about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/stdenv/stdenv.chapter.md2
-rw-r--r--nixos/doc/manual/from_md/release-notes/rl-2305.section.xml17
-rw-r--r--nixos/doc/manual/release-notes/rl-2305.section.md7
-rw-r--r--nixos/modules/services/hardware/bluetooth.nix27
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/firefox/common.nix2
-rw-r--r--pkgs/applications/terminal-emulators/xterm/default.nix4
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix7
-rw-r--r--pkgs/build-support/fetchbzr/builder.sh4
-rw-r--r--pkgs/build-support/fetchcvs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdarcs/builder.sh4
-rw-r--r--pkgs/build-support/fetchdocker/fetchdocker-builder.sh3
-rw-r--r--pkgs/build-support/fetchdocker/generic-fetcher.nix6
-rw-r--r--pkgs/build-support/fetchfirefoxaddon/default.nix2
-rw-r--r--pkgs/build-support/fetchfossil/builder.sh4
-rw-r--r--pkgs/build-support/fetchgit/builder.sh3
-rw-r--r--pkgs/build-support/fetchhg/builder.sh4
-rw-r--r--pkgs/build-support/fetchmtn/builder.sh12
-rw-r--r--pkgs/build-support/fetchsvn/builder.sh4
-rw-r--r--pkgs/build-support/fetchsvnssh/builder.sh4
-rw-r--r--pkgs/build-support/fetchurl/builder.sh2
-rw-r--r--pkgs/build-support/pkg-config-wrapper/default.nix5
-rw-r--r--pkgs/build-support/release/debian-build.nix6
-rw-r--r--pkgs/build-support/release/nix-build.nix3
-rw-r--r--pkgs/build-support/release/source-tarball.nix3
-rw-r--r--pkgs/build-support/setup-hooks/audit-tmpdir.sh4
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py7
-rw-r--r--pkgs/build-support/setup-hooks/canonicalize-jars.sh3
-rw-r--r--pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix2
-rw-r--r--pkgs/build-support/setup-hooks/make-symlinks-relative.sh4
-rw-r--r--pkgs/build-support/setup-hooks/multiple-outputs.sh26
-rw-r--r--pkgs/build-support/setup-hooks/patch-shebangs.sh2
-rw-r--r--pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh8
-rw-r--r--pkgs/build-support/setup-hooks/separate-debug-info.sh2
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh2
-rw-r--r--pkgs/build-support/trivial-builders.nix11
-rw-r--r--pkgs/build-support/vm/default.nix6
-rw-r--r--pkgs/desktops/xfce/default.nix4
-rw-r--r--pkgs/development/compilers/chicken/4/fetchegg/builder.sh4
-rw-r--r--pkgs/development/compilers/chicken/5/fetchegg/builder.sh4
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/11/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/12/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix12
-rw-r--r--pkgs/development/compilers/gcc/builder.sh30
-rw-r--r--pkgs/development/compilers/go/1.19.nix4
-rw-r--r--pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix13
-rw-r--r--pkgs/development/compilers/swift/compiler/default.nix651
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch (renamed from pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch)0
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch18
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch30
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-darwin-fix-bootstrap.patch20
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch17
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch21
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch67
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch39
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch26
-rw-r--r--pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch46
-rw-r--r--pkgs/development/compilers/swift/default.nix532
-rw-r--r--pkgs/development/compilers/swift/foundation/default.nix61
-rw-r--r--pkgs/development/compilers/swift/foundation/glue.cmake8
-rw-r--r--pkgs/development/compilers/swift/libdispatch/default.nix42
-rw-r--r--pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch35
-rw-r--r--pkgs/development/compilers/swift/libdispatch/glue.cmake5
-rw-r--r--pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch23
-rw-r--r--pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch13
-rw-r--r--pkgs/development/compilers/swift/patches/0006-clang-purity.patch16
-rw-r--r--pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch13
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/default.nix72
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix16
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json178
-rw-r--r--pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch12
-rw-r--r--pkgs/development/compilers/swift/sources.nix33
-rw-r--r--pkgs/development/compilers/swift/swift-docc/default.nix53
-rw-r--r--pkgs/development/compilers/swift/swift-docc/generated/default.nix15
-rw-r--r--pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json161
-rw-r--r--pkgs/development/compilers/swift/swift-driver/default.nix77
-rw-r--r--pkgs/development/compilers/swift/swift-driver/generated/default.nix11
-rw-r--r--pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json93
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch17
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch40
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch28
-rw-r--r--pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch16
-rw-r--r--pkgs/development/compilers/swift/swiftpm/cmake-glue.nix90
-rw-r--r--pkgs/development/compilers/swift/swiftpm/default.nix418
-rw-r--r--pkgs/development/compilers/swift/swiftpm/generated/default.nix14
-rw-r--r--pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json144
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch36
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch21
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch48
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch121
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch23
-rw-r--r--pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch14
-rw-r--r--pkgs/development/compilers/swift/swiftpm/setup-hook.sh60
-rw-r--r--pkgs/development/compilers/swift/wrapper/default.nix58
-rw-r--r--pkgs/development/compilers/swift/wrapper/setup-hook.sh28
-rw-r--r--pkgs/development/compilers/swift/wrapper/wrapper.sh291
-rw-r--r--pkgs/development/compilers/swift/xctest/default.nix55
-rw-r--r--pkgs/development/haskell-modules/generic-stack-builder.nix4
-rw-r--r--pkgs/development/interpreters/lua-5/wrap-lua.nix2
-rw-r--r--pkgs/development/interpreters/python/wrap-python.nix1
-rw-r--r--pkgs/development/libraries/audio/roc-toolkit/default.nix16
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix2
-rw-r--r--pkgs/development/libraries/giflib/default.nix8
-rw-r--r--pkgs/development/libraries/glibc/default.nix14
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix16
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix2
-rw-r--r--pkgs/development/libraries/json-glib/default.nix2
-rw-r--r--pkgs/development/libraries/libcbor/default.nix48
-rw-r--r--pkgs/development/libraries/libjxl/default.nix9
-rw-r--r--pkgs/development/libraries/libmpc/default.nix4
-rw-r--r--pkgs/development/libraries/libsoup/default.nix1
-rw-r--r--pkgs/development/libraries/libtheora/default.nix2
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libwebp/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix4
-rw-r--r--pkgs/development/libraries/mpfr/default.nix11
-rw-r--r--pkgs/development/libraries/mtdev/default.nix8
-rw-r--r--pkgs/development/libraries/ncurses/default.nix10
-rw-r--r--pkgs/development/libraries/nss/esr.nix4
-rw-r--r--pkgs/development/libraries/nss/generic.nix13
-rw-r--r--pkgs/development/libraries/pango/default.nix1
-rw-r--r--pkgs/development/libraries/qca-qt5/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix2
-rwxr-xr-xpkgs/development/libraries/qt-5/5.15/fetch.sh2
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json20
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix15
-rw-r--r--pkgs/development/libraries/qt-6/default.nix2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtbase.nix12
-rw-r--r--pkgs/development/libraries/swift-corelibs-libdispatch/default.nix42
-rw-r--r--pkgs/development/libraries/tracker/default.nix1
-rw-r--r--pkgs/development/python-modules/cachetools/default.nix7
-rw-r--r--pkgs/development/python-modules/chardet/default.nix3
-rw-r--r--pkgs/development/python-modules/cryptography/default.nix3
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix4
-rw-r--r--pkgs/development/python-modules/future/default.nix17
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix27
-rw-r--r--pkgs/development/python-modules/iso8601/default.nix3
-rw-r--r--pkgs/development/python-modules/iteration-utilities/default.nix28
-rw-r--r--pkgs/development/python-modules/jinja2-ansible-filters/default.nix31
-rw-r--r--pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix43
-rw-r--r--pkgs/development/python-modules/numpy/default.nix3
-rw-r--r--pkgs/development/python-modules/orjson/default.nix7
-rw-r--r--pkgs/development/python-modules/poetry-dynamic-versioning/default.nix5
-rw-r--r--pkgs/development/python-modules/pysvn/default.nix9
-rw-r--r--pkgs/development/python-modules/pytest-benchmark/default.nix4
-rw-r--r--pkgs/development/python-modules/pyyaml-include/default.nix37
-rw-r--r--pkgs/development/python-modules/requests/default.nix10
-rw-r--r--pkgs/development/python-modules/requests/relax-charset-normalizer.patch55
-rw-r--r--pkgs/development/python-modules/simplejson/default.nix15
-rw-r--r--pkgs/development/python-modules/sphinx-codeautolink/default.nix51
-rw-r--r--pkgs/development/python-modules/sphinx-hoverxref/default.nix67
-rw-r--r--pkgs/development/python-modules/sphinx-jquery/default.nix36
-rw-r--r--pkgs/development/python-modules/sphinx-notfound-page/default.nix51
-rw-r--r--pkgs/development/python-modules/sphinx-prompt/default.nix27
-rw-r--r--pkgs/development/python-modules/sphinx-tabs/default.nix55
-rw-r--r--pkgs/development/python-modules/sphinx-version-warning/default.nix59
-rw-r--r--pkgs/development/python-modules/twisted/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/wafHook/default.nix1
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.11.x.nix3
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.15.x.nix3
-rw-r--r--pkgs/development/tools/misc/automake/automake-1.16.x.nix3
-rw-r--r--pkgs/development/tools/misc/binutils/default.nix23
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix12
-rw-r--r--pkgs/development/tools/misc/libtool/libtool2.nix22
-rw-r--r--pkgs/development/tools/misc/lsof/default.nix4
-rw-r--r--pkgs/development/tools/misc/patchelf/setup-hook.sh4
-rw-r--r--pkgs/development/tools/misc/pkg-config/default.nix2
-rw-r--r--pkgs/development/tools/swiftpm2nix/default.nix25
-rw-r--r--pkgs/development/tools/swiftpm2nix/support.nix56
-rwxr-xr-xpkgs/development/tools/swiftpm2nix/swiftpm2nix.sh44
-rw-r--r--pkgs/development/tools/xcbuild/sdks.nix3
-rw-r--r--pkgs/development/tools/xcbuild/wrapper.nix2
-rw-r--r--pkgs/games/openra/common.nix4
-rw-r--r--pkgs/os-specific/bsd/freebsd/default.nix13
-rw-r--r--pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix64
-rw-r--r--pkgs/os-specific/bsd/netbsd/default.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix17
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix46
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix6
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix5
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix3
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix2
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix55
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix14
-rw-r--r--pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch44
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix1
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix19
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix10
-rw-r--r--pkgs/stdenv/adapters.nix1
-rw-r--r--pkgs/stdenv/darwin/make-bootstrap-tools.nix2
-rw-r--r--pkgs/stdenv/generic/setup.sh89
-rw-r--r--pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh13
-rw-r--r--pkgs/stdenv/linux/default.nix7
-rw-r--r--pkgs/stdenv/linux/make-bootstrap-tools.nix19
-rw-r--r--pkgs/test/stdenv/default.nix22
-rw-r--r--pkgs/tools/archivers/unzip/default.nix9
-rw-r--r--pkgs/tools/backup/tsm-client/default.nix10
-rw-r--r--pkgs/tools/compression/gzip/default.nix15
-rw-r--r--pkgs/tools/compression/lzip/default.nix4
-rw-r--r--pkgs/tools/compression/xz/default.nix4
-rw-r--r--pkgs/tools/misc/copier/default.nix51
-rw-r--r--pkgs/tools/networking/openconnect/common.nix5
-rw-r--r--pkgs/tools/networking/openconnect/default.nix3
-rw-r--r--pkgs/tools/networking/unbound/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/nix-perl.nix2
-rw-r--r--pkgs/tools/package-management/pkg/default.nix36
-rw-r--r--pkgs/tools/text/gawk/default.nix20
-rw-r--r--pkgs/top-level/all-packages.nix124
-rw-r--r--pkgs/top-level/darwin-packages.nix2
-rw-r--r--pkgs/top-level/make-tarball.nix6
-rw-r--r--pkgs/top-level/nixpkgs-basic-release-checks.nix2
-rw-r--r--pkgs/top-level/python-packages.nix22
227 files changed, 5106 insertions, 1166 deletions
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index e66cc3476776..2562d149cb1e 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -253,7 +253,7 @@ The propagated equivalent of `depsTargetTarget`. This is prefixed for the same r
 
 #### `NIX_DEBUG` {#var-stdenv-NIX_DEBUG}
 
-A natural number indicating how much information to log. If set to 1 or higher, `stdenv` will print moderate debugging information during the build. In particular, the `gcc` and `ld` wrapper scripts will print out the complete command line passed to the wrapped tools. If set to 6 or higher, the `stdenv` setup script will be run with `set -x` tracing. If set to 7 or higher, the `gcc` and `ld` wrapper scripts will also be run with `set -x` tracing.
+A number between 0 and 7 indicating how much information to log. If set to 1 or higher, `stdenv` will print moderate debugging information during the build. In particular, the `gcc` and `ld` wrapper scripts will print out the complete command line passed to the wrapped tools. If set to 6 or higher, the `stdenv` setup script will be run with `set -x` tracing. If set to 7 or higher, the `gcc` and `ld` wrapper scripts will also be run with `set -x` tracing.
 
 ### Attributes affecting build properties {#attributes-affecting-build-properties}
 
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 1a9d3bdb6c6b..d4799f6b2ff5 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -330,6 +330,12 @@
       </listitem>
       <listitem>
         <para>
+          Calling <literal>makeSetupHook</literal> without passing a
+          <literal>name</literal> argument is deprecated.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
           Qt 5.12 and 5.14 have been removed, as the corresponding
           branches have been EOL upstream for a long time. This affected
           under 10 packages in nixpkgs, largely unmaintained upstream as
@@ -363,6 +369,17 @@
           <literal>freetype</literal> and others.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The iputils package, which is installed by default, no longer
+          provides the <literal>ninfod</literal>,
+          <literal>rarpd</literal> and <literal>rdisc</literal> tools.
+          See
+          <link xlink:href="https://github.com/iputils/iputils/releases/tag/20221126">upstream’s
+          release notes</link> for more details and available
+          replacements.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-23.05-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 2563da719f62..e17da718824a 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -81,6 +81,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
 
+- Calling `makeSetupHook` without passing a `name` argument is deprecated.
+
 - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually.
 
 - In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`.
@@ -89,6 +91,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Deprecated `xlibsWrapper` transitional package has been removed in favour of direct use of its constitutents: `xorg.libX11`, `freetype` and others.
 
+- The iputils package, which is installed by default, no longer provides the
+  `ninfod`, `rarpd` and `rdisc` tools. See
+  [upstream's release notes](https://github.com/iputils/iputils/releases/tag/20221126)
+  for more details and available replacements.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index 6453e6968dcc..2a58be51bb02 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -71,6 +71,29 @@ in
         };
         description = lib.mdDoc "Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).";
       };
+
+      input = mkOption {
+        type = cfgFmt.type;
+        default = { };
+        example = {
+          General = {
+            IdleTimeout = 30;
+            ClassicBondedOnly = true;
+          };
+        };
+        description = lib.mdDoc "Set configuration for the input service (/etc/bluetooth/input.conf).";
+      };
+
+      network = mkOption {
+        type = cfgFmt.type;
+        default = { };
+        example = {
+          General = {
+            DisableSecurity = true;
+          };
+        };
+        description = lib.mdDoc "Set configuration for the network service (/etc/bluetooth/network.conf).";
+      };
     };
   };
 
@@ -80,6 +103,10 @@ in
     environment.systemPackages = [ package ]
       ++ optional cfg.hsphfpd.enable pkgs.hsphfpd;
 
+    environment.etc."bluetooth/input.conf".source =
+      cfgFmt.generate "input.conf" cfg.input;
+    environment.etc."bluetooth/network.conf".source =
+      cfgFmt.generate "network.conf" cfg.network;
     environment.etc."bluetooth/main.conf".source =
       cfgFmt.generate "main.conf" (recursiveUpdate defaults cfg.settings);
     services.udev.packages = [ package ];
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index cbed4b36181e..df42258700ca 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-7SuM7a8IIecAJ83QvJfUba/wArAEXywqL2HwVbeG8H4=";
+    sha256 = "05lr9f0q4x1kvgfa3xrfmagpwvijv9m1s316aa9figqlkcc5vv4k";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index e8deb9fcd9cc..07243fe10ed9 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -524,7 +524,7 @@ buildStdenv.mkDerivation ({
             fi
 
             # Extract the debug info.
-            header "separating debug info from $i (build ID $id)"
+            echo "separating debug info from $i (build ID $id)"
             mkdir -p "$dst/''${id:0:2}"
             $OBJCOPY --only-keep-debug "$i" "$dst/''${id:0:2}/''${id:2}.debug"
 
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index 24a698ba8035..a5c98cb7df81 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "377";
+  version = "378";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-2xCP56Rdjtl+YEchtYRDtHNknmHiY2Mb+HWfhhipkLI=";
+    hash = "sha256-ZJ37/V7dDtnkfPjk2VO0sNPDC8KAFm38T/0Ulz/sPpI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 56f7e697ec87..317db2924ab3 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -28,7 +28,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.39.0";
+  version = "2.39.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-uhmbE/tamco97JF7C9c2vA61qd+Hc31DXt398Q1pJls=";
+    sha256 = "sha256-QKOKCEezDDcbNYc7OvzxI4hd1B6j7Lv1EO+pfzzlwWE=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 06aabf2a6f3e..fc82fd02615d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -338,11 +338,18 @@ stdenv.mkDerivation {
     # compile, because it uses "#include_next <limits.h>" to find the
     # limits.h file in ../includes-fixed. To remedy the problem,
     # another -idirafter is necessary to add that directory again.
+    #
+    # We use --sysroot=/nix/store/does/not/exist to drop embedded default
+    # path to glibc headers gcc was built against. Without it -idirafter
+    # only appends to the list and outdated glibc headers end up being
+    # used. 'cc-cflags-before' is used to allow user's --sysroot= option
+    # to override our default.
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
+      echo "--sysroot=/nix/store/does/not/exist" >> $out/nix-support/cc-cflags-before
       echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index 163f6fc60eea..380642a5e681 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "$stdenv/setup"
 
-header "exporting \`$url' (revision $rev) into \`$out'"
+echo "exporting \`$url' (revision $rev) into \`$out'"
 
 # Perform a lightweight checkout so that we don't end up importing
 # all the repository's history.
 BZR_LOG=/dev/null bzr -Ossl.cert_reqs=none export -r "$rev" --format=dir "$out" "$url"
-
-stopNest
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index 90363275b973..4b49e9676ec0 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -24,5 +24,3 @@ else
 fi
 (cd export && cvs -f -z0 -d "$cvsRoot" export $tag "$module")
 mv export/* $out
-
-stopNest
diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index 018852770504..ce5537f46f40 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -11,10 +11,8 @@ elif test -n "$context"; then
     tagflags="--context=$context"
 fi
 
-header "getting $url $partial ${tagtext} into $out"
+echo "getting $url $partial ${tagtext} into $out"
 
 darcs get --lazy $tagflags "$url" "$out"
 # remove metadata, because it can change
 rm -rf "$out/_darcs"
-
-stopNest
diff --git a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
index e5a1a61b78d3..4eb70f672d48 100644
--- a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
+++ b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
@@ -1,6 +1,6 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source "${stdenv}/setup"
-header "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
+echo "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
 
 cat <<EOF > "${out}/compositeImage.sh"
@@ -26,4 +26,3 @@ ${gnutar}/bin/tar \
   -c "${manifest}" "${repositories}" -T "${imageFileStorePaths}"
 EOF
 chmod +x "${out}/compositeImage.sh"
-stopNest
diff --git a/pkgs/build-support/fetchdocker/generic-fetcher.nix b/pkgs/build-support/fetchdocker/generic-fetcher.nix
index 3b0c33770467..6a7b977db29f 100644
--- a/pkgs/build-support/fetchdocker/generic-fetcher.nix
+++ b/pkgs/build-support/fetchdocker/generic-fetcher.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
   inherit name;
   builder = writeText "${fetcher}-builder.sh" ''
     source "$stdenv/setup"
-    header "${fetcher} exporting to $out"
+    echo "${fetcher} exporting to $out"
 
     declare -A creds
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     fi
 
     if [ -f "$dockerCredentialsFile" ]; then
-      header "using credentials from $dockerCredentialsFile"
+      echo "using credentials from $dockerCredentialsFile"
 
       CREDSFILE=$(cat "$dockerCredentialsFile")
       creds[token]=$(${awk} -F'=' '/DOCKER_TOKEN/ {print $2}' <<< "$CREDSFILE" | head -n1)
@@ -77,8 +77,6 @@ stdenv.mkDerivation {
       ${layerDigestFlag} \
       "${repository}/${imageName}" \
       "${tag}"
-
-    stopNest
   '';
 
   buildInputs = [ haskellPackages.hocker ];
diff --git a/pkgs/build-support/fetchfirefoxaddon/default.nix b/pkgs/build-support/fetchfirefoxaddon/default.nix
index 0fa51e69840c..fe9ff5c469ba 100644
--- a/pkgs/build-support/fetchfirefoxaddon/default.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
   builder = writeScript "xpibuilder" ''
     source $stdenv/setup
 
-    header "firefox addon $name into $out"
+    echo "firefox addon $name into $out"
 
     UUID="${extid}"
     mkdir -p "$out/$UUID"
diff --git a/pkgs/build-support/fetchfossil/builder.sh b/pkgs/build-support/fetchfossil/builder.sh
index 009b23c406d6..36b758ab574e 100644
--- a/pkgs/build-support/fetchfossil/builder.sh
+++ b/pkgs/build-support/fetchfossil/builder.sh
@@ -1,6 +1,6 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
-header "Cloning Fossil $url [$rev] into $out"
+echo "Cloning Fossil $url [$rev] into $out"
 
 # Fossil, bless its adorable little heart, wants to write global configuration
 # to $HOME/.fossil. AFAICT, there is no way to disable this functionality.
@@ -19,5 +19,3 @@ popd
 
 # Just nuke the checkout file.
 rm $out/.fslckout
-
-stopNest
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index acb970639ab1..77f6381b09ab 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -6,7 +6,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (rev $rev) into $out"
+echo "exporting $url (rev $rev) into $out"
 
 $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${leaveDotGit:+--leave-dotGit} \
@@ -18,4 +18,3 @@ $SHELL $fetcher --builder --url "$url" --out "$out" --rev "$rev" \
   ${branchName:+--branch-name "$branchName"}
 
 runHook postFetch
-stopNest
diff --git a/pkgs/build-support/fetchhg/builder.sh b/pkgs/build-support/fetchhg/builder.sh
index cec0e441f229..1ce294757713 100644
--- a/pkgs/build-support/fetchhg/builder.sh
+++ b/pkgs/build-support/fetchhg/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
-header "getting $url${rev:+ ($rev)} into $out"
+echo "getting $url${rev:+ ($rev)} into $out"
 
 hg clone --insecure "$url" hg-clone
 
 hg archive -q$subrepoClause -y ${rev:+-r "$rev"} --cwd hg-clone $out
 rm -f $out/.hg_archival.txt
-
-stopNest
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index 7db66730dab8..1aabd7949ee1 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -8,7 +8,7 @@ if ! [ -f "$cacheDB" ]; then
     mtn --db "$cacheDB" db init
 fi
 
-header "getting revision $selector";
+echo "getting revision $selector";
 
 done=;
 for source in $dbs; do
@@ -32,9 +32,7 @@ for source in $dbs; do
     fi;
 done;
 
-stopNest;
-
-header "checking out the revision $revision";
+echo "checking out the revision $revision";
 
 if test -n "$done"; then
     mtn checkout --db "$cacheDB" -r "$revision" "$out" -b "${branch}"
@@ -43,10 +41,6 @@ else
     exit 1;
 fi;
 
-stopNest
-
-header "clearing _MTN in the output"
+echo "clearing _MTN in the output"
 
 rm -rf "$out/_MTN"
-
-stopNest
diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index b58e5a88b3cd..aa4d049aba43 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,7 +1,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (r$rev) into $out"
+echo "exporting $url (r$rev) into $out"
 
 if test -n "$http_proxy"; then
     # Configure proxy
@@ -22,5 +22,3 @@ fi;
 svn export --trust-server-cert --non-interactive \
     ${ignoreExternals:+--ignore-externals} ${ignoreKeywords:+--ignore-keywords} \
     -r "$rev" "$url" "$out"
-
-stopNest
diff --git a/pkgs/build-support/fetchsvnssh/builder.sh b/pkgs/build-support/fetchsvnssh/builder.sh
index b0441299dd2c..5782151524f7 100644
--- a/pkgs/build-support/fetchsvnssh/builder.sh
+++ b/pkgs/build-support/fetchsvnssh/builder.sh
@@ -1,7 +1,7 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting $url (r$rev) into $out"
+echo "exporting $url (r$rev) into $out"
 
 if test "$sshSupport"; then
     export SVN_SSH="$openssh/bin/ssh"
@@ -12,5 +12,3 @@ fi
 # whether the server is being spoofed --- only the cryptographic
 # hash of the output matters.
 expect -f $sshSubversion "$username" "$password" "$rev" "$url" $out
-
-stopNest
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index dd987f41b446..e8eaba934858 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -37,7 +37,7 @@ if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
 tryDownload() {
     local url="$1"
     echo
-    header "trying $url"
+    echo "trying $url"
     local curlexit=18;
 
     success=
diff --git a/pkgs/build-support/pkg-config-wrapper/default.nix b/pkgs/build-support/pkg-config-wrapper/default.nix
index ca14a4495fed..f68597662608 100644
--- a/pkgs/build-support/pkg-config-wrapper/default.nix
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@@ -46,14 +46,11 @@ stdenv.mkDerivation {
   strictDeps = true;
   dontBuild = true;
   dontConfigure = true;
+  dontUnpack = true;
 
   # Additional flags passed to pkg-config.
   addFlags = lib.optional stdenv.targetPlatform.isStatic "--static";
 
-  unpackPhase = ''
-    src=$PWD
-  '';
-
   installPhase =
     ''
       mkdir -p $out/bin $out/nix-support
diff --git a/pkgs/build-support/release/debian-build.nix b/pkgs/build-support/release/debian-build.nix
index 9104bf2dce5c..679adad827da 100644
--- a/pkgs/build-support/release/debian-build.nix
+++ b/pkgs/build-support/release/debian-build.nix
@@ -43,9 +43,8 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
       [ ! -f /etc/lsb-release ] || (source /etc/lsb-release; echo "OS release: $DISTRIB_DESCRIPTION")
       echo "System/kernel: $(uname -a)"
       if test -e /etc/debian_version; then echo "Debian release: $(cat /etc/debian_version)"; fi
-      header "installed Debian packages"
+      echo "installed Debian packages"
       dpkg-query --list
-      stopNest
     '';
 
     installPhase = ''
@@ -73,11 +72,10 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
       [ "$(echo $out/debs/*.deb)" != "" ]
 
       for i in $out/debs/*.deb; do
-        header "Generated DEB package: $i"
+        echo "Generated DEB package: $i"
         dpkg-deb --info "$i"
         pkgName=$(dpkg-deb -W "$i" | awk '{print $1}')
         echo "file deb $i" >> $out/nix-support/hydra-build-products
-        stopNest
       done
       dpkg -i $out/debs/*.deb
 
diff --git a/pkgs/build-support/release/nix-build.nix b/pkgs/build-support/release/nix-build.nix
index 5ed2b0752efc..9578fbf482f2 100644
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@@ -74,10 +74,9 @@ stdenv.mkDerivation (
       if test -n "$succeedOnFailure"; then
           if test -n "$keepBuildDirectory"; then
               KEEPBUILDDIR="$out/`basename $TMPDIR`"
-              header "Copying build directory to $KEEPBUILDDIR"
+              echo "Copying build directory to $KEEPBUILDDIR"
               mkdir -p $KEEPBUILDDIR
               cp -R "$TMPDIR/"* $KEEPBUILDDIR
-              stopNest
           fi
       fi
     '';
diff --git a/pkgs/build-support/release/source-tarball.nix b/pkgs/build-support/release/source-tarball.nix
index 742cce13b7bf..d624d071cc21 100644
--- a/pkgs/build-support/release/source-tarball.nix
+++ b/pkgs/build-support/release/source-tarball.nix
@@ -64,10 +64,9 @@ stdenv.mkDerivation (
       if test -n "$succeedOnFailure"; then
           if test -n "$keepBuildDirectory"; then
               KEEPBUILDDIR="$out/`basename $TMPDIR`"
-              header "Copying build directory to $KEEPBUILDDIR"
+              echo "Copying build directory to $KEEPBUILDDIR"
               mkdir -p $KEEPBUILDDIR
               cp -R "$TMPDIR/"* $KEEPBUILDDIR
-              stopNest
           fi
       fi
     '';
diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index 9c03bc2ee935..36714178156b 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -13,7 +13,7 @@ auditTmpdir() {
     local dir="$1"
     [ -e "$dir" ] || return 0
 
-    header "checking for references to $TMPDIR/ in $dir..."
+    echo "checking for references to $TMPDIR/ in $dir..."
 
     local i
     find "$dir" -type f -print0 | while IFS= read -r -d $'\0' i; do
@@ -36,6 +36,4 @@ auditTmpdir() {
         fi
 
     done
-
-    stopNest
 }
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index efb65a809962..e731feb1b125 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -131,7 +131,14 @@ def populate_cache(initial: List[Path], recursive: bool =False) -> None:
             if not path.is_file():
                 continue
 
+            # As an optimisation, resolve the symlinks here, as the target is unique
+            # XXX: (layus, 2022-07-25) is this really an optimisation in all cases ?
+            # It could make the rpath bigger or break the fragile precedence of $out.
             resolved = path.resolve()
+            # Do not use resolved paths when names do not match
+            if resolved.name != path.name:
+                resolved = path
+
             try:
                 with open_elf(path) as elf:
                     osabi = get_osabi(elf)
diff --git a/pkgs/build-support/setup-hooks/canonicalize-jars.sh b/pkgs/build-support/setup-hooks/canonicalize-jars.sh
index 8c55810748ea..5137bfc94b01 100644
--- a/pkgs/build-support/setup-hooks/canonicalize-jars.sh
+++ b/pkgs/build-support/setup-hooks/canonicalize-jars.sh
@@ -6,12 +6,11 @@ fixupOutputHooks+=('if [ -z "$dontCanonicalizeJars" -a -e "$prefix" ]; then cano
 
 canonicalizeJarsIn() {
   local dir="$1"
-  header "canonicalizing jars in $dir"
+  echo "canonicalizing jars in $dir"
   dir="$(realpath -sm -- "$dir")"
   while IFS= read -rd '' f; do
     canonicalizeJar "$f"
   done < <(find -- "$dir" -type f -name '*.jar' -print0)
-  stopNest
 }
 
 source @canonicalize_jar@
diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
index c9b03b75cd03..c81a253b0de8 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper/default.nix
@@ -10,6 +10,8 @@
 }:
 
 makeSetupHook {
+  name = "make-binary-wrapper-hook";
+
   deps = [ dieHook ]
     # https://github.com/NixOS/nixpkgs/issues/148189
     ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) cc;
diff --git a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
index cd9c2eaa2d80..f34353a7617b 100644
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@@ -6,8 +6,8 @@ postFixupHooks+=(_makeSymlinksRelative)
 _makeSymlinksRelative() {
     local symlinkTarget
 
-    if [ -n "${dontRewriteSymlinks-}" ]; then
-        return 0
+    if [ "${dontRewriteSymlinks-}" ] || [ ! -e "$prefix" ]; then
+       return
     fi
 
     while IFS= read -r -d $'\0' f; do
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 8a2fc2f915e9..3a318933f138 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -4,16 +4,32 @@ preFixupHooks+=(_multioutDocs)
 preFixupHooks+=(_multioutDevs)
 postFixupHooks+=(_multioutPropagateDev)
 
-# Assign the first string containing nonempty variable to the variable named $1
+# _assignFirst varName otherVarNames*
+#
+# Set the value of the variable named $varName to the first of otherVarNames
+# that refers to a non-empty variable name.
+#
+# If none of otherVarNames refers to a non-empty variable, the error message is
+# specific to this function's use case, which is setting up the output variables.
 _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    while (( $# )); do
-        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
-        shift
+    for var in "$@"; do
+        if [ -n "${!var-}" ]; then eval "${varName}"="${var}"; return; fi
     done
-    echo "Error: _assignFirst found no valid variant!"
+    echo
+    echo "error: _assignFirst: could not find a non-empty variable to assign to ${varName}."
+    echo "       The following variables were all unset or empty:"
+    echo "           $*"
+    if [ -z "${out:-}" ]; then
+        echo '       If you do not want an "out" output in your derivation, make sure to define'
+        echo '       the other specific required outputs. This can be achieved by picking one'
+        echo "       of the above as an output."
+        echo '       You do not have to remove "out" if you want to have a different default'
+        echo '       output, because the first output is taken as a default.'
+        echo
+    fi
     return 1 # none found
 }
 
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
index 04ebcd2cc64e..a26113abea88 100644
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -100,8 +100,6 @@ patchShebangs() {
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
-
-    stopNest
 }
 
 patchShebangsAuto () {
diff --git a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
index cfc9bd2f83d6..b85d4203480f 100644
--- a/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
+++ b/pkgs/build-support/setup-hooks/postgresql-test-hook/postgresql-test-hook.sh
@@ -53,7 +53,7 @@ EOF
     echo >&2 'initdb not found. Did you add postgresql to the nativeCheckInputs?'
     false
   fi
-  header 'initializing postgresql'
+  echo 'initializing postgresql'
   initdb -U postgres
 
   # Move the socket
@@ -65,15 +65,15 @@ EOF
     echo "listen_addresses = ''" >>"$PGDATA/postgresql.conf"
   fi
 
-  header 'starting postgresql'
+  echo 'starting postgresql'
   eval "${postgresqlStartCommands:-pg_ctl start}"
 
-  header 'setting up postgresql'
+  echo 'setting up postgresql'
   eval "$postgresqlTestSetupCommands"
 
 }
 
 postgresqlStop() {
-  header 'stopping postgresql'
+  echo 'stopping postgresql'
   pg_ctl stop
 }
diff --git a/pkgs/build-support/setup-hooks/separate-debug-info.sh b/pkgs/build-support/setup-hooks/separate-debug-info.sh
index be94af545be1..3c8c9c294c3e 100644
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@@ -26,7 +26,7 @@ _separateDebugInfo() {
         fi
 
         # Extract the debug info.
-        header "separating debug info from $i (build ID $id)"
+        echo "separating debug info from $i (build ID $id)"
         mkdir -p "$dst/${id:0:2}"
 
         # This may fail, e.g. if the binary is for a different
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 104b5515b3db..f5e3bdced699 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -36,7 +36,7 @@ _doStrip() {
         local -n ranlibCmd="${ranlibCmds[$i]}"
 
         # `dontStrip` disables them all
-        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
         then continue; fi
 
         stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S}"
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 80c3214f06a3..3de041636f05 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -546,6 +546,7 @@ rec {
    * # writes a Linux-exclusive setup hook where @bash@ myscript.sh is substituted for the
    * # bash interpreter.
    * myhellohookSub = makeSetupHook {
+   *                 name = "myscript-hook";
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
@@ -553,13 +554,21 @@ rec {
    *
    * # setup hook with a package test
    * myhellohookTested = makeSetupHook {
+   *                 name = "myscript-hook";
    *                 deps = [ hello ];
    *                 substitutions = { bash = "${pkgs.bash}/bin/bash"; };
    *                 meta.platforms = lib.platforms.linux;
    *                 passthru.tests.greeting = callPackage ./test { };
    *               } ./myscript.sh;
    */
-  makeSetupHook = { name ? "hook", deps ? [], substitutions ? {}, meta ? {}, passthru ? {} }: script:
+  makeSetupHook =
+    { name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook"
+    , deps ? []
+    , substitutions ? {}
+    , meta ? {}
+    , passthru ? {}
+    }:
+    script:
     runCommand name
       (substitutions // {
         inherit meta;
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 7bae2fc7cfb2..84754e580302 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -527,9 +527,8 @@ rec {
       echo "System/kernel: $(uname -a)"
       if test -e /etc/fedora-release; then echo "Fedora release: $(cat /etc/fedora-release)"; fi
       if test -e /etc/SuSE-release; then echo "SUSE release: $(cat /etc/SuSE-release)"; fi
-      header "installed RPM packages"
+      echo "installed RPM packages"
       rpm -qa --qf "%{Name}-%{Version}-%{Release} (%{Arch}; %{Distribution}; %{Vendor})\n"
-      stopNest
     '';
 
     buildPhase = ''
@@ -559,9 +558,8 @@ rec {
       find $rpmout -name "*.rpm" -exec cp {} $out/$outDir \;
 
       for i in $out/$outDir/*.rpm; do
-        header "Generated RPM/SRPM: $i"
+        echo "Generated RPM/SRPM: $i"
         rpm -qip $i
-        stopNest
       done
 
       eval "$postInstall"
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 6ac119931424..5dc21338a72c 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -25,7 +25,9 @@ makeScopeWithSplicing
 
       mkXfceDerivation = callPackage ./mkXfceDerivation.nix { };
 
-      automakeAddFlags = pkgs.makeSetupHook { } ./automakeAddFlags.sh;
+      automakeAddFlags = pkgs.makeSetupHook {
+        name = "xfce-automake-add-flags-hook";
+      } ./automakeAddFlags.sh;
 
