmark m $share/atom
-      paxmark m $share/resources/app/apm/bin/node
     '';
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/gnome-builder/default.nix b/pkgs/applications/editors/gnome-builder/default.nix
index 5a4be5eb4485..8e0176797d2d 100644
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@@ -7,6 +7,7 @@
 , flatpak
 , glibcLocales
 , gnome3
+, libgit2-glib
 , gobject-introspection
 , gspell
 , gtk-doc
@@ -26,6 +27,7 @@
 , sysprof
 , template-glib
 , vala
+, vte
 , webkitgtk
 , wrapGAppsHook
 }:
@@ -61,9 +63,9 @@ in stdenv.mkDerivation {
     ctags
     flatpak
     gnome3.devhelp
-    gnome3.libgit2-glib
+    libgit2-glib
     gnome3.libpeas
-    gnome3.vte
+    vte
     gspell
     gtk3
     gtksourceview4
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 50664fc9e59b..a1ef5fcb4b6f 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -35,9 +35,9 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
+  checkInputs = [ perlPackages.TestCommand ];
   preCheck = ''
-    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
+    export PERL5LIB="${perlPackages.TestCommand}/${perlPackages.perl.libPrefix}"
   '';
 
   doCheck = true;
diff --git a/pkgs/applications/graphics/shotwell/default.nix b/pkgs/applications/graphics/shotwell/default.nix
index aef7143f7e03..2f06451438d9 100644
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, meson, ninja, gtk3, libexif, libgphoto2, libsoup, libxml2, vala, sqlite
-, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib
+, webkitgtk, pkgconfig, gnome3, gst_all_1, libgudev, libraw, glib, json-glib, gcr
 , gettext, desktop-file-utils, gdk_pixbuf, librsvg, wrapGAppsHook
 , gobject-introspection, itstool, libgdata, python3 }:
 
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.libgee
     libgudev gnome3.gexiv2 gnome3.gsettings-desktop-schemas
     libraw json-glib glib gdk_pixbuf librsvg gnome3.rest
-    gnome3.gcr gnome3.defaultIconTheme libgdata
+    gcr gnome3.defaultIconTheme libgdata
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/shutter/default.nix b/pkgs/applications/graphics/shutter/default.nix
index 7e7bf644ce79..5800fb6df3cf 100644
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
+{ stdenv, fetchurl, perlPackages, makeWrapper, imagemagick, gdk_pixbuf, librsvg
 , hicolor-icon-theme, procps
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl procps gdk_pixbuf librsvg ] ++ perlModules;
+  buildInputs = [ perlPackages.perl procps gdk_pixbuf librsvg ] ++ perlModules;
 
   installPhase = ''
     mkdir -p "$out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     (cd "$out" && mv CHANGES README COPYING "$out/share/doc/shutter")
 
     wrapProgram $out/bin/shutter \
-      --set PERL5LIB "${stdenv.lib.makePerlPath perlModules}" \
+      --set PERL5LIB "${perlPackages.makePerlPath perlModules}" \
       --prefix PATH : "${imagemagick.out}/bin" \
       --suffix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"
diff --git a/pkgs/applications/misc/extract_url/default.nix b/pkgs/applications/misc/extract_url/default.nix
index 389ac7dfb1fc..2b7888c9cd04 100644
--- a/pkgs/applications/misc/extract_url/default.nix
+++ b/pkgs/applications/misc/extract_url/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, perl
-, MIMEtools, HTMLParser
-, cursesSupport ? true, CursesUI
-, uriFindSupport ? true, URIFind
+{ stdenv, lib, fetchFromGitHub, makeWrapper, perlPackages
+, cursesSupport ? true
+, uriFindSupport ? true
 }:
 
 let
   perlDeps =
-    [ MIMEtools HTMLParser ]
-    ++ lib.optional cursesSupport CursesUI
-    ++ lib.optional uriFindSupport URIFind;
+    [ perlPackages.MIMEtools perlPackages.HTMLParser ]
+    ++ lib.optional cursesSupport perlPackages.CursesUI
+    ++ lib.optional uriFindSupport perlPackages.URIFind;
 
 in stdenv.mkDerivation rec {
   name = "extract_url-${version}";
@@ -22,14 +21,14 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ] ++ perlDeps;
+  buildInputs = [ perlPackages.perl ] ++ perlDeps;
 
   makeFlags = [ "prefix=$(out)" ];
   installFlags = [ "INSTALL=install" ];
 
   postFixup = ''
     wrapProgram "$out/bin/extract_url" \
-      --set PERL5LIB "${lib.makeFullPerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makeFullPerlPath perlDeps}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/ikiwiki/default.nix b/pkgs/applications/misc/ikiwiki/default.nix
index 6e4fc2065885..957f0f7f68bb 100644
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@@ -1,13 +1,9 @@
-{ stdenv, fetchurl, perl, gettext, makeWrapper, PerlMagick, YAML
-, TextMarkdown, URI, HTMLParser, HTMLScrubber, HTMLTemplate, TimeDate
-, CGISession, CGIFormBuilder, DBFile, LocaleGettext, RpcXML, XMLSimple
-, YAMLLibYAML, which, HTMLTree, AuthenPassphrase, NetOpenIDConsumer
-, LWPxParanoidAgent, CryptSSLeay
+{ stdenv, fetchurl, perlPackages, gettext, makeWrapper, PerlMagick, which
 , gitSupport ? false, git ? null
 , docutilsSupport ? false, python ? null, docutils ? null
 , monotoneSupport ? false, monotone ? null
 , bazaarSupport ? false, bazaar ? null
-, cvsSupport ? false, cvs ? null, cvsps ? null, Filechdir ? null
+, cvsSupport ? false, cvs ? null, cvsps ? null
 , subversionSupport ? false, subversion ? null
 , mercurialSupport ? false, mercurial ? null
 , extraUtils ? []
@@ -17,7 +13,7 @@ assert docutilsSupport -> (python != null && docutils != null);
 assert gitSupport -> (git != null);
 assert monotoneSupport -> (monotone != null);
 assert bazaarSupport -> (bazaar != null);
-assert cvsSupport -> (cvs != null && cvsps != null && Filechdir != null);
+assert cvsSupport -> (cvs != null && cvsps != null && perlPackages.Filechdir != null);
 assert subversionSupport -> (subversion != null);
 assert mercurialSupport -> (mercurial != null);
 
@@ -35,20 +31,21 @@ stdenv.mkDerivation {
     sha256 = "00d7yzv426fvqbhvzyafddv7fa6b4j2647b0wi371wd5yjj9j3sz";
   };
 
-  buildInputs = [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
-    TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
-    RpcXML XMLSimple PerlMagick YAML YAMLLibYAML which HTMLTree AuthenPassphrase
-    NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ]
+  buildInputs = [ which ]
+    ++ (with perlPackages; [ perl TextMarkdown URI HTMLParser HTMLScrubber HTMLTemplate
+          TimeDate gettext makeWrapper DBFile CGISession CGIFormBuilder LocaleGettext
+          RpcXML XMLSimple PerlMagick YAML YAMLLibYAML HTMLTree AuthenPassphrase
+          NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay ])
     ++ lib.optionals docutilsSupport [python docutils]
     ++ lib.optionals gitSupport [git]
     ++ lib.optionals monotoneSupport [monotone]
     ++ lib.optionals bazaarSupport [bazaar]
-    ++ lib.optionals cvsSupport [cvs cvsps Filechdir]
+    ++ lib.optionals cvsSupport [cvs cvsps perlPackages.Filechdir]
     ++ lib.optionals subversionSupport [subversion]
     ++ lib.optionals mercurialSupport [mercurial];
 
   patchPhase = ''
-    sed -i s@/usr/bin/perl@${perl}/bin/perl@ pm_filter mdwn2man
+    sed -i s@/usr/bin/perl@${perlPackages.perl}/bin/perl@ pm_filter mdwn2man
     sed -i s@/etc/ikiwiki@$out/etc@ Makefile.PL
     sed -i /ENV{PATH}/d ikiwiki.in
     # State the gcc dependency, and make the cgi use our wrapper
@@ -60,7 +57,7 @@ stdenv.mkDerivation {
 
   postInstall = ''
     for a in "$out/bin/"*; do
-      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perl}/bin:$out/bin \
+      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perlPackages.perl}/bin:$out/bin \
       ${lib.optionalString gitSupport ''--prefix PATH : ${git}/bin \''}
       ${lib.optionalString monotoneSupport ''--prefix PATH : ${monotone}/bin \''}
       ${lib.optionalString bazaarSupport ''--prefix PATH : ${bazaar}/bin \''}
diff --git a/pkgs/applications/misc/plank/default.nix b/pkgs/applications/misc/plank/default.nix
index 626e400eac4b..cc6b74dc9989 100644
--- a/pkgs/applications/misc/plank/default.nix
+++ b/pkgs/applications/misc/plank/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, vala, atk, cairo, glib, gnome3, gtk3, libwnck3
 , libX11, libXfixes, libXi, pango, intltool, pkgconfig, libxml2
-, bamf, gdk_pixbuf, libdbusmenu-gtk3, file
+, bamf, gdk_pixbuf, libdbusmenu-gtk3, file, gnome-menus
 , wrapGAppsHook, autoreconfHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  buildInputs = [ vala atk cairo glib gnome3.gnome-menus
+  buildInputs = [ vala atk cairo glib gnome-menus
                   gtk3 gnome3.libgee libwnck3 libX11 libXfixes
                   libXi pango gnome3.gnome-common bamf gdk_pixbuf
                   libdbusmenu-gtk3 gnome3.dconf ];
diff --git a/pkgs/applications/misc/pmenu/default.nix b/pkgs/applications/misc/pmenu/default.nix
index b14bb445b5d1..4b39e9291a8a 100644
--- a/pkgs/applications/misc/pmenu/default.nix
+++ b/pkgs/applications/misc/pmenu/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, python2Packages, gnome3 }:
+{ stdenv, fetchFromGitLab, python2Packages, gnome-menus }:
 
 stdenv.mkDerivation rec {
   name = "pmenu-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ python2Packages.wrapPython ];
 
-  buildInputs = [ python2Packages.pygtk gnome3.gnome-menus ];
+  buildInputs = [ python2Packages.pygtk gnome-menus ];
 
   pythonPath = [ python2Packages.pygtk ];
     
diff --git a/pkgs/applications/misc/qdirstat/default.nix b/pkgs/applications/misc/qdirstat/default.nix
index cbbac11424ec..ab9029512a20 100644
--- a/pkgs/applications/misc/qdirstat/default.nix
+++ b/pkgs/applications/misc/qdirstat/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qmake
 , coreutils, xdg_utils, bash
-, perl, makeWrapper, perlPackages }:
+, makeWrapper, perlPackages }:
 
 let
   version = "1.4";
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ qmake makeWrapper ];
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
 
   preBuild = ''
     substituteInPlace scripts/scripts.pro \
@@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/qdirstat-cache-writer \
-      --set PERL5LIB "${stdenv.lib.makePerlPath [ perlPackages.URI ]}"
+      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.URI ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/rxvt_unicode/default.nix b/pkgs/applications/misc/rxvt_unicode/default.nix
index 0e59ef5512d8..57ce1f081801 100644
--- a/pkgs/applications/misc/rxvt_unicode/default.nix
+++ b/pkgs/applications/misc/rxvt_unicode/default.nix
@@ -51,8 +51,8 @@ stdenv.mkDerivation (rec {
     ''
     # make urxvt find its perl file lib/perl5/site_perl is added to PERL5LIB automatically
     + stdenv.lib.optionalString perlSupport ''
-      mkdir -p $out/lib/perl5
-      ln -s $out/{lib/urxvt,lib/perl5/site_perl}
+      mkdir -p $(dirname ${perl.libPrefix})
+      ln -s $out/lib/urxvt $out/${perl.libPrefix}
     '';
 
   postInstall = ''
diff --git a/pkgs/applications/misc/slic3r/default.nix b/pkgs/applications/misc/slic3r/default.nix
index 7b28462d5527..e012c3763b34 100644
--- a/pkgs/applications/misc/slic3r/default.nix
+++ b/pkgs/applications/misc/slic3r/default.nix
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1pg4jxzb7f58ls5s8mygza8kqdap2c50kwlsdkf28bz1xi611zbi";
   };
 
-  buildInputs = 
-  [boost] ++ 
+  buildInputs =
+  [boost] ++
   (with perlPackages; [ perl makeWrapper which
-    EncodeLocale MathClipper ExtUtilsXSpp threads
+    EncodeLocale MathClipper ExtUtilsXSpp
     MathConvexHullMonotoneChain MathGeometryVoronoi MathPlanePath Moo
     IOStringy ClassXSAccessor Wx GrowlGNTP NetDBus ImportInto XMLSAX
     ExtUtilsMakeMaker OpenGL WxGLCanvas ModuleBuild LWP
diff --git a/pkgs/applications/misc/slic3r/prusa3d.nix b/pkgs/applications/misc/slic3r/prusa3d.nix
index 251ee4d918b4..680703737c2a 100644
--- a/pkgs/applications/misc/slic3r/prusa3d.nix
+++ b/pkgs/applications/misc/slic3r/prusa3d.nix
@@ -74,7 +74,6 @@ stdenv.mkDerivation rec {
     Moo
     NetDBus
     OpenGL
-    threads
     XMLSAX
   ]);
 
diff --git a/pkgs/applications/misc/terminator/default.nix b/pkgs/applications/misc/terminator/default.nix
index f32a27b9b78d..4a6ad4e5ea38 100644
--- a/pkgs/applications/misc/terminator/default.nix
+++ b/pkgs/applications/misc/terminator/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python2, keybinder3, intltool, file, gtk3, gobject-introspection
-, libnotify, wrapGAppsHook, gnome3
+, libnotify, wrapGAppsHook, vte
 }:
 
 python2.pkgs.buildPythonApplication rec {
@@ -12,7 +12,7 @@ python2.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [ file intltool wrapGAppsHook gobject-introspection ];
-  buildInputs = [ gtk3 gnome3.vte libnotify keybinder3 ];
+  buildInputs = [ gtk3 vte libnotify keybinder3 ];
   propagatedBuildInputs = with python2.pkgs; [ pygobject3 psutil pycairo ];
 
   postPatch = ''
diff --git a/pkgs/applications/misc/termite/default.nix b/pkgs/applications/misc/termite/default.nix
index 957b5bc0e8d5..22f669f03294 100644
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk3, ncurses, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, pkgconfig, vte-ng, gtk3, ncurses, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "termite-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
 
-  buildInputs = [ vte gtk3 ncurses ];
+  buildInputs = [ vte-ng gtk3 ncurses ];
 
   nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
 
diff --git a/pkgs/applications/misc/yarssr/default.nix b/pkgs/applications/misc/yarssr/default.nix
index a8ff981400a9..a47fb93512db 100644
--- a/pkgs/applications/misc/yarssr/default.nix
+++ b/pkgs/applications/misc/yarssr/default.nix
@@ -1,8 +1,4 @@
-{
-fetchFromGitHub, stdenv, lib,
-makeWrapper, pkgs,
-perl, perlPackages,
-gnome2 }:
+{ fetchFromGitHub, stdenv, lib, gettext, gtk2, makeWrapper, perlPackages, gnome2 }:
 
 let
   perlDeps = with perlPackages; [
@@ -24,7 +20,7 @@ let
   ];
   libs = [
     stdenv.cc.cc.lib
-    pkgs.gtk2
+    gtk2
   ];
 in
 stdenv.mkDerivation rec {
@@ -38,7 +34,7 @@ stdenv.mkDerivation rec {
     sha256 = "0x7hz8x8qyp3i1vb22zhcnvwxm3jhmmmlr22jqc5b09vpmbw1l45";
   };
 
-  nativeBuildInputs = [ perl pkgs.gettext makeWrapper ];
+  nativeBuildInputs = [ perlPackages.perl gettext makeWrapper ];
   buildInputs = perlDeps ++ [gnome2.libglade];
   propagatedBuildInputs = libs ++ perlDeps;
 
@@ -55,7 +51,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     wrapProgram $out/bin/yarssr \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath libs} \
-      --set PERL5LIB "${lib.makePerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makePerlPath perlDeps}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index bcf6df7417f7..0c199dab6bc8 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -282,8 +282,6 @@ let
           MENUNAME="Chromium"
           process_template chrome/app/resources/manpage.1.in "${buildPath}/chrome.1"
         )
-      '' + optionalString (target == "mksnapshot" || target == "chrome") ''
-        paxmark m "${buildPath}/${target}"
       '';
       targets = extraAttrs.buildTargets or [];
       commands = map buildCommand targets;
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 2a2f71d419fd..8f135614f4d2 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -263,20 +263,12 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   doCheck = false; # "--disable-tests" above
 
-  preInstall = ''
-    # The following is needed for startup cache creation on grsecurity kernels.
-    paxmark m dist/bin/xpcshell
-  '';
-
   installPhase = if stdenv.isDarwin then ''
     mkdir -p $out/Applications
     cp -LR dist/Firefox.app $out/Applications
   '' else null;
 
   postInstall = lib.optionalString stdenv.isLinux ''
-    # For grsecurity kernels
-    paxmark m $out/lib/firefox*/{firefox,firefox-bin,plugin-container}
-
     # Remove SDK cruft. FIXME: move to a separate output?
     rm -rf $out/share/idl $out/include $out/lib/firefox-devel-*
 
diff --git a/pkgs/applications/networking/browsers/midori/default.nix b/pkgs/applications/networking/browsers/midori/default.nix
index 6091c25ccd94..290810198ade 100644
--- a/pkgs/applications/networking/browsers/midori/default.nix
+++ b/pkgs/applications/networking/browsers/midori/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook
+{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook, gcr
 , gtk3, webkitgtk, sqlite, gsettings-desktop-schemas, libsoup, glib-networking, gnome3
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk3 webkitgtk sqlite gsettings-desktop-schemas gnome3.gcr
+    gtk3 webkitgtk sqlite gsettings-desktop-schemas gcr
     (libsoup.override { gnomeSupport = true; }) gnome3.libpeas
     glib-networking
   ];
diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index 70eb381c60e8..75998662f7f2 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -4,7 +4,7 @@
 , graphicsSupport ? true, imlib2 ? null
 , x11Support ? graphicsSupport, libX11 ? null
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses ? null
-, perl, man, pkgconfig
+, perl, man, pkgconfig, buildPackages, w3m
 }:
 
 assert sslSupport -> openssl != null;
@@ -14,7 +14,17 @@ assert mouseSupport -> gpm-ncurses != null;
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+let
+  mktable = buildPackages.stdenv.mkDerivation rec {
+    name = "w3m-mktable";
+    inherit (w3m) src;
+    nativeBuildInputs = [ pkgconfig boehmgc ];
+    makeFlags = [ "mktable" ];
+    installPhase = ''
+      install -D mktable $out/bin/mktable
+    '';
+  };
+in stdenv.mkDerivation rec {
   name = "w3m-0.5.3+git20180125";
 
   src = fetchFromGitHub {
@@ -31,6 +41,8 @@ stdenv.mkDerivation rec {
   PERL = "${perl}/bin/perl";
   MAN = "${man}/bin/man";
 
+  makeFlags = [ "AR=${stdenv.cc.bintools.targetPrefix}ar" ];
+
   patches = [
     ./RAND_egd.libressl.patch
     (fetchpatch {
@@ -40,8 +52,14 @@ stdenv.mkDerivation rec {
     })
   ] ++ optional (graphicsSupport && !x11Support) [ ./no-x11.patch ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ncurses boehmgc gettext zlib ]
+  postPatch = optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    ln -s ${mktable}/bin/mktable mktable
+    # stop make from recompiling mktable
+    sed -ie 's!mktable.*:.*!mktable:!' Makefile.in
+  '';
+
+  nativeBuildInputs = [ pkgconfig gettext ];
+  buildInputs = [ ncurses boehmgc zlib ]
     ++ optional sslSupport openssl
     ++ optional mouseSupport gpm-ncurses
     ++ optional graphicsSupport imlib2
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 09ead9b3de65..4b1af80d6243 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
         patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \
                  $out/opt/discord/Discord
 
-        paxmark m $out/opt/discord/Discord
-
         wrapProgram $out/opt/discord/Discord --prefix LD_LIBRARY_PATH : ${libPath}
 
         ln -s $out/opt/discord/Discord $out/bin/
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index 2f3870d78994..4b8670f23d43 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -54,7 +54,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/franz/Franz
     wrapProgram $out/opt/franz/Franz --prefix PATH : ${xdg_utils}/bin
   '';
 
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index 85dafa331c16..7a78527c5012 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -52,7 +52,6 @@ in stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    paxmark m $out/opt/wavebox/Wavebox
     makeWrapper $out/opt/wavebox/Wavebox $out/bin/wavebox \
       --prefix PATH : ${xdg_utils}/bin
   '';
diff --git a/pkgs/applications/networking/irc/weechat/wrapper.nix b/pkgs/applications/networking/irc/weechat/wrapper.nix
index 1e371bb8e223..70628722cbad 100644
--- a/pkgs/applications/networking/irc/weechat/wrapper.nix
+++ b/pkgs/applications/networking/irc/weechat/wrapper.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, runCommand, writeScriptBin, buildEnv
-, pythonPackages, perl, perlPackages
+, pythonPackages, perlPackages
 }:
 
 weechat:
@@ -10,7 +10,7 @@ let
   }:
 
   let
-    perlInterpreter = perl;
+    perlInterpreter = perlPackages.perl;
     availablePlugins = let
         simplePlugin = name: {pluginFile = "${weechat.${name}}/lib/weechat/plugins/${name}.so";};
       in rec {
@@ -29,7 +29,7 @@ let
           withPackages = pkgsFun: (perl // {
             extraEnv = ''
               ${perl.extraEnv}
-              export PERL5LIB=${lib.makeFullPerlPath (pkgsFun perlPackages)}
+              export PERL5LIB=${perlPackages.makeFullPerlPath (pkgsFun perlPackages)}
             '';
           });
         };
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 038e24de0313..d36f8eb16d27 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -100,7 +100,7 @@ in stdenv.mkDerivation rec {
     ''
       cxxLib=$( echo -n ${gcc}/include/c++/* )
       archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
-  
+
       test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
 
       configureScript="$(realpath ./configure)"
@@ -108,18 +108,9 @@ in stdenv.mkDerivation rec {
       cd ../objdir
     '';
 
-  preInstall =
-    ''
-      # The following is needed for startup cache creation on grsecurity kernels.
-      paxmark m ../objdir/dist/bin/xpcshell
-    '';
-
   dontWrapGApps = true; # we do it ourselves
   postInstall =
     ''
-      # For grsecurity kernels
-      paxmark m $out/lib/thunderbird/thunderbird
-
       # TODO: Move to a dev output?
       rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
 
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index 9d51a76f5360..308c857644eb 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -2,7 +2,7 @@
 , stdenv, fetchurl, pkgconfig, gtk3, gtkspell3 ? null
 , perl, gmime2, gettext, intltool, itstool, libxml2, dbus-glib, libnotify, gnutls
 , makeWrapper, gnupg
-, gnomeSupport ? true, gnome3, libsecret
+, gnomeSupport ? true, libsecret, gcr
 }:
 
 assert spellChecking -> gtkspell3 != null;
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig gettext intltool itstool libxml2 makeWrapper ];
   buildInputs = [ gtk3 gmime2 libnotify gnutls ]
     ++ stdenv.lib.optional spellChecking gtkspell3
-    ++ stdenv.lib.optionals gnomeSupport [ libsecret gnome3.gcr ];
+    ++ stdenv.lib.optionals gnomeSupport [ libsecret gcr ];
 
   configureFlags = [
     "--with-dbus"
diff --git a/pkgs/applications/networking/sieve-connect/default.nix b/pkgs/applications/networking/sieve-connect/default.nix
index 78910d1ecf6e..55d473bc104b 100644
--- a/pkgs/applications/networking/sieve-connect/default.nix
+++ b/pkgs/applications/networking/sieve-connect/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl, perlPackages }: stdenv.mkDerivation rec {
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages }:
+
+stdenv.mkDerivation rec {
   name = "sieve-connect-${version}";
   version = "0.89";
 
@@ -9,7 +11,7 @@
     sha256 = "0g7cv29wd5673inl4c87xb802k86bj6gcwh131xrbbg0a0g1c8fp";
   };
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
   nativeBuildInputs = [ makeWrapper ];
 
   preBuild = ''
@@ -20,7 +22,7 @@
     echo "$(date +%Y-%m-%d)" > datefile
   '';
 
-  buildFlags = [ "PERL5LIB=${stdenv.lib.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
+  buildFlags = [ "PERL5LIB=${perlPackages.makePerlPath [ perlPackages.FileSlurp ]}" "bin" "man" ];
 
   installPhase = ''
     mkdir -p $out/bin $out/share/man/man1
@@ -28,9 +30,9 @@
     gzip -c sieve-connect.1 > $out/share/man/man1/sieve-connect.1.gz
 
     wrapProgram $out/bin/sieve-connect \
-      --prefix PERL5LIB : "${stdenv.lib.makePerlPath (with perlPackages; [
-        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS PodUsage
-        TermReadKey TermReadLineGnu ])}"
+      --prefix PERL5LIB : "${with perlPackages; makePerlPath [
+        AuthenSASL Socket6 IOSocketInet6 IOSocketSSL NetSSLeay NetDNS
+        TermReadKey TermReadLineGnu ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/tsung/default.nix b/pkgs/applications/networking/tsung/default.nix
index 0ee6d45e369a..050c8502e077 100644
--- a/pkgs/applications/networking/tsung/default.nix
+++ b/pkgs/applications/networking/tsung/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, stdenv, lib, makeWrapper,
   erlang,
   python2, python2Packages,
-  perl, perlPackages,
+  perlPackages,
   gnuplot }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [
     erlang
     gnuplot
-    perl
+    perlPackages.perl
     perlPackages.TemplateToolkit
     python2
     python2Packages.matplotlib
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     # Add Template Toolkit and gnuplot to tsung_stats.pl
     wrapProgram $out/bin/tsung_stats.pl \
         --prefix PATH : ${lib.makeBinPath [ gnuplot ]} \
-        --set PERL5LIB "${lib.makePerlPath [ perlPackages.TemplateToolkit ]}"
+        --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.TemplateToolkit ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index aa9317d2ffd6..9c4c22dabe97 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -112,7 +112,6 @@ stdenv.mkDerivation {
     patchelf --set-interpreter $interpreter \
              --set-rpath ${stdenv.lib.makeLibraryPath deps}:$out/lib \
              $out/bin/mendeleydesktop
-    paxmark m $out/bin/mendeleydesktop
 
     wrapProgram $out/bin/mendeleydesktop \
       --add-flags "--unix-distro-build" \
diff --git a/pkgs/applications/science/biology/N3/default.nix b/pkgs/applications/science/biology/N3/default.nix
index 3502ac3e51b7..d2dbcf185330 100644
--- a/pkgs/applications/science/biology/N3/default.nix
+++ b/pkgs/applications/science/biology/N3/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, MNI-Perllib, GetoptTabular,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl MNI-Perllib GetoptTabular ];
+  propagatedBuildInputs = with perlPackages; [ perl MNI-Perllib GetoptTabular ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/conglomerate/default.nix b/pkgs/applications/science/biology/conglomerate/default.nix
index c04bc84c156d..23182fcadc6b 100644
--- a/pkgs/applications/science/biology/conglomerate/default.nix
+++ b/pkgs/applications/science/biology/conglomerate/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchFromGitHub, cmake, coreutils, perl, bicpl, libminc, zlib, minc_tools,
-  makeWrapper, GetoptTabular, MNI-Perllib }:
+{ stdenv, fetchFromGitHub, cmake, coreutils, perlPackages, bicpl, libminc, zlib, minc_tools,
+  makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "conglomerate";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc zlib bicpl ];
-  propagatedBuildInputs = [ coreutils minc_tools perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = [ coreutils minc_tools ] ++ (with perlPackages; [ perl GetoptTabular MNI-Perllib ]);
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBICPL_DIR=${bicpl}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/inormalize/default.nix b/pkgs/applications/science/biology/inormalize/default.nix
index 7ba054a592ea..9e63b92b24ed 100644
--- a/pkgs/applications/science/biology/inormalize/default.nix
+++ b/pkgs/applications/science/biology/inormalize/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, EBTKS }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc EBTKS ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DEBTKS_DIR=${EBTKS}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/minc-tools/default.nix b/pkgs/applications/science/biology/minc-tools/default.nix
index c680eda95d2f..033f78609e9a 100644
--- a/pkgs/applications/science/biology/minc-tools/default.nix
+++ b/pkgs/applications/science/biology/minc-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perl, TextFormat, libminc, libjpeg, zlib }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perlPackages, libminc, libjpeg, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "minc-tools";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake flex bison makeWrapper ];
   buildInputs = [ libminc libjpeg zlib ];
-  propagatedBuildInputs = [ perl TextFormat ];
+  propagatedBuildInputs = with perlPackages; [ perl TextFormat ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" ];
 
diff --git a/pkgs/applications/science/biology/minc-widgets/default.nix b/pkgs/applications/science/biology/minc-widgets/default.nix
index 9084dfb2e1c3..497c39a52a4c 100644
--- a/pkgs/applications/science/biology/minc-widgets/default.nix
+++ b/pkgs/applications/science/biology/minc-widgets/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, makeWrapper,
-  perl, GetoptTabular, MNI-Perllib,
+  perlPackages,
   libminc, octave, coreutils, minc_tools }:
 
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib octave coreutils minc_tools ];
+  propagatedBuildInputs = (with perlPackages; [ perl GetoptTabular MNI-Perllib ]) ++ [ octave coreutils minc_tools ];
 
   postFixup = ''
     for p in $out/bin/*; do
diff --git a/pkgs/applications/science/biology/mni_autoreg/default.nix b/pkgs/applications/science/biology/mni_autoreg/default.nix
index 076ecd03a1b1..5901b696d642 100644
--- a/pkgs/applications/science/biology/mni_autoreg/default.nix
+++ b/pkgs/applications/science/biology/mni_autoreg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, perl, GetoptTabular, MNI-Perllib, libminc }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, perlPackages, libminc }:
 
 stdenv.mkDerivation rec {
   pname = "mni_autoreg";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake makeWrapper ];
   buildInputs = [ libminc ];
-  propagatedBuildInputs = [ perl GetoptTabular MNI-Perllib ];
+  propagatedBuildInputs = with perlPackages; [ perl GetoptTabular MNI-Perllib ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" "-DBUILD_TESTING=FALSE" ];
   # testing broken: './minc_wrapper: Permission denied' from Testing/ellipse0.mnc
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 88704ef281eb..46e88b1e0fc4 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, buildPackages
-, curl, openssl, zlib, expat, perl, python, gettext, cpio
+, curl, openssl, zlib, expat, perlPackages, python, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
 , openssh, pcre2
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
@@ -59,11 +59,11 @@ stdenv.mkDerivation {
         --subst-var-by gettext ${gettext}
   '';
 
-  nativeBuildInputs = [ gettext perl ]
+  nativeBuildInputs = [ gettext perlPackages.perl ]
     ++ stdenv.lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
   buildInputs = [curl openssl zlib expat cpio makeWrapper libiconv]
-    ++ stdenv.lib.optionals perlSupport [ perl ]
+    ++ stdenv.lib.optionals perlSupport [ perlPackages.perl ]
     ++ stdenv.lib.optionals guiSupport [tcl tk]
     ++ stdenv.lib.optionals withpcre2 [ pcre2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.Security ]
@@ -86,7 +86,7 @@ stdenv.mkDerivation {
     "prefix=\${out}"
     "SHELL_PATH=${stdenv.shell}"
   ]
-  ++ (if perlSupport then ["PERL_PATH=${perl}/bin/perl"] else ["NO_PERL=1"])
+  ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
   ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
@@ -133,7 +133,6 @@ stdenv.mkDerivation {
       # Install contrib stuff.
       mkdir -p $out/share/git
       cp -a contrib $out/share/git/
-      ln -s "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/
       mkdir -p $out/share/emacs/site-lisp
       ln -s "$out/share/git/contrib/emacs/"*.el $out/share/emacs/site-lisp/
       mkdir -p $out/etc/bash_completion.d
@@ -153,7 +152,7 @@ stdenv.mkDerivation {
             '${gnugrep}/bin/grep', '${gnused}/bin/sed', '${gawk}/bin/awk',
             '${coreutils}/bin/cut', '${coreutils}/bin/basename', '${coreutils}/bin/dirname',
             '${coreutils}/bin/wc', '${coreutils}/bin/tr'
-            ${stdenv.lib.optionalString perlSupport ", '${perl}/bin/perl'"}
+            ${stdenv.lib.optionalString perlSupport ", '${perlPackages.perl}/bin/perl'"}
           );
         }
         foreach $c (@a) {
@@ -174,47 +173,37 @@ stdenv.mkDerivation {
       mv $out/share/gitweb $gitweb/
 
       # wrap perl commands
-      gitperllib=$out/lib/perl5/site_perl
-      for i in ${builtins.toString perlLibs}; do
-        gitperllib=$gitperllib:$i/lib/perl5/site_perl
-      done
+      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc" $out/bin/git-credential-netrc \
+                  --set PERL5LIB   "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-add--interactive \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-archimport \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-instaweb \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-cvsexportcommit \
-                  --set GITPERLLIB "$gitperllib"
+                  --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
     ''
 
-   + (if svnSupport then
-
-      ''# wrap git-svn
-        gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString perlLibs} ${svn.out}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
-        wrapProgram $out/libexec/git-core/git-svn     \
-                     --set GITPERLLIB "$gitperllib"   \
+   + (if svnSupport then ''
+        # wrap git-svn
+        wrapProgram $out/libexec/git-core/git-svn                                                                                \
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath (perlLibs ++ [svn.out])}" \
                      --prefix PATH : "${svn.out}/bin" ''
        else '' # replace git-svn by notification script
         notSupported $out/libexec/git-core/git-svn
-       '')
-
-   + (if sendEmailSupport then
-      ''# wrap git-send-email
-        gitperllib=$out/lib/perl5/site_perl
-        for i in ${builtins.toString smtpPerlLibs}; do
-          gitperllib=$gitperllib:$i/lib/perl5/site_perl
-        done
+     '')
+
+   + (if sendEmailSupport then ''
+        # wrap git-send-email
         wrapProgram $out/libexec/git-core/git-send-email \
-                     --set GITPERLLIB "$gitperllib" ''
-       else '' # replace git-send-email by notification script
+                     --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath smtpPerlLibs}"
+      '' else ''
+        # replace git-send-email by notification script
         notSupported $out/libexec/git-core/git-send-email
-       '')
+      '')
 
    + stdenv.lib.optionalString withManual ''# Install man pages and Info manual
        make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-info \
@@ -236,9 +225,9 @@ stdenv.mkDerivation {
    + stdenv.lib.optionalString stdenv.isDarwin ''
     # enable git-credential-osxkeychain by default if darwin
     cat > $out/etc/gitconfig << EOF
-[credential]
-	helper = osxkeychain
-EOF
+    [credential]
+      helper = osxkeychain
+    EOF
   '';
 
 
diff --git a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
index ce251e11d328..a98dd5bc5862 100644
--- a/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitweb/default.nix
@@ -24,7 +24,7 @@ in stdenv.mkDerivation {
           $out/gitweb.cgi
       # Give access to CGI.pm and friends (was removed from perl core in 5.22)
       for p in ${stdenv.lib.concatStringsSep " " gitwebPerlLibs}; do
-          sed -i -e "/use CGI /i use lib \"$p/lib/perl5/site_perl\";" \
+          sed -i -e "/use CGI /i use lib \"$p/${perlPackages.perl.libPrefix}\";" \
               "$out/gitweb.cgi"
       done
 
diff --git a/pkgs/applications/version-management/git-and-tools/grv/default.nix b/pkgs/applications/version-management/git-and-tools/grv/default.nix
index dd080799557b..afd187ebb55b 100644
--- a/pkgs/applications/version-management/git-and-tools/grv/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/grv/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2_0_27, ncurses, pkgconfig, readline }:
+{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2, ncurses, pkgconfig, readline }:
 let
   version = "0.3.0";
 in
 buildGo19Package {
   name = "grv-${version}";
 
-  buildInputs = [ ncurses readline curl libgit2_0_27 ];
+  buildInputs = [ ncurses readline curl libgit2 ];
   nativeBuildInputs = [ pkgconfig ];
 
   goPackagePath = "github.com/rgburke/grv";
diff --git a/pkgs/applications/version-management/monotone/default.nix b/pkgs/applications/version-management/monotone/default.nix
index 0606c58c09d5..010d4d2f86ad 100644
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/share/${name}
     cp -rv contrib/ $out/share/${name}/contrib
-    mkdir -p $out/lib/perl5/site_perl/${perlVersion}
-    cp -v contrib/Monotone.pm $out/lib/perl5/site_perl/${perlVersion}
+    mkdir -p $out/${perl.libPrefix}/${perlVersion}
+    cp -v contrib/Monotone.pm $out/${perl.libPrefix}/${perlVersion}
   '';
 
   #doCheck = true; # some tests fail (and they take VERY long)
diff --git a/pkgs/applications/version-management/vcsh/default.nix b/pkgs/applications/version-management/vcsh/default.nix
index 0f0eec7ef9cd..a90eb531fe59 100644
--- a/pkgs/applications/version-management/vcsh/default.nix
+++ b/pkgs/applications/version-management/vcsh/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, which, git, ronn, perl, ShellCommand
-, TestMost, TestDifferences, TestDeep, TestException, TestWarn
-}:
+{ stdenv, fetchFromGitHub, which, git, ronn, perlPackages }:
 
 stdenv.mkDerivation rec {
   version = "1.20170915";       # date of commit we're pulling
@@ -13,10 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1wfzp8167lcq6akdpbi8fikjv0z3h1i5minh3423dljc04q0klm1";
   };
 
-  buildInputs = [
-    which git ronn perl ShellCommand TestMost TestDifferences TestDeep
-    TestException TestWarn
-  ];
+  buildInputs = [ which git ronn ]
+    ++ (with perlPackages; [ perl ShellCommand TestMost TestDifferences TestDeep TestException TestWarn ]);
 
   installPhase = "make install PREFIX=$out";
 
diff --git a/pkgs/applications/video/pitivi/default.nix b/pkgs/applications/video/pitivi/default.nix
index bce8e3981d13..2cd4f19ca939 100644
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, itstool, python3, wrapGAppsHook
 , python3Packages, gst_all_1, gtk3
-, gobject-introspection, librsvg, gnome3, libnotify
+, gobject-introspection, librsvg, gnome3, libnotify, gsound
 , meson, ninja
 }:
 
@@ -47,7 +47,7 @@ in python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [ meson ninja pkgconfig intltool itstool python3 wrapGAppsHook ];
 
   buildInputs = [
-    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gnome3.gsound
+    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gsound
     gnome3.defaultIconTheme
     gnome3.gsettings-desktop-schemas libnotify
     gst-transcoder
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 1cd85cead125..86cf5352d6b6 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -8,7 +8,7 @@
 , seccompSupport ? stdenv.isLinux, libseccomp
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 , sdlSupport ? !stdenv.isDarwin, SDL2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, gnome3
+, gtkSupport ? !stdenv.isDarwin && !xenSupport, gtk3, gettext, vte
 , vncSupport ? true, libjpeg, libpng
 , smartcardSupport ? true, libcacard
 , spiceSupport ? !stdenv.isDarwin, spice, spice-protocol
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     ++ optionals numaSupport [ numactl ]
     ++ optionals pulseSupport [ libpulseaudio ]
     ++ optionals sdlSupport [ SDL2 ]
-    ++ optionals gtkSupport [ gtk3 gettext gnome3.vte ]
+    ++ optionals gtkSupport [ gtk3 gettext vte ]
     ++ optionals vncSupport [ libjpeg libpng ]
     ++ optionals smartcardSupport [ libcacard ]
     ++ optionals spiceSupport [ spice-protocol spice ]
@@ -125,9 +125,6 @@ stdenv.mkDerivation rec {
 
   postFixup =
     ''
-      for exe in $out/bin/qemu-system-* ; do
-        paxmark m $exe
-      done
       # copy qemu-ga (guest agent) to separate output
       mkdir -p $ga/bin
       cp $out/bin/qemu-ga $ga/bin/
diff --git a/pkgs/build-support/writers/default.nix b/pkgs/build-support/writers/default.nix
index ef520f68320a..6e932ce860f6 100644
--- a/pkgs/build-support/writers/default.nix
+++ b/pkgs/build-support/writers/default.nix
@@ -192,12 +192,12 @@ rec {
       name = "perl-environment";
       paths = libraries;
       pathsToLink = [
-        "/lib/perl5/site_perl"
+        "/${pkgs.perl.libPrefix}"
       ];
     };
   in
   makeScriptWriter {
-    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/lib/perl5/site_perl";
+    interpreter = "${pkgs.perl}/bin/perl -I ${perl-env}/${pkgs.perl.libPrefix}";
   } name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index af8270e6eefa..59773e34ccec 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchzip }:
 
 let
-  version = "20180905";
+  version = "20181219";
 in fetchzip {
   name = "iana-etc-${version}";
   url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-  sha256 = "1vl3by24xddl267cjq9bcwb7yvfd7gqalwgd5sgx8i7kz9bk40q2";
+  sha256 = "0i3f7shvf1g6dp984w8xfix6id3q5c10b292wz2qw3v5n7h6wkm3";
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 62a67c11492b..4fe787bc5d4b 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -23,7 +23,7 @@ let
     deepin-shortcut-viewer = callPackage ./deepin-shortcut-viewer { };
     deepin-sound-theme = callPackage ./deepin-sound-theme { };
     deepin-terminal = callPackage ./deepin-terminal {
-      inherit (pkgs.gnome3) libgee vte;
+      inherit (pkgs.gnome3) libgee;
       wnck = pkgs.libwnck3;
     };
     deepin-wallpapers = callPackage ./deepin-wallpapers { };
diff --git a/pkgs/desktops/gnome-3/apps/seahorse/default.nix b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
index 344fb4a5738e..9ef2b57e6d14 100644
--- a/pkgs/desktops/gnome-3/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, vala, meson, ninja
 , pkgconfig, gtk3, glib, gobject-introspection
 , wrapGAppsHook, itstool, gnupg, libsoup
-, gnome3, gpgme, python3, openldap
+, gnome3, gpgme, python3, openldap, gcr
 , libsecret, avahi, p11-kit, openssh }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     python3 gobject-introspection
   ];
   buildInputs = [
-    gtk3 glib gnome3.gcr
+    gtk3 glib gcr
     gnome3.gsettings-desktop-schemas gnupg
     gnome3.defaultIconTheme gpgme
     libsecret avahi libsoup p11-kit
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index c9c8acfecb3b..5efd50a006b0 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, substituteAll, pkgconfig, gnome3, python3, gobject-introspection
-, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3
+, intltool, libsoup, libxml2, libsecret, icu, sqlite, tzdata, libcanberra-gtk3, gcr
 , p11-kit, db, nspr, nss, libical, gperf, wrapGAppsHook, glib-networking, pcre
 , vala, cmake, ninja, kerberos, openldap, webkitgtk, libaccounts-glib, json-glib }:
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
index ff4263f74e3b..ec6d1af015a5 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell-extensions/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, meson, ninja, gettext, pkgconfig, spidermonkey_52, glib
-, gnome3, substituteAll }:
+, gnome3, gnome-menus, substituteAll }:
 
 stdenv.mkDerivation rec {
   name = "gnome-shell-extensions-${version}";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   patches = [
     (substituteAll {
       src = ./fix_gmenu.patch;
-      gmenu_path = "${gnome3.gnome-menus}/lib/girepository-1.0";
+      gmenu_path = "${gnome-menus}/lib/girepository-1.0";
     })
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index c1d5a5a916b7..76e5bd13522e 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -2,8 +2,8 @@
 , python3Packages, libsoup, polkit, clutter, networkmanager, docbook_xsl , docbook_xsl_ns, at-spi2-core
 , libstartup_notification, telepathy-glib, telepathy-logger, libXtst, unzip, glibcLocales, shared-mime-info
 , libgweather, libcanberra-gtk3, librsvg, geoclue2, perl, docbook_xml_dtd_42, desktop-file-utils
-, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt
-, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet
+, libpulseaudio, libical, gobject-introspection, gstreamer, wrapGAppsHook, libxslt, gcr
+, accountsservice, gdk_pixbuf, gdm, upower, ibus, networkmanagerapplet, libgnomekbd
 , sassc, systemd, gst_all_1 }:
 
 # http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/gnome-base/gnome-shell/gnome-shell-3.10.2.1.ebuild?revision=1.3&view=markup
@@ -56,8 +56,7 @@ in stdenv.mkDerivation rec {
     })
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit (gnome3) libgnomekbd;
-      inherit unzip;
+      inherit libgnomekbd unzip;
     })
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix b/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
index 124db9272363..ab2ead7d3449 100644
--- a/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo-plugins/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, sqlite
 , gnome3, libxml2, gupnp, gssdp, lua5, liboauth, gupnp-av
-, gmime, json-glib, avahi, tracker, dleyna-server, itstool }:
+, gmime, json-glib, avahi, tracker, dleyna-server, itstool, totem-pl-parser }:
 
 let
   pname = "grilo-plugins";
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     gnome3.grilo libxml2 gupnp gssdp gnome3.libgdata
     lua5 liboauth gupnp-av sqlite gnome3.gnome-online-accounts
-    gnome3.totem-pl-parser gnome3.rest gmime json-glib
+    totem-pl-parser gnome3.rest gmime json-glib
     avahi gnome3.libmediaart tracker dleyna-server
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/grilo/default.nix b/pkgs/desktops/gnome-3/core/grilo/default.nix
index acde7a385727..a2bee6ac41ee 100644
--- a/pkgs/desktops/gnome-3/core/grilo/default.nix
+++ b/pkgs/desktops/gnome-3/core/grilo/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, vala, glib, liboauth, gtk3
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43
-, libxml2, gnome3, gobject-introspection, libsoup }:
+, libxml2, gnome3, gobject-introspection, libsoup, totem-pl-parser }:
 
 let
   pname = "grilo";
@@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {
     meson ninja pkgconfig gettext gobject-introspection vala
     gtk-doc docbook_xsl docbook_xml_dtd_43
   ];
-  buildInputs = [ glib liboauth gtk3 libxml2 libsoup gnome3.totem-pl-parser ];
+  buildInputs = [ glib liboauth gtk3 libxml2 libsoup totem-pl-parser ];
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/gnome-3/core/totem/default.nix b/pkgs/desktops/gnome-3/core/totem/default.nix
index 3b7015919141..3565931e4df1 100644
--- a/pkgs/desktops/gnome-3/core/totem/default.nix
+++ b/pkgs/desktops/gnome-3/core/totem/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, meson, ninja, intltool, gst_all_1
 , clutter-gtk, clutter-gst, python3Packages, shared-mime-info
-, pkgconfig, gtk3, glib, gobject-introspection
+, pkgconfig, gtk3, glib, gobject-introspection, totem-pl-parser
 , wrapGAppsHook, itstool, libxml2, vala, gnome3
 , gdk_pixbuf, tracker, nautilus }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja vala pkgconfig intltool python3Packages.python itstool gobject-introspection wrapGAppsHook ];
   buildInputs = [
-    gtk3 glib gnome3.grilo clutter-gtk clutter-gst gnome3.totem-pl-parser gnome3.grilo-plugins
+    gtk3 glib gnome3.grilo clutter-gtk clutter-gst totem-pl-parser gnome3.grilo-plugins
     gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly gst_all_1.gst-libav gnome3.libpeas shared-mime-info
     gdk_pixbuf libxml2 gnome3.defaultIconTheme gnome3.gnome-desktop
diff --git a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
index 5e57a22906c8..7127ab71b1fc 100644
--- a/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
+++ b/pkgs/desktops/gnome-3/core/tracker-miners/default.nix
@@ -2,7 +2,7 @@
 , meson, ninja, pkgconfig, vala, wrapGAppsHook, bzip2, dbus, evolution-data-server
 , exempi, flac, giflib, glib, gnome3, gst_all_1, icu, json-glib, libcue, libexif
 , libgrss, libgsf, libiptcdata, libjpeg, libpng, libseccomp, libsoup, libtiff, libuuid
-, libvorbis, libxml2, poppler, taglib, upower }:
+, libvorbis, libxml2, poppler, taglib, upower, totem-pl-parser }:
 
 let
   pname = "tracker-miners";
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
     giflib
     glib
     gnome3.gexiv2
-    gnome3.totem-pl-parser
+    totem-pl-parser
     gnome3.tracker
     gst_all_1.gst-plugins-base
     gst_all_1.gstreamer
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index 6bf0c5add1fd..e79ca7c3af86 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -38,7 +38,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   inherit (pkgs) atk glib gobject-introspection gspell webkitgtk gtk3 gtkmm3
     libgtop libgudev libhttpseverywhere librsvg libsecret gdk_pixbuf gtksourceview gtksourceviewmm gtksourceview4
     easytag meld orca rhythmbox shotwell gnome-usage
-    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda;
+    clutter clutter-gst clutter-gtk cogl gtk-vnc libdazzle libgda libgit2-glib libgxps libgdata libgepub libcroco libpeas libgee geocode-glib libgweather librest libzapojit libmediaart gfbgraph gexiv2 folks totem-pl-parser gcr gsound libgnomekbd vte vte_290 vte-ng gnome-menus;
 
   libsoup = pkgs.libsoup.override { gnomeSupport = true; };
   libchamplain = pkgs.libchamplain.override { libsoup = libsoup; };
@@ -47,6 +47,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   gtkmm = gtkmm3;
   vala = pkgs.vala_0_42;
   gegl_0_4 = pkgs.gegl_0_4.override { inherit gtk; };
+  rest = librest;
 
 # Simplify the nixos module and gnome packages
   defaultIconTheme = adwaita-icon-theme;
@@ -73,10 +74,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   evolution-data-server = callPackage ./core/evolution-data-server { };
 
-  geocode-glib = callPackage ./core/geocode-glib { };
-
-  gcr = callPackage ./core/gcr { }; # ToDo: tests fail
-
   gdm = callPackage ./core/gdm { };
 
   gjs = callPackage ./core/gjs { };
@@ -107,16 +104,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-font-viewer = callPackage ./core/gnome-font-viewer { };
 
-  gnome-menus = callPackage ./core/gnome-menus { };
-
   gnome-keyring = callPackage ./core/gnome-keyring { };
 
   libgnome-keyring = callPackage ./core/libgnome-keyring { };
 
-  libgnomekbd = callPackage ./core/libgnomekbd { };
-
-  folks = callPackage ./core/folks { };
-
   gnome-online-accounts = callPackage ./core/gnome-online-accounts { };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
@@ -153,30 +144,12 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gsettings-desktop-schemas = callPackage ./core/gsettings-desktop-schemas { };
 
-  gsound = callPackage ./core/gsound { };
-
   gucharmap = callPackage ./core/gucharmap { };
 
   gvfs = pkgs.gvfs.override { gnome = gnome3; gnomeSupport = true; };
 
   eog = callPackage ./core/eog { };
 
-  libcroco = callPackage ./core/libcroco {};
-
-  libgee = callPackage ./core/libgee { };
-
-  libgepub = callPackage ./core/libgepub { };
-
-  libgdata = callPackage ./core/libgdata { };
-
-  libgxps = callPackage ./core/libgxps { };
-
-  libpeas = callPackage ./core/libpeas {};
-
-  libgweather = callPackage ./core/libgweather { };
-
-  libzapojit = callPackage ./core/libzapojit { };
-
   mutter = callPackage ./core/mutter { };
 
   # Needed for elementary's gala and greeter until they get around to adapting to all the API breaking changes in libmutter-3
@@ -214,8 +187,6 @@ lib.makeScope pkgs.newScope (self: with self; {
     withGnome = true;
   };
 
-  rest = callPackage ./core/rest { };
-
   rygel = callPackage ./core/rygel { };
 
   simple-scan = callPackage ./core/simple-scan { };
@@ -224,18 +195,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   totem = callPackage ./core/totem { };
 
-  totem-pl-parser = callPackage ./core/totem-pl-parser { };
-
   tracker = callPackage ./core/tracker { };
 
   tracker-miners = callPackage ./core/tracker-miners { };
 
-  vte = callPackage ./core/vte { };
-
-  vte_290 = callPackage ./core/vte/2.90.nix { };
-
-  vte-ng = callPackage ./core/vte/ng.nix { };
-
   vino = callPackage ./core/vino { };
 
   yelp = callPackage ./core/yelp { };
@@ -361,18 +324,10 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   geary = callPackage ./misc/geary { };
 
-  gfbgraph = callPackage ./misc/gfbgraph { };
-
   gitg = callPackage ./misc/gitg { };
 
   libgnome-games-support = callPackage ./misc/libgnome-games-support { };
 