       #### CORE
 
diff --git a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
index 5f41a36263a9..cb56eabc5d78 100644
--- a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
@@ -1,10 +1,8 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting egg ${eggName} (version $version) into $out"
+echo "exporting egg ${eggName} (version $version) into $out"
 
 mkdir -p $out
 chicken-install -r "${eggName}:${version}"
 cp -r ${eggName}/* $out/
-
-stopNest
diff --git a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
index f02e01757787..34c9de37233d 100644
--- a/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/5/fetchegg/builder.sh
@@ -1,11 +1,9 @@
 if [ -e .attrs.sh ]; then source .attrs.sh; fi
 source $stdenv/setup
 
-header "exporting egg ${eggName} (version $version) into $out"
+echo "exporting egg ${eggName} (version $version) into $out"
 
 mkdir -p $out
 CHICKEN_EGG_CACHE=. chicken-install -r "${eggName}:${version}"
 rm ${eggName}/{STATUS,TIMESTAMP}
 cp -r ${eggName}/* $out/
-
-stopNest
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 2751501901f2..76374201f456 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -51,8 +51,14 @@ let majorVersion = "10";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches = [ ]
-      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -222,6 +228,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 265e696523da..52d7635f361c 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -51,8 +51,14 @@ let majorVersion = "11";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-         optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -226,6 +232,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 7e1847ebba98..3fe6620987a3 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -270,6 +270,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 042e561a2e36..810706ed0f3d 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -227,6 +227,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 8420cfdde7d5..e25af867e537 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -247,6 +247,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 66b53c6d5b5e..450b23310337 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -64,6 +64,13 @@ let majorVersion = "6";
 
     patches = optionals (!stdenv.targetPlatform.isRedox) [
       ../use-source-date-epoch.patch ./0001-Fix-build-for-glibc-2.31.patch
+
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
     ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional langAda ../gnat-cflags.patch
@@ -258,6 +265,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 8fd990f95ffb..a0465e8bdd60 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -56,6 +56,13 @@ let majorVersion = "7";
         ./gcc8-asan-glibc-2.34.patch
 
         ./0001-Fix-build-for-glibc-2.31.patch
+
+        # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+        (fetchurl {
+          name = "fix-bug-80431.patch";
+          url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+          sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+        })
       ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optionals targetPlatform.isNetBSD [
@@ -226,6 +233,7 @@ stdenv.mkDerivation ({
   ;
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 2dc141b529fc..03fb9fb1205c 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -46,8 +46,14 @@ let majorVersion = "8";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-         optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       /* ++ optional (hostPlatform != buildPlatform) (fetchpatch { # XXX: Refine when this should be applied
@@ -206,6 +212,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 9b5f4504db8e..317c77ea835f 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -55,9 +55,14 @@ let majorVersion = "9";
 
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
-    patches =
-      [ ]
-      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
+    patches = [
+      # Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+      (fetchurl {
+        name = "fix-bug-80431.patch";
+        url = "https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=de31f5445b12fd9ab9969dc536d821fe6f0edad0";
+        sha256 = "0sd52c898msqg7m316zp0ryyj7l326cjcn2y19dcxqp15r74qj0g";
+      })
+    ] ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional targetPlatform.isNetBSD ../libstdc++-netbsd-ctypes.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional (noSysDirs && hostPlatform.isRiscV) ../no-sys-dirs-riscv-gcc9.patch
@@ -221,6 +226,7 @@ stdenv.mkDerivation ({
   };
 
   targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
+  targetPlatformConfig = targetPlatform.config;
 
   buildFlags = optional
     (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 113bd83ea53f..dd5a8de76e2a 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -203,6 +203,17 @@ preInstall() {
         ln -s lib "$out/${targetConfig}/lib32"
         ln -s lib "${!outputLib}/${targetConfig}/lib32"
     fi
+
+    # cc-wrappers uses --sysroot=/nix/store/does/not/exist as a way to
+    # drop default sysheaders search path. Unfortunately that switches
+    # clang++ into searching libraries in gcc in cross-compiler paths:
+    #   from ${!outputLib}/lib (native)
+    #   to ${!outputLib}/${targetPlatformConfig}/lib
+    # We create the symlink to make both native and cross paths
+    # available even if the toolchain is not the cross-compiler.
+    if [ ! -e ${!outputLib}/${targetPlatformConfig} ] ; then
+        ln -s . ${!outputLib}/${targetPlatformConfig}
+    fi
 }
 
 
@@ -240,25 +251,6 @@ postInstall() {
     # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
     rm -rf $out/bin/gccbug
 
-    if [[ buildConfig == *"linux"* ]]; then
-        # Take out the bootstrap-tools from the rpath, as it's not needed at all having $out
-        for i in $(find "$out"/libexec/gcc/*/*/* -type f -a \! -name '*.la'); do
-            PREV_RPATH=`patchelf --print-rpath "$i"`
-            NEW_RPATH=`echo "$PREV_RPATH" | sed 's,:[^:]*bootstrap-tools/lib,,g'`
-            patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
-        done
-    fi
-
-    if [[ targetConfig == *"linux"* ]]; then
-        # For some reason, when building for linux on darwin, the libs retain
-        # RPATH to $out.
-        for i in "$lib"/"$targetConfig"/lib/{libtsan,libasan,libubsan}.so.*.*.*; do
-            PREV_RPATH=`patchelf --print-rpath "$i"`
-            NEW_RPATH=`echo "$PREV_RPATH" | sed "s,:${out}[^:]*,,g"`
-            patchelf --set-rpath "$NEW_RPATH" "$i" && echo OK
-        done
-    fi
-
     if type "install_name_tool"; then
         for i in "${!outputLib}"/lib/*.*.dylib "${!outputLib}"/lib/*.so.[0-9]; do
             install_name_tool -id "$i" "$i" || true
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index af6c99a50e25..b1d45536321e 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.4";
+  version = "1.19.5";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-7adNtKxJSACj5m7nhOSVv7ubjlNd+SSosBsagCi382g=";
+    sha256 = "sha256-jkhujoWigfxc4/C+3FudLb9idtfbCyXT7ANPMT2gN18=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
index 3afa59739a37..b50097d5e66b 100644
--- a/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
+++ b/pkgs/development/compilers/rust/cargo-auditable-cargo-wrapper.nix
@@ -1,12 +1,9 @@
-{ lib, writeShellApplication, cargo, cargo-auditable }:
+{ lib, writeShellScriptBin, cargo, cargo-auditable }:
 
-(writeShellApplication {
-  name = "cargo";
-  runtimeInputs = [ cargo cargo-auditable ];
-  text = ''
-    CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 cargo auditable "$@"
-  '';
-}) // {
+(writeShellScriptBin "cargo" ''
+  export PATH="${lib.makeBinPath [ cargo cargo-auditable ]}:$PATH"
+  CARGO_AUDITABLE_IGNORE_UNSUPPORTED=1 exec cargo auditable "$@"
+'') // {
   meta = cargo-auditable.meta // {
     mainProgram = "cargo";
   };
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
new file mode 100644
index 000000000000..a53dcd477153
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -0,0 +1,651 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, coreutils
+, gnugrep
+, perl
+, ninja
+, pkg-config
+, clang
+, bintools
+, python3
+, git
+, fetchpatch
+, makeWrapper
+, gnumake
+, file
+, runCommand
+, writeShellScriptBin
+# For lldb
+, libedit
+, ncurses
+, swig
+, libxml2
+# Linux-specific
+, glibc
+, libuuid
+# Darwin-specific
+, substituteAll
+, fixDarwinDylibNames
+, runCommandLocal
+, xcbuild
+, cctools # libtool
+, sigtool
+, DarwinTools
+, CoreServices
+, Foundation
+, Combine
+, CLTools_Executables
+}:
+
+let
+
+  inherit (stdenv) hostPlatform targetPlatform;
+
+  sources = callPackage ../sources.nix { };
+
+  # Tools invoked by swift at run-time.
+  runtimeDeps = lib.optionals stdenv.isDarwin [
+    # libtool is used for static linking. This is part of cctools, but adding
+    # that as a build input puts an unwrapped linker in PATH, and breaks
+    # builds. This small derivation exposes just libtool.
+    # NOTE: The same applies to swift-driver, but that is currently always
+    # invoked via the old `swift` / `swiftc`. May change in the future.
+    (runCommandLocal "libtool" { } ''
+      mkdir -p $out/bin
+      ln -s ${cctools}/bin/libtool $out/bin/libtool
+    '')
+  ];
+
+  # There are apparently multiple naming conventions on Darwin. Swift uses the
+  # xcrun naming convention. See `configure_sdk_darwin` calls in CMake files.
+  swiftOs = if targetPlatform.isDarwin
+    then {
+      "macos" = "macosx";
+      "ios" = "iphoneos";
+      #iphonesimulator
+      #appletvos
+      #appletvsimulator
+      #watchos
+      #watchsimulator
+    }.${targetPlatform.darwinPlatform}
+      or (throw "Cannot build Swift for target Darwin platform '${targetPlatform.darwinPlatform}'")
+    else targetPlatform.parsed.kernel.name;
+
+  # Apple Silicon uses a different CPU name in the target triple.
+  swiftArch = if stdenv.isDarwin && stdenv.isAarch64 then "arm64"
+    else targetPlatform.parsed.cpu.name;
+
+  # On Darwin, a `.swiftmodule` is a subdirectory in `lib/swift/<OS>`,
+  # containing binaries for supported archs. On other platforms, binaries are
+  # installed to `lib/swift/<OS>/<ARCH>`. Note that our setup-hook also adds
+  # `lib/swift` for convenience.
+  swiftLibSubdir = "lib/swift/${swiftOs}";
+  swiftModuleSubdir = if hostPlatform.isDarwin
+    then "lib/swift/${swiftOs}"
+    else "lib/swift/${swiftOs}/${swiftArch}";
+
+  # And then there's also a separate subtree for statically linked  modules.
+  toStaticSubdir = lib.replaceStrings [ "/swift/" ] [ "/swift_static/" ];
+  swiftStaticLibSubdir = toStaticSubdir swiftLibSubdir;
+  swiftStaticModuleSubdir = toStaticSubdir swiftModuleSubdir;
+
+  # This matches _SWIFT_DEFAULT_COMPONENTS, with specific components disabled.
+  swiftInstallComponents = [
+    "autolink-driver"
+    "compiler"
+    # "clang-builtin-headers"
+    "stdlib"
+    "sdk-overlay"
+    "parser-lib"
+    "static-mirror-lib"
+    "editor-integration"
+    # "tools"
+    # "testsuite-tools"
+    "toolchain-tools"
+    "toolchain-dev-tools"
+    "license"
+    (if stdenv.isDarwin then "sourcekit-xpc-service" else "sourcekit-inproc")
+    "swift-remote-mirror"
+    "swift-remote-mirror-headers"
+  ];
+
+  # Build a tool used during the build to create a custom clang wrapper, with
+  # which we wrap the clang produced by the swift build.
+  #
+  # This is used in a `POST_BUILD` for the CMake target, so we rename the
+  # actual clang to clang-unwrapped, then put the wrapper in place.
+  #
+  # We replace the `exec ...` command with `exec -a "$0"` in order to
+  # preserve $0 for clang. This is because, unlike Nix, we don't have
+  # separate wrappers for clang/clang++, and clang uses $0 to detect C++.
+  #
+  # Similarly, the C++ detection in the wrapper itself also won't work for us,
+  # so we base it on $0 as well.
+  makeClangWrapper = writeShellScriptBin "nix-swift-make-clang-wrapper" ''
+    set -euo pipefail
+
+    targetFile="$1"
+    unwrappedClang="$targetFile-unwrapped"
+
+    mv "$targetFile" "$unwrappedClang"
+    sed < '${clang}/bin/clang' > "$targetFile" \
+      -e 's|^\s*exec|exec -a "$0"|g' \
+      -e 's|^\[\[ "${clang.cc}/bin/clang" = \*++ ]]|[[ "$0" = *++ ]]|' \
+      -e "s|${clang.cc}/bin/clang|$unwrappedClang|g"
+    chmod a+x "$targetFile"
+  '';
+
+  # Create a tool used during the build to create a custom swift wrapper for
+  # each of the swift executables produced by the build.
+  #
+  # The build produces several `swift-frontend` executables during
+  # bootstrapping. Each of these has numerous aliases via symlinks, and the
+  # executable uses $0 to detect what tool is called.
+  wrapperParams = {
+    inherit bintools;
+    default_cc_wrapper = clang; # Instead of `@out@` in the original.
+    coreutils_bin = lib.getBin coreutils;
+    gnugrep_bin = gnugrep;
+    suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
+    use_response_file_by_default = 1;
+    swiftDriver = "";
+    # NOTE: @prog@ needs to be filled elsewhere.
+  };
+  swiftWrapper = runCommand "swift-wrapper.sh" wrapperParams ''
+    substituteAll '${../wrapper/wrapper.sh}' "$out"
+  '';
+  makeSwiftcWrapper = writeShellScriptBin "nix-swift-make-swift-wrapper" ''
+    set -euo pipefail
+
+    targetFile="$1"
+    unwrappedSwift="$targetFile-unwrapped"
+
+    mv "$targetFile" "$unwrappedSwift"
+    sed < '${swiftWrapper}' > "$targetFile" \
+      -e "s|@prog@|'$unwrappedSwift'|g" \
+      -e 's|exec "$prog"|exec -a "$0" "$prog"|g'
+    chmod a+x "$targetFile"
+  '';
+
+in stdenv.mkDerivation {
+  pname = "swift";
+  inherit (sources) version;
+
+  outputs = [ "out" "lib" "dev" "doc" "man" ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    ninja
+    perl # pod2man
+    pkg-config
+    python3
+    makeWrapper
+    makeClangWrapper
+    makeSwiftcWrapper
+  ]
+    ++ lib.optionals stdenv.isDarwin [
+      xcbuild
+      sigtool # codesign
+      DarwinTools # sw_vers
+      fixDarwinDylibNames
+    ];
+
+  buildInputs = [
+    # For lldb
+    python3
+    swig
+    libxml2
+  ]
+    ++ lib.optionals stdenv.isLinux [
+      libuuid
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      CoreServices
+      Foundation
+      Combine
+    ];
+
+  # This is a partial reimplementation of our setup hook. Because we reuse
+  # the Swift wrapper for the Swift build itself, we need to do some of the
+  # same preparation.
+  postHook = ''
+    for pkg in "''${pkgsHostTarget[@]}" '${clang.libc}'; do
+      for subdir in ${swiftModuleSubdir} ${swiftStaticModuleSubdir} lib/swift; do
+        if [[ -d "$pkg/$subdir" ]]; then
+          export NIX_SWIFTFLAGS_COMPILE+=" -I $pkg/$subdir"
+        fi
+      done
+      for subdir in ${swiftLibSubdir} ${swiftStaticLibSubdir} lib/swift; do
+        if [[ -d "$pkg/$subdir" ]]; then
+          export NIX_LDFLAGS+=" -L $pkg/$subdir"
+        fi
+      done
+    done
+  '';
+
+  # We invoke cmakeConfigurePhase multiple times, but only need this once.
+  dontFixCmake = true;
+  # We setup custom build directories.
+  dontUseCmakeBuildDir = true;
+
+  unpackPhase = let
+    copySource = repo: "cp -r ${sources.${repo}} ${repo}";
+  in ''
+    mkdir src
+    cd src
+
+    ${copySource "swift-cmark"}
+    ${copySource "llvm-project"}
+    ${copySource "swift"}
+    ${copySource "swift-experimental-string-processing"}
+    ${lib.optionalString
+      (!stdenv.isDarwin)
+      (copySource "swift-corelibs-libdispatch")}
+
+    chmod -R u+w .
+  '';
+
+  patchPhase = ''
+    # Just patch all the things for now, we can focus this later.
+    # TODO: eliminate use of env.
+    find -type f -print0 | xargs -0 sed -i \
+    ${lib.optionalString stdenv.isDarwin
+      "-e 's|/usr/libexec/PlistBuddy|${xcbuild}/bin/PlistBuddy|g'"} \
+      -e 's|/usr/bin/env|${coreutils}/bin/env|g' \
+      -e 's|/usr/bin/make|${gnumake}/bin/make|g' \
+      -e 's|/bin/mkdir|${coreutils}/bin/mkdir|g' \
+      -e 's|/bin/cp|${coreutils}/bin/cp|g' \
+      -e 's|/usr/bin/file|${file}/bin/file|g'
+
+    patch -p1 -d swift -i ${./patches/swift-wrap.patch}
+    patch -p1 -d swift -i ${./patches/swift-nix-resource-root.patch}
+    patch -p1 -d swift -i ${./patches/swift-linux-fix-linking.patch}
+    patch -p1 -d swift -i ${./patches/swift-darwin-fix-bootstrap.patch}
+    patch -p1 -d swift -i ${substituteAll {
+      src = ./patches/swift-darwin-plistbuddy-workaround.patch;
+      inherit swiftArch;
+    }}
+    patch -p1 -d swift -i ${substituteAll {
+      src = ./patches/swift-prevent-sdk-dirs-warning.patch;
+      inherit (builtins) storeDir;
+    }}
+    substituteInPlace swift/cmake/modules/SwiftConfigureSDK.cmake \
+      --replace '/usr/include' "${stdenv.cc.libc_dev}/include"
+
+    # This patch needs to know the lib output location, so must be substituted
+    # in the same derivation as the compiler.
+    storeDir="${builtins.storeDir}" \
+      substituteAll ${./patches/swift-separate-lib.patch} $TMPDIR/swift-separate-lib.patch
+    patch -p1 -d swift -i $TMPDIR/swift-separate-lib.patch
+
+    patch -p1 -d llvm-project/llvm -i ${./patches/llvm-module-cache.patch}
+
+    patch -p1 -d llvm-project/clang -i ${./patches/clang-toolchain-dir.patch}
+    patch -p1 -d llvm-project/clang -i ${./patches/clang-wrap.patch}
+    patch -p1 -d llvm-project/clang -i ${../../llvm/14/clang/purity.patch}
+    patch -p2 -d llvm-project/clang -i ${fetchpatch {
+      name = "clang-cmake-fix-interpreter.patch";
+      url = "https://github.com/llvm/llvm-project/commit/b5eaf500f2441eff2277ea2973878fb1f171fd0a.patch";
+      sha256 = "1rma1al0rbm3s3ql6bnvbcighp74lri1lcrwbyacgdqp80fgw1b6";
+    }}
+
+    ${lib.optionalString stdenv.isLinux ''
+    substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
+      --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
+      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "' \
+      --replace 'LibDir = "lib";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = "lib64";' 'LibDir = "${glibc}/lib";' \
+      --replace 'LibDir = X32 ? "libx32" : "lib64";' 'LibDir = "${glibc}/lib";'
+
+    # uuid.h is not part of glibc, but of libuuid.
+    sed -i 's|''${GLIBC_INCLUDE_PATH}/uuid/uuid.h|${libuuid.dev}/include/uuid/uuid.h|' \
+      swift/stdlib/public/Platform/glibc.modulemap.gyb
+    ''}
+
+    # Remove tests for cross compilation, which we don't currently support.
+    rm swift/test/Interop/Cxx/class/constructors-copy-irgen.swift
+    rm swift/test/Interop/Cxx/class/constructors-irgen.swift
+
+    # TODO: consider fixing and re-adding. This test fails due to a non-standard "install_prefix".
+    rm swift/validation-test/Python/build_swift.swift
+
+    # We cannot handle the SDK location being in "Weird Location" due to Nix isolation.
+    rm swift/test/DebugInfo/compiler-flags.swift
+
+    # TODO: Fix issue with ld.gold invoked from script finding crtbeginS.o and crtendS.o.
+    rm swift/test/IRGen/ELF-remove-autolink-section.swift
+
+    # The following two tests fail because we use don't use the bundled libicu:
+    # [SOURCE_DIR/utils/build-script] ERROR: can't find source directory for libicu (tried /build/src/icu)
+    rm swift/validation-test/BuildSystem/default_build_still_performs_epilogue_opts_after_split.test
+    rm swift/validation-test/BuildSystem/test_early_swift_driver_and_infer.swift
+
+    # TODO: This test fails for some unknown reason
+    rm swift/test/Serialization/restrict-swiftmodule-to-revision.swift
+
+    # This test was flaky in ofborg, see #186476
+    rm swift/test/AutoDiff/compiler_crashers_fixed/sr14290-missing-debug-scopes-in-pullback-trampoline.swift
+
+    patchShebangs .
+
+    ${lib.optionalString (!stdenv.isDarwin) ''
+    # NOTE: This interferes with ABI stability on Darwin, which uses the system
+    # libraries in the hardcoded path /usr/lib/swift.
+    fixCmakeFiles .
+    ''}
+  '';
+
+  configurePhase = ''
+    export SWIFT_SOURCE_ROOT="$PWD"
+    mkdir -p ../build
+    cd ../build
+    export SWIFT_BUILD_ROOT="$PWD"
+
+    # Most builds set a target, but LLDB doesn't. Harmless on non-Darwin.
+    export MACOSX_DEPLOYMENT_TARGET=10.15
+  '';
+
+  # These steps are derived from doing a normal build with.
+  #
+  #   ./swift/utils/build-toolchain test --dry-run
+  #
+  # But dealing with the custom Python build system is far more trouble than
+  # simply invoking CMake directly. Few variables it passes to CMake are
+  # actually required or non-default.
+  #
+  # Using CMake directly also allows us to split up the already large build,
+  # and package Swift components separately.
+  #
+  # Besides `--dry-run`, another good way to compare build changes between
+  # Swift releases is to diff the scripts:
+  #
+  #   git diff swift-5.6.3-RELEASE..swift-5.7-RELEASE -- utils/build*
+  #
+  buildPhase = ''
+    # Helper to build a subdirectory.
+    #
+    # Always reset cmakeFlags before calling this. The cmakeConfigurePhase
+    # amends flags and would otherwise keep expanding it.
+    function buildProject() {
+      mkdir -p $SWIFT_BUILD_ROOT/$1
+      cd $SWIFT_BUILD_ROOT/$1
+
+      cmakeDir=$SWIFT_SOURCE_ROOT/''${2-$1}
+      cmakeConfigurePhase
+
+      ninjaBuildPhase
+    }
+
+    cmakeFlags="-GNinja"
+    buildProject swift-cmark
+
+    # Some notes:
+    # - The Swift build just needs Clang.
+    # - We can further reduce targets to just our targetPlatform.
+    cmakeFlags="
+      -GNinja
+      -DLLVM_ENABLE_PROJECTS=clang
+      -DLLVM_TARGETS_TO_BUILD=${{
+        "x86_64" = "X86";
+        "aarch64" = "AArch64";
+      }.${targetPlatform.parsed.cpu.name}}
+    "
+    buildProject llvm llvm-project/llvm
+
+    # Some notes:
+    # - Building with libswift defaults to OFF in CMake, but is enabled in
+    #   standard builds, so we enable it as well.
+    # - Experimental features are OFF by default in CMake, but some are
+    #   required to build the stdlib.
+    # - SWIFT_STDLIB_ENABLE_OBJC_INTEROP is set explicitely because its check
+    #   is buggy. (Uses SWIFT_HOST_VARIANT_SDK before initialized.)
+    #   Fixed in: https://github.com/apple/swift/commit/84083afef1de5931904d5c815d53856cdb3fb232
+    cmakeFlags="
+      -GNinja
+      -DBOOTSTRAPPING_MODE=BOOTSTRAPPING
+      -DSWIFT_ENABLE_EXPERIMENTAL_CONCURRENCY=ON
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+      -DClang_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/clang
+      -DSWIFT_PATH_TO_CMARK_SOURCE=$SWIFT_SOURCE_ROOT/swift-cmark
+      -DSWIFT_PATH_TO_CMARK_BUILD=$SWIFT_BUILD_ROOT/swift-cmark
+      -DSWIFT_PATH_TO_LIBDISPATCH_SOURCE=$SWIFT_SOURCE_ROOT/swift-corelibs-libdispatch
+      -DEXPERIMENTAL_STRING_PROCESSING_SOURCE_DIR=$SWIFT_SOURCE_ROOT/swift-experimental-string-processing
+      -DSWIFT_INSTALL_COMPONENTS=${lib.concatStringsSep ";" swiftInstallComponents}
+      -DSWIFT_STDLIB_ENABLE_OBJC_INTEROP=${if stdenv.isDarwin then "ON" else "OFF"}
+    "
+    buildProject swift
+
+    # These are based on flags in `utils/build-script-impl`.
+    #
+    # LLDB_USE_SYSTEM_DEBUGSERVER=ON disables the debugserver build on Darwin,
+    # which requires a special signature.
+    #
+    # CMAKE_BUILD_WITH_INSTALL_NAME_DIR ensures we don't use rpath on Darwin.
+    #
+    # NOTE: On Darwin, we only want ncurses in the linker search path, because
+    # headers are part of libsystem. Adding its headers to the search path
+    # causes strange mixing and errors. Note that libedit propagates ncurses,
+    # so we add both manually here, instead of relying on setup hooks.
+    # TODO: Find a better way to prevent this conflict.
+    cmakeFlags="
+      -GNinja
+      -DLLDB_SWIFTC=$SWIFT_BUILD_ROOT/swift/bin/swiftc
+      -DLLDB_SWIFT_LIBS=$SWIFT_BUILD_ROOT/swift/lib/swift
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+      -DClang_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/clang
+      -DSwift_DIR=$SWIFT_BUILD_ROOT/swift/lib/cmake/swift
+      -DLLDB_ENABLE_CURSES=ON
+      -DLLDB_ENABLE_LIBEDIT=ON
+      -DLLDB_ENABLE_PYTHON=ON
+      -DLLDB_ENABLE_LZMA=OFF
+      -DLLDB_ENABLE_LUA=OFF
+      -DLLDB_INCLUDE_TESTS=OFF
+      -DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON
+      ${lib.optionalString stdenv.isDarwin ''
+      -DLLDB_USE_SYSTEM_DEBUGSERVER=ON
+      ''}
+      -DLibEdit_INCLUDE_DIRS=${libedit.dev}/include
+      -DLibEdit_LIBRARIES=${libedit}/lib/libedit${stdenv.hostPlatform.extensions.sharedLibrary}
+      -DCURSES_INCLUDE_DIRS=${if stdenv.isDarwin then "/var/empty" else ncurses.dev}/include
+      -DCURSES_LIBRARIES=${ncurses}/lib/libncurses${stdenv.hostPlatform.extensions.sharedLibrary}
+      -DPANEL_LIBRARIES=${ncurses}/lib/libpanel${stdenv.hostPlatform.extensions.sharedLibrary}
+    ";
+    buildProject lldb llvm-project/lldb
+
+    ${lib.optionalString stdenv.isDarwin ''
+    # Need to do a standalone build of concurrency for Darwin back deployment.
+    # Based on: utils/swift_build_support/swift_build_support/products/backdeployconcurrency.py
+    cmakeFlags="
+      -GNinja
+      -DCMAKE_Swift_COMPILER=$SWIFT_BUILD_ROOT/swift/bin/swiftc
+
+      -DTOOLCHAIN_DIR=/var/empty
+      -DSWIFT_NATIVE_LLVM_TOOLS_PATH=${stdenv.cc}/bin
+      -DSWIFT_NATIVE_CLANG_TOOLS_PATH=${stdenv.cc}/bin
+      -DSWIFT_NATIVE_SWIFT_TOOLS_PATH=$SWIFT_BUILD_ROOT/swift/bin
+
+      -DCMAKE_CROSSCOMPILING=ON
+
+      -DBUILD_SWIFT_CONCURRENCY_BACK_DEPLOYMENT_LIBRARIES=ON
+      -DSWIFT_INCLUDE_TOOLS=OFF
+      -DSWIFT_BUILD_STDLIB_EXTRA_TOOLCHAIN_CONTENT=OFF
+      -DSWIFT_BUILD_TEST_SUPPORT_MODULES=OFF
+      -DSWIFT_BUILD_STDLIB=OFF
+      -DSWIFT_BUILD_DYNAMIC_STDLIB=OFF
+      -DSWIFT_BUILD_STATIC_STDLIB=OFF
+      -DSWIFT_BUILD_REMOTE_MIRROR=OFF
+      -DSWIFT_BUILD_SDK_OVERLAY=OFF
+      -DSWIFT_BUILD_DYNAMIC_SDK_OVERLAY=OFF
+      -DSWIFT_BUILD_STATIC_SDK_OVERLAY=OFF
+      -DSWIFT_INCLUDE_TESTS=OFF
+      -DSWIFT_BUILD_PERF_TESTSUITE=OFF
+
+      -DSWIFT_HOST_VARIANT_ARCH=${swiftArch}
+      -DBUILD_STANDALONE=ON
+
+      -DSWIFT_INSTALL_COMPONENTS=back-deployment
+
+      -DSWIFT_SDKS=${{
+        "macos" = "OSX";
+        "ios" = "IOS";
+        #IOS_SIMULATOR
+        #TVOS
+        #TVOS_SIMULATOR
+        #WATCHOS
+        #WATCHOS_SIMULATOR
+      }.${targetPlatform.darwinPlatform}}
+
+      -DLLVM_DIR=$SWIFT_BUILD_ROOT/llvm/lib/cmake/llvm
+
+      -DSWIFT_DEST_ROOT=$out
+      -DSWIFT_HOST_VARIANT_SDK=OSX
+
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_OSX=10.15
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_IOS=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_MACCATALYST=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_TVOS=13.0
+      -DSWIFT_DARWIN_DEPLOYMENT_VERSION_WATCHOS=6.0
+    "
+
+    # This depends on the special Clang build specific to the Swift branch.
+    # We also need to call a specific Ninja target.
+    export CC=$SWIFT_BUILD_ROOT/llvm/bin/clang
+    export CXX=$SWIFT_BUILD_ROOT/llvm/bin/clang++
+    ninjaFlags="back-deployment"
+
+    buildProject swift-concurrency-backdeploy swift
+
+    export CC=$NIX_CC/bin/clang
+    export CXX=$NIX_CC/bin/clang++
+    unset ninjaFlags
+  ''}
+  '';
+
+  # TODO: ~50 failing tests on x86_64-linux. Other platforms not checked.
+  doCheck = false;
+  nativeCheckInputs = [ file ];
+  # TODO: consider using stress-tester and integration-test.
+  checkPhase = ''
+    cd $SWIFT_BUILD_ROOT/swift
+    checkTarget=check-swift-all
+    ninjaCheckPhase
+    unset checkTarget
+  '';
+
+  installPhase = ''
+    # Undo the clang and swift wrapping we did for the build.
+    # (This happened via patches to cmake files.)
+    cd $SWIFT_BUILD_ROOT
+    mv llvm/bin/clang-14{-unwrapped,}
+    mv swift/bin/swift-frontend{-unwrapped,}
+
+    mkdir $out $lib
+
+    # Install clang binaries only. We hide these with the wrapper, so they are
+    # for private use by Swift only.
+    cd $SWIFT_BUILD_ROOT/llvm
+    installTargets=install-clang
+    ninjaInstallPhase
+    unset installTargets
+
+    # LLDB is also a private install.
+    cd $SWIFT_BUILD_ROOT/lldb
+    ninjaInstallPhase
+
+    cd $SWIFT_BUILD_ROOT/swift
+    ninjaInstallPhase
+
+    ${lib.optionalString stdenv.isDarwin ''
+    cd $SWIFT_BUILD_ROOT/swift-concurrency-backdeploy
+    installTargets=install-back-deployment
+    ninjaInstallPhase
+    unset installTargets
+    ''}
+
+    # Separate $lib output here, because specific logic follows.
+    # Only move the dynamic run-time parts, to keep $lib small. Every Swift
+    # build will depend on it.
+    moveToOutput "lib/swift" "$lib"
+    moveToOutput "lib/libswiftDemangle.*" "$lib"
+
+    # This link is here because various tools (swiftpm) check for stdlib
+    # relative to the swift compiler. It's fine if this is for build-time
+    # stuff, but we should patch all cases were it would end up in an output.
+    ln -s $lib/lib/swift $out/lib/swift
+
+    # Swift has a separate resource root from Clang, but locates the Clang
+    # resource root via subdir or symlink. Provide a default here, but we also
+    # patch Swift to prefer NIX_CC if set.
+    ln -s ${clang}/resource-root $lib/lib/swift/clang
+
+    ${lib.optionalString stdenv.isDarwin ''
+    # Install required library for ObjC interop.
+    # TODO: Is there no source code for this available?
+    cp -r ${CLTools_Executables}/usr/lib/arc $out/lib/arc
+    ''}
+  '';
+
+  preFixup = lib.optionalString stdenv.isLinux ''
+    # This is cheesy, but helps the patchelf hook remove /build from RPATH.
+    cd $SWIFT_BUILD_ROOT/..
+    mv build buildx
+  '';
+
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    # These libraries need to use the system install name. The official SDK
+    # does the same (as opposed to using rpath). Presumably, they are part of
+    # the stable ABI. Not using the system libraries at run-time is known to
+    # cause ObjC class conflicts and segfaults.
+    declare -A systemLibs=(
+      [libswiftCore.dylib]=1
+      [libswiftDarwin.dylib]=1
+      [libswiftSwiftOnoneSupport.dylib]=1
+      [libswift_Concurrency.dylib]=1
+    )
+
+    for systemLib in "''${!systemLibs[@]}"; do
+      install_name_tool -id /usr/lib/swift/$systemLib $lib/${swiftLibSubdir}/$systemLib
+    done
+
+    for file in $out/bin/swift-frontend $lib/${swiftLibSubdir}/*.dylib; do
+      changeArgs=""
+      for dylib in $(otool -L $file | awk '{ print $1 }'); do
+        if [[ ''${systemLibs["$(basename $dylib)"]} ]]; then
+          changeArgs+=" -change $dylib /usr/lib/swift/$(basename $dylib)"
+        elif [[ "$dylib" = */bootstrapping1/* ]]; then
+          changeArgs+=" -change $dylib $lib/lib/swift/$(basename $dylib)"
+        fi
+      done
+      if [[ -n "$changeArgs" ]]; then
+        install_name_tool $changeArgs $file
+      fi
+    done
+
+    wrapProgram $out/bin/swift-frontend \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+  '';
+
+  passthru = {
+    inherit
+      swiftOs swiftArch
+      swiftModuleSubdir swiftLibSubdir
+      swiftStaticModuleSubdir swiftStaticLibSubdir;
+
+    # Internal attr for the wrapper.
+    _wrapperParams = wrapperParams;
+  };
+
+  meta = {
+    description = "The Swift Programming Language";
+    homepage = "https://github.com/apple/swift";
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+    license = lib.licenses.asl20;
+    platforms = with lib.platforms; linux ++ darwin;
+    # Swift doesn't support 32-bit Linux, unknown on other platforms.
+    badPlatforms = lib.platforms.i686;
+    timeout = 86400; # 24 hours.
+  };
+}
diff --git a/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch b/pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch
index 40d7728cf788..40d7728cf788 100644
--- a/pkgs/development/compilers/swift/patches/0005-clang-toolchain-dir.patch
+++ b/pkgs/development/compilers/swift/compiler/patches/clang-toolchain-dir.patch
diff --git a/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch b/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch
new file mode 100644
index 000000000000..9c6cafed3699
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/clang-wrap.patch
@@ -0,0 +1,18 @@
+Wrap the clang produced during the build
+
+--- a/tools/driver/CMakeLists.txt
++++ b/tools/driver/CMakeLists.txt
+@@ -59,6 +59,13 @@ endif()
+ 
+ add_dependencies(clang clang-resource-headers)
+ 
++# Nix: wrap the clang build.
++add_custom_command(
++  TARGET clang POST_BUILD
++  COMMAND nix-swift-make-clang-wrapper $<TARGET_FILE:clang>
++  VERBATIM
++)
++
+ if(NOT CLANG_LINKS_TO_CREATE)
+   set(CLANG_LINKS_TO_CREATE clang++ clang-cl clang-cpp)
+ endif()
diff --git a/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch b/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch
new file mode 100644
index 000000000000..9a22d0482ea5
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/llvm-module-cache.patch
@@ -0,0 +1,30 @@
+The compiler fails if LLVM modules are enabled and it cannot write its module
+cache. This patch detects and rejects the fake, non-existant $HOME used in Nix
+builds.
+
+We could simply return false in `cache_directory`, but that completely disables
+module caching, and may unnecessarily slow down builds. Instead, let it use
+'/tmp/.cache'.
+
+--- a/lib/Support/Unix/Path.inc
++++ b/lib/Support/Unix/Path.inc
+@@ -1380,6 +1380,9 @@ bool user_config_directory(SmallVectorImpl<char> &result) {
+   if (!home_directory(result)) {
+     return false;
+   }
++  if (std::equal(result.begin(), result.end(), "/homeless-shelter")) {
++    return false;
++  }
+   append(result, ".config");
+   return true;
+ }
+@@ -1401,6 +1404,9 @@ bool cache_directory(SmallVectorImpl<char> &result) {
+   if (!home_directory(result)) {
+     return false;
+   }
++  if (std::equal(result.begin(), result.end(), "/homeless-shelter")) {
++    system_temp_directory(true/*ErasedOnReboot*/, result);
++  }
+   append(result, ".cache");
+   return true;
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-darwin-fix-bootstrap.patch b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-fix-bootstrap.patch
new file mode 100644
index 000000000000..a87b90bd8ca7
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-fix-bootstrap.patch
@@ -0,0 +1,20 @@
+This patch fixes dylib references during bootstrapping. It's possible
+`LIBSWIFT_BUILD_MODE=BOOTSTRAPPING` is not really well tested on Darwin,
+because official builds don't use it.
+
+In the near future, Swift will require an existing Swift toolchain to
+bootstrap, and we will likely have to replace this any way.
+
+--- a/stdlib/cmake/modules/AddSwiftStdlib.cmake
++++ b/stdlib/cmake/modules/AddSwiftStdlib.cmake
+@@ -1035,6 +1035,10 @@ function(add_swift_target_library_single target name)
+       set(install_name_dir "${SWIFTLIB_SINGLE_DARWIN_INSTALL_NAME_DIR}")
+     endif()
+ 
++    if(DEFINED SWIFTLIB_SINGLE_BOOTSTRAPPING)
++      set(install_name_dir "${lib_dir}/${output_sub_dir}")
++    endif()
++
+     set_target_properties("${target}"
+       PROPERTIES
+       INSTALL_NAME_DIR "${install_name_dir}")
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch
new file mode 100644
index 000000000000..a3cf4f60675c
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-plistbuddy-workaround.patch
@@ -0,0 +1,17 @@
+CMake tries to read a list field from SDKSettings.plist, but the output of
+facebook/xcbuild PlistBuddy is incompatible with Apple's.
+
+Simply set the supported architectures to the one target architecture we're
+building for.
+
+--- a/cmake/modules/SwiftConfigureSDK.cmake
++++ b/cmake/modules/SwiftConfigureSDK.cmake
+@@ -189,7 +189,7 @@ macro(configure_sdk_darwin
+   endif()
+ 
+   # Remove any architectures not supported by the SDK.
+-  remove_sdk_unsupported_archs(${name} ${xcrun_name} ${SWIFT_SDK_${prefix}_PATH} SWIFT_SDK_${prefix}_ARCHITECTURES)
++  set(SWIFT_SDK_${prefix}_ARCHITECTURES "@swiftArch@")
+ 
+   list_intersect(
+     "${SWIFT_DARWIN_MODULE_ARCHS}"            # lhs
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
new file mode 100644
index 000000000000..e09d5162a93a
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
@@ -0,0 +1,21 @@
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1475,7 +1475,17 @@ const char *ToolChain::getClangLinkerDriver(
+ 
+     // If there is a linker driver in the toolchain folder, use that instead.
+     if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {toolchainPath}))
+-      LinkerDriver = Args.MakeArgString(tool.get());
++      return Args.MakeArgString(tool.get());
++  }
++
++  // For Nix, prefer linking using the wrapped system clang, instead of using
++  // the unwrapped clang packaged with swift. The latter is unable to link, but
++  // we still want to use it for other purposes (clang importer).
++  if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
++    llvm::SmallString<128> binDir(nixCC.getValue());
++    llvm::sys::path::append(binDir, "bin");
++    if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {binDir.str()}))
++      return Args.MakeArgString(tool.get());
+   }
+ 
+   return LinkerDriver;
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch b/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
new file mode 100644
index 000000000000..a68326c580b1
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
@@ -0,0 +1,67 @@
+Swift normally looks for the Clang resource dir in a subdir/symlink of its own
+resource dir. We provide a symlink to the Swift build-time Clang as a default
+there, but we also here patch two checks to try locate it via NIX_CC.
+
+The first (ClangImporter.cpp) happens when Swift code imports C modules. The
+second (ToolChains.cpp) happens when Swift is used to link the final product.
+
+--- a/lib/ClangImporter/ClangImporter.cpp
++++ b/lib/ClangImporter/ClangImporter.cpp
+@@ -68,6 +68,7 @@
+ #include "llvm/Support/FileSystem.h"
+ #include "llvm/Support/Memory.h"
+ #include "llvm/Support/Path.h"
++#include "llvm/Support/Process.h"
+ #include "llvm/Support/YAMLParser.h"
+ #include "llvm/Support/YAMLTraits.h"
+ #include <algorithm>
+@@ -809,6 +810,17 @@ importer::addCommonInvocationArguments(
+ 
+   const std::string &overrideResourceDir = importerOpts.OverrideResourceDir;
+   if (overrideResourceDir.empty()) {
++    // Prefer the Clang resource directory from NIX_CC, to allow swapping in a
++    // different stdenv.
++    // TODO: Figure out how to provide a user override for this. Probably a
++    // niche use case, though, and for now a user can unset NIX_CC to work
++    // around it if necessary.
++    if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
++      llvm::SmallString<128> resourceDir(nixCC.getValue());
++      llvm::sys::path::append(resourceDir, "resource-root");
++      invocationArgStrs.push_back("-resource-dir");
++      invocationArgStrs.push_back(std::string(resourceDir.str()));
++    } else {
+     llvm::SmallString<128> resourceDir(searchPathOpts.RuntimeResourcePath);
+ 
+     // Adjust the path to refer to our copy of the Clang resource directory
+@@ -824,6 +836,7 @@ importer::addCommonInvocationArguments(
+     // Set the Clang resource directory to the path we computed.
+     invocationArgStrs.push_back("-resource-dir");
+     invocationArgStrs.push_back(std::string(resourceDir.str()));
++    } // nixCC
+   } else {
+     invocationArgStrs.push_back("-resource-dir");
+     invocationArgStrs.push_back(overrideResourceDir);
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1372,10 +1372,20 @@ void ToolChain::getClangLibraryPath(const ArgList &Args,
+                                     SmallString<128> &LibPath) const {
+   const llvm::Triple &T = getTriple();
+ 
++  // Nix: We provide a `clang` symlink in the default Swift resource root, but
++  // prefer detecting the Clang resource root via NIX_CC, to allow swapping in
++  // a different stdenv. However, always honor a user-provided `-resource-dir`.
++  auto nixCC = llvm::sys::Process::GetEnv("NIX_CC");
++  if (nixCC && !Args.hasArgNoClaim(options::OPT_resource_dir)) {
++    LibPath.assign(nixCC.getValue());
++    llvm::sys::path::append(LibPath, "resource-root");
++  } else {
+   getResourceDirPath(LibPath, Args, /*Shared=*/true);
+   // Remove platform name.
+   llvm::sys::path::remove_filename(LibPath);
+-  llvm::sys::path::append(LibPath, "clang", "lib",
++  llvm::sys::path::append(LibPath, "clang");
++  } // nixCC
++  llvm::sys::path::append(LibPath, "lib",
+                           T.isOSDarwin() ? "darwin"
+                                          : getPlatformNameForTriple(T));
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch b/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch
new file mode 100644
index 000000000000..987b99d74539
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-prevent-sdk-dirs-warning.patch
@@ -0,0 +1,39 @@
+Prevents a user-visible warning on every compilation:
+
+  ld: warning: directory not found for option '-L.../MacOSX11.0.sdk/usr/lib/swift'
+
+--- a/lib/Driver/ToolChains.cpp
++++ b/lib/Driver/ToolChains.cpp
+@@ -1455,9 +1455,11 @@ void ToolChain::getRuntimeLibraryPaths(SmallVectorImpl<std::string> &runtimeLibP
+       runtimeLibPaths.push_back(std::string(scratchPath.str()));
+     }
+ 
++    if (!SDKPath.startswith("@storeDir@")) {
+     scratchPath = SDKPath;
+     llvm::sys::path::append(scratchPath, "usr", "lib", "swift");
+     runtimeLibPaths.push_back(std::string(scratchPath.str()));
++    }
+   }
+ }
+ 
+--- a/lib/Frontend/CompilerInvocation.cpp
++++ b/lib/Frontend/CompilerInvocation.cpp
+@@ -185,7 +185,9 @@ static void updateRuntimeLibraryPaths(SearchPathOptions &SearchPathOpts,
+       RuntimeLibraryImportPaths.push_back(std::string(LibPath.str()));
+     }
+ 
+-    LibPath = SearchPathOpts.getSDKPath();
++    auto SDKPath = SearchPathOpts.getSDKPath();
++    if (!SDKPath.startswith("@storeDir@")) {
++    LibPath = SDKPath;
+     llvm::sys::path::append(LibPath, "usr", "lib", "swift");
+     if (!Triple.isOSDarwin()) {
+       // Use the non-architecture suffixed form with directory-layout
+@@ -200,6 +202,7 @@ static void updateRuntimeLibraryPaths(SearchPathOptions &SearchPathOpts,
+       llvm::sys::path::append(LibPath, swift::getMajorArchitectureName(Triple));
+     }
+     RuntimeLibraryImportPaths.push_back(std::string(LibPath.str()));
++    }
+   }
+   SearchPathOpts.setRuntimeLibraryImportPaths(RuntimeLibraryImportPaths);
+ }
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch b/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch
new file mode 100644
index 000000000000..20d81a6e8296
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-separate-lib.patch
@@ -0,0 +1,26 @@
+Patch paths to use the separate 'lib' output. One of the things this patch
+fixes is the output of `swift -frontend -print-target-info`, which swiftpm uses
+to set rpath on Linux.
+
+The check if the executable path starts with 'out' is necessary for
+bootstrapping, or the compiler will fail when run from the build directory.
+
+--- a/lib/Frontend/CompilerInvocation.cpp
++++ b/lib/Frontend/CompilerInvocation.cpp
+@@ -49,11 +49,16 @@ swift::CompilerInvocation::CompilerInvocation() {
+ void CompilerInvocation::computeRuntimeResourcePathFromExecutablePath(
+     StringRef mainExecutablePath, bool shared,
+     llvm::SmallVectorImpl<char> &runtimeResourcePath) {
++  if (mainExecutablePath.startswith("@storeDir@")) {
++    auto libPath = StringRef("@lib@");
++    runtimeResourcePath.append(libPath.begin(), libPath.end());
++  } else {
+   runtimeResourcePath.append(mainExecutablePath.begin(),
+                              mainExecutablePath.end());
+ 
+   llvm::sys::path::remove_filename(runtimeResourcePath); // Remove /swift
+   llvm::sys::path::remove_filename(runtimeResourcePath); // Remove /bin
++  }
+   appendSwiftLibDir(runtimeResourcePath, shared);
+ }
+ 
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch b/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch
new file mode 100644
index 000000000000..e4697f631e70
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-wrap.patch
@@ -0,0 +1,46 @@
+Wrap the swift compiler produced during the build
+
+--- a/tools/driver/CMakeLists.txt
++++ b/tools/driver/CMakeLists.txt
+@@ -16,6 +16,13 @@ if(${LIBSWIFT_BUILD_MODE} MATCHES "BOOTSTRAPPING.*")
+                           swiftDriverTool
+                           libswiftStub)
+ 
++  # Nix: wrap the swift build.
++  add_custom_command(
++    TARGET swift-frontend-bootstrapping0 POST_BUILD
++    COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend-bootstrapping0>
++    VERBATIM
++  )
++
+   swift_create_post_build_symlink(swift-frontend-bootstrapping0
+     SOURCE "swift-frontend${CMAKE_EXECUTABLE_SUFFIX}"
+     DESTINATION "swiftc${CMAKE_EXECUTABLE_SUFFIX}"
+@@ -34,6 +41,13 @@ if(${LIBSWIFT_BUILD_MODE} MATCHES "BOOTSTRAPPING.*")
+                           swiftDriverTool
+                           libswift-bootstrapping1)
+ 
++  # Nix: wrap the swift build.
++  add_custom_command(
++    TARGET swift-frontend-bootstrapping1 POST_BUILD
++    COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend-bootstrapping1>
++    VERBATIM
++  )
++
+   swift_create_post_build_symlink(swift-frontend-bootstrapping1
+     SOURCE "swift-frontend${CMAKE_EXECUTABLE_SUFFIX}"
+     DESTINATION "swiftc${CMAKE_EXECUTABLE_SUFFIX}"
+@@ -50,6 +64,13 @@ target_link_libraries(swift-frontend
+                         swiftDriverTool
+                         libswift)
+ 
++# Nix: wrap the swift build.
++add_custom_command(
++  TARGET swift-frontend POST_BUILD
++  COMMAND nix-swift-make-swift-wrapper $<TARGET_FILE:swift-frontend>
++  VERBATIM
++)
++
+ # Create a `swift-driver` executable adjacent to the `swift-frontend` executable
+ # to ensure that `swiftc` forwards to the standalone driver when invoked.
+ swift_create_early_driver_copies(swift-frontend)
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index 50bc73582f1b..a51fa2805b76 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -1,475 +1,101 @@
-{ lib, stdenv
-, cmake
-, coreutils
-, glibc
-, gccForLibs
-, which
-, perl
-, libedit
-, ninja
-, pkg-config
-, sqlite
-, libxml2
-, clang_13
-, python3
-, ncurses
-, libuuid
-, libxcrypt
-, icu
-, libgcc
-, libblocksruntime
-, curl
-, rsync
-, git
-, libgit2
-, fetchFromGitHub
-, makeWrapper
-, gnumake
-, file
+{ lib
+, pkgs
+, newScope
+, darwin
+, llvmPackages_latest
+, overrideCC
 }:
 
 let
-  # The Swift toolchain script builds projects with separate repos. By convention, some of them share
-  # the same version with the main Swift compiler project per release. We fetch these with
-  # `fetchSwiftRelease`. The rest have their own versions locked to each Swift release, as defined in the
-  # Swift compiler repo:
-  #   utils/update_checkout/update_checkout-config.json.
-  #
-  # ... among projects listed in that file, we provide our own:
-  # - CMake
-  # - ninja
-  # - icu
-  #
-  # ... we'd like to include the following in the future:
-  # - stress-tester
-  # - integration-tests
+  self = rec {
 
-  versions = {
-    swift = "5.6.2";
-    yams = "4.0.2";
-    argumentParser = "1.0.3";
-    format = "release/5.6";
-    crypto = "1.1.5";
-    nio = "2.31.2";
-    nio-ssl = "2.15.0";
-  };
+    callPackage = newScope self;
 
-  fetchAppleRepo = { repo, rev, sha256 }:
-    fetchFromGitHub {
-      owner = "apple";
-      inherit repo rev sha256;
-      name = "${repo}-${rev}-src";
-    };
+    # Current versions of Swift on Darwin require macOS SDK 10.15 at least.
+    # Re-export this so we can rely on the minimum Swift SDK elsewhere.
+    apple_sdk = pkgs.darwin.apple_sdk_11_0;
 
-  fetchSwiftRelease = { repo, sha256, fetchSubmodules ? false }:
-    fetchFromGitHub {
-      owner = "apple";
-      inherit repo sha256 fetchSubmodules;
-      rev = "swift-${versions.swift}-RELEASE";
-      name = "${repo}-${versions.swift}-src";
-    };
+    # Our current Clang on Darwin is v11, but we need at least v12. The
+    # following applies the newer Clang with the same libc overrides as
+    # `apple_sdk.stdenv`.
+    #
+    # If 'latest' becomes an issue, recommend replacing it with v14, which is
+    # currently closest to the official Swift builds.
+    clang = if pkgs.stdenv.isDarwin
+      then
+        llvmPackages_latest.clang.override rec {
+          libc = apple_sdk.Libsystem;
+          bintools = pkgs.bintools.override { inherit libc; };
+        }
+      else
+        llvmPackages_latest.clang;
 
-  sources = {
-    # Projects that share `versions.swift` for each release.
-
-    swift = fetchSwiftRelease {
-      repo = "swift";
-      sha256 = "sha256-wiRXAXWEksJuy+YQQ+B7tzr2iLkSVkgV6o+wIz7yKJA=";
-    };
-    cmark = fetchSwiftRelease {
-      repo = "swift-cmark";
-      sha256 = "sha256-f0BoTs4HYdx/aJ9HIGCWMalhl8PvClWD6R4QK3qSgAw=";
-    };
-    llbuild = fetchSwiftRelease {
-      repo = "swift-llbuild";
-      sha256 = "sha256-SQ6V0zVshIYMjayx+ZpYuLijgQ89tqRnPlXBPf2FYqM=";
-    };
-    driver = fetchSwiftRelease {
-      repo = "swift-driver";
-      sha256 = "sha256-D5/C4Rbv5KIsKpy6YbuMxGIGaQkn80PD4Cp0l6bPKzY=";
-    };
-    toolsSupportCore = fetchSwiftRelease {
-      repo = "swift-tools-support-core";
-      sha256 = "sha256-FbtQCq1sSlzrskCrgzD4iYuo5eGaXrAUUxoNX/BiOfg=";
-    };
-    swiftpm = fetchSwiftRelease {
-      repo = "swift-package-manager";
-      sha256 = "sha256-esO4Swz3UYngbVgxoV+fkhSC0AU3IaxVjWkgK/s3x68=";
-    };
-    syntax = fetchSwiftRelease {
-      repo = "swift-syntax";
-      sha256 = "sha256-C9FPCtq49BvKXtTWWeReYWNrU70pHzT2DhAv3NiTbPU=";
-    };
-    corelibsXctest = fetchSwiftRelease {
-      repo = "swift-corelibs-xctest";
-      sha256 = "sha256-0hizfnKJaUUA+jXuXzXWk72FmlSyc+UGEf7BTLdJrx4=";
-    };
-    corelibsFoundation = fetchSwiftRelease {
-      repo = "swift-corelibs-foundation";
-      sha256 = "sha256-8sCL8Ia6yb6bRsJZ52gUJH0jN3lwClM573G8jgUdEhw=";
-    };
-    corelibsLibdispatch = fetchSwiftRelease {
-      repo = "swift-corelibs-libdispatch";
-      sha256 = "sha256-1tIskUMnfblnvZaFDQPUMBfWTmBYG98s7rEww7PwZO8=";
-      fetchSubmodules = true;
-    };
-    indexstoreDb = fetchSwiftRelease {
-      repo = "indexstore-db";
-      sha256 = "sha256-/PO4eMiASZN3pjFjBQ1r8vYwGRn6xm3SWaB2HDZlkPs=";
-    };
-    sourcekitLsp = fetchSwiftRelease {
-      repo = "sourcekit-lsp";
-      sha256 = "sha256-ttgUC4ZHD3P/xLHllEbACtHVrJ6HXqeVWccXcoPMkts=";
-    };
-    llvmProject = fetchSwiftRelease {
-      repo = "llvm-project";
-      sha256 = "sha256-YVs3lKV2RlaovpYkdGO+vzypolrmXmbKBBP4+osNMYw=";
-    };
-    docc = fetchSwiftRelease {
-      repo = "swift-docc";
-      sha256 = "sha256-rWiaNamZoHTO1bKpubxuT7m1IBOl7amT5M71mNauilY=";
-    };
-    docc-render-artifact = fetchSwiftRelease {
-      repo = "swift-docc-render-artifact";
-      sha256 = "sha256-AX+rtDLhq8drk7N6/hoH3fQioudmmTCnEhR45bME8uU=";
-    };
-    docc-symbolkit = fetchSwiftRelease {
-      repo = "swift-docc-symbolkit";
-      sha256 = "sha256-Xy1TQ5ucDW+MnkeOvVznsATBmwcQ3p1x+ofQ22ofk+o=";
-    };
-    lmdb = fetchSwiftRelease {
-      repo = "swift-lmdb";
-      sha256 = "sha256-i2GkWRWq1W5j8rF4PiHwWgT4Dur5FCY2o44HvUU3vtQ=";
-    };
-    markdown = fetchSwiftRelease {
-      repo = "swift-markdown";
-      sha256 = "sha256-XtFSBiNHhmULjS4OqSpMgUetLu3peRg7l6HpjwVsTj8=";
+    # Overrides that create a useful environment for swift packages, allowing
+    # packaging with `swiftPackages.callPackage`. These are similar to
+    # `apple_sdk_11_0.callPackage`, with our clang on top.
+    inherit (clang) bintools;
+    stdenv = overrideCC pkgs.stdenv clang;
+    darwin = pkgs.darwin.overrideScope (_: prev: {
+      inherit apple_sdk;
+      inherit (apple_sdk) Libsystem LibsystemCross libcharset libunwind objc4 configd IOKit Security;
+      CF = apple_sdk.CoreFoundation;
+    });
+    xcodebuild = pkgs.xcbuild.override {
+      inherit (apple_sdk.frameworks) CoreServices CoreGraphics ImageIO;
+      inherit stdenv;
+      sdkVer = "10.15";
     };
+    xcbuild = xcodebuild;
 
-    cmark-gfm = fetchAppleRepo {
-      repo = "swift-cmark";
-      rev = "swift-${versions.swift}-RELEASE-gfm";
-      sha256 = "sha256-g28iKmMR2W0r1urf8Fk1HBxAp5OlonNYSVN3Ril66tQ=";
+    swift-unwrapped = callPackage ./compiler {
+      inherit (darwin) DarwinTools cctools sigtool;
+      inherit (apple_sdk) CLTools_Executables;
+      inherit (apple_sdk.frameworks) CoreServices Foundation Combine;
     };
 
-    # Projects that have their own versions during each release
-
-    argumentParser = fetchAppleRepo {
-      repo = "swift-argument-parser";
-      rev = "${versions.argumentParser}";
-      sha256 = "sha256-vNqkuAwSZNCWvwe6E5BqbXQdIbmIia0dENmmSQ9P8Mo=";
-    };
-    format = fetchAppleRepo {
-      repo = "swift-format";
-      rev = "${versions.format}";
-      sha256 = "sha256-1f5sIrv9IbPB7Vnahq1VwH8gT41dcjWldRwvVEaMdto=";
-    };
-    crypto = fetchAppleRepo {
-      repo = "swift-crypto";
-      rev = "${versions.crypto}";
-      sha256 = "sha256-jwxXQuOF+CnpLMwTZ2z52Fgx2b97yWzXiPTx0Ye8KCQ=";
+    swiftNoSwiftDriver = callPackage ./wrapper {
+      swift = swift-unwrapped;
+      useSwiftDriver = false;
     };
-    nio = fetchAppleRepo {
-      repo = "swift-nio";
-      rev = versions.nio;
-      sha256 = "sha256-FscOA/S7on31QCR/MZFjg4ZB3FGJ+rdptZ6MRZJXexE=";
-    };
-    nio-ssl = fetchAppleRepo {
-      repo = "swift-nio-ssl";
-      rev = versions.nio-ssl;
-      sha256 = "sha256-5QGkmkCOXhG3uOdf0bd3Fo1MFekB8/WcveBXGhtVZKo=";
-    };
-    yams = fetchFromGitHub {
-      owner = "jpsim";
-      repo = "Yams";
-      rev = versions.yams;
-      sha256 = "sha256-cTkCAwxxLc35laOon1ZXXV8eAxX02oDolJyPauhZado=";
-      name = "Yams-${versions.yams}-src";
-    };
-  };
-
-  devInputs = [
-    curl
-    glibc
-    icu
-    libblocksruntime
-    libedit
-    libgcc
-    libuuid
-    libxcrypt
-    libxml2
-    ncurses
-    sqlite
-  ];
-
-  python = (python3.withPackages (ps: [ps.six]));
-
-  cmakeFlags = [
-    "-DGLIBC_INCLUDE_PATH=${stdenv.cc.libc.dev}/include"
-    "-DC_INCLUDE_DIRS=${lib.makeSearchPathOutput "dev" "include" devInputs}:${libxml2.dev}/include/libxml2"
-    "-DGCC_INSTALL_PREFIX=${gccForLibs}"
-  ];
-
-in
-stdenv.mkDerivation {
-  pname = "swift";
-  version = versions.swift;
-
-  nativeBuildInputs = [
-    cmake
-    git
-    makeWrapper
-    ninja
-    perl
-    pkg-config
-    python
-    rsync
-    which
-  ];
-  buildInputs = devInputs ++ [
-    clang_13
-  ];
-
-  # TODO: Revisit what needs to be propagated and how.
-  propagatedBuildInputs = [
-    libgcc
-    libgit2
-    python
-  ];
-  propagatedUserEnvPkgs = [ git pkg-config ];
-
-  hardeningDisable = [ "format" ]; # for LLDB
-
-  unpackPhase = ''
-    mkdir src
-    cd src
-    export SWIFT_SOURCE_ROOT=$PWD
-
-    cp -r ${sources.swift} swift
-    cp -r ${sources.cmark} cmark
-    cp -r ${sources.llbuild} llbuild
-    cp -r ${sources.argumentParser} swift-argument-parser
-    cp -r ${sources.driver} swift-driver
-    cp -r ${sources.toolsSupportCore} swift-tools-support-core
-    cp -r ${sources.swiftpm} swiftpm
-    cp -r ${sources.syntax} swift-syntax
-    cp -r ${sources.corelibsXctest} swift-corelibs-xctest
-    cp -r ${sources.corelibsFoundation} swift-corelibs-foundation
-    cp -r ${sources.corelibsLibdispatch} swift-corelibs-libdispatch
-    cp -r ${sources.yams} yams
-    cp -r ${sources.indexstoreDb} indexstore-db
-    cp -r ${sources.sourcekitLsp} sourcekit-lsp
-    cp -r ${sources.format} swift-format
-    cp -r ${sources.crypto} swift-crypto
-    cp -r ${sources.llvmProject} llvm-project
-    cp -r ${sources.cmark-gfm} swift-cmark-gfm
-    cp -r ${sources.docc} swift-docc
-    cp -r ${sources.docc-render-artifact} swift-docc-render-artifact
-    cp -r ${sources.docc-symbolkit} swift-docc-symbolkit
-    cp -r ${sources.lmdb} swift-lmdb
-    cp -r ${sources.markdown} swift-markdown
-    cp -r ${sources.nio} swift-nio
-    cp -r ${sources.nio-ssl} swift-nio-ssl
 
-    chmod -R u+w .
-  '';
+    Dispatch = if stdenv.isDarwin
+      then null # part of libsystem
+      else callPackage ./libdispatch { swift = swiftNoSwiftDriver; };
 
-  patchPhase = ''
-    # Just patch all the things for now, we can focus this later.
-    patchShebangs $SWIFT_SOURCE_ROOT
+    Foundation = if stdenv.isDarwin
+      then apple_sdk.frameworks.Foundation
+      else callPackage ./foundation { swift = swiftNoSwiftDriver; };
 
-    # TODO: eliminate use of env.
-    find -type f -print0 | xargs -0 sed -i \
-      -e 's|/usr/bin/env|${coreutils}/bin/env|g' \
-      -e 's|/usr/bin/make|${gnumake}/bin/make|g' \
-      -e 's|/bin/mkdir|${coreutils}/bin/mkdir|g' \
-      -e 's|/bin/cp|${coreutils}/bin/cp|g' \
-      -e 's|/usr/bin/file|${file}/bin/file|g'
-
-    # Build configuration patches.
-    patch -p1 -d swift -i ${./patches/0001-build-presets-linux-don-t-require-using-Ninja.patch}
-    patch -p1 -d swift -i ${./patches/0002-build-presets-linux-allow-custom-install-prefix.patch}
-    patch -p1 -d swift -i ${./patches/0003-build-presets-linux-don-t-build-extra-libs.patch}
-    patch -p1 -d swift -i ${./patches/0004-build-presets-linux-plumb-extra-cmake-options.patch}
-    patch -p1 -d swift -i ${./patches/0007-build-presets-linux-os-stdlib.patch}
-    substituteInPlace swift/cmake/modules/SwiftConfigureSDK.cmake \
-      --replace '/usr/include' "${stdenv.cc.libc.dev}/include"
-    sed -i swift/utils/build-presets.ini \
-      -e 's/^test-installable-package$/# \0/' \
-      -e 's/^test$/# \0/' \
-      -e 's/^validation-test$/# \0/' \
-      -e 's/^long-test$/# \0/' \
-      -e 's/^stress-test$/# \0/' \
-      -e 's/^test-optimized$/# \0/' \
-      -e 's/^swift-install-components=autolink.*$/\0;editor-integration/'
-
-    # LLVM toolchain patches.
-    patch -p1 -d llvm-project/clang -i ${./patches/0005-clang-toolchain-dir.patch}
-    patch -p1 -d llvm-project/clang -i ${./patches/0006-clang-purity.patch}
-    substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
-      --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
-      --replace 'SysRoot + "/usr/lib' '"${glibc}/lib" "' \
-      --replace 'LibDir = "lib";' 'LibDir = "${glibc}/lib";' \
-      --replace 'LibDir = "lib64";' 'LibDir = "${glibc}/lib";' \
-      --replace 'LibDir = X32 ? "libx32" : "lib64";' 'LibDir = "${glibc}/lib";'
-
-    # Substitute ncurses for curses in llbuild.
-    sed -i 's/curses/ncurses/' llbuild/*/*/CMakeLists.txt
-    sed -i 's/curses/ncurses/' llbuild/*/*/*/CMakeLists.txt
-
-    # uuid.h is not part of glibc, but of libuuid.
-    sed -i 's|''${GLIBC_INCLUDE_PATH}/uuid/uuid.h|${libuuid.dev}/include/uuid/uuid.h|' swift/stdlib/public/Platform/glibc.modulemap.gyb
-
-    # Support library build script patches.
-    PREFIX=''${out/#\/}
-    substituteInPlace swift/utils/swift_build_support/swift_build_support/products/benchmarks.py \
-      --replace \
-      "'--toolchain', toolchain_path," \
-      "'--toolchain', '/build/install/$PREFIX',"
-    substituteInPlace swift/benchmark/scripts/build_script_helper.py \
-      --replace \
-      "swiftbuild_path = os.path.join(args.toolchain, \"usr\", \"bin\", \"swift-build\")" \
-      "swiftbuild_path = os.path.join(args.toolchain, \"bin\", \"swift-build\")"
-    substituteInPlace swift-corelibs-xctest/build_script.py \
-      --replace usr "$PREFIX"
-
-    # Can be removed in later swift-docc versions, see
-    # https://github.com/apple/swift-docc/commit/bff70b847008f91ac729cfd299a85481eef3f581
-    substituteInPlace swift-docc/build-script-helper.py \
-      --replace \
-      "subprocess.check_output(cmd, env=env).strip(), 'docc')" \
-      "subprocess.check_output(cmd, env=env).strip().decode(), 'docc')"
-
-    # Can be removed in later Swift versions, see
-    # https://github.com/apple/swift/pull/58755
-    substituteInPlace swift/utils/process-stats-dir.py \
-      --replace \
-      "type=argparse.FileType('wb', 0)," \
-      "type=argparse.FileType('w', 0),"
-
-    # Apply Python 3 fix, see
-    # https://github.com/apple/swift/commit/ec6bc595092974628b27b114a472e84162261bbd
-    substituteInPlace swift/utils/swift_build_support/swift_build_support/productpipeline_list_builder.py \
-      --replace \
-      "filter(lambda x: x is not None, pipeline)" \
-      "[p for p in pipeline if p is not None]"
-  '';
-
-  configurePhase = ''
-    cd ..
-
-    mkdir build install
-    export SWIFT_BUILD_ROOT=$PWD/build
-    export SWIFT_INSTALL_DIR=$PWD/install
-
-    export INSTALLABLE_PACKAGE=$PWD/swift.tar.gz
-    export NIX_ENFORCE_PURITY=
-
-    cd $SWIFT_BUILD_ROOT
-  '';
-
-  buildPhase = ''
-    # Explicitly include C++ headers to prevent errors where stdlib.h is not found from cstdlib.
-    export NIX_CFLAGS_COMPILE="$(< ${clang_13}/nix-support/libcxx-cxxflags) $NIX_CFLAGS_COMPILE"
-
-    # During the Swift build, a full local LLVM build is performed and the resulting clang is
-    # invoked. This compiler is not using the Nix wrappers, so it needs some help to find things.
-    export NIX_LDFLAGS_BEFORE="-rpath ${gccForLibs.lib}/lib -L${gccForLibs.lib}/lib $NIX_LDFLAGS_BEFORE"
-
-    # However, we want to use the wrapped compiler whenever possible.
-    export CC="${clang_13}/bin/clang"
-
-    $SWIFT_SOURCE_ROOT/swift/utils/build-script \
-      --preset=buildbot_linux \
-      installable_package=$INSTALLABLE_PACKAGE \
-      install_prefix=$out \
-      install_destdir=$SWIFT_INSTALL_DIR \
-      extra_cmake_options="${lib.concatStringsSep "," cmakeFlags}"
-  '';
-
-  doCheck = true;
-
-  nativeCheckInputs = [ file ];
-
-  checkPhase = ''
-    # Remove compiler build system tests which fail due to our modified default build profile and
-    # nixpkgs-provided version of CMake.
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_implies_install_all.test
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/infer_dumps_deps_if_verbose_build.test
-
-    # This test apparently requires Python 2 (strings are assumed to be bytes-like), but the build
-    # process overall now otherwise requires Python 3 (which is what we have updated to). A fix PR
-    # has been submitted upstream.
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/SIL/verify_all_overlays.py
-
-    # TODO: consider fixing and re-adding. This test fails due to a non-standard "install_prefix".
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/Python/build_swift.swift
-
-    # We cannot handle the SDK location being in "Weird Location" due to Nix isolation.
-    rm $SWIFT_SOURCE_ROOT/swift/test/DebugInfo/compiler-flags.swift
-
-    # TODO: Fix issue with ld.gold invoked from script finding crtbeginS.o and crtendS.o.
-    rm $SWIFT_SOURCE_ROOT/swift/test/IRGen/ELF-remove-autolink-section.swift
-
-    # The following two tests fail because we use don't use the bundled libicu:
-    # [SOURCE_DIR/utils/build-script] ERROR: can't find source directory for libicu (tried /build/src/icu)
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/default_build_still_performs_epilogue_opts_after_split.test
-    rm $SWIFT_SOURCE_ROOT/swift/validation-test/BuildSystem/test_early_swift_driver_and_infer.swift
-
-    # TODO: This test fails for some unknown reason
-    rm $SWIFT_SOURCE_ROOT/swift/test/Serialization/restrict-swiftmodule-to-revision.swift
-
-    # This test was flaky in ofborg, see #186476
-    rm $SWIFT_SOURCE_ROOT/swift/test/AutoDiff/compiler_crashers_fixed/sr14290-missing-debug-scopes-in-pullback-trampoline.swift
-
-    # TODO: consider using stress-tester and integration-test.
-
-    # Match the wrapped version of Swift to be installed.
-    export LIBRARY_PATH=${lib.makeLibraryPath [icu libgcc libuuid]}:$l
-
-    checkTarget=check-swift-all-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}
-    ninjaFlags='-C buildbot_linux/swift-${stdenv.hostPlatform.parsed.kernel.name}-${stdenv.hostPlatform.parsed.cpu.name}'
-    ninjaCheckPhase
-  '';
-
-  installPhase = ''
-    mkdir -p $out
+    # TODO: Apple distributes a binary XCTest with Xcode, but it is not part of
+    # CLTools (or SUS), so would have to figure out how to fetch it. The binary
+    # version has several extra features, like a test runner and ObjC support.
+    XCTest = callPackage ./xctest {
+      inherit (darwin) DarwinTools;
+      swift = swiftNoSwiftDriver;
+    };
 
-    # Extract the generated tarball into the store.
-    tar xf $INSTALLABLE_PACKAGE -C $out --strip-components=3 ''${out/#\/}
-    find $out -type d -empty -delete
+    swiftpm = callPackage ./swiftpm {
+      inherit (darwin) DarwinTools cctools;
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+      swift = swiftNoSwiftDriver;
+    };
 
-    # Fix installation weirdness, also present in Apple’s official tarballs.
-    mv $out/local/include/indexstore $out/include
-    rmdir $out/local/include $out/local
-    rm -r $out/bin/sdk-module-lists $out/bin/swift-api-checker.py
+    swift-driver = callPackage ./swift-driver {
+      swift = swiftNoSwiftDriver;
+    };
 
-    wrapProgram $out/bin/swift \
-      --set CC $out/bin/clang \
-      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix LIBRARY_PATH : ${lib.makeLibraryPath [icu libgcc libuuid]} \
-      --suffix PATH : ${lib.makeBinPath [ stdenv.cc.bintools ]}
+    swift = callPackage ./wrapper {
+      swift = swift-unwrapped;
+    };
 
-    wrapProgram $out/bin/swiftc \
-      --set CC $out/bin/clang \
-      --suffix C_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix CPLUS_INCLUDE_PATH : $out/lib/swift/clang/include \
-      --suffix LIBRARY_PATH : ${lib.makeLibraryPath [icu libgcc libuuid]} \
-      --suffix PATH : ${lib.makeBinPath [ stdenv.cc.bintools ]}
-  '';
+    sourcekit-lsp = callPackage ./sourcekit-lsp {
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+    };
 
-  # Hack to avoid build and install directories in RPATHs.
-  preFixup = "rm -rf $SWIFT_BUILD_ROOT $SWIFT_INSTALL_DIR";
+    swift-docc = callPackage ./swift-docc {
+      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
+    };
 