-  libgit2-glib = callPackage ./misc/libgit2-glib { };
-
-  libmediaart = callPackage ./misc/libmediaart { };
-
-  gexiv2 = callPackage ./misc/gexiv2 { };
-
   gnome-applets = callPackage ./misc/gnome-applets { };
 
   gnome-flashback = callPackage ./misc/gnome-flashback { };
diff --git a/pkgs/desktops/gnome-3/misc/geary/default.nix b/pkgs/desktops/gnome-3/misc/geary/default.nix
index 7bb54904fb0f..0841fa13a73f 100644
--- a/pkgs/desktops/gnome-3/misc/geary/default.nix
+++ b/pkgs/desktops/gnome-3/misc/geary/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, intltool, pkgconfig, gtk3, vala_0_40, enchant
 , wrapGAppsHook, gdk_pixbuf, cmake, ninja, desktop-file-utils
 , libnotify, libcanberra-gtk3, libsecret, gmime, isocodes
-, gobject-introspection, libpthreadstubs, sqlite
+, gobject-introspection, libpthreadstubs, sqlite, gcr
 , gnome3, librsvg, gnome-doc-utils, webkitgtk, fetchpatch }:
 
 let
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ vala_0_40 intltool pkgconfig wrapGAppsHook cmake ninja desktop-file-utils gnome-doc-utils gobject-introspection ];
   buildInputs = [
     gtk3 enchant webkitgtk libnotify libcanberra-gtk3 gnome3.libgee libsecret gmime sqlite
-    libpthreadstubs gnome3.gsettings-desktop-schemas gnome3.gcr isocodes
+    libpthreadstubs gnome3.gsettings-desktop-schemas gcr isocodes
     gdk_pixbuf librsvg gnome3.defaultIconTheme
   ];
 
diff --git a/pkgs/desktops/gnome-3/misc/gitg/default.nix b/pkgs/desktops/gnome-3/misc/gitg/default.nix
index b424a8a79697..a447d2aa5903 100644
--- a/pkgs/desktops/gnome-3/misc/gitg/default.nix
+++ b/pkgs/desktops/gnome-3/misc/gitg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, vala, intltool, pkgconfig, gtk3, glib
+{ stdenv, fetchurl, fetchpatch, vala, intltool, pkgconfig, gtk3, glib
 , json-glib, wrapGAppsHook, libpeas, bash, gobject-introspection
 , gnome3, gtkspell3, shared-mime-info, libgee, libgit2-glib, libsecret
 , meson, ninja, python3
@@ -15,6 +15,13 @@ in stdenv.mkDerivation rec {
     sha256 = "1fz8q1aiql6k740savdjh0vzbyhcflgf94cfdhvzcrrvm929n2ss";
   };
 
+  patches = [
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gitg/commit/42bceea265f53fe7fd4a41037b936deed975fc6c.patch;
+      sha256 = "1xq245rsi1bi66lswk33pdiazfaagxf77836ds5q73900rx4r7fw";
+    })
+  ];
+
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
diff --git a/pkgs/desktops/mate/mate-terminal/default.nix b/pkgs/desktops/mate/mate-terminal/default.nix
index a2f35284f4e3..ce8f58cc99b2 100644
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, wrapGAppsHook }:
+{ stdenv, fetchurl, pkgconfig, intltool, glib, itstool, libxml2, mate, gnome3, gtk3, vte, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "mate-terminal-${version}";
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
      mate.mate-desktop
 
-     gnome3.vte
-     gnome3.gtk
+     vte
+     gtk3
      gnome3.dconf
   ];
 
diff --git a/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix b/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
index 95d371959e53..d6bc8f5330b0 100644
--- a/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/pantheon-terminal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
+{ stdenv, fetchurl, perl, cmake, vala_0_38, pkgconfig, glib, gtk3, granite, gnome3, vte_290, libnotify, gettext, wrapGAppsHook, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   majorVersion = "0.4";
diff --git a/pkgs/desktops/xfce4-13/default.nix b/pkgs/desktops/xfce4-13/default.nix
index 4809cec839ad..d3e46cf23654 100644
--- a/pkgs/desktops/xfce4-13/default.nix
+++ b/pkgs/desktops/xfce4-13/default.nix
@@ -81,9 +81,7 @@ makeScope newScope (self: with self; {
 
   xfce4-taskmanager = callPackage ./xfce4-taskmanager { };
 
-  xfce4-terminal = callPackage ./xfce4-terminal {
-    inherit (gnome3) vte;
-  };
+  xfce4-terminal = callPackage ./xfce4-terminal { };
 
   xfce4-volumed-pulse = callPackage ./xfce4-volumed-pulse { };
 
diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
index eb614b0784f9..531cf3a80517 100644
--- a/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix
@@ -61,14 +61,6 @@ let result = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    # Set PaX markings
-    exes=$(file $sourceRoot/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file"
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''}
-    done
-
     mv $sourceRoot $out
 
     rm -rf $out/demo
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 75e70006d749..07a003691d6b 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -282,11 +282,6 @@ postInstall() {
         fi
     done
 
-    # Disable RANDMMAP on grsec, which causes segfaults when using
-    # precompiled headers.
-    # See https://bugs.gentoo.org/show_bug.cgi?id=301299#c31
-    paxmark r $out/libexec/gcc/*/*/{cc1,cc1plus}
-
     # Two identical man pages are shipped (moving and compressing is done later)
     ln -sf gcc.1 "$out"/share/man/man1/g++.1
 }
diff --git a/pkgs/development/compilers/ghc/8.2.2-binary.nix b/pkgs/development/compilers/ghc/8.2.2-binary.nix
index 039eea744f36..f52d8fd4a11f 100644
--- a/pkgs/development/compilers/ghc/8.2.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.2.2-binary.nix
@@ -105,8 +105,6 @@ stdenv.mkDerivation rec {
           --replace-needed libtinfo.so libtinfo.so.5 \
           --interpreter ${glibcDynLinker} {} \;
 
-      paxmark m ./ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
-
       sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
       sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
     '';
diff --git a/pkgs/development/compilers/ghc/8.2.2.nix b/pkgs/development/compilers/ghc/8.2.2.nix
index 3b9fecd55e10..3e355dc302d6 100644
--- a/pkgs/development/compilers/ghc/8.2.2.nix
+++ b/pkgs/development/compilers/ghc/8.2.2.nix
@@ -238,11 +238,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.4.4.nix b/pkgs/development/compilers/ghc/8.4.4.nix
index 4db5c07b4601..c5fe3c925f00 100644
--- a/pkgs/development/compilers/ghc/8.4.4.nix
+++ b/pkgs/development/compilers/ghc/8.4.4.nix
@@ -214,11 +214,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.1.nix b/pkgs/development/compilers/ghc/8.6.1.nix
index 5710c60338a8..b54164ccc696 100644
--- a/pkgs/development/compilers/ghc/8.6.1.nix
+++ b/pkgs/development/compilers/ghc/8.6.1.nix
@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.2.nix b/pkgs/development/compilers/ghc/8.6.2.nix
index 914d6ae08fac..07d4420804dd 100644
--- a/pkgs/development/compilers/ghc/8.6.2.nix
+++ b/pkgs/development/compilers/ghc/8.6.2.nix
@@ -195,11 +195,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/8.6.3.nix b/pkgs/development/compilers/ghc/8.6.3.nix
index b29b7facd1f4..4e1f0dd9fc72 100644
--- a/pkgs/development/compilers/ghc/8.6.3.nix
+++ b/pkgs/development/compilers/ghc/8.6.3.nix
@@ -192,11 +192,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 42119682892d..65a4a0c4ecdb 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -177,11 +177,6 @@ stdenv.mkDerivation (rec {
   hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
 
   postInstall = ''
-    for bin in "$out"/lib/${name}/bin/*; do
-      isELF "$bin" || continue
-      paxmark m "$bin"
-    done
-
     # Install the bash completion file.
     install -D -m 444 utils/completion/ghc.bash $out/share/bash-completion/completions/${targetPrefix}ghc
 
diff --git a/pkgs/development/compilers/go/1.10.nix b/pkgs/development/compilers/go/1.10.nix
index 832c020c40de..92a9291222f5 100644
--- a/pkgs/development/compilers/go/1.10.nix
+++ b/pkgs/development/compilers/go/1.10.nix
@@ -22,13 +22,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.10.3";
+  version = "1.10.7";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "0i89298dgnmpmam3ifkm0ax266vvbq1yz7wfw8wwrcma0szrbrnb";
+    sha256 = "1alc7dagijdg4p4hhvlznlgcxsl8gz94v7p9wk3kn303y782dl41";
   };
 
   GOCACHE = "off";
diff --git a/pkgs/development/compilers/go/1.11.nix b/pkgs/development/compilers/go/1.11.nix
index 5d4a8e84265f..ab4c7e6ae63e 100644
--- a/pkgs/development/compilers/go/1.11.nix
+++ b/pkgs/development/compilers/go/1.11.nix
@@ -28,13 +28,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.11.2";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "0pk7pxfm3ij2ksdrg49jz501fr1d103zr4mjjwv821if9g279jc9";
+    sha256 = "036nc17hffy0gcfs9j64qzwpjry65znbm4klf2h0xn81dp8d6mxk";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 39fab8b25d8f..876e474bed97 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -25,11 +25,6 @@ let drv = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    exes=$(file $sourceRoot/bin/* $sourceRoot/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file"
-    done
-
     mv $sourceRoot $out
     jrePath=$out/jre
   '';
diff --git a/pkgs/development/compilers/julia/0004-hardened.patch b/pkgs/development/compilers/julia/0004-hardened.patch
deleted file mode 100644
index 901f967c9d55..000000000000
--- a/pkgs/development/compilers/julia/0004-hardened.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From eddb251a00ace6e63e32e7dcb9e1ec632cac14e0 Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Wed, 1 Feb 2017 06:09:49 -0600
-Subject: [PATCH] Set pax flags on julia binaries to disable memory protection.
-
----
- Makefile | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/Makefile b/Makefile
-index 0e28cc87b..aab8cfa8d 100644
---- a/Makefile
-+++ b/Makefile
-@@ -91,6 +91,8 @@ julia-src-release julia-src-debug : julia-src-% : julia-deps julia_flisp.boot.in
- 
- julia-ui-release julia-ui-debug : julia-ui-% : julia-src-%
- 	@$(MAKE) $(QUIET_MAKE) -C $(BUILDROOT)/ui julia-$*
-+	@echo "setting PaX flags on $(JULIA_EXECUTABLE_$*)"
-+	@paxctl -czexm $(JULIA_EXECUTABLE_$*)
- 
- julia-inference : julia-base julia-ui-$(JULIA_BUILD_MODE) $(build_prefix)/.examples
- 	@$(MAKE) $(QUIET_MAKE) -C $(BUILDROOT) $(build_private_libdir)/inference.ji JULIA_BUILD_MODE=$(JULIA_BUILD_MODE)
--- 
-2.11.0
-
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 086570f5ce20..4c0b1359bd8d 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2, paxctl
+, gfortran, m4, makeWrapper, patchelf, perl, which, python2
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
 , llvm
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   patches = [
     ./0001.1-use-system-utf8proc.patch
     ./0002-use-system-suitesparse.patch
-  ] ++ stdenv.lib.optional stdenv.needsPax ./0004-hardened.patch;
+  ];
 
   postPatch = ''
     patchShebangs . contrib
@@ -96,8 +96,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
   ;
 
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ]
-    ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ];
 
   makeFlags =
     let
diff --git a/pkgs/development/compilers/julia/shared.nix b/pkgs/development/compilers/julia/shared.nix
index 70ff40cd7ec5..95b45adcc6fc 100644
--- a/pkgs/development/compilers/julia/shared.nix
+++ b/pkgs/development/compilers/julia/shared.nix
@@ -5,7 +5,7 @@
 }:
 { stdenv, fetchurl, fetchzip
 # build tools
-, gfortran, m4, makeWrapper, patchelf, perl, which, python2, paxctl
+, gfortran, m4, makeWrapper, patchelf, perl, which, python2
 , llvm, cmake
 # libjulia dependencies
 , libunwind, readline, utf8proc, zlib
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001.1-use-system-utf8proc.patch
-  ] ++ stdenv.lib.optional stdenv.needsPax ./0004-hardened.patch;
+  ];
 
   postPatch = ''
     patchShebangs . contrib
@@ -117,8 +117,7 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optionals stdenv.isDarwin [CoreServices ApplicationServices]
   ;
 
-  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ]
-    ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  nativeBuildInputs = [ curl gfortran m4 makeWrapper patchelf perl python2 which ];
 
   makeFlags =
     let
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
index 388da007d33d..2645469767ad 100644
--- a/pkgs/development/compilers/llvm/3.5/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -81,12 +81,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-
-    paxmark m unittests/ExecutionEngine/JIT/JITTests
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/Support/SupportTests
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/3.7/llvm.nix b/pkgs/development/compilers/llvm/3.7/llvm.nix
index e540469c6278..a6fd18f94d68 100644
--- a/pkgs/development/compilers/llvm/3.7/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.7/llvm.nix
@@ -89,8 +89,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/llvm/3.8/llvm.nix b/pkgs/development/compilers/llvm/3.8/llvm.nix
index d7324665240f..fcb4214a1de8 100644
--- a/pkgs/development/compilers/llvm/3.8/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.8/llvm.nix
@@ -49,7 +49,7 @@ in stdenv.mkDerivation rec {
     sed -i 's/os_trace(\(.*\)");$/printf(\1\\n");/g' ./projects/compiler-rt/lib/sanitizer_common/sanitizer_mac.cc
 
     substituteInPlace CMakeLists.txt \
-      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$out/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   ''
   + ''
@@ -97,8 +97,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   postInstall = stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
diff --git a/pkgs/development/compilers/llvm/3.9/llvm.nix b/pkgs/development/compilers/llvm/3.9/llvm.nix
index 9e7fbbe96c35..00c56e49e374 100644
--- a/pkgs/development/compilers/llvm/3.9/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.9/llvm.nix
@@ -82,7 +82,7 @@ in stdenv.mkDerivation rec {
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
 
     substituteInPlace CMakeLists.txt \
-      --replace 'set(CMAKE_INSTALL_NAME_DIR "@rpath")' "set(CMAKE_INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(CMAKE_INSTALL_RPATH "@executable_path/../lib")' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
@@ -141,8 +141,6 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
   '';
 
   postInstall = ""
diff --git a/pkgs/development/compilers/llvm/4/lldb.nix b/pkgs/development/compilers/llvm/4/lldb.nix
index 325149fc19be..0be8a4d41865 100644
--- a/pkgs/development/compilers/llvm/4/lldb.nix
+++ b/pkgs/development/compilers/llvm/4/lldb.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/4/llvm.nix b/pkgs/development/compilers/llvm/4/llvm.nix
index 1b186c730c06..aac9c4275ad4 100644
--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@@ -53,7 +53,7 @@ in stdenv.mkDerivation (rec {
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
 
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
@@ -121,12 +121,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb.nix
index 5e670d4de159..7be9a7e47b74 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/5/llvm.nix b/pkgs/development/compilers/llvm/5/llvm.nix
index ae4b27441593..9e181a1202ba 100644
--- a/pkgs/development/compilers/llvm/5/llvm.nix
+++ b/pkgs/development/compilers/llvm/5/llvm.nix
@@ -42,7 +42,7 @@ in stdenv.mkDerivation (rec {
 
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
@@ -98,12 +98,6 @@ in stdenv.mkDerivation (rec {
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb.nix
index 9571e7ab5a63..d33de2488350 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 787a48416ab7..54617a075734 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -9,18 +9,28 @@
 , version
 , release_version
 , zlib
+, buildPackages
+, fetchpatch
 , debugVersion ? false
 , enableManpages ? false
+# Mesa requires AMDGPU target
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform "AMDGPU" ]
 , enableSharedLibraries ? true
-, enableWasm ? true
 }:
 
 let
+  inherit (stdenv.lib) optional optionals optionalString;
+
   src = fetch "llvm" "1qpls3vk85lydi5b4axl0809fv932qgsqgdgrk098567z4jc7mmn";
 
   # Used when creating a version-suffixed symlink of libLLVM.dylib
   shortVersion = with stdenv.lib;
     concatStringsSep "." (take 2 (splitString "." release_version));
+
+  inherit
+    (import ../common.nix { inherit (stdenv) lib; })
+    llvmBackendList;
+
 in stdenv.mkDerivation (rec {
   name = "llvm-${version}";
 
@@ -31,22 +41,30 @@ in stdenv.mkDerivation (rec {
   '';
 
   outputs = [ "out" "python" ]
-    ++ stdenv.lib.optional enableSharedLibraries "lib";
+    ++ optional enableSharedLibraries "lib";
 
   nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    ++ optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  patches = [
+    # fixes tests, included in llvm_7
+    (fetchpatch {
+      url = "https://github.com/llvm-mirror/llvm/commit/737553be0c9c25c497b45a241689994f177d5a5d.patch";
+      sha256 = "0hnaxnkx7zy5yg98f1ggv8a9l0r6g19n6ygqsv26masrnlcbccli";
+    })
+  ];
+
+  postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + stdenv.lib.optionalString (enableSharedLibraries) ''
+  + optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
   '' + ''
@@ -54,7 +72,7 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+  '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
@@ -73,40 +91,31 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_ENABLE_RTTI=ON"
-
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
-
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
+    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList enableTargets}"
+    "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ]
-  ++ stdenv.lib.optional enableSharedLibraries
+  ] ++ optionals enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
-  ++ stdenv.lib.optionals enableManpages [
+  ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ stdenv.lib.optional (!isDarwin)
+  ] ++ optionals (!isDarwin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ stdenv.lib.optionals (isDarwin) [
+  ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ]
-  ++ stdenv.lib.optional enableWasm
-   "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
-  ;
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_6}/bin/llvm-tblgen"
+  ];
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
@@ -117,13 +126,13 @@ in stdenv.mkDerivation (rec {
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
   ''
-  + stdenv.lib.optionalString enableSharedLibraries ''
+  + optionalString enableSharedLibraries ''
     moveToOutput "lib/libLLVM-*" "$lib"
     moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
   ''
-  + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index 6c3f0699978f..809e992ac586 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 67bde813feed..a852822cddc4 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -10,19 +10,27 @@
 , version
 , release_version
 , zlib
+, buildPackages
 , debugVersion ? false
 , enableManpages ? false
 , enableSharedLibraries ? true
-, enableWasm ? true
+# Mesa requires AMDGPU target
+, enableTargets ? [ stdenv.hostPlatform stdenv.targetPlatform "AMDGPU" ]
 , enablePFM ? !stdenv.isDarwin
 }:
 
 let
+  inherit (stdenv.lib) optional optionals optionalString;
+
   src = fetch "llvm" "08p27wv1pr9ql2zc3f3qkkymci46q7myvh8r5ijippnbwr2gihcb";
 
   # Used when creating a version-suffixed symlink of libLLVM.dylib
   shortVersion = with stdenv.lib;
     concatStringsSep "." (take 1 (splitString "." release_version));
+
+  inherit
+    (import ../common.nix { inherit (stdenv) lib; })
+    llvmBackendList;
 in stdenv.mkDerivation (rec {
   name = "llvm-${version}";
 
@@ -33,23 +41,23 @@ in stdenv.mkDerivation (rec {
   '';
 
   outputs = [ "out" "python" ]
-    ++ stdenv.lib.optional enableSharedLibraries "lib";
+    ++ optional enableSharedLibraries "lib";
 
   nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    ++ optional enableManpages python.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ]
-    ++ stdenv.lib.optional enablePFM libpfm; # exegesis
+    ++ optional enablePFM libpfm; # exegesis
 
   propagatedBuildInputs = [ ncurses zlib ];
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = optionalString stdenv.isDarwin ''
     substituteInPlace cmake/modules/AddLLVM.cmake \
-      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir INSTALL_NAME_DIR "$lib/lib")" \
+      --replace 'set(_install_name_dir INSTALL_NAME_DIR "@rpath")' "set(_install_name_dir)" \
       --replace 'set(_install_rpath "@loader_path/../lib" ''${extra_libdir})' ""
   ''
   # Patch llvm-config to return correct library path based on --link-{shared,static}.
-  + stdenv.lib.optionalString (enableSharedLibraries) ''
+  + optionalString (enableSharedLibraries) ''
     substitute '${./llvm-outputs.patch}' ./llvm-outputs.patch --subst-var lib
     patch -p1 < ./llvm-outputs.patch
   '' + ''
@@ -57,7 +65,7 @@ in stdenv.mkDerivation (rec {
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
-  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+  '' + optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -i ${../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
@@ -78,40 +86,31 @@ in stdenv.mkDerivation (rec {
     "-DLLVM_BUILD_TESTS=ON"
     "-DLLVM_ENABLE_FFI=ON"
     "-DLLVM_ENABLE_RTTI=ON"
-
     "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
-    "-DTARGET_TRIPLE=${stdenv.hostPlatform.config}"
-
+    "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.targetPlatform.config}"
+    "-DLLVM_TARGETS_TO_BUILD=${llvmBackendList enableTargets}"
+    "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
     "-DLLVM_ENABLE_DUMP=ON"
-  ]
-  ++ stdenv.lib.optional enableSharedLibraries
+  ] ++ optionals enableSharedLibraries [
     "-DLLVM_LINK_LLVM_DYLIB=ON"
-  ++ stdenv.lib.optionals enableManpages [
+  ] ++ optionals enableManpages [
     "-DLLVM_BUILD_DOCS=ON"
     "-DLLVM_ENABLE_SPHINX=ON"
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ]
-  ++ stdenv.lib.optional (!isDarwin)
+  ] ++ optionals (!isDarwin) [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
-  ++ stdenv.lib.optionals (isDarwin) [
+  ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ]
-  ++ stdenv.lib.optional enableWasm
-   "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
-  ;
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-DCMAKE_CROSSCOMPILING=True"
+    "-DLLVM_TABLEGEN=${buildPackages.llvm_7}/bin/llvm-tblgen"
+  ];
 
   postBuild = ''
     rm -fR $out
-
-    paxmark m bin/{lli,llvm-rtdyld}
-    paxmark m unittests/ExecutionEngine/MCJIT/MCJITTests
-    paxmark m unittests/ExecutionEngine/Orc/OrcJITTests
-    paxmark m unittests/Support/SupportTests
-    paxmark m bin/lli-child-target
   '';
 
   preCheck = ''
@@ -122,13 +121,13 @@ in stdenv.mkDerivation (rec {
     mkdir -p $python/share
     mv $out/share/opt-viewer $python/share/opt-viewer
   ''
-  + stdenv.lib.optionalString enableSharedLibraries ''
+  + optionalString enableSharedLibraries ''
     moveToOutput "lib/libLLVM-*" "$lib"
     moveToOutput "lib/libLLVM${stdenv.hostPlatform.extensions.sharedLibrary}" "$lib"
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM-" "$lib/lib/libLLVM-"
   ''
-  + stdenv.lib.optionalString (stdenv.isDarwin && enableSharedLibraries) ''
+  + optionalString (stdenv.isDarwin && enableSharedLibraries) ''
     substituteInPlace "$out/lib/cmake/llvm/LLVMExports-${if debugVersion then "debug" else "release"}.cmake" \
       --replace "\''${_IMPORT_PREFIX}/lib/libLLVM.dylib" "$lib/lib/libLLVM.dylib"
     ln -s $lib/lib/libLLVM.dylib $lib/lib/libLLVM-${shortVersion}.dylib
diff --git a/pkgs/development/compilers/llvm/common.nix b/pkgs/development/compilers/llvm/common.nix
new file mode 100644
index 000000000000..27f48ff3f113
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common.nix
@@ -0,0 +1,20 @@
+{ lib }:
+
+rec {
+  llvmBackend = platform:
+    if builtins.typeOf platform == "string" then
+      platform
+    else if platform.parsed.cpu.family == "x86" then
+      "X86"
+    else if platform.parsed.cpu.name == "aarch64" then
+      "AArch64"
+    else if platform.parsed.cpu.family == "arm" then
+      "ARM"
+    else if platform.parsed.cpu.family == "mips" then
+      "Mips"
+    else
+      throw "Unsupported system";
+
+  llvmBackendList = platforms:
+    lib.concatStringsSep ";" (map llvmBackend platforms);
+}
diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index 271d26eda1c0..511565495526 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nasm-${version}";
-  version = "2.14";
+  version = "2.14.01";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}.tar.bz2";
-    sha256 = "0i678zbm1ljn5jwia7gj1n503izwvzlh55xzm4i0qgfmr8kzsg6l";
+    sha256 = "1v9fazd3in0rphnw5ck58wqnl8dis4dyqpsqgjsm4h9jjj0vylvz";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/development/compilers/openjdk/11.nix b/pkgs/development/compilers/openjdk/11.nix
index 42208ecf8d95..a389f0f5ca1a 100644
--- a/pkgs/development/compilers/openjdk/11.nix
+++ b/pkgs/development/compilers/openjdk/11.nix
@@ -21,7 +21,6 @@ let
   update = ".0.1";
   build = "13";
   repover = "jdk-${major}${update}+${build}";
-  paxflags = if stdenv.isi686 then "msp" else "m";
 
   openjdk = stdenv.mkDerivation {
     name = "openjdk-${major}${update}-b${build}";
@@ -106,14 +105,6 @@ let
         rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
       ''}
 
-      # Set PaX markings
-      exes=$(file $out/lib/openjdk/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-      echo "to mark: *$exes*"
-      for file in $exes; do
-        echo "marking *$file*"
-        paxmark ${paxflags} "$file"
-      done
-
       ln -s $out/lib/openjdk/bin $out/bin
     '';
 
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index d26627ff5b9c..19b16921e329 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -25,7 +25,6 @@ let
   build = "26";
   baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = "jdk8u${update}-b${build}";
-  paxflags = if stdenv.isi686 then "msp" else "m";
   jdk8 = fetchurl {
              url = "${baseurl}/archive/${repover}.tar.gz";
              sha256 = "1hx5sfsglc101aqs9n7cz7rh447d6rxfxkbw03crvzbvy9n6ag2d";
@@ -176,14 +175,6 @@ let
       rm -rf $out/lib/openjdk/jre/lib/cmm
       ln -s {$jre,$out}/lib/openjdk/jre/lib/cmm
 
-      # Set PaX markings
-      exes=$(file $out/lib/openjdk/bin/* $jre/lib/openjdk/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-      echo "to mark: *$exes*"
-      for file in $exes; do
-        echo "marking *$file*"
-        paxmark ${paxflags} "$file"
-      done
-
       # Remove duplicate binaries.
       for i in $(cd $out/lib/openjdk/bin && echo *); do
         if [ "$i" = java ]; then continue; fi
diff --git a/pkgs/development/compilers/openjdk/bootstrap.nix b/pkgs/development/compilers/openjdk/bootstrap.nix
index 1b20ca6cc606..e58888cc9ed8 100644
--- a/pkgs/development/compilers/openjdk/bootstrap.nix
+++ b/pkgs/development/compilers/openjdk/bootstrap.nix
@@ -36,13 +36,5 @@ let
       patchelf --set-interpreter $(cat "${stdenv.cc}/nix-support/dynamic-linker") "$elf" || true
       patchelf --set-rpath "${stdenv.cc.libc}/lib:${stdenv.cc.cc.lib}/lib:${zlib}/lib:$LIBDIRS" "$elf" || true
     done
-
-    # Temporarily, while NixOS's OpenJDK bootstrap tarball doesn't have PaX markings:
-    find "$out/bin" -type f -print0 | while IFS= read -r -d "" elf; do
-      isELF "$elf" || continue
-      paxmark m "$elf"
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$elf"''}
-    done
   '';
 in bootstrap
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index 5d55e0554e55..8e04b776ed8a 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -93,14 +93,6 @@ let result = stdenv.mkDerivation rec {
   installPhase = ''
     cd ..
 
-    # Set PaX markings
-    exes=$(file $sourceRoot/bin/* $sourceRoot/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
-    for file in $exes; do
-      paxmark m "$file" || true
-      # On x86 for heap sizes over 700MB disable SEGMEXEC and PAGEEXEC as well.
-      ${stdenv.lib.optionalString stdenv.isi686 ''paxmark msp "$file"''}
-    done
-
     if test -z "$installjdk"; then
       mv $sourceRoot/jre $out
     else
diff --git a/pkgs/development/compilers/rust/binaryBuild.nix b/pkgs/development/compilers/rust/binaryBuild.nix
index 488d43a6fea4..77dba7f9e620 100644
--- a/pkgs/development/compilers/rust/binaryBuild.nix
+++ b/pkgs/development/compilers/rust/binaryBuild.nix
@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, bash, buildRustPackage, curl, darwin
+{ stdenv, makeWrapper, bash, curl, darwin
 , version
 , src
 , platform
@@ -18,8 +18,6 @@ let
 in
 
 rec {
-  inherit buildRustPackage;
-
   rustc = stdenv.mkDerivation rec {
     name = "rustc-${versionType}-${version}";
 
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index f0413f194135..9528d798618f 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -37,6 +37,5 @@ let
 
 in callPackage ./binaryBuild.nix
   { inherit version src platform;
-    buildRustPackage = null;
     versionType = "bootstrap";
   }
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index bbfa1be8f921..02b100fe6130 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -27,7 +27,6 @@
 , git
 , libgit2
 , fetchFromGitHub
-, paxctl
 , findutils
 , makeWrapper
 , gnumake
@@ -150,7 +149,7 @@ stdenv.mkDerivation rec {
     findutils
     makeWrapper
     gnumake
-  ] ++ stdenv.lib.optional stdenv.needsPax paxctl;
+  ];
 
   # TODO: Revisit what's propagated and how
   propagatedBuildInputs = [
@@ -218,9 +217,6 @@ stdenv.mkDerivation rec {
     substituteInPlace swift/utils/build-script-impl \
       --replace '/usr/include/c++' "${clang.cc.gcc}/include/c++"
     patch -p1 -d swift -i ${./patches/glibc-arch-headers.patch}
-  '' + stdenv.lib.optionalString stdenv.needsPax ''
-    patch -p1 -d swift -i ${./patches/build-script-pax.patch}
-  '' + ''
     patch -p1 -d swift -i ${./patches/0001-build-presets-linux-don-t-require-using-Ninja.patch}
     patch -p1 -d swift -i ${./patches/0002-build-presets-linux-allow-custom-install-prefix.patch}
     patch -p1 -d swift -i ${./patches/0004-build-presets-linux-plumb-extra-cmake-options.patch}
@@ -266,9 +262,6 @@ stdenv.mkDerivation rec {
     tar xf $INSTALLABLE_PACKAGE -C $out --strip-components=3 $PREFIX
     find $out -type d -empty -delete
 
-    paxmark pmr $out/bin/swift
-    paxmark pmr $out/bin/*
-
     # TODO: Use wrappers to get these on the PATH for swift tools, instead
     ln -s ${clang}/bin/* $out/bin/
     ln -s ${targetPackages.stdenv.cc.bintools.bintools_bin}/bin/ar $out/bin/ar
diff --git a/pkgs/development/compilers/swift/patches/build-script-pax.patch b/pkgs/development/compilers/swift/patches/build-script-pax.patch
deleted file mode 100644
index 1f47bf8ee045..000000000000
--- a/pkgs/development/compilers/swift/patches/build-script-pax.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- swift/utils/build-script-impl	2017-01-23 12:47:20.401326309 -0600
-+++ swift-pax/utils/build-script-impl	2017-01-23 13:24:10.339366996 -0600
-@@ -1837,6 +1837,17 @@ function set_lldb_xcodebuild_options() {
-     fi
- }
- 
-+## XXX: Taken from nixpkgs /pkgs/stdenv/generic/setup.sh
-+isELF() {
-+    local fn="$1"
-+    local fd
-+    local magic
-+    exec {fd}< "$fn"
-+    read -n 4 -u $fd magic
-+    exec {fd}<&-
-+    if [[ "$magic" =~ ELF ]]; then return 0; else return 1; fi
-+}
-+
- #
- # Configure and build each product
- #
-@@ -2735,6 +2746,12 @@ for host in "${ALL_HOSTS[@]}"; do
-             fi
- 
-             call "${CMAKE_BUILD[@]}" "${build_dir}" $(cmake_config_opt ${product}) -- "${BUILD_ARGS[@]}" ${build_targets[@]}
-+            
-+						while IFS= read -r -d $'\0' i; do
-+								if ! isELF "$i"; then continue; fi
-+								echo "setting pax flags on $i"
-+								paxctl -czexm "$i" || true
-+						done < <(find "${build_dir}" -executable -type f -wholename "*/bin/*" -print0)
-         fi
-     done
- done
diff --git a/pkgs/development/compilers/terra/default.nix b/pkgs/development/compilers/terra/default.nix
index 98795f96ffa5..80d04080aac3 100644
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@@ -51,10 +51,6 @@ stdenv.mkDerivation rec {
   ''
   ;
 
-  postFixup = ''
-    paxmark m $bin/bin/terra
-  '';
-
   buildInputs = with llvmPackages; [ lua llvm clang-unwrapped ncurses ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix
index da706d502e6f..a5c3db65857f 100644
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@@ -33,10 +33,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkTarget = "test";
 
-  postFixup = ''
-    paxmark m $out/bin/tcc
-  '';
-
   meta = {
     description = "Small, fast, and embeddable C compiler and interpreter";
 
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index daf0987be571..f945a6581096 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -47,8 +47,8 @@ let
 in rec {
   vala_0_36 = generic {
     major   = "0.36";
-    minor   = "15";
-    sha256  = "11lnwjbhiz2l7g6y1f0jb0s81ymgssinlil3alibzcwmzpk175ix";
+    minor   = "17";
+    sha256  = "1f6qg40zd6jzhbwr3dy4fb66k4qs1xlk2whdyqh64zxxjw0k9pv7";
   };
 
   vala_0_38 = generic {
@@ -60,14 +60,14 @@ in rec {
 
   vala_0_40 = generic {
     major   = "0.40";
-    minor   = "11";
-    sha256  = "0xhm61kjdws167pafcji43s7icfvpq58lkbq3irb1jv3icjr3i8z";
+    minor   = "12";
+    sha256  = "1nhk45w5iwg97q3cfybn0i4qz5w9qvk423ndpg6mq6cnna076snx";
   };
 
   vala_0_42 = generic {
     major   = "0.42";
-    minor   = "3";
-    sha256  = "0zaq9009wqk5aah131m426a2ia0scwpjpl4npf8p7p43wv8kvisz";
+    minor   = "4";
+    sha256  = "07jgkx812y7wq4cswwfsf1f4k3lq9hcjra45682bdi8a11nr0a5m";
   };
 
   vala = vala_0_42;
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 0529c9f1e28c..bc0b728ecce4 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -59,7 +59,8 @@ in stdenv.mkDerivation ({
 
   debugInfo = enableDebugInfo;
 
-  enableParallelBuilding = true;
+  # On some machines, parallel build reliably crashes on `GEN    asn1ct_eval_ext.erl` step
+  enableParallelBuilding = false;
 
   # Clang 4 (rightfully) thinks signed comparisons of pointers with NULL are nonsense
   prePatch = ''
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index ca0335178373..5e8f5e2d59b6 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -154,11 +154,11 @@ let
       platforms = platforms.all;
     };
   } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "ab8d05c9e695d3db4f7dc15c70f23623349c2f49"; # Oct 03, 2018
+    crossVersion = "276849e62f472c1b241d9e7b38a28e4cc9f98563"; # Dez 02, 2018
 
     perl-cross-src = fetchurlBoot {
       url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1g7p7mqmx8x3diqvbh881gr72d106cn6yvm4gx7f0ars3n3b3wj0";
+      sha256 = "1fpr1m9lgkwdp1vmdr0s6gvmcpd0m8q6jwn024bkczc2h37bdynd";
     };
 
     depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@@ -174,15 +174,10 @@ let
     setupHook = ./setup-hook-cross.sh;
   });
 in rec {
-  perl526 = common {
-    version = "5.26.2";
-    sha256 = "03gpnxx1g6hvlh0v4aqx00580h787sfywp1vlvw64q2xcbm9qbsp";
-  };
-
   # the latest Maint version
   perl528 = common {
-    version = "5.28.0";
-    sha256 = "1a3f822lcl8dr8v0hk80yyhpzqlljg49z9flb48rs3nbsij9z4ky";
+    version = "5.28.1";
+    sha256 = "0iy3as4hnbjfyws4in3j9d6zhhjxgl5m95i5n9jy2bnzcpz8bgry";
   };
 
   # the latest Devel version
diff --git a/pkgs/development/interpreters/python/cpython/2.7/boot.nix b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
index 976d30819dbe..ccb366903c5c 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/boot.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/boot.nix
@@ -77,8 +77,6 @@ stdenv.mkDerivation rec {
     ''
       ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
 
-      paxmark E $out/bin/python2.7
-
       rm "$out"/lib/python*/plat-*/regen # refers to glibc.dev
     '';
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 63dad3bf42ff..ff1497a24e46 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -229,8 +229,6 @@ in stdenv.mkDerivation ({
         ln -s $out/lib/python${majorVersion}/pdb.py $out/bin/pdb${majorVersion}
         ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
 
-        paxmark E $out/bin/python${majorVersion}
-
         # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
         echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
 
diff --git a/pkgs/development/interpreters/python/cpython/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 92c277aacd4f..19e9f3169c7a 100644
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -143,7 +143,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index cad35cac53a8..a36965a78017 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -158,7 +158,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
diff --git a/pkgs/development/interpreters/python/cpython/3.7/default.nix b/pkgs/development/interpreters/python/cpython/3.7/default.nix
index a008be707c2c..1d8b1c0eadf3 100644
--- a/pkgs/development/interpreters/python/cpython/3.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.7/default.nix
@@ -14,8 +14,10 @@
 , self
 , CF, configd
 , python-setup-hook
+, nukeReferences
 # For the Python package set
 , packageOverrides ? (self: super: {})
+, buildPackages
 }:
 
 assert x11Support -> tcl != null
@@ -33,12 +35,15 @@ let
   sitePackages = "lib/${libPrefix}/site-packages";
 
   buildInputs = filter (p: p != null) [
-    zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl ]
+    zlib bzip2 expat lzma libffi gdbm sqlite readline ncurses openssl nukeReferences ]
     ++ optionals x11Support [ tcl tk libX11 xproto ]
     ++ optionals stdenv.isDarwin [ CF configd ];
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
-
+  pythonForBuild = if stdenv.hostPlatform == stdenv.buildPlatform then
+    "$out/bin/python"
+  else
+    buildPackages.python37.interpreter;
 in stdenv.mkDerivation {
   name = "python3-${version}";
   pythonVersion = majorVersion;
@@ -46,6 +51,10 @@ in stdenv.mkDerivation {
 
   inherit buildInputs;
 
+  nativeBuildInputs =
+    optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ buildPackages.stdenv.cc buildPackages.python37 ];
+
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
     sha256 = "1fzi9d2gibh0wzwidyckzbywsxcsbckgsl05ryxlifxia77fhgyq";
@@ -95,6 +104,27 @@ in stdenv.mkDerivation {
     "--with-system-expat"
     "--with-system-ffi"
     "--with-openssl=${openssl.dev}"
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_buggy_getaddrinfo=no"
+    # Assume little-endian IEEE 754 floating point when cross compiling
+    "ac_cv_little_endian_double=yes"
+    "ac_cv_big_endian_double=no"
+    "ac_cv_mixed_endian_double=no"
+    "ac_cv_x87_double_rounding=yes"
+    "ac_cv_tanh_preserves_zero_sign=yes"
+    # Generally assume that things are present and work
+    "ac_cv_posix_semaphores_enabled=yes"
+    "ac_cv_broken_sem_getvalue=no"
+    "ac_cv_wchar_t_signed=yes"
+    "ac_cv_rshift_extends_sign=yes"
+    "ac_cv_broken_nice=no"
+    "ac_cv_broken_poll=no"
+    "ac_cv_working_tzset=yes"
+    "ac_cv_have_long_long_format=yes"
+    "ac_cv_have_size_t_format=yes"
+    "ac_cv_computed_gotos=yes"
+    "ac_cv_file__dev_ptmx=yes"
+    "ac_cv_file__dev_ptc=yes"
   ];
 
   preConfigure = ''
@@ -125,7 +155,6 @@ in stdenv.mkDerivation {
     touch $out/lib/python${majorVersion}/test/__init__.py
 
     ln -s "$out/include/python${majorVersion}m" "$out/include/python${majorVersion}"
-    paxmark E $out/bin/python${majorVersion}
 
     # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
     echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
@@ -145,19 +174,28 @@ in stdenv.mkDerivation {
     # some $TMPDIR references to improve binary reproducibility.
     # Note that the .pyc file of _sysconfigdata.py should be regenerated!
     for i in $out/lib/python${majorVersion}/_sysconfigdata*.py $out/lib/python${majorVersion}/config-${majorVersion}m*/Makefile; do
-      sed -i $i -e "s|-I/nix/store/[^ ']*||g" -e "s|-L/nix/store/[^ ']*||g" -e "s|$TMPDIR|/no-such-path|g"
+      sed -i $i -e "s|$TMPDIR|/no-such-path|g"
+      nuke-refs $i
     done
 
+    # Further get rid of references. https://github.com/NixOS/nixpkgs/issues/51668
+    find $out/lib/python*/config-*-* -type f -print -exec nuke-refs '{}' +
+    find $out/lib -name '_sysconfigdata_m*.py*' -print -exec nuke-refs '{}' +
+
     # Determinism: rebuild all bytecode
     # We exclude lib2to3 because that's Python 2 code which fails
     # We rebuild three times, once for each optimization level
     # Python 3.7 implements PEP 552, introducing support for deterministic bytecode.
     # This is automatically used when `SOURCE_DATE_EPOCH` is set.
-    find $out -name "*.py" | $out/bin/python     -m compileall -q -f -x "lib2to3" -i -
-    find $out -name "*.py" | $out/bin/python -O  -m compileall -q -f -x "lib2to3" -i -
-    find $out -name "*.py" | $out/bin/python -OO -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild}     -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild} -O  -m compileall -q -f -x "lib2to3" -i -
+    find $out -name "*.py" | ${pythonForBuild} -OO -m compileall -q -f -x "lib2to3" -i -
   '';
 
+  # Enforce that we don't have references to the OpenSSL -dev package, which we
+  # explicitly specify in our configure flags above.
+  disallowedReferences = [ openssl.dev ];
+
   passthru = let
     pythonPackages = callPackage ../../../../../top-level/python-packages.nix {
       python = self;
diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index 1efd777bb052..4ff0a62d7fbd 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -7,7 +7,7 @@ with lib;
 
 makeSetupHook {
       deps = makeWrapper;
-      substitutions.libPrefix = python.libPrefix;
+      substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
       substitutions.python = python;
       substitutions.magicalSedExpression = let
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index 01b573e6ad5d..6fa8c316a17d 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -92,7 +92,7 @@ _addToPythonPath() {
     pythonPathsSeen[$dir]=1
     # addToSearchPath is defined in stdenv/generic/setup.sh. It will have
     # the effect of calling `export program_X=$dir/...:$program_X`.
-    addToSearchPath program_PYTHONPATH $dir/lib/@libPrefix@/site-packages
+    addToSearchPath program_PYTHONPATH $dir/@sitePackages@
     addToSearchPath program_PATH $dir/bin
 
     # Inspect the propagated inputs (if they exist) and recur on them.
@@ -113,9 +113,9 @@ createBuildInputsPth() {
             if $(echo -n $x |grep -q python-recursive-pth-loader); then
                 continue
             fi
-            if test -d "$x"/lib/@libPrefix@/site-packages; then
-                echo $x/lib/@libPrefix@/site-packages \
-                    >> "$out"/lib/@libPrefix@/site-packages/${name}-nix-python-$category.pth
+            if test -d "$x"/@sitePackages@; then
+                echo $x/@sitePackages@ \
+                    >> "$out"/@sitePackages@/${name}-nix-python-$category.pth
             fi
         done
     fi
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 9be8247add11..7365cd522734 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -73,15 +73,12 @@ let
         # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
         NROFF = if docSupport then "${groff}/bin/nroff" else null;
 
-        nativeBuildInputs =
-             ops useRailsExpress [ autoreconfHook bison ]
-          ++ ops (stdenv.buildPlatform != stdenv.hostPlatform) [
-               buildPackages.ruby
-             ];
+        nativeBuildInputs = [ autoreconfHook bison ]
+          ++ (op docSupport groff)
+          ++ op (stdenv.buildPlatform != stdenv.hostPlatform) buildPackages.ruby;
         buildInputs =
              (op fiddleSupport libffi)
           ++ (ops cursesSupport [ ncurses readline ])
-          ++ (op docSupport groff)
           ++ (op zlibSupport zlib)
           ++ (op opensslSupport openssl)
           ++ (op gdbmSupport gdbm)
@@ -149,7 +146,7 @@ let
         postInstall = ''
           # Update rubygems
           pushd rubygems
-          ${buildRuby} setup.rb
+          ${buildRuby} setup.rb --destdir $GEM_HOME
           popd
 
           # Remove unnecessary groff reference from runtime closure, since it's big
diff --git a/pkgs/development/interpreters/spidermonkey/1.8.5.nix b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
index 466371955868..9c81b230ada2 100644
--- a/pkgs/development/interpreters/spidermonkey/1.8.5.nix
+++ b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   # so the failure of that test does not matter much.
   configureFlags = [ "--enable-threadsafe" "--with-system-nspr" ] ++
     stdenv.lib.optionals (stdenv.hostPlatform.system == "armv5tel-linux") [
-        "--with-cpu-arch=armv5t" 
+        "--with-cpu-arch=armv5t"
         "--disable-tracejit" ];
 
   # hack around a make problem, see https://github.com/NixOS/nixpkgs/issues/1279#issuecomment-29547393
@@ -59,9 +59,6 @@ stdenv.mkDerivation rec {
 
   preCheck = ''
     rm jit-test/tests/sunspider/check-date-format-tofte.js    # https://bugzil.la/600522
-
-    paxmark mr shell/js
-    paxmark mr jsapi-tests/jsapi-tests
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/interpreters/tcl/generic.nix b/pkgs/development/interpreters/tcl/generic.nix
index a472ccaafbf2..011b3a125ef2 100644
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -15,15 +15,19 @@ stdenv.mkDerivation rec {
   setOutputFlags = false;
 
   preConfigure = ''
-    # Note: using $out instead of $man to prevent a runtime dependency on $man.
-    configureFlagsArray+=(--mandir=$out/share/man --enable-man-symlinks)
-
-    # Don't install tzdata because NixOS already has a more up-to-date copy.
-    configureFlagsArray+=(--with-tzdata=no)
-
     cd unix
   '';
 
+  configureFlags = [
+    "--enable-threads"
+    # Note: using $out instead of $man to prevent a runtime dependency on $man.
+    "--mandir=${placeholder "out"}/share/man"
+    "--enable-man-symlinks"
+    # Don't install tzdata because NixOS already has a more up-to-date copy.
+    "--with-tzdata=no"
+    "tcl_cv_strtod_unbroken=ok"
+  ] ++ stdenv.lib.optional stdenv.is64bit "--enable-64bit";
+
   enableParallelBuilding = true;
 
   postInstall = ''
diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index f9559d94174d..4b280cc18621 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, attr }:
 
 stdenv.mkDerivation rec {
-  name = "acl-2.2.52";
+  name = "acl-2.2.53";
 
   src = fetchurl {
-    url = "mirror://savannah/acl/${name}.src.tar.gz";
-    sha256 = "08qd9s3wfhv0ajswsylnfwr5h0d7j9d4rgip855nrh400nxp940p";
+    url = "mirror://savannah/acl/${name}.tar.gz";
+    sha256 = "1ir6my3w74s6nfbgbqgzj6w570sn0qjf3524zx8xh67lqrjrigh6";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
@@ -22,10 +22,6 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ZIP=gzip" "ECHO=echo" "SED=sed" "AWK=gawk" ];
-
-  installTargets = [ "install" "install-lib" "install-dev" ];
-
   meta = with stdenv.lib; {
     homepage = "https://savannah.nongnu.org/projects/acl";
     description = "Library and tools for manipulating access control lists";
diff --git a/pkgs/development/libraries/atkmm/default.nix b/pkgs/development/libraries/atkmm/default.nix
index 9ec9e6284f83..5338aa683a7c 100644
--- a/pkgs/development/libraries/atkmm/default.nix
+++ b/pkgs/development/libraries/atkmm/default.nix
@@ -1,14 +1,12 @@
-{ stdenv, fetchurl, atk, glibmm, pkgconfig }:
-let
-  ver_maj = "2.24";
-  ver_min = "2";
-in
+{ stdenv, fetchurl, atk, glibmm, pkgconfig, gnome3 }:
+
 stdenv.mkDerivation rec {
-  name = "atkmm-${ver_maj}.${ver_min}";
+  pname = "atkmm";
+  version = "2.28.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/atkmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "ff95385759e2af23828d4056356f25376cfabc41e690ac1df055371537e458bd";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0fnxrspxkhhbrjphqrpvl3zjm66n50s4cywrrrwkhbflgy8zqk2c";
   };
 
   outputs = [ "out" "dev" ];
@@ -19,6 +17,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = {
     description = "C++ wrappers for ATK accessibility toolkit";
     license = stdenv.lib.licenses.lgpl21Plus;
diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index f859894cd47b..623864529f0f 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -1,23 +1,17 @@
 { stdenv, fetchurl, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "attr-2.4.47";
+  name = "attr-2.4.48";
 
   src = fetchurl {
-    url = "mirror://savannah/attr/${name}.src.tar.gz";
-    sha256 = "0nd8y0m6awc9ahv0ciiwf8gy54c8d3j51pw9xg7f7cn579jjyxr5";
+    url = "mirror://savannah/attr/${name}.tar.gz";
+    sha256 = "1rr4adzwax4bzr2c00f06zcsljv5y6p9wymz1g89ww7cb2rp5bay";
   };
 
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ gettext ];
 
-  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ECHO=echo" "SED=sed" "AWK=gawk" ];
-
-  installTargets = [ "install" "install-lib" "install-dev" ];
-
-  patches = if (stdenv.hostPlatform.libc == "musl") then [ ./fix-headers-musl.patch ] else null;
-
   postPatch = ''
     for script in install-sh include/install-sh; do
       patchShebangs $script
diff --git a/pkgs/development/libraries/attr/fix-headers-musl.patch b/pkgs/development/libraries/attr/fix-headers-musl.patch
deleted file mode 100644
index e969f640eeef..000000000000
--- a/pkgs/development/libraries/attr/fix-headers-musl.patch
+++ /dev/null
@@ -1,54 +0,0 @@
---- attr-2.4.47/include/xattr.h
-+++ attr-2.4.47/include/xattr.h
-@@ -31,33 +31,37 @@
- #define XATTR_REPLACE 0x2       /* set value, fail if attr does not exist */
- 
- 
--__BEGIN_DECLS
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
- 
- extern int setxattr (const char *__path, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- extern int lsetxattr (const char *__path, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- extern int fsetxattr (int __filedes, const char *__name,
--		      const void *__value, size_t __size, int __flags) __THROW;
-+		      const void *__value, size_t __size, int __flags);
- 
- extern ssize_t getxattr (const char *__path, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- extern ssize_t lgetxattr (const char *__path, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- extern ssize_t fgetxattr (int __filedes, const char *__name,
--				void *__value, size_t __size) __THROW;
-+				void *__value, size_t __size);
- 
- extern ssize_t listxattr (const char *__path, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- extern ssize_t llistxattr (const char *__path, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- extern ssize_t flistxattr (int __filedes, char *__list,
--				size_t __size) __THROW;
-+				size_t __size);
- 
--extern int removexattr (const char *__path, const char *__name) __THROW;
--extern int lremovexattr (const char *__path, const char *__name) __THROW;
--extern int fremovexattr (int __filedes,   const char *__name) __THROW;
-+extern int removexattr (const char *__path, const char *__name);
-+extern int lremovexattr (const char *__path, const char *__name);
-+extern int fremovexattr (int __filedes,   const char *__name);
- 
--__END_DECLS
-+#ifdef __cplusplus
-+}
-+#endif
- 
- #endif	/* __XATTR_H__ */
diff --git a/pkgs/development/libraries/clucene-core/2.x.nix b/pkgs/development/libraries/clucene-core/2.x.nix
index 004c01a5b69e..6eb310550bcd 100644
--- a/pkgs/development/libraries/clucene-core/2.x.nix
+++ b/pkgs/development/libraries/clucene-core/2.x.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
     "-DBUILD_CONTRIBS=ON"
     "-DBUILD_CONTRIBS_LIB=ON"
     "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "-D_CL_HAVE_GCC_ATOMIC_FUNCTIONS=0"
+    "-D_CL_HAVE_NAMESPACES_EXITCODE=0"
+    "-D_CL_HAVE_NO_SNPRINTF_BUG_EXITCODE=0"
+    "-D_CL_HAVE_NO_SNWPRINTF_BUG_EXITCODE=0"
+    "-D_CL_HAVE_TRY_BLOCKS_EXITCODE=0"
+    "-D_CL_HAVE_PTHREAD_MUTEX_RECURSIVE=0"
+    "-DLUCENE_STATIC_CONSTANT_SYNTAX_EXITCODE=0"
   ];
 
   patches = # From debian
diff --git a/pkgs/development/libraries/eigen/default.nix b/pkgs/development/libraries/eigen/default.nix
index c48f8e4c9732..25d0760a32d1 100644
--- a/pkgs/development/libraries/eigen/default.nix
+++ b/pkgs/development/libraries/eigen/default.nix
@@ -1,7 +1,7 @@
 {stdenv, fetchurl, fetchpatch, cmake}:
 
 let
-  version = "3.3.5";
+  version = "3.3.7";
 in
 stdenv.mkDerivation {
   name = "eigen-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     url = "https://bitbucket.org/eigen/eigen/get/${version}.tar.gz";
     name = "eigen-${version}.tar.gz";
-    sha256 = "13p60x6k61zq2y2in7g4fy5p55cr5dbmj3zvw10zcazxraxbcm04";
+    sha256 = "1nnh0v82a5xibcjaph51mx06mxbllk77fvihnd5ba0kpl23yz13y";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/core/folks/default.nix b/pkgs/development/libraries/folks/default.nix
index 2eb33cde975f..2ce50a92ea36 100644
--- a/pkgs/desktops/gnome-3/core/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -1,20 +1,19 @@
 { fetchurl, stdenv, pkgconfig, glib, gnome3, nspr, intltool, gobject-introspection
-, vala, sqlite, libxml2, dbus-glib, libsoup, nss, dbus
+, vala, sqlite, libxml2, dbus-glib, libsoup, nss, dbus, libgee
 , telepathy-glib, evolution-data-server, libsecret, db }:
 