-  meta = with lib; {
-    description = "The Swift Programming Language";
-    homepage = "https://github.com/apple/swift";
-    maintainers = with maintainers; [ dtzWill trepetti dduan trundle ];
-    license = licenses.asl20;
-    # Swift doesn't support 32-bit Linux, unknown on other platforms.
-    platforms = platforms.linux;
-    badPlatforms = platforms.i686;
-    timeout = 86400; # 24 hours.
   };
-}
+
+in self
diff --git a/pkgs/development/compilers/swift/foundation/default.nix b/pkgs/development/compilers/swift/foundation/default.nix
new file mode 100644
index 000000000000..efb35bd74c9f
--- /dev/null
+++ b/pkgs/development/compilers/swift/foundation/default.nix
@@ -0,0 +1,61 @@
+# TODO: We already package the CoreFoundation component of Foundation in:
+#   pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+# This is separate because the CF build is completely different and part of
+# stdenv. Merging the two was kept outside of the scope of Swift work.
+
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, swift
+, Dispatch
+, icu
+, libxml2
+, curl
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-foundation";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-foundation;
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ cmake ninja swift ];
+  buildInputs = [ icu libxml2 curl ];
+  propagatedBuildInputs = [ Dispatch ];
+
+  preConfigure = ''
+    # Fails to build with -D_FORTIFY_SOURCE.
+    NIX_HARDENING_ENABLE=''${NIX_HARDENING_ENABLE/fortify/}
+  '';
+
+  postInstall = ''
+    # Split up the output.
+    mkdir $dev
+    mv $out/lib/swift/${swift.swiftOs} $out/swiftlibs
+    mv $out/lib/swift $dev/include
+    mkdir $out/lib/swift
+    mv $out/swiftlibs $out/lib/swift/${swift.swiftOs}
+
+    # Provide a CMake module. This is primarily used to glue together parts of
+    # the Swift toolchain. Modifying the CMake config to do this for us is
+    # otherwise more trouble.
+    mkdir -p $dev/lib/cmake/Foundation
+    export dylibExt="${stdenv.hostPlatform.extensions.sharedLibrary}"
+    export swiftOs="${swift.swiftOs}"
+    substituteAll ${./glue.cmake} $dev/lib/cmake/Foundation/FoundationConfig.cmake
+  '';
+
+  meta = {
+    description = "Core utilities, internationalization, and OS independence for Swift";
+    homepage = "https://github.com/apple/swift-corelibs-foundation";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/foundation/glue.cmake b/pkgs/development/compilers/swift/foundation/glue.cmake
new file mode 100644
index 000000000000..a34984d19f04
--- /dev/null
+++ b/pkgs/development/compilers/swift/foundation/glue.cmake
@@ -0,0 +1,8 @@
+add_library(Foundation SHARED IMPORTED)
+set_property(TARGET Foundation PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundation@dylibExt@")
+
+add_library(FoundationNetworking SHARED IMPORTED)
+set_property(TARGET FoundationNetworking PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundationNetworking@dylibExt@")
+
+add_library(FoundationXML SHARED IMPORTED)
+set_property(TARGET FoundationXML PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libFoundationXML@dylibExt@")
diff --git a/pkgs/development/compilers/swift/libdispatch/default.nix b/pkgs/development/compilers/swift/libdispatch/default.nix
new file mode 100644
index 000000000000..4a0616ded5ac
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, useSwift ? true, swift
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-libdispatch";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-libdispatch;
+
+  outputs = [ "out" "dev" "man" ];
+
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optionals useSwift [ ninja swift ];
+
+  patches = [ ./disable-swift-overlay.patch ];
+
+  cmakeFlags = lib.optional useSwift "-DENABLE_SWIFT=ON";
+
+  postInstall = ''
+    # Provide a CMake module. This is primarily used to glue together parts of
+    # the Swift toolchain. Modifying the CMake config to do this for us is
+    # otherwise more trouble.
+    mkdir -p $dev/lib/cmake/dispatch
+    export dylibExt="${stdenv.hostPlatform.extensions.sharedLibrary}"
+    substituteAll ${./glue.cmake} $dev/lib/cmake/dispatch/dispatchConfig.cmake
+  '';
+
+  meta = {
+    description = "Grand Central Dispatch";
+    homepage = "https://github.com/apple/swift-corelibs-libdispatch";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ cmm dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch b/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch
new file mode 100644
index 000000000000..0ea1869d5528
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/disable-swift-overlay.patch
@@ -0,0 +1,35 @@
+Enabling Swift support is normally intended for building an overlay for a
+Swift SDK, which changes the installation layout. Prevent this.
+
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -287,7 +287,7 @@ configure_file("${PROJECT_SOURCE_DIR}/cmake/config.h.in"
+ add_compile_definitions($<$<OR:$<COMPILE_LANGUAGE:C>,$<COMPILE_LANGUAGE:CXX>>:HAVE_CONFIG_H>)
+ 
+ 
+-if(ENABLE_SWIFT)
++if(0)
+   set(INSTALL_TARGET_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/$<LOWER_CASE:${CMAKE_SYSTEM_NAME}>" CACHE PATH "Path where the libraries will be installed")
+   set(INSTALL_DISPATCH_HEADERS_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/dispatch" CACHE PATH "Path where the headers will be installed for libdispatch")
+   set(INSTALL_BLOCK_HEADERS_DIR "${CMAKE_INSTALL_LIBDIR}/swift$<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:_static>/Block" CACHE PATH "Path where the headers will be installed for the blocks runtime")
+--- a/man/CMakeLists.txt
++++ b/man/CMakeLists.txt
+@@ -1,6 +1,6 @@
+ 
+ # TODO(compnerd) add symlinks
+-if(NOT ENABLE_SWIFT)
++if(1)
+   install(FILES
+             dispatch.3
+             dispatch_after.3
+--- a/src/swift/CMakeLists.txt
++++ b/src/swift/CMakeLists.txt
+@@ -47,7 +47,7 @@ get_swift_host_arch(swift_arch)
+ install(FILES
+   ${CMAKE_CURRENT_BINARY_DIR}/swift/Dispatch.swiftmodule
+   ${CMAKE_CURRENT_BINARY_DIR}/swift/Dispatch.swiftdoc
+-  DESTINATION ${INSTALL_TARGET_DIR}/${swift_arch})
++  DESTINATION ${INSTALL_TARGET_DIR}/swift)
+ set_property(GLOBAL APPEND PROPERTY DISPATCH_EXPORTS swiftDispatch)
+ install(TARGETS swiftDispatch
+   EXPORT dispatchExports
diff --git a/pkgs/development/compilers/swift/libdispatch/glue.cmake b/pkgs/development/compilers/swift/libdispatch/glue.cmake
new file mode 100644
index 000000000000..dd696dc61085
--- /dev/null
+++ b/pkgs/development/compilers/swift/libdispatch/glue.cmake
@@ -0,0 +1,5 @@
+add_library(dispatch SHARED IMPORTED)
+set_property(TARGET dispatch PROPERTY IMPORTED_LOCATION "@out@/lib/libdispatch@dylibExt@")
+
+add_library(swiftDispatch SHARED IMPORTED)
+set_property(TARGET swiftDispatch PROPERTY IMPORTED_LOCATION "@out@/lib/libswiftDispatch@dylibExt@")
diff --git a/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch b/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
deleted file mode 100644
index 6c42921cd233..000000000000
--- a/pkgs/development/compilers/swift/patches/0001-build-presets-linux-don-t-require-using-Ninja.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Don't build Ninja, we use our own.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -779,7 +779,7 @@ swiftpm
-
- dash-dash
-
--build-ninja
-+# build-ninja
- install-llvm
- install-swift
- install-lldb
diff --git a/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch b/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
deleted file mode 100644
index 0b4c2cc55c4f..000000000000
--- a/pkgs/development/compilers/swift/patches/0002-build-presets-linux-allow-custom-install-prefix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Use custom install prefix.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -788,7 +788,7 @@
- install-swiftpm
- install-xctest
- install-libicu
--install-prefix=/usr
-+install-prefix=%(install_prefix)s
- install-libcxx
- install-sourcekit-lsp
- build-swift-static-stdlib
diff --git a/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch b/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
deleted file mode 100644
index eb522ac96f7e..000000000000
--- a/pkgs/development/compilers/swift/patches/0003-build-presets-linux-don-t-build-extra-libs.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Disable targets, where we use Nix packages.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -818,8 +818,6 @@
- swiftpm
- swift-driver
- xctest
--libicu
--libcxx
- swiftdocc
- 
- # build-ninja
-@@ -830,9 +828,7 @@
- install-swiftpm
- install-swift-driver
- install-xctest
--install-libicu
- install-prefix=%(install_prefix)s
--install-libcxx
- install-sourcekit-lsp
- install-swiftdocc
- build-swift-static-stdlib
diff --git a/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch b/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
deleted file mode 100644
index 3cacdfc0c55e..000000000000
--- a/pkgs/development/compilers/swift/patches/0004-build-presets-linux-plumb-extra-cmake-options.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Plumb extra-cmake-options.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -812,6 +812,8 @@
- # Path to the .tar.gz package we would create.
- installable-package=%(installable_package)s
-
-+extra-cmake-options=%(extra_cmake_options)s
-+
- [preset: buildbot_linux]
- mixin-preset=mixin_linux_installation
- build-subdir=buildbot_linux
diff --git a/pkgs/development/compilers/swift/patches/0006-clang-purity.patch b/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
deleted file mode 100644
index 928c1db6dee8..000000000000
--- a/pkgs/development/compilers/swift/patches/0006-clang-purity.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Apply the "purity" patch (updated for 5.4.2).
-
---- a/lib/Driver/ToolChains/Gnu.cpp
-+++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -488,11 +488,5 @@
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
--
--    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
--      CmdArgs.push_back("-dynamic-linker");
--      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
--                                           ToolChain.getDynamicLinker(Args)));
--    }
-   }
-
-   CmdArgs.push_back("-o");
diff --git a/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch b/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch
deleted file mode 100644
index 46da01635540..000000000000
--- a/pkgs/development/compilers/swift/patches/0007-build-presets-linux-os-stdlib.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Use os-stdlib in tests.
-
---- a/utils/build-presets.ini
-+++ b/utils/build-presets.ini
-@@ -872,7 +872,7 @@
- indexstore-db
- sourcekit-lsp
- swiftdocc
--lit-args=-v --time-tests
-+lit-args=-v --time-tests --param use_os_stdlib
- 
- # rdar://problem/31454823
- lldb-test-swift-only
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
new file mode 100644
index 000000000000..deb82de20add
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, callPackage
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, CryptoKit
+, LocalAuthentication
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+in
+stdenv.mkDerivation {
+  pname = "sourcekit-lsp";
+
+  inherit (sources) version;
+  src = sources.sourcekit-lsp;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [
+    Foundation
+    XCTest
+    sqlite
+    ncursesInput
+  ]
+    ++ lib.optionals stdenv.isDarwin [ CryptoKit LocalAuthentication ];
+
+  configurePhase = generated.configure + ''
+    swiftpmMakeMutable indexstore-db
+    patch -p1 -d .build/checkouts/indexstore-db -i ${./patches/indexstore-db-macos-target.patch}
+
+    # This toggles a section specific to Xcode XCTest, which doesn't work on
+    # Darwin, where we also use swift-corelibs-xctest.
+    substituteInPlace Sources/LSPTestSupport/PerfTestCase.swift \
+      --replace '#if os(macOS)' '#if false'
+
+    # Required to link with swift-corelibs-xctest on Darwin.
+    export SWIFTTSC_MACOS_DEPLOYMENT_TARGET=10.12
+  '';
+
+  # TODO: BuildServerBuildSystemTests fails
+  #doCheck = true;
+
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin
+    cp $binPath/sourcekit-lsp $out/bin/
+  '';
+
+  # Canary to verify output of our Swift toolchain does not depend on the Swift
+  # compiler itself. (Only its 'lib' output.)
+  disallowedRequisites = [ swift.swift ];
+
+  meta = {
+    description = "Language Server Protocol implementation for Swift and C-based languages";
+    homepage = "https://github.com/apple/sourcekit-lsp";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix
new file mode 100644
index 000000000000..2c822a2ead37
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/generated/default.nix
@@ -0,0 +1,16 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "indexstore-db" = "005vvkrncgpryzrn0hzgsapflpyga0n7152b2b565wislpx90cwl";
+    "swift-argument-parser" = "1jph9w7lk9nr20fsv2c8p4hisx3dda817fh7pybd0r0j1jwa9nmw";
+    "swift-collections" = "0l0pv16zil3n7fac7mdf5qxklxr5rwiig5bixgca1ybq7arlnv7i";
+    "swift-crypto" = "020b8q4ss2k7a65r5dgh59z40i6sn7ij1allxkh8c8a9d0jzn313";
+    "swift-driver" = "0nblvs47kh2hl1l70rmrbablx4m5i27w8l3dfrv2h7zccqr8jl0a";
+    "swift-llbuild" = "1bvqbj8ji72ilh3ah2mw411jwzbbjxjyasa6sg4b8da0kqia4021";
+    "swift-package-manager" = "16qvk14f1l0hf5bphx6qk51nn9d36a2iw5v3sgkvmqi8h7l4kqg5";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1ryd5iyx5mfv8bhyq3bf08z7nv886chzzqnmwaj16r2cry9yml7c";
+    "Yams" = "11abhcfkmqm3cmh7vp7rqzvxd1zj02j2866a2pp6v9m89456xb76";
+  };
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json b/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json
new file mode 100644
index 000000000000..4e8625ed0d6a
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/generated/workspace-state.json
@@ -0,0 +1,178 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "indexstore-db",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/indexstore-db.git",
+          "name": "IndexStoreDB"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "2ff1c0491248cd958a2ac05da9aa613eb27a8eeb"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "indexstore-db"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e394bf350e38cb100b6bc4172834770ede1b7232",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-collections",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-collections.git",
+          "name": "swift-collections"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "f504716c27d2e5d4144fa4794b12129301d17729",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-collections"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "ddb07e896a2a8af79512543b1c7eb9797f8898a5",
+            "version": "1.1.7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-driver",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-driver.git",
+          "name": "swift-driver"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "6c71f58f89d65eb79f1f6b32a707ddc39cec5ad6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-driver"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "d99c31577c60a247b065d29289a44fbdd141e2be"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-package-manager",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-package-manager.git",
+          "name": "SwiftPM"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "f04ad469a6053d713c2fb854fbeb27ee3e6c9dee"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-package-manager"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "main",
+            "revision": "0220fc394f2ae820eeacd754fb2c7ce211e9979e"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "01835dc202670b5bb90d07f3eae41867e9ed29f6",
+            "version": "5.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch b/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch
new file mode 100644
index 000000000000..53e790874d5d
--- /dev/null
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/patches/indexstore-db-macos-target.patch
@@ -0,0 +1,12 @@
+Raise the deployment target of IndexStoreDB so it can link against our XCTest.
+
+--- a/Package.swift
++++ b/Package.swift
+@@ -4,6 +4,7 @@ import PackageDescription
+
+ let package = Package(
+   name: "IndexStoreDB",
++  platforms: [.macOS("10.12")],
+   products: [
+     .library(
+       name: "IndexStoreDB",
diff --git a/pkgs/development/compilers/swift/sources.nix b/pkgs/development/compilers/swift/sources.nix
new file mode 100644
index 000000000000..9c28c683406e
--- /dev/null
+++ b/pkgs/development/compilers/swift/sources.nix
@@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub }:
+
+let
+
+  # These packages are all part of the Swift toolchain, and have a single
+  # upstream version that should match. We also list the hashes here so a basic
+  # version upgrade touches only this file.
+  version = "5.7";
+  hashes = {
+    llvm-project = "sha256-uW6dEAFaDOlHXnq8lFYxrKNLRPEukauZJxX4UCpWpIY=";
+    sourcekit-lsp = "sha256-uA3a+kAqI+XFzkDFEJ8XuRTgfYqacEuTsOU289Im+0Y=";
+    swift = "sha256-n8WVQYinAyIj4wmQnDhvPsH+t8ydANkGbjFJ6blfHOY=";
+    swift-cmark = "sha256-f0BoTs4HYdx/aJ9HIGCWMalhl8PvClWD6R4QK3qSgAw=";
+    swift-corelibs-foundation = "sha256-6XUSC6759dcG24YapWicjRzUnmVVe0QPSsLEw4sQNjI=";
+    swift-corelibs-libdispatch = "sha256-1qbXiC1k9+T+L6liqXKg6EZXqem6KEEx8OctuL4Kb2o=";
+    swift-corelibs-xctest = "sha256-qLUO9/3tkJWorDMEHgHd8VC3ovLLq/UWXJWMtb6CMN0=";
+    swift-docc = "sha256-WlXJMAnrlVPCM+iCIhG0Gyho76BsC2yVBEpX3m/WiIQ=";
+    swift-docc-render-artifact = "sha256-ttdurN/K7OX+I4577jG3YGeRs+GLUTc7BiiEZGmFD+s=";
+    swift-driver = "sha256-sk7XWXYR1MGPEeVxA6eA/vxhN6Gq16iD1RHpVstL3zE=";
+    swift-experimental-string-processing = "sha256-Ar9fQWi8bYSvGErrS0SWrxIxwEwCjsYIZcWweZ8bV28=";
+    swift-package-manager = "sha256-MZah+/XfeK46YamxwuE3Kiv+u5bj7VmjEh6ztDF+0j4=";
+  };
+
+  # Create fetch derivations.
+  sources = lib.mapAttrs (repo: hash: fetchFromGitHub {
+    owner = "apple";
+    inherit repo;
+    rev = "swift-${version}-RELEASE";
+    name = "${repo}-${version}-src";
+    hash = hashes.${repo};
+  }) hashes;
+
+in sources // { inherit version; }
diff --git a/pkgs/development/compilers/swift/swift-docc/default.nix b/pkgs/development/compilers/swift/swift-docc/default.nix
new file mode 100644
index 000000000000..f85512f84071
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, callPackage
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, CryptoKit
+, LocalAuthentication
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+in
+stdenv.mkDerivation {
+  pname = "swift-docc";
+
+  inherit (sources) version;
+  src = sources.swift-docc;
+  # TODO: We could build this from `apple/swift-docc-render` source, but that
+  # repository is not tagged.
+  renderArtifact = sources.swift-docc-render-artifact;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [ Foundation XCTest ]
+    ++ lib.optionals stdenv.isDarwin [ CryptoKit LocalAuthentication ];
+
+  configurePhase = generated.configure;
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin $out/share/docc
+    cp $binPath/docc $out/bin/
+    ln -s $renderArtifact/dist $out/share/docc/render
+  '';
+
+  # Canary to verify output of our Swift toolchain does not depend on the Swift
+  # compiler itself. (Only its 'lib' output.)
+  disallowedRequisites = [ swift.swift ];
+
+  meta = {
+    description = "Documentation compiler for Swift";
+    homepage = "https://github.com/apple/swift-docc";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-docc/generated/default.nix b/pkgs/development/compilers/swift/swift-docc/generated/default.nix
new file mode 100644
index 000000000000..bcd873a44f89
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/generated/default.nix
@@ -0,0 +1,15 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "070gip241dgn3d0nxgwxva4vp6kbnf11g01q5yaq6kmflcmz58f2";
+    "swift-cmark" = "0xfchdgls3070z16in8ks69y8fpiajmyk7lmp5h7ym7164isa6bb";
+    "swift-crypto" = "0h054rq14jyg94aiymmp37vqz60a13dlczp5g09pln724j4ypv92";
+    "swift-docc-plugin" = "11d6nhi139yzk1lxxrixsbgyj1bnvmh40wj30y725q83nqq49ljh";
+    "swift-docc-symbolkit" = "14hb2wc09hisf2r2yny17z28z0m58cf4lnqaczad2x2hk4s1iayi";
+    "swift-lmdb" = "1m5y6x2vs1wflcv2c57rx87gh12sy0hkwy5iy9inxmda2mcs8qcb";
+    "swift-markdown" = "09270bfrwlp904cma29hsbhr1p25v8kwgvhcfi7lg2av7aaknd97";
+    "swift-nio" = "04bvay94b34ynmlvgyl9a7f431l3cf8k2zr483spv8mvyh1hxiqn";
+    "swift-nio-ssl" = "1ak4aldilmz0pnfgbwq1x4alr38nfyvx2pz7p2vi2plf82da80g5";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json b/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json
new file mode 100644
index 000000000000..ced9a6df956c
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/generated/workspace-state.json
@@ -0,0 +1,161 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "d2930e8fcf9c33162b9fcc1d522bc975e2d4179b",
+            "version": "1.0.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-cmark",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-cmark.git",
+          "name": "cmark-gfm"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7-gfm",
+            "revision": "792c1c3326327515ce9bf64c44196b7f4daab9a6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-cmark"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9680b7251cd2be22caaed8f1468bd9e8915a62fb",
+            "version": "1.1.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-docc-plugin",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-docc-plugin",
+          "name": "SwiftDocCPlugin"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "3303b164430d9a7055ba484c8ead67a52f7b74f6",
+            "version": "1.0.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-docc-plugin"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-docc-symbolkit",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-docc-symbolkit",
+          "name": "SymbolKit"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "8682202025906dce29a8b04f9263f40ba87b89d8"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-docc-symbolkit"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-lmdb",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-lmdb.git",
+          "name": "CLMDB"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "6ea45a7ebf6d8f72bd299dfcc3299e284bbb92ee"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-lmdb"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-markdown",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-markdown.git",
+          "name": "swift-markdown"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "d6cd065a7e4b6c3fad615dcd39890e095a2f63a2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-markdown"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-nio",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-nio.git",
+          "name": "swift-nio"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "1d425b0851ffa2695d488cce1d68df2539f42500",
+            "version": "2.31.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-nio"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-nio-ssl",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-nio-ssl.git",
+          "name": "swift-nio-ssl"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "2e74773972bd6254c41ceeda827f229bccbf1c0f",
+            "version": "2.15.0"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-nio-ssl"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/default.nix b/pkgs/development/compilers/swift/swift-driver/default.nix
new file mode 100644
index 000000000000..60fe2aeb9c92
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, callPackage
+, fetchpatch
+, swift
+, swiftpm
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, substituteAll
+}:
+let
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+in
+stdenv.mkDerivation {
+  pname = "swift-driver";
+
+  inherit (sources) version;
+  src = sources.swift-driver;
+
+  nativeBuildInputs = [ swift swiftpm ];
+  buildInputs = [
+    Foundation
+    XCTest
+    sqlite
+    ncursesInput
+  ];
+
+  patches = [
+    ./patches/nix-resource-root.patch
+    ./patches/disable-catalyst.patch
+    ./patches/linux-fix-linking.patch
+    # TODO: Replace with branch patch once merged:
+    # https://github.com/apple/swift-driver/pull/1197
+    (fetchpatch {
+      url = "https://github.com/apple/swift-driver/commit/d3ef9cdf4871a58eddec7ff0e28fe611130da3f9.patch";
+      hash = "sha256-eVBaKN6uzj48ZnHtwGV0k5ChKjak1tDCyE+wTdyGq2c=";
+    })
+    # Prevent a warning about SDK directories we don't have.
+    (substituteAll {
+      src = ./patches/prevent-sdk-dirs-warnings.patch;
+      inherit (builtins) storeDir;
+    })
+  ];
+
+  configurePhase = generated.configure;
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+
+  # TODO: Darwin-specific installation includes more, but not sure why.
+  installPhase = ''
+    binPath="$(swiftpmBinPath)"
+    mkdir -p $out/bin
+    for executable in swift-driver swift-help swift-build-sdk-interfaces; do
+      cp $binPath/$executable $out/bin/
+    done
+  '';
+
+  meta = {
+    description = "Swift compiler driver";
+    homepage = "https://github.com/apple/swift-driver";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/generated/default.nix b/pkgs/development/compilers/swift/swift-driver/generated/default.nix
new file mode 100644
index 000000000000..c5ee8a8c90cb
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/generated/default.nix
@@ -0,0 +1,11 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "11did5snqj8chcbdbiyx84mpif940ls2pr1iikwivvfp63i248hm";
+    "swift-llbuild" = "07zbp2dyfqd1bnyg7snpr9brn40jf22ivly5v10mql3hrg76a18h";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1vabl1z5sm2lrd75f5c781rkrq0liinpjvnrjr6i6r8cqrp0q5jb";
+    "Yams" = "1893y13sis2aimi1a5kgkczbf06z4yig054xb565yg2xm13srb45";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json b/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json
new file mode 100644
index 000000000000..7671303387ec
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/generated/workspace-state.json
@@ -0,0 +1,93 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e1465042f195f374b94f915ba8ca49de24300a0d",
+            "version": "1.0.2"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "564424db5fdb62dcb5d863bdf7212500ef03a87b"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "afc0938503bac012f76ceb619d031f63edc4c5f7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9ff1cc9327586db4e0c8f46f064b6a82ec1566fa",
+            "version": "4.0.6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch b/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch
new file mode 100644
index 000000000000..b9eb23f21061
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/disable-catalyst.patch
@@ -0,0 +1,17 @@
+Tries to parse SDKSettings.plist looking for a Catalyst version map, but we
+don't currently support this.
+
+--- a/Sources/SwiftDriver/Toolchains/DarwinToolchain.swift
++++ b/Sources/SwiftDriver/Toolchains/DarwinToolchain.swift
+@@ -297,11 +297,7 @@ public final class DarwinToolchain: Toolchain {
+                                                debugDescription: "Malformed version string")
+       }
+       self.version = version
+-      if self.canonicalName.hasPrefix("macosx") {
+-        self.versionMap = try keyedContainer.decode(VersionMap.self, forKey: .versionMap)
+-      } else {
+         self.versionMap = VersionMap()
+-      }
+     }
+ 
+ 
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
new file mode 100644
index 000000000000..c0cfe2b7d225
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
@@ -0,0 +1,40 @@
+--- a/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
+@@ -9,6 +9,7 @@
+ // See https://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
+ //
+ //===----------------------------------------------------------------------===//
++import Foundation
+ import TSCBasic
+ import SwiftOptions
+ 
+@@ -116,7 +117,20 @@ extension GenericUnixToolchain {
+       // just using `clang` and avoid a dependency on the C++ runtime.
+       let clangTool: Tool =
+         parsedOptions.hasArgument(.enableExperimentalCxxInterop) ? .clangxx : .clang
+-      var clangPath = try getToolPath(clangTool)
++
++      // For Nix, prefer linking using the wrapped system clang, instead of using
++      // the unwrapped clang packaged with swift. The latter is unable to link, but
++      // we still want to use it for other purposes (clang importer).
++      var clangPath: AbsolutePath
++      let env = ProcessInfo.processInfo.environment
++      if let nixCC = env["NIX_CC"],
++         let binPath = try? AbsolutePath(validating: "\(nixCC)/bin"),
++         let tool = lookupExecutablePath(filename: parsedOptions.hasArgument(.enableExperimentalCxxInterop)
++                                                        ? "clang++" : "clang",
++                                         searchPaths: [binPath]) {
++        clangPath = tool
++      } else {
++      clangPath = try getToolPath(clangTool)
+       if let toolsDirPath = parsedOptions.getLastArgument(.toolsDirectory) {
+         // FIXME: What if this isn't an absolute path?
+         let toolsDir = try AbsolutePath(validating: toolsDirPath.asSingle)
+@@ -132,6 +146,7 @@ extension GenericUnixToolchain {
+         commandLine.appendFlag("-B")
+         commandLine.appendPath(toolsDir)
+       }
++      } // nixCC
+ 
+       // Executables on Linux get -pie
+       if targetTriple.os == .linux && linkerOutputType == .executable {
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch b/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
new file mode 100644
index 000000000000..6c3ae87d68c9
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
@@ -0,0 +1,28 @@
+Swift normally looks for the Clang resource dir in a subdir/symlink of its own
+resource dir. We provide a symlink to the Swift build-time Clang as a default
+there, but we also here patch a check to try locate it via NIX_CC.
+
+--- a/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
+@@ -9,6 +9,7 @@
+ // See https://swift.org/CONTRIBUTORS.txt for the list of Swift project authors
+ //
+ //===----------------------------------------------------------------------===//
++import Foundation
+ import TSCBasic
+ import SwiftOptions
+ 
+@@ -24,6 +25,13 @@ extension Toolchain {
+     for targetInfo: FrontendTargetInfo,
+     parsedOptions: inout ParsedOptions
+   ) throws -> VirtualPath {
++    let env = ProcessInfo.processInfo.environment
++    if let nixCC = env["NIX_CC"] {
++      return try VirtualPath(path: nixCC)
++        .appending(components: "resource-root", "lib",
++                   targetInfo.target.triple.platformName(conflatingDarwin: true)!)
++    }
++
+     return VirtualPath.lookup(targetInfo.runtimeResourcePath.path)
+       .appending(components: "clang", "lib",
+                  targetInfo.target.triple.platformName(conflatingDarwin: true)!)
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch b/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch
new file mode 100644
index 000000000000..6080865ebe37
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-driver/patches/prevent-sdk-dirs-warnings.patch
@@ -0,0 +1,16 @@
+Prevents a user-visible warning on every compilation:
+
+  ld: warning: directory not found for option '-L.../MacOSX11.0.sdk/usr/lib/swift'
+
+--- a/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
++++ b/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
+@@ -50,7 +50,9 @@ extension Toolchain {
+         result.append(sdkPath.appending(components: "System", "iOSSupport", "usr", "lib", "swift"))
+       }
+ 
++      if sdkPath.absolutePath?.pathString.starts(with: "@storeDir@") == false {
+       result.append(sdkPath.appending(components: "usr", "lib", "swift"))
++      }
+     }
+ 
+     return result
diff --git a/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix b/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix
new file mode 100644
index 000000000000..f297eafd389b
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/cmake-glue.nix
@@ -0,0 +1,90 @@
+# SwiftPM dependencies are normally not installed using CMake, and only provide
+# CMake modules to link them together in a build tree. We have separate
+# derivations, so need a real install step. Here we provide our own minimal
+# CMake modules to install along with the build products.
+{ lib, stdenv, swift }:
+let
+
+  inherit (stdenv.hostPlatform) extensions;
+
+  # This file exports shell snippets for use in postInstall.
+  mkInstallScript = module: template: ''
+    mkdir -p $out/lib/cmake/${module}
+    (
+      export staticLibExt="${extensions.staticLibrary}"
+      export sharedLibExt="${extensions.sharedLibrary}"
+      export swiftOs="${swift.swiftOs}"
+      substituteAll \
+        ${builtins.toFile "${module}Config.cmake" template} \
+        $out/lib/cmake/${module}/${module}Config.cmake
+    )
+  '';
+
+in lib.mapAttrs mkInstallScript {
+  SwiftSystem = ''
+    add_library(SwiftSystem::SystemPackage STATIC IMPORTED)
+    set_property(TARGET SwiftSystem::SystemPackage PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libSystemPackage@staticLibExt@")
+  '';
+
+  SwiftCollections = ''
+    add_library(SwiftCollections::Collections STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::Collections PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libCollections@staticLibExt@")
+
+    add_library(SwiftCollections::DequeModule STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::DequeModule PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libDequeModule@staticLibExt@")
+
+    add_library(SwiftCollections::OrderedCollections STATIC IMPORTED)
+    set_property(TARGET SwiftCollections::OrderedCollections PROPERTY IMPORTED_LOCATION "@out@/lib/swift_static/@swiftOs@/libOrderedCollections@staticLibExt@")
+  '';
+
+  TSC = ''
+    add_library(TSCLibc SHARED IMPORTED)
+    set_property(TARGET TSCLibc PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCLibc@sharedLibExt@")
+
+    add_library(TSCBasic SHARED IMPORTED)
+    set_property(TARGET TSCBasic PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCBasic@sharedLibExt@")
+
+    add_library(TSCUtility SHARED IMPORTED)
+    set_property(TARGET TSCUtility PROPERTY IMPORTED_LOCATION "@out@/lib/libTSCUtility@sharedLibExt@")
+  '';
+
+  ArgumentParser = ''
+    add_library(ArgumentParser SHARED IMPORTED)
+    set_property(TARGET ArgumentParser PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libArgumentParser@sharedLibExt@")
+
+    add_library(ArgumentParserToolInfo SHARED IMPORTED)
+    set_property(TARGET ArgumentParserToolInfo PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libArgumentParserToolInfo@sharedLibExt@")
+  '';
+
+  Yams = ''
+    add_library(CYaml SHARED IMPORTED)
+    set_property(TARGET CYaml PROPERTY IMPORTED_LOCATION "@out@/lib/libCYaml@sharedLibExt@")
+
+    add_library(Yams SHARED IMPORTED)
+    set_property(TARGET Yams PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libYams@sharedLibExt@")
+  '';
+
+  LLBuild = ''
+    add_library(libllbuild SHARED IMPORTED)
+    set_property(TARGET libllbuild PROPERTY IMPORTED_LOCATION "@out@/lib/libllbuild@sharedLibExt@")
+
+    add_library(llbuildSwift SHARED IMPORTED)
+    set_property(TARGET llbuildSwift PROPERTY IMPORTED_LOCATION "@out@/lib/swift/pm/llbuild/libllbuildSwift@sharedLibExt@")
+  '';
+
+  SwiftDriver = ''
+    add_library(SwiftDriver SHARED IMPORTED)
+    set_property(TARGET SwiftDriver PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftDriver@sharedLibExt@")
+
+    add_library(SwiftDriverExecution SHARED IMPORTED)
+    set_property(TARGET SwiftDriverExecution PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftDriverExecution@sharedLibExt@")
+
+    add_library(SwiftOptions SHARED IMPORTED)
+    set_property(TARGET SwiftOptions PROPERTY IMPORTED_LOCATION "@out@/lib/libSwiftOptions@sharedLibExt@")
+  '';
+
+  SwiftCrypto = ''
+    add_library(Crypto SHARED IMPORTED)
+    set_property(TARGET Crypto PROPERTY IMPORTED_LOCATION "@out@/lib/swift/@swiftOs@/libCrypto@sharedLibExt@")
+  '';
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/default.nix b/pkgs/development/compilers/swift/swiftpm/default.nix
new file mode 100644
index 000000000000..67198a3c2584
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/default.nix
@@ -0,0 +1,418 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, git
+, swift
+, swiftpm2nix
+, Foundation
+, XCTest
+, sqlite
+, ncurses
+, substituteAll
+, runCommandLocal
+, makeWrapper
+, DarwinTools # sw_vers
+, cctools # vtool
+, xcbuild
+, CryptoKit
+, LocalAuthentication
+}:
+
+let
+
+  inherit (swift) swiftOs swiftModuleSubdir swiftStaticModuleSubdir;
+  sharedLibraryExt = stdenv.hostPlatform.extensions.sharedLibrary;
+
+  sources = callPackage ../sources.nix { };
+  generated = swiftpm2nix.helpers ./generated;
+  cmakeGlue = callPackage ./cmake-glue.nix { };
+
+  # Common attributes for the bootstrap swiftpm and the final swiftpm.
+  commonAttrs = {
+    inherit (sources) version;
+    src = sources.swift-package-manager;
+    nativeBuildInputs = [ makeWrapper ];
+    # Required at run-time for the host platform to build package manifests.
+    propagatedBuildInputs = [ Foundation ];
+    patches = [
+      ./patches/cmake-disable-rpath.patch
+      ./patches/disable-sandbox.patch
+      ./patches/fix-clang-cxx.patch
+      (substituteAll {
+        src = ./patches/disable-xctest.patch;
+        inherit (builtins) storeDir;
+      })
+      (substituteAll {
+        src = ./patches/fix-stdlib-path.patch;
+        inherit (builtins) storeDir;
+        swiftLib = swift.swift.lib;
+      })
+    ];
+    postPatch = ''
+      # The location of xcrun is hardcoded. We need PATH lookup instead.
+      find Sources -name '*.swift' | xargs sed -i -e 's|/usr/bin/xcrun|xcrun|g'
+
+      # Patch the location where swiftpm looks for its API modules.
+      substituteInPlace Sources/PackageModel/UserToolchain.swift \
+        --replace \
+          'librariesPath = applicationPath.parentDirectory' \
+          "librariesPath = AbsolutePath(\"$out\")"
+    '';
+  };
+
+  # Tools invoked by swiftpm at run-time.
+  runtimeDeps = [ git ]
+    ++ lib.optionals stdenv.isDarwin [
+      xcbuild.xcrun
+      # vtool is used to determine a minimum deployment target. This is part of
+      # cctools, but adding that as a build input puts an unwrapped linker in
+      # PATH, and breaks builds. This small derivation exposes just vtool.
+      (runCommandLocal "vtool" { } ''
+        mkdir -p $out/bin
+        ln -s ${cctools}/bin/vtool $out/bin/vtool
+      '')
+    ];
+
+  # Common attributes for the bootstrap derivations.
+  mkBootstrapDerivation = attrs: stdenv.mkDerivation (attrs // {
+    nativeBuildInputs = (attrs.nativeBuildInputs or [ ])
+      ++ [ cmake ninja swift ]
+      ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
+
+    buildInputs = (attrs.buildInputs or [ ])
+      ++ [ Foundation ];
+
+    postPatch = (attrs.postPatch or "")
+      + lib.optionalString stdenv.isDarwin ''
+        # On Darwin only, Swift uses arm64 as cpu arch.
+        if [ -e cmake/modules/SwiftSupport.cmake ]; then
+          substituteInPlace cmake/modules/SwiftSupport.cmake \
+            --replace '"aarch64" PARENT_SCOPE' '"arm64" PARENT_SCOPE'
+        fi
+      '';
+
+    preConfigure = (attrs.preConfigure or "")
+      + ''
+        # Builds often don't set a target, and our default minimum macOS deployment
+        # target on x86_64-darwin is too low. Harmless on non-Darwin.
+        export MACOSX_DEPLOYMENT_TARGET=10.15.4
+      '';
+
+    postInstall = (attrs.postInstall or "")
+      + lib.optionalString stdenv.isDarwin ''
+        # The install name of libraries is incorrectly set to lib/ (via our
+        # CMake setup hook) instead of lib/swift/. This'd be easily fixed by
+        # fixDarwinDylibNames, but some builds create libraries that reference
+        # eachother, and we also have to fix those references.
+        dylibs="$(find $out/lib/swift* -name '*.dylib')"
+        changes=""
+        for dylib in $dylibs; do
+          changes+=" -change $(otool -D $dylib | tail -n 1) $dylib"
+        done
+        for dylib in $dylibs; do
+          install_name_tool -id $dylib $changes $dylib
+        done
+      '';
+
+    cmakeFlags = (attrs.cmakeFlags or [ ])
+      ++ [
+        # Some builds link to libraries within the same build. Make sure these
+        # create references to $out. None of our builds run their own products,
+        # so we don't have to account for that scenario.
+        "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
+      ];
+  });
+
+  # On Darwin, we only want ncurses in the linker search path, because headers
+  # are part of libsystem. Adding its headers to the search path causes strange
+  # mixing and errors.
+  # TODO: Find a better way to prevent this conflict.
+  ncursesInput = if stdenv.isDarwin then ncurses.out else ncurses;
+
+  # Derivations for bootstrapping dependencies using CMake.
+  # This is based on the `swiftpm/Utilities/bootstrap` script.
+  #
+  # Some of the installation steps here are a bit hacky, because it seems like
+  # these packages were not really meant to be installed using CMake. The
+  # regular swiftpm bootstrap simply refers to the source and build
+  # directories. The advantage of separate builds is that we can more easily
+  # link libs together using existing Nixpkgs infra.
+  #
+  # In the end, we don't expose these derivations, and they only exist during
+  # the bootstrap phase. The final swiftpm derivation does not depend on them.
+
+  swift-system = mkBootstrapDerivation {
+    name = "swift-system";
+    src = generated.sources.swift-system;
+
+    postInstall = cmakeGlue.SwiftSystem
+      + lib.optionalString (!stdenv.isDarwin) ''
+        # The cmake rules apparently only use the Darwin install convention.
+        # Fix up the installation so the module can be found on non-Darwin.
+        mkdir -p $out/${swiftStaticModuleSubdir}
+        mv $out/lib/swift_static/${swiftOs}/*.swiftmodule $out/${swiftStaticModuleSubdir}/
+      '';
+  };
+