 # TODO: enable more folks backends
 
-let
+stdenv.mkDerivation rec {
+  pname = "folks";
   version = "0.11.4";
-in stdenv.mkDerivation rec {
-  name = "folks-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/folks/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "16hqh2gxlbx0b0hgq216hndr1m72vj54jvryzii9zqkk0g9kxc57";
   };
 
-  propagatedBuildInputs = [ glib gnome3.libgee sqlite ];
+  propagatedBuildInputs = [ glib libgee sqlite ];
   # dbus_daemon needed for tests
   buildInputs = [
     dbus-glib telepathy-glib evolution-data-server dbus
@@ -33,19 +32,15 @@ in stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome3.updateScript {
-      packageName = "folks";
-      attrPath = "gnome3.folks";
+      packageName = pname;
       versionPolicy = "none";
     };
   };
 
   meta = {
-    description = "Folks";
-
+    description = "A library that aggregates people from multiple sources to create metacontacts";
     homepage = https://wiki.gnome.org/Projects/Folks;
-
     license = stdenv.lib.licenses.lgpl2Plus;
-
     maintainers = gnome3.maintainers;
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice
   };
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 5a11d03c5917..59ffd47c3104 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -62,6 +62,9 @@ in stdenv.mkDerivation rec {
   doCheck = true;
 
   postInstall = glib.flattenInclude + ''
+    substituteInPlace $dev/bin/freetype-config \
+      --replace ${buildPackages.pkgconfig} ${pkgconfig}
+
     wrapProgram "$dev/bin/freetype-config" \
       --set PKG_CONFIG_PATH "$PKG_CONFIG_PATH:$dev/lib/pkgconfig"
   '';
diff --git a/pkgs/desktops/gnome-3/core/gcr/default.nix b/pkgs/development/libraries/gcr/default.nix
index 2cfdb518dfab..56c52e1e3688 100644
--- a/pkgs/desktops/gnome-3/core/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@@ -1,19 +1,19 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnupg, p11-kit, glib
-, libgcrypt, libtasn1, dbus-glib, gtk, pango, gdk_pixbuf, atk
+, libgcrypt, libtasn1, dbus-glib, gtk3, pango, gdk_pixbuf, atk
 , gobject-introspection, makeWrapper, libxslt, vala, gnome3
 , python2 }:
 
 stdenv.mkDerivation rec {
-  name = "gcr-${version}";
+  pname = "gcr";
   version = "3.28.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gcr/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "02xgky22xgvhgd525khqh64l5i21ca839fj9jzaqdi3yvb8pbq8m";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "gcr"; attrPath = "gnome3.gcr"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   postPatch = ''
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     gpg libgcrypt libtasn1 dbus-glib pango gdk_pixbuf atk
   ];
 
-  propagatedBuildInputs = [ glib gtk p11-kit ];
+  propagatedBuildInputs = [ glib gtk3 p11-kit ];
 
   checkInputs = [ python2 ];
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
diff --git a/pkgs/desktops/gnome-3/core/geocode-glib/default.nix b/pkgs/development/libraries/geocode-glib/default.nix
index ce5f46534c7b..2d308add87ad 100644
--- a/pkgs/desktops/gnome-3/core/geocode-glib/default.nix
+++ b/pkgs/development/libraries/geocode-glib/default.nix
@@ -1,13 +1,13 @@
 { fetchurl, stdenv, meson, ninja, pkgconfig, gettext, gtk-doc, docbook_xsl, gobject-introspection, gnome3, libsoup, json-glib }:
 
 stdenv.mkDerivation rec {
-  name = "geocode-glib-${version}";
+  pname = "geocode-glib";
   version = "3.26.0";
 
-  outputs = [ "out" "dev" "installedTests" ];
+  outputs = [ "out" "dev" "devdoc" "installedTests" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/geocode-glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/geocode-glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1vmydxs5xizcmaxpkfrq75xpj6pqrpdjizxyb30m00h54yqqch7a";
   };
 
@@ -24,8 +24,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome3.updateScript {
-      packageName = "geocode-glib";
-      attrPath = "gnome3.geocode-glib";
+      packageName = pname;
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/core/geocode-glib/installed-tests-path.patch b/pkgs/development/libraries/geocode-glib/installed-tests-path.patch
index 499c68008088..499c68008088 100644
--- a/pkgs/desktops/gnome-3/core/geocode-glib/installed-tests-path.patch
+++ b/pkgs/development/libraries/geocode-glib/installed-tests-path.patch
diff --git a/pkgs/development/libraries/geoip/default.nix b/pkgs/development/libraries/geoip/default.nix
index cb8138dc115e..1b1f7373709f 100644
--- a/pkgs/development/libraries/geoip/default.nix
+++ b/pkgs/development/libraries/geoip/default.nix
@@ -17,6 +17,11 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   postConfigure = ''
     find . -name Makefile.in -exec sed -i -r 's#^pkgdatadir\s*=.+$#pkgdatadir = ${dataDir}#' {} \;
   '';
diff --git a/pkgs/desktops/gnome-3/misc/gexiv2/default.nix b/pkgs/development/libraries/gexiv2/default.nix
index d74faf09fb7d..74311525f1e2 100644
--- a/pkgs/desktops/gnome-3/misc/gexiv2/default.nix
+++ b/pkgs/development/libraries/gexiv2/default.nix
@@ -1,29 +1,29 @@
-{ stdenv, fetchurl, meson, ninja, pkgconfig, exiv2, glib, gnome3, gobject-introspection, vala }:
+{ stdenv, fetchurl, meson, ninja, pkgconfig, exiv2, glib, gnome3, gobject-introspection, vala, gtk-doc, docbook_xsl, docbook_xml_dtd_43 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gexiv2";
   version = "0.10.9";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1vf0zv92p9hybdhn7zx53h3ia53ph97a21xz8rfk877xlr5261l8";
   };
 
-  preConfigure = ''
-    patchShebangs .
-  '';
-
-  nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection vala ];
+  nativeBuildInputs = [ meson ninja pkgconfig gobject-introspection vala gtk-doc docbook_xsl docbook_xml_dtd_43 ];
   buildInputs = [ glib ];
   propagatedBuildInputs = [ exiv2 ];
 
+  mesonFlags = [
+    "-Denable-gtk-doc=true" # TODO: change to gtk_doc in a next release
+  ];
+
+  doCheck = true;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/misc/gfbgraph/default.nix b/pkgs/development/libraries/gfbgraph/default.nix
index f4c0d6134c0f..1bdcb7d8b28d 100644
--- a/pkgs/desktops/gnome-3/misc/gfbgraph/default.nix
+++ b/pkgs/development/libraries/gfbgraph/default.nix
@@ -1,22 +1,20 @@
-{ stdenv, fetchurl, pkgconfig, glib
+{ stdenv, fetchurl, pkgconfig, glib, librest
 , gnome3, libsoup, json-glib, gobject-introspection }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gfbgraph";
   version = "0.2.3";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1dp0v8ia35fxs9yhnqpxj3ir5lh018jlbiwifjfn8ayy7h47j4fs";
   };
 
   nativeBuildInputs = [ pkgconfig gobject-introspection ];
   buildInputs = [ glib gnome3.gnome-online-accounts ];
-  propagatedBuildInputs = [ libsoup json-glib gnome3.rest ];
+  propagatedBuildInputs = [ libsoup json-glib librest ];
 
   configureFlags = [ "--enable-introspection" ];
 
@@ -25,11 +23,11 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
   meta = with stdenv.lib; {
+    homepage = https://wiki.gnome.org/Projects/GFBGraph;
     description = "GLib/GObject wrapper for the Facebook Graph API";
     maintainers = gnome3.maintainers;
     license = licenses.lgpl2;
diff --git a/pkgs/development/libraries/git2/0.27.nix b/pkgs/development/libraries/git2/0.27.nix
deleted file mode 100644
index 93948a1b0d67..000000000000
--- a/pkgs/development/libraries/git2/0.27.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
-, zlib, libssh2, openssl, http-parser, curl
-, libiconv, Security
-}:
-
-stdenv.mkDerivation rec {
-  version = "0.27.7";
-  name = "libgit2-${version}";
-
-  src = fetchFromGitHub {
-    owner = "libgit2";
-    repo = "libgit2";
-    rev = "v${version}";
-    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
-  };
-
-  cmakeFlags = [ "-DTHREADSAFE=ON" ];
-
-  nativeBuildInputs = [ cmake python pkgconfig ];
-
-  buildInputs = [ zlib libssh2 openssl http-parser curl ]
-    ++ stdenv.lib.optional stdenv.isDarwin Security;
-
-  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
-
-  enableParallelBuilding = true;
-
-  doCheck = false; # hangs. or very expensive?
-
-  meta = {
-    description = "The Git linkable library";
-    homepage = https://libgit2.github.com/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = with stdenv.lib.platforms; all;
-  };
-}
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 48d595137b3d..ec610d1e5656 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake
-, zlib, python, libssh2, openssl, curl, http-parser
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+, zlib, libssh2, openssl, http-parser, curl
 , libiconv, Security
 }:
 
-stdenv.mkDerivation (rec {
-  name = "libgit2-${version}";
-  version = "0.26.6";
-  # keep the version in sync with pythonPackages.pygit2 and gnome3.libgit2-glib
+stdenv.mkDerivation rec {
+  pname = "libgit2";
+  version = "0.27.7";
+  # keep the version in sync with pythonPackages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "17pjvprmdrx4h6bb1hhc98w9qi6ki7yl57f090n9kbhswxqfs7s3";
+    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
   };
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation (rec {
   buildInputs = [ zlib libssh2 openssl http-parser curl ]
     ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) [ libiconv ];
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
   enableParallelBuilding = true;
 
@@ -34,5 +34,4 @@ stdenv.mkDerivation (rec {
     license = licenses.gpl2;
     platforms = with platforms; all;
   };
-} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-})
+}
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 1eb50fc4f100..37275489cc3d 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, fetchurl, gettext, meson, ninja, pkgconfig, perl, python3, glibcLocales
+{ stdenv, fetchurl, fetchpatch, gettext, meson, ninja, pkgconfig, perl, python3, glibcLocales
 , libiconv, zlib, libffi, pcre, libelf, gnome3, libselinux, bash, gnum4, gtk-doc, docbook_xsl, docbook_xml_dtd_45
 # use utillinuxMinimal to avoid circular dependency (utillinux, systemd, glib)
 , utillinuxMinimal ? null
+, buildPackages
 
 # this is just for tests (not in the closure of any regular package)
 , doCheck ? stdenv.config.doCheckByDefault or false
@@ -43,7 +44,7 @@ let
     ln -sr -t "''${!outputInclude}/include/" "''${!outputInclude}"/lib/*/include/* 2>/dev/null || true
   '';
 
-  version = "2.58.1";
+  version = "2.58.2";
 in
 
 stdenv.mkDerivation rec {
@@ -51,7 +52,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1mnp4vankish8bqxymdl591p9v1ynk7pfc5dmpx3vamn4vcskmlp";
+    sha256 = "0jrxfm4gn1qz3y1450z709v74ys2bkjr8yffkgy106kgagb4xcn7";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch
@@ -63,6 +64,12 @@ stdenv.mkDerivation rec {
       ./schema-override-variable.patch
       # Require substituteInPlace in postPatch
       ./fix-gio-launch-desktop-path.patch
+      # https://gitlab.gnome.org/GNOME/glib/issues/1626
+      # https://gitlab.gnome.org/GNOME/glib/merge_requests/557
+      (fetchpatch {
+        url = https://gitlab.gnome.org/GNOME/glib/commit/85c4031696add9797e2334ced20678edcd96c869.patch;
+        sha256 = "1hmyvhx89wip2a26gk1rvd87k0pjfia51s0ysybjyzf5f1pzw877";
+      })
     ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
@@ -78,12 +85,16 @@ stdenv.mkDerivation rec {
     utillinuxMinimal # for libmount
   ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 glibcLocales ];
+  nativeBuildInputs = [
+    meson ninja pkgconfig perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 glibcLocales
+  ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
+    # Avoid the need for gobject introspection binaries in PATH in cross-compiling case.
+    # Instead we just copy them over from the native output.
+    "-Dgtk_doc=${if stdenv.hostPlatform == stdenv.buildPlatform then "true" else "false"}"
   ];
 
   LC_ALL = "en_US.UTF-8";
@@ -126,6 +137,8 @@ stdenv.mkDerivation rec {
     # This file is *included* in gtk3 and would introduce runtime reference via __FILE__.
     sed '1i#line 1 "${name}/include/glib-2.0/gobject/gobjectnotifyqueue.c"' \
       -i "$dev"/include/glib-2.0/gobject/gobjectnotifyqueue.c
+  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    cp -r ${buildPackages.glib.devdoc} $devdoc
   '';
 
   checkInputs = [ tzdata libxml2 desktop-file-utils shared-mime-info ];
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index ee77f4b498e4..10d5ee275006 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -1,27 +1,16 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, gnum4, glib, libsigcxx }:
+{ stdenv, fetchurl, pkgconfig, gnum4, glib, libsigcxx, gnome3 }:
 
-let
-  ver_maj = "2.56";
-  ver_min = "0";
-in
 stdenv.mkDerivation rec {
-  name = "glibmm-${ver_maj}.${ver_min}";
+  pname = "glibmm";
+  version = "2.58.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/glibmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "1abrkqhca5p8n6ly3vp1232rny03s7lrd8f8iz2m2m141nxgqx3f";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0idnaii4h3mdym2a55gkavipyxigwvbgfmzmwql85s4rgciqjhfk";
   };
 
   outputs = [ "out" "dev" ];
 
-  patchFlags = "-p0";
-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/macports/macports-ports/e864b2340be9ef003d8ff4aef92e7151d06287dd/devel/glibmm/files/0001-ustring-Fix-wchar-conversion-on-macOS-with-libc.patch";
-      sha256 = "02qvnailw1i59cjbj3cy7y02kfcivsvkdjrf4njkp4plarayyqp9";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig gnum4 ];
   propagatedBuildInputs = [ glib libsigcxx ];
 
@@ -29,6 +18,12 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails. one test needs the net, another /etc/fstab
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the GLib library";
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-menus/default.nix b/pkgs/development/libraries/gnome-menus/default.nix
index 9d49eb5e007c..0538b8ec06be 100644
--- a/pkgs/desktops/gnome-3/core/gnome-menus/default.nix
+++ b/pkgs/development/libraries/gnome-menus/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, intltool, pkgconfig, glib, gobject-introspection }:
 
 stdenv.mkDerivation rec {
-  name = "gnome-menus-${version}";
+  pname = "gnome-menus";
   version = "3.10.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnome-menus/3.10/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0wcacs1vk3pld8wvrwq7fdrm11i56nrajkrp6j1da6jc4yx0m5a6";
   };
 
@@ -16,8 +16,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = https://www.gnome.org;
-    description = "Gnome menu specification";
-
+    description = "Library that implements freedesktops's Desktop Menu Specification in GNOME";
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 3dc66aec1595..e1acf0e5d2cf 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -9,7 +9,7 @@
 
 let
   pname = "gobject-introspection";
-  version = "1.58.1";
+  version = "1.58.2";
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "12fzs3044047icdfs7cb2lsmnfi6w6fyhkci3m2rbvf5llgnhm29";
+    sha256 = "1a7dw9d4kqi0skyygc2bhdvzipc0kjfy3x5q856cmxws8mlhypia";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/desktops/gnome-3/core/gsound/default.nix b/pkgs/development/libraries/gsound/default.nix
index b0384c1ebb09..337a2472babd 100644
--- a/pkgs/desktops/gnome-3/core/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@@ -1,13 +1,11 @@
 { stdenv, fetchurl, pkgconfig, glib, libcanberra, gobject-introspection, libtool, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gsound";
   version = "1.0.2";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "bba8ff30eea815037e53bee727bbd5f0b6a2e74d452a7711b819a7c444e78e53";
   };
 
@@ -17,7 +15,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
index d4d4082509e4..96c9d8e0c8e1 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
@@ -36,8 +36,6 @@ stdenv.mkDerivation rec {
   postInstall = ''
     # Hm, apparently --disable-gtk-doc is ignored...
     rm -rf $out/share/gtk-doc
-
-    paxmark m $out/bin/gst-launch* $out/libexec/gstreamer-*/gst-plugin-scanner
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 421029a9d55f..5c6cd2c7eda0 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, gettext, perl, makeWrapper, shared-mime-info
+{ stdenv, fetchurl, fetchpatch, pkgconfig, gettext, perl, makeWrapper, shared-mime-info, isocodes
 , expat, glib, cairo, pango, gdk_pixbuf, atk, at-spi2-atk, gobject-introspection
 , xorg, epoxy, json-glib, libxkbcommon, gmp, gnome3
 , x11Support ? stdenv.isLinux
@@ -13,14 +13,14 @@ assert cupsSupport -> cups != null;
 with stdenv.lib;
 
 let
-  version = "3.24.1";
+  version = "3.24.2";
 in
 stdenv.mkDerivation rec {
   name = "gtk+3-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "0bxhsp7cjph7szg1iyv16nwi60bz59x1smjkqv6sv6mr0zipnf38";
+    sha256 = "14l8mimdm44r3h5pn5hzigl1z25jna8jxvb16l88v4nc4zj0afsv";
   };
 
   outputs = [ "out" "dev" ];
@@ -35,9 +35,14 @@ stdenv.mkDerivation rec {
       url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
+    # https://gitlab.gnome.org/GNOME/gtk/issues/1521
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gtk/commit/2905fc861acda3d134a198e56ef2f6c962ad3061.patch;
+      sha256 = "0y8ljny59kgdhrcfpimi2r082bax60d5kflw1qj9k1mnzjcvjjwl";
+    })
   ];
 
-  buildInputs = [ libxkbcommon epoxy json-glib ]
+  buildInputs = [ libxkbcommon epoxy json-glib isocodes ]
     ++ optional stdenv.isDarwin AppKit;
   propagatedBuildInputs = with xorg; with stdenv.lib;
     [ expat glib cairo pango gdk_pixbuf atk at-spi2-atk gnome3.gsettings-desktop-schemas
diff --git a/pkgs/development/libraries/gtkd/default.nix b/pkgs/development/libraries/gtkd/default.nix
index 66ba526f08e2..780b00f9d9a2 100644
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchzip, atk, cairo, dmd, gdk_pixbuf, gnome3, gst_all_1, librsvg
-, pango, pkgconfig, which }:
+, pango, pkgconfig, which, vte }:
 
 stdenv.mkDerivation rec {
   name = "gtkd-${version}";
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   inherit atk cairo gdk_pixbuf librsvg pango;
-  inherit (gnome3) glib gtk3 gtksourceview libgda libpeas vte;
+  inherit (gnome3) glib gtk3 gtksourceview libgda libpeas;
   inherit (gst_all_1) gstreamer;
   gst_plugins_base = gst_all_1.gst-plugins-base;
 
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index 7845143ebeb5..ba20af1caf51 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -1,15 +1,12 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy }:
+{ stdenv, fetchurl, pkgconfig, gtk3, glibmm, cairomm, pangomm, atkmm, epoxy, gnome3 }:
 
-let
-  ver_maj = "3.22";
-  ver_min = "2";
-in
 stdenv.mkDerivation rec {
-  name = "gtkmm-${ver_maj}.${ver_min}";
+  pname = "gtkmm";
+  version = "3.24.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gtkmm/${ver_maj}/${name}.tar.xz";
-    sha256 = "91afd98a31519536f5f397c2d79696e3d53143b80b75778521ca7b48cb280090";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0hxaq4x9jqj8vvnv3sb6nwapz83v8lclbm887qqci0g50llcjpyg";
   };
 
   outputs = [ "out" "dev" ];
@@ -24,6 +21,13 @@ stdenv.mkDerivation rec {
   # https://bugzilla.gnome.org/show_bug.cgi?id=764521
   doCheck = false;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      attrPath = "${pname}3";
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the GTK+ graphical user interface library";
 
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 4e407502516d..f7fda1a382fe 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -2,7 +2,7 @@
 , glib, libgudev, udisks2, libgcrypt, libcap, polkit
 , libgphoto2, avahi, libarchive, fuse, libcdio
 , libxml2, libxslt, docbook_xsl, docbook_xml_dtd_42, samba, libmtp
-, gnomeSupport ? false, gnome, wrapGAppsHook
+, gnomeSupport ? false, gnome, gcr, wrapGAppsHook
 , libimobiledevice, libbluray, libcdio-paranoia, libnfs, openssh
 , libsecret, libgdata, python3
 }:
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 7a7624c96753..2bd757786fdc 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.1.0";
+  version = "2.2.0";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "1y8jzm76wj8pcj3z47fikhasipyizd6w9r20yc7p139jqxp4jnwf";
+    sha256 = "047q63jr513azf3g1y7f5xn60b4jdjs9zsmrx04sfw5rasyzrk5p";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/hivex/default.nix b/pkgs/development/libraries/hivex/default.nix
index b2e2dbd35a40..740d2d3244df 100644
--- a/pkgs/development/libraries/hivex/default.nix
+++ b/pkgs/development/libraries/hivex/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
-, perl, libxml2, IOStringy }:
+, perlPackages, libxml2 }:
 
 stdenv.mkDerivation rec {
   name = "hivex-${version}";
@@ -14,9 +14,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoreconfHook makeWrapper
-    perl libxml2 IOStringy
-  ];
+    autoreconfHook makeWrapper libxml2
+  ] ++ (with perlPackages; [ perl IOStringy ]);
 
   postInstall = ''
     for bin in $out/bin/*; do
diff --git a/pkgs/development/libraries/jansson/default.nix b/pkgs/development/libraries/jansson/default.nix
index b1167efdfee6..bdb8f3b76ae6 100644
--- a/pkgs/development/libraries/jansson/default.nix
+++ b/pkgs/development/libraries/jansson/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "jansson-2.11";
+  name = "jansson-2.12";
 
   src = fetchurl {
     url = "http://www.digip.org/jansson/releases/${name}.tar.gz";
-    sha256 = "1x5jllzzqamq6kahx9d9a5mrarm9m3f30vfxvcqpi6p4mcnz91bf";
+    sha256 = "1jfj4xq3rdgnkxval1x2gqwhaam34qdxbplsj5fsrvs8a1vfr3az";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 165f9139ff1f..50a669b053f9 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   # not via outputBin, due to reference from libkrb5.so
   postInstall = ''
-    moveToOutput bin "$dev"
+    moveToOutput bin/krb5-config "$dev"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libassuan/default.nix b/pkgs/development/libraries/libassuan/default.nix
index 91ceb959779e..540aef9edf25 100644
--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, gettext, pth, libgpgerror }:
 
 stdenv.mkDerivation rec {
-  name = "libassuan-2.5.1";
+  name = "libassuan-2.5.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libassuan/${name}.tar.bz2";
-    sha256 = "0jb4nb4nrjr949gd3lw8lh4v5d6qigxaq6xwy24w5apjnhvnrya7";
+    sha256 = "1rw8nw6fx6ppxga6m4cqcp898lnlzf7vn3s5c2lzfxg3fzr1nswq";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index a887384f94da..ea1df23182d3 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "libatomic_ops-${version}";
-  version = "7.6.6";
+  version = "7.6.8";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 = "0x7071z707msvyrv9dmgahd1sghbkw8fpbagvcag6xs8yp2spzlr";
+    sha256 = "0rgni7056gnbn105lln629gwd6s51779yb5ds9s7wxl1vyg2fshx";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/desktops/gnome-3/core/libcroco/default.nix b/pkgs/development/libraries/libcroco/default.nix
index 312231f648f3..dc4a967e7ac6 100644
--- a/pkgs/desktops/gnome-3/core/libcroco/default.nix
+++ b/pkgs/development/libraries/libcroco/default.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libxml2, glib, fetchpatch, gnome3 }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libcroco";
   version = "0.6.12";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0q7qhi7z64i26zabg9dbs5706fa8pmzp1qhpa052id4zdiabbi6x";
   };
 
diff --git a/pkgs/desktops/gnome-3/core/libgdata/default.nix b/pkgs/development/libraries/libgdata/default.nix
index 4cbf0a78d894..f22cc568a97c 100644
--- a/pkgs/desktops/gnome-3/core/libgdata/default.nix
+++ b/pkgs/development/libraries/libgdata/default.nix
@@ -1,30 +1,27 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib
+{ stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib, gcr
 , gobject-introspection, liboauth, gnome3, p11-kit, openssl, uhttpmock }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgdata";
   version = "0.17.9";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0fj54yqxdapdppisqm1xcyrpgcichdmipq0a0spzz6009ikzgi45";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${gnome3.libsoup.dev}/include/libsoup-gnome-2.4/ -I${gnome3.gcr}/include/gcr-3 -I${gnome3.gcr}/include/gck-1";
+  NIX_CFLAGS_COMPILE = "-I${gnome3.libsoup.dev}/include/libsoup-gnome-2.4/ -I${gcr}/include/gcr-3 -I${gcr}/include/gck-1";
+
+  nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
 
   buildInputs = with gnome3;
-    [ pkgconfig libsoup intltool libxml2 glib gobject-introspection
-      liboauth gcr gnome-online-accounts p11-kit openssl uhttpmock ];
+    [ libsoup libxml2 glib liboauth gcr gnome-online-accounts p11-kit openssl uhttpmock ];
 
   propagatedBuildInputs = [ json-glib ];
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none"; # Stable version has not been updated for a long time.
     };
   };
@@ -36,5 +33,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.lgpl21Plus;
   };
-
 }
diff --git a/pkgs/desktops/gnome-3/core/libgee/default.nix b/pkgs/development/libraries/libgee/default.nix
index 2de8b430843c..260c3a3d97bf 100644
--- a/pkgs/desktops/gnome-3/core/libgee/default.nix
+++ b/pkgs/development/libraries/libgee/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl, autoconf, vala, pkgconfig, glib, gobject-introspection, gnome3 }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libgee";
   version = "0.20.1";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0c26x8gi3ivmhlbqcmiag4jwrkvcy28ld24j55nqr3jikb904a5v";
   };
 
@@ -24,7 +22,6 @@ stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/core/libgepub/default.nix b/pkgs/development/libraries/libgepub/default.nix
index 26531a61ffaa..70ec222f88fb 100644
--- a/pkgs/desktops/gnome-3/core/libgepub/default.nix
+++ b/pkgs/development/libraries/libgepub/default.nix
@@ -1,14 +1,12 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, glib, gobject-introspection, gnome3
 , webkitgtk, libsoup, libxml2, libarchive }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgepub";
   version = "0.6.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "16dkyywqdnfngmwsgbyga0kl9vcnzczxi3lmhm27pifrq5f3k2n7";
   };
 
@@ -20,7 +18,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix b/pkgs/development/libraries/libgit2-glib/default.nix
index 8d078ea41e78..498858d52e91 100644
--- a/pkgs/desktops/gnome-3/misc/libgit2-glib/default.nix
+++ b/pkgs/development/libraries/libgit2-glib/default.nix
@@ -2,12 +2,12 @@
 , gtk-doc, gobject-introspection, libgit2, glib, python3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgit2-glib-${version}";
-  version = "0.26.4";
+  pname = "libgit2-glib";
+  version = "0.27.7";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libgit2-glib/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0nhyqas110q7ingw97bvyjdb7v4dzch517dq8sn8c33s8910wqcp";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1hpgs8dx0dk25mc8jsizi2cwwhnmahrn3dyry9p7a1g48mnxyc8i";
   };
 
   postPatch = ''
@@ -18,7 +18,10 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "libgit2-glib"; attrPath = "gnome3.libgit2-glib"; };
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+      versionPolicy = "none";
+    };
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/libgnomekbd/default.nix b/pkgs/development/libraries/libgnomekbd/default.nix
index a9b27fa65a47..20a9bb91604e 100644
--- a/pkgs/desktops/gnome-3/core/libgnomekbd/default.nix
+++ b/pkgs/development/libraries/libgnomekbd/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, pkgconfig, file, intltool, glib, gtk3, libxklavier, makeWrapper, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgnomekbd-${version}";
+  pname = "libgnomekbd";
   version = "3.26.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libgnomekbd/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "ea3b418c57c30615f7ee5b6f718def7c9d09ce34637324361150744258968875";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "libgnomekbd"; attrPath = "gnome3.libgnomekbd"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   nativeBuildInputs = [ pkgconfig file intltool makeWrapper ];
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index e713eb7f8918..05ae29358fa4 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -17,11 +17,11 @@
   };
 in stdenv.mkDerivation (rec {
   name = "libgpg-error-${version}";
-  version = "1.32";
+  version = "1.33";
 
   src = fetchurl {
     url = "mirror://gnupg/libgpg-error/${name}.tar.bz2";
-    sha256 = "1jj08ns4sh1hmafqp1giskvdicdz18la516va26jycy27kkwaif3";
+    sha256 = "1zq3pw93d0ani8bam7f4qjivll1b0zg9qbblwwvcjip7ark84f2x";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libgsf/default.nix b/pkgs/development/libraries/libgsf/default.nix
index bcd37396bf7f..4e7ff0314381 100644
--- a/pkgs/development/libraries/libgsf/default.nix
+++ b/pkgs/development/libraries/libgsf/default.nix
@@ -1,12 +1,13 @@
 { fetchurl, stdenv, pkgconfig, intltool, gettext, glib, libxml2, zlib, bzip2
-, python, perl, gdk_pixbuf, libiconv, libintl }:
+, python, perl, gdk_pixbuf, libiconv, libintl, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "libgsf-1.14.44";
+  pname = "libgsf";
+  version = "1.14.45";
 
   src = fetchurl {
-    url    = "mirror://gnome/sources/libgsf/1.14/${name}.tar.xz";
-    sha256 = "1ppzfk3zmmgrg9jh8vc4dacddbfngjslq2wpj94pcr3i0c8dxgk8";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1yk91ccf7z9b8d8ac6vip3gc5c0pkwgabqy6l0pj0kf43l7jrg2w";
   };
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
@@ -21,6 +22,12 @@ stdenv.mkDerivation rec {
   doCheck = true;
   preCheck = "patchShebangs ./tests/";
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "GNOME's Structured File Library";
     homepage    = https://www.gnome.org/projects/libgsf;
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index aad6365e4c2d..4e43ef91e79f 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
-, ncurses, cpio, gperf, perl, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
+, ncurses, cpio, gperf, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
 , acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex
-, gmp, readline, file, libintl_perl, GetoptLong, SysVirt, numactl, xen, libapparmor
+, gmp, readline, file, numactl, xen, libapparmor
 , getopt, perlPackages, ocamlPackages
 , appliance ? null
 , javaSupport ? false, jdk ? null }:
@@ -20,11 +20,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    makeWrapper autoreconfHook ncurses cpio gperf perl
+    makeWrapper autoreconfHook ncurses cpio gperf
     cdrkit flex bison qemu pcre augeas libxml2 acl libcap libcap_ng libconfig
-    systemd fuse yajl libvirt gmp readline file hivex libintl_perl GetoptLong
-    SysVirt numactl xen libapparmor getopt perlPackages.ModuleBuild
-  ] ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt ocaml_gettext ounit ])
+    systemd fuse yajl libvirt gmp readline file hivex
+    numactl xen libapparmor getopt perlPackages.ModuleBuild
+  ] ++ (with perlPackages; [ perl libintl_perl GetoptLong SysVirt ])
+    ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt ocaml_gettext ounit ])
     ++ stdenv.lib.optional javaSupport jdk;
 
   prePatch = ''
@@ -52,7 +53,7 @@ stdenv.mkDerivation rec {
     for bin in $out/bin/*; do
       wrapProgram "$bin" \
         --prefix PATH     : "$out/bin:${hivex}/bin:${qemu}/bin" \
-        --prefix PERL5LIB : "$out/lib/perl5/site_perl"
+        --prefix PERL5LIB : "$out/${perlPackages.perl.libPrefix}"
     done
   '';
 
diff --git a/pkgs/desktops/gnome-3/core/libgweather/default.nix b/pkgs/development/libraries/libgweather/default.nix
index f9feb21749ae..b5fda25a8c55 100644
--- a/pkgs/desktops/gnome-3/core/libgweather/default.nix
+++ b/pkgs/development/libraries/libgweather/default.nix
@@ -1,21 +1,19 @@
-{ stdenv, fetchurl, meson, ninja, pkgconfig, libxml2, glib, gtk, gettext, libsoup
+{ stdenv, fetchurl, meson, ninja, pkgconfig, libxml2, glib, gtk3, gettext, libsoup
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43, gobject-introspection, python3, tzdata, geocode-glib, vala, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgweather";
   version = "3.28.2";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0xfy5ghwvnz2g9074dy6512m4z2pv66pmja14vhi9imgacbfh708";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext vala gtk-doc docbook_xsl docbook_xml_dtd_43 gobject-introspection python3 ];
-  buildInputs = [ glib gtk libsoup libxml2 geocode-glib ];
+  buildInputs = [ glib gtk3 libsoup libxml2 geocode-glib ];
 
   postPatch = ''
     chmod +x meson/meson_post_install.py
@@ -31,7 +29,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
diff --git a/pkgs/desktops/gnome-3/core/libgxps/default.nix b/pkgs/development/libraries/libgxps/default.nix
index 852a546f4bf3..3b7f29de573f 100644
--- a/pkgs/desktops/gnome-3/core/libgxps/default.nix
+++ b/pkgs/development/libraries/libgxps/default.nix
@@ -2,14 +2,12 @@
 , libarchive, freetype, libjpeg, libtiff, gnome3, fetchpatch
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libgxps";
   version = "0.3.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "412b1343bd31fee41f7204c47514d34c563ae34dafa4cc710897366bd6cd0fae";
   };
 
@@ -38,7 +36,6 @@ in stdenv.mkDerivation rec {
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 1a903978fb8d..a1563420630b 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -2,25 +2,36 @@
 , libevdev, mtdev, udev, libwacom
 , documentationSupport ? false, doxygen ? null, graphviz ? null # Documentation
 , eventGUISupport ? false, cairo ? null, glib ? null, gtk3 ? null # GUI event viewer support
-, testsSupport ? false, check ? null, valgrind ? null, python3Packages ? null
+, testsSupport ? false, check ? null, valgrind ? null, python3 ? null
 }:
 
-assert documentationSupport -> doxygen != null && graphviz != null;
+assert documentationSupport -> doxygen != null && graphviz != null && python3 != null;
 assert eventGUISupport -> cairo != null && glib != null && gtk3 != null;
-assert testsSupport -> check != null && valgrind != null && python3Packages != null;
+assert testsSupport -> check != null && valgrind != null && python3 != null;
 
 let
   mkFlag = optSet: flag: "-D${flag}=${stdenv.lib.boolToString optSet}";
+
+  sphinx-build = if documentationSupport then
+    python3.pkgs.sphinx.overrideAttrs (super: {
+      propagatedBuildInputs = super.propagatedBuildInputs ++ (with python3.pkgs; [ recommonmark sphinx_rtd_theme ]);
+
+      postFixup = super.postFixup or "" + ''
+        # Do not propagate Python
+        rm $out/nix-support/propagated-build-inputs
+      '';
+    })
+  else null;
 in
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "0mg2zqbjcgj0aq7d9nwawvyhx43vakilahrc83hrfyif3a3gyrpj";
+    sha256 = "1riircgrj002w1sd1053aq9098s6ys99gya0k0crhb9f3ij2kwx4";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -32,18 +43,25 @@ stdenv.mkDerivation rec {
     "--libexecdir=${placeholder "bin"}/libexec"
   ];
 
-  nativeBuildInputs = [ pkgconfig meson ninja python3Packages.python ]
-    ++ optionals documentationSupport [ doxygen graphviz ]
-    ++ optionals testsSupport [ check valgrind python3Packages.pyparsing ];
+  nativeBuildInputs = [ pkgconfig meson ninja ]
+    ++ optionals documentationSupport [ doxygen graphviz sphinx-build ]
+    ++ optionals testsSupport [ valgrind ];
 
-  buildInputs = [ libevdev mtdev libwacom ]
-    ++ optionals eventGUISupport [ cairo glib gtk3 ];
+  buildInputs = [ libevdev mtdev libwacom (python3.withPackages (pkgs: with pkgs; [ evdev ])) ]
+    ++ optionals eventGUISupport [ cairo glib gtk3 ]
+    ++ optionals testsSupport [ check ];
 
   propagatedBuildInputs = [ udev ];
 
   patches = [ ./udev-absolute-path.patch ];
 
-  doCheck = testsSupport;
+  postPatch = ''
+    patchShebangs tools/helper-copy-and-exec-from-tmp.sh
+    patchShebangs test/symbols-leak-test
+    patchShebangs test/check-leftover-udev-rules.sh
+  '';
+
+  doCheck = testsSupport && stdenv.hostPlatform == stdenv.buildPlatform;
 
   meta = {
     description = "Handles input devices in Wayland compositors and provides a generic X.Org input driver";
diff --git a/pkgs/desktops/gnome-3/misc/libmediaart/default.nix b/pkgs/development/libraries/libmediaart/default.nix
index fac5db943871..48bd959009a1 100644
--- a/pkgs/desktops/gnome-3/misc/libmediaart/default.nix
+++ b/pkgs/development/libraries/libmediaart/default.nix
@@ -1,24 +1,24 @@
-{ stdenv, fetchurl, pkgconfig, glib, gdk_pixbuf, gobject-introspection, gnome3 }:
+{ stdenv, fetchurl, meson, ninja, pkgconfig, vala, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, gdk_pixbuf, gobject-introspection, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libmediaart";
   version = "1.9.4";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "a57be017257e4815389afe4f58fdacb6a50e74fd185452b23a652ee56b04813d";
   };
 
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+  nativeBuildInputs = [ meson ninja pkgconfig vala gtk-doc docbook_xsl docbook_xml_dtd_412 gobject-introspection ];
   buildInputs = [ glib gdk_pixbuf ];
 
+  doCheck = true;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
       versionPolicy = "none";
     };
   };
diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 7e3c45634d9e..aa606e2a177e 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
     mkdir -p $out/lib
     cd libmilter
     cat > a.m4 <<EOF
+      define(\`confCC', \`$CC')
+      define(\`confAR', \`$AR')
       define(\`confEBINDIR', \`$out/libexec')
       define(\`confINCLUDEDIR', \`$out/include')
       define(\`confLIBDIR', \`$out/lib')
@@ -29,9 +31,9 @@ stdenv.mkDerivation rec {
     sh Build -f ./a.m4
   '';
 
-  patches = [ ./install.patch ./sharedlib.patch];
+  patches = [ ./install.patch ./sharedlib.patch ];
 
-  buildInputs = [ m4 ];
+  nativeBuildInputs = [ m4 ];
 
   meta = with stdenv.lib; {
     description = "Sendmail Milter mail filtering API library";
diff --git a/pkgs/desktops/gnome-3/core/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index fdbeb94c5054..314d5884501f 100644
--- a/pkgs/desktops/gnome-3/core/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -1,32 +1,34 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnome3
-, glib, gtk3, gobject-introspection, python3Packages, ncurses
+, glib, gtk3, gobject-introspection, python3, ncurses
 }:
 
 stdenv.mkDerivation rec {
-  name = "libpeas-${version}";
+  pname = "libpeas";
   version = "1.22.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/libpeas/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0qm908kisyjzjxvygdl18hjqxvvgkq9w0phs2g55pck277sw0bsv";
   };
 
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = "libpeas"; attrPath = "gnome3.libpeas"; };
-  };
-
   configureFlags = [ "--enable-python3" ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs =  [ intltool glib gtk3 gnome3.defaultIconTheme ncurses python3Packages.python python3Packages.pygobject3 ];
+  nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
+  buildInputs =  [ glib gtk3 ncurses python3 python3.pkgs.pygobject3 ];
   propagatedBuildInputs = [
     # Required by libpeas-1.0.pc
     gobject-introspection
   ];
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "A GObject-based plugins engine";
-    homepage = http://ftp.acc.umu.se/pub/GNOME/sources/libpeas/;
+    homepage = https://wiki.gnome.org/Projects/Libpeas;
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = gnome3.maintainers;
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index ffd195b6462d..d64591273bcc 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -9,7 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "0jabhjx77yppr7x38bkfww6n2a480gj62rw0qp7prhdmg19mf766";
   };
 
-  installFlags = "DESTDIR=\${out} PREFIX= LDCONFIG=true";
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "LDCONFIG=true"
+    "ARCH=${stdenv.targetPlatform.uname.processor}"
+    "SYS=${stdenv.targetPlatform.uname.system}"
+  ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
 
diff --git a/pkgs/desktops/gnome-3/core/rest/default.nix b/pkgs/development/libraries/librest/default.nix
index 70cc31cd706c..e70ac9a53626 100644
--- a/pkgs/desktops/gnome-3/core/rest/default.nix
+++ b/pkgs/development/libraries/librest/default.nix
@@ -1,29 +1,28 @@
 { stdenv, fetchurl, pkgconfig, glib, libsoup, gobject-introspection, gnome3 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "rest";
   version = "0.8.1";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0513aad38e5d3cedd4ae3c551634e3be1b9baaa79775e53b2dba9456f15b01c9";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ glib libsoup gobject-introspection];
+  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+  buildInputs = [ glib libsoup ];
 
   configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
+      attrPath = "librest";
     };
   };
 
   meta = with stdenv.lib; {
+    description = "Helper library for RESTful services";
     homepage = https://wiki.gnome.org/Projects/Librest;
     license = licenses.lgpl21;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 5a5fa3e279ab..602b6708df07 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -5,14 +5,14 @@
 
 let
   pname = "librsvg";
-  version = "2.44.9";
+  version = "2.44.10";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1ivg7cz7zlfjhnxvp7z2344r8r0z02mjh4mpgy823az6ps62igwj";
+    sha256 = "1bnasw669dzyxmnx51ymnhbjgb5d4gb1pb3f26qyh017ajqrdz7l";
   };
 
   outputs = [ "out" "dev" "installedTests" ];
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index e67ecea07764..f1b9d349a428 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, cmake, zlib, openssl, libsodium }:
 
 stdenv.mkDerivation rec {
-  name = "libssh-0.8.4";
+  name = "libssh-0.8.5";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/0.8/${name}.tar.xz";
-    sha256 = "06xqfm1alfb6faqzjhyhjs0arjcd8rnc7ci046x8d18s089pgc3b";
+    sha256 = "0dd3nmd20jw4z116qbz3wbffxbzrczi6mcxw0rmqzj0g4hqw9lh7";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 6cfc5060b610..da367b52cc0d 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libwacom-${version}";
-  version = "0.31";
+  version = "0.32";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "0qjd4bn2abwzic34cm0sw3srx02spszbsvfdbzbpn2cb62b5gjmw";
+    sha256 = "15fz2z2h2awh2l08cv663s1zk4z8bmvvivwnnfvx2q8lkqgfkr7f";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/desktops/gnome-3/core/libzapojit/default.nix b/pkgs/development/libraries/libzapojit/default.nix
index 5c0291767877..2ad017dc90be 100644
--- a/pkgs/desktops/gnome-3/core/libzapojit/default.nix
+++ b/pkgs/development/libraries/libzapojit/default.nix
@@ -1,30 +1,28 @@
-{ stdenv, fetchurl, pkgconfig, glib, intltool, json-glib, rest, libsoup, gnome-online-accounts, gnome3, gobject-introspection }:
-let
+{ stdenv, fetchurl, pkgconfig, glib, intltool, json-glib, librest, libsoup, gnome3, gobject-introspection }:
+
+stdenv.mkDerivation rec {
   pname = "libzapojit";
   version = "0.0.3";
-in
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0zn3s7ryjc3k1abj4k55dr2na844l451nrg9s6cvnnhh569zj99x";
   };
 
   nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
-  propagatedBuildInputs = [ glib json-glib rest libsoup gnome-online-accounts ]; # zapojit-0.0.pc
+  propagatedBuildInputs = [ glib json-glib librest libsoup gnome3.gnome-online-accounts ]; # zapojit-0.0.pc
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
-      attrPath = "gnome3.${pname}";
     };
   };
 
   meta = with stdenv.lib; {
     description = "GObject wrapper for the SkyDrive and Hotmail REST APIs";
+    homepage = https://wiki.gnome.org/Projects/Zapojit;
     license = licenses.lgpl21Plus;
     maintainers = gnome3.maintainers;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index faf1261da4a5..9b496134774a 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, intltool, autoreconfHook
 , file, expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
-, libelf, libvdpau, valgrind-light, python2
+, libelf, libvdpau, valgrind-light, python2, python2Packages
 , libglvnd
 , enableRadv ? true
 , galliumDrivers ? null
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "18.2.6";
+  version = "18.3.1";
   branch  = head (splitString "." version);
 in
 
@@ -81,7 +81,7 @@ let self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "04nwxykmc80gicmal0zkk8is34rmbqawmfckirqhrps9h97zmfly";
+    sha256 = "0qyw9dj2p9n91qzc4ylck2an7ibssjvzi2bjcpv2ajk851yq47sv";
   };
 
   prePatch = "patchShebangs .";
@@ -134,11 +134,14 @@ let self = stdenv.mkDerivation {
     "--disable-opencl"
   ];
 
-  nativeBuildInputs = [ autoreconfHook intltool pkgconfig file ];
+  nativeBuildInputs = [
+    autoreconfHook intltool pkgconfig file
+    python2 python2Packages.Mako
+  ];
 
-  propagatedBuildInputs = with xorg;
-    [ libXdamage libXxf86vm ]
-    ++ optional stdenv.isLinux libdrm
+  propagatedBuildInputs = with xorg; [
+    libXdamage libXxf86vm
+  ] ++ optional stdenv.isLinux libdrm
     ++ optionals stdenv.isDarwin [ OpenGL Xplugin ];
 
   buildInputs = with xorg; [
@@ -146,10 +149,9 @@ let self = stdenv.mkDerivation {
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence libXrandr
     libffi libvdpau libelf libXvMC
-    libpthreadstubs openssl/*or another sha1 provider*/
-    valgrind-light python2 python2.pkgs.Mako
+    libpthreadstubs openssl /*or another sha1 provider*/
   ] ++ lib.optionals (elem "wayland" eglPlatforms) [ wayland wayland-protocols ]
-    ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ];
+    ++ lib.optionals stdenv.isLinux [ valgrind-light libomxil-bellagio libva-minimal ];
 
   enableParallelBuilding = true;
   doCheck = false;
@@ -161,7 +163,10 @@ let self = stdenv.mkDerivation {
   ];
 
   # TODO: probably not all .la files are completely fixed, but it shouldn't matter;
-  postInstall = optionalString (galliumDrivers != []) ''
+  postInstall = ''
+    # Some installs don't have any drivers so this directory is never created.
+    mkdir -p $drivers
+  '' + optionalString (galliumDrivers != []) ''
     # move gallium-related stuff to $drivers, so $out doesn't depend on LLVM
     mv -t "$drivers/lib/"    \
       $out/lib/libXvMC*      \
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 815db76d5ac3..f5995a8f480e 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
     "--enable-pc-files"
     "--enable-symlinks"
     "--with-manpage-format=normal"
+    "--disable-stripping"
   ] ++ lib.optional unicode "--enable-widec"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 5b998926f0a5..900451351c82 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.4";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "150y8655h629wn946dvzasq16qxsc1m9nf58mifvhl350bgl4ymf";
+    sha256 = "1bcji95n1iz9p9vsgdgr26v6s7zhpsxfbjjwpqcihpfd6lawyhgr";
   };
 })
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 4d48ae0b12bd..f8b993d202ab 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -5,7 +5,7 @@ let
     url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
   };
-  version = "3.40.1";
+  version = "3.41";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${name}.tar.gz";
-    sha256 = "1wf8qapd2lh8pbjd6pp9m32mx1zyddrmv5c4cr86xj3r5ap6n3jy";
+    sha256 = "0bbif42fzz5gk451sv3yphdrl7m4p6zgk5jk0307j06xs3sihbmb";
   };
 
   buildInputs = [ perl zlib sqlite ]
diff --git a/pkgs/development/libraries/opendkim/default.nix b/pkgs/development/libraries/opendkim/default.nix
index 71c2e56f5410..3d110910b159 100644
--- a/pkgs/development/libraries/opendkim/default.nix
+++ b/pkgs/development/libraries/opendkim/default.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
     sha256 = "06v8bqhh604sz9rh5bvw278issrwjgc4h1wx2pz9a84lpxbvm823";
   };
 
-  configureFlags= [ "--with-milter=${libmilter}" ];
+  configureFlags= [
+    "--with-milter=${libmilter}"
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
diff --git a/pkgs/development/libraries/openjpeg/2.x.nix b/pkgs/development/libraries/openjpeg/2.x.nix
index fd9c7eea8c2e..3aa2fdf0dd25 100644
--- a/pkgs/development/libraries/openjpeg/2.x.nix
+++ b/pkgs/development/libraries/openjpeg/2.x.nix
@@ -6,6 +6,11 @@ callPackage ./generic.nix (args // rec {
   revision = "v${version}";
   sha256 = "08plxrnfl33sn2vh5nwbsngyv6b1sfpplvx881crm1v1ai10m2lz";
 
+  extraFlags = [
+    "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/openjpeg-${branch}"
+    "-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/openjpeg-${branch}"
+  ];
+
   patches = [
     (fetchpatch {
       name = "CVE-2018-7648.patch";
@@ -17,5 +22,10 @@ callPackage ./generic.nix (args // rec {
       url = "https://github.com/uclouvain/openjpeg/commit/92023cd6c377e0384a7725949b25655d4d94dced.patch";
       sha256 = "0rrxxqcp3vjkmvywxj9ac766m3fppy0x0nszrkf8irrqy1gnp38k";
     })
+    (fetchpatch {
+      url = https://github.com/uclouvain/openjpeg/commit/24fd3ce777a64b8b315cfe1ee642ec7b1cc6aa97.patch;
+      sha256 = "1sl5wplgdfiqw8qbd8s5j5hq3ynbwgsnv8nxqfrk5s7vyrzx9pxv";
+    })
+    ./fix-cmake-config-includedir.patch
   ];
 })
diff --git a/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
new file mode 100644
index 000000000000..6ff720ead4e1
--- /dev/null
+++ b/pkgs/development/libraries/openjpeg/fix-cmake-config-includedir.patch
@@ -0,0 +1,55 @@
+--- a/cmake/OpenJPEGConfig.cmake.in
++++ b/cmake/OpenJPEGConfig.cmake.in
+@@ -32,7 +32,7 @@
+   set(INC_DIR "@CMAKE_INSTALL_PREFIX@/@OPENJPEG_INSTALL_INCLUDE_DIR@")
+   file(RELATIVE_PATH PKG_TO_INC_RPATH "${PKG_DIR}" "${INC_DIR}")
+ 
+-  get_filename_component(OPENJPEG_INCLUDE_DIRS "${SELF_DIR}/${PKG_TO_INC_RPATH}" ABSOLUTE)
++  get_filename_component(OPENJPEG_INCLUDE_DIRS "@OPENJPEG_INSTALL_INCLUDE_DIR@" ABSOLUTE)
+ 
+ else()
+   if(EXISTS ${SELF_DIR}/OpenJPEGExports.cmake)
+--- a/src/lib/openjp2/libopenjp2.pc.cmake.in
++++ b/src/lib/openjp2/libopenjp2.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjp2
+ Description: JPEG2000 library (Part 1 and 2)
+--- a/src/lib/openjp3d/libopenjp3d.pc.cmake.in
++++ b/src/lib/openjp3d/libopenjp3d.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjp3d
+ Description: JPEG2000 Extensions for three-dimensional data (Part 10)
+--- a/src/lib/openjpip/libopenjpip.pc.cmake.in
++++ b/src/lib/openjpip/libopenjpip.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjpip
+ Description: JPEG2000 Interactivity tools, APIs and protocols (Part 9)
+--- a/src/lib/openjpwl/libopenjpwl.pc.cmake.in
++++ b/src/lib/openjpwl/libopenjpwl.pc.cmake.in
+@@ -3,7 +3,7 @@
+ mandir=${prefix}/@OPENJPEG_INSTALL_MAN_DIR@
+ docdir=${prefix}/@OPENJPEG_INSTALL_DOC_DIR@
+ libdir=${prefix}/@OPENJPEG_INSTALL_LIB_DIR@
+-includedir=${prefix}/@OPENJPEG_INSTALL_INCLUDE_DIR@
++includedir=@OPENJPEG_INSTALL_INCLUDE_DIR@
+ 
+ Name: openjpwl
+ Description: JPEG2000 Wireless library (Part 11)
diff --git a/pkgs/development/libraries/openjpeg/generic.nix b/pkgs/development/libraries/openjpeg/generic.nix
index 96cf0451ebf4..d3130a64b030 100644
--- a/pkgs/development/libraries/openjpeg/generic.nix
+++ b/pkgs/development/libraries/openjpeg/generic.nix
@@ -11,7 +11,7 @@
 , testsSupport ? false
 , jdk ? null
 # Inherit generics
-, branch, version, revision, sha256, patches ? [], ...
+, branch, version, revision, sha256, patches ? [], extraFlags ? [], ...
 }:
 
 assert jpipServerSupport -> jpipLibSupport && curl != null && fcgi != null;
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     (mkFlag jp3dSupport "BUILD_JP3D")
     (mkFlag thirdPartySupport "BUILD_THIRDPARTY")
     (mkFlag testsSupport "BUILD_TESTING")
-  ];
+  ] ++ extraFlags;
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 16e00e9f2b95..0a5f83d1c7c6 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -13,18 +13,27 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ openssl cyrus_sasl db groff libtool ];
-
-  configureFlags =
-    [ "--enable-overlays"
-      "--disable-dependency-tracking"   # speeds up one-time build
-      "--enable-modules"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-      "--enable-crypt"
-    ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
-      ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
-      ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
+  nativeBuildInputs = [ groff ];
+
+  buildInputs = [ openssl cyrus_sasl db libtool ];
+
+  # Disable install stripping as it breaks cross-compiling.
+  # We strip binaries anyway in fixupPhase.
+  makeFlags= [ "STRIP=" ];
+
+  configureFlags = [
+    "--enable-overlays"
+    "--disable-dependency-tracking"   # speeds up one-time build
+    "--enable-modules"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-crypt"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "--with-yielding_select=yes"
+    "ac_cv_func_memcmp_working=yes"
+  ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
+    ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
+    ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
 
   doCheck = false; # needs a running LDAP server
 
diff --git a/pkgs/development/libraries/pangomm/default.nix b/pkgs/development/libraries/pangomm/default.nix
index 93c2501a6203..064ebf71cc32 100644
--- a/pkgs/development/libraries/pangomm/default.nix
+++ b/pkgs/development/libraries/pangomm/default.nix
@@ -1,16 +1,13 @@
-{ stdenv, fetchurl, pkgconfig, pango, glibmm, cairomm
+{ stdenv, fetchurl, pkgconfig, pango, glibmm, cairomm, gnome3
 , ApplicationServices }:
 
-let
-  ver_maj = "2.40";
-  ver_min = "1";
-in
 stdenv.mkDerivation rec {
-  name = "pangomm-${ver_maj}.${ver_min}";
+  pname = "pangomm";
+  version= "2.42.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/pangomm/${ver_maj}/${name}.tar.xz";
-    sha256 = "9762ee2a2d5781be6797448d4dd2383ce14907159b30bc12bf6b08e7227be3af";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0mmzxp3wniaafkxr30sb22mq9x44xckb5d60h1bl99lkzxks0vfa";
   };
 
   outputs = [ "out" "dev" ];
@@ -22,6 +19,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "C++ interface to the Pango text rendering library";
     homepage    = https://www.pango.org/;
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 8093aec6bcc6..83f19e442c60 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -72,13 +72,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = "INTROSPECTION_GIRDIR=$(out)/share/gir-1.0 INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0";
 
-  # The following is required on grsecurity/PaX due to spidermonkey's JIT
-  postBuild = stdenv.lib.optionalString stdenv.isLinux ''
-    paxmark mr src/polkitbackend/.libs/polkitd
-  '' + stdenv.lib.optionalString (stdenv.isLinux && doCheck) ''
-    paxmark mr test/polkitbackend/.libs/polkitbackendjsauthoritytest
-  '';
-
   installFlags=["datadir=$(out)/share" "sysconfdir=$(out)/etc"];
 
   inherit doCheck;
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 53ed04527a84..e5b469f73956 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let # beware: updates often break cups-filters build
-  version = "0.67.0";
+  version = "0.72.0";
   mkFlag = optset: flag: "-DENABLE_${flag}=${if optset then "on" else "off"}";
 in
 stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "1yb6agmcxf0ixqm65d4aknl0hgmswf94x0k59ic0qqav1wd4yjm3";
+    sha256 = "0lfs1b1jfamxl13zbl5n448dqvl9n8frbv8180y7b7kfyaw7wx61";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/qt-5/5.11/default.nix b/pkgs/development/libraries/qt-5/5.11/default.nix
index 6f90f1cea7f0..5fbab32acda8 100644
--- a/pkgs/development/libraries/qt-5/5.11/default.nix
+++ b/pkgs/development/libraries/qt-5/5.11/default.nix
@@ -61,7 +61,6 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index e1621b005c61..000000000000
--- a/pkgs/development/libraries/qt-5/5.11/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/src/3rdparty/chromium/v8/src/v8.gyp b/chromium/v8/src/v8.gyp
-index e7e19f5059..934448c7d8 100644
---- a/src/3rdparty/chromium/v8/src/v8.gyp
-+++ b/src/3rdparty/chromium/v8/src/v8.gyp
-@@ -35,6 +35,7 @@
-     'v8_extra_library_files%': [],
-     'v8_experimental_extra_library_files%': [],
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'v8_os_page_size%': 0,
-   },
-   'includes': ['../gypfiles/toolchain.gypi', '../gypfiles/features.gypi', 'inspector/inspector.gypi'],
-@@ -2576,7 +2577,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': [
-         'v8_base',
-@@ -2606,5 +2607,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
new file mode 100644
index 000000000000..22535deb7678
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -0,0 +1,146 @@
+/*
+
+# Updates
+
+Before a major version update, make a copy of this directory. (We like to
+keep the old version around for a short time after major updates.) Add a
+top-level attribute to `top-level/all-packages.nix`.
+
+1. Update the URL in `pkgs/development/libraries/qt-5/$VERSION/fetch.sh`.
+2. From the top of the Nixpkgs tree, run
+   `./maintainers/scripts/fetch-kde-qt.sh > pkgs/development/libraries/qt-5/$VERSION/srcs.nix`.
+3. Update `qtCompatVersion` below if the minor version number changes.
+4. Check that the new packages build correctly.
+5. Commit the changes and open a pull request.
+
+*/
+
+{
+  newScope,
+  stdenv, fetchurl, fetchFromGitHub, makeSetupHook,
+  bison, cups ? null, harfbuzz, libGL, perl,
+  gstreamer, gst-plugins-base, gtk3, dconf,
+  cf-private,
+
+  # options
+  developerBuild ? false,
+  decryptSslTraffic ? false,
+  debug ? false,
+}:
+
+with stdenv.lib;
+
+let
+
+  qtCompatVersion = "5.12";
+
+  mirror = "https://download.qt.io";
+  srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
+    # Community port of the now unmaintained upstream qtwebkit.
+    qtwebkit = {
+      src = fetchFromGitHub {
+        owner = "annulen";
+        repo = "webkit";
+        rev = "4ce8ebc4094512b9916bfa5984065e95ac97c9d8";
+        sha256 = "05h1xnxzbf7sp3plw5dndsvpf6iigh0bi4vlj4svx0hkf1giakjf";
+      };
+      version = "5.212-alpha-01-26-2018";
+    };
+  };
+
+  patches = {
+    qtbase = [
+      ./qtbase.patch
+      ./qtbase-darwin.patch
+      ./qtbase-revert-no-macos10.10.patch
+      ./qtbase-fixguicmake.patch
+    ] ++ optionals stdenv.isDarwin [
+      ./qtbase-darwin-nseventtype.patch
+    ];
+    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtscript = [ ./qtscript.patch ];
+    qtserialport = [ ./qtserialport.patch ];
+    qtwebkit = [ ./qtwebkit.patch ];
+  };
+
+  mkDerivation =
+    import ../mkDerivation.nix
+    { inherit stdenv; inherit (stdenv) lib; }
+    { inherit debug; };
+
+  qtModule =
+    import ../qtModule.nix
+    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    { inherit self srcs patches; };
+
+  addPackages = self: with self;
+    let
+      callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
+    in {
+
+      inherit mkDerivation;
+
+      qtbase = callPackage ../modules/qtbase.nix {
+        inherit (srcs.qtbase) src version;
+        patches = patches.qtbase;
+        inherit bison cups harfbuzz libGL;
+        withGtk3 = true; inherit dconf gtk3;
+        inherit developerBuild decryptSslTraffic;
+      };
+
+      qtcharts = callPackage ../modules/qtcharts.nix {};
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
+      qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
+      qtdoc = callPackage ../modules/qtdoc.nix {};
+      qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
+      qtimageformats = callPackage ../modules/qtimageformats.nix {};
+      qtlocation = callPackage ../modules/qtlocation.nix {};
+      qtmacextras = callPackage ../modules/qtmacextras.nix {
+        inherit cf-private;
+      };
+      qtmultimedia = callPackage ../modules/qtmultimedia.nix {
+        inherit gstreamer gst-plugins-base;
+      };
+      qtquick1 = null;
+      qtquickcontrols = callPackage ../modules/qtquickcontrols.nix {};
+      qtquickcontrols2 = callPackage ../modules/qtquickcontrols2.nix {};
+      qtscript = callPackage ../modules/qtscript.nix {};
+      qtsensors = callPackage ../modules/qtsensors.nix {};
+      qtserialport = callPackage ../modules/qtserialport.nix {};
+      qtspeech = callPackage ../modules/qtspeech.nix {};
+      qtsvg = callPackage ../modules/qtsvg.nix {};
+      qttools = callPackage ../modules/qttools.nix {};
+      qttranslations = callPackage ../modules/qttranslations.nix {};
+      qtvirtualkeyboard = callPackage ../modules/qtvirtualkeyboard.nix {};
+      qtwayland = callPackage ../modules/qtwayland.nix {};
+      qtwebchannel = callPackage ../modules/qtwebchannel.nix {};
+      qtwebengine = callPackage ../modules/qtwebengine.nix {};
+      qtwebglplugin = callPackage ../modules/qtwebglplugin.nix {};
+      qtwebkit = callPackage ../modules/qtwebkit.nix {};
+      qtwebsockets = callPackage ../modules/qtwebsockets.nix {};
+      qtx11extras = callPackage ../modules/qtx11extras.nix {};
+      qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
+
+      env = callPackage ../qt-env.nix {};
+      full = env "qt-full-${qtbase.version}" ([
+        qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
+        qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
+        qtscript qtsensors qtserialport qtsvg qttools qttranslations
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtx11extras qtxmlpatterns
+      ] ++ optional (!stdenv.isDarwin) qtwayland
+        ++ optional (stdenv.isDarwin) qtmacextras);
+
+      qmake = makeSetupHook {
+        deps = [ self.qtbase.dev ];
+        substitutions = {
+          inherit (stdenv) isDarwin;
+          qtbase_dev = self.qtbase.dev;
+          fix_qt_builtin_paths = ../hooks/fix-qt-builtin-paths.sh;
+        };
+      } ../hooks/qmake-hook.sh;
+    };
+
+   self = makeScope newScope addPackages;
+
+in self
diff --git a/pkgs/development/libraries/qt-5/5.12/fetch.sh b/pkgs/development/libraries/qt-5/5.12/fetch.sh
new file mode 100644
index 000000000000..b77a58cafa2e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/fetch.sh
@@ -0,0 +1,2 @@
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.12/5.12.0/submodules/ \
+            -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch
new file mode 100644
index 000000000000..9ef6e8ef0692
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin-nseventtype.patch
@@ -0,0 +1,13 @@
+--- a/src/plugins/platforms/cocoa/qcocoawindow.mm
++++ b/src/plugins/platforms/cocoa/qcocoawindow.mm
+@@ -404,8 +404,8 @@ void QCocoaWindow::setVisible(bool visible)
+                         removeMonitor();
+                         monitor = [NSEvent addGlobalMonitorForEventsMatchingMask:NSLeftMouseDownMask|NSRightMouseDownMask|NSOtherMouseDownMask|NSMouseMovedMask handler:^(NSEvent *e) {
+                             QPointF localPoint = QCocoaScreen::mapFromNative([NSEvent mouseLocation]);
+-                            const auto button = e.type == NSEventTypeMouseMoved ? Qt::NoButton : cocoaButton2QtButton([e buttonNumber]);
+-                            const auto eventType = e.type == NSEventTypeMouseMoved ? QEvent::MouseMove : QEvent::MouseButtonPress;
++                            const auto button = e.type == NSMouseMoved ? Qt::NoButton : cocoaButton2QtButton([e buttonNumber]);
++                            const auto eventType = e.type == NSMouseMoved ? QEvent::MouseMove : QEvent::MouseButtonPress;
+                             QWindowSystemInterface::handleMouseEvent(window(), window()->mapFromGlobal(localPoint.toPoint()), localPoint,
+                                                                      Qt::MouseButtons(uint(NSEvent.pressedMouseButtons & 0xFFFF)), button, eventType);
+                         }];
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch
new file mode 100644
index 000000000000..7ce27a99758e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-darwin.patch
@@ -0,0 +1,70 @@
+diff --git a/src/plugins/bearer/corewlan/qcorewlanengine.mm b/src/plugins/bearer/corewlan/qcorewlanengine.mm
+index c3dd49ff3e..6871399817 100644
+--- a/src/plugins/bearer/corewlan/qcorewlanengine.mm
++++ b/src/plugins/bearer/corewlan/qcorewlanengine.mm
+@@ -283,7 +283,7 @@ void QScanThread::getUserConfigurations()
+     QMacAutoReleasePool pool;
+     userProfiles.clear();
+ 
+-    NSArray<NSString *> *wifiInterfaces = [CWWiFiClient interfaceNames];
++    NSArray *wifiInterfaces = [CWWiFiClient interfaceNames];
+     for (NSString *ifName in wifiInterfaces) {
+ 
+         CWInterface *wifiInterface = [[CWWiFiClient sharedWiFiClient] interfaceWithName:ifName];
+@@ -598,7 +598,7 @@ void QCoreWlanEngine::doRequestUpdate()
+ 
+     QMacAutoReleasePool pool;
+ 
+-    NSArray<NSString *> *wifiInterfaces = [CWWiFiClient interfaceNames];
++    NSArray *wifiInterfaces = [CWWiFiClient interfaceNames];
+     for (NSString *ifName in wifiInterfaces) {
+             scanThread->interfaceName = QString::fromNSString(ifName);
+             scanThread->start();
+diff --git a/src/plugins/platforms/cocoa/qcocoascreen.mm b/src/plugins/platforms/cocoa/qcocoascreen.mm
+index afe14e623c..74d69c2fa1 100644
+--- a/src/plugins/platforms/cocoa/qcocoascreen.mm
++++ b/src/plugins/platforms/cocoa/qcocoascreen.mm
+@@ -127,7 +127,7 @@ void QCocoaScreen::updateProperties()
+     const qreal previousRefreshRate = m_refreshRate;
+ 
+     // The reference screen for the geometry is always the primary screen
+-    QRectF primaryScreenGeometry = QRectF::fromCGRect([[NSScreen screens] firstObject].frame);
++    QRectF primaryScreenGeometry = QRectF::fromCGRect([[[NSScreen screens] firstObject] frame]);
+     m_geometry = qt_mac_flip(QRectF::fromCGRect(nsScreen.frame), primaryScreenGeometry).toRect();
+     m_availableGeometry = qt_mac_flip(QRectF::fromCGRect(nsScreen.visibleFrame), primaryScreenGeometry).toRect();
+ 
+diff --git a/src/plugins/platforms/cocoa/qcocoawindow.mm b/src/plugins/platforms/cocoa/qcocoawindow.mm
+index df1ad82592..0318a4ff96 100644
+--- a/src/plugins/platforms/cocoa/qcocoawindow.mm
++++ b/src/plugins/platforms/cocoa/qcocoawindow.mm
+@@ -1704,7 +1704,7 @@ void QCocoaWindow::applyContentBorderThickness(NSWindow *window)
+ 
+     if (!m_drawContentBorderGradient) {
+         window.styleMask = window.styleMask & ~NSWindowStyleMaskTexturedBackground;
+-        [window.contentView.superview setNeedsDisplay:YES];
++        [[window.contentView superview] setNeedsDisplay:YES];
+         window.titlebarAppearsTransparent = NO;
+         return;
+     }
+diff --git a/src/plugins/platforms/cocoa/qnswindow.mm b/src/plugins/platforms/cocoa/qnswindow.mm
+index c17ad47aba..a0f1dd38fb 100644
+--- a/src/plugins/platforms/cocoa/qnswindow.mm
++++ b/src/plugins/platforms/cocoa/qnswindow.mm
+@@ -230,7 +230,7 @@ static bool isMouseEvent(NSEvent *ev)
+     if (pw->frameStrutEventsEnabled() && isMouseEvent(theEvent)) {
+         NSPoint loc = [theEvent locationInWindow];
+         NSRect windowFrame = [self convertRectFromScreen:self.frame];
+-        NSRect contentFrame = self.contentView.frame;
++        NSRect contentFrame = [self.contentView frame];
+         if (NSMouseInRect(loc, windowFrame, NO) && !NSMouseInRect(loc, contentFrame, NO))
+             [qnsview_cast(pw->view()) handleFrameStrutMouseEvent:theEvent];
+     }
+@@ -257,7 +257,7 @@ static bool isMouseEvent(NSEvent *ev)
+ + (void)applicationActivationChanged:(NSNotification*)notification
+ {
+     const id sender = self;
+-    NSEnumerator<NSWindow*> *windowEnumerator = nullptr;
++    NSEnumerator *windowEnumerator = nullptr;
+     NSApplication *application = [NSApplication sharedApplication];
+ 
+     // Unfortunately there's no NSWindowListOrderedBackToFront,
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch
new file mode 100644
index 000000000000..8b46d432812a
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-fixguicmake.patch
@@ -0,0 +1,30 @@
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 0bbc871..3673634 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -286,7 +286,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-        set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
++        set(imported_location \"${PLUGIN_LOCATION}\")
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+index 5baf0fd..3583745 100644
+--- a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+@@ -2,10 +2,10 @@
+ add_library(Qt5::$$CMAKE_PLUGIN_NAME MODULE IMPORTED)
+ 
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
+ !!ENDIF
+ !!IF !isEmpty(CMAKE_DEBUG_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
+ !!ENDIF
+ 
+ list(APPEND Qt5$${CMAKE_MODULE_NAME}_PLUGINS Qt5::$$CMAKE_PLUGIN_NAME)
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch b/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch
new file mode 100644
index 000000000000..29776518379d
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase-revert-no-macos10.10.patch
@@ -0,0 +1,102 @@
+Revert "Remove code paths for macOS < 10.11"
+
+This reverts commit 138a65e0cfa80b13fd018a01e7d8b33341a3cfd3.
+
+From 138a65e0cfa80b13fd018a01e7d8b33341a3cfd3 Mon Sep 17 00:00:00 2001
+From: Jake Petroules <jake.petroules@qt.io>
+Date: Thu, 8 Feb 2018 11:05:42 -0800
+Subject: [PATCH] Remove code paths for macOS < 10.11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I5ae02d88aa3dcd97d1f2ebf6255a68643e5d6daa
+Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
+Reviewed-by: Gabriel de Dietrich <gabriel.dedietrich@qt.io>
+Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com>
+---
+ .../fontdatabases/mac/qfontengine_coretext.mm            | 16 +++-------------
+ src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm    |  6 +-----
+ src/plugins/platforms/cocoa/qnswindowdelegate.mm         | 16 ----------------
+ 3 files changed, 4 insertions(+), 34 deletions(-)
+
+diff --git a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
+index 98b753eff9..489d9cd031 100644
+--- a/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
++++ b/src/platformsupport/fontdatabases/mac/qfontengine_coretext.mm
+@@ -47,18 +47,28 @@
+ 
+ #include <cmath>
+ 
+-#if defined(Q_OS_MACOS)
++#if defined(Q_OS_OSX) && !QT_OSX_DEPLOYMENT_TARGET_BELOW(__MAC_10_11)
+ #import <AppKit/AppKit.h>
+ #endif
+ 
+-#if defined(QT_PLATFORM_UIKIT)
++#if defined(QT_PLATFORM_UIKIT) && !QT_IOS_DEPLOYMENT_TARGET_BELOW(__IPHONE_8_2)
+ #import <UIKit/UIKit.h>
+ #endif
+ 
+ // These are available cross platform, exported as kCTFontWeightXXX from CoreText.framework,
+ // but they are not documented and are not in public headers so are private API and exposed
+ // only through the NSFontWeightXXX and UIFontWeightXXX aliases in AppKit and UIKit (rdar://26109857)
+-#if defined(Q_OS_MACOS)
++#if QT_MAC_DEPLOYMENT_TARGET_BELOW(__MAC_10_11, __IPHONE_8_2)
++#define kCTFontWeightUltraLight -0.8
++#define kCTFontWeightThin -0.6
++#define kCTFontWeightLight -0.4
++#define kCTFontWeightRegular 0
++#define kCTFontWeightMedium 0.23
++#define kCTFontWeightSemibold 0.3
++#define kCTFontWeightBold 0.4
++#define kCTFontWeightHeavy 0.56
++#define kCTFontWeightBlack 0.62
++#elif defined(Q_OS_OSX)
+ #define kCTFontWeightUltraLight NSFontWeightUltraLight
+ #define kCTFontWeightThin NSFontWeightThin
+ #define kCTFontWeightLight NSFontWeightLight
+diff --git a/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm b/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
+index 94f2125bad..272cd9f3dc 100644
+--- a/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
++++ b/src/plugins/platforms/cocoa/qcocoafiledialoghelper.mm
+@@ -162,7 +162,11 @@ QT_NAMESPACE_ALIAS_OBJC_CLASS(QNSOpenSavePanelDelegate);
+     // resetting our mCurrentDir, set the delegate
+     // here to make sure it gets the correct value.
+     [mSavePanel setDelegate:self];
+-    mOpenPanel.accessoryViewDisclosed = YES;
++
++#if QT_OSX_PLATFORM_SDK_EQUAL_OR_ABOVE(__MAC_10_11)
++    if (__builtin_available(macOS 10.11, *))
++        mOpenPanel.accessoryViewDisclosed = YES;
++#endif
+ 
+     if (mOptions->isLabelExplicitlySet(QFileDialogOptions::Accept))
+         [mSavePanel setPrompt:[self strip:options->labelText(QFileDialogOptions::Accept)]];
+diff --git a/src/plugins/platforms/cocoa/qnswindowdelegate.mm b/src/plugins/platforms/cocoa/qnswindowdelegate.mm
+index 057a4c2943..eb55e50622 100644
+--- a/src/plugins/platforms/cocoa/qnswindowdelegate.mm
++++ b/src/plugins/platforms/cocoa/qnswindowdelegate.mm
+@@ -103,6 +103,22 @@ static QRegExp whitespaceRegex = QRegExp(QStringLiteral("\\s*"));
+     return QCocoaScreen::mapToNative(maximizedFrame);
+ }
+ 
++#if QT_MACOS_DEPLOYMENT_TARGET_BELOW(__MAC_10_11)
++/*
++    AppKit on OS X 10.10 wrongly calls windowWillUseStandardFrame:defaultFrame
++    from -[NSWindow _frameForFullScreenMode] when going into fullscreen, resulting
++    in black bars on top and bottom of the window. By implementing the following
++    method, AppKit will choose that instead, and resolve the right fullscreen
++    geometry.
++*/
++- (NSSize)window:(NSWindow *)window willUseFullScreenContentSize:(NSSize)proposedSize
++{
++    Q_UNUSED(proposedSize);
++    Q_ASSERT(window == m_cocoaWindow->nativeWindow());
++    return NSSizeFromCGSize(m_cocoaWindow->screen()->geometry().size().toCGSize());
++}
++#endif
++
+ - (BOOL)window:(NSWindow *)window shouldPopUpDocumentPathMenu:(NSMenu *)menu
+ {
+     Q_UNUSED(window);
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase.patch b/pkgs/development/libraries/qt-5/5.12/qtbase.patch
new file mode 100644
index 000000000000..68ebd56b76c0
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase.patch
@@ -0,0 +1,1096 @@
+diff --git a/mkspecs/common/mac.conf b/mkspecs/common/mac.conf
+index 61bea952b2..9909dae726 100644
+--- a/mkspecs/common/mac.conf
++++ b/mkspecs/common/mac.conf
+@@ -23,7 +23,7 @@ QMAKE_INCDIR_OPENGL     = \
+ 
+ QMAKE_FIX_RPATH         = install_name_tool -id
+ 
+-QMAKE_LFLAGS_RPATH      = -Wl,-rpath,
++QMAKE_LFLAGS_RPATH      =
+ QMAKE_LFLAGS_GCSECTIONS = -Wl,-dead_strip
+ 
+ QMAKE_LFLAGS_REL_RPATH  =
+diff --git a/mkspecs/features/create_cmake.prf b/mkspecs/features/create_cmake.prf
+index 2ed708e085..05e60ff45f 100644
+--- a/mkspecs/features/create_cmake.prf
++++ b/mkspecs/features/create_cmake.prf
+@@ -21,7 +21,7 @@ load(cmake_functions)
+ # at cmake time whether package has been found via a symlink, and correct
+ # that to an absolute path. This is only done for installations to
+ # the /usr or / prefix.
+-CMAKE_INSTALL_LIBS_DIR = $$cmakeTargetPath($$[QT_INSTALL_LIBS])
++CMAKE_INSTALL_LIBS_DIR = $$cmakeTargetPath($$NIX_OUTPUT_OUT/lib/)
+ contains(CMAKE_INSTALL_LIBS_DIR, ^(/usr)?/lib(64)?.*): CMAKE_USR_MOVE_WORKAROUND = $$CMAKE_INSTALL_LIBS_DIR
+ 
+ CMAKE_OUT_DIR = $$MODULE_BASE_OUTDIR/lib/cmake
+@@ -51,45 +51,20 @@ split_incpath {
+         $$cmake_extra_source_includes.output
+ }
+ 
+-CMAKE_INCLUDE_DIR = $$cmakeRelativePath($$[QT_INSTALL_HEADERS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_INCLUDE_DIR, "^\\.\\./.*") {
+-    CMAKE_INCLUDE_DIR = $$[QT_INSTALL_HEADERS]/
+-    CMAKE_INCLUDE_DIR_IS_ABSOLUTE = True
+-}
++CMAKE_INCLUDE_DIR = $$NIX_OUTPUT_DEV/include/
++CMAKE_INCLUDE_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_LIB_DIR = $$cmakeRelativePath($$[QT_INSTALL_LIBS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_LIB_DIR,"^\\.\\./.*") {
+-    CMAKE_LIB_DIR = $$[QT_INSTALL_LIBS]/
+-    CMAKE_LIB_DIR_IS_ABSOLUTE = True
+-} else {
+-    CMAKE_RELATIVE_INSTALL_LIBS_DIR = $$cmakeRelativePath($$[QT_INSTALL_PREFIX], $$[QT_INSTALL_LIBS])
+-    # We need to go up another two levels because the CMake files are
+-    # installed in $${CMAKE_LIB_DIR}/cmake/Qt5$${CMAKE_MODULE_NAME}
+-    CMAKE_RELATIVE_INSTALL_DIR = "$${CMAKE_RELATIVE_INSTALL_LIBS_DIR}../../"
+-}
++CMAKE_BIN_DIR = $$NIX_OUTPUT_BIN/bin/
++CMAKE_BIN_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_BIN_DIR = $$cmakeRelativePath($$[QT_HOST_BINS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_BIN_DIR, "^\\.\\./.*") {
+-    CMAKE_BIN_DIR = $$[QT_HOST_BINS]/
+-    CMAKE_BIN_DIR_IS_ABSOLUTE = True
+-}
++CMAKE_LIB_DIR = $$NIX_OUTPUT_OUT/lib/
++CMAKE_LIB_DIR_IS_ABSOLUTE = True
+ 
+-CMAKE_PLUGIN_DIR = $$cmakeRelativePath($$[QT_INSTALL_PLUGINS], $$[QT_INSTALL_PREFIX])
+-contains(CMAKE_PLUGIN_DIR, "^\\.\\./.*") {
+-    CMAKE_PLUGIN_DIR = $$[QT_INSTALL_PLUGINS]/
+-    CMAKE_PLUGIN_DIR_IS_ABSOLUTE = True
+-}
+-
+-win32:!static:!staticlib {
+-    CMAKE_DLL_DIR = $$cmakeRelativePath($$[QT_INSTALL_BINS], $$[QT_INSTALL_PREFIX])
+-    contains(CMAKE_DLL_DIR, "^\\.\\./.*") {
+-        CMAKE_DLL_DIR = $$[QT_INSTALL_BINS]/
+-        CMAKE_DLL_DIR_IS_ABSOLUTE = True
+-    }
+-} else {
+-    CMAKE_DLL_DIR = $$CMAKE_LIB_DIR
+-    CMAKE_DLL_DIR_IS_ABSOLUTE = $$CMAKE_LIB_DIR_IS_ABSOLUTE
+-}
++CMAKE_PLUGIN_DIR = $$NIX_OUTPUT_PLUGIN/
++CMAKE_PLUGIN_DIR_IS_ABSOLUTE = True
++ 
++CMAKE_DLL_DIR = $$NIX_OUTPUT_OUT/lib/
++CMAKE_DLL_DIR_IS_ABSOLUTE = True
+ 
+ static|staticlib:CMAKE_STATIC_TYPE = true
+ 
+@@ -169,7 +144,7 @@ contains(CONFIG, plugin) {
+       cmake_target_file
+ 
+     cmake_qt5_plugin_file.files = $$cmake_target_file.output
+-    cmake_qt5_plugin_file.path = $$[QT_INSTALL_LIBS]/cmake/Qt5$${CMAKE_MODULE_NAME}
++    cmake_qt5_plugin_file.path = $$NIX_OUTPUT_OUT/lib/cmake/Qt5$${CMAKE_MODULE_NAME}
+     INSTALLS += cmake_qt5_plugin_file
+ 
+     return()
+@@ -316,7 +291,7 @@ exists($$cmake_macros_file.input) {
+     cmake_qt5_module_files.files += $$cmake_macros_file.output
+ }
+ 
+-cmake_qt5_module_files.path = $$[QT_INSTALL_LIBS]/cmake/Qt5$${CMAKE_MODULE_NAME}
++cmake_qt5_module_files.path = $$NIX_OUTPUT_OUT/lib/cmake/Qt5$${CMAKE_MODULE_NAME}
+ 
+ # We are generating cmake files. Most developers of Qt are not aware of cmake,
+ # so we require automatic tests to be available. The only module which should
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 3ed6dd5889..4c7c8da21a 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -3,30 +3,6 @@ if (CMAKE_VERSION VERSION_LESS 3.1.0)
+     message(FATAL_ERROR \"Qt 5 $${CMAKE_MODULE_NAME} module requires at least CMake version 3.1.0\")
+ endif()
+ 
+-!!IF !isEmpty(CMAKE_USR_MOVE_WORKAROUND)
+-!!IF !isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-set(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$[QT_INSTALL_PREFIX]\")
+-!!ELSE
+-get_filename_component(_IMPORT_PREFIX \"${CMAKE_CURRENT_LIST_FILE}\" PATH)
+-# Use original install prefix when loaded through a
+-# cross-prefix symbolic link such as /lib -> /usr/lib.
+-get_filename_component(_realCurr \"${_IMPORT_PREFIX}\" REALPATH)
+-get_filename_component(_realOrig \"$$CMAKE_INSTALL_LIBS_DIR/cmake/Qt5$${CMAKE_MODULE_NAME}\" REALPATH)
+-if(_realCurr STREQUAL _realOrig)
+-    get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$CMAKE_INSTALL_LIBS_DIR/$${CMAKE_RELATIVE_INSTALL_LIBS_DIR}\" ABSOLUTE)
+-else()
+-    get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"${CMAKE_CURRENT_LIST_DIR}/$${CMAKE_RELATIVE_INSTALL_DIR}\" ABSOLUTE)
+-endif()
+-unset(_realOrig)
+-unset(_realCurr)
+-unset(_IMPORT_PREFIX)
+-!!ENDIF
+-!!ELIF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-get_filename_component(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"${CMAKE_CURRENT_LIST_DIR}/$${CMAKE_RELATIVE_INSTALL_DIR}\" ABSOLUTE)
+-!!ELSE
+-set(_qt5$${CMAKE_MODULE_NAME}_install_prefix \"$$[QT_INSTALL_PREFIX]\")
+-!!ENDIF
+-
+ !!IF !equals(TEMPLATE, aux)
+ # For backwards compatibility only. Use Qt5$${CMAKE_MODULE_NAME}_VERSION instead.
+ set(Qt5$${CMAKE_MODULE_NAME}_VERSION_STRING "$$eval(QT.$${MODULE}.VERSION)")
+@@ -52,11 +28,7 @@ endmacro()
+ macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATION IMPLIB_LOCATION)
+     set_property(TARGET Qt5::$${CMAKE_MODULE_NAME} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+-!!ELSE
+     set(imported_location \"$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+-!!ENDIF
+     _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+     set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
+         \"INTERFACE_LINK_LIBRARIES\" \"${_Qt5$${CMAKE_MODULE_NAME}_LIB_DEPENDENCIES}\"
+@@ -69,11 +41,7 @@ macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATI
+     )
+ 
+ !!IF !isEmpty(CMAKE_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_implib \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+-!!ELSE
+     set(imported_implib \"IMPORTED_IMPLIB_${Configuration}\" \"$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+-!!ENDIF
+     _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_implib})
+     if(NOT \"${IMPLIB_LOCATION}\" STREQUAL \"\")
+         set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
+@@ -89,24 +57,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !no_module_headers
+ !!IF !isEmpty(CMAKE_BUILD_IS_FRAMEWORK)
+     set(_Qt5$${CMAKE_MODULE_NAME}_OWN_INCLUDE_DIRS
+-      \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework\"
+-      \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Headers\"
++      \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework\"
++      \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Headers\"
+     )
+ !!IF isEmpty(CMAKE_NO_PRIVATE_INCLUDES)
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/\"
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/$${MODULE_INCNAME}\"
+-    )
+-!!ELSE
+-    set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+-!!ENDIF
+-!!ELSE
+-!!IF isEmpty(CMAKE_INCLUDE_DIR_IS_ABSOLUTE)
+-    set(_Qt5$${CMAKE_MODULE_NAME}_OWN_INCLUDE_DIRS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$$CMAKE_INCLUDE_DIR\" \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}\")
+-!!IF isEmpty(CMAKE_NO_PRIVATE_INCLUDES)
+-    set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}/$$VERSION\"
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_INCLUDE_DIR}$${MODULE_INCNAME}/$$VERSION/$${MODULE_INCNAME}\"
++        \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/\"
++        \"$${CMAKE_LIB_DIR}Qt$${CMAKE_MODULE_NAME}.framework/Versions/$$section(VERSION, ., 0, 0)/Headers/$$VERSION/$${MODULE_INCNAME}\"
+     )
+ !!ELSE
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+@@ -122,7 +79,6 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
+ !!ENDIF
+ !!ENDIF
+-!!ENDIF
+ !!IF !isEmpty(CMAKE_ADD_SOURCE_INCLUDE_DIRS)
+     include(\"${CMAKE_CURRENT_LIST_DIR}/ExtraSourceIncludes.cmake\" OPTIONAL)
+ !!ENDIF
+@@ -272,25 +228,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
+ !!IF isEmpty(CMAKE_DEBUG_TYPE)
+ !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    if (EXISTS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ELSE // CMAKE_LIB_DIR_IS_ABSOLUTE
+     if (EXISTS \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ENDIF // CMAKE_LIB_DIR_IS_ABSOLUTE
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(DEBUG \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" \"\" )
+ !!ELSE // CMAKE_STATIC_WINDOWS_BUILD
+     if (EXISTS
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}$${CMAKE_LIB_FILE_LOCATION_DEBUG}\"
+-!!ELSE
+         \"$${CMAKE_LIB_FILE_LOCATION_DEBUG}\"
+-!!ENDIF
+       AND EXISTS
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ELSE
+         \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+-!!ENDIF
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(DEBUG \"$${CMAKE_LIB_FILE_LOCATION_DEBUG}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
+ !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
+     endif()
+@@ -309,25 +253,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+ !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
+ !!IF isEmpty(CMAKE_RELEASE_TYPE)
+ !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    if (EXISTS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ELSE // CMAKE_LIB_DIR_IS_ABSOLUTE
+     if (EXISTS \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ENDIF // CMAKE_LIB_DIR_IS_ABSOLUTE
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(RELEASE \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" \"\" )
+ !!ELSE // CMAKE_STATIC_WINDOWS_BUILD
+     if (EXISTS
+-!!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_DLL_DIR}$${CMAKE_LIB_FILE_LOCATION_RELEASE}\"
+-!!ELSE
+         \"$${CMAKE_LIB_FILE_LOCATION_RELEASE}\"
+-!!ENDIF
+       AND EXISTS
+-!!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-        \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ELSE
+         \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+-!!ENDIF
+         _populate_$${CMAKE_MODULE_NAME}_target_properties(RELEASE \"$${CMAKE_LIB_FILE_LOCATION_RELEASE}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
+ !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
+     endif()
+@@ -346,11 +278,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-!!IF isEmpty(CMAKE_PLUGIN_DIR_IS_ABSOLUTE)
+-        set(imported_location \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
+-!!ELSE
+         set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
+-!!ENDIF
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/mac/default_post.prf b/mkspecs/features/mac/default_post.prf
+index 99f68b78f5..dde69cb7c2 100644
+--- a/mkspecs/features/mac/default_post.prf
++++ b/mkspecs/features/mac/default_post.prf
+@@ -63,199 +63,3 @@ qt {
+         }
+     }
+ }
+-
+-# Add the same default rpaths as Xcode does for new projects.
+-# This is especially important for iOS/tvOS/watchOS where no other option is possible.
+-!no_default_rpath {
+-    QMAKE_RPATHDIR += @executable_path/Frameworks
+-    equals(TEMPLATE, lib):!plugin:lib_bundle: QMAKE_RPATHDIR += @loader_path/Frameworks
+-}
+-
+-# Don't pass -headerpad_max_install_names when using Bitcode.
+-# In that case the linker emits a warning stating that the flag is ignored when
+-# used with bitcode, for reasons that cannot be determined (rdar://problem/20748962).
+-# Using this flag is also unnecessary in practice on UIKit platforms since they
+-# are sandboxed, and only UIKit platforms support bitcode to begin with.
+-!bitcode: QMAKE_LFLAGS += $$QMAKE_LFLAGS_HEADERPAD
+-
+-app_extension_api_only {
+-    QMAKE_CFLAGS              += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_CXXFLAGS            += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_CXXFLAGS_PRECOMPILE += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-    QMAKE_LFLAGS              += $$QMAKE_CFLAGS_APPLICATION_EXTENSION
+-}
+-
+-macx-xcode {
+-    qmake_pkginfo_typeinfo.name = QMAKE_PKGINFO_TYPEINFO
+-    !isEmpty(QMAKE_PKGINFO_TYPEINFO): \
+-        qmake_pkginfo_typeinfo.value = $$QMAKE_PKGINFO_TYPEINFO
+-    else: \
+-        qmake_pkginfo_typeinfo.value = "????"
+-    QMAKE_MAC_XCODE_SETTINGS += qmake_pkginfo_typeinfo
+-
+-    !isEmpty(VERSION) {
+-        l = $$split(VERSION, '.') 0 0  # make sure there are at least three
+-        VER_MAJ = $$member(l, 0, 0)
+-        VER_MIN = $$member(l, 1, 1)
+-        VER_PAT = $$member(l, 2, 2)
+-        unset(l)
+-
+-        qmake_full_version.name = QMAKE_FULL_VERSION
+-        qmake_full_version.value = $${VER_MAJ}.$${VER_MIN}.$${VER_PAT}
+-        QMAKE_MAC_XCODE_SETTINGS += qmake_full_version
+-
+-        qmake_short_version.name = QMAKE_SHORT_VERSION
+-        qmake_short_version.value = $${VER_MAJ}.$${VER_MIN}
+-        QMAKE_MAC_XCODE_SETTINGS += qmake_short_version
+-    }
+-
+-    !isEmpty(QMAKE_XCODE_DEBUG_INFORMATION_FORMAT) {
+-        debug_information_format.name = DEBUG_INFORMATION_FORMAT
+-        debug_information_format.value = $$QMAKE_XCODE_DEBUG_INFORMATION_FORMAT
+-        debug_information_format.build = debug
+-        QMAKE_MAC_XCODE_SETTINGS += debug_information_format
+-    }
+-
+-    QMAKE_XCODE_ARCHS =
+-
+-    arch_device.name = "ARCHS[sdk=$${device.sdk}*]"
+-    arch_device.value = $$QMAKE_APPLE_DEVICE_ARCHS
+-    QMAKE_XCODE_ARCHS += $$QMAKE_APPLE_DEVICE_ARCHS
+-    QMAKE_MAC_XCODE_SETTINGS += arch_device
+-
+-    simulator {
+-        arch_simulator.name = "ARCHS[sdk=$${simulator.sdk}*]"
+-        arch_simulator.value = $$QMAKE_APPLE_SIMULATOR_ARCHS
+-        QMAKE_XCODE_ARCHS += $$QMAKE_APPLE_SIMULATOR_ARCHS
+-        QMAKE_MAC_XCODE_SETTINGS += arch_simulator
+-    }
+-
+-    only_active_arch.name = ONLY_ACTIVE_ARCH
+-    only_active_arch.value = YES
+-    only_active_arch.build = debug
+-    QMAKE_MAC_XCODE_SETTINGS += only_active_arch
+-} else {
+-    device|!simulator: VALID_DEVICE_ARCHS = $$QMAKE_APPLE_DEVICE_ARCHS
+-    simulator: VALID_SIMULATOR_ARCHS = $$QMAKE_APPLE_SIMULATOR_ARCHS
+-    VALID_ARCHS = $$VALID_DEVICE_ARCHS $$VALID_SIMULATOR_ARCHS
+-
+-    isEmpty(VALID_ARCHS): \
+-        error("QMAKE_APPLE_DEVICE_ARCHS or QMAKE_APPLE_SIMULATOR_ARCHS must contain at least one architecture")
+-
+-    single_arch: VALID_ARCHS = $$first(VALID_ARCHS)
+-
+-    ACTIVE_ARCHS = $(filter $(EXPORT_VALID_ARCHS), $(ARCHS))
+-    ARCH_ARGS = $(foreach arch, $(if $(EXPORT_ACTIVE_ARCHS), $(EXPORT_ACTIVE_ARCHS), $(EXPORT_VALID_ARCHS)), -arch $(arch))
+-
+-    QMAKE_EXTRA_VARIABLES += VALID_ARCHS ACTIVE_ARCHS ARCH_ARGS
+-
+-    arch_flags = $(EXPORT_ARCH_ARGS)
+-
+-    QMAKE_CFLAGS += $$arch_flags
+-    QMAKE_CXXFLAGS += $$arch_flags
+-    QMAKE_LFLAGS += $$arch_flags
+-
+-    QMAKE_PCH_ARCHS = $$VALID_ARCHS
+-
+-    macos: deployment_target = $$QMAKE_MACOSX_DEPLOYMENT_TARGET
+-    ios: deployment_target = $$QMAKE_IOS_DEPLOYMENT_TARGET
+-    tvos: deployment_target = $$QMAKE_TVOS_DEPLOYMENT_TARGET
+-    watchos: deployment_target = $$QMAKE_WATCHOS_DEPLOYMENT_TARGET
+-
+-    # If we're doing a simulator and device build, device and simulator
+-    # architectures use different paths and flags for the sysroot and
+-    # deployment target switch, so we must multiplex them across multiple
+-    # architectures using -Xarch. Otherwise we fall back to the simple path.
+-    # This is not strictly necessary, but results in cleaner command lines
+-    # and makes it easier for people to override EXPORT_VALID_ARCHS to limit
+-    # individual rules to a different set of architecture(s) from the overall
+-    # build (such as machtest in QtCore).
+-    simulator:device {
+-        QMAKE_XARCH_CFLAGS =
+-        QMAKE_XARCH_LFLAGS =
+-        QMAKE_EXTRA_VARIABLES += QMAKE_XARCH_CFLAGS QMAKE_XARCH_LFLAGS
+-
+-        for (arch, VALID_ARCHS) {
+-            contains(VALID_SIMULATOR_ARCHS, $$arch) {
+-                sdk = $$simulator.sdk
+-                version_identifier = $$simulator.deployment_identifier
+-            } else {
+-                sdk = $$device.sdk
+-                version_identifier = $$device.deployment_identifier
+-            }
+-
+-            version_min_flags = \
+-                -Xarch_$${arch} \
+-                -m$${version_identifier}-version-min=$$deployment_target
+-            QMAKE_XARCH_CFLAGS_$${arch} = $$version_min_flags \
+-                -Xarch_$${arch} \
+-                -isysroot$$xcodeSDKInfo(Path, $$sdk)
+-            QMAKE_XARCH_LFLAGS_$${arch} = $$version_min_flags \
+-                -Xarch_$${arch} \
+-                -Wl,-syslibroot,$$xcodeSDKInfo(Path, $$sdk)
+-
+-            QMAKE_XARCH_CFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS_$${arch})
+-            QMAKE_XARCH_LFLAGS += $(EXPORT_QMAKE_XARCH_LFLAGS_$${arch})
+-
+-            QMAKE_EXTRA_VARIABLES += \
+-                QMAKE_XARCH_CFLAGS_$${arch} \
+-                QMAKE_XARCH_LFLAGS_$${arch}
+-        }
+-
+-        QMAKE_CFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS)
+-        QMAKE_CXXFLAGS += $(EXPORT_QMAKE_XARCH_CFLAGS)
+-        QMAKE_LFLAGS += $(EXPORT_QMAKE_XARCH_LFLAGS)
+-    } else {
+-        simulator: \
+-            version_identifier = $$simulator.deployment_identifier
+-        else: \
+-            version_identifier = $$device.deployment_identifier
+-        version_min_flag = -m$${version_identifier}-version-min=$$deployment_target
+-        QMAKE_CFLAGS += -isysroot $$QMAKE_MAC_SDK_PATH $$version_min_flag
+-        QMAKE_CXXFLAGS += -isysroot $$QMAKE_MAC_SDK_PATH $$version_min_flag
+-        QMAKE_LFLAGS += -Wl,-syslibroot,$$QMAKE_MAC_SDK_PATH $$version_min_flag
+-    }
+-
+-    # Enable precompiled headers for multiple architectures
+-    QMAKE_CFLAGS_USE_PRECOMPILE =
+-    for (arch, VALID_ARCHS) {
+-        icc_pch_style: \
+-            use_flag = "-pch-use "
+-        else: \
+-            use_flag = -include
+-
+-        # Only use Xarch with multi-arch, as the option confuses ccache
+-        count(VALID_ARCHS, 1, greaterThan): \
+-            QMAKE_CFLAGS_USE_PRECOMPILE += \
+-                -Xarch_$${arch}
+-
+-        QMAKE_CFLAGS_USE_PRECOMPILE += \
+-            $${use_flag}${QMAKE_PCH_OUTPUT_$${arch}}
+-    }
+-    icc_pch_style {
+-        QMAKE_CXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE -include ${QMAKE_PCH_INPUT}
+-        QMAKE_CFLAGS_USE_PRECOMPILE =
+-    } else {
+-        QMAKE_CXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-        QMAKE_OBJCFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-        QMAKE_OBJCXXFLAGS_USE_PRECOMPILE = $$QMAKE_CFLAGS_USE_PRECOMPILE
+-    }
+-
+-    QMAKE_PCH_OUTPUT_EXT = _${QMAKE_PCH_ARCH}$${QMAKE_PCH_OUTPUT_EXT}
+-}
+-
+-cache(QMAKE_XCODE_DEVELOPER_PATH, stash)
+-!isEmpty(QMAKE_XCODE_VERSION): \
+-    cache(QMAKE_XCODE_VERSION, stash)
+-
+-QMAKE_XCODE_LIBRARY_SUFFIX = $$qtPlatformTargetSuffix()
+-
+-xcode_product_bundle_identifier_setting.name = PRODUCT_BUNDLE_IDENTIFIER
+-xcode_product_bundle_identifier_setting.value = $$QMAKE_TARGET_BUNDLE_PREFIX
+-isEmpty(xcode_product_bundle_identifier_setting.value): \
+-    xcode_product_bundle_identifier_setting.value = "com.yourcompany"
+-xcode_product_bundle_target = $$QMAKE_BUNDLE
+-isEmpty(xcode_product_bundle_target): \
+-    xcode_product_bundle_target = ${PRODUCT_NAME:rfc1034identifier}
+-xcode_product_bundle_identifier_setting.value = "$${xcode_product_bundle_identifier_setting.value}.$${xcode_product_bundle_target}"
+-QMAKE_MAC_XCODE_SETTINGS += xcode_product_bundle_identifier_setting
+diff --git a/mkspecs/features/mac/default_pre.prf b/mkspecs/features/mac/default_pre.prf
+index e3534561a5..3b01424e67 100644
+--- a/mkspecs/features/mac/default_pre.prf
++++ b/mkspecs/features/mac/default_pre.prf
+@@ -1,60 +1,2 @@
+ CONFIG = asset_catalogs rez $$CONFIG
+ load(default_pre)
+-
+-isEmpty(QMAKE_XCODE_DEVELOPER_PATH) {
+-    # Get path of Xcode's Developer directory
+-    QMAKE_XCODE_DEVELOPER_PATH = $$system("/usr/bin/xcode-select --print-path 2>/dev/null")
+-    isEmpty(QMAKE_XCODE_DEVELOPER_PATH): \
+-        error("Xcode path is not set. Please use xcode-select to choose Xcode installation path.")
+-
+-    # Make sure Xcode path is valid
+-    !exists($$QMAKE_XCODE_DEVELOPER_PATH): \
+-        error("Xcode is not installed in $${QMAKE_XCODE_DEVELOPER_PATH}. Please use xcode-select to choose Xcode installation path.")
+-}
+-
+-isEmpty(QMAKE_XCODEBUILD_PATH): \
+-    QMAKE_XCODEBUILD_PATH = $$system("/usr/bin/xcrun -find xcodebuild 2>/dev/null")
+-
+-!isEmpty(QMAKE_XCODEBUILD_PATH) {
+-    # Make sure Xcode is set up properly
+-    !system("/usr/bin/xcrun xcodebuild -license check 2>/dev/null"): \
+-        error("Xcode not set up properly. You need to confirm the license agreement by running 'sudo xcrun xcodebuild -license accept'.")
+-
+-    isEmpty(QMAKE_XCODE_VERSION) {
+-        # Extract Xcode version using xcodebuild
+-        xcode_version = $$system("/usr/bin/xcrun xcodebuild -version")
+-        QMAKE_XCODE_VERSION = $$member(xcode_version, 1)
+-        isEmpty(QMAKE_XCODE_VERSION): error("Could not resolve Xcode version.")
+-        unset(xcode_version)
+-    }
+-}
+-
+-isEmpty(QMAKE_TARGET_BUNDLE_PREFIX) {
+-    QMAKE_XCODE_PREFERENCES_FILE = $$(HOME)/Library/Preferences/com.apple.dt.Xcode.plist
+-    exists($$QMAKE_XCODE_PREFERENCES_FILE): \
+-        QMAKE_TARGET_BUNDLE_PREFIX = $$system("/usr/libexec/PlistBuddy -c 'print IDETemplateOptions:bundleIdentifierPrefix' $$QMAKE_XCODE_PREFERENCES_FILE 2>/dev/null")
+-
+-    !isEmpty(_QMAKE_CACHE_):!isEmpty(QMAKE_TARGET_BUNDLE_PREFIX): \
+-        cache(QMAKE_TARGET_BUNDLE_PREFIX)
+-}
+-
+-QMAKE_ASSET_CATALOGS_APP_ICON = AppIcon
+-
+-# Make the default debug info format for static debug builds
+-# DWARF instead of DWARF with dSYM. This cuts down build times
+-# for application debug builds significantly, as Xcode doesn't
+-# have to pull out all the DWARF info from the Qt static libs
+-# and put it into a dSYM file. We don't need that dSYM file in
+-# the first place, since the information is available in the
+-# object files inside the archives (static libraries).
+-macx-xcode:qtConfig(static): \
+-    QMAKE_XCODE_DEBUG_INFORMATION_FORMAT = dwarf
+-
+-# This variable is used by the xcode_dynamic_library_suffix
+-# feature, which allows Xcode to choose the Qt libraries to link to
+-# at build time, depending on the current Xcode SDK and configuration.
+-QMAKE_XCODE_LIBRARY_SUFFIX_SETTING = QT_LIBRARY_SUFFIX
+-
+-xcode_copy_phase_strip_setting.name = COPY_PHASE_STRIP
+-xcode_copy_phase_strip_setting.value = NO
+-QMAKE_MAC_XCODE_SETTINGS += xcode_copy_phase_strip_setting
+diff --git a/mkspecs/features/mac/sdk.prf b/mkspecs/features/mac/sdk.prf
+index 8360dd8b38..8b13789179 100644
+--- a/mkspecs/features/mac/sdk.prf
++++ b/mkspecs/features/mac/sdk.prf
+@@ -1,58 +1 @@
+ 
+-isEmpty(QMAKE_MAC_SDK): \
+-    error("QMAKE_MAC_SDK must be set when using CONFIG += sdk.")
+-
+-contains(QMAKE_MAC_SDK, .*/.*): \
+-    error("QMAKE_MAC_SDK can only contain short-form SDK names (eg. macosx, iphoneos)")
+-
+-defineReplace(xcodeSDKInfo) {
+-    info = $$1
+-    equals(info, "Path"): \
+-        infoarg = --show-sdk-path
+-    equals(info, "PlatformPath"): \
+-        infoarg = --show-sdk-platform-path
+-    equals(info, "SDKVersion"): \
+-        infoarg = --show-sdk-version
+-    sdk = $$2
+-    isEmpty(sdk): \
+-        sdk = $$QMAKE_MAC_SDK
+-
+-    isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}) {
+-        QMAKE_MAC_SDK.$${sdk}.$${info} = $$system("/usr/bin/xcrun --sdk $$sdk $$infoarg 2>/dev/null")
+-        # --show-sdk-platform-path won't work for Command Line Tools; this is fine
+-        # only used by the XCTest backend to testlib
+-        isEmpty(QMAKE_MAC_SDK.$${sdk}.$${info}):if(!isEmpty(QMAKE_XCODEBUILD_PATH)|!equals(infoarg, "--show-sdk-platform-path")): \
+-            error("Could not resolve SDK $$info for \'$$sdk\' using $$infoarg")
+-        cache(QMAKE_MAC_SDK.$${sdk}.$${info}, set stash, QMAKE_MAC_SDK.$${sdk}.$${info})
+-    }
+-
+-    return($$eval(QMAKE_MAC_SDK.$${sdk}.$${info}))
+-}
+-
+-QMAKE_MAC_SDK_PATH = $$xcodeSDKInfo(Path)
+-QMAKE_MAC_SDK_PLATFORM_PATH = $$xcodeSDKInfo(PlatformPath)
+-QMAKE_MAC_SDK_VERSION = $$xcodeSDKInfo(SDKVersion)
+-
+-sysrootified =
+-for(val, QMAKE_INCDIR_OPENGL): sysrootified += $${QMAKE_MAC_SDK_PATH}$$val
+-QMAKE_INCDIR_OPENGL = $$sysrootified
+-
+-QMAKESPEC_NAME = $$basename(QMAKESPEC)
+-
+-# Resolve SDK version of various tools
+-for(tool, $$list(QMAKE_CC QMAKE_CXX QMAKE_FIX_RPATH QMAKE_AR QMAKE_RANLIB QMAKE_LINK QMAKE_LINK_SHLIB QMAKE_ACTOOL QMAKE_LINK_C QMAKE_LINK_C_SHLIB)) {
+-    tool_variable = QMAKE_MAC_SDK.$${QMAKESPEC_NAME}.$${QMAKE_MAC_SDK}.$${tool}
+-    !isEmpty($$tool_variable) {
+-        $$tool = $$eval($$tool_variable)
+-        next()
+-    }
+-
+-    value = $$eval($$tool)
+-    isEmpty(value): next()
+-
+-    sysrooted = $$system("/usr/bin/xcrun -sdk $$QMAKE_MAC_SDK -find $$first(value) 2>/dev/null")
+-    isEmpty(sysrooted): next()
+-
+-    $$tool = $$sysrooted $$member(value, 1, -1)
+-    cache($$tool_variable, set stash, $$tool)
+-}
+diff --git a/mkspecs/features/qml_module.prf b/mkspecs/features/qml_module.prf
+index 65212b2abf..accd4c07f0 100644
+--- a/mkspecs/features/qml_module.prf
++++ b/mkspecs/features/qml_module.prf
+@@ -52,7 +52,7 @@ qmldir.base = $$_PRO_FILE_PWD_
+ # Tools need qmldir and plugins.qmltypes always installed on the file system
+ qmldir.files = $$qmldir_file $$fq_aux_qml_files
+ install_qml_files: qmldir.files += $$fq_qml_files
+-qmldir.path = $$instbase/$$TARGETPATH
++qmldir.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ INSTALLS += qmldir
+ 
+ !debug_and_release|!build_all|CONFIG(release, debug|release) {
+diff --git a/mkspecs/features/qml_plugin.prf b/mkspecs/features/qml_plugin.prf
+index cd6377dcc6..e98bf98151 100644
+--- a/mkspecs/features/qml_plugin.prf
++++ b/mkspecs/features/qml_plugin.prf
+@@ -56,7 +56,7 @@ qml1_target {
+     instbase = $$[QT_INSTALL_QML]
+ }
+ 
+-target.path = $$instbase/$$TARGETPATH
++target.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ INSTALLS += target
+ 
+ # Some final setup
+diff --git a/mkspecs/features/qt_app.prf b/mkspecs/features/qt_app.prf
+index 8354f30eea..62028fef8e 100644
+--- a/mkspecs/features/qt_app.prf
++++ b/mkspecs/features/qt_app.prf
+@@ -30,7 +30,7 @@ host_build:force_bootstrap {
+     target.path = $$[QT_HOST_BINS]
+ } else {
+     !build_pass:qtConfig(debug_and_release): CONFIG += release
+-    target.path = $$[QT_INSTALL_BINS]
++    target.path = $$NIX_OUTPUT_BIN/bin
+     CONFIG += relative_qt_rpath  # Qt's tools and apps should be relocatable
+ }
+ INSTALLS += target
+diff --git a/mkspecs/features/qt_build_paths.prf b/mkspecs/features/qt_build_paths.prf
+index 3bb3823a8e..655b7b7db8 100644
+--- a/mkspecs/features/qt_build_paths.prf
++++ b/mkspecs/features/qt_build_paths.prf
+@@ -24,6 +24,6 @@ exists($$MODULE_BASE_INDIR/.git): \
+ !force_independent {
+     # If the module is not built independently, everything ends up in qtbase.
+     # This is the case in non-prefix builds, except for selected modules.
+-    MODULE_BASE_OUTDIR = $$[QT_HOST_PREFIX]
+-    MODULE_QMAKE_OUTDIR = $$[QT_HOST_PREFIX]
++    MODULE_BASE_OUTDIR = $$NIX_OUTPUT_OUT
++    MODULE_QMAKE_OUTDIR = $$NIX_OUTPUT_OUT
+ }
+diff --git a/mkspecs/features/qt_common.prf b/mkspecs/features/qt_common.prf
+index 4ad9946ae0..6d66f29c26 100644
+--- a/mkspecs/features/qt_common.prf
++++ b/mkspecs/features/qt_common.prf
+@@ -34,8 +34,8 @@ contains(TEMPLATE, .*lib) {
+         qqt_libdir = \$\$\$\$[QT_HOST_LIBS]
+         qt_libdir = $$[QT_HOST_LIBS]
+     } else {
+-        qqt_libdir = \$\$\$\$[QT_INSTALL_LIBS]
+-        qt_libdir = $$[QT_INSTALL_LIBS]
++        qqt_libdir = \$\$\$\$NIX_OUTPUT_OUT/lib
++        qt_libdir = $$NIX_OUTPUT_OUT/lib
+     }
+     contains(QMAKE_DEFAULT_LIBDIRS, $$qt_libdir) {
+         lib_replace.match = "[^ ']*$$rplbase/lib"
+diff --git a/mkspecs/features/qt_docs.prf b/mkspecs/features/qt_docs.prf
+index 3139c443c6..1b4f2fddd8 100644
+--- a/mkspecs/features/qt_docs.prf
++++ b/mkspecs/features/qt_docs.prf
+@@ -45,7 +45,7 @@ QMAKE_DOCS_OUTPUTDIR = $$QMAKE_DOCS_BASE_OUTDIR/$$QMAKE_DOCS_TARGETDIR
+ 
+ QDOC += -outputdir $$shell_quote($$QMAKE_DOCS_OUTPUTDIR)
+ !build_online_docs: \
+-    QDOC += -installdir $$shell_quote($$[QT_INSTALL_DOCS])
++    QDOC += -installdir $$shell_quote($$NIX_OUTPUT_DOC)
+ PREP_DOC_INDEXES =
+ DOC_INDEXES =
+ !isEmpty(QTREPOS) {
+@@ -64,8 +64,8 @@ DOC_INDEXES =
+         DOC_INDEXES += -indexdir $$shell_quote($$qrep/doc)
+ } else {
+     prepare_docs: \
+-        PREP_DOC_INDEXES += -indexdir $$shell_quote($$[QT_INSTALL_DOCS/get])
+-    DOC_INDEXES += -indexdir $$shell_quote($$[QT_INSTALL_DOCS/get])
++        PREP_DOC_INDEXES += -indexdir $$shell_quote($$NIX_OUTPUT_DOC)
++    DOC_INDEXES += -indexdir $$shell_quote($$NIX_OUTPUT_DOC)
+ }
+ 
+ qtattributionsscanner.target = qtattributionsscanner
+@@ -88,12 +88,12 @@ prepare_docs {
+     qch_docs.commands = $$QHELPGENERATOR $$shell_quote($$QMAKE_DOCS_OUTPUTDIR/$${QMAKE_DOCS_TARGET}.qhp) -o $$shell_quote($$QMAKE_DOCS_BASE_OUTDIR/$${QMAKE_DOCS_TARGET}.qch)
+ 
+     inst_html_docs.files = $$QMAKE_DOCS_OUTPUTDIR
+-    inst_html_docs.path = $$[QT_INSTALL_DOCS]
++    inst_html_docs.path = $$NIX_OUTPUT_DOC
+     inst_html_docs.CONFIG += no_check_exist directory no_default_install no_build
+     INSTALLS += inst_html_docs
+ 
+     inst_qch_docs.files = $$QMAKE_DOCS_BASE_OUTDIR/$${QMAKE_DOCS_TARGET}.qch
+-    inst_qch_docs.path = $$[QT_INSTALL_DOCS]
++    inst_qch_docs.path = $$NIX_OUTPUT_DOC
+     inst_qch_docs.CONFIG += no_check_exist no_default_install no_build
+     INSTALLS += inst_qch_docs
+ 
+diff --git a/mkspecs/features/qt_example_installs.prf b/mkspecs/features/qt_example_installs.prf
+index 43b58817fe..e635b8f67a 100644
+--- a/mkspecs/features/qt_example_installs.prf
++++ b/mkspecs/features/qt_example_installs.prf
+@@ -88,7 +88,7 @@ sourcefiles += \
+     $$SOURCES $$HEADERS $$FORMS $$RESOURCES $$TRANSLATIONS \
+     $$DBUS_ADAPTORS $$DBUS_INTERFACES
+ addInstallFiles(sources.files, $$sourcefiles)
+-sources.path = $$[QT_INSTALL_EXAMPLES]/$$probase
++sources.path = $$NIX_OUTPUT_DEV/share/examples/$$probase
+ INSTALLS += sources
+ 
+ check_examples {
+diff --git a/mkspecs/features/qt_functions.prf b/mkspecs/features/qt_functions.prf
+index 1903e509c8..ae7b585989 100644
+--- a/mkspecs/features/qt_functions.prf
++++ b/mkspecs/features/qt_functions.prf
+@@ -69,7 +69,7 @@ defineTest(qtHaveModule) {
+ defineTest(qtPrepareTool) {
+     cmd = $$eval(QT_TOOL.$${2}.binary)
+     isEmpty(cmd) {
+-        cmd = $$[QT_HOST_BINS]/$$2
++        cmd = $$system("command -v $$2")
+         exists($${cmd}.pl) {
+             $${1}_EXE = $${cmd}.pl
+             cmd = perl -w $$system_path($${cmd}.pl)
+diff --git a/mkspecs/features/qt_installs.prf b/mkspecs/features/qt_installs.prf
+index 8f98987b99..21b3bb8b32 100644
+--- a/mkspecs/features/qt_installs.prf
++++ b/mkspecs/features/qt_installs.prf
+@@ -12,16 +12,10 @@
+ #library
+ !qt_no_install_library {
+     win32 {
+-       host_build: \
+-           dlltarget.path = $$[QT_HOST_BINS]
+-       else: \
+-           dlltarget.path = $$[QT_INSTALL_BINS]
++        dlltarget.path = $$NIX_OUTPUT_BIN/bin
+        INSTALLS += dlltarget
+     }
+-    host_build: \
+-        target.path = $$[QT_HOST_LIBS]
+-    else: \
+-        target.path = $$[QT_INSTALL_LIBS]
++    target.path = $$NIX_OUTPUT_OUT/lib
+     !static: target.CONFIG = no_dll
+     INSTALLS += target
+ }
+@@ -29,33 +23,33 @@
+ #headers
+ qt_install_headers {
+     gen_headers.files = $$SYNCQT.GENERATED_HEADER_FILES
+-    gen_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME
++    gen_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME
+     INSTALLS += gen_headers
+ 
+     targ_headers.files = $$SYNCQT.HEADER_FILES $$SYNCQT.INJECTED_HEADER_FILES
+-    targ_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME
++    targ_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME
+     INSTALLS += targ_headers
+ 
+     private_headers.files = $$SYNCQT.PRIVATE_HEADER_FILES $$SYNCQT.INJECTED_PRIVATE_HEADER_FILES
+-    private_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
++    private_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
+     INSTALLS += private_headers
+ 
+     qpa_headers.files = $$SYNCQT.QPA_HEADER_FILES
+-    qpa_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/qpa
++    qpa_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/qpa
+     INSTALLS += qpa_headers
+ }
+ 
+ #module
+ qt_install_module {
+     !isEmpty(MODULE_PRI) {
+-        pritarget.path = $$[QT_HOST_DATA]/mkspecs/modules
++        pritarget.path = $$NIX_OUTPUT_DEV/mkspecs/modules
+         pritarget.files = $$MODULE_PRI
+         INSTALLS += pritarget
+     } else: isEmpty(MODULE_PRIVATE_PRI) {
+         warning("Project $$basename(_PRO_FILE_) is a module, but has not defined MODULE_PRI, which is required for Qt to expose the module to other projects.")
+     }
+     !isEmpty(MODULE_PRIVATE_PRI) {
+-        privpritarget.path = $$[QT_HOST_DATA]/mkspecs/modules
++        privpritarget.path = $$NIX_OUTPUT_DEV/mkspecs/modules
+         privpritarget.files = $$MODULE_PRIVATE_PRI
+         INSTALLS += privpritarget
+     }
+diff --git a/mkspecs/features/qt_plugin.prf b/mkspecs/features/qt_plugin.prf
+index 40528a65e2..903f795284 100644
+--- a/mkspecs/features/qt_plugin.prf
++++ b/mkspecs/features/qt_plugin.prf
+@@ -88,7 +88,7 @@ CONFIG(static, static|shared)|prefix_build {
+     }
+ }
+ 
+-target.path = $$[QT_INSTALL_PLUGINS]/$$PLUGIN_TYPE
++target.path = $$NIX_OUTPUT_PLUGIN/$$PLUGIN_TYPE
+ INSTALLS += target
+ 
+ TARGET = $$qt5LibraryTarget($$TARGET)
+diff --git a/src/corelib/Qt5CoreConfigExtras.cmake.in b/src/corelib/Qt5CoreConfigExtras.cmake.in
+index e0652fdcf9..450b2a2d28 100644
+--- a/src/corelib/Qt5CoreConfigExtras.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::qmake)
+     add_executable(Qt5::qmake IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -18,7 +18,7 @@ if (NOT TARGET Qt5::moc)
+     add_executable(Qt5::moc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -35,7 +35,7 @@ if (NOT TARGET Qt5::rcc)
+     add_executable(Qt5::rcc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -116,7 +116,7 @@ if (NOT TARGET Qt5::WinMain)
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ENDIF
+@@ -130,7 +130,7 @@ if (NOT TARGET Qt5::WinMain)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
+ 
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+index c357237d0e..6f0c75de3c 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_HOST_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_HOST_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+index 706304cf34..546420f6ad 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_INSTALL_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_INSTALL_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/kernel/qcoreapplication.cpp b/src/corelib/kernel/qcoreapplication.cpp
+index 463e30e1c3..0e1ab669e4 100644
+--- a/src/corelib/kernel/qcoreapplication.cpp
++++ b/src/corelib/kernel/qcoreapplication.cpp
+@@ -2665,6 +2665,15 @@ QStringList QCoreApplication::libraryPaths()
+         QStringList *app_libpaths = new QStringList;
+         coreappdata()->app_libpaths.reset(app_libpaths);
+ 
++        // Add library paths derived from PATH
++        const QStringList paths = QFile::decodeName(qgetenv("PATH")).split(':');
++        const QString plugindir = QStringLiteral("../" NIXPKGS_QT_PLUGIN_PREFIX);
++        for (const QString &path: paths) {
++            if (!path.isEmpty()) {
++                app_libpaths->append(QDir::cleanPath(path + QDir::separator() + plugindir));
++            }
++        }
++
+         const QByteArray libPathEnv = qgetenv("QT_PLUGIN_PATH");
+         if (!libPathEnv.isEmpty()) {
+             QStringList paths = QFile::decodeName(libPathEnv).split(QDir::listSeparator(), QString::SkipEmptyParts);
+diff --git a/src/corelib/tools/qtimezoneprivate_tz.cpp b/src/corelib/tools/qtimezoneprivate_tz.cpp
+index bed62a02bd..73158993f7 100644
+--- a/src/corelib/tools/qtimezoneprivate_tz.cpp
++++ b/src/corelib/tools/qtimezoneprivate_tz.cpp
+@@ -70,7 +70,11 @@ typedef QHash<QByteArray, QTzTimeZone> QTzTimeZoneHash;
+ // Parse zone.tab table, assume lists all installed zones, if not will need to read directories
+ static QTzTimeZoneHash loadTzTimeZones()
+ {
+-    QString path = QStringLiteral("/usr/share/zoneinfo/zone.tab");
++    // Try TZDIR first, in case we're running on NixOS.
++    QString path = QFile::decodeName(qgetenv("TZDIR")) + QStringLiteral("/zone.tab");
++    // Fallback to traditional paths in case we are not on NixOS.
++    if (!QFile::exists(path))
++        path = QStringLiteral("/usr/share/zoneinfo/zone.tab");
+     if (!QFile::exists(path))
+         path = QStringLiteral("/usr/lib/zoneinfo/zone.tab");
+ 
+@@ -644,12 +648,16 @@ void QTzTimeZonePrivate::init(const QByteArray &ianaId)
+         if (!tzif.open(QIODevice::ReadOnly))
+             return;
+     } else {
+-        // Open named tz, try modern path first, if fails try legacy path
+-        tzif.setFileName(QLatin1String("/usr/share/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++        // Try TZDIR first, in case we're running on NixOS
++        tzif.setFileName(QFile::decodeName(qgetenv("TZDIR")) + QStringLiteral("/") + QString::fromLocal8Bit(ianaId));
+         if (!tzif.open(QIODevice::ReadOnly)) {
+-            tzif.setFileName(QLatin1String("/usr/lib/zoneinfo/") + QString::fromLocal8Bit(ianaId));
+-            if (!tzif.open(QIODevice::ReadOnly))
+-                return;
++            // Open named tz, try modern path first, if fails try legacy path
++            tzif.setFileName(QLatin1String("/usr/share/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++            if (!tzif.open(QIODevice::ReadOnly)) {
++                tzif.setFileName(QLatin1String("/usr/lib/zoneinfo/") + QString::fromLocal8Bit(ianaId));
++                if (!tzif.open(QIODevice::ReadOnly))
++                    return;
++            }
+         }
+     }
+ 
+diff --git a/src/dbus/Qt5DBusConfigExtras.cmake.in b/src/dbus/Qt5DBusConfigExtras.cmake.in
+index 1d947159e2..b36865fc48 100644
+--- a/src/dbus/Qt5DBusConfigExtras.cmake.in
++++ b/src/dbus/Qt5DBusConfigExtras.cmake.in
+@@ -2,11 +2,7 @@
+ if (NOT TARGET Qt5::qdbuscpp2xml)
+     add_executable(Qt5::qdbuscpp2xml IMPORTED)
+ 
+-!!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5DBus_install_prefix}/$${CMAKE_BIN_DIR}qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+-!!ELSE
+-    set(imported_location \"$${CMAKE_BIN_DIR}qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+-!!ENDIF
++    set(imported_location \"$$NIX_OUTPUT_DEV/bin/qdbuscpp2xml$$CMAKE_BIN_SUFFIX\")
+     _qt5_DBus_check_file_exists(${imported_location})
+ 
+     set_target_properties(Qt5::qdbuscpp2xml PROPERTIES
+@@ -17,11 +13,7 @@ endif()
+ if (NOT TARGET Qt5::qdbusxml2cpp)
+     add_executable(Qt5::qdbusxml2cpp IMPORTED)
+ 
+-!!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5DBus_install_prefix}/$${CMAKE_BIN_DIR}qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+-!!ELSE
+-    set(imported_location \"$${CMAKE_BIN_DIR}qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+-!!ENDIF
++    set(imported_location \"$$NIX_OUTPUT_DEV/bin/qdbusxml2cpp$$CMAKE_BIN_SUFFIX\")
+     _qt5_DBus_check_file_exists(${imported_location})
+ 
+     set_target_properties(Qt5::qdbusxml2cpp PROPERTIES
+diff --git a/src/gui/Qt5GuiConfigExtras.cmake.in b/src/gui/Qt5GuiConfigExtras.cmake.in
+index 07869efd7d..fb4183bada 100644
+--- a/src/gui/Qt5GuiConfigExtras.cmake.in
++++ b/src/gui/Qt5GuiConfigExtras.cmake.in
+@@ -2,7 +2,7 @@
+ !!IF !isEmpty(CMAKE_ANGLE_EGL_DLL_RELEASE)
+ 
+ !!IF isEmpty(CMAKE_INCLUDE_DIR_IS_ABSOLUTE)
+-set(Qt5Gui_EGL_INCLUDE_DIRS \"${_qt5$${CMAKE_MODULE_NAME}_install_prefix}/$$CMAKE_INCLUDE_DIR/QtANGLE\")
++set(Qt5Gui_EGL_INCLUDE_DIRS \"$$NIX_OUTPUT_DEV/$$CMAKE_INCLUDE_DIR/QtANGLE\")
+ !!ELSE
+ set(Qt5Gui_EGL_INCLUDE_DIRS \"$$CMAKE_INCLUDE_DIR/QtANGLE\")
+ !!ENDIF
+@@ -17,13 +17,13 @@ macro(_populate_qt5gui_gl_target_properties TargetName Configuration LIB_LOCATIO
+     set_property(TARGET Qt5::${TargetName} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+ !!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Gui_install_prefix}/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
++    set(imported_location \"$$NIX_OUTPUT_OUT/$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_DLL_DIR}${LIB_LOCATION}\")
+ !!ENDIF
+ 
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_implib \"${_qt5Gui_install_prefix}/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
++    set(imported_implib \"$$NIX_OUTPUT_OUT/$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+ !!ELSE
+     set(imported_implib \"$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
+ !!ENDIF
+diff --git a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+index b5a0a5bbeb..6c20305f4d 100644
+--- a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
++++ b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+@@ -265,12 +265,9 @@ void TableGenerator::initPossibleLocations()
+     m_possibleLocations.reserve(7);
+     if (qEnvironmentVariableIsSet("QTCOMPOSE"))
+         m_possibleLocations.append(QString::fromLocal8Bit(qgetenv("QTCOMPOSE")));
+-    m_possibleLocations.append(QStringLiteral("/usr/share/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/local/share/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/lib/X11/locale"));
+-    m_possibleLocations.append(QStringLiteral("/usr/local/lib/X11/locale"));
+     m_possibleLocations.append(QStringLiteral(X11_PREFIX "/share/X11/locale"));
+     m_possibleLocations.append(QStringLiteral(X11_PREFIX "/lib/X11/locale"));
++    m_possibleLocations.append(QLatin1String(NIXPKGS_QTCOMPOSE));
+ }
+ 
+ QString TableGenerator::findComposeFile()
+diff --git a/src/plugins/platforms/xcb/qxcbcursor.cpp b/src/plugins/platforms/xcb/qxcbcursor.cpp
+index 57629ac03a..8a7f219a98 100644
+--- a/src/plugins/platforms/xcb/qxcbcursor.cpp
++++ b/src/plugins/platforms/xcb/qxcbcursor.cpp
+@@ -316,10 +316,10 @@ QXcbCursor::QXcbCursor(QXcbConnection *conn, QXcbScreen *screen)
+ #if QT_CONFIG(xcb_xlib) && QT_CONFIG(library)
+     static bool function_ptrs_not_initialized = true;
+     if (function_ptrs_not_initialized) {
+-        QLibrary xcursorLib(QLatin1String("Xcursor"), 1);
++        QLibrary xcursorLib(QLatin1String(NIXPKGS_LIBXCURSOR), 1);
+         bool xcursorFound = xcursorLib.load();
+         if (!xcursorFound) { // try without the version number
+-            xcursorLib.setFileName(QLatin1String("Xcursor"));
++            xcursorLib.setFileName(QLatin1String(NIXPKGS_LIBXCURSOR));
+             xcursorFound = xcursorLib.load();
+         }
+         if (xcursorFound) {
+diff --git a/src/plugins/platformthemes/gtk3/main.cpp b/src/plugins/platformthemes/gtk3/main.cpp
+index fb1c425d8e..bb8bab9795 100644
+--- a/src/plugins/platformthemes/gtk3/main.cpp
++++ b/src/plugins/platformthemes/gtk3/main.cpp
+@@ -39,6 +39,7 @@
+ 
+ #include <qpa/qplatformthemeplugin.h>
+ #include "qgtk3theme.h"
++#include <QFile>
+ 
+ QT_BEGIN_NAMESPACE
+ 
+@@ -54,8 +55,22 @@ public:
+ QPlatformTheme *QGtk3ThemePlugin::create(const QString &key, const QStringList &params)
+ {
+     Q_UNUSED(params);
+-    if (!key.compare(QLatin1String(QGtk3Theme::name), Qt::CaseInsensitive))
++    if (!key.compare(QLatin1String(QGtk3Theme::name), Qt::CaseInsensitive)) {
++
++#ifdef NIXPKGS_QGTK3_XDG_DATA_DIRS
++        QStringList XDG_DATA_DIRS = QFile::decodeName(qgetenv("XDG_DATA_DIRS")).split(':');
++        XDG_DATA_DIRS << QLatin1String(NIXPKGS_QGTK3_XDG_DATA_DIRS);
++        qputenv("XDG_DATA_DIRS", QFile::encodeName(XDG_DATA_DIRS.join(':')));
++#endif
++
++#ifdef NIXPKGS_QGTK3_GIO_EXTRA_MODULES
++        QStringList GIO_EXTRA_MODULES = QFile::decodeName(qgetenv("GIO_EXTRA_MODULES")).split(':');
++        GIO_EXTRA_MODULES << QLatin1String(NIXPKGS_QGTK3_GIO_EXTRA_MODULES);
++        qputenv("GIO_EXTRA_MODULES", QFile::encodeName(GIO_EXTRA_MODULES.join(':')));
++#endif
++
+         return new QGtk3Theme;
++    }
+ 
+     return 0;
+ }
+diff --git a/src/testlib/qtestassert.h b/src/testlib/qtestassert.h
+index 6498ea84ef..d821ced7fc 100644
+--- a/src/testlib/qtestassert.h
++++ b/src/testlib/qtestassert.h
+@@ -44,10 +44,13 @@
+ 
+ QT_BEGIN_NAMESPACE
+ 
+-
++#if defined(QT_NO_DEBUG) && !defined(QT_FORCE_ASSERTS)
++#define QTEST_ASSERT(cond) do { } while ((false) && (cond))
++#define QTEST_ASSERT_X(cond, where, what) do { } while ((false) && (cond))
++#else
+ #define QTEST_ASSERT(cond) do { if (!(cond)) qt_assert(#cond,__FILE__,__LINE__); } while (false)
+-
+ #define QTEST_ASSERT_X(cond, where, what) do { if (!(cond)) qt_assert_x(where, what,__FILE__,__LINE__); } while (false)
++#endif
+ 
+ QT_END_NAMESPACE
+ 
+diff --git a/src/widgets/Qt5WidgetsConfigExtras.cmake.in b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+index 99d87e2e46..a4eab2aa72 100644
+--- a/src/widgets/Qt5WidgetsConfigExtras.cmake.in
++++ b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::uic)
+     add_executable(Qt5::uic IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Widgets_install_prefix}/$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
diff --git a/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch b/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch
new file mode 100644
index 000000000000..8f5b5d4790fb
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtdeclarative.patch
@@ -0,0 +1,33 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 005db4248..685c5b1b2 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1760,6 +1760,15 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     QString installImportsPath =  QLibraryInfo::location(QLibraryInfo::Qml2ImportsPath);
+     addImportPath(installImportsPath);
+ 
++    // Add import paths derived from PATH
++    const QStringList paths = QFile::decodeName(qgetenv("PATH")).split(':');
++    const QString qmldir = QStringLiteral("../" NIXPKGS_QML2_IMPORT_PREFIX);
++    for (const QString &path: paths) {
++        if (!path.isEmpty()) {
++            addImportPath(QDir::cleanPath(path + QDir::separator() + qmldir));
++        }
++    }
++
+     // env import paths
+     if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty("QML2_IMPORT_PATH"))) {
+         const QString envImportPath = qEnvironmentVariable("QML2_IMPORT_PATH");
+diff --git a/tools/qmlcachegen/qmlcache.prf b/tools/qmlcachegen/qmlcache.prf
+index 537eaf62e..e21de58f6 100644
+--- a/tools/qmlcachegen/qmlcache.prf
++++ b/tools/qmlcachegen/qmlcache.prf
+@@ -26,7 +26,7 @@ defineReplace(qmlCacheOutputFileName) {
+ }
+ 
+ qmlcacheinst.base = $$QMLCACHE_DESTDIR
+-qmlcacheinst.path = $$[QT_INSTALL_QML]/$$TARGETPATH
++qmlcacheinst.path = $$NIX_OUTPUT_QML/$$TARGETPATH
+ qmlcacheinst.CONFIG = no_check_exist
+ 
+ qmlcachegen.input = CACHEGEN_FILES
diff --git a/pkgs/development/libraries/qt-5/5.12/qtscript.patch b/pkgs/development/libraries/qt-5/5.12/qtscript.patch
new file mode 100644
index 000000000000..5508dec1280e
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtscript.patch
@@ -0,0 +1,13 @@
+diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
+index 1f6d25e..087c3fb 100644
+--- a/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
++++ b/src/3rdparty/javascriptcore/JavaScriptCore/wtf/Threading.h
+@@ -81,7 +81,7 @@
+ #include <pthread.h>
+ #elif PLATFORM(GTK)
+ #include <wtf/gtk/GOwnPtr.h>
+-typedef struct _GMutex GMutex;
++typedef union _GMutex GMutex;
+ typedef struct _GCond GCond;
+ #endif
+ 
diff --git a/pkgs/development/libraries/qt-5/5.12/qtserialport.patch b/pkgs/development/libraries/qt-5/5.12/qtserialport.patch
new file mode 100644
index 000000000000..f25524e80bcf
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtserialport.patch
@@ -0,0 +1,22 @@
+diff --git a/src/serialport/qtudev_p.h b/src/serialport/qtudev_p.h
+index af2dab2..8e17f64 100644
+--- a/src/serialport/qtudev_p.h
++++ b/src/serialport/qtudev_p.h
+@@ -111,9 +111,17 @@ inline QFunctionPointer resolveSymbol(QLibrary *udevLibrary, const char *symbolN
+ inline bool resolveSymbols(QLibrary *udevLibrary)
+ {
+     if (!udevLibrary->isLoaded()) {
++#ifdef NIXPKGS_LIBUDEV
++        udevLibrary->setFileNameAndVersion(QLatin1String(NIXPKGS_LIBUDEV), 1);
++#else
+         udevLibrary->setFileNameAndVersion(QStringLiteral("udev"), 1);
++#endif
+         if (!udevLibrary->load()) {
++#ifdef NIXPKGS_LIBUDEV
++            udevLibrary->setFileNameAndVersion(QLatin1String(NIXPKGS_LIBUDEV), 0);
++#else
+             udevLibrary->setFileNameAndVersion(QStringLiteral("udev"), 0);
++#endif
+             if (!udevLibrary->load()) {
+                 qWarning("Failed to load the library: %s, supported version(s): %i and %i", qPrintable(udevLibrary->fileName()), 1, 0);
+                 return false;
diff --git a/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch b/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch
new file mode 100644
index 000000000000..b94a4b76cbab
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtwebkit.patch
@@ -0,0 +1,12 @@
+diff --git a/Source/WebKit2/PlatformQt.cmake b/Source/WebKit2/PlatformQt.cmake
+--- a/Source/WebKit2/PlatformQt.cmake
++++ b/Source/WebKit2/PlatformQt.cmake
+@@ -261,6 +261,7 @@
+ list(APPEND WebKit2_SYSTEM_INCLUDE_DIRECTORIES
+     ${GLIB_INCLUDE_DIRS}
+     ${GSTREAMER_INCLUDE_DIRS}
++    ${GSTREAMER_PBUTILS_INCLUDE_DIRS}
+     ${Qt5Quick_INCLUDE_DIRS}
+     ${Qt5Quick_PRIVATE_INCLUDE_DIRS}
+     ${SQLITE_INCLUDE_DIR}
+
diff --git a/pkgs/development/libraries/qt-5/5.12/srcs.nix b/pkgs/development/libraries/qt-5/5.12/srcs.nix
new file mode 100644
index 000000000000..d83edc97e94f
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/srcs.nix
@@ -0,0 +1,325 @@
+# DO NOT EDIT! This file is generated automatically by fetch-kde-qt.sh
+{ fetchurl, mirror }:
+
+{
+  qt3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qt3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nii8qz8791ripmqd158qah40j2dj50zn7lmqksqz8gz2jfdqam1";
+      name = "qt3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtactiveqt = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtactiveqt-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gkdx3mc6ysqlf0ci77kf9c961dc9sbi4j3z5q237d1w4js7ca52";
+      name = "qtactiveqt-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtandroidextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtandroidextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0s083ngvya8bknp0bvgb3hyk6zr8shg8rmkzn98956dqz0xs3agm";
+      name = "qtandroidextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtbase = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtbase-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1jzfx8c0hzch0kmz2m4vkn65s7ikiymnm29lsymil4hfg0fj40sy";
+      name = "qtbase-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtcanvas3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcanvas3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0a61z5amp409aq9v7j0fyk003fbz2i247idl7lgfbl4qqh0ry6xj";
+      name = "qtcanvas3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtcharts = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcharts-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0l6lrrwqbqaf6agsghaw4ysm2vb6b4n9j5lgrs1i0q8h9i51rmww";
+      name = "qtcharts-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtconnectivity = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtconnectivity-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1912a4my72wcqmmdyj24wkwq9p9ih4gzzzvgiq75pfwyhnxa3g4f";
+      name = "qtconnectivity-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdatavis3d = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdatavis3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0czlj088gf2r6w5ahh0p8n36lbwmds86mxqijshmhzax5cspxnjf";
+      name = "qtdatavis3d-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdeclarative = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdeclarative-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0yr29hm3bqlwxcmna0bzyxw8k4hw3x8k3k4iiw2sw52p5c85izag";
+      name = "qtdeclarative-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtdoc = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdoc-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1k8caa1nmc9nrhb29vq1qzaz608klnjxy509w6ppxlzz2zbpcr9h";
+      name = "qtdoc-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtgamepad = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgamepad-everywhere-src-5.12.0.tar.xz";
+      sha256 = "14b0np15gm5lzvip33pg6w9dfs065wwdfz18na28bhbxj6wh06ac";
+      name = "qtgamepad-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtgraphicaleffects = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0m9l031zhw8il66ld8bj1lwqlc2xx89nl6dvssz1kl2d5nqqy1c1";
+      name = "qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtimageformats = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtimageformats-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bkkk5skpplwfbqv7g41rhgynyxs3khvf8gk2rl2gdixdplpv42z";
+      name = "qtimageformats-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtlocation = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtlocation-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0ja4cwj59y1xhwwf4f5gzr0fdrrsxbh14g2x812n03x0yd6i78xh";
+      name = "qtlocation-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtmacextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmacextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "00xhkj66i3srwmzzin1mcx9m94l5ns08f93c1za3wl23ani7n2nr";
+      name = "qtmacextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtmultimedia = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmultimedia-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a96x6c2w9rs6vfsdcnzmmad4w32dxy2dvismldcwmwcq2whqjsw";
+      name = "qtmultimedia-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtnetworkauth = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtnetworkauth-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0x877ra8375pf8d8p6hgdkyw8yzjqfca6rgki6vi1q8fyi31j4a1";
+      name = "qtnetworkauth-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtpurchasing = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtpurchasing-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nk0dp247v1rfbnj84g99zsj6iv86pq32f478r92adz9qcgfs2yr";
+      name = "qtpurchasing-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtquickcontrols = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0wyd24aphpixi3k9vbxw73z3dy1xnf8hwc99wimr5mpf1cj67yrb";
+      name = "qtquickcontrols-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtquickcontrols2 = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1ikxj32rd9pipnrz81l5ln700lnw8w6bx573w01x424sx0p7wxw9";
+      name = "qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtremoteobjects = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtremoteobjects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0pwx2m17yw1qqv8qigfndgj1yd5kq8w5cbiaqlw4zdk1m6jd0h09";
+      name = "qtremoteobjects-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtscript = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscript-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a7ziipvy8cfmrpw2b868167sw21zrqhfv2la0w9vs6hwli1mzlp";
+      name = "qtscript-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtscxml = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscxml-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0syx3bx9pxxrsxanfv245ifppjhbj7sbrndh8il86xlrcr9cwvnw";
+      name = "qtscxml-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtsensors = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsensors-everywhere-src-5.12.0.tar.xz";
+      sha256 = "19n5vlx0j5a0h86mpgs86qzsxbyq8fcrls7yqnjdaw0zga234cf5";
+      name = "qtsensors-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtserialbus = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialbus-everywhere-src-5.12.0.tar.xz";
+      sha256 = "16imi82v17n18a5m0i2fcfj6hqdpnzn2z9kdcf6a8h93fv4qd4kb";
+      name = "qtserialbus-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtserialport = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialport-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1fx9fm0418jq05j2hlb52lblq8nr4m0hj8sizi86p708jmb01m2r";
+      name = "qtserialport-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtspeech = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtspeech-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1yx4wahl7iaj6lgpvnw8pdi2q4wc2fkpzfidd3j1bc98wpna4f8r";
+      name = "qtspeech-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtsvg = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsvg-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1kpvqd0p7dblgh26p3a99npqr0wmyg5yv0dcmf78ssrvsy58vrpb";
+      name = "qtsvg-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qttools = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttools-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1hyschrj568h65m3kl35xqz25hpk61vr98r08375vkavdr5y6k2p";
+      name = "qttools-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qttranslations = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttranslations-everywhere-src-5.12.0.tar.xz";
+      sha256 = "023m68vdjj75xnbpc1jflyg85amnjc9i6nwv650k0w4n1dp1hksv";
+      name = "qttranslations-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtvirtualkeyboard = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nnns0i577zda6qxxd7pxcy06dq0y7lnni8ghn4adh9yl6dvi4yv";
+      name = "qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwayland = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwayland-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1mvyv4wkcxj4h3q0mqw53zb1d0pahf8mz3r29kckadvk64djsp2m";
+      name = "qtwayland-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebchannel = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebchannel-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1w2b31d7xjzdcgwkb4mz3qrl9ci7c9l4c3v4h8y59isip45g66l5";
+      name = "qtwebchannel-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebengine = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebengine-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0z38ad25n7ckylxnmqrxy95ds4pn7i5k7qxh856zgq1h18wiwn5x";
+      name = "qtwebengine-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebglplugin = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebglplugin-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bk5dg33kn2l5lmgd6slsrs9xg15x9h9li91lr1q7qs67b8kl8k5";
+      name = "qtwebglplugin-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebsockets = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebsockets-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gzwfjnlgcijym5bn9gi93qlvzizrhf1q9dq06576419sg0s2ka4";
+      name = "qtwebsockets-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwebview = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebview-everywhere-src-5.12.0.tar.xz";
+      sha256 = "11b16b31bxcazqzg1ag9rzh4gj9pif2cf3jz2mj1sdprxp22ra5p";
+      name = "qtwebview-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtwinextras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwinextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1l6s140vrfxb9ar4p1dq9w2gfk3zvgrpqdxbbzs4ngfpwk6mlky6";
+      name = "qtwinextras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtx11extras = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtx11extras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "114b4akzpcgx57c6gkl558bl0mbasi34r22fmq3ny84dhvlv9m06";
+      name = "qtx11extras-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+  qtxmlpatterns = {
+    version = "5.12.0";
+    src = fetchurl {
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0xckcw1j6f5l92c269pb8cx77d21sghp7m7dc05jl1dqmyy7jqpk";
+      name = "qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
+    };
+  };
+}
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index e815cc8f70f2..9391999f1e90 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -51,8 +51,7 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = [ ./qtwebengine-seccomp.patch ]
-      ++ optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
+    qtwebengine = [ ./qtwebengine-seccomp.patch ];
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index b3316188f7d9..000000000000
--- a/pkgs/development/libraries/qt-5/5.6/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,46 +0,0 @@
---- qtwebengine-opensource-src-5.6.0-orig/src/3rdparty/chromium/v8/tools/gyp/v8.gyp	2016-03-04 01:48:36.000000000 +1100
-+++ qtwebengine-opensource-src-5.6.0/src/3rdparty/chromium/v8/tools/gyp/v8.gyp	2016-05-01 19:15:44.052770543 +1000
-@@ -33,6 +33,7 @@
-     'embed_script%': "",
-     'v8_extra_library_files%': [],
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'remove_v8base_debug_symbols%': 0,
-   },
-   'includes': ['../../build/toolchain.gypi', '../../build/features.gypi'],
-@@ -1913,7 +1914,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': ['v8_base', 'v8_nosnapshot', 'v8_libplatform'],
-       'include_dirs+': [
-@@ -1936,5 +1937,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/5.9/default.nix b/pkgs/development/libraries/qt-5/5.9/default.nix
index 6fcb7a0dc5eb..4acc6a6393f1 100644
--- a/pkgs/development/libraries/qt-5/5.9/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/default.nix
@@ -43,7 +43,6 @@ let
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
-    qtwebengine = optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch b/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch
deleted file mode 100644
index 5e170567ce5d..000000000000
--- a/pkgs/development/libraries/qt-5/5.9/qtwebengine-paxmark-mksnapshot.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-Index: qtwebengine-opensource-src-5.9.0/src/3rdparty/chromium/v8/src/v8.gyp
-===================================================================
---- qtwebengine-opensource-src-5.9.0.orig/src/3rdparty/chromium/v8/src/v8.gyp
-+++ qtwebengine-opensource-src-5.9.0/src/3rdparty/chromium/v8/src/v8.gyp
-@@ -36,6 +36,7 @@
-     'v8_experimental_extra_library_files%': [],
-     'v8_enable_inspector%': 0,
-     'mksnapshot_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot<(EXECUTABLE_SUFFIX)',
-+    'mksnapshot_u_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mksnapshot_u<(EXECUTABLE_SUFFIX)',
-     'mkpeephole_exec': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkpeephole<(EXECUTABLE_SUFFIX)',
-     'v8_os_page_size%': 0,
-   },
-@@ -2432,7 +2433,7 @@
-         ]
-     },
-     {
--      'target_name': 'mksnapshot',
-+      'target_name': 'mksnapshot_u',
-       'type': 'executable',
-       'dependencies': [
-         'v8_base',
-@@ -2485,5 +2486,26 @@
-         }],
-       ],
-     },
-+    {
-+      'target_name': 'mksnapshot',
-+      'type': 'executable',
-+      'dependencies': ['mksnapshot_u'],
-+      'actions': [
-+        {
-+          'action_name': 'paxmark_m_mksnapshot',
-+          'inputs': [
-+            '<(mksnapshot_u_exec)',
-+          ],
-+          'outputs': [
-+            '<(mksnapshot_exec)',
-+          ],
-+          'action': [
-+            'sh',
-+            '-c',
-+            'cp <(mksnapshot_u_exec) <(mksnapshot_exec) && paxctl -czexm <(mksnapshot_exec)',
-+          ],
-+        },
-+      ],
-+    },
-   ],
- }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index ad54a49e50b7..a80488bad5e1 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -14,7 +14,7 @@
 , enableProprietaryCodecs ? true
 , gn, darwin, openbsm
 , ffmpeg ? null
-, lib, stdenv # lib.optional, needsPax
+, lib, stdenv
 }:
 