+  swift-collections = mkBootstrapDerivation {
+    name = "swift-collections";
+    src = generated.sources.swift-collections;
+
+    postPatch = ''
+      # Only builds static libs on Linux, but this installation difference is a
+      # hassle. Because this installation is temporary for the bootstrap, may
+      # as well build static libs everywhere.
+      sed -i -e '/BUILD_SHARED_LIBS/d' CMakeLists.txt
+    '';
+
+    postInstall = cmakeGlue.SwiftCollections
+      + lib.optionalString (!stdenv.isDarwin) ''
+        # The cmake rules apparently only use the Darwin install convention.
+        # Fix up the installation so the module can be found on non-Darwin.
+        mkdir -p $out/${swiftStaticModuleSubdir}
+        mv $out/lib/swift_static/${swiftOs}/*.swiftmodule $out/${swiftStaticModuleSubdir}/
+      '';
+  };
+
+  swift-tools-support-core = mkBootstrapDerivation {
+    name = "swift-tools-support-core";
+    src = generated.sources.swift-tools-support-core;
+
+    buildInputs = [
+      swift-system
+      sqlite
+    ];
+
+    postInstall = cmakeGlue.TSC + ''
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp swift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+
+      # Static libs are not installed.
+      cp lib/*.a $out/lib/
+
+      # Headers are not installed.
+      mkdir -p $out/include
+      cp -r ../Sources/TSCclibc/include $out/include/TSC
+    '';
+  };
+
+  swift-argument-parser = mkBootstrapDerivation {
+    name = "swift-argument-parser";
+    src = generated.sources.swift-argument-parser;
+
+    buildInputs = [ ncursesInput sqlite ];
+
+    cmakeFlags = [
+      "-DBUILD_TESTING=NO"
+      "-DBUILD_EXAMPLES=NO"
+    ];
+
+    postInstall = cmakeGlue.ArgumentParser
+      + lib.optionalString stdenv.isLinux ''
+        # Fix rpath so ArgumentParserToolInfo can be found.
+        patchelf --add-rpath "$out/lib/swift/${swiftOs}" \
+          $out/lib/swift/${swiftOs}/libArgumentParser.so
+      '';
+  };
+
+  Yams = mkBootstrapDerivation {
+    name = "Yams";
+    src = generated.sources.Yams;
+
+    # Conflicts with BUILD file on case-insensitive filesystems.
+    cmakeBuildDir = "_build";
+
+    postInstall = cmakeGlue.Yams;
+  };
+
+  llbuild = mkBootstrapDerivation {
+    name = "llbuild";
+    src = generated.sources.swift-llbuild;
+
+    nativeBuildInputs = lib.optional stdenv.isDarwin xcbuild;
+    buildInputs = [ ncursesInput sqlite ];
+
+    patches = [
+      ./patches/llbuild-cmake-disable-rpath.patch
+    ];
+
+    postPatch = ''
+      # Substitute ncurses for curses.
+      find . -name CMakeLists.txt | xargs sed -i -e 's/curses/ncurses/'
+
+      # Use absolute install names instead of rpath.
+      substituteInPlace \
+        products/libllbuild/CMakeLists.txt \
+        products/llbuildSwift/CMakeLists.txt \
+        --replace '@rpath' "$out/lib"
+
+      # This subdirectory is enabled for Darwin only, but requires ObjC XCTest
+      # (and only Swift XCTest is open source).
+      substituteInPlace perftests/CMakeLists.txt \
+        --replace 'add_subdirectory(Xcode/' '#add_subdirectory(Xcode/'
+    '';
+
+    cmakeFlags = [
+      "-DLLBUILD_SUPPORT_BINDINGS=Swift"
+    ];
+
+    postInstall = cmakeGlue.LLBuild + ''
+      # Install module map.
+      cp ../products/libllbuild/include/module.modulemap $out/include
+
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp products/llbuildSwift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+    '';
+  };
+
+  swift-driver = mkBootstrapDerivation {
+    name = "swift-driver";
+    src = generated.sources.swift-driver;
+
+    buildInputs = [
+      Yams
+      llbuild
+      swift-system
+      swift-argument-parser
+      swift-tools-support-core
+    ];
+
+    postInstall = cmakeGlue.SwiftDriver + ''
+      # Swift modules are not installed.
+      mkdir -p $out/${swiftModuleSubdir}
+      cp swift/*.swift{module,doc} $out/${swiftModuleSubdir}/
+    '';
+  };
+
+  swift-crypto = mkBootstrapDerivation {
+    name = "swift-crypto";
+    src = generated.sources.swift-crypto;
+
+    postPatch = ''
+      substituteInPlace CMakeLists.txt \
+        --replace /usr/bin/ar $NIX_CC/bin/ar
+    '';
+
+    postInstall = cmakeGlue.SwiftCrypto + ''
+      # Static libs are not installed.
+      cp lib/*.a $out/lib/
+
+      # Headers are not installed.
+      cp -r ../Sources/CCryptoBoringSSL/include $out/include
+    '';
+  };
+
+  # Build a bootrapping swiftpm using CMake.
+  swiftpm-bootstrap = mkBootstrapDerivation (commonAttrs // {
+    pname = "swiftpm-bootstrap";
+
+    buildInputs = [
+      llbuild
+      swift-argument-parser
+      swift-collections
+      swift-crypto
+      swift-driver
+      swift-system
+      swift-tools-support-core
+    ];
+
+    cmakeFlags = [
+      "-DUSE_CMAKE_INSTALL=ON"
+    ];
+
+    postInstall = ''
+      for program in $out/bin/swift-*; do
+        wrapProgram $program --prefix PATH : ${lib.makeBinPath runtimeDeps}
+      done
+    '';
+  });
+
+# Build the final swiftpm with the bootstrapping swiftpm.
+in stdenv.mkDerivation (commonAttrs // {
+  pname = "swiftpm";
+
+  nativeBuildInputs = commonAttrs.nativeBuildInputs ++ [
+    swift
+    swiftpm-bootstrap
+  ];
+  buildInputs = [
+    ncursesInput
+    sqlite
+    XCTest
+  ]
+    ++ lib.optionals stdenv.isDarwin [
+      CryptoKit
+      LocalAuthentication
+    ];
+
+  configurePhase = generated.configure + ''
+    # Functionality provided by Xcode XCTest, but not available in
+    # swift-corelibs-xctest.
+    swiftpmMakeMutable swift-tools-support-core
+    substituteInPlace .build/checkouts/swift-tools-support-core/Sources/TSCTestSupport/XCTestCasePerf.swift \
+      --replace 'canImport(Darwin)' 'false'
+
+    # Prevent a warning about SDK directories we don't have.
+    swiftpmMakeMutable swift-driver
+    patch -p1 -d .build/checkouts/swift-driver -i ${substituteAll {
+      src = ../swift-driver/patches/prevent-sdk-dirs-warnings.patch;
+      inherit (builtins) storeDir;
+    }}
+  '';
+
+  buildPhase = ''
+    # Required to link with swift-corelibs-xctest on Darwin.
+    export SWIFTTSC_MACOS_DEPLOYMENT_TARGET=10.12
+
+    TERM=dumb swift-build -c release
+  '';
+
+  # TODO: Tests depend on indexstore-db being provided by an existing Swift
+  # toolchain. (ie. looks for `../lib/libIndexStore.so` relative to swiftc.
+  #doCheck = true;
+  #checkPhase = ''
+  #  TERM=dumb swift-test -c release
+  #'';
+
+  # The following is dervied from Utilities/bootstrap, see install_swiftpm.
+  installPhase = ''
+    binPath="$(swift-build --show-bin-path -c release)"
+
+    mkdir -p $out/bin $out/lib/swift
+
+    cp $binPath/swift-package $out/bin/
+    wrapProgram $out/bin/swift-package \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+    for tool in swift-build swift-test swift-run swift-package-collection; do
+      ln -s $out/bin/swift-package $out/bin/$tool
+    done
+
+    installSwiftpmModule() {
+      mkdir -p $out/lib/swift/pm/$2
+      cp $binPath/lib$1${sharedLibraryExt} $out/lib/swift/pm/$2/
+
+      if [[ -f $binPath/$1.swiftinterface ]]; then
+        cp $binPath/$1.swiftinterface $out/lib/swift/pm/$2/
+      else
+        cp -r $binPath/$1.swiftmodule $out/lib/swift/pm/$2/
+      fi
+      cp $binPath/$1.swiftdoc $out/lib/swift/pm/$2/
+    }
+    installSwiftpmModule PackageDescription ManifestAPI
+    installSwiftpmModule PackagePlugin PluginAPI
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    description = "The Package Manager for the Swift Programming Language";
+    homepage = "https://github.com/apple/swift-package-manager";
+    platforms = with lib.platforms; linux ++ darwin;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+})
diff --git a/pkgs/development/compilers/swift/swiftpm/generated/default.nix b/pkgs/development/compilers/swift/swiftpm/generated/default.nix
new file mode 100644
index 000000000000..978aee7455dc
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/generated/default.nix
@@ -0,0 +1,14 @@
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {
+    "swift-argument-parser" = "1jph9w7lk9nr20fsv2c8p4hisx3dda817fh7pybd0r0j1jwa9nmw";
+    "swift-collections" = "0l0pv16zil3n7fac7mdf5qxklxr5rwiig5bixgca1ybq7arlnv7i";
+    "swift-crypto" = "020b8q4ss2k7a65r5dgh59z40i6sn7ij1allxkh8c8a9d0jzn313";
+    "swift-driver" = "1lcb5wqragc74nd0fjnk47lyph9hs0i9cps1mplvp2i91yzjqk05";
+    "swift-llbuild" = "07zbp2dyfqd1bnyg7snpr9brn40jf22ivly5v10mql3hrg76a18h";
+    "swift-system" = "0402hkx2q2dv27gccnn8ma79ngvwiwzkhcv4zlcdldmy6cgi0px7";
+    "swift-tools-support-core" = "1vabl1z5sm2lrd75f5c781rkrq0liinpjvnrjr6i6r8cqrp0q5jb";
+    "Yams" = "1893y13sis2aimi1a5kgkczbf06z4yig054xb565yg2xm13srb45";
+  };
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json b/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json
new file mode 100644
index 000000000000..26219857c177
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/generated/workspace-state.json
@@ -0,0 +1,144 @@
+{
+  "object": {
+    "artifacts": [],
+    "dependencies": [
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-argument-parser",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-argument-parser.git",
+          "name": "swift-argument-parser"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "e394bf350e38cb100b6bc4172834770ede1b7232",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-argument-parser"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-collections",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-collections.git",
+          "name": "swift-collections"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "f504716c27d2e5d4144fa4794b12129301d17729",
+            "version": "1.0.3"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-collections"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-crypto",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-crypto.git",
+          "name": "swift-crypto"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "ddb07e896a2a8af79512543b1c7eb9797f8898a5",
+            "version": "1.1.7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-crypto"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-driver",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-driver.git",
+          "name": "swift-driver"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "82b274af66cfbb8f3131677676517b34d01e30fd"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-driver"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-llbuild",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-llbuild.git",
+          "name": "llbuild"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "564424db5fdb62dcb5d863bdf7212500ef03a87b"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-llbuild"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-system",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-system.git",
+          "name": "swift-system"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "836bc4557b74fe6d2660218d56e3ce96aff76574",
+            "version": "1.1.1"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-system"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "swift-tools-support-core",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/apple/swift-tools-support-core.git",
+          "name": "swift-tools-support-core"
+        },
+        "state": {
+          "checkoutState": {
+            "branch": "release/5.7",
+            "revision": "afc0938503bac012f76ceb619d031f63edc4c5f7"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "swift-tools-support-core"
+      },
+      {
+        "basedOn": null,
+        "packageRef": {
+          "identity": "yams",
+          "kind": "remoteSourceControl",
+          "location": "https://github.com/jpsim/Yams.git",
+          "name": "Yams"
+        },
+        "state": {
+          "checkoutState": {
+            "revision": "9ff1cc9327586db4e0c8f46f064b6a82ec1566fa",
+            "version": "4.0.6"
+          },
+          "name": "sourceControlCheckout"
+        },
+        "subpath": "Yams"
+      }
+    ]
+  },
+  "version": 5
+}
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch b/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch
new file mode 100644
index 000000000000..9aeba452f9e8
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/cmake-disable-rpath.patch
@@ -0,0 +1,36 @@
+Disable rpath for the bootstrap build with CMake.
+
+--- a/Sources/PackageDescription/CMakeLists.txt
++++ b/Sources/PackageDescription/CMakeLists.txt
+@@ -31,14 +31,11 @@ if(CMAKE_HOST_SYSTEM_NAME STREQUAL Darwin)
+   set(SWIFT_INTERFACE_PATH ${CMAKE_BINARY_DIR}/pm/ManifestAPI/PackageDescription.swiftinterface)
+   target_compile_options(PackageDescription PUBLIC
+     $<$<COMPILE_LANGUAGE:Swift>:-emit-module-interface-path$<SEMICOLON>${SWIFT_INTERFACE_PATH}>)
+-  target_link_options(PackageDescription PRIVATE
+-    "SHELL:-Xlinker -install_name -Xlinker @rpath/libPackageDescription.dylib")
+ endif()
+ 
+ set_target_properties(PackageDescription PROPERTIES
+     Swift_MODULE_NAME PackageDescription
+     Swift_MODULE_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+-    INSTALL_NAME_DIR \\@rpath
+     OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+     OUTPUT_NAME PackageDescription
+     ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/ManifestAPI
+--- a/Sources/PackagePlugin/CMakeLists.txt
++++ b/Sources/PackagePlugin/CMakeLists.txt
+@@ -29,14 +29,11 @@ if(CMAKE_HOST_SYSTEM_NAME STREQUAL Darwin)
+   set(SWIFT_INTERFACE_PATH ${CMAKE_BINARY_DIR}/pm/PluginAPI/PackagePlugin.swiftinterface)
+   target_compile_options(PackagePlugin PUBLIC
+     $<$<COMPILE_LANGUAGE:Swift>:-emit-module-interface-path$<SEMICOLON>${SWIFT_INTERFACE_PATH}>)
+-  target_link_options(PackagePlugin PRIVATE
+-    "SHELL:-Xlinker -install_name -Xlinker @rpath/libPackagePlugin.dylib")
+ endif()
+ 
+ set_target_properties(PackagePlugin PROPERTIES
+   Swift_MODULE_NAME PackagePlugin
+   Swift_MODULE_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
+-  INSTALL_NAME_DIR \\@rpath
+   OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
+   OUTPUT_NAME PackagePlugin
+   ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/pm/PluginAPI
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch b/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch
new file mode 100644
index 000000000000..406e1d68d0e4
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/disable-sandbox.patch
@@ -0,0 +1,21 @@
+Nix may already sandbox the build, in which case sandbox_apply will fail.
+
+--- a/Sources/Basics/Sandbox.swift
++++ b/Sources/Basics/Sandbox.swift
+@@ -30,12 +30,14 @@ public enum Sandbox {
+         readOnlyDirectories: [AbsolutePath] = []
+     ) -> [String] {
+         #if os(macOS)
++        let env = ProcessInfo.processInfo.environment
++        if env["NIX_BUILD_TOP"] == nil || env["IN_NIX_SHELL"] != nil {
+         let profile = macOSSandboxProfile(strictness: strictness, writableDirectories: writableDirectories, readOnlyDirectories: readOnlyDirectories)
+         return ["/usr/bin/sandbox-exec", "-p", profile] + command
+-        #else
++        }
++        #endif
+         // rdar://40235432, rdar://75636874 tracks implementing sandboxes for other platforms.
+         return command
+-        #endif
+     }
+
+     /// Basic strictness level of a sandbox applied to a command line.
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch b/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch
new file mode 100644
index 000000000000..e24d154d2987
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/disable-xctest.patch
@@ -0,0 +1,48 @@
+XCTest is not fully open-source, only the Swift library parts. We don't have a
+command-line runner available, so disable support.
+
+--- a/Sources/Commands/TestingSupport.swift
++++ b/Sources/Commands/TestingSupport.swift
+@@ -60,7 +60,7 @@ enum TestingSupport {
+     /// - Returns: Array of TestSuite
+     static func getTestSuites(fromTestAt path: AbsolutePath, swiftTool: SwiftTool, swiftOptions: SwiftToolOptions) throws -> [TestSuite] {
+         // Run the correct tool.
+-        #if os(macOS)
++        #if false
+         let data: String = try withTemporaryFile { tempFile in
+             let args = [try TestingSupport.xctestHelperPath(swiftTool: swiftTool).pathString, path.pathString, tempFile.path.pathString]
+             var env = try TestingSupport.constructTestEnvironment(toolchain: try swiftTool.getToolchain(), options: swiftOptions, buildParameters: swiftTool.buildParametersForTest())
+--- a/Sources/swiftpm-xctest-helper/main.swift
++++ b/Sources/swiftpm-xctest-helper/main.swift
+@@ -9,8 +9,11 @@
+ */
+ 
+ #if os(macOS)
+-import XCTest
+ import func Darwin.C.exit
++print("Not supported in Nix.")
++exit(1)
++#if false
++import XCTest
+ 
+ /// A helper tool to get list of tests from a XCTest Bundle on macOS.
+ ///
+@@ -132,6 +135,7 @@ do {
+     exit(1)
+ }
+ 
++#endif // nix
+ #else
+ 
+ #if os(Windows)
+--- a/Sources/PackageModel/Destination.swift
++++ b/Sources/PackageModel/Destination.swift
+@@ -174,7 +174,7 @@ public struct Destination: Encodable, Equatable {
+             arguments: ["/usr/bin/xcrun", "--sdk", "macosx", "--show-sdk-platform-path"],
+             environment: environment).spm_chomp()
+
+-        if let platformPath = platformPath, !platformPath.isEmpty {
++        if let platformPath = platformPath, !platformPath.isEmpty && !platformPath.starts(with: "@storeDir@") {
+             // For XCTest framework.
+             let fwk = AbsolutePath(platformPath).appending(
+                 components: "Developer", "Library", "Frameworks")
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch b/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch
new file mode 100644
index 000000000000..60c4e33eb154
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/fix-clang-cxx.patch
@@ -0,0 +1,121 @@
+Swiftpm may invoke clang, not clang++, to compile C++. Our cc-wrapper also
+doesn't pick up the arguments that enable C++ compilation in this case. Patch
+swiftpm to properly invoke clang++.
+
+--- a/Sources/Build/LLBuildManifestBuilder.swift
++++ b/Sources/Build/LLBuildManifestBuilder.swift
+@@ -782,7 +782,7 @@ extension LLBuildManifestBuilder {
+ 
+             args += ["-c", path.source.pathString, "-o", path.object.pathString]
+ 
+-            let clangCompiler = try buildParameters.toolchain.getClangCompiler().pathString
++            let clangCompiler = try buildParameters.toolchain.getClangCompiler(isCXX: isCXX).pathString
+             args.insert(clangCompiler, at: 0)
+ 
+             let objectFileNode: Node = .file(path.object)
+--- a/Sources/PackageModel/Destination.swift
++++ b/Sources/PackageModel/Destination.swift
+@@ -153,7 +153,7 @@ public struct Destination: Encodable, Equatable {
+ 
+         var extraCPPFlags: [String] = []
+ #if os(macOS)
+-        extraCPPFlags += ["-lc++"]
++        extraCPPFlags += ["-lc++", "-lc++abi"]
+ #elseif os(Windows)
+         extraCPPFlags += []
+ #else
+--- a/Sources/PackageModel/Toolchain.swift
++++ b/Sources/PackageModel/Toolchain.swift
+@@ -20,7 +20,7 @@ public protocol Toolchain {
+     var macosSwiftStdlib: AbsolutePath { get }
+ 
+     /// Path of the `clang` compiler.
+-    func getClangCompiler() throws -> AbsolutePath
++    func getClangCompiler(isCXX: Bool) throws -> AbsolutePath
+ 
+     // FIXME: This is a temporary API until index store is widely available in
+     // the OSS clang compiler. This API should not used for any other purpose.
+--- a/Sources/PackageModel/UserToolchain.swift
++++ b/Sources/PackageModel/UserToolchain.swift
+@@ -57,7 +57,7 @@ public final class UserToolchain: Toolchain {
+     /// Only use search paths, do not fall back to `xcrun`.
+     let useXcrun: Bool
+ 
+-    private var _clangCompiler: AbsolutePath?
++    private var _clangCompiler: [Bool: AbsolutePath] = [:]
+ 
+     private let environment: EnvironmentVariables
+ 
+@@ -150,29 +150,31 @@ public final class UserToolchain: Toolchain {
+     }
+ 
+     /// Returns the path to clang compiler tool.
+-    public func getClangCompiler() throws -> AbsolutePath {
++    public func getClangCompiler(isCXX: Bool) throws -> AbsolutePath {
+         // Check if we already computed.
+-        if let clang = self._clangCompiler {
++        if let clang = self._clangCompiler[isCXX] {
+             return clang
+         }
+ 
+         // Check in the environment variable first.
+-        if let toolPath = UserToolchain.lookup(variable: "CC", searchPaths: self.envSearchPaths, environment: environment) {
+-            self._clangCompiler = toolPath
++        let envVar = isCXX ? "CXX" : "CC";
++        if let toolPath = UserToolchain.lookup(variable: envVar, searchPaths: self.envSearchPaths, environment: environment) {
++            self._clangCompiler[isCXX] = toolPath
+             return toolPath
+         }
+ 
+         // Then, check the toolchain.
++        let tool = isCXX ? "clang++" : "clang";
+         do {
+-            if let toolPath = try? UserToolchain.getTool("clang", binDir: self.destination.binDir) {
+-                self._clangCompiler = toolPath
++            if let toolPath = try? UserToolchain.getTool(tool, binDir: self.destination.binDir) {
++                self._clangCompiler[isCXX] = toolPath
+                 return toolPath
+             }
+         }
+ 
+         // Otherwise, lookup it up on the system.
+-        let toolPath = try UserToolchain.findTool("clang", envSearchPaths: self.envSearchPaths, useXcrun: useXcrun)
+-        self._clangCompiler = toolPath
++        let toolPath = try UserToolchain.findTool(tool, envSearchPaths: self.envSearchPaths, useXcrun: useXcrun)
++        self._clangCompiler[isCXX] = toolPath
+         return toolPath
+     }
+ 
+--- a/Sources/SPMBuildCore/BuildParameters.swift
++++ b/Sources/SPMBuildCore/BuildParameters.swift
+@@ -342,7 +342,7 @@ private struct _Toolchain: Encodable {
+     public func encode(to encoder: Encoder) throws {
+         var container = encoder.container(keyedBy: CodingKeys.self)
+         try container.encode(toolchain.swiftCompilerPath, forKey: .swiftCompiler)
+-        try container.encode(toolchain.getClangCompiler(), forKey: .clangCompiler)
++        try container.encode(toolchain.getClangCompiler(isCXX: false), forKey: .clangCompiler)
+ 
+         try container.encode(toolchain.extraCCFlags, forKey: .extraCCFlags)
+         try container.encode(toolchain.extraCPPFlags, forKey: .extraCPPFlags)
+--- a/Sources/XCBuildSupport/XcodeBuildSystem.swift
++++ b/Sources/XCBuildSupport/XcodeBuildSystem.swift
+@@ -172,7 +172,7 @@ public final class XcodeBuildSystem: SPMBuildCore.BuildSystem {
+         // Generate a table of any overriding build settings.
+         var settings: [String: String] = [:]
+         // An error with determining the override should not be fatal here.
+-        settings["CC"] = try? buildParameters.toolchain.getClangCompiler().pathString
++        settings["CC"] = try? buildParameters.toolchain.getClangCompiler(isCXX: false).pathString
+         // Always specify the path of the effective Swift compiler, which was determined in the same way as for the native build system.
+         settings["SWIFT_EXEC"] = buildParameters.toolchain.swiftCompilerPath.pathString
+         settings["LIBRARY_SEARCH_PATHS"] = "$(inherited) \(buildParameters.toolchain.toolchainLibDir.pathString)"
+--- a/Tests/BuildTests/MockBuildTestHelper.swift
++++ b/Tests/BuildTests/MockBuildTestHelper.swift
+@@ -15,7 +15,7 @@ struct MockToolchain: PackageModel.Toolchain {
+     #else
+     let extraCPPFlags: [String] = ["-lstdc++"]
+     #endif
+-    func getClangCompiler() throws -> AbsolutePath {
++    func getClangCompiler(isCXX: Bool) throws -> AbsolutePath {
+         return AbsolutePath("/fake/path/to/clang")
+     }
+ 
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch b/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch
new file mode 100644
index 000000000000..327ccf37e425
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/fix-stdlib-path.patch
@@ -0,0 +1,23 @@
+Swiftpm looks for the Swift stdlib relative to the swift compiler, but that's a
+wrapper in our case. It wants to add the stdlib to the rpath, which is
+necessary for back-deployment of some features.
+
+--- a/Sources/PackageModel/Toolchain.swift
++++ b/Sources/PackageModel/Toolchain.swift
+@@ -43,10 +43,16 @@ extension Toolchain {
+     }
+ 
+     public var macosSwiftStdlib: AbsolutePath { 
++        if swiftCompilerPath.pathString.starts(with: "@storeDir@") {
++            return AbsolutePath("@swiftLib@/lib/swift/macosx")
++        }
+         return AbsolutePath("../../lib/swift/macosx", relativeTo: resolveSymlinks(swiftCompilerPath))
+     }
+ 
+     public var toolchainLibDir: AbsolutePath {
++        if swiftCompilerPath.pathString.starts(with: "@storeDir@") {
++            return AbsolutePath("@swiftLib@/lib")
++        }
+         // FIXME: Not sure if it's better to base this off of Swift compiler or our own binary.
+         return AbsolutePath("../../lib", relativeTo: resolveSymlinks(swiftCompilerPath))
+     }
diff --git a/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch b/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch
new file mode 100644
index 000000000000..785e82cc34b6
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/patches/llbuild-cmake-disable-rpath.patch
@@ -0,0 +1,14 @@
+Specifying `-platform_version` targeting macos before 10.15 causes cctools ld
+to link with `@rpath`. This may have something to do with Swift ABI stability.
+
+--- a/products/llbuildSwift/CMakeLists.txt
++++ b/products/llbuildSwift/CMakeLists.txt
+@@ -22,7 +17,7 @@ endif()
+
+ # TODO(compnerd) move both of these outside of the CMake into the invocation
+ if(CMAKE_SYSTEM_NAME STREQUAL Darwin)
+-  add_compile_options(-target ${CMAKE_OSX_ARCHITECTURES}-apple-macosx10.10)
++  add_compile_options(-target ${CMAKE_OSX_ARCHITECTURES}-apple-macosx10.15)
+   if(NOT CMAKE_OSX_SYSROOT STREQUAL "")
+     add_compile_options(-sdk ${CMAKE_OSX_SYSROOT})
+   endif()
diff --git a/pkgs/development/compilers/swift/swiftpm/setup-hook.sh b/pkgs/development/compilers/swift/swiftpm/setup-hook.sh
new file mode 100644
index 000000000000..160fbb1ccca3
--- /dev/null
+++ b/pkgs/development/compilers/swift/swiftpm/setup-hook.sh
@@ -0,0 +1,60 @@
+# Build using 'swift-build'.
+swiftpmBuildPhase() {
+    runHook preBuild
+
+    local buildCores=1
+    if [ "${enableParallelBuilding-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
+    local flagsArray=(
+        -j $buildCores
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    echoCmd 'build flags' "${flagsArray[@]}"
+    TERM=dumb swift-build "${flagsArray[@]}"
+
+    runHook postBuild
+}
+
+if [ -z "${dontUseSwiftpmBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=swiftpmBuildPhase
+fi
+
+# Check using 'swift-test'.
+swiftpmCheckPhase() {
+    runHook preCheck
+
+    local buildCores=1
+    if [ "${enableParallelBuilding-1}" ]; then
+        buildCores="$NIX_BUILD_CORES"
+    fi
+
+    local flagsArray=(
+        -j $buildCores
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    TERM=dumb swift-test "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+if [ -z "${dontUseSwiftpmCheck-}" ] && [ -z "${checkPhase-}" ]; then
+    checkPhase=swiftpmCheckPhase
+fi
+
+# Helper used to find the binary output path.
+# Useful for performing the installPhase of swiftpm packages.
+swiftpmBinPath() {
+    local flagsArray=(
+        -c "${swiftpmBuildConfig-release}"
+        $swiftpmFlags "${swiftpmFlagsArray[@]}"
+    )
+
+    swift-build --show-bin-path "${flagsArray[@]}"
+}
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
new file mode 100644
index 000000000000..a7d16cc2471a
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, swift
+, useSwiftDriver ? true, swift-driver
+}:
+
+stdenv.mkDerivation (swift._wrapperParams // {
+  pname = "swift-wrapper";
+  inherit (swift) version meta;
+
+  outputs = [ "out" "man" ];
+
+  # Wrapper and setup hook variables.
+  inherit swift;
+  inherit (swift)
+    swiftOs swiftArch
+    swiftModuleSubdir swiftLibSubdir
+    swiftStaticModuleSubdir swiftStaticLibSubdir;
+  swiftDriver = if useSwiftDriver
+    then "${swift-driver}/bin/swift-driver" else "";
+
+  passAsFile = [ "buildCommand" ];
+  buildCommand = ''
+    mkdir -p $out/bin $out/nix-support
+
+    # Symlink all Swift binaries first.
+    # NOTE: This specifically omits clang binaries. We want to hide these for
+    # private use by Swift only.
+    ln -s -t $out/bin/ $swift/bin/swift*
+
+    # Replace specific binaries with wrappers.
+    for executable in swift swiftc swift-frontend; do
+      export prog=$swift/bin/$executable
+      rm $out/bin/$executable
+      substituteAll '${./wrapper.sh}' $out/bin/$executable
+      chmod a+x $out/bin/$executable
+    done
+
+    ${lib.optionalString useSwiftDriver ''
+    # Symlink swift-driver executables.
+    ln -s -t $out/bin/ ${swift-driver}/bin/*
+    ''}
+
+    ln -s ${swift.man} $man
+
+    # This link is here because various tools (swiftpm) check for stdlib
+    # relative to the swift compiler. It's fine if this is for build-time
+    # stuff, but we should patch all cases were it would end up in an output.
+    ln -s ${swift.lib}/lib $out/lib
+
+    substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
+  '';
+
+  passthru = {
+    inherit swift;
+    inherit (swift) swiftOs swiftArch swiftModuleSubdir swiftLibSubdir;
+  };
+})
diff --git a/pkgs/development/compilers/swift/wrapper/setup-hook.sh b/pkgs/development/compilers/swift/wrapper/setup-hook.sh
new file mode 100644
index 000000000000..398f19977f66
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/setup-hook.sh
@@ -0,0 +1,28 @@
+# Add import paths for build inputs.
+swiftWrapper_addImports () {
+    # Include subdirectories following both the Swift platform convention, and
+    # a simple `lib/swift` for Nix convenience.
+    for subdir in @swiftModuleSubdir@ @swiftStaticModuleSubdir@ lib/swift; do
+        if [[ -d "$1/$subdir" ]]; then
+            export NIX_SWIFTFLAGS_COMPILE+=" -I $1/$subdir"
+        fi
+    done
+    for subdir in @swiftLibSubdir@ @swiftStaticLibSubdir@ lib/swift; do
+        if [[ -d "$1/$subdir" ]]; then
+            export NIX_LDFLAGS+=" -L $1/$subdir"
+        fi
+    done
+}
+
+addEnvHooks "$targetOffset" swiftWrapper_addImports
+
+# Use a postHook here because we rely on NIX_CC, which is set by the cc-wrapper
+# setup hook, so delay until we're sure it was run.
+swiftWrapper_postHook () {
+    # On Darwin, libc also contains Swift modules.
+    if [[ -e "$NIX_CC/nix-support/orig-libc" ]]; then
+        swiftWrapper_addImports "$(<$NIX_CC/nix-support/orig-libc)"
+    fi
+}
+
+postHooks+=(swiftWrapper_postHook)
diff --git a/pkgs/development/compilers/swift/wrapper/wrapper.sh b/pkgs/development/compilers/swift/wrapper/wrapper.sh
new file mode 100644
index 000000000000..0c56e63b6f29
--- /dev/null
+++ b/pkgs/development/compilers/swift/wrapper/wrapper.sh
@@ -0,0 +1,291 @@
+#! @shell@
+# NOTE: This wrapper is derived from cc-wrapper.sh, and is hopefully somewhat
+# diffable with the original, so changes can be merged if necessary.
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+cc_wrapper="${NIX_CC:-@default_cc_wrapper@}"
+
+source $cc_wrapper/nix-support/utils.bash
+
+expandResponseParams "$@"
+
+# Check if we should wrap this Swift invocation at all, and how. Specifically,
+# there are some internal tools we don't wrap, plus swift-frontend doesn't link
+# and doesn't understand linker flags. This follows logic in
+# `lib/DriverTool/driver.cpp`.
+prog=@prog@
+progName="$(basename "$prog")"
+firstArg="${params[0]:-}"
+isFrontend=0
+isRepl=0
+
+# These checks follow `shouldRunAsSubcommand`.
+if [[ "$progName" == swift ]]; then
+    case "$firstArg" in
+        "" | -* | *.* | */* | repl)
+            ;;
+        *)
+            exec "swift-$firstArg" "${params[@]:1}"
+            ;;
+    esac
+fi
+
+# These checks follow the first part of `run_driver`.
+#
+# NOTE: The original function short-circuits, but we can't here, because both
+# paths must be wrapped. So we use an 'isFrontend' flag instead.
+case "$firstArg" in
+    -frontend)
+        isFrontend=1
+        # Ensure this stays the first argument.
+        params=( "${params[@]:1}" )
+        extraBefore+=( "-frontend" )
+        ;;
+    -modulewrap)
+        # Don't wrap this integrated tool.
+        exec "$prog" "${params[@]}"
+        ;;
+    repl)
+        isRepl=1
+        params=( "${params[@]:1}" )
+        ;;
+    --driver-mode=*)
+        ;;
+    *)
+        if [[ "$progName" == swift-frontend ]]; then
+            isFrontend=1
+        fi
+        ;;
+esac
+
+# For many tasks, Swift reinvokes swift-driver, the new driver implementation
+# written in Swift. It needs some help finding the executable, though, and
+# reimplementing the logic here is little effort. These checks follow
+# `shouldDisallowNewDriver`.
+if [[
+    $isFrontend = 0 &&
+    -n "@swiftDriver@" &&
+    -z "${SWIFT_USE_OLD_DRIVER:-}" &&
+    ( "$progName" == "swift" || "$progName" == "swiftc" )
+]]; then
+    prog=@swiftDriver@
+    # Driver mode must be the very first argument.
+    extraBefore+=( "--driver-mode=$progName" )
+    if [[ $isRepl = 1 ]]; then
+        extraBefore+=( "-repl" )
+    fi
+
+    # Ensure swift-driver invokes the unwrapped frontend (instead of finding
+    # the wrapped one via PATH), because we don't have to wrap a second time.
+    export SWIFT_DRIVER_SWIFT_FRONTEND_EXEC="@swift@/bin/swift-frontend"
+
+    # Ensure swift-driver can find the LLDB with Swift support for the REPL.
+    export SWIFT_DRIVER_LLDB_EXEC="@swift@/bin/lldb"
+fi
+
+path_backup="$PATH"
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
+    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
+fi
+
+# Parse command line options and set several variables.
+# For instance, figure out if linker flags should be passed.
+# GCC prints annoying warnings when they are not needed.
+isCxx=0
+dontLink=$isFrontend
+
+for p in "${params[@]}"; do
+    case "$p" in
+        -enable-cxx-interop)
+            isCxx=1 ;;
+    esac
+done
+
+# NOTE: We don't modify these for Swift, but sourced scripts may use them.
+cxxInclude=1
+cxxLibrary=1
+cInclude=1
+
+linkType=$(checkLinkType "${params[@]}")
+
+# Optionally filter out paths not refering to the store.
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
+    kept=()
+    nParams=${#params[@]}
+    declare -i n=0
+    while (( "$n" < "$nParams" )); do
+        p=${params[n]}
+        p2=${params[n+1]:-} # handle `p` being last one
+        n+=1
+
+        skipNext=false
+        path=""
+        case "$p" in
+            -[IL]/*) path=${p:2} ;;
+            -[IL]) path=$p2 skipNext=true ;;
+        esac
+
+        if [[ -n $path ]] && badPath "$path"; then
+            skip "$path"
+            $skipNext && n+=1
+            continue
+        fi
+
+        kept+=("$p")
+    done
+    # Old bash empty array hack
+    params=(${kept+"${kept[@]}"})
+fi
+
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source @bintools@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
+if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source $cc_wrapper/nix-support/add-flags.sh
+fi
+
+if [[ "$isCxx" = 1 ]]; then
+    if [[ "$cxxInclude" = 1 ]]; then
+        NIX_CFLAGS_COMPILE_@suffixSalt@+=" $NIX_CXXSTDLIB_COMPILE_@suffixSalt@"
+    fi
+    if [[ "$cxxLibrary" = 1 ]]; then
+        NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
+    fi
+fi
+
+source $cc_wrapper/nix-support/add-hardening.sh
+
+# Add the flags for the C compiler proper.
+addCFlagsToList() {
+    declare -n list="$1"
+    shift
+
+    for ((i = 1; i <= $#; i++)); do
+        local val="${!i}"
+        case "$val" in
+            # Pass through using -Xcc, but also convert to Swift -I.
+            # These have slightly different meaning for Clang, but Swift
+            # doesn't have exact equivalents.
+            -isystem | -idirafter)
+                i=$((i + 1))
+                list+=("-Xcc" "$val" "-Xcc" "${!i}" "-I" "${!i}")
+                ;;
+            # Simple rename.
+            -iframework)
+                i=$((i + 1))
+                list+=("-Fsystem" "${!i}")
+                ;;
+            # Pass through verbatim.
+            -I | -Fsystem)
+                i=$((i + 1))
+                list+=("${val}" "${!i}")
+                ;;
+            -I* | -L* | -F*)
+                list+=("${val}")
+                ;;
+            # Pass through using -Xcc.
+            *)
+                list+=("-Xcc" "$val")
+                ;;
+        esac
+    done
+}
+for i in ${NIX_SWIFTFLAGS_COMPILE:-}; do
+    extraAfter+=("$i")
+done
+for i in ${NIX_SWIFTFLAGS_COMPILE_BEFORE:-}; do
+    extraBefore+=("$i")
+done
+addCFlagsToList extraAfter $NIX_CFLAGS_COMPILE_@suffixSalt@
+addCFlagsToList extraBefore ${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@
+
+if [ "$dontLink" != 1 ]; then
+
+    # Add the flags that should only be passed to the compiler when
+    # linking.
+    addCFlagsToList extraAfter $(filterRpathFlags "$linkType" $NIX_CFLAGS_LINK_@suffixSalt@)
+
+    # Add the flags that should be passed to the linker (and prevent
+    # `ld-wrapper' from adding NIX_LDFLAGS_@suffixSalt@ again).
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@); do
+        extraBefore+=("-Xlinker" "$i")
+    done
+    if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
+        extraBefore+=("-Xlinker" "-dynamic-linker=$NIX_DYNAMIC_LINKER_@suffixSalt@")
+    fi
+    for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@); do
+        if [ "${i:0:3}" = -L/ ]; then
+            extraAfter+=("$i")
+        else
+            extraAfter+=("-Xlinker" "$i")
+        fi
+    done
+    export NIX_LINK_TYPE_@suffixSalt@=$linkType
+fi
+
+# TODO: If we ever need to expand functionality of this hook, it may no longer
+# be compatible with Swift. Right now, it is only used on Darwin to force
+# -target, which also happens to work with Swift.
+if [[ -e $cc_wrapper/nix-support/add-local-cc-cflags-before.sh ]]; then
+    source $cc_wrapper/nix-support/add-local-cc-cflags-before.sh
+fi
+
+# May need to transform the triple injected by the above.
+for ((i = 1; i < ${#extraBefore[@]}; i++)); do
+    if [[ "${extraBefore[i]}" = -target ]]; then
+        i=$((i + 1))
+        # On Darwin only, need to change 'aarch64' to 'arm64'.
+        extraBefore[i]="${extraBefore[i]/aarch64-apple-/arm64-apple-}"
+        # On Darwin, Swift requires the triple to be annotated with a version.
+        # TODO: Assumes macOS.
+        extraBefore[i]="${extraBefore[i]/-apple-darwin/-apple-macosx${MACOSX_DEPLOYMENT_TARGET:-11.0}}"
+        break
+    fi
+done
+
+# As a very special hack, if the arguments are just `-v', then don't
+# add anything.  This is to prevent `gcc -v' (which normally prints
+# out the version number and returns exit code 0) from printing out
+# `No input files specified' and returning exit code 1.
+if [ "$*" = -v ]; then
+    extraAfter=()
+    extraBefore=()
+fi
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see ld-wrapper for explanation.
+    echo "extra flags before to $prog:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to $prog:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to $prog:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+PATH="$path_backup"
+# Old bash workaround, see above.
+
+if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
+    exec "$prog" @<(printf "%q\n" \
+       ${extraBefore+"${extraBefore[@]}"} \
+       ${params+"${params[@]}"} \
+       ${extraAfter+"${extraAfter[@]}"})
+else
+    exec "$prog" \
+       ${extraBefore+"${extraBefore[@]}"} \
+       ${params+"${params[@]}"} \
+       ${extraAfter+"${extraAfter[@]}"}
+fi
diff --git a/pkgs/development/compilers/swift/xctest/default.nix b/pkgs/development/compilers/swift/xctest/default.nix
new file mode 100644
index 000000000000..c8003d8486f1
--- /dev/null
+++ b/pkgs/development/compilers/swift/xctest/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, stdenv
+, callPackage
+, cmake
+, ninja
+, swift
+, Foundation
+, DarwinTools
+}:
+
+let
+  sources = callPackage ../sources.nix { };
+in stdenv.mkDerivation {
+  pname = "swift-corelibs-xctest";
+
+  inherit (sources) version;
+  src = sources.swift-corelibs-xctest;
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [ cmake ninja swift ]
+    ++ lib.optional stdenv.isDarwin DarwinTools; # sw_vers
+  buildInputs = [ Foundation ];
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    # On Darwin only, Swift uses arm64 as cpu arch.
+    substituteInPlace cmake/modules/SwiftSupport.cmake \
+      --replace '"aarch64" PARENT_SCOPE' '"arm64" PARENT_SCOPE'
+  '';
+
+  preConfigure = ''
+    # On aarch64-darwin, our minimum target is 11.0, but we can target lower,
+    # and some dependants require a lower target. Harmless on non-Darwin.
+    export MACOSX_DEPLOYMENT_TARGET=10.12
+  '';
+
+  cmakeFlags = lib.optional stdenv.isDarwin "-DUSE_FOUNDATION_FRAMEWORK=ON";
+
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    # Darwin normally uses the Xcode version of XCTest. Installing
+    # swift-corelibs-xctest is probably not officially supported, but we have
+    # no alternative. Fix up the installation here.
+    mv $out/lib/swift/darwin/${swift.swiftArch}/* $out/lib/swift/darwin
+    rmdir $out/lib/swift/darwin/${swift.swiftArch}
+    mv $out/lib/swift/darwin $out/lib/swift/${swift.swiftOs}
+  '';
+
+  meta = {
+    description = "Framework for writing unit tests in Swift";
+    homepage = "https://github.com/apple/swift-corelibs-xctest";
+    platforms = lib.platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+  };
+}
diff --git a/pkgs/development/haskell-modules/generic-stack-builder.nix b/pkgs/development/haskell-modules/generic-stack-builder.nix
index 8b3020f88613..eae0337effc0 100644
--- a/pkgs/development/haskell-modules/generic-stack-builder.nix
+++ b/pkgs/development/haskell-modules/generic-stack-builder.nix
@@ -16,7 +16,9 @@ let
 
   # Add all dependencies in buildInputs including propagated ones to
   # STACK_IN_NIX_EXTRA_ARGS.
-  stackHook = makeSetupHook {} ./stack-hook.sh;
+  stackHook = makeSetupHook {
+    name = "stack-hook";
+  } ./stack-hook.sh;
 
 in stdenv.mkDerivation (args // {
 
diff --git a/pkgs/development/interpreters/lua-5/wrap-lua.nix b/pkgs/development/interpreters/lua-5/wrap-lua.nix
index 049afcd6116d..c9ef151bea3c 100644
--- a/pkgs/development/interpreters/lua-5/wrap-lua.nix
+++ b/pkgs/development/interpreters/lua-5/wrap-lua.nix
@@ -7,10 +7,10 @@
 # defined in trivial-builders.nix
 # imported as wrapLua in lua-packages.nix and passed to build-lua-derivation to be used as buildInput
 makeSetupHook {
+  name = "wrap-lua-hook";
   deps = makeWrapper;
   substitutions.executable = lua.interpreter;
   substitutions.lua = lua;
   substitutions.LuaPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
   substitutions.LuaCPathSearchPaths = lib.escapeShellArgs lua.LuaPathSearchPaths;
 } ./wrap.sh
-
diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index 29fc6cf820b2..feb4e4e79f48 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -6,6 +6,7 @@
 with lib;
 
 makePythonHook {
+      name = "wrap-python-hook";
       deps = makeWrapper;
       substitutions.sitePackages = python.sitePackages;
       substitutions.executable = python.interpreter;
diff --git a/pkgs/development/libraries/audio/roc-toolkit/default.nix b/pkgs/development/libraries/audio/roc-toolkit/default.nix
index a4916eecfe41..f52800e2e70c 100644
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@@ -12,7 +12,9 @@
   libunwindSupport ? true,
   libunwind,
   pulseaudioSupport ? true,
-  libpulseaudio
+  libpulseaudio,
+  soxSupport ? true,
+  sox
 }:
 
 stdenv.mkDerivation rec {
@@ -35,17 +37,17 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [
     libuv
-    libunwind
-    openfec
-    libpulseaudio
     speexdsp
-  ];
+  ] ++ lib.optional openfecSupport openfec
+    ++ lib.optional libunwindSupport libunwind
+    ++ lib.optional pulseaudioSupport libpulseaudio
+    ++ lib.optional soxSupport sox;
 
   sconsFlags =
     [ "--build=${stdenv.buildPlatform.config}"
       "--host=${stdenv.hostPlatform.config}"
-      "--prefix=${placeholder "out"}"
-      "--disable-sox" ] ++
+      "--prefix=${placeholder "out"}" ] ++
+    lib.optional (!soxSupport) "--disable-sox" ++
     lib.optional (!libunwindSupport) "--disable-libunwind" ++
     lib.optional (!pulseaudioSupport) "--disable-pulseaudio" ++
     (if (!openfecSupport)
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 87d3285e64bc..5e44d2221f2a 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -62,8 +62,6 @@ stdenv.mkDerivation rec {
     fixDarwinDylibNames
   ];
 
-  buildInputs = [ gobject-introspection ];
-
   propagatedBuildInputs = [
     glib
     libtiff
diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix
index 795aeb88440e..5202dc0edabc 100644
--- a/pkgs/development/libraries/giflib/default.nix
+++ b/pkgs/development/libraries/giflib/default.nix
@@ -8,7 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "1gbrg03z1b6rlrvjyc6d41bc8j1bsr7rm8206gb1apscyii5bnii";
   };
 
-  patches = lib.optional stdenv.hostPlatform.isDarwin
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-28506.patch";
+      url = "https://src.fedoraproject.org/rpms/giflib/raw/2e9917bf13df114354163f0c0211eccc00943596/f/CVE-2022-28506.patch";
+      sha256 = "sha256-TBemEXkuox8FdS9RvjnWcTWPaHRo4crcwSR9czrUwBY=";
+    })
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin
     (fetchpatch {
       # https://sourceforge.net/p/giflib/bugs/133/
       name = "darwin-soname.patch";
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 2d7e6614cecc..9193404d0123 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -76,11 +76,19 @@ in
     # - clang-wrapper in cross-compilation
     # Last attempt: https://github.com/NixOS/nixpkgs/pull/36948
     preInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-      if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
+      if [ -f ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
           mkdir -p $out/lib
-          cp ${stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
+          cp ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
           # the .so It used to be a symlink, but now it is a script
-          cp -a ${stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
+          cp -a ${lib.getLib stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
+          # wipe out reference to previous libc it was built against
+          chmod +w $out/lib/libgcc_s.so.1
+          # rely on default RUNPATHs of the binary and other libraries
+          # Do no force-pull wrong glibc.
+          patchelf --remove-rpath $out/lib/libgcc_s.so.1
+          # 'patchelf' does not remove the string itself. Wipe out
+          # string reference to avoid possible link to bootstrapTools
+          ${buildPackages.nukeReferences}/bin/nuke-refs $out/lib/libgcc_s.so.1
       fi
     '';
 
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 112158a47276..1533f59b4aec 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -2,7 +2,6 @@
 , stdenv
 , substituteAll
 , fetchurl
-, fetchpatch2
 , pkg-config
 , gettext
 , docbook-xsl-nons
@@ -61,7 +60,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.35";
+  version = "3.24.36";
 
   outputs = [ "out" "dev" ] ++ lib.optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -73,22 +72,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-7BD+bXEu8LPGO1+TJjnJ0a6Z/OlPUA9vBpZWKf72C9E=";
+    sha256 = "sha256-J6bvFXdDNQyAf/6lm6odcCJtvt6CpelT/9WOpgWf5pE=";
   };
 
   patches = [
     ./patches/3.0-immodules.cache.patch
     ./patches/3.0-Xft-setting-fallback-compute-DPI-properly.patch
-
-    # Add accidentally non-dist’d build file.
-    # https://gitlab.gnome.org/GNOME/gtk/-/commit/b2ad8d2abafbd94c7e58e5e1b98c92e6b6fa6d9a
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/66a199806ceb3daa5e2c7d3a5b45a86007cec46a.patch";
-      includes = [
-        "gdk/wayland/cursor/meson.build"
-      ];
-      sha256 = "cOOcSB3yphff2+7l7YpFbGSswWjV8lJ2tk+Vjgl1ras=";
-    })
   ] ++ lib.optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
@@ -121,7 +110,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     libxkbcommon
     (libepoxy.override { inherit x11Support; })
     isocodes
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 9da8e8837bc1..782823cd6748 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     docbook_xml_dtd_43
   ];
 
-  buildInputs = [ glib freetype gobject-introspection ]
+  buildInputs = [ glib freetype ]
     ++ lib.optionals withCoreText [ ApplicationServices CoreText ];
 
   propagatedBuildInputs = lib.optional withGraphite2 graphite2
diff --git a/pkgs/development/libraries/json-glib/default.nix b/pkgs/development/libraries/json-glib/default.nix
index 9885384e00e1..efac3690851e 100644
--- a/pkgs/development/libraries/json-glib/default.nix
+++ b/pkgs/development/libraries/json-glib/default.nix
@@ -49,8 +49,6 @@ stdenv.mkDerivation rec {
     fixDarwinDylibNames
   ];
 
-  buildInputs = [ gobject-introspection ];
-
   propagatedBuildInputs = [
     glib
   ];
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7a7edc5b122e..7abbd944ed01 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -1,22 +1,50 @@
-{ lib, stdenv, fetchFromGitHub, cmake, cmocka }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, cmocka
 
-stdenv.mkDerivation rec {
+# for passthru.tests
+, libfido2
+, mysql80
+, openssh
+, systemd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Wp/48yQA17mf/dTgeMcMDvPpKOPkfLhQkCnzgGLpLtk=";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-YJSIZ7o191/0QJf1fH6LUYykS2pvP17knSeRO2WcDeM=";
   };
 
   nativeBuildInputs = [ cmake ];
-  nativeCheckInputs = [ cmocka ];
 
-  doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DBUILD_SHARED_LIBS=on"
+  ] ++ lib.optional finalAttrs.doCheck "-DWITH_TESTS=ON";
 
-  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" "-DBUILD_SHARED_LIBS=on" ];
+  # 2 tests are not 32-bit clean: overflow size_t:
+  #   https://github.com/PJK/libcbor/issues/263
+  doCheck =
+    !stdenv.hostPlatform.is32bit
+    && (!stdenv.hostPlatform.isStatic)
+    && stdenv.hostPlatform == stdenv.buildPlatform;
+  nativeCheckInputs = [ cmocka ];
+
+  passthru.tests = {
+    inherit libfido2 mysql80;
+    openssh = (openssh.override { withFIDO = true; });
+    systemd = (systemd.override {
+      withFido2 = true;
+      withCryptsetup = true;
+    });
+  };
 
   meta = with lib; {
     description = "CBOR protocol implementation for C and others";
@@ -24,4 +52,4 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ dtzWill ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 1c03973fff96..700223cd1a79 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -34,6 +34,15 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # present in master
+    (fetchpatch {
+      name = "fix-test-failure-on-ia64-ppc64-riscv64";
+      url = "https://github.com/libjxl/libjxl/commit/bb8eac5d6acec223e44cf8cc72ae02f0816de311.patch";
+      hash = "sha256-DuUCStWEquhWo7bOss0RgZ7ouYE4FpWrIMFywYR424s=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     gtest
diff --git a/pkgs/development/libraries/libmpc/default.nix b/pkgs/development/libraries/libmpc/default.nix
index 8421a2503070..481f12e17526 100644
--- a/pkgs/development/libraries/libmpc/default.nix
+++ b/pkgs/development/libraries/libmpc/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmpc";
-  version = "1.2.1"; # to avoid clash with the MPD client
+  version = "1.3.1"; # to avoid clash with the MPD client
 
   src = fetchurl {
     url = "mirror://gnu/mpc/mpc-${version}.tar.gz";
-    sha256 = "0n846hqfqvmsmim7qdlms0qr86f1hck19p12nq3g3z2x74n3sl0p";
+    sha256 = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index df753b55b08c..91b4a42d54ed 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     sqlite
     libpsl
     glib.out
diff --git a/pkgs/development/libraries/libtheora/default.nix b/pkgs/development/libraries/libtheora/default.nix
index 1e88218aa0d4..0e0030558dba 100644
--- a/pkgs/development/libraries/libtheora/default.nix
+++ b/pkgs/development/libraries/libtheora/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  configureFlags = [ "--disable-examples" ];
+
   outputs = [ "out" "dev" "devdoc" ];
   outputDoc = "devdoc";
 
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index bad8e14d59e4..9f958efe71b3 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-HTwJQpDND4PjiNpUjHtTgkQdkahm2BUe71UDRQpvo6M=";
+    sha256 = "sha256-Vw62xgWzaaWKQWIZDYpVpOgEUQGUNToImEAo6lwiFFU=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 13ad9eb29c2e..dff7abc7dd53 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.2.4";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-XX6qOWlIl8TqOQMiGpmmDVKwQnM1taG6lrqq1ZFVk5s=";
+    hash   = "sha256-nhXkq+qKpaa75YQB/W/cRozslTIFPdXeqj1y6emQeHk=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 2d624256eabd..ed936a9d0377 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxkbcommon";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0fbb2dyjvf71p42y2jmwdcylsvj03w52f5rb23c2d00rwahhfg4l";
+    sha256 = "sha256-Vg8RxLu8oQ9JXz7306aqTKYrT4+wtS59RZ0Yom5G4Bc=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index 7d9e94c6f909..e0a33e27c12c 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -11,7 +11,7 @@
 # files.
 
 stdenv.mkDerivation rec {
-  version = "4.1.1";
+  version = "4.2.0";
   pname = "mpfr";
 
   src = fetchurl {
@@ -19,16 +19,9 @@ stdenv.mkDerivation rec {
       "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
       "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
     ];
-    hash = "sha256-/9GVvVZ9uv/DuYsj/QCq0FN2gMmJYXHkT+P/eeKKwz0=";
+    hash = "sha256-BqN43xNQEkjBsttaqXeiyBJq6Emp2be+JUb7Spwm2ZM=";
   };
 
-  patches = [
-    (fetchurl { # https://gitlab.inria.fr/mpfr/mpfr/-/issues/1
-      url = "https://www.mpfr.org/mpfr-4.1.1/patch01";
-      hash = "sha256-gKPCcJviGsqsEqnMmYiNY6APp3+3VXbyBf6LoZhP9Eo=";
-    })
-  ];
-
   outputs = [ "out" "dev" "doc" "info" ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mtdev/default.nix b/pkgs/development/libraries/mtdev/default.nix
index 4a510762f7f0..9e6a45e2975a 100644
--- a/pkgs/development/libraries/mtdev/default.nix
+++ b/pkgs/development/libraries/mtdev/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, evdev-proto }:
 
 stdenv.mkDerivation rec {
   pname = "mtdev";
@@ -9,8 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1q700h9dqcm3zl6c3gj0qxxjcx6ibw2c51wjijydhwdcm26v5mqm";
   };
 
+  buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD evdev-proto;
+
   meta = with lib; {
-    homepage = "http://bitmath.org/code/mtdev/";
+    homepage = "https://bitmath.org/code/mtdev/";
     description = "Multitouch Protocol Translation Library";
     longDescription = ''
       The mtdev is a stand-alone library which transforms all variants of
@@ -20,6 +22,6 @@ stdenv.mkDerivation rec {
       See the kernel documentation for further details.
     '';
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = with platforms; freebsd ++ linux;
   };
 }
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 2cfe41956a4b..4caf05ef3cfe 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -11,16 +11,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  ver = "6.3";
-  # We pick fresh intermediate release to get a fix for CVE-2022-29458
-  # which was fixed in 20220416 patchset.
-  patchver = "20220507";
-  version = "${ver}-p${patchver}";
+  version = "6.4";
   pname = "ncurses" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   src = fetchurl {
-    url = "https://invisible-island.net/archives/ncurses/current/ncurses-${ver}-${patchver}.tgz";
-    sha256 = "02y4n4my5qqhw3fdhdjv1zc9xpyglzlzmzjwq2zcwbwv738255ja";
+    url = "https://invisible-island.net/archives/ncurses/ncurses-${version}.tar.gz";
+    hash = "sha256-aTEoPZrIfFBz8wtikMTHXyFjK7T8NgOsgQCBK+0kgVk=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 2a3b25bc5827..c3f04cf6b15b 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.79.2";
-  hash = "sha256-hwcHDI74CgYp2vhQyKspKQ6T/O55f6g/cZvb9z1np4E=";
+  version = "3.79.3";
+  hash = "sha256-8fhrlMe832xWYTYVMnZE7MV20W8sMX+5hHDcAcWYSA4=";
 }
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 89227b78f2f7..e1b6abc5b253 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -103,11 +103,14 @@ stdenv.mkDerivation rec {
       runHook postBuild
     '';
 
-  NIX_CFLAGS_COMPILE =
-    "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" "
-    + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1"
-    + lib.optionalString stdenv.hostPlatform.isILP32 " -DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
-  ;
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
+    "-DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\""
+  ] ++ lib.optionals stdenv.hostPlatform.is64bit [
+    "-DNSS_USE_64=1"
+  ] ++ lib.optionals stdenv.hostPlatform.isILP32 [
+    "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
+  ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index e6d9a6d7b89d..662437659147 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fribidi
     libthai
-    gobject-introspection
   ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     ApplicationServices
     Carbon
diff --git a/pkgs/development/libraries/qca-qt5/default.nix b/pkgs/development/libraries/qca-qt5/default.nix
index d10ebbdd4b77..67d916dd14ee 100644
--- a/pkgs/development/libraries/qca-qt5/default.nix
+++ b/pkgs/development/libraries/qca-qt5/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qca-qt5";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchurl {
     url = "http://download.kde.org/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-a2lYgafj/ZX3Oq7m6uq5b2rRflFenCs9SzJy14Yv9cQ=";
+    sha256 = "sha256-kffZFqs2kr9ZkfClU7+BUxYb/doUvQBdSAorTjhDYug=";
   };
 
   buildInputs = [ openssl qtbase ];
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index dd33d9614207..2afe36934a03 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -203,6 +203,7 @@ let
         ++ lib.optional (stdenv.isDarwin) qtmacextras);
 
       qmake = makeSetupHook {
+        name = "qmake-hook";
         deps = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
@@ -211,6 +212,7 @@ let
       } ../hooks/qmake-hook.sh;
 
       wrapQtAppsHook = makeSetupHook {
+        name = "wrap-qt5-apps-hook";
         deps = [ self.qtbase.dev buildPackages.makeWrapper ]
           ++ lib.optional stdenv.isLinux self.qtwayland.dev;
       } ../hooks/wrap-qt-apps-hook.sh;
diff --git a/pkgs/development/libraries/qt-5/5.15/fetch.sh b/pkgs/development/libraries/qt-5/5.15/fetch.sh
index dcada3649078..7225b432c574 100755
--- a/pkgs/development/libraries/qt-5/5.15/fetch.sh
+++ b/pkgs/development/libraries/qt-5/5.15/fetch.sh
@@ -10,7 +10,7 @@ srcs="${here}/srcs-generated.json"
 while read -r module; do
     if [[ -z "$module" ]]; then continue; fi
     url="https://invent.kde.org/qt/qt/${module}.git"
-    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 \
+    nix-prefetch-git --url $url --rev refs/heads/kde/5.15 --fetch-submodules \
         | jq "{key: \"${module}\", value: {url,rev,sha256}}"
 done < "$modules" | jq -s 'from_entries' > "${srcs}.tmp"
 
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 229bfabbece2..3f6c616c3948 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -2,7 +2,7 @@
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
     "rev": "c3c7e6ebc29cce466d954f72f340a257d76b5ec2",
-    "sha256": "0lh05j21acs8wz72g4cs092m1yglpbjkhh55ww1351fjrp5gbzrg"
+    "sha256": "13ixg0gx7sp90k0db2xn7r2rj1w3zw3vs84pav0v8fwfvph9ki98"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
@@ -16,8 +16,8 @@
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "9cf586d629a04040c9414c4f9e17abbc65c644eb",
-    "sha256": "1jvm92m3jz34yvzyn4vnihga2phpgszb2wqk0y7pr0ww6vs9kaf6"
+    "rev": "fa8dee92201448cc4eaa92f222b93d0b044d8ea5",
+    "sha256": "16b0q0anlgmfzbdm0jyakb8cxikrr295pj7avzny26x9609lzqga"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
@@ -36,8 +36,8 @@
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "8defe7bfcae2ac5cb6dc25bfe3678124b09cf6f9",
-    "sha256": "0xzdnrhqalsrc52a326c5baf3si815a4rb2p1a4djyf8anp9wcai"
+    "rev": "05c3f4921d81fb1b0eb497515c24ae56221d1e0a",
+    "sha256": "0101bbpnrj4rp51dcnn2gjcq7vw55g4c8y4lmg2nd5g69whmkl1c"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
@@ -62,7 +62,7 @@
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
     "rev": "f991e28cb0a670597f1955585c76ce8a26ce9e4b",
-    "sha256": "1vflnscqc0jidr68v5ikxr579rx7k5yhdik8dcmnfgvmz3fq4jlz"
+    "sha256": "0bvxjciisq2hixhbxxs68zdwfdyvljy8iq48rnwpynqsdrhh5rma"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
@@ -92,7 +92,7 @@
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
     "rev": "47defc8b33b7bdf1dbf289b65b301fba2def9b1c",
-    "sha256": "1w4f02kch7p2jhn6dlzks6jpfcsm9ik04jnnaw6qvpxpsxwvcaah"
+    "sha256": "0kfwkxln3yz0c5rd1kfjmw0y2drwm1gg2s7f52kajfvg4274ha9c"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
@@ -181,8 +181,8 @@
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "63fb8da1ecf8e48262cd515690cf71a425f92bf5",
-    "sha256": "0kjw5dsgn67897laana4h06czr9g8555jiqf1k3pkzv4fxzcqypn"
+    "rev": "90f3590c3c49a0820462af9a778dd13d8df42244",
+    "sha256": "1dxc3imh8455vy3pggrzjflb2v5382q9ha2fwplybxawld9wdw45"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
@@ -202,6 +202,6 @@
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
     "rev": "3199d91de3f38e5ece3d36bcefe2c33b2c014f3f",
-    "sha256": "1hjw5ymbc1fl4r4lym7n7ilmb953izmvyp6z8g5l8l7cz9sjz4ka"
+    "sha256": "1l6babh2cjqwaqk12cqpkkl2qy909b1fd84p0ab19raw419ncawz"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 4bc04dbefd01..19f36c337e5c 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -14,7 +14,7 @@ let
         fetchgit {
           inherit (args) url rev sha256;
           fetchLFS = false;
-          fetchSubmodules = false;
+          fetchSubmodules = true;
           deepClone = false;
           leaveDotGit = false;
         };
@@ -22,19 +22,6 @@ let
 in
 lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
 // {
-  qt3d = {
-    inherit version;
-    src = fetchgit {
-      url = "https://invent.kde.org/qt/qt/qt3d.git";
-      rev = "c3c7e6ebc29cce466d954f72f340a257d76b5ec2";
-      sha256 = "sha256-KMWZ4N2OO7TBVpcgvQf/gweZRT62i9XABOnq0x94PY4=";
-      fetchLFS = false;
-      fetchSubmodules = true;
-      deepClone = false;
-      leaveDotGit = false;
-    };
-  };
-
   # qtwebkit does not have an official release tarball on the qt mirror and is
   # mostly maintained by the community.
   qtwebkit = rec {
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 9664f005d7ee..b09521e34e3c 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -140,10 +140,12 @@ let
       };
 
       wrapQtAppsHook = makeSetupHook {
+        name = "wrap-qt6-apps-hook";
           deps = [ buildPackages.makeWrapper ];
         } ./hooks/wrap-qt-apps-hook.sh;
 
       qmake = makeSetupHook {
+        name = "qmake6-hook";
         deps = [ self.qtbase.dev ];
         substitutions = {
           inherit debug;
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index ae89c223d2df..ff7009a41ce8 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -127,10 +127,11 @@ stdenv.mkDerivation rec {
     unixODBCDrivers.psql
     unixODBCDrivers.sqlite
     unixODBCDrivers.mariadb
-  ] ++ lib.optionals systemdSupport [
-    systemd
   ] ++ lib.optionals stdenv.isLinux [
     util-linux
+  ] ++ lib.optionals systemdSupport [
+    systemd
+  ] ++ [
     mtdev
     lksctp-tools
     libselinux
@@ -222,8 +223,8 @@ stdenv.mkDerivation rec {
     "-DQT_FEATURE_journald=${if systemdSupport then "ON" else "OFF"}"
     "-DQT_FEATURE_vulkan=ON"
   ] ++ lib.optionals stdenv.isDarwin [
-    # error: 'path' is unavailable: introduced in macOS 10.15
-    "-DQT_FEATURE_cxx17_filesystem=OFF"
+    # build as a set of dynamic libraries
+    "-DFEATURE_framework=OFF"
   ];
 
   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [
@@ -271,7 +272,8 @@ stdenv.mkDerivation rec {
     # fixup .pc file (where to find 'moc' etc.)
     if [ -f "$dev/lib/pkgconfig/Qt6Core.pc" ]; then
       sed -i "$dev/lib/pkgconfig/Qt6Core.pc" \
-        -e "/^bindir=/ c bindir=$dev/bin"
+        -e "/^bindir=/ c bindir=$dev/bin" \
+        -e "/^libexecdir=/ c libexecdir=$dev/libexec"
     fi
 
     patchShebangs $out $dev
diff --git a/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix b/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix
deleted file mode 100644
index 76cc0d3e30ef..000000000000
--- a/pkgs/development/libraries/swift-corelibs-libdispatch/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, clangStdenv
-, fetchFromGitHub
-, cmake
-, ninja
-, libbsd
-, libsystemtap
-}:
-
-let
-  version = "5.5";
-in clangStdenv.mkDerivation {
-  pname = "swift-corelibs-libdispatch";
-  inherit version;
-
-  outputs = [ "out" "dev" "man" ];
-
-  src = fetchFromGitHub {
-    owner = "apple";
-    repo = "swift-corelibs-libdispatch";
-    rev = "swift-${version}-RELEASE";
-    sha256 = "sha256-MbLgmS6qRSRT+2dGqbYTNb5MTM4Wz/grDXFk1kup+jk=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    ninja
-  ];
-
-  buildInputs = [
-    libbsd
-    libsystemtap
-  ];
-
-  meta = {
-    description = "Grand Central Dispatch";
-    homepage = "https://github.com/apple/swift-corelibs-libdispatch";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.cmm ];
-  };
-}
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index e5ea8b17f6aa..9027c14de90c 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -61,7 +61,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     libxml2
     sqlite
diff --git a/pkgs/development/python-modules/cachetools/default.nix b/pkgs/development/python-modules/cachetools/default.nix
index 114c7275f380..08e0b559b0f2 100644
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "cachetools";
-  version = "5.2.0";
+  version = "5.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tkem";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-DheHTD62f1ZxoiS0y0/CzDMHvKGmEiEUAX6oaqTpB78=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1B/vAfGroGABijMWuiKmIkMyjNSp2B3VkH7s1NMlbw0=";
   };
 
   nativeCheckInputs = [
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Extensible memoizing collections and decorators";
     homepage = "https://github.com/tkem/cachetools";
+    changelog = "https://github.com/tkem/cachetools/blob/v${version}/CHANGELOG.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 69353dcaec28..e750bbece81d 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -23,7 +23,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    hypothesis
+    # "hypothesis" indirectly depends on chardet to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index ead0a1b1a5c0..b8cf310a06ee 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -62,7 +62,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     cryptography-vectors
-    hypothesis
+    # "hypothesis" indirectly depends on cryptography to build its documentation
+    (hypothesis.override { enableDocumentation = false; })
     iso8601
     pretend
     py
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 9120017a7da5..5e7930bbc9cd 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.4";
+  version = "1.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-csyDWVvcsAMzgomb0xq0NbVP7qYQpDv9obBGANlwiVI=";
+    hash = "sha256-XQcYYz4MOxWj9QlgM6KuwBaCHjYzGRkQw3cN5WBSnAo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/future/default.nix b/pkgs/development/python-modules/future/default.nix
index a24ea8ab9723..7c4a5507b540 100644
--- a/pkgs/development/python-modules/future/default.nix
+++ b/pkgs/development/python-modules/future/default.nix
@@ -5,16 +5,27 @@
 
 buildPythonPackage rec {
   pname = "future";
-  version = "0.18.2";
+  version = "0.18.3";
+
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b1bead90b70cf6ec3f0710ae53a525360fa360d306a86583adc6bf83a4db537d";
+    hash = "sha256-NKF0Nu0elml6hvnePRWjsL4B2LyN6cHf/Vn7gjTtUwc=";
   };
 
+  pythonImportsCheck = [
+    "future.builtins"
+    "future.moves"
+    "future.standard_library"
+    "past.builtins"
+    "past.translation"
+  ];
+
   doCheck = false;
 
   meta = {
+    changelog = "https://github.com/PythonCharmers/python-future/blob/v${version}/docs/whatsnew.rst";
     description = "Clean single-source support for Python 3 and 2";
     longDescription = ''
       python-future is the missing compatibility layer between Python 2 and
@@ -29,7 +40,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://python-future.org";
     downloadPage = "https://github.com/PythonCharmers/python-future/releases";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ prikhi ];
   };
 }
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 994262a9871a..61b4f87a6793 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -9,11 +9,18 @@
 , pytest-xdist
 , sortedcontainers
 , pythonOlder
+, sphinxHook
+, sphinx-rtd-theme
+, sphinx-hoverxref
+, sphinx-codeautolink
+# Used to break internal dependency loop.
+, enableDocumentation ? true
 }:
 
 buildPythonPackage rec {
   pname = "hypothesis";
   version = "6.61.0";
+  outputs = [ "out" ] ++ lib.optional enableDocumentation "doc";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,8 +32,28 @@ buildPythonPackage rec {
     hash = "sha256-gTcdJaOgP8Nc4fN8UH6+sLedivq5ZNxMRULajFOVnSo=";
   };
 
+  # I tried to package sphinx-selective-exclude, but it throws
+  # error about "module 'sphinx' has no attribute 'directives'".
+  #
+  # It probably has to do with monkey-patching internals of Sphinx.
+  # On bright side, this extension does not introduces new commands,
+  # only changes "::only" command, so we probably okay with stock
+  # implementation.
+  #
+  # I wonder how upstream of "hypothesis" builds documentation.
+  postPatch = ''
+    sed -i -e '/sphinx_selective_exclude.eager_only/ d' docs/conf.py
+  '';
+
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
 