 with stdenv.lib;
@@ -42,9 +42,8 @@ qtModule {
       ( cd src/3rdparty/chromium; patchShebangs . )
     ''
     # Patch Chromium build files
-    + ''
-      substituteInPlace ./src/3rdparty/chromium/build/common.gypi \
-        --replace /bin/echo ${coreutils}/bin/echo
+    + optionalString (builtins.compareVersions qtCompatVersion "5.12" < 0) ''
+      substituteInPlace ./src/3rdparty/chromium/build/common.gypi --replace /bin/echo ${coreutils}/bin/echo
       substituteInPlace ./src/3rdparty/chromium/v8/${if qt56 then "build" else "gypfiles"}/toolchain.gypi \
         --replace /bin/echo ${coreutils}/bin/echo
       substituteInPlace ./src/3rdparty/chromium/v8/${if qt56 then "build" else "gypfiles"}/standalone.gypi \
@@ -182,7 +181,6 @@ EOF
     [Paths]
     Prefix = ..
     EOF
-    paxmark m $out/libexec/QtWebEngineProcess
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/tdb/default.nix b/pkgs/development/libraries/tdb/default.nix
index f6e4a0472828..d2ff7c5efd34 100644
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, python, pkgconfig, readline, libxslt
-, docbook_xsl, docbook_xml_dtd_42
+{ stdenv, fetchurl, python2, pkgconfig, readline, libxslt
+, docbook_xsl, docbook_xml_dtd_42, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -10,28 +10,32 @@ stdenv.mkDerivation rec {
     sha256 = "1ibcz466xwk1x6xvzlgzd5va4lyrjzm3rnjak29kkwk7cmhw4gva";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig python2 ];
   buildInputs = [
-    python readline libxslt docbook_xsl docbook_xml_dtd_42
+    readline libxslt docbook_xsl docbook_xml_dtd_42
   ];
 
   preConfigure = ''
-    sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,g' buildtools/bin/waf
+    patchShebangs buildtools/bin/waf
   '';
 
   configureFlags = [
     "--bundled-libraries=NONE"
     "--builtin-libraries=replace"
+  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "--cross-compile"
+    "--cross-execute=${stdenv.hostPlatform.emulator buildPackages}"
   ];
+  configurePlatforms = [ ];
 
   meta = with stdenv.lib; {
     description = "The trivial database";
-    longDescription =
-      '' TDB is a Trivial Database. In concept, it is very much like GDBM,
-         and BSD's DB except that it allows multiple simultaneous writers and
-         uses locking internally to keep writers from trampling on each
-         other.  TDB is also extremely small.
-      '';
+    longDescription = ''
+      TDB is a Trivial Database. In concept, it is very much like GDBM,
+      and BSD's DB except that it allows multiple simultaneous writers
+      and uses locking internally to keep writers from trampling on each
+      other. TDB is also extremely small.
+    '';
     homepage = https://tdb.samba.org/;
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ wkennington ];
diff --git a/pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix b/pkgs/development/libraries/totem-pl-parser/default.nix
index baf42b88e15b..4c052a5c02f6 100644
--- a/pkgs/desktops/gnome-3/core/totem-pl-parser/default.nix
+++ b/pkgs/development/libraries/totem-pl-parser/default.nix
@@ -1,16 +1,18 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, gmime, libxml2, gobject-introspection, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "totem-pl-parser-${version}";
+  pname = "totem-pl-parser";
   version = "3.26.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/totem-pl-parser/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0k5pnka907invgds48d73c1xx1a366v5dcld3gr2l1dgmjwc9qka";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "totem-pl-parser"; attrPath = "gnome3.totem-pl-parser"; };
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext gobject-introspection ];
diff --git a/pkgs/desktops/gnome-3/core/vte/2.90.nix b/pkgs/development/libraries/vte/2.90.nix
index 52bf198f29ce..4b2b74c5e1d5 100644
--- a/pkgs/desktops/gnome-3/core/vte/2.90.nix
+++ b/pkgs/development/libraries/vte/2.90.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gnome3, ncurses, gobject-introspection }:
+{ stdenv, fetchurl, intltool, pkgconfig, gnome3, glib, gtk3, ncurses, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   versionMajor = "0.36";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gobject-introspection intltool gnome3.glib gnome3.gtk3 ncurses ];
+  buildInputs = [ gobject-introspection intltool glib gtk3 ncurses ];
 
   configureFlags = [ "--enable-introspection" ];
 
diff --git a/pkgs/desktops/gnome-3/core/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index 904bdd323d81..97bb961c4bc5 100644
--- a/pkgs/desktops/gnome-3/core/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -1,27 +1,27 @@
 { stdenv, fetchurl, intltool, pkgconfig
-, gnome3, ncurses, gobject-introspection, vala, libxml2, gnutls
+, gnome3, glib, gtk3, ncurses, gobject-introspection, vala, libxml2, gnutls
 , gperf, pcre2
 }:
 
 stdenv.mkDerivation rec {
-  name = "vte-${version}";
+  pname = "vte";
   version = "0.54.3";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/vte/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1zgb8jgi6sr4km58zfml8zkm24qipbngl2h7s5razhi5a0a84dk9";
   };
 
   passthru = {
-    updateScript = gnome3.updateScript { packageName = "vte"; attrPath = "gnome3.vte"; };
+    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   nativeBuildInputs = [ gobject-introspection intltool pkgconfig vala gperf libxml2 ];
-  buildInputs = [ gnome3.glib gnome3.gtk3 ncurses ];
+  buildInputs = [ glib gtk3 ncurses ];
 
   propagatedBuildInputs = [
     # Required by vte-2.91.pc.
-    gnome3.gtk3
+    gtk3
     gnutls
     pcre2
   ];
diff --git a/pkgs/desktops/gnome-3/core/vte/ng.nix b/pkgs/development/libraries/vte/ng.nix
index e6dc005fe58e..3aee9e9dcdf3 100644
--- a/pkgs/desktops/gnome-3/core/vte/ng.nix
+++ b/pkgs/development/libraries/vte/ng.nix
@@ -1,6 +1,6 @@
-{ gnome3, fetchFromGitHub, autoconf, automake, gtk-doc, gettext, libtool, gperf }:
+{ vte, fetchFromGitHub, autoconf, automake, gtk-doc, gettext, libtool, gperf }:
 
-gnome3.vte.overrideAttrs (oldAttrs: rec {
+vte.overrideAttrs (oldAttrs: rec {
   name = "vte-ng-${version}";
   version = "0.50.2.a";
 
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 866b1232aef5..c694cc7b4452 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkgconfig
-, libffi, libxml2
+, libffi, libxml2, wayland
 , expat ? null # Build wayland-scanner (currently cannot be disabled as of 1.7.0)
 }:
 
@@ -15,9 +15,18 @@ stdenv.mkDerivation rec {
     sha256 = "1xajhxad43izq9f7sbww1hlg42nayijy8xnp21kgpk09c6sw4wjf";
   };
 
-  configureFlags = [ "--with-scanner" "--disable-documentation" ];
-
-  nativeBuildInputs = [ pkgconfig ];
+  configureFlags = [
+    "--disable-documentation"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "--with-host-scanner"
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    # for wayland-scanner during build
+    wayland
+  ];
 
   buildInputs = [ libffi /* docbook_xsl doxygen graphviz libxslt xmlto */ expat libxml2 ];
 
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 06a4e48827ed..3b0a447f7376 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, cmake, alsaLib, freepats }:
 
 stdenv.mkDerivation rec {
-  name = "wildmidi-0.4.2";
+  name = "wildmidi-0.4.3";
 
   src = fetchurl {
     url = "https://github.com/Mindwerks/wildmidi/archive/${name}.tar.gz";
-    sha256 = "178hm2wh5h7apkcb1a0dyla2ia8569php8ikz62rh0g6dp5l67am";
+    sha256 = "1igkxv4axnqap59d8pjgqj94x0khn3fdd2hq6wdvkd2v8nb5m3j9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 4212687a02ac..7ea28f6b61e8 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation rec {
       url = "https://bitbucket.org/multicoreware/x265/commits/471726d3a0462739ff8e3518eb1a1e8a01de4e8d/raw";
       sha256 = "0mj8lb8ng8lrhzjavap06vjhqf6j0r3sn76c6rhs3012f86lv928";
     })
+    # Fix build on ARM (#406) 
+    (fetchpatch {
+      url = "https://bitbucket.org/multicoreware/x265/issues/attachments/406/multicoreware/x265/1527562952.26/406/X265-2.8-asm-primitives.patch";
+      sha256 = "1vf8bpl37gbd9dcbassgkq9i0rp24qm3bl6hx9zv325174bn402v";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 79bebd87dbc2..ab0482559a43 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zeromq-${version}";
-  version = "4.2.5";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "18mjmbhvfhr4463dqayl5hdjfy5rx7na1xsq9dsvlaz9qlr5fskw";
+    sha256 = "12a2l6dzxkk1x8yl8bihnfs6gi2vgyi4jm9q8acj46f6niryhsmr";
   };
 
   nativeBuildInputs = [ cmake asciidoc ];
diff --git a/pkgs/development/perl-modules/DBD-SQLite/default.nix b/pkgs/development/perl-modules/DBD-SQLite/default.nix
index 5b6990810b39..98d98266db17 100644
--- a/pkgs/development/perl-modules/DBD-SQLite/default.nix
+++ b/pkgs/development/perl-modules/DBD-SQLite/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, buildPerlPackage, DBI, sqlite }:
+{ stdenv, fetchurl, buildPerlPackage, perl, DBI, sqlite }:
 
 buildPerlPackage rec {
   name = "DBD-SQLite-1.58";
@@ -20,7 +20,7 @@ buildPerlPackage rec {
 
   postInstall = ''
     # Get rid of a pointless copy of the SQLite sources.
-    rm -rf $out/lib/perl5/site_perl/*/*/auto/share
+    rm -rf $out/${perl.libPrefix}/*/*/auto/share
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index ef8d1e52fe07..8ccfd2e9efb7 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2018.10.15";
+  version = "2018.11.29";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6d58c986d22b038c8c0df30d639f23a3e6d172a05c3583e766f4c0b785c0986a";
+    sha256 = "1dvccavd2fzq4j37w0sznylp92ps14zi6gvlxzm23in0yhzciya7";
   };
 
   meta = {
@@ -18,4 +18,4 @@ buildPythonPackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ koral ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/elasticsearch-curator/default.nix b/pkgs/development/python-modules/elasticsearch-curator/default.nix
index 1ea6e4cabad8..66c124d65a78 100644
--- a/pkgs/development/python-modules/elasticsearch-curator/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-curator/default.nix
@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname   = "elasticsearch-curator";
-  version = "5.5.4";
+  version = "5.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e75abeb7f7be939b1c64c071898760dc10ab5f08307c253fc074abf8a41a76f0";
+    sha256 = "0r4p229233ivprxnvp33hilkgczijmyvi33wivxhhj6q3kkywpyq";
   };
 
   # The test hangs so we disable it.
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 331c88a5e3a0..f5769bf0b2d9 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -5,6 +5,7 @@
 , typing
 , isPy3k
 , pythonOlder
+, python
 }:
 
 buildPythonPackage rec {
@@ -21,8 +22,9 @@ buildPythonPackage rec {
     ++ lib.optional (pythonOlder "3.5") typing
   ;
 
-  # https://gitlab.com/python-devs/importlib_resources/issues/69
-  doCheck = !isPy3k;
+  checkPhase = ''
+    ${python.interpreter} -m unittest discover
+  '';
 
   meta = with lib; {
     description = "Read resources from Python packages";
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 2334e4a3431b..313a3e5ab189 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2_0_27, six, cffi }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2, six, cffi }:
 
 buildPythonPackage rec {
   pname = "pygit2";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="${libgit2_0_27}/lib"
+    export DYLD_LIBRARY_PATH="${libgit2}/lib"
   '';
 
   patches = [ (fetchpatch {
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "18x1fpmywhjjr4lvakwmy34zpxfqi8pqqj48g1wcib39lh3s7l4f";
   }) ];
 
-  propagatedBuildInputs = [ libgit2_0_27 six ] ++ lib.optional (!isPyPy) cffi;
+  propagatedBuildInputs = [ libgit2 six ] ++ lib.optional (!isPyPy) cffi;
 
   preCheck = ''
     # disable tests that require networking
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index acc8ee713117..d1b2f075b914 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -3,13 +3,13 @@ pycairo, cairo, which, ncurses, meson, ninja, isPy3k, gnome3 }:
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.30.2";
+  version = "3.30.4";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "15zd4w43js048y7fd1kdi6wpvccz1njjy60xw1ckvfy1qhikbz54";
+    sha256 = "0hscyvr6hh8l90fyz97b9d03506g3r8s5hl1bgk5aadq8jja3h9d";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 597a8e0783a2..5fe21024e008 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "878352408424dffaa695ffedf2f9f92844e116686923ed9aa8626fc30d32cfd1";
+    sha256 = "51a2424c8ed80e60bdb9a896806e7adaf24a58253b326fbad10f80a6d06f2214";
   };
 
   checkInputs = [ nose pytest ];
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 55bae2740cc2..5b4bde0ff0af 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -1,10 +1,11 @@
 {stdenv, fetchFromGitHub
+, buildPackages
 , callPackage
-, ninja, meson , pkgconfig
+, pkgconfig
 , libusb, readline, libewf, perl, zlib, openssl
-, libuv
+, libuv, file, libzip, xxHash
 , gtk2 ? null, vte ? null, gtkdialog ? null
-, python ? null
+, python3 ? null
 , ruby ? null
 , lua ? null
 , useX11, rubyBindings, pythonBindings, luaBindings
@@ -12,7 +13,7 @@
 
 assert useX11 -> (gtk2 != null && vte != null && gtkdialog != null);
 assert rubyBindings -> ruby != null;
-assert pythonBindings -> python != null;
+assert pythonBindings -> python3 != null;
 
 
 let
@@ -49,39 +50,42 @@ let
         if ! grep -F "CS_TIP=${cs_tip}" shlr/Makefile; then echo "CS_TIP mismatch"; exit 1; fi
         # When using meson, it expects capstone source relative to build directory
         mkdir -p build/shlr
-        ln -s ${capstone} build/shlr/capstone
+        cp -r ${capstone} shlr/capstone
+        chmod -R +w shlr/capstone
       '';
 
       postInstall = ''
-        ln -s $out/bin/radare2 $out/bin/r2
         install -D -m755 $src/binr/r2pm/r2pm $out/bin/r2pm
       '';
 
-      mesonFlags = [
-        "-Dr2_version_commit=${version_commit}"
-        "-Dr2_gittap=${gittap}"
-        "-Dr2_gittip=${gittip}"
-        # 2.8.0 expects this, but later it becomes an option with default=false.
-        "-Dcapstone_in_builddir=true"
-
-        "-Duse_sys_openssl=true"
-        "-Duse_sys_zlib=true"
+      WITHOUT_PULL="1";
+      makeFlags = [
+        "GITTAP=${gittap}"
+        "GITTIP=${gittip}"
+        "RANLIB=${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.bintools.targetPrefix}ranlib"
+      ];
+      configureFlags = [
+        "--with-sysmagic"
+        "--with-syszip"
+        "--with-sysxxhash"
+        "--with-openssl"
       ];
 
       enableParallelBuilding = true;
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-      nativeBuildInputs = [ pkgconfig ninja meson ];
-      buildInputs = [ readline libusb libewf perl zlib openssl libuv ]
-        ++ optional useX11 [gtkdialog vte gtk2]
-        ++ optional rubyBindings [ruby]
-        ++ optional pythonBindings [python]
-        ++ optional luaBindings [lua];
+      nativeBuildInputs = [ pkgconfig ];
+      buildInputs = [ file libzip xxHash readline libusb libewf perl zlib openssl libuv ]
+        ++ optional useX11 [ gtkdialog vte gtk2 ]
+        ++ optional rubyBindings [ ruby ]
+        ++ optional pythonBindings [ python3 ]
+        ++ optional luaBindings [ lua ];
 
       meta = {
         description = "unix-like reverse engineering framework and commandline tools";
         homepage = http://radare.org/;
         license = stdenv.lib.licenses.gpl2Plus;
-        maintainers = with stdenv.lib.maintainers; [raskin makefu mic92];
+        maintainers = with stdenv.lib.maintainers; [ raskin makefu mic92 ];
         platforms = with stdenv.lib.platforms; linux;
         inherit version;
       };
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index d70ec0ed9ac5..78f40913eb5f 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -11,15 +11,15 @@ stdenv.mkDerivation rec {
   # autoreconfHook is needed to pick up patching of Makefile.am
   # Remove when the patch no longer applies.
   patches = [ ./coregrind-makefile-race.patch ];
-  nativeBuildInputs = [ autoreconfHook ];
+  # Perl is needed for `cg_annotate'.
+  nativeBuildInputs = [ autoreconfHook perl ];
 
   outputs = [ "out" "dev" "man" "doc" ];
 
   hardeningDisable = [ "stackprotector" ];
 
-  # Perl is needed for `cg_annotate'.
   # GDB is needed to provide a sane default for `--db-command'.
-  buildInputs = [ perl gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
+  buildInputs = [ gdb ]  ++ stdenv.lib.optionals (stdenv.isDarwin) [ bootstrap_cmds xnu ];
 
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.isLinux;
@@ -73,8 +73,6 @@ stdenv.mkDerivation rec {
         --replace 'obj:/usr/X11R6/lib' 'obj:*/lib' \
         --replace 'obj:/usr/lib' 'obj:*/lib'
     done
-
-    paxmark m $out/lib/valgrind/*-*-linux
   '';
 
   meta = {
diff --git a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
index 382c2f0c05b2..591927c15285 100644
--- a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
+++ b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
@@ -1,6 +1,6 @@
 --- a/mesonbuild/coredata.py
 +++ b/mesonbuild/coredata.py
-@@ -298,18 +298,13 @@
+@@ -375,18 +375,13 @@
          '''
          if option.endswith('dir') and os.path.isabs(value) and \
             option not in builtin_dir_noprefix_options:
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 13f61fb16177..17938ab47b37 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,12 +1,12 @@
 { lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.48.2";
+  version = "0.49.0";
   pname = "meson";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1shfbr0mf8gmwpw5ivrmwp8282qw9mfhxmccd7fsgidp4x3nslby";
+    sha256 = "0895igla1qav8k250z2qv03a0fg491wzzkfpbk50wwq848vmbkd0";
   };
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/meson/fix-rpath.patch b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
index 30ecb30ee932..1a5f8cb89dce 100644
--- a/pkgs/development/tools/build-managers/meson/fix-rpath.patch
+++ b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
@@ -1,27 +1,18 @@
 --- a/mesonbuild/compilers/compilers.py
 +++ b/mesonbuild/compilers/compilers.py
-@@ -1112,6 +1112,8 @@
-         for p in rpath_paths:
-             if p == from_dir:
-                 relative = '' # relpath errors out in this case
-+            elif os.path.isabs(p):
-+                relative = p # These can be outside of build dir.
-             else:
-                 relative = os.path.relpath(os.path.join(build_dir, p), os.path.join(build_dir, from_dir))
-             rel_rpaths.append(relative)
-@@ -1121,8 +1123,10 @@
-             if paths != '':
-                 paths += ':'
-             paths += build_rpath
--        if len(paths) < len(install_rpath):
--            padding = 'X' * (len(install_rpath) - len(paths))
-+        store_paths = ':'.join(filter(lambda path: path.startswith('@storeDir@'), paths.split(':')))
-+        extra_space_needed = len(install_rpath + (':' if install_rpath and store_paths else '') + store_paths) - len(paths)
-+        if extra_space_needed > 0:
-+            padding = 'X' * extra_space_needed
-             if not paths:
-                 paths = padding
-             else:
+@@ -1202,8 +1202,10 @@
+             # In order to avoid relinking for RPATH removal, the binary needs to contain just
+             # enough space in the ELF header to hold the final installation RPATH.
+             paths = ':'.join(all_paths)
+-            if len(paths) < len(install_rpath):
+-                padding = 'X' * (len(install_rpath) - len(paths))
++            store_paths = ':'.join(filter(lambda path: path.startswith('@storeDir@'), all_paths))
++            extra_space_needed = len(install_rpath + (':' if install_rpath and store_paths else '') + store_paths) - len(paths)
++            if extra_space_needed > 0:
++                padding = 'X' * extra_space_needed
+                 if not paths:
+                     paths = padding
+                 else:
 --- a/mesonbuild/scripts/depfixer.py
 +++ b/mesonbuild/scripts/depfixer.py
 @@ -303,6 +303,14 @@
diff --git a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
index b7667ed493f2..7a33d4127fae 100644
--- a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
+++ b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
@@ -1,6 +1,6 @@
 --- a/mesonbuild/modules/gnome.py
 +++ b/mesonbuild/modules/gnome.py
-@@ -780,6 +780,13 @@
+@@ -805,6 +805,13 @@
          scan_command += self._scan_langs(state, [lc[0] for lc in langs_compilers])
          scan_command += list(external_ldflags)
  
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 7d045115b594..787a5dbc646e 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -30,19 +30,9 @@ stdenv.mkDerivation rec {
   });
 
   patches = [
-    # Since binutils 2.22, DT_NEEDED flags aren't copied for dynamic outputs.
-    # That requires upstream changes for things to work. So we can patch it to
-    # get the old behaviour by now.
-    ./dtneeded.patch
-
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
-    # Always add PaX flags section to ELF files.
-    # This is needed, for instance, so that running "ldd" on a binary that is
-    # PaX-marked to disable mprotect doesn't fail with permission denied.
-    ./pt-pax-flags.patch
-
     # Bfd looks in BINDIR/../lib for some plugins that don't
     # exist. This is pointless (since users can't install plugins
     # there) and causes a cycle between the lib and bin outputs, so
diff --git a/pkgs/development/tools/misc/binutils/dtneeded.patch b/pkgs/development/tools/misc/binutils/dtneeded.patch
deleted file mode 100644
index 3754ec569eec..000000000000
--- a/pkgs/development/tools/misc/binutils/dtneeded.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/ld/ldmain.c b/ld/ldmain.c
-index 15f8ebf..f71241e 100644
---- a/ld/ldmain.c
-+++ b/ld/ldmain.c
-@@ -298,6 +298,7 @@ main (int argc, char **argv)
-   lang_init ();
-   ldemul_before_parse ();
-   lang_has_input_file = FALSE;
-+  input_flags.add_DT_NEEDED_for_dynamic = TRUE;
-   parse_args (argc, argv);
- 
-   if (config.hash_table_size != 0)
diff --git a/pkgs/development/tools/misc/binutils/pt-pax-flags.patch b/pkgs/development/tools/misc/binutils/pt-pax-flags.patch
deleted file mode 100644
index 3c060012ad0e..000000000000
--- a/pkgs/development/tools/misc/binutils/pt-pax-flags.patch
+++ /dev/null
@@ -1,233 +0,0 @@
---- binutils-2.15.94.0.2.2.orig/bfd/elf-bfd.h	2005-02-07 20:42:44.000000000 +0100
-+++ binutils-2.15.94.0.2.2/bfd/elf-bfd.h	2005-02-20 13:13:17.362558200 +0100
-@@ -1266,6 +1266,9 @@
-   /* Should the PT_GNU_RELRO segment be emitted?  */
-   bfd_boolean relro;
- 
-+  /* Segment flags for the PT_PAX_FLAGS segment.  */
-+  unsigned int pax_flags;
-+
-   /* Symbol version definitions in external objects.  */
-   Elf_Internal_Verdef *verdef;
- 
---- binutils-2.17.50.0.18/bfd/elf.c.orig	2007-08-01 11:12:02.000000000 -0400
-+++ binutils-2.17.50.0.18/bfd/elf.c	2007-08-01 14:27:36.086986774 -0400
-@@ -1085,6 +1085,7 @@
-     case PT_GNU_EH_FRAME: pt = "EH_FRAME"; break;
-     case PT_GNU_STACK: pt = "STACK"; break;
-     case PT_GNU_RELRO: pt = "RELRO"; break;
-+    case PT_PAX_FLAGS: pt = "PAX_FLAGS"; break;
-     default: pt = NULL; break;
-     }
-   return pt;
-@@ -2346,6 +2347,9 @@
-     case PT_GNU_RELRO:
-       return _bfd_elf_make_section_from_phdr (abfd, hdr, hdr_index, "relro");
- 
-+    case PT_PAX_FLAGS:
-+      return _bfd_elf_make_section_from_phdr (abfd, hdr, hdr_index, "pax_flags");
-+
-     default:
-       /* Check for any processor-specific program segment types.  */
-       bed = get_elf_backend_data (abfd);
-@@ -3326,6 +3330,11 @@
-       ++segs;
-     }
- 
-+    {
-+      /* We need a PT_PAX_FLAGS segment.  */
-+      ++segs;
-+    }
-+
-   for (s = abfd->sections; s != NULL; s = s->next)
-     {
-       if ((s->flags & SEC_LOAD) != 0
-@@ -3945,6 +3954,20 @@
- 	  pm = &m->next;
- 	}
- 
-+      {
-+        amt = sizeof (struct elf_segment_map);
-+        m = bfd_zalloc (abfd, amt);
-+        if (m == NULL)
-+  	goto error_return;
-+        m->next = NULL;
-+        m->p_type = PT_PAX_FLAGS;
-+        m->p_flags = elf_tdata (abfd)->pax_flags;
-+        m->p_flags_valid = 1;
-+  
-+        *pm = m;
-+        pm = &m->next;
-+      }
-+
-       free (sections);
-       elf_tdata (abfd)->segment_map = mfirst;
-     }
-@@ -5129,7 +5152,8 @@
-        5. PT_GNU_STACK segments do not include any sections.
-        6. PT_TLS segment includes only SHF_TLS sections.
-        7. SHF_TLS sections are only in PT_TLS or PT_LOAD segments.
--       8. PT_DYNAMIC should not contain empty sections at the beginning
-+       8. PT_PAX_FLAGS segments do not include any sections.
-+       9. PT_DYNAMIC should not contain empty sections at the beginning
- 	  (with the possible exception of .dynamic).  */
- #define IS_SECTION_IN_INPUT_SEGMENT(section, segment, bed)		\
-   ((((segment->p_paddr							\
-@@ -5138,6 +5162,7 @@
-      && (section->flags & SEC_ALLOC) != 0)				\
-     || IS_COREFILE_NOTE (segment, section))				\
-    && segment->p_type != PT_GNU_STACK					\
-+   && segment->p_type != PT_PAX_FLAGS					\
-    && (segment->p_type != PT_TLS					\
-        || (section->flags & SEC_THREAD_LOCAL))				\
-    && (segment->p_type == PT_LOAD					\
---- binutils-2.23.52.0.1/bfd/elflink.c.orig	2013-02-27 21:28:03.000000000 +0100
-+++ binutils-2.23.52.0.1/bfd/elflink.c	2013-03-01 17:32:44.922717879 +0100
-@@ -5764,18 +5764,32 @@
-       && ! (*bed->elf_backend_always_size_sections) (output_bfd, info))
-     return FALSE;
- 
-+  elf_tdata (output_bfd)->pax_flags = PF_NORANDEXEC;
-+
-+  if (info->execheap)
-+    elf_tdata (output_bfd)->pax_flags |= PF_NOMPROTECT;
-+  else if (info->noexecheap)
-+    elf_tdata (output_bfd)->pax_flags |= PF_MPROTECT;
-+
-   /* Determine any GNU_STACK segment requirements, after the backend
-      has had a chance to set a default segment size.  */
-   if (info->execstack)
-+  {
-     elf_stack_flags (output_bfd) = PF_R | PF_W | PF_X;
-+    elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
-+  }
-   else if (info->noexecstack)
-+  {
-     elf_stack_flags (output_bfd) = PF_R | PF_W;
-+    elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
-+  }
-   else
-     {
-       bfd *inputobj;
-       asection *notesec = NULL;
-       int exec = 0;
- 
-+      elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
-       for (inputobj = info->input_bfds;
- 	   inputobj;
- 	   inputobj = inputobj->link_next)
-@@ -5789,7 +5803,11 @@
- 	  if (s)
- 	    {
- 	      if (s->flags & SEC_CODE)
--		exec = PF_X;
-+		{
-+		  elf_tdata (output_bfd)->pax_flags &= ~PF_NOEMUTRAMP;
-+		  elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
-+		  exec = PF_X;
-+		}
- 	      notesec = s;
- 	    }
- 	  else if (bed->default_execstack)
---- binutils-2.15.94.0.2.2.orig/binutils/readelf.c	2005-02-18 07:14:30.000000000 +0100
-+++ binutils-2.15.94.0.2.2/binutils/readelf.c	2005-02-20 13:13:17.470541784 +0100
-@@ -2293,6 +2293,7 @@
- 			return "GNU_EH_FRAME";
-     case PT_GNU_STACK:	return "GNU_STACK";
-     case PT_GNU_RELRO:  return "GNU_RELRO";
-+    case PT_PAX_FLAGS:	return "PAX_FLAGS";
- 
-     default:
-       if ((p_type >= PT_LOPROC) && (p_type <= PT_HIPROC))
---- binutils-2.15.94.0.2.2.orig/include/bfdlink.h	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/include/bfdlink.h	2005-02-20 13:13:17.476540872 +0100
-@@ -313,6 +313,14 @@
-      flags.  */
-   unsigned int noexecstack: 1;
- 
-+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_NOMPROTECT
-+     flags.  */
-+  unsigned int execheap: 1;
-+
-+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_MPROTECT
-+     flags.  */
-+  unsigned int noexecheap: 1;
-+
-   /* TRUE if PT_GNU_RELRO segment should be created.  */
-   unsigned int relro: 1;
- 
---- binutils-2.15.94.0.2.2.orig/include/elf/common.h	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/include/elf/common.h	2005-02-20 13:13:17.482539960 +0100
-@@ -423,6 +423,7 @@
- #define PT_SUNW_EH_FRAME PT_GNU_EH_FRAME      /* Solaris uses the same value */
- #define PT_GNU_STACK	(PT_LOOS + 0x474e551) /* Stack flags */
- #define PT_GNU_RELRO	(PT_LOOS + 0x474e552) /* Read-only after relocation */
-+#define PT_PAX_FLAGS   (PT_LOOS + 0x5041580) /* PaX flags */
- 
- /* Program segment permissions, in program header p_flags field.  */
- 
-@@ -433,6 +434,19 @@
- #define PF_MASKOS	0x0FF00000	/* New value, Oct 4, 1999 Draft */
- #define PF_MASKPROC	0xF0000000	/* Processor-specific reserved bits */
- 
-+#define PF_PAGEEXEC        (1 << 4)    /* Enable  PAGEEXEC */
-+#define PF_NOPAGEEXEC  (1 << 5)    /* Disable PAGEEXEC */
-+#define PF_SEGMEXEC        (1 << 6)    /* Enable  SEGMEXEC */
-+#define PF_NOSEGMEXEC  (1 << 7)    /* Disable SEGMEXEC */
-+#define PF_MPROTECT        (1 << 8)    /* Enable  MPROTECT */
-+#define PF_NOMPROTECT  (1 << 9)    /* Disable MPROTECT */
-+#define PF_RANDEXEC        (1 << 10)   /* Enable  RANDEXEC */
-+#define PF_NORANDEXEC  (1 << 11)   /* Disable RANDEXEC */
-+#define PF_EMUTRAMP        (1 << 12)   /* Enable  EMUTRAMP */
-+#define PF_NOEMUTRAMP  (1 << 13)   /* Disable EMUTRAMP */
-+#define PF_RANDMMAP        (1 << 14)   /* Enable  RANDMMAP */
-+#define PF_NORANDMMAP  (1 << 15)   /* Disable RANDMMAP */
-+
- /* Values for section header, sh_type field.  */
- 
- #define SHT_NULL	0		/* Section header table entry unused */
---- binutils-2.18.50.0.1/ld/emultempl/elf32.em.orig	2007-09-08 19:34:12.000000000 +0200
-+++ binutils-2.18.50.0.1/ld/emultempl/elf32.em	2007-09-15 21:41:35.688212063 +0200
-@@ -2139,6 +2139,16 @@
- 	  link_info.noexecstack = TRUE;
- 	  link_info.execstack = FALSE;
- 	}
-+      else if (strcmp (optarg, "execheap") == 0)
-+	{
-+	  link_info.execheap = TRUE;
-+	  link_info.noexecheap = FALSE;
-+	}
-+      else if (strcmp (optarg, "noexecheap") == 0)
-+	{
-+	  link_info.noexecheap = TRUE;
-+	  link_info.execheap = FALSE;
-+	}
- EOF
- 
-   if test -n "$COMMONPAGESIZE"; then
---- binutils-2.15.94.0.2.2.orig/ld/ldgram.y	2004-11-22 21:33:32.000000000 +0100
-+++ binutils-2.15.94.0.2.2/ld/ldgram.y	2005-02-20 13:13:17.499537376 +0100
-@@ -1073,6 +1073,8 @@
- 			    $$ = exp_intop (0x6474e550);
- 			  else if (strcmp (s, "PT_GNU_STACK") == 0)
- 			    $$ = exp_intop (0x6474e551);
-+			  else if (strcmp (s, "PT_PAX_FLAGS") == 0)
-+			    $$ = exp_intop (0x65041580);
- 			  else
- 			    {
- 			      einfo (_("\
---- binutils-2.26/ld/lexsup.c.orig	2015-11-13 09:27:42.000000000 +0100
-+++ binutils-2.26/ld/lexsup.c	2016-01-26 21:08:41.787138458 +0100
-@@ -1793,8 +1793,12 @@
-   fprintf (file, _("\
-   -z muldefs                  Allow multiple definitions\n"));
-   fprintf (file, _("\
-+  -z execheap                 Mark executable as requiring executable heap\n"));
-+  fprintf (file, _("\
-   -z execstack                Mark executable as requiring executable stack\n"));
-   fprintf (file, _("\
-+  -z noexecheap               Mark executable as not requiring executable heap\n"));
-+  fprintf (file, _("\
-   -z noexecstack              Mark executable as not requiring executable stack\n"));
- }
- 
diff --git a/pkgs/development/tools/misc/creduce/default.nix b/pkgs/development/tools/misc/creduce/default.nix
index 66f1fff41902..a2b487a4bcce 100644
--- a/pkgs/development/tools/misc/creduce/default.nix
+++ b/pkgs/development/tools/misc/creduce/default.nix
@@ -2,7 +2,7 @@
 , llvm, clang-unwrapped
 , flex
 , zlib
-, perl, ExporterLite, FileWhich, GetoptTabular, RegexpCommon, TermReadKey
+, perlPackages
 , utillinux
 }:
 
@@ -22,8 +22,7 @@ stdenv.mkDerivation rec {
     # Actual deps:
     llvm clang-unwrapped
     flex zlib
-    perl ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey
-  ];
+  ] ++ (with perlPackages; [ perl ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey ]);
 
   # On Linux, c-reduce's preferred way to reason about
   # the cpu architecture/topology is to use 'lscpu',
diff --git a/pkgs/development/tools/misc/csmith/default.nix b/pkgs/development/tools/misc/csmith/default.nix
index a0040e4ed3e5..eff1af8cdb47 100644
--- a/pkgs/development/tools/misc/csmith/default.nix
+++ b/pkgs/development/tools/misc/csmith/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, m4, makeWrapper, libbsd, perl, SysCPU }:
+{ stdenv, fetchurl, m4, makeWrapper, libbsd, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "csmith-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ m4 makeWrapper ];
-  buildInputs = [ perl SysCPU libbsd ];
+  buildInputs = [ libbsd ] ++ (with perlPackages; [ perl SysCPU ]);
 
   postInstall = ''
     substituteInPlace $out/bin/compiler_test.pl \
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index c04031bc41db..9464ad463f66 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, expect, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  name = "dejagnu-1.6.1";
+  name = "dejagnu-1.6.2";
 
   src = fetchurl {
     url = "mirror://gnu/dejagnu/${name}.tar.gz";
-    sha256 = "14hnq1mh91vqprc43xdy4f15sycw6fbajrh7zi6cw2kyg6xjhnxz";
+    sha256 = "0qfj2wd4qk1yn9yzam6g8nmyxfazcc0knjyyibycb2ainkhp21hd";
   };
 
   buildInputs = [ expect makeWrapper ];
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 29942bb2fc4d..fa4bb3475938 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 
 # Build time
-, fetchurl, fetchpatch, pkgconfig, perl, texinfo, setupDebugInfoDirs
+, fetchurl, fetchpatch, pkgconfig, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
 , ncurses, readline, gmp, mpfr, expat, zlib, dejagnu
@@ -49,6 +49,8 @@ stdenv.mkDerivation rec {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
   enableParallelBuilding = true;
 
   # darwin build fails with format hardening since v7.12
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index ca48af641968..29ed23117fba 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, gettext, LocaleGettext }:
+{ stdenv, fetchurl, perlPackages, gettext }:
 
 stdenv.mkDerivation rec {
   name = "help2man-1.47.8";
@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1p5830h88cx0zn0snwaj0vpph81xicpsirfwlxmcgjrlmn0nm3sj";
   };
 
-  nativeBuildInputs = [ gettext LocaleGettext ];
-  buildInputs = [ perl LocaleGettext ];
+  nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.perl perlPackages.LocaleGettext ];
 
   doCheck = false;                                # target `check' is missing
 
@@ -18,11 +18,10 @@ stdenv.mkDerivation rec {
   # We don't use makeWrapper here because it uses substitutions our
   # bootstrap shell can't handle.
   postInstall = ''
-    gettext_perl="$(echo ${LocaleGettext}/lib/perl*/site_perl)"
     mv $out/bin/help2man $out/bin/.help2man-wrapped
     cat > $out/bin/help2man <<EOF
     #! $SHELL -e
-    export PERL5LIB=\''${PERL5LIB:+:}$gettext_perl
+    export PERL5LIB=\''${PERL5LIB:+:}${perlPackages.LocaleGettext}/${perlPackages.perl.libPrefix}
     ${stdenv.lib.optionalString stdenv.hostPlatform.isCygwin
         ''export PATH=\''${PATH:+:}${gettext}/bin''}
     exec -a \$0 $out/bin/.help2man-wrapped "\$@"
diff --git a/pkgs/development/tools/misc/icon-naming-utils/default.nix b/pkgs/development/tools/misc/icon-naming-utils/default.nix
index 5fd0fe8be2f2..d7b2cd36492e 100644
--- a/pkgs/development/tools/misc/icon-naming-utils/default.nix
+++ b/pkgs/development/tools/misc/icon-naming-utils/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, perl, XMLSimple, librsvg}:
+{stdenv, fetchurl, perlPackages, librsvg}:
 
 stdenv.mkDerivation rec {
   name = "icon-naming-utils-0.8.90";
@@ -8,13 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "071fj2jm5kydlz02ic5sylhmw6h2p3cgrm3gwdfabinqkqcv4jh4";
   };
 
-  buildInputs = [perl XMLSimple librsvg];
+  buildInputs = [ librsvg ] ++ (with perlPackages; [ perl XMLSimple ]);
 
   postInstall =
     ''
       # Add XML::Simple to the runtime search path.
       substituteInPlace $out/libexec/icon-name-mapping \
-          --replace '/bin/perl' '/bin/perl -I${XMLSimple}/lib/perl5/site_perl'
+          --replace '/bin/perl' '/bin/perl -I${perlPackages.XMLSimple}/${perlPackages.perl.libPrefix}'
     '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/sslmate/default.nix b/pkgs/development/tools/sslmate/default.nix
index 9261b892cca5..8683c75a696d 100644
--- a/pkgs/development/tools/sslmate/default.nix
+++ b/pkgs/development/tools/sslmate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perlPackages, perl, makeWrapper, openssl }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, openssl }:
 
 stdenv.mkDerivation rec {
   name = "sslmate-1.7.0";
@@ -10,11 +10,11 @@ stdenv.mkDerivation rec {
 
   makeFlags = "PREFIX=$(out)";
 
-  buildInputs = [ perl makeWrapper ];
+  buildInputs = [ perlPackages.perl makeWrapper ];
 
   postInstall = ''
     wrapProgram $out/bin/sslmate --prefix PERL5LIB : \
-      "${with perlPackages; stdenv.lib.makePerlPath [
+      "${with perlPackages; makePerlPath [
         URI
         JSONPP
         TermReadKey
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index e71375402c70..29325fad7243 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
     rmdir $out/usr
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=strict-aliasing";
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 
   cmakeFlags = [ "-GNinja" ];
 
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index c0ba92ad4417..8ff02dfe7180 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -92,7 +92,6 @@ in
     doCheck = false; # fails 4 out of 1453 tests
 
     postInstall = ''
-      paxmark m $out/bin/node
       PATH=$out/bin:$PATH patchShebangs $out
 
       ${optionalString enableNpm ''
diff --git a/pkgs/development/web/wml/default.nix b/pkgs/development/web/wml/default.nix
index 58336c80e04f..44ce36b76ddc 100644
--- a/pkgs/development/web/wml/default.nix
+++ b/pkgs/development/web/wml/default.nix
@@ -22,7 +22,7 @@ perlPackages.buildPerlPackage rec {
     sed -i '/p2_mp4h\/doc/d' Makefile.in
   '';
 
-  buildInputs = with perlPackages; 
+  buildInputs = with perlPackages;
     [ perl TermReadKey GD BitVector ncurses lynx makeWrapper ImageSize ];
 
   patches = [ ./redhat-with-thr.patch ./dynaloader.patch ./no_bitvector.patch ];
@@ -45,7 +45,7 @@ perlPackages.buildPerlPackage rec {
 
   preFixup = ''
     wrapProgram $out/bin/wml \
-      --set PERL5LIB ${with perlPackages; stdenv.lib.makePerlPath [
+      --set PERL5LIB ${with perlPackages; makePerlPath [
         BitVector TermReadKey ImageSize
       ]}
   '';
diff --git a/pkgs/misc/cups/cups-clean-dirty.patch b/pkgs/misc/cups/cups-clean-dirty.patch
deleted file mode 100644
index 0bdc8198e8fb..000000000000
--- a/pkgs/misc/cups/cups-clean-dirty.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/scheduler/main.c b/scheduler/main.c
-index 8925c8373..acf031684 100644
---- a/scheduler/main.c
-+++ b/scheduler/main.c
-@@ -893,7 +893,7 @@ main(int  argc,				/* I - Number of command-line args */
-     * Write dirty config/state files...
-     */
- 
--    if (DirtyCleanTime && current_time >= DirtyCleanTime && cupsArrayCount(Clients) == 0)
-+    if (DirtyCleanTime && current_time >= DirtyCleanTime)
-       cupsdCleanDirty();
- 
- #ifdef __APPLE__
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 227886e126fc..e3649bb821b3 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -10,27 +10,17 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "cups-${version}";
-  version = "2.2.6";
+  version = "2.2.10";
 
   passthru = { inherit version; };
 
   src = fetchurl {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    sha256 = "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20";
+    sha256 = "1fq52aw1mini3ld2czv5gg37wbbvh4n7yc7wzzxvbs3zpfrv5j3p";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
 
-  patches = [
-    (fetchpatch {
-      name = "cups"; # weird name to avoid change (for now)
-      url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/cups-systemd-socket.patch"
-          + "?h=packages/cups&id=41fefa22ac518";
-      sha256 = "1ddgdlg9s0l2ph6l8lx1m1lx6k50gyxqi3qiwr44ppq1rxs80ny5";
-    })
-    ./cups-clean-dirty.patch
-  ];
-
   postPatch = ''
     substituteInPlace cups/testfile.c \
       --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'
diff --git a/pkgs/misc/cups/filters.nix b/pkgs/misc/cups/filters.nix
index 9eeadda73fc8..348b7c6550e2 100644
--- a/pkgs/misc/cups/filters.nix
+++ b/pkgs/misc/cups/filters.nix
@@ -2,7 +2,6 @@
 , libjpeg, libpng, perl, ijs, qpdf, dbus, avahi
 , makeWrapper, coreutils, gnused, bc, gawk, gnugrep, which, ghostscript
 , mupdf
-, fetchpatch
 }:
 
 let
@@ -10,23 +9,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "cups-filters-${version}";
-  version = "1.20.4";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://openprinting.org/download/cups-filters/${name}.tar.xz";
-    sha256 = "0sjkmclcb1r77015wllsyz26272br3s17v6b1q2xwb2nm2gnwx9k";
+    sha256 = "0k0x9p40bahq44189vy9zai2ia9i91h26chrddr0m9agzsy5s3k3";
   };
 
-  patches = [
-    # This patch fixes cups-filters when compiled with poppler-0.67.0.
-    # Issue: https://github.com/OpenPrinting/cups-filters/pull/50
-    # PR: https://github.com/OpenPrinting/cups-filters/pull/51
-    (fetchpatch {
-      url = "https://github.com/OpenPrinting/cups-filters/commit/219de01c61f3b1ec146abf142d0dfc8c560cc58e.patch";
-      sha256 = "0f0lql3rbm2g8mxrpigfyi8fb4i2g4av20g417jzdilp60jq0ny8";
-    })
-  ];
-
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
index 318e2728fc2e..80d57484ecc7 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -65,6 +65,12 @@ in appleDerivation {
   '';
 
   installPhase = ''
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      fi
+    done
+
     bsdmake -C usr-share-locale.tproj install DESTDIR="$locale/share/locale"
 
     # need to get rid of runtime dependency on flex
diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 5d9781f3aa4a..f646e57549ea 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -13,8 +13,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $f $out/usr/bin/$(basename $f)
+      fi
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 4220c50d61cb..b2d8522f3264 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -10,8 +10,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $f $out/bin/$(basename $f)
+      fi
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
index f27b5ae13022..0f46e50de3a0 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -22,8 +22,10 @@ appleDerivation {
   installPhase = ''
     install -D Products/Release/libdisk.a $out/lib/libdisk.a
     rm Products/Release/libdisk.a
-    for bin in Products/Release/*; do
-      install -D $bin $out/bin/$(basename $bin)
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
     done
   '';
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index a19e0736336d..c23205253221 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -19,8 +19,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      done
+    done
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index dccc83a70bff..8e69cb4bfa7e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -20,8 +20,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/bin/
-    install Products/Release/* $out/bin/
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $file $out/bin/$(basename $f)
+      fi
+    done
 
     for n in 1 5; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index bec05ef85757..5b2322915dc9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -28,8 +28,11 @@ appleDerivation rec {
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
-    mkdir -p $out/usr/bin
-    install Products/Release/* $out/usr/bin
+    for f in Products/Release/*; do
+      if [ -f $f ]; then
+        install -D $f $out/usr/bin/$(basename $f)
+      fi
+    done
 
     export DSTROOT=$out
     export SRCROOT=$PWD
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 91abb3ca07a8..14d7a5e3b32d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -13,9 +13,10 @@ appleDerivation {
   '';
 
   installPhase = ''
-    mkdir -p $out/bin
     for f in Products/Release/*; do
-      install -D $f $out/bin/$(basename $f)
+      if [ -f $f ]; then
+        install -D $f $out/bin/$(basename $f)
+      fi
     done
   '';
 
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index bd10dde5572c..db33b78a4aba 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,5 +1,4 @@
-{ stdenv, binutils-unwrapped, cctools
-}:
+{ stdenv, binutils-unwrapped, cctools, llvm }:
 
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same targetPrefix.
@@ -8,12 +7,12 @@ assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
 let
   inherit (binutils-unwrapped) targetPrefix;
   cmds = [
-    "ar" "ranlib" "as" "dsymutil" "install_name_tool"
+    "ar" "ranlib" "as" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
   ];
 in
 
-# TODO loop over targetPrefixed binaries too
+# TODO: loop over targetPrefixed binaries too
 stdenv.mkDerivation {
   name = "${targetPrefix}cctools-binutils-darwin";
   outputs = [ "out" "info" "man" ];
@@ -25,9 +24,8 @@ stdenv.mkDerivation {
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
     # - as: as above
-    # - ar: the binutils one prodices .a files that the cctools ld doesn't like
+    # - ar: the binutils one produces .a files that the cctools ld doesn't like
     # - ranlib: for compatibility with ar
-    # - dsymutil: soon going away once it goes into LLVM (this one is fake anyway)
     # - otool: we use it for some of our name mangling
     # - install_name_tool: we use it to rewrite stuff in our bootstrap tools
     # - strip: the binutils one seems to break mach-o files
@@ -37,6 +35,8 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
+    ln -s ${llvm}/bin/llvm-dsymutil $out/bin/dsymutil
+
     ln -s ${binutils-unwrapped.out}/share $out/share
 
     ln -s ${cctools}/libexec $out/libexec
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 2bca1bcc1d75..d41f571cf97b 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -29,15 +29,11 @@ let
 
     outputs = [ "out" "dev" ];
 
-    nativeBuildInputs = [
-      autoconf automake libtool autoreconfHook
-    ];
-    buildInputs = [ libuuid ] ++
-      stdenv.lib.optionals stdenv.isDarwin [ llvm libcxxabi libobjc ];
+    nativeBuildInputs = [ autoconf automake libtool autoreconfHook ];
+    buildInputs = [ libuuid ]
+      ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ];
 
-    patches = [
-      ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
-    ];
+    patches = [ ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch ];
 
     __propagatedImpureHostDeps = [
       # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
@@ -48,7 +44,9 @@ let
     enableParallelBuilding = true;
 
     # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
-    configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+    configurePlatforms = [ "build" "host" ]
+      ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
+    configureFlags = [ "--disable-clang-as" ];
 
     postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace cctools/Makefile.am --replace libobjc2 ""
@@ -92,13 +90,6 @@ let
       popd
     '';
 
-    postInstall = ''
-      cat >$out/bin/dsymutil << EOF
-      #!${stdenv.shell}
-      EOF
-      chmod +x $out/bin/dsymutil
-    '';
-
     passthru = {
       inherit targetPrefix;
     };
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 851520a93beb..6cb0c123406e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -8,6 +8,7 @@
 , swig
 , ncurses
 , pam
+, libnotify
 , buildPackages
 }:
 
@@ -79,6 +80,8 @@ let
     dontDisableStatic = true;
 
     prePatch = prePatchCommon + ''
+      substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site
+      substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.in --replace install_vendor install_site
       substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
       substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
     '';
@@ -127,9 +130,10 @@ let
         wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-notify ; do
-        wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
-      done
+      substituteInPlace $out/bin/aa-notify --replace /usr/bin/notify-send ${libnotify}/bin/notify-send
+      # aa-notify checks its name and does not work named ".aa-notify-wrapped"
+      mv $out/bin/aa-notify $out/bin/aa-notify-wrapped
+      makeWrapper ${perl}/bin/perl $out/bin/aa-notify --set PERL5LIB ${libapparmor}/${perl.libPrefix} --add-flags $out/bin/aa-notify-wrapped
     '';
 
     inherit doCheck;
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 8f98391021fd..ff6ce3b4889d 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, bison, flex, pkgconfig
+{ stdenv, fetchurl, fetchpatch, bison, flex, pkgconfig, pruneLibtoolFiles
 , libnetfilter_conntrack, libnftnl, libmnl, libpcap }:
 
 stdenv.mkDerivation rec {
@@ -21,16 +21,24 @@ stdenv.mkDerivation rec {
       url = "https://git.netfilter.org/iptables/patch/?id=51d374ba41ae4f1bb851228c06b030b83dd2092f";
       sha256 = "05fwrq03f9sm0v2bfwshbrg7pi2p978w1460arnmpay3135gj266";
     })
-    # extensions: libip6t_mh: fix bogus translation error
+    # Extensions: libip6t_mh: fix bogus translation error
     (fetchpatch {
       url = "https://git.netfilter.org/iptables/patch/?id=5839d7fe62ff667af7132fc7d589b386951f27b3";
       sha256 = "0578jn1ip710z9kijwg9g2vjq2kfrbafl03m1rgi4fasz215gvkf";
     })
     # Prevent headers collisions between linux and netfilter (in.h and in6.h)
-    (./netinet-headers-collision.patch)
+    # Fixed upstream with two commits
+    (fetchpatch {
+      url = "https://git.netfilter.org/iptables/patch/?id=8d9d7e4b9ef4c6e6abab2cf35c747d7ca36824bd";
+      sha256 = "0q3wcspiqym1r6dg1jhg7h8hpvsjzx1k7cs39z36mzlbmj9lm0zb";
+    })
+    (fetchpatch {
+      url = "https://git.netfilter.org/iptables/patch/?id=2908eda10bf9fc81119d4f3ad672c67918ab5955";
+      sha256 = "1dci4c8b7gcdrf77l2aicrcwlbp320xjz76fhavams0b4kgs6yr3";
+    })
   ];
 
-  nativeBuildInputs = [ bison flex pkgconfig ];
+  nativeBuildInputs = [ bison flex pkgconfig pruneLibtoolFiles ];
 
   buildInputs = [ libnetfilter_conntrack libnftnl libmnl libpcap ];
 
diff --git a/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch b/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch
deleted file mode 100644
index 940ffa0c29cc..000000000000
--- a/pkgs/os-specific/linux/iptables/netinet-headers-collision.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/include/linux/netfilter.h
-+++ b/include/linux/netfilter.h
-@@ -3,7 +3,9 @@
- 
- #include <linux/types.h>
- 
-+#ifndef _NETINET_IN_H
- #include <linux/in.h>
- #include <linux/in6.h>
-+#endif
- #include <limits.h>
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index a7e8894ccfef..c6055c2e8497 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
-  version = "2.25";
+  version = "2.26";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${name}.tar.xz";
-    sha256 = "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39";
+    sha256 = "12s5b8fp61jcn4qld8a7fakcz1han4a6l3b8cyl3n6r7hk2bfc5n";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 915aee6fd860..51e1a3220941 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -19,9 +19,8 @@ stdenv.mkDerivation rec {
     sha256 = "0mwcq78v6ngbq06xmb9dvilpg0jnl2vs9fgrpakhmmiskdvc1znh";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libsepol pcre fts ]
-             ++ optionals enablePython [ swig python ];
+  nativeBuildInputs = [ pkgconfig ] ++ optionals enablePython [ swig python ];
+  buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 7f84e1cc9b41..0927934b0ba3 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "2.89"; in
+let version = "2.93"; in
 
 stdenv.mkDerivation {
   name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
 
   src = fetchurl {
-    url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.bz2";
-    sha256 = "0rdw5lgg2rpcfdmq90br388qr01w89vsqmpvrqcqjqsmxk9zw3c2";
+    url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
+    sha256 = "1zx84vrzv615na661dd6mg4wh999m0jp25lsa241961x4c74cba7";
   };
 
   prePatch = ''
diff --git a/pkgs/servers/bird/default.nix b/pkgs/servers/bird/default.nix
index 5683da5e8e3f..94579e1bdb16 100644
--- a/pkgs/servers/bird/default.nix
+++ b/pkgs/servers/bird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, flex, bison, readline }:
+{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline }:
 
 with lib;
 
@@ -18,8 +18,15 @@ let
 
       patches = [
         (./. + "/dont-create-sysconfdir-${builtins.substring 0 1 version}.patch")
+        # https://github.com/BIRD/bird/pull/4
+        (fetchpatch {
+          url = "https://github.com/BIRD/bird/commit/fca9ab48e3823c734886f47156a92f6b804c16e9.patch";
+          sha256 = "1pnndc3n56lqqcy74ln0w5kn3i9rbzsm2dqiyp1qw7j33dpkln1b";
+        })
       ];
 
+      CPP="${stdenv.cc.targetPrefix}cpp -E";
+
       configureFlags = [
         "--localstatedir=/var"
       ] ++ optional enableIPv6 "--enable-ipv6";
diff --git a/pkgs/servers/foswiki/default.nix b/pkgs/servers/foswiki/default.nix
index 542322d0e621..572d1736755b 100644
--- a/pkgs/servers/foswiki/default.nix
+++ b/pkgs/servers/foswiki/default.nix
@@ -15,8 +15,8 @@ perlPackages.buildPerlPackage rec {
     # minimum requirements from INSTALL.html#System_Requirements
     AlgorithmDiff ArchiveTar AuthenSASL CGI CGISession CryptPasswdMD5
     EmailMIME Encode Error FileCopyRecursive HTMLParser HTMLTree
-    IOSocketIP IOSocketSSL JSON
-    LocaleMaketext LocaleMaketextLexicon LocaleMsgfmt
+    IOSocketSSL JSON
+    LocaleMaketextLexicon LocaleMsgfmt
     LWP URI perlPackages.version
     /*# optional dependencies
     libapreq2 DBI DBDmysql DBDPg DBDSQLite FCGI FCGIProcManager
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 25ff20635aff..9ea49267cf8c 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, zlib, pcre, libxml2, libxslt
+{ stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , gd, geoip
 , withDebug ? false
 , withStream ? true
@@ -60,8 +60,25 @@ stdenv.mkDerivation {
 
   NIX_CFLAGS_COMPILE = [ "-I${libxml2.dev}/include/libxml2" ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
 
+  configurePlatforms = [];
+
   preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
 
+  patches = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/102-sizeof_test_fix.patch";
+      sha256 = "0i2k30ac8d7inj9l6bl0684kjglam2f68z8lf3xggcc2i5wzhh8a";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/101-feature_test_fix.patch";
+      sha256 = "0v6890a85aqmw60pgj3mm7g8nkaphgq65dj4v9c6h58wdsrc6f0y";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/master/net/nginx/patches/103-sys_nerr.patch";
+      sha256 = "0s497x6mkz947aw29wdy073k8dyjq8j99lax1a1mzpikzr4rxlmd";
+    })
+  ];
+
   hardeningEnable = optional (!stdenv.isDarwin) "pie";
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/mail/dkimproxy/default.nix b/pkgs/servers/mail/dkimproxy/default.nix
index 2912ce4cfcaa..d4bfd3c6ca57 100644
--- a/pkgs/servers/mail/dkimproxy/default.nix
+++ b/pkgs/servers/mail/dkimproxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, perl, fetchurl, Error, MailDKIM, MIMETools, NetServer }:
+{ stdenv, perlPackages, fetchurl }:
 
 let
   pkg = "dkimproxy";
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  buildInputs = [ perl ];
-  propagatedBuildInputs = [ Error MailDKIM MIMETools NetServer ];
+  buildInputs = [ perlPackages.perl ];
+  propagatedBuildInputs = with perlPackages; [ Error MailDKIM MIMETools NetServer ];
 
   meta = with stdenv.lib; {
     description = "SMTP-proxy that signs and/or verifies emails";
diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index 6c6ddf651e62..6007d15a3a15 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     sha256 = "01ggzf7b3jpl89mjiqr7xbpbs181g2gjf6wzg70qaqfzz3ppc6yr";
   };
 
+  enableParallelBuilding = true;
+
   preConfigure = ''
     patchShebangs src/config/settings-get.pl
   '';
@@ -57,6 +59,21 @@ stdenv.mkDerivation rec {
     "--with-ldap"
     "--with-lucene"
     "--with-icu"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "i_cv_epoll_works=${if stdenv.isLinux then "yes" else "no"}"
+    "i_cv_posix_fallocate_works=${if stdenv.isDarwin then "no" else "yes"}"
+    "i_cv_inotify_works=${if stdenv.isLinux then "yes" else "no"}"
+    "i_cv_signed_size_t=no"
+    "i_cv_signed_time_t=yes"
+    "i_cv_c99_vsnprintf=yes"
+    "lib_cv_va_copy=yes"
+    "i_cv_mmap_plays_with_write=yes"
+    "i_cv_gmtime_max_time_t=${toString stdenv.hostPlatform.parsed.cpu.bits}"
+    "i_cv_signed_time_t=yes"
+    "i_cv_fd_passing=yes"
+    "lib_cv_va_copy=yes"
+    "lib_cv___va_copy=yes"
+    "lib_cv_va_val_copy=yes"
   ] ++ lib.optional (stdenv.isLinux) "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     ++ lib.optional (stdenv.isDarwin) "--enable-static"
     ++ lib.optional withMySQL "--with-mysql"
diff --git a/pkgs/servers/mail/dspam/default.nix b/pkgs/servers/mail/dspam/default.nix
index 8fa7719a722b..44e2223960a2 100644
--- a/pkgs/servers/mail/dspam/default.nix
+++ b/pkgs/servers/mail/dspam/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper
 , gawk, gnused, gnugrep, coreutils, which
-, perl, libnet
+, perlPackages
 , withMySQL ? false, zlib, mysql57
 , withPgSQL ? false, postgresql
 , withSQLite ? false, sqlite
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1acklnxn1wvc7abn31l3qdj8q6k13s51k5gv86vka7q20jb5cxmf";
   };
 