+  nativeBuildInputs = lib.optionals enableDocumentation [
+    sphinxHook
+    sphinx-rtd-theme
+    sphinx-hoverxref
+    sphinx-codeautolink
+  ];
+
   propagatedBuildInputs = [
     attrs
     sortedcontainers
diff --git a/pkgs/development/python-modules/iso8601/default.nix b/pkgs/development/python-modules/iso8601/default.nix
index c3e022cdb38b..af90e739163c 100644
--- a/pkgs/development/python-modules/iso8601/default.nix
+++ b/pkgs/development/python-modules/iso8601/default.nix
@@ -25,7 +25,8 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    hypothesis
+    # "hypothesis" indirectly depends on iso8601 to build its documentation
+    (hypothesis.override { enableDocumentation = false; })
     pytestCheckHook
     pytz
   ];
diff --git a/pkgs/development/python-modules/iteration-utilities/default.nix b/pkgs/development/python-modules/iteration-utilities/default.nix
new file mode 100644
index 000000000000..fd17b76103ba
--- /dev/null
+++ b/pkgs/development/python-modules/iteration-utilities/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildPythonPackage, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "iteration-utilities";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "MSeifert04";
+    repo = "iteration_utilities";
+    rev = "v${version}";
+    sha256 = "sha256-Q/ZuwAf+NPikN8/eltwaUilnLw4DKFm864tUe6GLDak=";
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "iteration_utilities" ];
+
+  meta = with lib; {
+    description = "Utilities based on Pythons iterators and generators";
+    homepage = "https://github.com/MSeifert04/iteration_utilities";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/jinja2-ansible-filters/default.nix b/pkgs/development/python-modules/jinja2-ansible-filters/default.nix
new file mode 100644
index 000000000000..33975ee204ea
--- /dev/null
+++ b/pkgs/development/python-modules/jinja2-ansible-filters/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi
+, jinja2
+, pyyaml
+}:
+
+buildPythonPackage rec {
+  pname = "jinja2-ansible-filters";
+  version = "1.3.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-B8EM9E1wc/TwEQLKEtmi3DG0HUfkxh7ZLvam0mabNWs=";
+  };
+
+  propagatedBuildInputs = [
+    jinja2
+    pyyaml
+  ];
+
+  # no tests include in sdist, and source not available
+  doCheck = false;
+
+  pythonImportsCheck = [ "jinja2_ansible_filters" ];
+
+  meta = with lib; {
+    description = "Jinja2 Ansible Filters";
+    homepage = "https://pypi.org/project/jinja2-ansible-filters/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
new file mode 100644
index 000000000000..57f900c6ab12
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@@ -0,0 +1,43 @@
+{ lib, buildPythonPackage, fetchFromGitHub
+, beautifulsoup4
+, jsbeautifier
+, mkdocs
+, mkdocs-material
+, pymdown-extensions
+, pyyaml
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-mermaid2-plugin";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "fralau";
+    repo = "mkdocs-mermaid2-plugin";
+    rev = "v${version}";
+    sha256 = "sha256-Oe6wkVrsB0NWF+HHeifrEogjxdGPINRDJGkh9p+GoHs=";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    jsbeautifier
+    mkdocs
+    mkdocs-material
+    pymdown-extensions
+    pyyaml
+    requests
+  ];
+
+  # non-traditional python tests (e.g. nodejs based tests)
+  doCheck = false;
+
+  pythonImportsCheck = [ "mermaid2" ];
+
+  meta = with lib; {
+    description = "A MkDocs plugin for including mermaid graphs in markdown sources";
+    homepage = "https://github.com/fralau/mkdocs-mermaid2-plugin";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index ff7bc68dd23c..5640c01d6430 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -77,7 +77,8 @@ in buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest
-    hypothesis
+    # "hypothesis" indirectly depends on numpy to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 50ea51adecb1..4890614ed5a9 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -16,20 +16,20 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.8.2";
+  version = "3.8.4";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = pname;
     rev = version;
-    hash = "sha256-jiyYCjZ6c62zmm4Ge9KbEI8/PtPunu79HVODyoHFdSg=";
+    hash = "sha256-XQBiE8hmLC/AIRt0eJri/ilPHUEYiOxd0onRBQsx+pM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-z1B0oSp37OGJ21Q57UUfmSRfUWLftiiBayN9y6yKNyg=";
+    hash = "sha256-O2W9zO7qHWG+78T+uECICAmecaSIbTTJPktJIPZYElE=";
   };
 
   format = "pyproject";
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Fast, correct Python JSON library supporting dataclasses, datetimes, and numpy";
     homepage = "https://github.com/ijl/orjson";
+    changelog = "https://github.com/ijl/orjson/blob/${version}/CHANGELOG.md";
     license = with licenses; [ asl20 mit ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ misuzu ];
diff --git a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
index b8e386d7c209..7692ab2fceed 100644
--- a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
+++ b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
@@ -5,6 +5,7 @@
 , jinja2
 , markupsafe
 , poetry-core
+, poetry
 , pytestCheckHook
 , pythonOlder
 , tomlkit
@@ -37,8 +38,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    poetry
   ];
 
+  # virtualenv: error: argument dest: the destination . is not write-able at /
+  doCheck = false;
+
   disabledTests = [
     # these require .git, but leaveDotGit = true doesn't help
     "test__get_version__defaults"
diff --git a/pkgs/development/python-modules/pysvn/default.nix b/pkgs/development/python-modules/pysvn/default.nix
index fc8bdc2ab0d1..db7848a9282a 100644
--- a/pkgs/development/python-modules/pysvn/default.nix
+++ b/pkgs/development/python-modules/pysvn/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "pysvn";
-  version = "1.9.18";
+  version = "1.9.20";
   format = "other";
 
   src = fetchurl {
-    url = "https://pysvn.barrys-emacs.org/source_kits/${pname}-${version}.tar.gz";
-    hash = "sha256-lUPsNumMYwZoiR1Gt/hqdLLoHOZybRxwvu9+eU1CY78=";
+    url = "mirror://sourceforge/project/pysvn/pysvn/V${version}/pysvn-${version}.tar.gz";
+    hash = "sha256-LbAz+KjEY3nkSJAzJNwlnSRYoWr4i1ITRUPV3ZBH7cc=";
   };
 
   patches = [
@@ -62,8 +62,7 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  # FIXME https://github.com/NixOS/nixpkgs/issues/175227
-  # pythonImportsCheck = [ "pysvn" ];
+  pythonImportsCheck = [ "pysvn" ];
 
   installPhase = ''
     dest=$(toPythonPath $out)/pysvn
diff --git a/pkgs/development/python-modules/pytest-benchmark/default.nix b/pkgs/development/python-modules/pytest-benchmark/default.nix
index b9def8d834af..6fd0cefb51c3 100644
--- a/pkgs/development/python-modules/pytest-benchmark/default.nix
+++ b/pkgs/development/python-modules/pytest-benchmark/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-benchmark";
-  version = "3.4.1";
+  version = "4.0.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ionelmc";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qc/8Epax5bPUZvhq42xSj6NUq0T4gbO5dDDS6omWBOU=";
+    hash = "sha256-f9Ty4+5PycraxoLUSa9JFusV5Cot6bBWKfOGHZIRR3o=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pyyaml-include/default.nix b/pkgs/development/python-modules/pyyaml-include/default.nix
new file mode 100644
index 000000000000..e6effdd72740
--- /dev/null
+++ b/pkgs/development/python-modules/pyyaml-include/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchPypi
+, pytestCheckHook
+, pyyaml
+, setuptools-scm
+, setuptools-scm-git-archive
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "pyyaml-include";
+  version = "1.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-9/vrjnG1C+Dm4HRy98edv7GhW63pyToHg2n/SeV+Z3E=";
+  };
+
+  nativeBuildInputs = [
+    pyyaml
+    setuptools-scm
+    setuptools-scm-git-archive
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "yamlinclude" ];
+
+  meta = with lib; {
+    description = "Extending PyYAML with a custom constructor for including YAML files within YAML files";
+    homepage = "https://github.com/tanbro/pyyaml-include";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 8f68f1459e55..dfa4b16c8e98 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -18,21 +18,18 @@
 
 buildPythonPackage rec {
   pname = "requests";
-  version = "2.28.1";
+  version = "2.28.2";
   format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   __darwinAllowLocalNetworking = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fFWZsQL+3apmHIJsVqtP7ii/0X9avKHrvj5/GdfJeYM=";
+    hash = "sha256-mLGyeC48bEkEk4uEwOuTJyEGnf25E0MTvv98g8LfJL8=";
   };
 
-  patches = [
-    ./relax-charset-normalizer.patch
-  ];
-
   propagatedBuildInputs = [
     brotlicffi
     certifi
@@ -90,6 +87,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "HTTP library for Python";
     homepage = "http://docs.python-requests.org/";
+    changelog = "https://github.com/psf/requests/blob/v${version}/HISTORY.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/requests/relax-charset-normalizer.patch b/pkgs/development/python-modules/requests/relax-charset-normalizer.patch
deleted file mode 100644
index ef14c09fffb8..000000000000
--- a/pkgs/development/python-modules/requests/relax-charset-normalizer.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 54ae822ce968f49a4d5a10e30c5d75e76c887fe4 Mon Sep 17 00:00:00 2001
-From: deedy5 <65482418+deedy5@users.noreply.github.com>
-Date: Thu, 20 Oct 2022 18:26:18 +0000
-Subject: [PATCH] Allow charset normalizer >=2 and <4 (#6261)
-
----
- requests/__init__.py | 4 ++--
- setup.cfg            | 2 +-
- setup.py             | 2 +-
- 3 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/requests/__init__.py b/requests/__init__.py
-index 7ac8e29..22db3c1 100644
---- a/requests/__init__.py
-+++ b/requests/__init__.py
-@@ -80,8 +80,8 @@ def check_compatibility(urllib3_version, chardet_version, charset_normalizer_ver
-     elif charset_normalizer_version:
-         major, minor, patch = charset_normalizer_version.split(".")[:3]
-         major, minor, patch = int(major), int(minor), int(patch)
--        # charset_normalizer >= 2.0.0 < 3.0.0
--        assert (2, 0, 0) <= (major, minor, patch) < (3, 0, 0)
-+        # charset_normalizer >= 2.0.0 < 4.0.0
-+        assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)
-     else:
-         raise Exception("You need either charset_normalizer or chardet installed")
- 
-diff --git a/setup.cfg b/setup.cfg
-index 93d1f99..ea45aaf 100644
---- a/setup.cfg
-+++ b/setup.cfg
-@@ -5,7 +5,7 @@ provides-extra =
- 	use_chardet_on_py3
- requires-dist = 
- 	certifi>=2017.4.17
--	charset_normalizer>=2,<3
-+	charset_normalizer>=2,<4
- 	idna>=2.5,<4
- 	urllib3>=1.21.1,<1.27
- 
-diff --git a/setup.py b/setup.py
-index 23977ed..092b40d 100755
---- a/setup.py
-+++ b/setup.py
-@@ -59,7 +59,7 @@ if sys.argv[-1] == "publish":
-     sys.exit()
- 
- requires = [
--    "charset_normalizer>=2,<3",
-+    "charset_normalizer>=2,<4",
-     "idna>=2.5,<4",
-     "urllib3>=1.21.1,<1.27",
-     "certifi>=2017.4.17",
--- 
-2.38.1
-
diff --git a/pkgs/development/python-modules/simplejson/default.nix b/pkgs/development/python-modules/simplejson/default.nix
index a58cf5818b72..381c7688be18 100644
--- a/pkgs/development/python-modules/simplejson/default.nix
+++ b/pkgs/development/python-modules/simplejson/default.nix
@@ -1,19 +1,23 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, stdenv
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "simplejson";
-  version = "3.18.0";
+  version = "3.18.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-X1lD/kCbKDPPgpr2deoVbC5LADqBlNZHvDg7206E9ZE=";
+    hash = "sha256-m5V1wmqkPxZBH25vWajztwa3HF4KtH+HXXs4TCecTm8=";
   };
 
   nativeCheckInputs = [
@@ -22,7 +26,9 @@ buildPythonPackage rec {
 
   doCheck = !stdenv.isDarwin;
 
-  pythonImportsCheck = [ "simplejson" ];
+  pythonImportsCheck = [
+    "simplejson"
+  ];
 
   meta = with lib; {
     description = "Extensible JSON encoder/decoder for Python";
@@ -33,6 +39,7 @@ buildPythonPackage rec {
       for unicode characters).
     '';
     homepage = "https://github.com/simplejson/simplejson";
+    changelog = "https://github.com/simplejson/simplejson/blob/v${version}/CHANGES.txt";
     license = with licenses; [ mit afl21 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/sphinx-codeautolink/default.nix b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
new file mode 100644
index 000000000000..c9dcec606fa1
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-codeautolink/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-rtd-theme
+, matplotlib
+, ipython
+# runtime dependencies
+, sphinx
+, beautifulsoup4
+# check dependencies
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-codeautolink";
+  version = "0.12.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "felix-hilden";
+    repo = "sphinx-codeautolink";
+    rev = "v${version}";
+    hash = "sha256-x81jhYknJ6lsLxR5ZyuYNNz/zt0kto6bNyaeZmPKDIE=";
+  };
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+    sphinx-rtd-theme
+    matplotlib
+    ipython
+  ];
+
+  sphinxRoot = "docs/src";
+
+  propagatedBuildInputs = [ sphinx beautifulsoup4 ];
+
+  nativeCheckInputs = [ pytest ];
+
+  pythonImportsCheck = [ "sphinx_codeautolink" ];
+
+  meta = with lib; {
+    description = "A sphinx extension that makes code examples clickable";
+    homepage = "https://github.com/felix-hilden/sphinx-codeautolink";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-hoverxref/default.nix b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
new file mode 100644
index 000000000000..c606297e1afc
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-notfound-page
+, sphinx-prompt
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinx-version-warning
+, sphinxcontrib-autoapi
+, sphinxcontrib-bibtex
+, sphinxemoji
+# runtime dependencies
+, sphinx
+, sphinx-jquery
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-hoverxref";
+  version = "1.3.0";
+  format = "flit";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "readthedocs";
+    repo = "sphinx-hoverxref";
+    rev = version;
+    hash = "sha256-DJ+mHu9IeEYEyf/SD+nDNtWpTf6z7tQzG0ogaECDpkU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonImportsCheckHook
+
+    sphinxHook
+    sphinx-notfound-page
+    sphinx-prompt
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinx-version-warning
+    sphinxcontrib-autoapi
+    sphinxcontrib-bibtex
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx sphinx-jquery ];
+
+  pythonImportsCheck = [ "hoverxref" ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating tooltips on the cross references of the documentation";
+    longDescription = ''
+      sphinx-hoverxref is a Sphinx extension to show a floating window
+      (tooltips or modal dialogues) on the cross references of the
+      documentation embedding the content of the linked section on them.
+
+      With sphinx-hoverxref, you don’t need to click a link to see what’s
+      in there.
+    '';
+    homepage = "https://github.com/readthedocs/sphinx-hoverxref";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-jquery/default.nix b/pkgs/development/python-modules/sphinx-jquery/default.nix
new file mode 100644
index 000000000000..6bbf8687f5a1
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-jquery/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-jquery";
+  version = "3.0.0";
+  format = "flit";
+
+  src = fetchFromGitHub {
+    owner = "sphinx-contrib";
+    repo = "jquery";
+    rev = "v${version}";
+    hash = "sha256-argG+jMUqLiWo4lKWAmHmUxotHl+ddJuJZ/zcUl9u5Q=";
+  };
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    flit-core
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "sphinxcontrib.jquery" ];
+
+  meta = with lib; {
+    description = "A sphinx extension that ensures that jQuery is installed for use in Sphinx themes or extensions";
+    homepage = "https://github.com/sphinx-contrib/jquery";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-notfound-page/default.nix b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
new file mode 100644
index 000000000000..dd2efe81fd15
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-notfound-page/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, flit-core
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+, sphinx-prompt
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinxcontrib-autoapi
+, sphinxemoji
+# runtime dependencies
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-notfound-page";
+  version = "0.8.3";
+  format = "flit";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "readthedocs";
+    repo = "sphinx-notfound-page";
+    rev = version;
+    hash = "sha256-9iP6X2dqtMC3+CIrNI3fGDLL8xyXVAWNhN90DlMa9JU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+    pythonImportsCheckHook
+    sphinxHook
+    sphinx-prompt
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinxcontrib-autoapi
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "notfound" ];
+
+  meta = with lib; {
+    description = "A sphinx extension to create a custom 404 page with absolute URLs hardcoded";
+    homepage = "https://github.com/readthedocs/sphinx-notfound-page";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
new file mode 100644
index 000000000000..cc5d5f0b2eca
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, sphinxHook
+, sphinx
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-prompt";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "sbrunner";
+    repo = "sphinx-prompt";
+    rev = version;
+    hash = "sha256-ClUPAIyPrROJw4GXeakA8U443Vlhy3P/2vFnAtyrPHU=";
+  };
+
+  propagatedBuildInputs = [ sphinx ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating unselectable prompt";
+    homepage = "https://github.com/sbrunner/sphinx-prompt";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-tabs/default.nix b/pkgs/development/python-modules/sphinx-tabs/default.nix
new file mode 100644
index 000000000000..a2714c2d1260
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-tabs/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonImportsCheckHook
+# documentation build dependencies
+, sphinxHook
+# runtime dependencies
+, sphinx
+, pygments
+, docutils
+# test dependencies
+, pytest
+, beautifulsoup4
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-tabs";
+  version = "3.4.1";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "executablebooks";
+    repo = "sphinx-tabs";
+    rev = "v${version}";
+    hash = "sha256-5lpo7NRCksXJOdbLSFjDxQV/BsxRBb93lA6tavz6YEs=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace 'docutils~=0.18.0' 'docutils'
+  '';
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+  ];
+
+  propagatedBuildInputs = [
+    sphinx
+    pygments
+    docutils
+  ];
+
+  nativeCheckInputs = [ pytest
+    beautifulsoup4
+  ];
+
+  pythonImportsCheck = [ "sphinx_tabs" ];
+
+  meta = with lib; {
+    description = "A sphinx extension for creating tabbed content when building HTML.";
+    homepage = "https://github.com/executablebooks/sphinx-tabs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-version-warning/default.nix b/pkgs/development/python-modules/sphinx-version-warning/default.nix
new file mode 100644
index 000000000000..bf57d4f2fd83
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-version-warning/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, pythonImportsCheckHook
+, sphinx
+, sphinxHook
+, sphinxcontrib-autoapi
+, sphinx-rtd-theme
+, sphinx-tabs
+, sphinx-prompt
+, sphinxemoji
+}:
+
+# Latest tagged release release "1.1.2" (Nov 2018) does not contain
+# documenation, it was added in commits Aug 10, 2019. Repository does not have
+# any activity since then.
+buildPythonPackage rec {
+  pname = "sphinx-version-warning";
+  version = "unstable-2019-08-10";
+  outputs = [ "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "humitos";
+    repo = "sphinx-version-warning";
+    rev = "a82156c2ea08e5feab406514d0ccd9d48a345f48";
+    hash = "sha256-WnJYMk1gPLT0dBn7lmxVDNVkLYkDCgQOtM9fQ3kc6k0=";
+  };
+
+  # It tries to write to file relative to it own location at runtime
+  # and gets permission denied, since Nix store is immutable.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/humitos/sphinx-version-warning/commit/cb1b47becf2a0d3b2570ca9929f42f7d7e472b6f.patch";
+      hash = "sha256-Vj0QAHIBmc0VxE+TTmJePzvr5nc45Sn2qqM+C/pkgtM=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pythonImportsCheckHook
+    sphinxHook
+    sphinxcontrib-autoapi
+    sphinx-rtd-theme
+    sphinx-tabs
+    sphinx-prompt
+    sphinxemoji
+  ];
+
+  propagatedBuildInputs = [ sphinx ];
+
+  pythonImportsCheck = [ "versionwarning" ];
+
+  meta = with lib; {
+    description = "A sphinx extension to show a warning banner at the top of your documentation";
+    homepage = "https://github.com/humitos/sphinx-version-warning";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kaction ];
+  };
+}
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 49a8ca0c9971..0f0f455a4235 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -143,7 +143,8 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     git
     glibcLocales
-    hypothesis
+    # "hypothesis" indirectly depends on twisted to build its documentation.
+    (hypothesis.override { enableDocumentation = false; })
     pyhamcrest
   ]
   ++ passthru.optional-dependencies.conch
diff --git a/pkgs/development/tools/build-managers/wafHook/default.nix b/pkgs/development/tools/build-managers/wafHook/default.nix
index 2131caede3c8..f0f3a683aab0 100644
--- a/pkgs/development/tools/build-managers/wafHook/default.nix
+++ b/pkgs/development/tools/build-managers/wafHook/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, pkgs, makeSetupHook, waf }:
 
 makeSetupHook {
+  name = "waf-hook";
   substitutions = {
     inherit waf;
     crossFlags = lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system)
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 4f9a92d362bc..161dca6f1805 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -22,9 +22,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl autoconf ];
   buildInputs = [ autoconf ];
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 11 of 782 tests
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
diff --git a/pkgs/development/tools/misc/automake/automake-1.15.x.nix b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
index 470827c2b45e..f0df759ee2cf 100644
--- a/pkgs/development/tools/misc/automake/automake-1.15.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.15.x.nix
@@ -16,9 +16,6 @@ stdenv.mkDerivation rec {
 
   patches = [ ./help2man-SOURCE_DATE_EPOCH-support.patch ];
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
   doInstallCheck = false; # runs the same thing, fails the same tests
 
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 65d6185f50c0..0d9572c6f314 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   setupHook = ./setup-hook.sh;
 
-  # Disable indented log output from Make, otherwise "make.test" will
-  # fail.
-  preCheck = "unset NIX_INDENT_MAKE";
   doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
   doInstallCheck = false; # runs the same thing, fails the same tests
 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 3d53c5122f00..39e852a60bbb 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -15,7 +15,6 @@ in
 , noSysDirs
 , perl
 , substitute
-, texinfo
 , zlib
 
 , enableGold ? withGold stdenv.targetPlatform
@@ -52,7 +51,7 @@ let
   targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
 in
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = targetPrefix + "binutils";
   inherit version;
 
@@ -110,10 +109,12 @@ stdenv.mkDerivation {
 
   strictDeps = true;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
+  # texinfo was removed here in https://github.com/NixOS/nixpkgs/pull/210132
+  # to reduce rebuilds during stdenv bootstrap.  Please don't add it back without
+  # checking the impact there first.
   nativeBuildInputs = [
     bison
     perl
-    texinfo
   ]
   ++ lib.optionals targetPlatform.isiOS [ autoreconfHook ]
   ++ lib.optionals buildPlatform.isDarwin [ autoconf269 automake gettext libtool ]
@@ -144,6 +145,20 @@ stdenv.mkDerivation {
     for i in binutils/Makefile.in gas/Makefile.in ld/Makefile.in gold/Makefile.in; do
         sed -i "$i" -e 's|ln |ln -s |'
     done
+
+    # autoreconfHook is not included for all targets.
+    # Call it here explicitly as well.
+    ${finalAttrs.postAutoreconf}
+  '';
+
+  postAutoreconf = ''
+    # As we regenerated configure build system tries hard to use
+    # texinfo to regenerate manuals. Let's avoid the dependency
+    # on texinfo in bootstrap path and keep manuals unmodified.
+    touch gas/doc/.dirstamp
+    touch gas/doc/asconfig.texi
+    touch gas/doc/as.1
+    touch gas/doc/as.info
   '';
 
   # As binutils takes part in the stdenv building, we don't want references
@@ -226,4 +241,4 @@ stdenv.mkDerivation {
     # collision due to the ld/as wrappers/symlinks in the latter.
     priority = 10;
   };
-}
+})
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index 87271cf50ffa..ec43a3932d92 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -37,6 +37,18 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
+    (fetchpatch {
+      name = "use-curlopt_protocols_str-for-new-libcurl.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=6560fb26a62ef135a804357ef4f15a47de3e49b3;hp=a5b07cdf9c491fb7a4a16598c482c68b718f59b9";
+      excludes = [ "debuginfod/ChangeLog" ]; # Doesn't apply
+      sha256 = "sha256-yjeliqojRGvfwbXynmxFGyKqAY7AEr0mbSGQEliYhZ4=";
+    })
+    (fetchpatch {
+      name = "fix-usage-of-deprecated-curlinfo.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=d2bf497b12fbd49b4996ccf0744303ffd67735b1;hp=6ecd16410ce1fe5cb0ac5b7c3342c5cc330e3a04";
+      excludes = [ "debuginfod/ChangeLog" ]; # Doesn't apply
+      sha256 = "sha256-zMx/TazM7vXJre2XagIWvwRS8cd8pbzMTmAbpbqZmx0=";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 8625a421af64..a2c58010eff7 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, autoconf, automake, m4, perl, help2man
+{ lib, stdenv, fetchurl, fetchpatch, m4
 , runtimeShell
 , file
 }:
@@ -23,28 +23,22 @@ stdenv.mkDerivation rec {
   #   https://lists.gnu.org/archive/html/autotools-announce/2022-03/msg00000.html
   FILECMD = "${file}/bin/file";
 
-  # Normally we'd use autoreconfHook, but that includes libtoolize.
-  postPatch = ''
-    aclocal -I m4
-    automake
-    autoconf
-
-    pushd libltdl
-    aclocal -I ../m4
-    automake
-    autoconf
-    popd
-  '' +
+  postPatch =
   # libtool commit da2e352735722917bf0786284411262195a6a3f6 changed
   # the shebang from `/bin/sh` (which is a special sandbox exception)
   # to `/usr/bin/env sh`, meaning that we now need to patch shebangs
   # in libtoolize.in:
   ''
     substituteInPlace libtoolize.in       --replace '#! /usr/bin/env sh' '#!${runtimeShell}'
+    # avoid help2man run after 'libtoolize.in' update
+    touch doc/libtoolize.1
   '';
 
   strictDeps = true;
-  nativeBuildInputs = [ autoconf automake help2man m4 perl ];
+  # As libtool is an early bootstrap dependency try hard not to
+  # add autoconf and automake or help2man dependencies here. That way we can
+  # avoid pulling in perl and get away with just an `m4` depend.
+  nativeBuildInputs = [ m4 file ];
   propagatedBuildInputs = [ m4 file ];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index ac80fc471e06..017367e90ba6 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -6,13 +6,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "lsof";
-  version = "4.96.4";
+  version = "4.96.5";
 
   src = fetchFromGitHub {
     owner = "lsof-org";
     repo = "lsof";
     rev = version;
-    sha256 = "sha256-S+8KizjayqeiWsMySWjRoZQf7ODCjdMq5ULoetOdYiA=";
+    hash = "sha256-3ZEGCKc7inbqcE4LuhfKON3C8LebVOlZPEhOHVgx8Lo=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/patchelf/setup-hook.sh b/pkgs/development/tools/misc/patchelf/setup-hook.sh
index 576b9ca2103e..8f010a3f4d0b 100644
--- a/pkgs/development/tools/misc/patchelf/setup-hook.sh
+++ b/pkgs/development/tools/misc/patchelf/setup-hook.sh
@@ -8,7 +8,7 @@ patchELF() {
     local dir="$1"
     [ -e "$dir" ] || return 0
 
-    header "shrinking RPATHs of ELF executables and libraries in $dir"
+    echo "shrinking RPATHs of ELF executables and libraries in $dir"
 
     local i
     while IFS= read -r -d $'\0' i; do
@@ -17,6 +17,4 @@ patchELF() {
         echo "shrinking $i"
         patchelf --shrink-rpath "$i" || true
     done < <(find "$dir" -type f -print0)
-
-    stopNest
 }
diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index f2721ab952c6..360e50aef187 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     rm -f check/check-requires-private check/check-gtk check/missing
   '';
 
-  buildInputs = optional (stdenv.isCygwin || stdenv.isDarwin || stdenv.isSunOS) libiconv;
+  buildInputs = [ libiconv ];
 
   configureFlags = [ "--with-internal-glib" ]
     ++ optionals (stdenv.isSunOS) [ "--with-libiconv=gnu" "--with-system-library-path" "--with-system-include-path" "CFLAGS=-DENABLE_NLS" ]
diff --git a/pkgs/development/tools/swiftpm2nix/default.nix b/pkgs/development/tools/swiftpm2nix/default.nix
new file mode 100644
index 000000000000..25d6b06ef98b
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, callPackage, makeWrapper, jq, nix-prefetch-git }:
+
+stdenv.mkDerivation {
+  name = "swiftpm2nix";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    install -vD ${./swiftpm2nix.sh} $out/bin/swiftpm2nix
+    wrapProgram $out/bin/$name \
+      --prefix PATH : ${lib.makeBinPath [ jq nix-prefetch-git ]} \
+  '';
+
+  preferLocalBuild = true;
+
+  passthru = callPackage ./support.nix { };
+
+  meta = {
+    description = "Generate a Nix expression to fetch swiftpm dependencies";
+    maintainers = with lib.maintainers; [ dtzWill trepetti dduan trundle stephank ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/swiftpm2nix/support.nix b/pkgs/development/tools/swiftpm2nix/support.nix
new file mode 100644
index 000000000000..94076517ebfc
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/support.nix
@@ -0,0 +1,56 @@
+{ lib, fetchgit, formats }:
+with lib;
+let
+  json = formats.json { };
+in rec {
+
+  # Derive a pin file from workspace state.
+  mkPinFile = workspaceState:
+    assert workspaceState.version == 5;
+    json.generate "Package.resolved" {
+      version = 1;
+      object.pins = map (dep: {
+        package = dep.packageRef.name;
+        repositoryURL = dep.packageRef.location;
+        state = dep.state.checkoutState;
+      }) workspaceState.object.dependencies;
+    };
+
+  # Make packaging helpers from swiftpm2nix generated output.
+  helpers = generated: let
+    inherit (import generated) workspaceStateFile hashes;
+    workspaceState = builtins.fromJSON (builtins.readFile workspaceStateFile);
+    pinFile = mkPinFile workspaceState;
+  in rec {
+
+    # Create fetch expressions for dependencies.
+    sources = listToAttrs (
+      map (dep: nameValuePair dep.subpath (fetchgit {
+        url = dep.packageRef.location;
+        rev = dep.state.checkoutState.revision;
+        sha256 = hashes.${dep.subpath};
+      })) workspaceState.object.dependencies
+    );
+
+    # Configure phase snippet for use in packaging.
+    configure = ''
+      mkdir -p .build/checkouts
+      ln -sf ${pinFile} ./Package.resolved
+      install -m 0600 ${workspaceStateFile} ./.build/workspace-state.json
+    ''
+      + concatStrings (mapAttrsToList (name: src: ''
+        ln -s '${src}' '.build/checkouts/${name}'
+      '') sources)
+      + ''
+        # Helper that makes a swiftpm dependency mutable by copying the source.
+        swiftpmMakeMutable() {
+          local orig="$(readlink .build/checkouts/$1)"
+          rm .build/checkouts/$1
+          cp -r "$orig" .build/checkouts/$1
+          chmod -R u+w .build/checkouts/$1
+        }
+      '';
+
+  };
+
+}
diff --git a/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh b/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh
new file mode 100755
index 000000000000..72051b4e448d
--- /dev/null
+++ b/pkgs/development/tools/swiftpm2nix/swiftpm2nix.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Generates a Nix expression to fetch swiftpm dependencies, and a
+# configurePhase snippet to prepare a working directory for swift-build.
+
+set -eu -o pipefail
+shopt -s lastpipe
+
+stateFile=".build/workspace-state.json"
+if [[ ! -f "$stateFile" ]]; then
+  echo >&2 "Missing $stateFile. Run 'swift package resolve' first."
+  exit 1
+fi
+
+if [[ "$(jq .version $stateFile)" != "5" ]]; then
+  echo >&2 "Unsupported $stateFile version"
+  exit 1
+fi
+
+# Iterate dependencies and prefetch.
+hashes=""
+jq -r '.object.dependencies[] | "\(.subpath) \(.packageRef.location) \(.state.checkoutState.revision)"' $stateFile \
+| while read -r name url rev; do
+  echo >&2 "-- Fetching $name"
+  sha256="$(nix-prefetch-git $url $rev | jq -r .sha256)"
+  hashes+="
+    \"$name\" = \"$sha256\";"
+  echo >&2
+done
+hashes+=$'\n'"  "
+
+# Generate output.
+mkdir -p nix
+# Copy the workspace state, but clear 'artifacts'.
+jq '.object.artifacts = []' < $stateFile > nix/workspace-state.json
+# Build an expression for fetching sources, and preparing the working directory.
+cat > nix/default.nix << EOF
+# This file was generated by swiftpm2nix.
+{
+  workspaceStateFile = ./workspace-state.json;
+  hashes = {$hashes};
+}
+EOF
+echo >&2 "-- Generated ./nix"
diff --git a/pkgs/development/tools/xcbuild/sdks.nix b/pkgs/development/tools/xcbuild/sdks.nix
index 5ff3ca6808dc..e1b8254d7fd8 100644
--- a/pkgs/development/tools/xcbuild/sdks.nix
+++ b/pkgs/development/tools/xcbuild/sdks.nix
@@ -2,7 +2,7 @@
 , writeText, version, xcodePlatform }:
 
 let
-  inherit (lib.generators) toPlist;
+  inherit (lib.generators) toPlist toJSON;
 
   SDKSettings = {
     CanonicalName = sdkName;
@@ -22,6 +22,7 @@ in
 runCommand "SDKs" {} ''
   sdk=$out/${sdkName}.sdk
   install -D ${writeText "SDKSettings.plist" (toPlist {} SDKSettings)} $sdk/SDKSettings.plist
+  install -D ${writeText "SDKSettings.json" (toJSON {} SDKSettings)} $sdk/SDKSettings.json
   install -D ${writeText "SystemVersion.plist" (toPlist {} SystemVersion)} $sdk/System/Library/CoreServices/SystemVersion.plist
   ln -s $sdk $sdk/usr
 
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index 2dbea4e3833a..35eddd40f859 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -77,7 +77,7 @@ while [ $# -gt 0 ]; do
          --toolchain | -toolchain) shift ;;
          --find | -find | -f)
            shift
-           command -v $1 ;;
+           command -v $1 || exit 1 ;;
          --log | -log) ;; # noop
          --verbose | -verbose) ;; # noop
          --no-cache | -no-cache) ;; # noop
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
index 59c897ba3713..d9cc93e82348 100644
--- a/pkgs/games/openra/common.nix
+++ b/pkgs/games/openra/common.nix
@@ -12,7 +12,9 @@ with lib;
 let
   path = makeBinPath ([ mono python3 ] ++ optional (zenity != null) zenity);
   rpath = makeLibraryPath [ lua freetype openal SDL2 ];
-  mkdirp = makeSetupHook { } ./mkdirp.sh;
+  mkdirp = makeSetupHook {
+    name = "openra-mkdirp-hook";
+  } ./mkdirp.sh;
 
 in {
   patchEngine = dir: version: ''
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index 3a53916a46de..e7252ab35e63 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -2,7 +2,7 @@
 , makeScopeWithSplicing, generateSplicesForMkScope
 , buildPackages
 , bsdSetupHook, makeSetupHook
-, fetchgit, fetchurl, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
+, fetchgit, fetchzip, coreutils, groff, mandoc, byacc, flex, which, m4, gawk, substituteAll, runtimeShell
 , zlib, expat, libmd
 , runCommand, writeShellScript, writeText, symlinkJoin
 }:
@@ -75,6 +75,11 @@ in makeScopeWithSplicing
   in {
   inherit freebsdSrc;
 
+  ports = fetchzip {
+    url = "https://cgit.freebsd.org/ports/snapshot/ports-dde3b2b456c3a4bdd217d0bf3684231cc3724a0a.tar.gz";
+    sha256 = "BpHqJfnGOeTE7tkFJBx0Wk8ryalmf4KNTit/Coh026E=";
+  };
+
   # Why do we have splicing and yet do `nativeBuildInputs = with self; ...`?
   # See note in ../netbsd/default.nix.
 