-  buildInputs = [ perl ]
+  buildInputs = [ perlPackages.perl ]
                 ++ lib.optionals withMySQL [ zlib mysql57.connector-c ]
                 ++ lib.optional withPgSQL postgresql
                 ++ lib.optional withSQLite sqlite
@@ -62,7 +62,7 @@ in stdenv.mkDerivation rec {
     rm -rf $out/var
 
     wrapProgram $out/bin/dspam_notify \
-      --set PERL5LIB "${lib.makePerlPath [ libnet ]}"
+      --set PERL5LIB "${perlPackages.makePerlPath [ perlPackages.libnet ]}"
 
     # Install SQL scripts
     mkdir -p $out/share/dspam/sql
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index e2a78477bb63..019cc1b1948c 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper, gnused, db, openssl, cyrus_sasl, libnsl
 , coreutils, findutils, gnugrep, gawk, icu, pcre, m4
+, buildPackages
 , withLDAP ? true, openldap
 , withPgSQL ? false, postgresql
 , withMySQL ? false, mysql
@@ -49,13 +50,17 @@ in stdenv.mkDerivation rec {
     ./relative-symlinks.patch
   ];
 
-  preBuild = ''
+  postPatch = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+    sed -e 's!bin/postconf!${buildPackages.postfix}/bin/postconf!' -i postfix-install
+  '' + ''
     sed -e '/^PATH=/d' -i postfix-install
     sed -e "s|@PACKAGE@|$out|" -i conf/post-install
 
     # post-install need skip permissions check/set on all symlinks following to /nix/store
     sed -e "s|@NIX_STORE@|$NIX_STORE|" -i conf/post-install
+  '';
 
+  postConfigure = ''
     export command_directory=$out/sbin
     export config_directory=/etc/postfix
     export meta_directory=$out/etc/postfix
@@ -69,6 +74,8 @@ in stdenv.mkDerivation rec {
     export readme_directory=$out/share/postfix/doc
     export sendmail_path=$out/bin/sendmail
 
+    makeFlagsArray+=(AR=$AR _AR=$AR RANLIB=$RANLIB _RANLIB=$RANLIB)
+
     make makefiles CCARGS='${ccargs}' AUXLIBS='${auxlibs}'
   '';
 
diff --git a/pkgs/servers/mail/postgrey/default.nix b/pkgs/servers/mail/postgrey/default.nix
index 3e7163cb1541..0abfc00fdd66 100644
--- a/pkgs/servers/mail/postgrey/default.nix
+++ b/pkgs/servers/mail/postgrey/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchurl, perl, perlPackages, lib, runCommand, postfix }:
+{ stdenv, fetchurl, perlPackages, lib, runCommand, postfix }:
 
 let
-    mk-perl-flags = inputs: lib.concatStringsSep " " (map (dep: "-I ${dep}/lib/perl5/site_perl") inputs);
+    mk-perl-flags = inputs: lib.concatStringsSep " " (map (dep: "-I ${dep}/${perlPackages.perl.libPrefix}") inputs);
     postgrey-flags = mk-perl-flags (with perlPackages; [
       NetServer BerkeleyDB DigestSHA1 NetAddrIP IOMultiplex
     ]);
@@ -26,9 +26,9 @@ in runCommand name {
     cd $out
     tar -xzf $src --strip-components=1
     mv postgrey policy-test bin
-    sed -i -e "s,#!/usr/bin/perl -T,#!${perl}/bin/perl -T ${postgrey-flags}," \
+    sed -i -e "s,#!/usr/bin/perl -T,#!${perlPackages.perl}/bin/perl -T ${postgrey-flags}," \
            -e "s#/etc/postfix#$out#" \
         bin/postgrey
-    sed -i -e "s,#!/usr/bin/perl,#!${perl}/bin/perl ${policy-test-flags}," \
+    sed -i -e "s,#!/usr/bin/perl,#!${perlPackages.perl}/bin/perl ${policy-test-flags}," \
         bin/policy-test
 ''
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index d32957210132..c3fcd13a41f8 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl, perl, perlPackages, HTMLParser, NetDNS, NetAddrIP, DBFile
-, HTTPDate, MailDKIM, LWP, IOSocketSSL, makeWrapper, gnupg1
-}:
+{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg1 }:
 
 perlPackages.buildPerlPackage rec {
   name = "SpamAssassin-3.4.1";
@@ -13,12 +11,12 @@ perlPackages.buildPerlPackage rec {
   # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7434
   patches = [ ./sa-update_add--siteconfigpath.patch ];
 
-  buildInputs = with perlPackages; [ makeWrapper HTMLParser NetDNS NetAddrIP DBFile HTTPDate MailDKIM
-    LWP IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF NetDNSResolverProgrammable ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [ HTMLParser NetDNS NetAddrIP DBFile HTTPDate MailDKIM
+    LWP IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF NetDNSResolverProgrammable ]);
 
   # Enabling 'taint' mode is desirable, but that flag disables support
   # for the PERL5LIB environment variable. Needs further investigation.
-  makeFlags = "PERL_BIN=${perl}/bin/perl PERL_TAINT=no";
+  makeFlags = "PERL_BIN=${perlPackages.perl}/bin/perl PERL_TAINT=no";
 
   makeMakerFlags = "CONFDIR=/homeless/shelter LOCALSTATEDIR=/var/lib/spamassassin";
 
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index f35b8ff01884..73251bfd9e19 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "0aav15f0lh8k4i62aza2bdv4s8vv65j38pz2zc4v45snd3arfby0";
   };
 
+  configureFlags = [
+     "ac_cv_c_endian=${if stdenv.hostPlatform.isBigEndian then "big" else "little"}"
+  ];
+
   buildInputs = [cyrus_sasl libevent];
 
   hardeningEnable = [ "pie" ];
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index 72d5f124c63d..032789ef05d0 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perl, perlPackages
+{ stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perlPackages
 , python, ruby, jre, nettools, bc
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     coreutils
     rrdtool
     nettools
-    perl
+    perlPackages.perl
     perlPackages.ModuleBuild
     perlPackages.HTMLTemplate
     perlPackages.NetCIDR
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
     perlPackages.NetSNMP
     perlPackages.NetServer
     perlPackages.ListMoreUtils
-    perlPackages.TimeHiRes
     perlPackages.LWP
     perlPackages.DBDPg
     python
@@ -60,8 +59,8 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   checkPhase = ''
-   export PERL5LIB="$PERL5LIB:${rrdtool}/lib/perl5/site_perl"
-   LC_ALL=C make -j1 test 
+   export PERL5LIB="$PERL5LIB:${rrdtool}/${perlPackages.perl.libPrefix}"
+   LC_ALL=C make -j1 test
   '';
 
   patches = [
@@ -95,8 +94,8 @@ stdenv.mkDerivation rec {
   makeFlags = ''
     PREFIX=$(out)
     DESTDIR=$(out)
-    PERLLIB=$(out)/lib/perl5/site_perl
-    PERL=${perl}/bin/perl
+    PERLLIB=$(out)/${perlPackages.perl.libPrefix}
+    PERL=${perlPackages.perl}/bin/perl
     PYTHON=${python}/bin/python
     RUBY=${ruby}/bin/ruby
     JAVARUN=${jre}/bin/java
@@ -118,10 +117,10 @@ stdenv.mkDerivation rec {
             *.jar) continue;;
         esac
         wrapProgram "$file" \
-          --set PERL5LIB "$out/lib/perl5/site_perl:${with perlPackages; stdenv.lib.makePerlPath [
+          --set PERL5LIB "$out/${perlPackages.perl.libPrefix}:${with perlPackages; makePerlPath [
                 LogLog4perl IOSocketInet6 Socket6 URI DBFile DateManip
                 HTMLTemplate FileCopyRecursive FCGI NetCIDR NetSNMP NetServer
-                ListMoreUtils TimeHiRes DBDPg LWP rrdtool
+                ListMoreUtils DBDPg LWP rrdtool
                 ]}"
     done
   '';
diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index d86eac719a60..b228d6901014 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -24,9 +24,8 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
-      perlversion=$(perl -e 'use Config; print $Config{version};')
       perlarchname=$(perl -e 'use Config; print $Config{archname};')
-      installFlags="INSTALLSITEARCH=$out/lib/perl5/site_perl/$perlversion/$perlarchname INSTALLSITEMAN3DIR=$out/share/man/man3"
+      installFlags="INSTALLSITEARCH=$out/${perl.libPrefix}/${perl.version}/$perlarchname INSTALLSITEMAN3DIR=$out/share/man/man3"
 
       # http://article.gmane.org/gmane.network.net-snmp.user/32434
       substituteInPlace "man/Makefile.in" --replace 'grep -vE' '@EGREP@ -v'
diff --git a/pkgs/servers/monitoring/plugins/labs_consol_de.nix b/pkgs/servers/monitoring/plugins/labs_consol_de.nix
index 5d93f4c53496..c47e627f8169 100644
--- a/pkgs/servers/monitoring/plugins/labs_consol_de.nix
+++ b/pkgs/servers/monitoring/plugins/labs_consol_de.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, fetchurl, autoreconfHook, makeWrapper
-, perl, DBDsybase, NetSNMP, coreutils, gnused, gnugrep }:
+, perlPackages, coreutils, gnused, gnugrep }:
 
 let
   glplugin = fetchFromGitHub {
@@ -12,7 +12,7 @@ let
   generic = { pname, version, sha256, description, buildInputs, ... }:
   let
     name' = "${stdenv.lib.replaceStrings [ "-" ] [ "_" ] "${pname}"}-${version}";
-  in perl.stdenv.mkDerivation {
+  in stdenv.mkDerivation {
     name = "${pname}-${version}";
 
     src = fetchurl {
@@ -20,7 +20,7 @@ let
       inherit sha256;
     };
 
-    buildInputs = [ perl ] ++ buildInputs;
+    buildInputs = [ perlPackages.perl ] ++ buildInputs;
 
     nativeBuildInputs = [ autoreconfHook makeWrapper ];
 
@@ -58,7 +58,7 @@ in {
     version     = "2.6.4.14";
     sha256      = "0w6gybrs7imx169l8740s0ax3adya867fw0abrampx59mnsj5pm1";
     description = "Check plugin for Microsoft SQL Server.";
-    buildInputs = [ DBDsybase ];
+    buildInputs = [ perlPackages.DBDsybase ];
   };
 
   check-nwc-health = generic {
@@ -66,7 +66,7 @@ in {
     version     = "7.0.1.3";
     sha256      = "0rgd6zgd7kplx3z72n8zbzwkh8vnd83361sk9ibh6ng78sds1sl5";
     description = "Check plugin for network equipment.";
-    buildInputs = [ NetSNMP ];
+    buildInputs = [ perlPackages.NetSNMP ];
   };
 
   check-ups-health = generic {
@@ -74,6 +74,6 @@ in {
     version     = "2.8.2.2";
     sha256      = "1gc2wjsymay2vk5ywc1jj9cvrbhs0fs851x8l4nc75df2g75v521";
     description = "Check plugin for UPSs.";
-    buildInputs = [ NetSNMP ];
+    buildInputs = [ perlPackages.NetSNMP ];
   };
 }
diff --git a/pkgs/servers/openxpki/default.nix b/pkgs/servers/openxpki/default.nix
index 2b1000d0d851..192951607bfa 100644
--- a/pkgs/servers/openxpki/default.nix
+++ b/pkgs/servers/openxpki/default.nix
@@ -20,34 +20,34 @@ perlPackages.buildPerlPackage {
       IPCShareLite JSON LogLog4perl LWPProtocolConnect LWPProtocolHttps MailRFC822Address
       Moose NetAddrIP NetDNS NetIP perlldap NetHTTP NetServer NetSSLeay ParamsValidate PathClass
       ProcProcessTable ProcSafeExec RegexpCommon SOAPLite Switch SysSigAction TemplateToolkit
-      TestPod TestPodCoverage TextCSV_XS TimeHiRes Workflow XMLFilterXInclude XMLParser
+      TestPod TestPodCoverage TextCSV_XS Workflow XMLFilterXInclude XMLParser
       XMLSAX XMLSAXWriter XMLSimple XMLValidatorSchema ]
     ++ stdenv.lib.optionals extraDependencies1
     [ # dependencies from parsing through core/server
-      ClassAccessor Carp PathTools DataDumper DateTime DateTimeFormatStrptime DBI DigestMD5
-      Encode ExceptionClass Exporter FilePath FileTemp Filter GetoptLong HTMLParser
-      ScalarListUtils MathBigInt Memoize libnet PodUsage RTClientREST Socket
-      Storable XSLoader ]
+      ClassAccessor PathTools DataDumper DateTime DateTimeFormatStrptime DBI
+      Encode ExceptionClass FilePath FileTemp Filter GetoptLong HTMLParser
+      ScalarListUtils MathBigInt Memoize libnet RTClientREST
+      Storable ]
     ++ stdenv.lib.optionals extraDependencies2
     [ # dependencies taken from Debian
-      MooseXTypesPathClass DataStreamBulk MooseXStrictConstructor NamespaceAutoclean GitPurePerl
+      MooseXTypesPathClass DataStreamBulk MooseXStrictConstructor GitPurePerl
       ConfigGitLike DevelStackTrace TreeDAGNode ClassObservable ClassFactory TimeDate ConfigAny
       CGIFast ClassISA YAML YAMLLibYAML AuthenSASL TextCSV FileFindRulePerl IODigest ]
     ++ stdenv.lib.optionals extraDependencies3
     [ # dependencies taken from https://metacpan.org/pod/release/ALECH/Bundle-OpenXPKI-0.06/lib/Bundle/OpenXPKI.pm
-      AttributeHandlers AttributeParamsValidate AutoLoader BC CGI CPAN CacheCache ClassClassgenclassgen
+      AttributeParamsValidate BC CGI CPAN CacheCache ClassClassgenclassgen
       ClassContainer ClassDataInheritable ClassSingleton ConvertASN1 DBDSQLite DBIxHTMLViewLATEST
-      DBFile DataPage DataSpreadPagination DateTimeLocale DateTimeTimeZone DevelPPPort DevelSelfStubber
-      DevelSymdump DigestSHA1 Env Error ExtUtilsCommand ExtUtilsConstant ExtUtilsInstall
-      ExtUtilsMakeMaker FileCheckTree FilterSimple GoferTransporthttp HTMLMason HTMLTagset
-      HTTPServerSimpleMason I18NCollate IO IPCSysV LocaleCodes LocaleMaketext LogDispatch MathBigRat
-      MathComplex MathRound ModuleBuild ModuleBuildDeprecated NetPing PerlIOviaQuotedPrint PodChecker
-      PodCoverage PodEscapes PodLaTeX PodParser PodPerldoc PodPlainer PodSimple Safe SearchDict SelfLoader
-      SubUplevel SysSyslog TemplatePluginAutoformat TermANSIColor TermCap TermReadKey Test TestException
-      TestHTTPServerSimple TestHarness TestHarnessStraps TextAbbrev TextBalanced TextIconv TextSoundex
-      TextTabsWrap ThreadQueue ThreadSemaphore TieFile TieRefHash TimeLocal URI UnicodeCollate
-      UnicodeNormalize WWWMechanize Want XMLFilterBufferText XMLNamespaceSupport autodie base bignum if_
-      lib libapreq2 libnet podlators threads threadsshared version ];
+      DBFile DataPage DataSpreadPagination DateTimeLocale DateTimeTimeZone DevelPPPort
+      DevelSymdump DigestSHA1 Env Error ExtUtilsConstant ExtUtilsInstall
+      ExtUtilsMakeMaker FileCheckTree GoferTransporthttp HTMLMason HTMLTagset
+      HTTPServerSimpleMason IO IPCSysV LocaleCodes LogDispatch MathBigRat
+      MathRound ModuleBuild ModuleBuildDeprecated NetPing PodChecker
+      PodCoverage PodLaTeX PodParser PodPerldoc PodPlainer PodSimple
+      SubUplevel SysSyslog TemplatePluginAutoformat TermReadKey TestException
+      TestHTTPServerSimple TestHarnessStraps TextBalanced TextIconv TextSoundex
+      ThreadQueue TieFile TieRefHash TimeLocal URI
+      UnicodeNormalize WWWMechanize Want XMLFilterBufferText XMLNamespaceSupport bignum
+      libapreq2 libnet podlators threadsshared version ];
 
   preConfigure = ''
     substituteInPlace core/server/Makefile.PL \
diff --git a/pkgs/servers/slimserver/default.nix b/pkgs/servers/slimserver/default.nix
index fe14f0f33c81..ffbeb2fca34c 100644
--- a/pkgs/servers/slimserver/default.nix
+++ b/pkgs/servers/slimserver/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchpatch, makeWrapper
-, perl, perlPackages, flac, faad2, sox, lame, monkeysAudio, wavpack }:
+, perlPackages, flac, faad2, sox, lame, monkeysAudio, wavpack }:
 
 perlPackages.buildPerlPackage rec {
   name = "slimserver-${version}";
@@ -12,7 +12,7 @@ perlPackages.buildPerlPackage rec {
 
   buildInputs = [
     makeWrapper
-    perl
+    perlPackages.perl
     perlPackages.AnyEvent
     perlPackages.AudioScan
     perlPackages.CarpClan
@@ -77,9 +77,9 @@ perlPackages.buildPerlPackage rec {
 
   buildPhase = ''
     mv lib tmp
-    mkdir -p lib/perl5/site_perl
-    mv CPAN_used/* lib/perl5/site_perl
-    cp -rf tmp/* lib/perl5/site_perl
+    mkdir -p ${perlPackages.perl.libPrefix}
+    mv CPAN_used/* ${perlPackages.perl.libPrefix}
+    cp -rf tmp/* ${perlPackages.perl.libPrefix}
   '';
 
   doCheck = false;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index af5204320002..f7f401c148fa 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -145,7 +145,8 @@ self: super:
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag;
     propagatedBuildInputs = [ self.libSM ];
-    CPP = stdenv.lib.optionalString stdenv.isDarwin "clang -E -";
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    CPP = if stdenv.isDarwin then "clang -E -" else "${stdenv.cc.targetPrefix}cc -E -";
     outputs = [ "out" "dev" "devdoc" ];
   });
 
@@ -213,6 +214,8 @@ self: super:
 
   libXinerama = super.libXinerama.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
   });
 
   libXmu = super.libXmu.overrideAttrs (attrs: {
@@ -251,6 +254,8 @@ self: super:
 
   libXvMC = super.libXvMC.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "doc" ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
     buildInputs = attrs.buildInputs ++ [self.renderproto];
   });
 
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index b8b1e4a258dd..aafc0855dbe3 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -59,8 +59,7 @@ in lib.init bootStages ++ [
       extraNativeBuildInputs = old.extraNativeBuildInputs
         ++ lib.optionals
              (hostPlatform.isLinux && !buildPlatform.isLinux)
-             [ buildPackages.patchelf buildPackages.paxctl ]
-        ++ lib.optional hostPlatform.isDarwin buildPackages.clang
+             [ buildPackages.patchelf ]
         ++ lib.optional
              (let f = p: !p.isx86 || p.libc == "musl"; in f hostPlatform && !(f buildPlatform))
              buildPackages.updateAutotoolsGnuConfigScriptsHook
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index be9d38f9780a..f77f43aea886 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -130,9 +130,6 @@ let
       # The derivation's `system` is `buildPlatform.system`.
       inherit (buildPlatform) system;
 
-      # Whether we should run paxctl to pax-mark binaries.
-      needsPax = isLinux;
-
       inherit (import ./make-derivation.nix {
         inherit lib config stdenv;
       }) mkDerivation;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index be96d018612c..03fa589138d5 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -280,10 +280,6 @@ if [ -z "${SHELL:-}" ]; then echo "SHELL not set"; exit 1; fi
 BASH="$SHELL"
 export CONFIG_SHELL="$SHELL"
 
-# Dummy implementation of the paxmark function. On Linux, this is
-# overwritten by paxctl's setup hook.
-paxmark() { true; }
-
 
 # Execute the pre-hook.
 if [ -z "${shell:-}" ]; then export shell="$SHELL"; fi
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 28c3b9f3fb45..12bf781de709 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -216,7 +216,7 @@ in
       inherit (prevStage)
         ccWrapperStdenv
         gcc-unwrapped coreutils gnugrep
-        perl paxctl gnum4 bison;
+        perl gnum4 bison;
       # This also contains the full, dynamically linked, final Glibc.
       binutils = prevStage.binutils.override {
         # Rewrap the binutils with the new glibc, so both the next
@@ -250,7 +250,7 @@ in
         isl = isl_0_17;
       };
     };
-    extraNativeBuildInputs = [ prevStage.patchelf prevStage.paxctl ] ++
+    extraNativeBuildInputs = [ prevStage.patchelf ] ++
       # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
       lib.optional (!localSystem.isx86 || localSystem.libc == "musl")
                    prevStage.updateAutotoolsGnuConfigScriptsHook;
@@ -325,7 +325,7 @@ in
       initialPath =
         ((import ../common-path.nix) {pkgs = prevStage;});
 
-      extraNativeBuildInputs = [ prevStage.patchelf prevStage.paxctl ] ++
+      extraNativeBuildInputs = [ prevStage.patchelf ] ++
         # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
         lib.optional (!localSystem.isx86 || localSystem.libc == "musl")
         prevStage.updateAutotoolsGnuConfigScriptsHook;
@@ -349,7 +349,7 @@ in
         # Simple executable tools
         concatMap (p: [ (getBin p) (getLib p) ]) [
             gzip bzip2 xz bash binutils.bintools coreutils diffutils findutils
-            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed paxctl
+            gawk gnumake gnused gnutar gnugrep gnupatch patchelf ed
           ]
         # Library dependencies
         ++ map getLib (
@@ -368,7 +368,7 @@ in
         inherit (prevStage)
           gzip bzip2 xz bash coreutils diffutils findutils gawk
           gnumake gnused gnutar gnugrep gnupatch patchelf
-          attr acl paxctl zlib pcre;
+          attr acl zlib pcre;
         ${localSystem.libc} = getLibc prevStage;
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
         # Need to get rid of these when cross-compiling.
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 4f8c234b752f..5f44e19fdf27 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
     for p in $out/bin/*
       do wrapProgram "$p" \
-      --prefix PERL5LIB ":" "${perlPackages.DBFile}/lib/perl5/site_perl" \
+      --prefix PERL5LIB ":" "${perlPackages.DBFile}/${perlPackages.perl.libPrefix}" \
       --prefix PATH ":" "${stdenv.lib.makeBinPath [ which bzip2 ]}"
     done
 
diff --git a/pkgs/tools/backup/znapzend/default.nix b/pkgs/tools/backup/znapzend/default.nix
index bc57215c0c4b..5314eef9eb6a 100644
--- a/pkgs/tools/backup/znapzend/default.nix
+++ b/pkgs/tools/backup/znapzend/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     sha256 = checksum;
   };
 
-  buildInputs = [ wget perl perlPackages.TestHarness MojoIOLoopForkCall-0-17 perlPackages.TAPParserSourceHandlerpgTAP ];
+  buildInputs = [ wget perl MojoIOLoopForkCall-0-17 perlPackages.TAPParserSourceHandlerpgTAP ];
 
   nativeBuildInputs = [ autoconf automake ];
 
@@ -52,7 +52,6 @@ stdenv.mkDerivation rec {
   postInstall = ''
     substituteInPlace $out/bin/znapzend --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
       "
     substituteInPlace $out/bin/znapzendzetup --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
@@ -68,7 +66,6 @@ stdenv.mkDerivation rec {
       "
     substituteInPlace $out/bin/znapzendztatz --replace "${perl}/bin/perl" \
       "${perl}/bin/perl \
-      -I${perlPackages.TestHarness}/${perl.libPrefix} \
       -I${Mojolicious-6-46}/${perl.libPrefix} \
       -I${perlPackages.TAPParserSourceHandlerpgTAP}/${perl.libPrefix} \
       -I${MojoIOLoopForkCall-0-17}/${perl.libPrefix} \
diff --git a/pkgs/tools/filesystems/file-rename/default.nix b/pkgs/tools/filesystems/file-rename/default.nix
index 6c226bb97845..e799bc5a4dad 100644
--- a/pkgs/tools/filesystems/file-rename/default.nix
+++ b/pkgs/tools/filesystems/file-rename/default.nix
@@ -12,7 +12,7 @@ perlPackages.buildPerlPackage rec {
 
   postInstall = ''
     wrapProgram $out/bin/rename \
-      --prefix PERL5LIB : $out/lib/perl5/site_perl
+      --prefix PERL5LIB : $out/${perlPackages.perl.libPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index a7bb616d82b5..2bce8ec4941b 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, unzip, makeWrapper, perl, ImageExifTool
-, CpanelJSONXS, coreutils, zip, imagemagick, pngcrush, lcms2
+{ stdenv, fetchurl, unzip, makeWrapper, perlPackages
+, coreutils, zip, imagemagick, pngcrush, lcms2
 , facedetect, fbida }:
 
 # TODO: add optional dependencies (snippet from fgallery source):
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "18wlvqbxcng8pawimbc8f2422s8fnk840hfr6946lzsxr0ijakvf";
   };
 
-  buildInputs = [ unzip makeWrapper perl ImageExifTool CpanelJSONXS ];
+  buildInputs = [ unzip makeWrapper ] ++ (with perlPackages; [ perl ImageExifTool CpanelJSONXS ]);
 
   installPhase = ''
     mkdir -p "$out/bin"
diff --git a/pkgs/tools/misc/arp-scan/default.nix b/pkgs/tools/misc/arp-scan/default.nix
index 4f683beb06ff..dc51d04e4b5e 100644
--- a/pkgs/tools/misc/arp-scan/default.nix
+++ b/pkgs/tools/misc/arp-scan/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     for name in get-{oui,iab}; do
-      wrapProgram "$out/bin/$name" --set PERL5LIB "${stdenv.lib.makePerlPath perlModules }"
+      wrapProgram "$out/bin/$name" --set PERL5LIB "${perlPackages.makePerlPath perlModules }"
     done;
   '';
 
diff --git a/pkgs/tools/misc/cloc/default.nix b/pkgs/tools/misc/cloc/default.nix
index 5a69a6ae7ad2..903b5b13f845 100644
--- a/pkgs/tools/misc/cloc/default.nix
+++ b/pkgs/tools/misc/cloc/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, perl
-, AlgorithmDiff, ParallelForkManager, RegexpCommon
-}:
+{ stdenv, fetchFromGitHub, makeWrapper, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "cloc-${version}";
@@ -17,9 +15,9 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */Unix)
   '';
 
-  buildInputs = [
-    makeWrapper perl AlgorithmDiff ParallelForkManager RegexpCommon
-  ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [
+    perl AlgorithmDiff ParallelForkManager RegexpCommon
+  ]);
 
   makeFlags = [ "prefix=" "DESTDIR=$(out)" "INSTALL=install" ];
 
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c252a8748bce..3a3486503081 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -25,16 +25,27 @@ stdenv.mkDerivation rec {
 
   patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
 
-  # The test tends to fail on btrfs and maybe other unusual filesystems.
   postPatch = ''
+    # The test tends to fail on btrfs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 0' -i ./tests/dd/sparse.sh
     sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh
     sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh
     sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh
+
+    # sandbox does not allow setgid
     sed '2i echo Skipping chmod setgid test && exit 0' -i ./tests/chmod/setgid.sh
-    sed '2i print "Skipping env -S test";  exit 0;' -i ./tests/misc/env-S.pl
     substituteInPlace ./tests/install/install-C.sh \
       --replace 'mode3=2755' 'mode3=1755'
+
+    sed '2i print "Skipping env -S test";  exit 0;' -i ./tests/misc/env-S.pl
+
+    # these tests fail in the unprivileged nix sandbox (without nix-daemon) as we break posix assumptions
+    for f in ./tests/chgrp/{basic.sh,recurse.sh,default-no-deref.sh,no-x.sh,posix-H.sh}; do
+      sed '2i echo Skipping chgrp && exit 0' -i "$f"
+    done
+    for f in gnulib-tests/{test-chown.c,test-fchownat.c,test-lchown.c}; do
+      echo "int main() { return 0; }" > "$f"
+    done
   '';
 
   outputs = [ "out" "info" ];
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index a08f465d6cd7..3ed284aa3e1f 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -1,5 +1,5 @@
-{stdenv, fetchurl, perl, CryptSSLeay, LWP, unzip, xz, dpkg, TimeDate, DBFile
-, FileDesktopEntry, libxslt, docbook_xsl, makeWrapper
+{stdenv, fetchurl, unzip, xz, dpkg
+, libxslt, docbook_xsl, makeWrapper
 , python3Packages
 , perlPackages, curl, gnupg, diffutils
 , sendmailPath ? "/run/wrappers/bin/sendmail"
@@ -16,10 +16,8 @@ in stdenv.mkDerivation rec {
     sha256 = "0xy1nvqrnifx46g8ch69pk31by0va6hn10wpi1fkrsrgncanjjh1";
   };
 
-  buildInputs = [ perl CryptSSLeay LWP unzip xz dpkg TimeDate DBFile 
-    FileDesktopEntry libxslt python setuptools makeWrapper
-    perlPackages.ParseDebControl perlPackages.LWPProtocolHttps
-    curl gnupg diffutils ];
+  buildInputs = [ unzip xz dpkg libxslt python setuptools makeWrapper curl gnupg diffutils ] ++
+    (with perlPackages; [ perl CryptSSLeay LWP TimeDate DBFile FileDesktopEntry ParseDebControl LWPProtocolHttps ]);
 
   preConfigure = ''
     export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${dpkg}";
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 86287779792d..d50797508596 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -109,8 +109,6 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    paxmark pms $out/sbin/grub-{probe,bios-setup}
-
     # Avoid a runtime reference to gcc
     sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
   '';
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index d4d79c6e59fa..94beff8dfe37 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -90,10 +90,6 @@ stdenv.mkDerivation rec {
   doCheck = false;
   enableParallelBuilding = true;
 
-  postInstall = ''
-    paxmark pms $out/sbin/grub-{probe,bios-setup}
-  '';
-
   meta = with stdenv.lib; {
     description = "GRUB 2.0 extended with TCG (TPM) support for integrity measured boot process (trusted boot)";
     homepage = https://github.com/Sirrix-AG/TrustedGRUB2;
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index caef0f7b8bb2..e87328f271e9 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perl, IPCRun, TimeDate, TimeDuration, makeWrapper, darwin }:
+{ stdenv, fetchgit, libxml2, libxslt, docbook-xsl, docbook_xml_dtd_44, perlPackages, makeWrapper, darwin }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 libxslt docbook-xsl docbook_xml_dtd_44 makeWrapper ]
     ++ optional stdenv.isDarwin darwin.cctools;
 
-  propagatedBuildInputs = [ perl IPCRun TimeDate TimeDuration ];
+  propagatedBuildInputs = with perlPackages; [ perl IPCRun TimeDate TimeDuration ];
 
   buildFlags = "CC=cc";
   installFlags = "PREFIX=$(out)";
diff --git a/pkgs/tools/misc/rrdtool/default.nix b/pkgs/tools/misc/rrdtool/default.nix
index 4d826c97d29c..ab16d8cb6bf3 100644
--- a/pkgs/tools/misc/rrdtool/default.nix
+++ b/pkgs/tools/misc/rrdtool/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # for munin and rrdtool support
-    mkdir -p $out/lib/perl5/site_perl/
-    mv $out/lib/perl/5* $out/lib/perl5/site_perl/
+    mkdir -p $out/${perl.libPrefix}
+    mv $out/lib/perl/5* $out/${perl.libPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 42ea641afb67..bf37678d06c9 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,21 +24,16 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.62.0";
+  name = "curl-7.63.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "084niy7cin13ba65p8x38w2xcyc54n3fgzbin40fa2shfr0ca0kq";
+    sha256 = "1n4dzlbllwks8xkz466j362da0pbnxgwr11d64504xzzxka7xawv";
   };
 
-  patches = [
-    # Cherry picked fix for https://github.com/curl/curl/issues/3218
-    ./fix-ipv6-url-parsing.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch b/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
deleted file mode 100644
index 8a74b27ce7fd..000000000000
--- a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From b28094833a971870fd8c07960b3b12bf6fbbaad3 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Fri, 2 Nov 2018 15:11:16 +0100
-Subject: [PATCH] URL: fix IPv6 numeral address parser
-
-Regression from 46e164069d1a52. Extended test 1560 to verify.
-
-Reported-by: tpaukrt on github
-Fixes #3218
-Closes #3219
----
- lib/urlapi.c            | 8 ++++++--
- tests/libtest/lib1560.c | 9 +++++++++
- 2 files changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/lib/urlapi.c b/lib/urlapi.c
-index c53e523434..18a6076fff 100644
---- a/lib/urlapi.c
-+++ b/lib/urlapi.c
-@@ -499,8 +499,12 @@ static CURLUcode parse_port(struct Curl_URL *u, char *hostname)
-      (']' == endbracket)) {
-     /* this is a RFC2732-style specified IP-address */
-     portptr = &hostname[len];
--    if (*portptr != ':')
--      return CURLUE_MALFORMED_INPUT;
-+    if(*portptr) {
-+      if(*portptr != ':')
-+        return CURLUE_MALFORMED_INPUT;
-+    }
-+    else
-+      portptr = NULL;
-   }
-   else
-     portptr = strchr(hostname, ':');
-diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
-index e0faa12b29..57469a9063 100644
---- a/tests/libtest/lib1560.c
-+++ b/tests/libtest/lib1560.c
-@@ -128,6 +128,15 @@ struct querycase {
- };
- 
- static struct testcase get_parts_list[] ={
-+  {"http://[fd00:a41::50]:8080",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | 8080 | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-+  {"http://[fd00:a41::50]/",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-+  {"http://[fd00:a41::50]",
-+   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
-+   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
-   {"https://[::1%252]:1234",
-    "https | [11] | [12] | [13] | [::1%252] | 1234 | / | [16] | [17]",
-    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
diff --git a/pkgs/tools/networking/infiniband-diags/default.nix b/pkgs/tools/networking/infiniband-diags/default.nix
index fbca48fa17c8..0e41163577e7 100644
--- a/pkgs/tools/networking/infiniband-diags/default.nix
+++ b/pkgs/tools/networking/infiniband-diags/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  configureFlags = [ "--with-perl-installdir=\${out}/lib/perl5/site_perl" "--sbindir=\${out}/bin" ];
+  configureFlags = [ "--with-perl-installdir=\${out}/${perl.libPrefix}" "--sbindir=\${out}/bin" ];
 
   postInstall = ''
     rmdir $out/var/run $out/var
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     for pls in $out/bin/{ibfindnodesusing.pl,ibidsverify.pl}; do
       echo "wrapping $pls"
-      wrapProgram $pls --prefix PERL5LIB : "$out/lib/perl5/site_perl"
+      wrapProgram $pls --prefix PERL5LIB : "$out/${perl.libPrefix}"
     done
   '';
 
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index c83ab66b27a0..9f81e0d57211 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, zlib, protobuf, ncurses, pkgconfig, IOTty
-, makeWrapper, perl, openssl, autoreconfHook, openssh, bash-completion
+{ lib, stdenv, fetchurl, zlib, protobuf, ncurses, pkgconfig
+, makeWrapper, perlPackages, openssl, autoreconfHook, openssh, bash-completion
 , libutempter ? null, withUtempter ? stdenv.isLinux }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +11,9 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ protobuf ncurses zlib IOTty makeWrapper perl openssl bash-completion ] ++ lib.optional withUtempter libutempter;
+  buildInputs = [ protobuf ncurses zlib makeWrapper openssl bash-completion ]
+    ++ (with perlPackages; [ perl IOTty ])
+    ++ lib.optional withUtempter libutempter;
 
   patches = [ ./ssh_path.patch ./utempter_path.patch ];
   postPatch = ''
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index 9f1b50085078..f3fe14e4f246 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -2,7 +2,7 @@
 , libnotify, libsecret, polkit, isocodes, modemmanager, libxml2, docbook_xsl, docbook_xml_dtd_43
 , mobile-broadband-provider-info, glib-networking, gsettings-desktop-schemas
 , libgudev, jansson, wrapGAppsHook, gobject-introspection, python3
-, libappindicator-gtk3, withGnome ? false }:
+, libappindicator-gtk3, withGnome ? false, gcr }:
 
 let
   pname = "network-manager-applet";
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
     polkit isocodes mobile-broadband-provider-info libgudev
     modemmanager jansson glib-networking
     libappindicator-gtk3 gnome3.defaultIconTheme
-  ] ++ stdenv.lib.optionals withGnome [ gnome3.gcr ]; # advanced certificate chooser
+  ] ++ stdenv.lib.optionals withGnome [ gcr ]; # advanced certificate chooser
 
   nativeBuildInputs = [ meson ninja intltool pkgconfig wrapGAppsHook gobject-introspection python3 gtk-doc docbook_xsl docbook_xml_dtd_43 libxml2 ];
 
diff --git a/pkgs/tools/networking/slimrat/default.nix b/pkgs/tools/networking/slimrat/default.nix
index ef2c91ee2fab..8632a33e3498 100644
--- a/pkgs/tools/networking/slimrat/default.nix
+++ b/pkgs/tools/networking/slimrat/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, perl, WWWMechanize, LWP, makeWrapper}:
+{stdenv, fetchurl, perlPackages, makeWrapper}:
 
 stdenv.mkDerivation {
   name = "slimrat-1.0";
@@ -7,10 +7,10 @@ stdenv.mkDerivation {
     sha256 = "139b71d45k4b1y47iq62a9732cnaqqbh8s4knkrgq2hx0jxpsk5a";
   };
 
-  buildInputs = [ perl WWWMechanize LWP makeWrapper ];
+  buildInputs = [ makeWrapper ] ++ (with perlPackages; [ perl WWWMechanize LWP ]);
 
   patchPhase = ''
-    sed -e 's,#!.*,#!${perl}/bin/perl,' -i src/{slimrat,slimrat-gui}
+    sed -e 's,#!.*,#!${perlPackages.perl}/bin/perl,' -i src/{slimrat,slimrat-gui}
   '';
 
   installPhase = ''
diff --git a/pkgs/tools/networking/smokeping/default.nix b/pkgs/tools/networking/smokeping/default.nix
index 87e0a788383c..08b5e6a211b8 100644
--- a/pkgs/tools/networking/smokeping/default.nix
+++ b/pkgs/tools/networking/smokeping/default.nix
@@ -1,8 +1,4 @@
-{ stdenv, fetchurl, fping, rrdtool, FCGI, CGI
-, CGIFast, ConfigGrammar, DigestHMAC, NetTelnet
-, NetOpenSSH, NetSNMP, LWP, IOTty, perl, NetDNS
-, perlldap
-}:
+{ stdenv, fetchurl, fping, rrdtool, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "smokeping-${version}";
@@ -11,9 +7,10 @@ stdenv.mkDerivation rec {
     url = "https://oss.oetiker.ch/smokeping/pub/smokeping-${version}.tar.gz";
     sha256 = "1p9hpa2zs33p7hzrds80kwrm5255s0869v3s3qmsyx2sx63c7czj";
   };
-  propagatedBuildInputs = [
-    rrdtool FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet NetOpenSSH
-      NetSNMP LWP IOTty fping perl NetDNS perlldap ];
+  propagatedBuildInputs = [ rrdtool ] ++
+    (with perlPackages; [ perl FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet
+      NetOpenSSH NetSNMP LWP IOTty fping NetDNS perlldap ]);
+
   postInstall = ''
     mv $out/htdocs/smokeping.fcgi.dist $out/htdocs/smokeping.fcgi
   '';
diff --git a/pkgs/tools/networking/swaks/default.nix b/pkgs/tools/networking/swaks/default.nix
index 8daf034d4bdd..2abdab773ddf 100644
--- a/pkgs/tools/networking/swaks/default.nix
+++ b/pkgs/tools/networking/swaks/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     mv swaks $out/bin/
 
     wrapProgram $out/bin/swaks --set PERL5LIB \
-      "${with perlPackages; stdenv.lib.makePerlPath [
+      "${with perlPackages; makePerlPath [
         NetSSLeay AuthenSASL NetDNS IOSocketInet6
       ]}"
   '';
diff --git a/pkgs/tools/networking/swec/default.nix b/pkgs/tools/networking/swec/default.nix
index bc9c9532e4f0..515fcee6963b 100644
--- a/pkgs/tools/networking/swec/default.nix
+++ b/pkgs/tools/networking/swec/default.nix
@@ -1,5 +1,4 @@
-{ fetchurl, stdenv, makeWrapper, perl, LWP, URI, HTMLParser
-, HTTPServerSimple, Parent }:
+{ fetchurl, stdenv, makeWrapper, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "swec-0.4";
@@ -9,13 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "1m3971z4z1wr0paggprfz0n8ng8vsnkc9m6s3bdplgyz7qjk6jwx";
   };
 
-  buildInputs = [ makeWrapper perl LWP URI HTMLParser ];
-  checkInputs = [ HTTPServerSimple Parent ];
+  buildInputs = [ makeWrapper perlPackages.perl perlPackages.LWP perlPackages.URI perlPackages.HTMLParser ];
+  checkInputs = [ perlPackages.HTTPServerSimple perlPackages.Parent ];
 
   configurePhase = ''
     for i in swec tests/{runTests,testServer}
     do
-      sed -i "$i" -e's|/usr/bin/perl|${perl}/bin/perl|g'
+      sed -i "$i" -e's|/usr/bin/perl|${perlPackages.perl}/bin/perl|g'
     done
   '';
 
@@ -29,9 +28,7 @@ stdenv.mkDerivation rec {
     sed -i "$out/bin/swec" -e"s|realpath(\$0)|'$out/share/${name}/swec'|g"
 
     wrapProgram "$out/bin/swec" \
-      --prefix PERL5LIB : \
-      ${stdenv.lib.concatStringsSep ":"
-          (map (x: "${x}/lib/perl5/site_perl") [ LWP URI HTMLParser ])}
+      --prefix PERL5LIB : ${with perlPackages; makePerlPath [ LWP URI HTMLParser ]}
   '';
 
   doCheck = true;
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 4da6f6e177be..0c7acaad49fe 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.8.1";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0p9w6spar5dfi7fplxjcq4394wldabaws0ns30cqq6sxqfwv6qn3";
+    sha256 = "1k6fljr7k721vg2ivn5dfr0hs1kn8p1sm003glgd9ypd261jns9b";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 43def7d69eb4..57ab0bab5167 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, gettext, pkgconfig, perl
+{ stdenv, fetchurl, gettext, pkgconfig, perlPackages
 , libidn2, zlib, pcre, libuuid, libiconv, libintl
-, IOSocketSSL, LWP, python3, lzip
+, python3, lzip
 , libpsl ? null
 , openssl ? null }:
 
@@ -28,12 +28,12 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  nativeBuildInputs = [ gettext pkgconfig perl lzip libiconv libintl ];
+  nativeBuildInputs = [ gettext pkgconfig perlPackages.perl lzip libiconv libintl ];
   buildInputs = [ libidn2 zlib pcre libuuid ]
-    ++ stdenv.lib.optionals doCheck [ IOSocketSSL LWP python3 ]
+    ++ stdenv.lib.optionals doCheck [ perlPackages.IOSocketSSL perlPackages.LWP python3 ]
     ++ stdenv.lib.optional (openssl != null) openssl
     ++ stdenv.lib.optional (libpsl != null) libpsl
-    ++ stdenv.lib.optional stdenv.isDarwin perl;
+    ++ stdenv.lib.optional stdenv.isDarwin perlPackages.perl;
 
   configureFlags = [
     (stdenv.lib.withFeatureAs (openssl != null) "ssl" "openssl")
diff --git a/pkgs/tools/package-management/apt/default.nix b/pkgs/tools/package-management/apt/default.nix
index abd5e6f2f4fb..46da85d97488 100644
--- a/pkgs/tools/package-management/apt/default.nix
+++ b/pkgs/tools/package-management/apt/default.nix
@@ -1,9 +1,8 @@
-{ stdenv, lib, fetchzip, pkgconfig, cmake, perl, curl, gtest, lzma, bzip2 , lz4
+{ stdenv, lib, fetchzip, pkgconfig, cmake, perlPackages, curl, gtest, lzma, bzip2, lz4
 , db, dpkg, libxslt, docbook_xsl, docbook_xml_dtd_45
 
 # used when WITH_DOC=ON
 , w3m
-, Po4a
 , doxygen
 
 # used when WITH_NLS=ON
@@ -27,9 +26,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
 
   buildInputs = [
-    cmake perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
+    cmake perlPackages.perl curl gtest lzma bzip2 lz4 db dpkg libxslt.bin
   ] ++ lib.optionals withDocs [
-    doxygen Po4a w3m docbook_xml_dtd_45
+    doxygen perlPackages.Po4a w3m docbook_xml_dtd_45
   ] ++ lib.optionals withNLS [
     gettext
   ];
diff --git a/pkgs/tools/security/diceware/default.nix b/pkgs/tools/security/diceware/default.nix
index 32819b603f90..1c3d5f1d465f 100644
--- a/pkgs/tools/security/diceware/default.nix
+++ b/pkgs/tools/security/diceware/default.nix
@@ -6,11 +6,11 @@ with pythonPackages;
 
 buildPythonApplication rec {
   pname = "diceware";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "22a998361fd2afbc7890062e228235b3501084de1e6a5bb61f16d2637977f50d";
+    sha256 = "0klb0ysybzlh2wihvir82hgq62v0jjmlcqklwajyms7c0p529yby";
   };
 
   nativeBuildInputs = [ pytestrunner ];
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 08dc68889809..b6de575edb90 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1ncwqjhcxh46fgkp84g2lhf91amcha7abk6wdm1kagzm7q93wv29";
+    sha256 = "1jw282iy27j1qygym52aa44zxy7ly4bdadhd628hwr4q9j5hy0yv";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index cb545570f51f..97f6ec21b548 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl nss nspr kerberos gmp zlib libpcap re2 gcc pythonPackages.wrapPython perl makeWrapper ];
   propagatedBuildInputs = (with pythonPackages; [ dpkt scapy lxml ]) ++ # For pcap2john.py
-                          (with perlPackages; [ DigestMD4 DigestMD5 DigestSHA1 GetoptLong # For pass_gen.pl
+                          (with perlPackages; [ DigestMD4 DigestSHA1 GetoptLong # For pass_gen.pl
                                                 perlldap ]); # For sha-dump.pl
                           # TODO: Get dependencies for radius2john.pl and lion2john-alt.pl
 
diff --git a/pkgs/tools/security/kpcli/default.nix b/pkgs/tools/security/kpcli/default.nix
index cb471d663ecb..350d0e66dc7d 100644
--- a/pkgs/tools/security/kpcli/default.nix
+++ b/pkgs/tools/security/kpcli/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     chmod +x $out/share/kpcli.pl
 
     makeWrapper $out/share/kpcli.pl $out/bin/kpcli --set PERL5LIB \
-      "${with perlPackages; stdenv.lib.makePerlPath ([
+      "${with perlPackages; makePerlPath ([
          CaptureTiny Clipboard Clone CryptRijndael SortNaturally TermReadKey TermShellUI FileKeePass TermReadLineGnu XMLParser
       ] ++ stdenv.lib.optional stdenv.isDarwin MacPasteboard)}"
   '';
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index 46be3b98c550..114ba57e1700 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -60,7 +60,7 @@ in stdenv.mkDerivation rec {
   postFixup =
     let wrapperArgs = runtimeDeps:
           "--prefix PERL5LIB : "
-          + (with perlPackages; stdenv.lib.makePerlPath [
+          + (with perlPackages; makePerlPath [
               CryptOpenSSLRSA
               CryptOpenSSLBignum
             ])
diff --git a/pkgs/tools/security/pcsctools/default.nix b/pkgs/tools/security/pcsctools/default.nix
index c1ab5e82af34..24519654e9a5 100644
--- a/pkgs/tools/security/pcsctools/default.nix
+++ b/pkgs/tools/security/pcsctools/default.nix
@@ -1,6 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, pkgconfig, udev, dbus, pcsclite
-, wget, coreutils
-, perl, pcscperl, Glib, Gtk2, Pango, Cairo
+, wget, coreutils, perlPackages
 }:
 
 let deps = lib.makeBinPath [ wget coreutils ];
@@ -13,17 +12,17 @@ in stdenv.mkDerivation rec {
     sha256 = "14vw6ya8gzyw3lzyrsvfcxx7qm7ry39fbxcdqqh552c1lyxnm7n3";
   };
 
-  buildInputs = [ udev dbus perl pcsclite ];
+  buildInputs = [ udev dbus perlPackages.perl pcsclite ];
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
 
   postInstall = ''
     wrapProgram $out/bin/scriptor \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl ]}"
     wrapProgram $out/bin/gscriptor \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl Glib Gtk2 Pango Cairo ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl Glib Gtk2 Pango Cairo ]}"
     wrapProgram $out/bin/ATR_analysis \
-      --set PERL5LIB "${lib.makePerlPath [ pcscperl ]}"
+      --set PERL5LIB "${with perlPackages; makePerlPath [ pcscperl ]}"
     wrapProgram $out/bin/pcsc_scan \
       --set PATH "$out/bin:${deps}"
   '';
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 14848df3f3ad..996b6fa6d2c2 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -10,7 +10,7 @@ let
   GnuPGInterfaceRuntimeDependencies = with perlPackages; [
     strictures ClassMethodModifiers DataPerl DevelGlobalDestruction ExporterTiny
     GnuPGInterface ListMoreUtils ModuleRuntime Moo MooXHandlesVia MooXlate
-    RoleTiny SubExporterProgressive SubQuote TypeTiny XSLoader
+    RoleTiny SubExporterProgressive SubQuote TypeTiny
   ];
 in stdenv.mkDerivation rec {
   pname = "signing-party";
@@ -122,14 +122,14 @@ in stdenv.mkDerivation rec {
     # scripts)
 
     wrapProgram $out/bin/caff --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath ([
+      ${with perlPackages; makePerlPath ([
         TextTemplate MIMETools MailTools TimeDate NetIDNEncode ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ nettools gnupg1 ]}"
 
     wrapProgram $out/bin/gpg-key2latex --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 libpaper ]}"
 
@@ -140,7 +140,7 @@ in stdenv.mkDerivation rec {
       "${stdenv.lib.makeBinPath [ gnupg1 qprint ]}"
 
     wrapProgram $out/bin/gpgdir --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath ([
+      ${with perlPackages; makePerlPath ([
         TermReadKey ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
@@ -155,7 +155,7 @@ in stdenv.mkDerivation rec {
 #    wrapProgram $out/bin/gpgparticipants-prefill
 
     wrapProgram $out/bin/gpgsigs --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
@@ -171,12 +171,12 @@ in stdenv.mkDerivation rec {
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
     wrapProgram $out/bin/pgp-clean --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
     wrapProgram $out/bin/pgp-fixkey --set PERL5LIB \
-      ${stdenv.lib.makePerlPath GnuPGInterfaceRuntimeDependencies} \
+      ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
       "${stdenv.lib.makeBinPath [ gnupg1 ]}"
 
@@ -189,7 +189,7 @@ in stdenv.mkDerivation rec {
 #    wrapProgram $out/bin/sig2dot
 
     wrapProgram $out/bin/springgraph --set PERL5LIB \
-      ${with perlPackages; stdenv.lib.makePerlPath [ GD ]}
+      ${with perlPackages; makePerlPath [ GD ]}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/system/logcheck/default.nix b/pkgs/tools/system/logcheck/default.nix
index 0f2de9888e44..25a9660aed90 100644
--- a/pkgs/tools/system/logcheck/default.nix
+++ b/pkgs/tools/system/logcheck/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lockfileProgs, perl, mimeConstruct }:
+{ stdenv, fetchurl, lockfileProgs, perlPackages }:
 
 stdenv.mkDerivation rec {
   name = "logcheck-${version}";
@@ -16,13 +16,13 @@ stdenv.mkDerivation rec {
   '';
 
   preConfigure = ''
-    substituteInPlace src/logtail --replace "/usr/bin/perl" "${perl}/bin/perl"
-    substituteInPlace src/logtail2 --replace "/usr/bin/perl" "${perl}/bin/perl"
+    substituteInPlace src/logtail --replace "/usr/bin/perl" "${perlPackages.perl}/bin/perl"
+    substituteInPlace src/logtail2 --replace "/usr/bin/perl" "${perlPackages.perl}/bin/perl"
 
     sed -i -e 's|! -f /usr/bin/lockfile|! -f ${lockfileProgs}/bin/lockfile|' \
            -e 's|^\([ \t]*\)lockfile-|\1${lockfileProgs}/bin/lockfile-|' \
            -e "s|/usr/sbin/logtail2|$out/sbin/logtail2|" \
-           -e 's|mime-construct|${mimeConstruct}/bin/mime-construct|' \
+           -e 's|mime-construct|${perlPackages.mimeConstruct}/bin/mime-construct|' \
            -e 's|\$(run-parts --list "\$dir")|"$dir"/*|' src/logcheck
   '';
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     "SBINDIR=sbin"
     "BINDIR=bin"
     "SHAREDIR=share/logtail/detectrotate"
- ];
+  ];
 
   meta = with stdenv.lib; {
     description = "Mails anomalies in the system logfiles to the administrator";
@@ -44,6 +44,5 @@ stdenv.mkDerivation rec {
     homepage = http://logcheck.alioth.debian.org/;
     license = licenses.gpl2;
     maintainers = [ maintainers.bluescreen303 ];
-    
   };
 }
diff --git a/pkgs/tools/text/mb2md/default.nix b/pkgs/tools/text/mb2md/default.nix
index a920cbf39482..adaff3e2f436 100644
--- a/pkgs/tools/text/mb2md/default.nix
+++ b/pkgs/tools/text/mb2md/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, perl, makeWrapper, perlPackages }:
+{ stdenv, lib, fetchurl, makeWrapper, perlPackages }:
 
 let
   perlDeps = with perlPackages; [ TimeDate ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
 
   unpackPhase = ''
     sourceRoot=.
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/mb2md \
-      --set PERL5LIB "${lib.makePerlPath perlDeps}"
+      --set PERL5LIB "${perlPackages.makePerlPath perlDeps}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/text/namazu/default.nix b/pkgs/tools/text/namazu/default.nix
index 67a26cb41aa0..59cfc86efbf3 100644
--- a/pkgs/tools/text/namazu/default.nix
+++ b/pkgs/tools/text/namazu/default.nix
@@ -11,14 +11,13 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ];
 
   # First install the `File::MMagic' Perl module.
-  # !!! this shouldn't refer to Perl 5.10.0!
   preConfigure = ''
-    ( cd File-MMagic &&				\
-      perl Makefile.PL				\
-        LIB="$out/lib/perl5/site_perl/5.10.0"	\
-        INSTALLSITEMAN3DIR="$out/man" &&	\
+    ( cd File-MMagic &&                              \
+      perl Makefile.PL                               \
+        LIB="$out/${perl.libPrefix}/${perl.version}" \
+        INSTALLSITEMAN3DIR="$out/man" &&             \
       make && make install )
-    export PERL5LIB="$out/lib/perl5/site_perl/5.10.0:$PERL5LIB"
+    export PERL5LIB="$out/${perl.libPrefix}/${perl.version}:$PERL5LIB"
   '';
 
   # FIXME: The `tests/namazu-6' test fails on GNU/Linux, presumably because
diff --git a/pkgs/tools/text/popfile/default.nix b/pkgs/tools/text/popfile/default.nix
index dbc16cf7a453..5e76e3541733 100644
--- a/pkgs/tools/text/popfile/default.nix
+++ b/pkgs/tools/text/popfile/default.nix
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
     perl
     DBI
     DBDSQLite
-    DigestMD5
     HTMLTagset
     TimeDate # == DateParse
     HTMLTemplate
diff --git a/pkgs/tools/text/schema2ldif/default.nix b/pkgs/tools/text/schema2ldif/default.nix
index 699d2d28b82b..2df6cbb27a2d 100644
--- a/pkgs/tools/text/schema2ldif/default.nix
+++ b/pkgs/tools/text/schema2ldif/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, perl, perlPackages }: stdenv.mkDerivation rec {
+{ stdenv, fetchurl, makeWrapper, perlPackages }: stdenv.mkDerivation rec {
   name = "schema2ldif-${version}";
   version = "1.3";
 
@@ -7,7 +7,7 @@
     sha256 = "00cd9xx9g0mnnfn5lvay3vg166z84jla0ya1x34ljdc8bflxsr9a";
   };
 
-  buildInputs = [ perl ];
+  buildInputs = [ perlPackages.perl ];
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
@@ -18,7 +18,7 @@
     gzip -c man/ldap-schema-manager.1 > $out/share/man/man1/ldap-schema-manager.1.gz
 
     wrapProgram $out/bin/schema2ldif \
-       --prefix PERL5PATH : "${stdenv.lib.makePerlPath [ perlPackages.GetoptLong perlPackages.PodUsage ]}"
+       --prefix PERL5PATH : "${perlPackages.makePerlPath [ perlPackages.GetoptLong ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/biber/default.nix b/pkgs/tools/typesetting/biber/default.nix
index ea9b68f02b9e..123147cb5f17 100644
--- a/pkgs/tools/typesetting/biber/default.nix
+++ b/pkgs/tools/typesetting/biber/default.nix
@@ -20,8 +20,8 @@ perlPackages.buildPerlModule rec {
     DateTime DateTimeFormatBuilder DateTimeCalendarJulian
     ExtUtilsLibBuilder FileSlurper FileWhich IPCRun3 LogLog4perl LWPProtocolHttps ListAllUtils
     ListMoreUtils MozillaCA ReadonlyXS RegexpCommon TextBibTeX
-    UnicodeCollate UnicodeLineBreak URI XMLLibXMLSimple XMLLibXSLT XMLWriter
-    ClassAccessor TextCSV TextCSV_XS TextRoman DataUniqid LinguaTranslit UnicodeNormalize SortKey
+    UnicodeLineBreak URI XMLLibXMLSimple XMLLibXSLT XMLWriter
+    ClassAccessor TextCSV TextCSV_XS TextRoman DataUniqid LinguaTranslit SortKey
     TestDifferences
   ];
 
diff --git a/pkgs/tools/typesetting/docbook2odf/default.nix b/pkgs/tools/typesetting/docbook2odf/default.nix
index 029227cd1186..7200909660bd 100644
--- a/pkgs/tools/typesetting/docbook2odf/default.nix
+++ b/pkgs/tools/typesetting/docbook2odf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perl, makeWrapper, zip, libxslt, PerlMagick }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, zip, libxslt }:
 
 stdenv.mkDerivation rec {
   name = "docbook2odf-0.244";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "10k44g0qqa37k30pfj8vz95j6zdzz0nmnqjq1lyahfs2h4glzgwb";
   };
 
-  buildInputs = [ perl makeWrapper ];
+  buildInputs = [ perlPackages.perl makeWrapper ];
 
   installPhase = ''
     mkdir -p "$out/bin/"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram "$out/bin/docbook2odf" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ zip libxslt ]}" \
-      --prefix PERL5PATH : "${stdenv.lib.makePerlPath [PerlMagick]}"
+      --prefix PERL5PATH : "${perlPackages.makePerlPath [ perlPackages.PerlMagick ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index e38e4a1f0596..5309e4555b49 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -1,5 +1,4 @@
-{ fetchurl, stdenv, texinfo, perl
-, XMLSAX, XMLSAXBase, XMLParser, XMLNamespaceSupport
+{ fetchurl, stdenv, texinfo, perlPackages
 , groff, libxml2, libxslt, gnused, libiconv, opensp
 , docbook_xml_dtd_43
 , makeWrapper }:
@@ -16,9 +15,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  buildInputs = [ perl texinfo groff libxml2 libxslt makeWrapper
-                  XMLSAX XMLParser XMLNamespaceSupport opensp libiconv
-                ];
+  buildInputs = [ texinfo groff libxml2 libxslt makeWrapper opensp libiconv ]
+    ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
     # Broken substitution is used for `perl/config.pl', which leaves literal
@@ -36,10 +34,8 @@ stdenv.mkDerivation rec {
     do
       # XXX: We work around the fact that `wrapProgram' doesn't support
       # spaces below by inserting escaped backslashes.
-      wrapProgram $out/bin/$i --prefix PERL5LIB : \
-        "${XMLSAX}/lib/perl5/site_perl:${XMLSAXBase}/lib/perl5/site_perl:${XMLParser}/lib/perl5/site_perl" \
-        --prefix PERL5LIB : \
-        "${XMLNamespaceSupport}/lib/perl5/site_perl" \
+      wrapProgram $out/bin/$i \
+        --prefix PERL5LIB : ${with perlPackages; makeFullPerlPath [XMLSAX XMLParser XMLNamespaceSupport]} \
         --prefix XML_CATALOG_FILES "\ " \
         "$out/share/docbook2X/dtd/catalog.xml\ $out/share/docbook2X/xslt/catalog.xml\ ${docbook_xml_dtd_43}/xml/dtd/docbook/catalog.xml"
     done
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 29a7f05af071..209cc45eee95 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -28,9 +28,19 @@ let
 
     patches = [
       (fetchurl {
-        name = "texlive-poppler-0.64.patch";
-        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.64.patch?h=packages/texlive-bin&id=da56abf0f8a1e85daca0ec0f031b8fa268519e6b;
-        sha256 = "0443d074zl3c5raba8jyhavish706arjcd80ibb84zwnwck4ai0w";
+        name = "poppler-compat-fixes-up-to-0.70.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/poppler-compat-fixes-up-to-0.70.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "0a8bvyl7v6zlyyg3ycl0dmg2g2qahxlq3qmc1nv33r24anzb8xhs";
+      })
+      (fetchurl {
+        name = "luatex-poppler-0.70-const-fixes.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/luatex-poppler-0.70-const-fixes.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "0yiw2x97whdi23dc10xnqpxqj3aja15alir1byp1y03j60zv5n7i";
+      })
+      (fetchurl {
+        name = "texlive-poppler-0.71.patch";
+        url = https://git.archlinux.org/svntogit/packages.git/plain/trunk/texlive-poppler-0.71.patch?h=packages/texlive-bin&id=85ee0539525d8012f134b76c18dfb10d0837a7e2;
+        sha256 = "164wibyf786gdcb0ij4svsmyi13wvcx0cpdr4flki0lpy3igvlnq";
       })
       (fetchurl {
         name = "synctex-missing-header.patch";
@@ -38,6 +48,17 @@ let
         sha256 = "1c4aq8lk8g3mlfq3mdjnxvmhss3qs7nni5rmw0k054dmj6q1xj5n";
       })
     ];
+
+    postPatch = ''
+      for i in texk/kpathsea/mktex*; do
+        sed -i '/^mydir=/d' "$i"
+      done
+      cp -pv texk/web2c/pdftexdir/pdftoepdf{-poppler0.70.0,}.cc
+      cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler,}.cc
+      # fix build with poppler 0.71
+      find texk/web2c/{lua,pdf}texdir -type f | xargs sed -e 's|gTrue|true|g' -e 's|gFalse|false|g' -e 's|GBool|bool|g' -e 's|getCString|c_str|g' -i
+    '';
+
     # remove when removing synctex-missing-header.patch
     preAutoreconf = "pushd texk/web2c";
     postAutoreconf = "popd";
@@ -72,7 +93,7 @@ texliveYear = year;
 core = stdenv.mkDerivation rec {
   name = "texlive-bin-${version}";
 
-  inherit (common) src patches preAutoreconf postAutoreconf;
+  inherit (common) src patches postPatch preAutoreconf postAutoreconf;
 
   outputs = [ "out" "doc" ];
 
@@ -85,14 +106,6 @@ core = stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  postPatch = ''
-    for i in texk/kpathsea/mktex*; do
-      sed -i '/^mydir=/d' "$i"
-    done
-    cp -pv texk/web2c/pdftexdir/pdftoepdf{-newpoppler.cc,.cc}
-    cp -pv texk/web2c/pdftexdir/pdftosrc{-newpoppler.cc,.cc}
-  '';
-
   preConfigure = ''
     rm -r libs/{cairo,freetype2,gd,gmp,graphite2,harfbuzz,icu,libpaper,libpng} \
       libs/{mpfr,pixman,poppler,potrace,xpdf,zlib,zziplib}
@@ -172,7 +185,7 @@ inherit (core-big) metafont metapost luatex xetex;
 core-big = stdenv.mkDerivation { #TODO: upmendex
   name = "texlive-core-big.bin-${version}";
 
-  inherit (common) src patches preAutoreconf postAutoreconf;
+  inherit (common) src patches postPatch preAutoreconf postAutoreconf;
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 400a26f84fd2..b5b03b470cde 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
 
   # `libxml2' provides `xmllint', needed at build-time and run-time.
   # `libxslt' provides `xsltproc', used by `xmlto' at run-time.
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl getopt ];
+  nativeBuildInputs = [ makeWrapper getopt ];
+  buildInputs = [ libxml2 libxslt docbook_xml_dtd_45 docbook_xsl ];
 
   postInstall = ''
     wrapProgram "$out/bin/xmlto" \
diff --git a/pkgs/tools/virtualization/nixos-container/default.nix b/pkgs/tools/virtualization/nixos-container/default.nix
index 0763536533f0..94a19c5375ea 100644
--- a/pkgs/tools/virtualization/nixos-container/default.nix
+++ b/pkgs/tools/virtualization/nixos-container/default.nix
@@ -1,11 +1,11 @@
-{ substituteAll, perl, perlPackages, shadow, utillinux }:
+{ substituteAll, perlPackages, shadow, utillinux }:
 
 substituteAll {
     name = "nixos-container";
     dir = "bin";
     isExecutable = true;
     src = ./nixos-container.pl;
-    perl = "${perl}/bin/perl -I${perlPackages.FileSlurp}/lib/perl5/site_perl";
+    perl = "${perlPackages.perl}/bin/perl -I${perlPackages.FileSlurp}/${perlPackages.perl.libPrefix}";
     su = "${shadow.su}/bin/su";
     inherit utillinux;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ffb41b2ffc5..6815da9c3fe5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -667,7 +667,6 @@ in
   apg = callPackage ../tools/security/apg { };
 
   apt = callPackage ../tools/package-management/apt {
-    inherit (perlPackages) Po4a;
     # include/c++/6.4.0/cstdlib:75:25: fatal error: stdlib.h: No such file or directory
     stdenv = overrideCC stdenv gcc5;
   };
@@ -1006,9 +1005,7 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd {
-    libgit2 = libgit2_0_27;
-  };
+  blsd = callPackage ../tools/misc/blsd { };
 
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
@@ -1986,7 +1983,7 @@ in
   libpinyin = callPackage ../development/libraries/libpinyin { };
 
   libskk = callPackage ../development/libraries/libskk {
-    inherit (gnome3) gnome-common libgee;
+    inherit (gnome3) gnome-common;
   };
 
   m17n_db = callPackage ../tools/inputmethods/m17n-db { };
@@ -2004,9 +2001,7 @@ in
     inherit (pythonPackages) marisa;
   };
 
-  libkkc = callPackage ../tools/inputmethods/libkkc {
-    inherit (gnome3) libgee;
-  };
+  libkkc = callPackage ../tools/inputmethods/libkkc { };
 
   ibus = callPackage ../tools/inputmethods/ibus {
     gconf = gnome2.GConf;
@@ -2083,9 +2078,7 @@ in
 
   client-ip-echo = callPackage ../servers/misc/client-ip-echo { };
 
-  cloc = callPackage ../tools/misc/cloc {
-    inherit (perlPackages) perl AlgorithmDiff ParallelForkManager RegexpCommon;
-  };
+  cloc = callPackage ../tools/misc/cloc { };
 
   cloog = callPackage ../development/libraries/cloog {
     isl = isl_0_14;
@@ -2214,9 +2207,7 @@ in
 
   debianutils = callPackage ../tools/misc/debianutils { };
 
-  debian-devscripts = callPackage ../tools/misc/debian-devscripts {
-    inherit (perlPackages) CryptSSLeay LWP TimeDate DBFile FileDesktopEntry;
-  };
+  debian-devscripts = callPackage ../tools/misc/debian-devscripts { };
 
   debootstrap = callPackage ../tools/misc/debootstrap { };
 
@@ -2318,15 +2309,11 @@ in
 
   dmg2img = callPackage ../tools/misc/dmg2img { };
 
-  docbook2odf = callPackage ../tools/typesetting/docbook2odf {
-    inherit (perlPackages) PerlMagick;
-  };
+  docbook2odf = callPackage ../tools/typesetting/docbook2odf { };
 
   doas = callPackage ../tools/security/doas { };
 
-  docbook2x = callPackage ../tools/typesetting/docbook2x {
-    inherit (perlPackages) XMLSAX XMLSAXBase XMLParser XMLNamespaceSupport;
-  };
+  docbook2x = callPackage ../tools/typesetting/docbook2x { };
 
   docbook2mdoc = callPackage ../tools/misc/docbook2mdoc { };
 
@@ -2562,9 +2549,7 @@ in
 
   ext4magic = callPackage ../tools/filesystems/ext4magic { };
 
-  extract_url = callPackage ../applications/misc/extract_url {
-    inherit (perlPackages) MIMEtools HTMLParser CursesUI URIFind;
-  };
+  extract_url = callPackage ../applications/misc/extract_url { };
 
   extundelete = callPackage ../tools/filesystems/extundelete { };
 
@@ -2646,9 +2631,7 @@ in
 
   ferm = callPackage ../tools/networking/ferm { };
 
-  fgallery = callPackage ../tools/graphics/fgallery {
-    inherit (perlPackages) ImageExifTool CpanelJSONXS;
-  };
+  fgallery = callPackage ../tools/graphics/fgallery { };
 
   flannel = callPackage ../tools/networking/flannel { };
 
@@ -2892,8 +2875,12 @@ in
 
   getopt = callPackage ../tools/misc/getopt { };
 
+  gexiv2 = callPackage ../development/libraries/gexiv2 { };
+
   gftp = callPackage ../tools/networking/gftp { };
 
+  gfbgraph = callPackage ../development/libraries/gfbgraph { };
+
   ggobi = callPackage ../tools/graphics/ggobi { };
 
   gibo = callPackage ../tools/misc/gibo { };
@@ -3727,6 +3714,8 @@ in
 
   libcloudproviders = callPackage ../development/libraries/libcloudproviders { };
 
+  libcroco = callPackage ../development/libraries/libcroco { };
+
   libsmi = callPackage ../development/libraries/libsmi { };
 
   lesspipe = callPackage ../tools/misc/lesspipe { };
@@ -4026,6 +4015,8 @@ in
 
   libreswan = callPackage ../tools/networking/libreswan { };
 
+  librest = callPackage ../development/libraries/librest { };
+
   libwebsockets = callPackage ../development/libraries/libwebsockets { };
 
   lidarr = callPackage ../servers/lidarr { };
@@ -4038,9 +4029,7 @@ in
 
   localtime = callPackage ../tools/system/localtime { };
 
-  logcheck = callPackage ../tools/system/logcheck {
-    inherit (perlPackages) mimeConstruct;
-  };
+  logcheck = callPackage ../tools/system/logcheck { };
 
   logmein-hamachi = callPackage ../tools/networking/logmein-hamachi { };
 
@@ -4277,13 +4266,10 @@ in
   monit = callPackage ../tools/system/monit { };
 
   moreutils = callPackage ../tools/misc/moreutils {
-    inherit (perlPackages) IPCRun TimeDate TimeDuration;
     docbook-xsl = docbook_xsl;
   };
 
-  mosh = callPackage ../tools/networking/mosh {
-    inherit (perlPackages) IOTty;
-  };
+  mosh = callPackage ../tools/networking/mosh { };
 
   motuclient = callPackage ../applications/science/misc/motu-client { };
 
@@ -4786,9 +4772,7 @@ in
     inherit (darwin.apple_sdk.frameworks) IOKit;
   };
 
-  pcsctools = callPackage ../tools/security/pcsctools {
-    inherit (perlPackages) pcscperl Glib Gtk2 Pango Cairo;
-  };
+  pcsctools = callPackage ../tools/security/pcsctools { };
 
   pcsc-cyberjack = callPackage ../tools/security/pcsc-cyberjack { };
 
@@ -4867,7 +4851,7 @@ in
   };
 
   pinentry_gnome = res.pinentry.override {
-    gcr = gnome3.gcr;
+    inherit gcr;
   };
 
   pinentry_qt4 = res.pinentry.override {
@@ -5469,9 +5453,7 @@ in
 
   sleepyhead = callPackage ../applications/misc/sleepyhead {};
 
-  slimrat = callPackage ../tools/networking/slimrat {
-    inherit (perlPackages) WWWMechanize LWP;
-  };
+  slimrat = callPackage ../tools/networking/slimrat { };
 
   slsnif = callPackage ../tools/misc/slsnif { };
 
@@ -5650,9 +5632,7 @@ in
 
   swagger-codegen = callPackage ../tools/networking/swagger-codegen { };
 
-  swec = callPackage ../tools/networking/swec {
-    inherit (perlPackages) LWP URI HTMLParser HTTPServerSimple Parent;
-  };
+  swec = callPackage ../tools/networking/swec { };
 
   swfdec = callPackage ../tools/graphics/swfdec {};
 
@@ -5997,10 +5977,7 @@ in
 
   vcftools = callPackage ../applications/science/biology/vcftools { };
 
-  vcsh = callPackage ../applications/version-management/vcsh {
-    inherit (perlPackages) ShellCommand TestMost TestDifferences TestDeep
-      TestException TestWarn;
-  };
+  vcsh = callPackage ../applications/version-management/vcsh { };
 
   vcstool = callPackage ../development/tools/vcstool { };
 
@@ -6014,7 +5991,6 @@ in
 
   viking = callPackage ../applications/misc/viking {
     inherit (gnome2) scrollkeeper;
-    inherit (gnome3) gexiv2;
   };
 
   vim-vint = callPackage ../development/tools/vim-vint { };
@@ -6255,9 +6231,7 @@ in
 
   urlwatch = callPackage ../tools/networking/urlwatch { };
 
-  valum = callPackage ../development/web/valum {
-    inherit (gnome3) libgee;
-  };
+  valum = callPackage ../development/web/valum { };
 
   inherit (callPackages ../servers/varnish { })
     varnish4 varnish5 varnish6;
@@ -6306,7 +6280,6 @@ in
   weighttp = callPackage ../tools/networking/weighttp { };
 
   wget = callPackage ../tools/networking/wget {
-    inherit (perlPackages) IOSocketSSL LWP;
     libpsl = null;
   };
 
@@ -7868,7 +7841,7 @@ in
 
   ocropus = callPackage ../applications/misc/ocropus { };
 
-  inherit (callPackages ../development/interpreters/perl {}) perl526 perl528 perldevel;
+  inherit (callPackages ../development/interpreters/perl {}) perl528 perldevel;
 
   pachyderm = callPackage ../applications/networking/cluster/pachyderm { };
 
@@ -8519,16 +8492,12 @@ in
   credstash = with python3Packages; toPythonApplication credstash;
 
   creduce = callPackage ../development/tools/misc/creduce {
-    inherit (perlPackages) perl
-      ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey;
     inherit (llvmPackages_6) llvm clang-unwrapped;
   };
 
   cscope = callPackage ../development/tools/misc/cscope { };
 
-  csmith = callPackage ../development/tools/misc/csmith {
-    inherit (perlPackages) perl SysCPU;
-  };
+  csmith = callPackage ../development/tools/misc/csmith { };
 
   csslint = callPackage ../development/web/csslint { };
 
@@ -8744,9 +8713,7 @@ in
 
   hcloud = callPackage ../development/tools/hcloud { };
 
-  help2man = callPackage ../development/tools/misc/help2man {
-    inherit (perlPackages) LocaleGettext;
-  };
+  help2man = callPackage ../development/tools/misc/help2man { };
 
   heroku = callPackage ../development/tools/heroku {
     nodejs = nodejs-10_x;
@@ -8764,9 +8731,7 @@ in
 
   icmake = callPackage ../development/tools/build-managers/icmake { };
 
-  iconnamingutils = callPackage ../development/tools/misc/icon-naming-utils {
-    inherit (perlPackages) XMLSimple;
-  };
+  iconnamingutils = callPackage ../development/tools/misc/icon-naming-utils { };
 
   ikos = callPackage ../development/tools/analysis/ikos {
     inherit (llvmPackages_7) stdenv clang llvm;
@@ -9818,6 +9783,8 @@ in
 
   folly = callPackage ../development/libraries/folly { };
 
+  folks = callPackage ../development/libraries/folks { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;
@@ -9851,6 +9818,8 @@ in
 
   gcab = callPackage ../development/libraries/gcab { };
 
+  gcr = callPackages ../development/libraries/gcr { };
+
   gdome2 = callPackage ../development/libraries/gdome2 {
     inherit (gnome2) gtkdoc;
   };
@@ -9877,6 +9846,8 @@ in
 
   geoclue2 = callPackage ../development/libraries/geoclue {};
 
+  geocode-glib = callPackage ../development/libraries/geocode-glib {};
+
   geoipWithDatabase = makeOverridable (callPackage ../development/libraries/geoip) {
     drvName = "geoip-tools";
     geoipDatabase = geolite-legacy;
@@ -9925,9 +9896,7 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  libgit2_0_27 = callPackage ../development/libraries/git2/0.27.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
 
   glbinding = callPackage ../development/libraries/glbinding { };
 
@@ -10151,6 +10120,8 @@ in
 
   gsoap = callPackage ../development/libraries/gsoap { };
 
+  gsound = callPackages ../development/libraries/gsound { };
+
   gss = callPackage ../development/libraries/gss { };
 
   gtkimageview = callPackage ../development/libraries/gtkimageview { };
@@ -10205,6 +10176,8 @@ in
 
   gnome-sharp = callPackage ../development/libraries/gnome-sharp { mono = mono4; };
 
+  gnome-menus = callPackage ../development/libraries/gnome-menus { };
+
   granite = callPackage ../development/libraries/granite { };
   elementary-cmake-modules = callPackage ../development/libraries/elementary-cmake-modules { };
 
@@ -10312,9 +10285,7 @@ in
 
   hiredis = callPackage ../development/libraries/hiredis { };
 
-  hivex = callPackage ../development/libraries/hivex {
-    inherit (perlPackages) IOStringy;
-  };
+  hivex = callPackage ../development/libraries/hivex { };
 
   hound = callPackage ../development/tools/misc/hound { };
 
@@ -10684,8 +10655,6 @@ in
 
   libconfuse = callPackage ../development/libraries/libconfuse { };
 
-  inherit (gnome3) libcroco;
-
   libcangjie = callPackage ../development/libraries/libcangjie { };
 
   libcollectdclient = callPackage ../development/libraries/libcollectdclient { };
@@ -10845,13 +10814,19 @@ in
 
   libgdamm = callPackage ../development/libraries/libgdamm { };
 
-  libgdata = gnome3.libgdata;
+  libgdata = callPackage ../development/libraries/libgdata { };
+
+  libgee = callPackage ../development/libraries/libgee { };
+
+  libgepub = callPackage ../development/libraries/libgepub { };
 
   libgig = callPackage ../development/libraries/libgig { };
 
   libgnome-keyring = callPackage ../development/libraries/libgnome-keyring { };
   libgnome-keyring3 = gnome3.libgnome-keyring;
 
+  libgnomekbd = callPackage ../development/libraries/libgnomekbd { };
+
   libglvnd = callPackage ../development/libraries/libglvnd { };
 
   libgnurl = callPackage ../development/libraries/libgnurl { };
@@ -10862,6 +10837,10 @@ in
 
   libgrss = callPackage ../development/libraries/libgrss { };
 
+  libgweather = callPackage ../development/libraries/libgweather { };
+
+  libgxps = callPackage ../development/libraries/libgxps { };
+
   libiio = callPackage ../development/libraries/libiio { };
 
   libseccomp = callPackage ../development/libraries/libseccomp { };
@@ -10960,7 +10939,6 @@ in
 
   libguestfs-appliance = callPackage ../development/libraries/libguestfs/appliance.nix {};
   libguestfs = callPackage ../development/libraries/libguestfs {
-    inherit (perlPackages) libintl_perl GetoptLong SysVirt;
     appliance = libguestfs-appliance;
   };
 
@@ -11023,6 +11001,8 @@ in
 
   libmcrypt = callPackage ../development/libraries/libmcrypt {};
 
+  libmediaart = callPackage ../development/libraries/libmediaart { };
+
   libmediainfo = callPackage ../development/libraries/libmediainfo { };
 
   libmhash = callPackage ../development/libraries/libmhash {};
@@ -11293,6 +11273,8 @@ in
 
   libpcap = callPackage ../development/libraries/libpcap { };
 
+  libpeas = callPackage ../development/libraries/libpeas { };
+
   libpipeline = callPackage ../development/libraries/libpipeline { };
 
   libpgf = callPackage ../development/libraries/libpgf { };
@@ -11570,6 +11552,8 @@ in
 
   libyubikey = callPackage ../development/libraries/libyubikey { };
 
+  libzapojit = callPackage ../development/libraries/libzapojit { };
+
   libzen = callPackage ../development/libraries/libzen { };
 
   libzip = callPackage ../development/libraries/libzip { };
@@ -12191,8 +12175,24 @@ in
 
   libsForQt511 = recurseIntoAttrs (lib.makeScope qt511.newScope mkLibsForQt5);
 
-  qt5 = qt511;
-  libsForQt5 = libsForQt511;
+  qt512 = recurseIntoAttrs (makeOverridable
+    (import ../development/libraries/qt-5/5.12) {
+      inherit newScope;
+      inherit stdenv fetchurl fetchFromGitHub makeSetupHook;
+      bison = bison2; # error: too few arguments to function 'int yylex(...
+      inherit cups;
+      harfbuzz = harfbuzzFull;
+      inherit libGL;
+      inherit perl;
+      inherit (darwin) cf-private;
+      inherit (gnome3) gtk3 dconf;
+      inherit (gst_all_1) gstreamer gst-plugins-base;
+    });
+
+  libsForQt512 = recurseIntoAttrs (lib.makeScope qt512.newScope mkLibsForQt5);
+
+  qt5 = qt512;
+  libsForQt5 = libsForQt512;
 
   qt5ct = libsForQt5.callPackage ../tools/misc/qt5ct { };
 
@@ -12752,9 +12752,7 @@ in
     python = python2;
   };
 
-  tdb = callPackage ../development/libraries/tdb {
-    python = python2;
-  };
+  tdb = callPackage ../development/libraries/tdb {};
 
   tecla = callPackage ../development/libraries/tecla { };
 
@@ -12821,6 +12819,8 @@ in
 
   torch-hdf5 = callPackage ../development/libraries/torch-hdf5 {};
 
+  totem-pl-parser = callPackage ../development/libraries/totem-pl-parser { };
+
   tremor = callPackage ../development/libraries/tremor { };
 
   twolame = callPackage ../development/libraries/twolame { };
@@ -12926,6 +12926,12 @@ in
 
   vsqlite = callPackage ../development/libraries/vsqlite { };
 
+  vte = callPackage ../development/libraries/vte { };
+
+  vte_290 = callPackage ../development/libraries/vte/2.90.nix { };
+
+  vte-ng = callPackage ../development/libraries/vte/ng.nix { };
+
   vtk = callPackage ../development/libraries/vtk {
     inherit (darwin) cf-private libobjc;
     inherit (darwin.apple_sdk.libs) xpc;
@@ -13322,10 +13328,6 @@ in
 
   ### DEVELOPMENT / PERL MODULES
 
-  perl526Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
-    perl = perl526;
-    overrides = (config.perlPackageOverrides or (p: {})) pkgs;
-  });
   # the latest Maint version
   perl528Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
     perl = perl528;
@@ -13509,16 +13511,12 @@ in
 
   diod = callPackage ../servers/diod { lua = lua5_1; };
 
-  dkimproxy = callPackage ../servers/mail/dkimproxy {
-    inherit (perlPackages) Error MailDKIM MIMETools NetServer;
-  };
+  dkimproxy = callPackage ../servers/mail/dkimproxy { };
 
   dovecot = callPackage ../servers/mail/dovecot { };
   dovecot_pigeonhole = callPackage ../servers/mail/dovecot/plugins/pigeonhole { };
 
-  dspam = callPackage ../servers/mail/dspam {
-    inherit (perlPackages) libnet;
-  };
+  dspam = callPackage ../servers/mail/dspam { };
 
   etcd = callPackage ../servers/etcd { };
 
@@ -13854,7 +13852,7 @@ in
 
   monitoring-plugins = callPackage ../servers/monitoring/plugins { };
 
-  inherit (callPackage ../servers/monitoring/plugins/labs_consol_de.nix { inherit (perlPackages) DBDsybase NetSNMP; })
+  inherit (callPackage ../servers/monitoring/plugins/labs_consol_de.nix { })
     check-mssql-health
     check-nwc-health
     check-ups-health;
@@ -14013,10 +14011,7 @@ in
 
   supervise = callPackage ../tools/system/supervise { };
 
-  spamassassin = callPackage ../servers/mail/spamassassin {
-    inherit (perlPackages) HTMLParser NetDNS NetAddrIP DBFile
-      HTTPDate MailDKIM LWP IOSocketSSL;
-  };
+  spamassassin = callPackage ../servers/mail/spamassassin { };
 
   deadpixi-sam-unstable = callPackage ../applications/editors/deadpixi-sam { };
   deadpixi-sam = deadpixi-sam-unstable;
@@ -15953,7 +15948,6 @@ in
   aacgain = callPackage ../applications/audio/aacgain { };
 
   abcde = callPackage ../applications/audio/abcde {
-    inherit (perlPackages) MusicBrainz MusicBrainzDiscID;
     inherit (pythonPackages) eyeD3;
   };
 
@@ -17291,7 +17285,6 @@ in
   gimp = callPackage ../applications/graphics/gimp {
     gegl = gegl_0_4;
     lcms = lcms2;
-    inherit (gnome3) gexiv2;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
     inherit (darwin) cf-private;
   };
@@ -17474,9 +17467,7 @@ in
     inherit (gnome2) gtk;
   };
 
-  guake = callPackage ../applications/misc/guake {
-    inherit (gnome3) vte;
-  };
+  guake = callPackage ../applications/misc/guake { };
 
   guitone = callPackage ../applications/version-management/guitone {
     graphviz = graphviz_2_32;
@@ -17649,10 +17640,6 @@ in
   ike = callPackage ../applications/networking/ike { };
 
   ikiwiki = callPackage ../applications/misc/ikiwiki {
-    inherit (perlPackages) TextMarkdown URI HTMLParser HTMLScrubber
-      HTMLTemplate TimeDate CGISession DBFile CGIFormBuilder LocaleGettext
-      RpcXML XMLSimple YAML YAMLLibYAML HTMLTree Filechdir
-      AuthenPassphrase NetOpenIDConsumer LWPxParanoidAgent CryptSSLeay;
     inherit (perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig;}; }) PerlMagick;
   };
 
@@ -17995,7 +17982,7 @@ in
   libvmi = callPackage ../development/libraries/libvmi { };
 
   liferea = callPackage ../applications/networking/newsreaders/liferea {
-    inherit (gnome3) libpeas gsettings-desktop-schemas dconf;
+    inherit (gnome3) gsettings-desktop-schemas dconf;
   };
 
   lightworks = callPackage ../applications/video/lightworks {
@@ -18468,9 +18455,7 @@ in
     ruby = ruby_2_3.override { cursesSupport = true; };
   };
 
-  synapse = callPackage ../applications/misc/synapse {
-    inherit (gnome3) libgee;
-  };
+  synapse = callPackage ../applications/misc/synapse { };
 
   synapse-bt = callPackage ../applications/networking/p2p/synapse-bt {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -18717,7 +18702,6 @@ in
   pdfgrep  = callPackage ../tools/typesetting/pdfgrep { };
 
   pdfpc = callPackage ../applications/misc/pdfpc {
-    inherit (gnome3) libgee;
     inherit (gst_all_1) gstreamer gst-plugins-base;
   };
 
@@ -19157,9 +19141,7 @@ in
 
   udiskie = python3Packages.callPackage ../applications/misc/udiskie { };
 
-  sakura = callPackage ../applications/misc/sakura {
-    vte = gnome3.vte;
-  };
+  sakura = callPackage ../applications/misc/sakura { };
 
   sayonara = callPackage ../applications/audio/sayonara { };
 
@@ -19244,7 +19226,6 @@ in
   ssvnc = callPackage ../applications/networking/remote/ssvnc { };
 
   stupidterm = callPackage ../applications/misc/stupidterm {
-    vte = gnome3.vte;
     gtk = gtk3;
   };
 
@@ -19303,7 +19284,6 @@ in
   lightdm_qt = lightdm.override { withQt5 = true; };
 
   lightdm-enso-os-greeter = callPackage ../applications/display-managers/lightdm-enso-os-greeter {
-    inherit (gnome3) libgee;
     inherit (xorg) libX11 libXdmcp libpthreadstubs;
   };
 
@@ -19548,18 +19528,14 @@ in
 
   terminus = callPackage ../applications/misc/terminus { };
 
-  lxterminal = callPackage ../applications/misc/lxterminal {
-    vte = gnome3.vte;
-  };
+  lxterminal = callPackage ../applications/misc/lxterminal { };
 
   aminal = callPackage ../applications/misc/aminal {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel;
     inherit (darwin) cf-private;
   };
 
-  termite-unwrapped = callPackage ../applications/misc/termite {
-    vte = gnome3.vte-ng;
-  };
+  termite-unwrapped = callPackage ../applications/misc/termite { };
 
   termite = callPackage ../applications/misc/termite/wrapper.nix { termite = termite-unwrapped; };
 
@@ -19595,7 +19571,6 @@ in
   tig = gitAndTools.tig;
 
   tilda = callPackage ../applications/misc/tilda {
-    vte = gnome3.vte;
     gtk = gtk3;
   };
 
@@ -19803,7 +19778,6 @@ in
   virt-what = callPackage ../applications/virtualization/virt-what { };
 
   virtmanager = callPackage ../applications/virtualization/virt-manager {
-    vte = gnome3.vte;
     dconf = gnome3.dconf;
     system-libvirt = libvirt;
   };
@@ -20304,13 +20278,12 @@ in
   xterm = callPackage ../applications/misc/xterm { };
 
   mlterm = callPackage ../applications/misc/mlterm {
-    vte = gnome3.vte;
     libssh2 = null;
     openssl = null;
   };
 
   roxterm = callPackage ../applications/misc/roxterm {
-    inherit (gnome3) gsettings-desktop-schemas vte;
+    inherit (gnome3) gsettings-desktop-schemas;
   };
 
   termonad-with-packages = callPackage ../applications/misc/termonad {
@@ -21428,9 +21401,7 @@ in
 
   bcftools = callPackage ../applications/science/biology/bcftools { };
 
-  conglomerate = callPackage ../applications/science/biology/conglomerate {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  conglomerate = callPackage ../applications/science/biology/conglomerate { };
 
   dcm2niix = callPackage ../applications/science/biology/dcm2niix { };
 
@@ -21448,9 +21419,7 @@ in
 
   igv = callPackage ../applications/science/biology/igv { };
 
-  inormalize = callPackage ../applications/science/biology/inormalize {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  inormalize = callPackage ../applications/science/biology/inormalize { };
 
   iv = callPackage ../applications/science/biology/iv {
     neuron-version = neuron.version;
@@ -21462,9 +21431,7 @@ in
 
   muscle = callPackage ../applications/science/biology/muscle { };
 
-  n3 = callPackage ../applications/science/biology/N3 {
-    inherit (perlPackages) perl GetoptTabular MNI-Perllib;
-  };
+  n3 = callPackage ../applications/science/biology/N3 { };
 
   neuron = callPackage ../applications/science/biology/neuron {
     python = null;
@@ -21478,17 +21445,11 @@ in
 
   mrbayes = callPackage ../applications/science/biology/mrbayes { };
 
-  minc_tools = callPackage ../applications/science/biology/minc-tools {
-    inherit (perlPackages) TextFormat;
-  };
+  minc_tools = callPackage ../applications/science/biology/minc-tools { };
 
-  minc_widgets = callPackage ../applications/science/biology/minc-widgets {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  minc_widgets = callPackage ../applications/science/biology/minc-widgets { };
 
-  mni_autoreg = callPackage ../applications/science/biology/mni_autoreg {
-    inherit (perlPackages) GetoptTabular MNI-Perllib;
-  };
+  mni_autoreg = callPackage ../applications/science/biology/mni_autoreg { };
 
   minimap2 = callPackage ../applications/science/biology/minimap2 { };
 
@@ -22838,12 +22799,7 @@ in
     conf = config.slock.conf or null;
   };
 
-  smokeping = callPackage ../tools/networking/smokeping {
-    inherit fping rrdtool;
-    inherit (perlPackages)
-      FCGI CGI CGIFast ConfigGrammar DigestHMAC NetTelnet
-      NetOpenSSH NetSNMP LWP IOTty perl NetDNS perlldap;
-  };
+  smokeping = callPackage ../tools/networking/smokeping { };
 
   snapraid = callPackage ../tools/filesystems/snapraid { };
 
@@ -23165,7 +23121,7 @@ in
   iterm2 = callPackage ../applications/misc/iterm2 {};
 
   sequeler = callPackage ../applications/misc/sequeler {
-    inherit (gnome3) gtksourceview libgda libgee;
+    inherit (gnome3) gtksourceview libgda;
   };
 
   sequelpro = callPackage ../applications/misc/sequelpro {};
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index b52afe98f7fa..1fc36139ac07 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -15,6 +15,7 @@ in
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
     inherit (darwin) cctools;
     inherit (pkgs) binutils-unwrapped;
+    inherit (pkgs.llvmPackages_5) llvm;
   };
 
   binutils = pkgs.wrapBintoolsWith {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e3f02fa97287..3c80eac6a3b1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7,8 +7,8 @@
 
 {config, pkgs, fetchurl, fetchFromGitHub, stdenv, gnused, perl, overrides}:
 
-# cpan2nix assumes that perl-packages.nix will be used only with perl 5.26 or above
-assert stdenv.lib.versionAtLeast perl.version "5.26";
+# cpan2nix assumes that perl-packages.nix will be used only with perl 5.28.1 or above
+assert stdenv.lib.versionAtLeast perl.version "5.28.1";
 let
   inherit (stdenv.lib) maintainers;
   self = _self // overrides;
@@ -30,6 +30,24 @@ let
       checkPhase = "./Build test";
     });
 
+  /* Construct a perl search path (such as $PERL5LIB)
+
+     Example:
+       pkgs = import <nixpkgs> { }
+       makePerlPath [ pkgs.perlPackages.libnet ]
+       => "/nix/store/n0m1fk9c960d8wlrs62sncnadygqqc6y-perl-Net-SMTP-1.25/lib/perl5/site_perl"
+  */
+  makePerlPath = stdenv.lib.makeSearchPathOutput "lib" perl.libPrefix;
+
+  /* Construct a perl search path recursively including all dependencies (such as $PERL5LIB)
+
+     Example:
+       pkgs = import <nixpkgs> { }
+       makeFullPerlPath [ pkgs.perlPackages.CGI ]
+       => "/nix/store/fddivfrdc1xql02h9q500fpnqy12c74n-perl-CGI-4.38/lib/perl5/site_perl:/nix/store/8hsvdalmsxqkjg0c5ifigpf31vc4vsy2-perl-HTML-Parser-3.72/lib/perl5/site_perl:/nix/store/zhc7wh0xl8hz3y3f71nhlw1559iyvzld-perl-HTML-Tagset-3.20/lib/perl5/site_perl"
+  */
+  makeFullPerlPath = deps: makePerlPath (stdenv.lib.misc.closePropagation deps);
+
 
   ack = buildPerlPackage rec {
     name = "ack-2.24";
@@ -1088,18 +1106,6 @@ let
     };
   };
 
-  Carp = buildPerlPackage rec {
-    name = "Carp-1.50";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/X/XS/XSAWYERX/Carp-1.50.tar.gz;
-      sha256 = "1ngbpjyd9qi7n4h5r3q3qibd8by7rfiv7364jqlv4lbd3973n9zm";
-    };
-    meta = with stdenv.lib; {
-      description = "Alternative warn and die for modules";
-      license = with licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   CarpAlways = buildPerlPackage rec {
     name = "Carp-Always-0.16";
     src = fetchurl {
@@ -4026,8 +4032,8 @@ let
       sha256 = "5509e532cdd0e3d91eda550578deaac29e2f008a12b64576e8c261bb92e8c2c1";
     };
     postInstall = stdenv.lib.optionalString (perl ? crossVersion) ''
-      mkdir -p $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI
-      cat > $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI.pm <<EOF
+      mkdir -p $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI
+      cat > $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI.pm <<EOF
       package DBI;
       BEGIN {
       our \$VERSION = "$version";
@@ -4035,8 +4041,8 @@ let
       1;
       EOF
 
-      autodir=$(echo $out/lib/perl5/site_perl/${perl.version}/*/auto/DBI)
-      cat > $out/lib/perl5/site_perl/cross_perl/${perl.version}/DBI/DBD.pm <<EOF
+      autodir=$(echo $out/${perl.libPrefix}/${perl.version}/*/auto/DBI)
+      cat > $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI/DBD.pm <<EOF
       package DBI::DBD;
       use Exporter ();
       use vars qw (@ISA @EXPORT);
@@ -5318,14 +5324,6 @@ let
     };
   };
 
-  ExtUtilsCBuilder = buildPerlPackage rec {
-    name = "ExtUtils-CBuilder-0.280230";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/A/AM/AMBS/ExtUtils-CBuilder-0.280230.tar.gz;
-      sha256 = "1mcwvic01x0flcz3jsny5j8j5zz96r63qjwq75hs42cpf3by3ahx";
-    };
-  };
-
   ExtUtilsCChecker = buildPerlModule rec {
     name = "ExtUtils-CChecker-0.10";
     src = fetchurl {
@@ -5466,14 +5464,6 @@ let
     };
   };
 
-  ExtUtilsParseXS = buildPerlPackage rec {
-    name = "ExtUtils-ParseXS-3.35";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SM/SMUELLER/${name}.tar.gz";
-      sha256 = "077fqiyabydm8j34wxzxwxskyidh8nmwq9gskaxai8kq298z1pj1";
-    };
-  };
-
   ExtUtilsPkgConfig = buildPerlPackage rec {
     name = "ExtUtils-PkgConfig-1.16";
     src = fetchurl {
@@ -6198,18 +6188,6 @@ let
     };
   };
 
-  FilterSimple = buildPerlPackage {
-    name = "Filter-Simple-0.94";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SM/SMUELLER/Filter-Simple-0.94.tar.gz;
-      sha256 = "1lkrgsqaxf595ha1y29gxqqf4kf8cpm5yzr4gg7zngbq1nb0pz6g";
-    };
-    meta = {
-      description = "Simplified source filtering";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   FinanceQuote = buildPerlPackage rec {
     name = "Finance-Quote-1.47";
     src = fetchurl {
@@ -7716,18 +7694,6 @@ let
     };
   };
 
-  IOSocketIP = buildPerlModule {
-    name = "IO-Socket-IP-0.39";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PEVANS/IO-Socket-IP-0.39.tar.gz;
-      sha256 = "11950da7636cb786efd3bfb5891da4c820975276bce43175214391e5c32b7b96";
-    };
-    meta = {
-      description = "Family-neutral IP socket supporting both IPv4 and IPv6";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   IOSocketInet6 = buildPerlModule rec {
     name = "IO-Socket-INET6-2.72";
     src = fetchurl {
@@ -9162,7 +9128,7 @@ let
     buildInputs = [ ModuleBuild NetDNSResolverProgrammable ];
     propagatedBuildInputs = [ Error NetAddrIP NetDNS URI ];
 
-    buildPhase = "perl Build.PL --install_base=$out --install_path=\"sbin=$out/bin\" --install_path=\"lib=$out/lib/perl5/site_perl\"; ./Build build ";
+    buildPhase = "perl Build.PL --install_base=$out --install_path=\"sbin=$out/bin\" --install_path=\"lib=$out/${perl.libPrefix}\"; ./Build build ";
 
     doCheck = false; # The main test performs network access
     meta = {
@@ -12101,7 +12067,7 @@ let
       sha256 = "0xk4h4dzl80kf97lbx0nznx9ajrb6kkg7k3iwca3rj6f3rqggv9y";
     };
     outputs = [ "out" ];
-    buildInputs = [ DBDmysql DBI IOSocketSSL TermReadKey TimeHiRes ];
+    buildInputs = [ DBDmysql DBI IOSocketSSL TermReadKey ];
     meta = {
       description = ''Collection of advanced command-line tools to perform a variety of MySQL and system tasks.'';
       homepage = http://www.percona.com/software/percona-toolkit;
@@ -13391,18 +13357,6 @@ let
     };
   };
 
-  SelfLoader = buildPerlPackage {
-    name = "SelfLoader-1.24";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/S/SM/SMUELLER/SelfLoader-1.24.tar.gz;
-      sha256 = "4c7cd20fd82aa10520ac14b05fa003f60c72bb4c95527bd12aec8bf3c4546098";
-    };
-    meta = {
-      description = "Load functions only on demand";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   SerealDecoder = buildPerlPackage rec {
     name = "Sereal-Decoder-4.005";
     src = fetchurl {
@@ -13573,22 +13527,6 @@ let
     buildInputs = [ TestWarn XMLParserLite ];
   };
 
-  Socket = buildPerlPackage {
-    name = "Socket-2.027";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/P/PE/PEVANS/Socket-2.027.tar.gz;
-      sha256 = "1a725fbqx6bjzjf63bgs5wvzd20kffz1f94pbmv1670p9m4i270l";
-    };
-    postPatch = ''
-      # requires network access
-      rm t/getnameinfo.t t/getaddrinfo.t
-    '';
-    meta = {
-      description = "Networking constants and support functions";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   Socket6 = buildPerlPackage rec {
     name = "Socket6-0.29";
     src = fetchurl {
@@ -15215,20 +15153,6 @@ let
     };
   };
 
-  TestHarness = buildPerlPackage {
-    name = "Test-Harness-3.42";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/L/LE/LEONT/Test-Harness-3.42.tar.gz;
-      sha256 = "0fd90d4efea82d6e262e6933759e85d27cbcfa4091b14bf4042ae20bab528e53";
-    };
-    doCheck = false; # makes assumptions about path to Perl
-    meta = {
-      homepage = http://testanything.org/;
-      description = "Run Perl standard test scripts with statistics";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   TestHarnessStraps = buildPerlModule {
     name = "Test-Harness-Straps-0.30";
     src = fetchurl {
@@ -16175,7 +16099,7 @@ let
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/biblex"
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/bibparse"
       install_name_tool -change "$oldPath" "$newPath" "$out/bin/dumpnames"
-      install_name_tool -change "$oldPath" "$newPath" "$out/lib/perl5/site_perl/${perl.version}/darwin-2level/auto/Text/BibTeX/BibTeX.bundle"
+      install_name_tool -change "$oldPath" "$newPath" "$out/${perl.libPrefix}/${perl.version}/darwin-2level/auto/Text/BibTeX/BibTeX.bundle"
     '';
     meta = {
       description = "Interface to read and parse BibTeX files";
@@ -16653,18 +16577,6 @@ let
     buildInputs = [ TestDifferences ];
   };
 
-  threads = buildPerlPackage rec {
-    name = "threads-2.21";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JD/JDHEDDEN/${name}.tar.gz";
-      sha256 = "047i22mdnf7fa0h9w5jhqrjbg561l5jxk8xqzwh6zbmwlac4qf98";
-    };
-    meta = {
-      description = "Perl interpreter-based threads";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   threadsshared = buildPerlPackage rec {
     name = "threads-shared-1.58";
     src = fetchurl {
@@ -16851,14 +16763,6 @@ let
     };
   };
 
-  TimeHiRes = buildPerlPackage rec {
-    name = "Time-HiRes-1.9758";
-    src = fetchurl {
-      url = mirror://cpan/authors/id/J/JH/JHI/Time-HiRes-1.9758.tar.gz;
-      sha256 = "07jbydcdzpjm6i4nidci0rlklx4kla210fsl6zishw0yq5di9yjv";
-    };
-  };
-
   TimeLocal = buildPerlPackage {
     name = "Time-Local-1.28";
     src = fetchurl {
@@ -17047,18 +16951,6 @@ let
     };
   };
 
-  UnicodeCollate = buildPerlPackage rec {
-    name = "Unicode-Collate-1.25";
-    src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SA/SADAHIRO/${name}.tar.gz";
-      sha256 = "1dpvck4saah8hqb9c82i25yimy9x2hkr1k3a2f1ly0k0ifhbiyyx";
-    };
-    meta = {
-      description = "Unicode Collation Algorithm";
-      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-    };
-  };
-
   UnicodeLineBreak = buildPerlPackage rec {
     name = "Unicode-LineBreak-2018.003";
     src = fetchurl {
@@ -17944,6 +17836,18 @@ let
   UnicodeNormalize = null; # part of Perl 5.26
   XSLoader = null; # part of Perl 5.26
 
+  Carp = null; # part of Perl 5.28
+  ExtUtilsCBuilder = null; # part of Perl 5.28
+  ExtUtilsParseXS = null; # part of Perl 5.28
+  FilterSimple = null; # part of Perl 5.28
+  IOSocketIP = null; # part of Perl 5.28
+  SelfLoader = null; # part of Perl 5.28
+  Socket = null; # part of Perl 5.28
+  TestHarness = null; # part of Perl 5.28
+  threads = null; # part of Perl 5.28
+  TimeHiRes = null; # part of Perl 5.28
+  UnicodeCollate = null; # part of Perl 5.28
+
   ArchiveZip_1_53 = self.ArchiveZip;
   Autobox = self.autobox;
   CommonSense = self.commonsense; # For backwards compatibility.
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d9295c58a22c..453eda0d6118 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1690,10 +1690,10 @@ in {
     then callPackage ../development/python-modules/faulthandler {}
     else throw "faulthandler is built into ${python.executable}";
 
-  flexmock = callPackage ../development/python-modules/flexmock { };
-
   fb-re2 = callPackage ../development/python-modules/fb-re2 { };
 
+  flexmock = callPackage ../development/python-modules/flexmock { };
+
   flit = callPackage ../development/python-modules/flit { };
 
   flowlogs_reader = callPackage ../development/python-modules/flowlogs_reader { };