@@ -388,6 +393,12 @@ in makeScopeWithSplicing
     outputs = [ "out" "man" "test" ];
   };
 
+  sed = mkDerivation {
+    path = "usr.bin/sed";
+    TESTSRC = "${freebsdSrc}/contrib/netbsd-tests";
+    MK_TESTS = "no";
+  };
+
   # Don't add this to nativeBuildInputs directly.  Use statHook instead.
   stat = mkDerivation {
     path = "usr.bin/stat";
diff --git a/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
new file mode 100644
index 000000000000..3c3dcb6d5d67
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/evdev-proto/default.nix
@@ -0,0 +1,64 @@
+{ lib, stdenv, linuxHeaders, freebsd, runCommandCC, buildPackages }:
+
+stdenv.mkDerivation {
+  pname = "evdev-proto";
+  inherit (linuxHeaders) version;
+
+  src = freebsd.ports;
+
+  sourceRoot = "source/devel/evdev-proto";
+
+  useTempPrefix = true;
+
+  nativeBuildInputs = [ freebsd.makeMinimal ];
+
+  ARCH = freebsd.makeMinimal.MACHINE_ARCH;
+  OPSYS = "FreeBSD";
+  _OSRELEASE = "${lib.versions.majorMinor freebsd.makeMinimal.version}-RELEASE";
+
+  AWK = "awk";
+  CHMOD = "chmod";
+  FIND = "find";
+  MKDIR = "mkdir -p";
+  PKG_BIN = "${buildPackages.pkg}/bin/pkg";
+  RM = "rm -f";
+  SED = "${buildPackages.freebsd.sed}/bin/sed";
+  SETENV = "env";
+  SH = "sh";
+  TOUCH = "touch";
+  XARGS = "xargs";
+
+  ABI_FILE = runCommandCC "abifile" {} "$CC -shared -o $out";
+  CLEAN_FETCH_ENV = true;
+  INSTALL_AS_USER = true;
+  NO_CHECKSUM = true;
+  NO_MTREE = true;
+  SRC_BASE = freebsd.freebsdSrc;
+
+  preUnpack = ''
+    export MAKE_JOBS_NUMBER="$NIX_BUILD_CORES"
+
+    export DISTDIR="$PWD/distfiles"
+    export PKG_DBDIR="$PWD/pkg"
+    export PREFIX="$prefix"
+
+    mkdir -p "$DISTDIR/evdev-proto"
+    tar -C "$DISTDIR/evdev-proto" \
+        -xf ${linuxHeaders.src} \
+        --strip-components 4 \
+        linux-${linuxHeaders.version}/include/uapi/linux
+  '';
+
+  makeFlags = [ "DIST_SUBDIR=evdev-proto" ];
+
+  postInstall = ''
+    mv $prefix $out
+  '';
+
+  meta = with lib; {
+    description = "Input event device header files for FreeBSD";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = platforms.freebsd;
+    license = licenses.gpl2Only;
+  };
+}
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 8903db9f36b7..1033927ce675 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -680,6 +680,13 @@ in makeScopeWithSplicing
   ##
   ## START LIBRARIES
   ##
+  libarch = mkDerivation {
+    path = "lib/libarch";
+    version = "9.2";
+    sha256 = "6ssenRhuSwp0Jn71ErT0PrEoCJ+cIYRztwdL4QTDZsQ=";
+    meta.platforms = lib.platforms.netbsd;
+  };
+
   libutil = mkDerivation {
     path = "lib/libutil";
     version = "9.2";
@@ -809,6 +816,16 @@ in makeScopeWithSplicing
     meta.platforms = lib.platforms.netbsd;
   };
 
+  libpci = mkDerivation {
+    pname = "libpci";
+    path = "lib/libpci";
+    version = "9.2";
+    sha256 = "+IOEO1Bw3/H3iCp3uk3bwsFZbvCqN5Ciz70irnPl8E8=";
+    NIX_CFLAGS_COMPILE = [ "-I." ];
+    meta.platforms = lib.platforms.netbsd;
+    extraPaths = with self; [ sys.src ];
+  };
+
   libpthread-headers = mkDerivation {
     pname = "libpthread-headers";
     path = "lib/libpthread";
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
index d7ac5d9fd904..839548ae8ffd 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix
@@ -45,12 +45,20 @@ let
 
         cp -r ${MacOSX-SDK}${standardFrameworkPath name private} $out/Library/Frameworks
 
+        if [[ -d ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule ]]; then
+          mkdir -p $out/lib/swift
+          cp -r -t $out/lib/swift \
+            ${MacOSX-SDK}/usr/lib/swift/${name}.swiftmodule \
+            ${MacOSX-SDK}/usr/lib/swift/libswift${name}.tbd
+        fi
+
         # Fix and check tbd re-export references
         chmod u+w -R $out
         find $out -name '*.tbd' -type f | while read tbd; do
           echo "Fixing re-exports in $tbd"
           rewrite-tbd \
             -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+            -p /usr/lib/swift/:$out/lib/swift/ \
             ${mkDepsRewrites deps} \
             -r ${builtins.storeDir} \
             "$tbd"
@@ -163,6 +171,15 @@ in rec {
 
     # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
     JavaVM = super.JavaNativeFoundation;
+
+    CoreVideo = lib.overrideDerivation super.CoreVideo (drv: {
+      installPhase = drv.installPhase + ''
+        # When used as a module, complains about a missing import for
+        # Darwin.C.stdint. Apparently fixed in later SDKs.
+        awk -i inplace '/CFBase.h/ { print "#include <stdint.h>" } { print }' \
+          $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
+      '';
+    });
   };
 
   bareFrameworks = (
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index a4f71f12821d..dfa52606c817 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -3,16 +3,7 @@
 , xar, cpio, python3, pbzx }:
 
 let
-  MacOSX-SDK = stdenvNoCC.mkDerivation rec {
-    pname = "MacOSX-SDK";
-    version = "11.0.0";
-
-    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
-    src = fetchurl {
-      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
-      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
-    };
-
+  mkSusDerivation = args: stdenvNoCC.mkDerivation (args // {
     dontBuild = true;
     darwinDontCodeSign = true;
 
@@ -24,16 +15,45 @@ let
       pbzx $src | cpio -idm
     '';
 
+    passthru = {
+      inherit (args) version;
+    };
+  });
+
+  MacOSX-SDK = mkSusDerivation {
+    pname = "MacOSX-SDK";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_macOSNMOS_SDK.pkg";
+      sha256 = "0n425smj4q1vxbza8fzwnk323fyzbbq866q32w288c44hl5yhwsf";
+    };
+
     installPhase = ''
       cd Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk
 
       mkdir $out
       cp -r System usr $out/
     '';
+  };
 
-    passthru = {
-      inherit version;
+  CLTools_Executables = mkSusDerivation {
+    pname = "CLTools_Executables";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/46/21/001-89745-A_56FM390IW5/v1um2qppgfdnam2e9cdqcqu2r6k8aa3lis/CLTools_Executables.pkg";
+      sha256 = "0nvb1qx7l81l2wcl8wvgbpsg5rcn51ylhivqmlfr2hrrv3zrrpl0";
     };
+
+    installPhase = ''
+      cd Library/Developer/CommandLineTools
+
+      mkdir $out
+      cp -r Library usr $out/
+    '';
   };
 
   callPackage = newScope (packages // pkgs.darwin // { inherit MacOSX-SDK; });
@@ -43,7 +63,7 @@ let
 
     # TODO: this is nice to be private. is it worth the callPackage above?
     # Probably, I don't think that callPackage costs much at all.
-    inherit MacOSX-SDK;
+    inherit MacOSX-SDK CLTools_Executables;
 
     Libsystem = callPackage ./libSystem.nix {};
     LibsystemCross = pkgs.darwin.Libsystem;
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
index dc4ab1955b50..2cf1c5dd0fc8 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix
@@ -75,7 +75,7 @@
   FileProviderUI                   = {};
   FinderSync                       = {};
   ForceFeedback                    = { inherit IOKit; };
-  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration libobjc; };
+  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration Combine libobjc; };
   GLKit                            = {};
   GLUT                             = { inherit OpenGL; };
   GSS                              = {};
@@ -159,7 +159,7 @@
   ScreenSaver                      = {};
   ScreenTime                       = {};
   ScriptingBridge                  = {};
-  Security                         = { inherit IOKit libDER; };
+  Security                         = { inherit IOKit libDER xpc; };
   SecurityFoundation               = { inherit Security; };
   SecurityInterface                = { inherit Security SecurityFoundation; };
   SensorKit                        = {};
@@ -169,7 +169,7 @@
   Speech                           = {};
   SpriteKit                        = {};
   StoreKit                         = {};
-  SwiftUI                          = {};
+  SwiftUI                          = { inherit AppKit DeveloperToolsSupport UniformTypeIdentifiers; };
   SyncServices                     = {};
   System                           = {};
   SystemConfiguration              = { inherit Security; };
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
index 0297f8897f12..7be670425d7a 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation {
   ];
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
 
     for dir in $includeDirs; do
       from=${MacOSX-SDK}/usr/include/$dir
@@ -57,6 +57,13 @@ stdenvNoCC.mkDerivation {
         $out/lib
     done
 
+    for name in os Dispatch; do
+      cp -dr \
+        ${MacOSX-SDK}/usr/lib/swift/$name.swiftmodule \
+        ${MacOSX-SDK}/usr/lib/swift/libswift$name.tbd \
+        $out/lib/swift
+    done
+
     for f in $csu; do
       from=${MacOSX-SDK}/usr/lib/$f
       if [ -e "$from" ]; then
@@ -71,6 +78,7 @@ stdenvNoCC.mkDerivation {
       rewrite-tbd \
         -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
         -p /usr/lib/system/:$out/lib/system/ \
+        -p /usr/lib/swift/:$out/lib/swift/ \
         -r ${builtins.storeDir} \
         "$tbd"
     done
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
index 63ef2a1c263e..9288097ef369 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix
@@ -8,14 +8,17 @@ let self = stdenvNoCC.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/{include,lib}
+    mkdir -p $out/{include,lib/swift}
     cp -r ${MacOSX-SDK}/usr/include/objc $out/include
     cp ${MacOSX-SDK}/usr/lib/libobjc* $out/lib
+    cp -r ${MacOSX-SDK}/usr/lib/swift/ObjectiveC.swiftmodule $out/lib/swift
+    cp ${MacOSX-SDK}/usr/lib/swift/libswiftObjectiveC.tbd $out/lib/swift
   '';
 
   passthru = {
     tbdRewrites = {
       const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+      const."/usr/lib/swift/libswiftObjectiveC.dylib" = "${self}/lib/swift/libswiftObjectiveC.dylib";
     };
   };
 }; in self
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
index b413744677d2..74f1160e4306 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -5,8 +5,6 @@ appleDerivation' stdenv {
   srcs = lib.attrValues IOKitSrcs;
   sourceRoot = ".";
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/IOKit.framework/IOKit"
     "/System/Library/Frameworks/IOKit.framework/Resources"
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
index bb09adce252e..f4fe65b8066c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/boot.nix
@@ -1,8 +1,6 @@
 { appleDerivation', stdenv, darwin-stubs }:
 
 appleDerivation' stdenv {
-  phases = [ "unpackPhase" "installPhase" ];
-
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/Security.framework/Security"
     "/System/Library/Frameworks/Security.framework/Resources"
diff --git a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
index 64de728805fd..4082f5b760cf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
@@ -1,8 +1,7 @@
 { appleDerivation', stdenvNoCC }:
 
 appleDerivation' stdenvNoCC {
-  phases = [ "unpackPhase" "installPhase" ];
-
+  dontBuild = true;
   installPhase = ''
     mkdir -p $out/include
     cp mDNSShared/dns_sd.h $out/include
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
index 2fc4afa77d9f..315f0fb06219 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
@@ -1,8 +1,6 @@
 { appleDerivation, darwin-stubs }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "installPhase" ];
-
   # Not strictly necessary, since libSystem depends on it, but it's nice to be explicit so we
   # can easily find out what's impure.
   __propagatedImpureHostDeps = [
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 020aee04af79..303eb801478c 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -130,6 +130,10 @@ in stdenv.mkDerivation rec {
     mkdir $out/etc/bluetooth
     ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
 
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
     # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
     for files in `find tools/ -type f -perm -755`; do
       filename=$(basename $files)
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 951c84eaf492..8396fd5e3d33 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -1,42 +1,43 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, gettext, libxslt, docbook_xsl_ns
-, libcap, libidn2
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gettext
+, libxslt
+, docbook_xsl_ns
+, libcap
+, libidn2
 , iproute2
 , apparmorRulesFromClosure
 }:
 
-let
-  version = "20211215";
-  sunAsIsLicense = {
-    fullName = "AS-IS, SUN MICROSYSTEMS license";
-    url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "iputils";
-  inherit version;
+  version = "20221126";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1vzdch1xi2x2j8mvnsr4wwwh7kdkgf926xafw5kkb74yy1wac5qv";
+    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
   };
 
-  outputs = ["out" "apparmor"];
+  outputs = [ "out" "apparmor" ];
 
   # We don't have the required permissions inside the build sandbox:
   # /build/source/build/ping/ping: socket: Operation not permitted
   doCheck = false;
 
   mesonFlags = [
-    "-DBUILD_RARPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
     "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
-    # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
-    ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+  # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+  ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkg-config gettext libxslt.bin docbook_xsl_ns ];
   buildInputs = [ libcap ]
@@ -65,23 +66,19 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/iputils/iputils";
+    changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
     description = "A set of small useful utilities for Linux networking";
-    inherit (src.meta) homepage;
-    changelog = "https://github.com/iputils/iputils/releases/tag/s${version}";
-    license = with licenses; [ gpl2Plus bsd3 sunAsIsLicense ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos lheckemann ];
-
     longDescription = ''
       A set of small useful utilities for Linux networking including:
 
-      arping
-      clockdiff
-      ninfod
-      ping
-      rarpd
-      rdisc
-      tracepath
+      - arping: send ARP REQUEST to a neighbour host
+      - clockdiff: measure clock difference between hosts
+      - ping: send ICMP ECHO_REQUEST to network hosts
+      - tracepath: traces path to a network host discovering MTU along this path
     '';
+    license = with licenses; [ gpl2Plus bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos lheckemann ];
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 2f48448541b3..5a5193997be0 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.17";
-  hash = "sha256-cobPqWUYKMWJOJUJVGMzuNqWXfqEoaTIqz5oGkf6uuc=";
+  version = "2.03.18";
+  hash = "sha256-n2g+KYDZXA3Ou9JcfBdwMsVhXXJnv8iF6r/OWSgPR2k=";
 }
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index ba2d0967e45d..4a5e50d9c6ab 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
   # NixOS module which is based on those files without relying on them. Still, it
   # is helpful to have properly patched versions for non-NixOS distributions.
   postFixup = ''
-    header "Fixing aesmd.service"
+    echo "Fixing aesmd.service"
     substituteInPlace $out/lib/systemd/system/aesmd.service \
       --replace '@aesm_folder@' \
                 "$out/aesm" \
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
       --replace "/bin/kill" \
                 "${coreutils}/bin/kill"
 
-    header "Fixing remount-dev-exec.service"
+    echo "Fixing remount-dev-exec.service"
     substituteInPlace $out/lib/systemd/system/remount-dev-exec.service \
       --replace '/bin/mount' \
                 "${util-linux}/bin/mount"
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 5213dc1e4fda..053aaecbcbb7 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation rec {
       };
     in
     ''
-      header "Setting up IPP crypto build artifacts"
+      echo "Setting up IPP crypto build artifacts"
 
       pushd 'external/ippcp_internal'
 
@@ -149,7 +149,7 @@ stdenv.mkDerivation rec {
     ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
     installDir=$installDir/sgxsdk
 
-    header "Move files created by installer"
+    echo "Move files created by installer"
 
     mkdir -p $out/bin
     pushd $out
@@ -206,15 +206,15 @@ stdenv.mkDerivation rec {
 
 
   preFixup = ''
-    header "Strip sgxsdk prefix"
+    echo "Strip sgxsdk prefix"
     for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
       substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
     done
 
-    header "Fixing pkg-config files"
+    echo "Fixing pkg-config files"
     sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
 
-    header "Fixing SGX_SDK default in samples"
+    echo "Fixing SGX_SDK default in samples"
     substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
       --replace '/opt/intel/sgxsdk' "$out"
     for file in $out/share/SampleCode/*/Makefile; do
@@ -222,12 +222,12 @@ stdenv.mkDerivation rec {
         --replace '/opt/intel/sgxsdk' "$out"
     done
 
-    header "Fixing BINUTILS_DIR in buildenv.mk"
+    echo "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
       --replace 'BINUTILS_DIR ?= /usr/local/bin' \
                 'BINUTILS_DIR ?= ${BINUTILS_DIR}'
 
-    header "Fixing GDB path in bin/sgx-gdb"
+    echo "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
diff --git a/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
new file mode 100644
index 000000000000..c64fdd8d34c0
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-tpm2_context_init-fix-driver-name-checking.patch
@@ -0,0 +1,44 @@
+From 236e9281cb158be3191c500524fbc5f397a25e03 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Sun, 15 Jan 2023 20:15:55 +0800
+Subject: [PATCH] tpm2_context_init: fix driver name checking
+
+https://github.com/systemd/systemd/commit/542dbc623e introduced
+additional checks for tpm2 driver names, namely ensuring the driver
+name, when concated with "libtss2-tcti-" and ".so.0", generates a valid
+filename (with no '/' inside).
+
+For example, if the driver is name "device", the line
+  fn = strjoina("libtss2-tcti-", driver, ".so.0")
+would yield "libtss2-tcti-device.so.0", passing the check. And the
+filename is then passed to dlopen for loading the driver.
+
+Our current approach for systemd to correctly locate these dynamically
+loaded libraries is to patch the filenames to include their absolute
+path. Thus the line mentioned above is patched into
+  fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0")
+yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0",
+tripping the check.
+
+This patch relaxes the check to also accept absolute paths, by replacing
+filename_is_valid with path_is_valid.
+---
+ src/shared/tpm2-util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
+index ba8dfb041d..7de5d5fc77 100644
+--- a/src/shared/tpm2-util.c
++++ b/src/shared/tpm2-util.c
+@@ -192,7 +192,7 @@ int tpm2_context_init(const char *device, struct tpm2_context *ret) {
+                 fn = strjoina("libtss2-tcti-", driver, ".so.0");
+ 
+                 /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
+-                if (!filename_is_valid(fn))
++                if (!path_is_valid(fn))
+                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+ 
+                 dl = dlopen(fn, RTLD_NOW);
+-- 
+2.39.0
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index fadb6a486c82..4af13ea26af5 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -174,6 +174,7 @@ stdenv.mkDerivation {
     ./0016-pkg-config-derive-prefix-from-prefix.patch
     ./0017-inherit-systemd-environment-when-calling-generators.patch
     ./0018-core-don-t-taint-on-unmerged-usr.patch
+    ./0019-tpm2_context_init-fix-driver-name-checking.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 2d954d83ecf3..ba4fe8356ce7 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchurl, openssl, pkg-config, libnl
 , nixosTests, wpa_supplicant_gui
-, dbusSupport ? true, dbus
+, dbusSupport ? !stdenv.hostPlatform.isStatic, dbus
 , withReadline ? true, readline
-, withPcsclite ? true, pcsclite
+, withPcsclite ? !stdenv.hostPlatform.isStatic, pcsclite
 , readOnlyModeSSIDs ? false
 }:
 
@@ -73,6 +73,15 @@ stdenv.mkDerivation rec {
     CONFIG_CTRL_IFACE_DBUS=y
     CONFIG_CTRL_IFACE_DBUS_NEW=y
     CONFIG_CTRL_IFACE_DBUS_INTRO=y
+  ''
+    # Upstream uses conditionals based on ifdef, so opposite of =y is
+    # not =n, as one may expect, but undefine.
+    #
+    # This config is sourced into makefile.
+    + optionalString (!dbusSupport) ''
+    undefine CONFIG_CTRL_IFACE_DBUS
+    undefine CONFIG_CTRL_IFACE_DBUS_NEW
+    undefine CONFIG_CTRL_IFACE_DBUS_INTRO
   '' + (if withReadline then ''
     CONFIG_READLINE=y
   '' else ''
@@ -104,13 +113,15 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
-
+  ''
+  + lib.optionalString dbusSupport ''
     mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
-
+  ''
+  + ''
     rm $out/share/man/man8/wpa_priv.8
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 6de759498b21..9c4f62e3d244 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -3,7 +3,7 @@
   lib, stdenv, makeWrapper, fetchurl, fetchpatch, fetchFromGitLab, buildPackages,
   automake, autoconf, libiconv, libtool, intltool,
   freetype, tradcpp, fontconfig, meson, ninja, ed, fontforge,
-  libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
+  libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm, netbsd,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
   mcpp, libepoxy, openssl, pkg-config, llvm, libxslt, libxcrypt,
   ApplicationServices, Carbon, Cocoa, Xplugin,
@@ -328,7 +328,13 @@ self: super:
   });
 
   libpciaccess = super.libpciaccess.overrideAttrs (attrs: {
-    meta = attrs.meta // { platforms = lib.platforms.linux; };
+    buildInputs = lib.optionals stdenv.hostPlatform.isNetBSD (with netbsd; [ libarch libpci ]);
+
+    meta = attrs.meta // {
+      # https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/blob/master/configure.ac#L108-114
+      platforms = lib.fold (os: ps: ps ++ lib.platforms.${os}) []
+        [ "cygwin" "freebsd" "linux" "netbsd" "openbsd" "illumos" ];
+    };
   });
 
   setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 85bd8d2087f6..42d19a0fad4b 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -100,6 +100,7 @@ rec {
         + lib.optionalString (stdenv.cc.isGNU or false) " -static-libgcc";
       nativeBuildInputs = (args.nativeBuildInputs or []) ++ [
         (pkgs.buildPackages.makeSetupHook {
+          name = "darwin-portable-libSystem-hook";
           substitutions = {
             libsystem = "${stdenv.cc.libc}/lib/libSystem.B.dylib";
           };
diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
index 5e549e48287c..2cc44b319ffa 100644
--- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix
@@ -71,7 +71,7 @@ in rec {
       cp ${gawk}/bin/gawk $out/bin
       cp -d ${gawk}/bin/awk $out/bin
       cp ${gnutar}/bin/tar $out/bin
-      cp ${gzip}/bin/gzip $out/bin
+      cp ${gzip}/bin/.gzip-wrapped $out/bin/gzip
       cp ${bzip2_.bin}/bin/bzip2 $out/bin
       cp -d ${gnumake}/bin/* $out/bin
       cp -d ${patch}/bin/* $out/bin
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index b07420bb4185..b1b982ecdffc 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1,4 +1,5 @@
 # shellcheck shell=bash
+# shellcheck disable=1090,2154,2123,2034,2178,2048,2068,1091
 __nixpkgs_setup_set_original=$-
 set -eu
 set -o pipefail
@@ -32,7 +33,7 @@ if [ -n "$__structuredAttrs" ]; then
     export NIX_ATTRS_JSON_FILE="$NIX_BUILD_TOP/.attrs.json"
     export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
 else
-    : ${outputs:=out}
+    : "${outputs:=out}"
 fi
 
 getAllOutputNames() {
@@ -125,11 +126,6 @@ _eval() {
 ######################################################################
 # Logging.
 
-# Obsolete.
-stopNest() { true; }
-header() { echo "$1"; }
-closeNest() { true; }
-
 # Prints a command such that all word splits are unambiguous. We need
 # to split the command in three parts because the middle format string
 # will be, and must be, repeated for each argument. The first argument
@@ -210,8 +206,8 @@ addToSearchPath() {
 # syntax when they switch to setting __structuredAttrs = true.
 prependToVar() {
     local -n nameref="$1"
+    local useArray type
 
-    useArray=
     if [ -n "$__structuredAttrs" ]; then
         useArray=true
     else
@@ -243,8 +239,8 @@ prependToVar() {
 # Same as above
 appendToVar() {
     local -n nameref="$1"
+    local useArray type
 
-    useArray=
     if [ -n "$__structuredAttrs" ]; then
         useArray=true
     else
@@ -398,7 +394,7 @@ fi
 # implementation uses zip archive and zip does not support dates going back to
 # 1970.
 export SOURCE_DATE_EPOCH
-: ${SOURCE_DATE_EPOCH:=315532800}
+: "${SOURCE_DATE_EPOCH:=315532800}"
 
 
 # Wildcard expansions that don't match should expand to an empty list.
@@ -448,7 +444,6 @@ runHook addInputsHook
 
 # Package accumulators
 
-# shellcheck disable=SC2034
 declare -a pkgsBuildBuild pkgsBuildHost pkgsBuildTarget
 declare -a pkgsHostHost pkgsHostTarget
 declare -a pkgsTargetTarget
@@ -473,7 +468,6 @@ declare -a pkgTargetHookVars=(envTargetTargetHook)
 declare -a pkgHookVarVars=(pkgBuildHookVars pkgHostHookVars pkgTargetHookVars)
 
 # those variables are declared here, since where and if they are used varies
-# shellcheck disable=SC2034
 declare -a preFixupHooks fixupOutputHooks preConfigureHooks postFixupHooks postUnpackHooks unpackCmdHooks
 
 # Add env hooks for all sorts of deps with the specified host offset.
@@ -521,7 +515,7 @@ findInputs() {
     local -r targetOffset="$3"
 
     # Sanity check
-    (( hostOffset <= targetOffset )) || exit -1
+    (( hostOffset <= targetOffset )) || exit 1
 
     local varVar="${pkgAccumVarVars[hostOffset + 1]}"
     local varRef="$varVar[$((targetOffset - hostOffset))]"
@@ -610,12 +604,12 @@ findInputs() {
 # in each list must be store paths, and therefore space-free.
 
 # Make sure all are at least defined as empty
-: ${depsBuildBuild=} ${depsBuildBuildPropagated=}
-: ${nativeBuildInputs=} ${propagatedNativeBuildInputs=} ${defaultNativeBuildInputs=}
-: ${depsBuildTarget=} ${depsBuildTargetPropagated=}
-: ${depsHostHost=} ${depsHostHostPropagated=}
-: ${buildInputs=} ${propagatedBuildInputs=} ${defaultBuildInputs=}
-: ${depsTargetTarget=} ${depsTargetTargetPropagated=}
+: "${depsBuildBuild=}" "${depsBuildBuildPropagated=}"
+: "${nativeBuildInputs=}" "${propagatedNativeBuildInputs=}" "${defaultNativeBuildInputs=}"
+: "${depsBuildTarget=}" "${depsBuildTargetPropagated=}"
+: "${depsHostHost=}" "${depsHostHostPropagated=}"
+: "${buildInputs=}" "${propagatedBuildInputs=}" "${defaultBuildInputs=}"
+: "${depsTargetTarget=}" "${depsTargetTargetPropagated=}"
 
 for pkg in ${depsBuildBuild[@]} ${depsBuildBuildPropagated[@]}; do
     findInputs "$pkg" -1 -1
@@ -650,7 +644,7 @@ activatePackage() {
     local -r targetOffset="$3"
 
     # Sanity check
-    (( hostOffset <= targetOffset )) || exit -1
+    (( hostOffset <= targetOffset )) || exit 1
 
     if [ -f "$pkg" ]; then
         source "$pkg"
@@ -798,10 +792,6 @@ unset _HOST_PATH
 unset _XDG_DATA_DIRS
 
 
-# Make GNU Make produce nested output.
-export NIX_INDENT_MAKE=1
-
-
 # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
 # means that we're supposed to try and auto-detect the number of
 # available CPU cores at run-time.
@@ -888,7 +878,7 @@ substituteStream() {
 # fail loudly if provided with a binary (containing null bytes)
 consumeEntire() {
     # read returns non-0 on EOF, so we want read to fail
-    if IFS='' read -r -d '' $1 ; then
+    if IFS='' read -r -d '' "$1" ; then
         echo "consumeEntire(): ERROR: Input null bytes, won't process" >&2
         return 1
     fi
@@ -1033,7 +1023,7 @@ _defaultUnpack() {
 
 unpackFile() {
     curSrc="$1"
-    header "unpacking source archive $curSrc" 3
+    echo "unpacking source archive $curSrc"
     if ! runOneHook unpackCmd "$curSrc"; then
         echo "do not know how to unpack source archive $curSrc"
         exit 1
@@ -1079,7 +1069,7 @@ unpackPhase() {
     # Find the source directory.
 
     # set to empty if unset
-    : ${sourceRoot=}
+    : "${sourceRoot=}"
 
     if [ -n "${setSourceRoot:-}" ]; then
         runOneHook setSourceRoot
@@ -1130,7 +1120,7 @@ patchPhase() {
     fi
 
     for i in "${patchesArray[@]}"; do
-        header "applying patch $i" 3
+        echo "applying patch $i"
         local uncompress=cat
         case "$i" in
             *.gz)
@@ -1183,7 +1173,7 @@ configurePhase() {
     runHook preConfigure
 
     # set to empty if unset
-    : ${configureScript=}
+    : "${configureScript=}"
 
     if [[ -z "$configureScript" && -x ./configure ]]; then
         configureScript=./configure
@@ -1253,7 +1243,7 @@ buildPhase() {
     runHook preBuild
 
     if [[ -z "${makeFlags-}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
-        echo "no Makefile, doing nothing"
+        echo "no Makefile or custom buildPhase, doing nothing"
     else
         foundMakefile=1
 
@@ -1323,6 +1313,15 @@ checkPhase() {
 installPhase() {
     runHook preInstall
 
+    # Dont reuse 'foundMakefile' set in buildPhase, a makefile may have been created in buildPhase
+    if [[ -z "${makeFlags-}" && -z "${makefile:-}" && ! ( -e Makefile || -e makefile || -e GNUmakefile ) ]]; then
+        echo "no Makefile or custom installPhase, doing nothing"
+        runHook postInstall
+        return
+    else
+        foundMakefile=1
+    fi
+
     if [ -n "$prefix" ]; then
         mkdir -p "$prefix"
     fi
@@ -1436,7 +1435,7 @@ installCheckPhase() {
         echo "no Makefile or custom installCheckPhase, doing nothing"
     #TODO(@oxij): should flagsArray influence make -n?
     elif [[ -z "${installCheckTarget:-}" ]] \
-       && ! make -n ${makefile:+-f $makefile} ${installCheckTarget:-installcheck} >/dev/null 2>&1; then
+       && ! make -n ${makefile:+-f $makefile} "${installCheckTarget:-installcheck}" >/dev/null 2>&1; then
         echo "no installcheck target in ${makefile:-Makefile}, doing nothing"
     else
         # Old bash empty array hack
@@ -1485,15 +1484,15 @@ distPhase() {
 showPhaseHeader() {
     local phase="$1"
     case "$phase" in
-        unpackPhase) header "unpacking sources";;
-        patchPhase) header "patching sources";;
-        configurePhase) header "configuring";;
-        buildPhase) header "building";;
-        checkPhase) header "running tests";;
-        installPhase) header "installing";;
-        fixupPhase) header "post-installation fixup";;
-        installCheckPhase) header "running install tests";;
-        *) header "$phase";;
+        unpackPhase) echo "unpacking sources";;
+        patchPhase) echo "patching sources";;
+        configurePhase) echo "configuring";;
+        buildPhase) echo "building";;
+        checkPhase) echo "running tests";;
+        installPhase) echo "installing";;
+        fixupPhase) echo "post-installation fixup";;
+        installCheckPhase) echo "running install tests";;
+        *) echo "$phase";;
     esac
 }
 
@@ -1503,19 +1502,23 @@ showPhaseFooter() {
     local startTime="$2"
     local endTime="$3"
     local delta=$(( endTime - startTime ))
-    (( $delta < 30 )) && return
+    (( delta < 30 )) && return
 
     local H=$((delta/3600))
     local M=$((delta%3600/60))
     local S=$((delta%60))
     echo -n "$phase completed in "
-    (( $H > 0 )) && echo -n "$H hours "
-    (( $M > 0 )) && echo -n "$M minutes "
+    (( H > 0 )) && echo -n "$H hours "
+    (( M > 0 )) && echo -n "$M minutes "
     echo "$S seconds"
 }
 
 
 genericBuild() {
+    # variable used by our gzip wrapper to add -n.
+    # gzip is in common-path.nix and is added to nix-shell but we only want to change its behaviour in nix builds. do not move to a setupHook in gzip.
+    export GZIP_NO_TIMESTAMPS=1
+
     if [ -f "${buildCommandPath:-}" ]; then
         source "$buildCommandPath"
         return
@@ -1548,7 +1551,7 @@ genericBuild() {
         if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then continue; fi
 
         if [[ -n $NIX_LOG_FD ]]; then
-            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&$NIX_LOG_FD
+            echo "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }" >&"$NIX_LOG_FD"
         fi
 
         showPhaseHeader "$curPhase"
diff --git a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
index f394869ea915..5b5677eef136 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
+++ b/pkgs/stdenv/linux/bootstrap-tools/scripts/unpack-bootstrap-tools.sh
@@ -17,6 +17,15 @@ else
    LD_BINARY=$out/lib/ld-*so.?
 fi
 
+# path to version-specific libraries, like libstdc++.so
+LIBSTDCXX_SO_DIR=$(echo $out/lib/gcc/*/*)
+
+# Move version-specific libraries out to avoid library mix when we
+# upgrade gcc.
+# TODO(trofi): update bootstrap tarball script and tarballs to put them
+# into expected location directly.
+LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/mv $out/lib/libstdc++.* $LIBSTDCXX_SO_DIR/
+
 # On x86_64, ld-linux-x86-64.so.2 barfs on patchelf'ed programs.  So
 # use a copy of patchelf.
 LD_LIBRARY_PATH=$out/lib $LD_BINARY $out/bin/cp $out/bin/patchelf .
@@ -25,8 +34,8 @@ for i in $out/bin/* $out/libexec/gcc/*/*/*; do
     if [ -L "$i" ]; then continue; fi
     if [ -z "${i##*/liblto*}" ]; then continue; fi
     echo patching "$i"
-    LD_LIBRARY_PATH=$out/lib $LD_BINARY \
-        ./patchelf --set-interpreter $LD_BINARY --set-rpath $out/lib --force-rpath "$i"
+    LD_LIBRARY_PATH=$out/lib:$LIBSTDCXX_SO_DIR $LD_BINARY \
+        ./patchelf --set-interpreter $LD_BINARY --set-rpath $out/lib:$LIBSTDCXX_SO_DIR --force-rpath "$i"
 done
 
 for i in $out/lib/librt-*.so $out/lib/libpcre*; do
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 870fb04c3883..5c7dfcceec64 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -296,7 +296,7 @@ in
 
     overrides = self: super: {
       inherit (prevStage)
-        ccWrapperStdenv
+        ccWrapperStdenv gettext
         gcc-unwrapped coreutils gnugrep
         perl gnum4 bison;
       dejagnu = super.dejagnu.overrideAttrs (a: { doCheck = false; } );
@@ -332,7 +332,8 @@ in
         # and that can fail to load.  Therefore we upgrade `ld` to use newer libc;
         # apparently the interpreter needs to match libc, too.
         bintools = self.stdenvNoCC.mkDerivation {
-          inherit (prevStage.bintools.bintools) name;
+          pname = prevStage.bintools.bintools.pname + "-patchelfed-ld";
+          inherit (prevStage.bintools.bintools) version;
           enableParallelBuilding = true;
           dontUnpack = true;
           dontBuild = true;
@@ -369,7 +370,7 @@ in
     overrides = self: super: rec {
       inherit (prevStage)
         ccWrapperStdenv
-        binutils coreutils gnugrep
+        binutils coreutils gnugrep gettext
         perl patchelf linuxHeaders gnum4 bison libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
       gcc-unwrapped =
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index e98ba0c08595..3aa7f6a3df53 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -115,7 +115,7 @@ in with pkgs; rec {
         cp ${gawk.out}/bin/gawk $out/bin
         cp -d ${gawk.out}/bin/awk $out/bin
         cp ${tarMinimal.out}/bin/tar $out/bin
-        cp ${gzip.out}/bin/gzip $out/bin
+        cp ${gzip.out}/bin/.gzip-wrapped $out/bin/gzip
         cp ${bzip2.bin}/bin/bzip2 $out/bin
         cp -d ${gnumake.out}/bin/* $out/bin
         cp -d ${patch}/bin/* $out/bin
@@ -272,16 +272,17 @@ in with pkgs; rec {
       gcc --version
 
     '' + lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
-      ldlinux=$(echo ${bootstrapTools}/lib/${builtins.unsafeDiscardStringContext /* only basename */ (builtins.baseNameOf binutils.dynamicLinker)})
-      export CPP="cpp -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools}"
-      export CC="gcc -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools} -Wl,-dynamic-linker,$ldlinux -Wl,-rpath,${bootstrapTools}/lib"
-      export CXX="g++ -idirafter ${bootstrapTools}/include-glibc -B${bootstrapTools} -Wl,-dynamic-linker,$ldlinux -Wl,-rpath,${bootstrapTools}/lib"
+      rtld=$(echo ${bootstrapTools}/lib/${builtins.unsafeDiscardStringContext /* only basename */ (builtins.baseNameOf binutils.dynamicLinker)})
+      libc_includes=${bootstrapTools}/include-glibc
     '' + lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-      ldmusl=$(echo ${bootstrapTools}/lib/ld-musl*.so.?)
-      export CPP="cpp -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools}"
-      export CC="gcc -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools} -Wl,-dynamic-linker,$ldmusl -Wl,-rpath,${bootstrapTools}/lib"
-      export CXX="g++ -idirafter ${bootstrapTools}/include-libc -B${bootstrapTools} -Wl,-dynamic-linker,$ldmusl -Wl,-rpath,${bootstrapTools}/lib"
+      rtld=$(echo ${bootstrapTools}/lib/ld-musl*.so.?)
+      libc_includes=${bootstrapTools}/include-libc
     '' + ''
+      # path to version-specific libraries, like libstdc++.so
+      cxx_libs=$(echo ${bootstrapTools}/lib/gcc/*/*)
+      export CPP="cpp -idirafter $libc_includes -B${bootstrapTools}"
+      export  CC="gcc -idirafter $libc_includes -B${bootstrapTools} -Wl,-dynamic-linker,$rtld -Wl,-rpath,${bootstrapTools}/lib -Wl,-rpath,$cxx_libs"
+      export CXX="g++ -idirafter $libc_includes -B${bootstrapTools} -Wl,-dynamic-linker,$rtld -Wl,-rpath,${bootstrapTools}/lib -Wl,-rpath,$cxx_libs"
 
       echo '#include <stdio.h>' >> foo.c
       echo '#include <limits.h>' >> foo.c
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 5ff18298f217..bad6eb7ba7aa 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -4,7 +4,8 @@
 { stdenv
 , pkgs
 , lib
-,
+, runCommand
+, testers
 }:
 
 let
@@ -99,6 +100,25 @@ in
   # tests for hooks in `stdenv.defaultNativeBuildInputs`
   hooks = lib.recurseIntoAttrs (import ./hooks.nix { stdenv = bootStdenv; pkgs = earlyPkgs; });
 
+  outputs-no-out = runCommand "outputs-no-out-assert" {
+    result = testers.testBuildFailure (stdenv.mkDerivation {
+      NIX_DEBUG = 1;
+      name = "outputs-no-out";
+      outputs = ["foo"];
+      buildPhase = ":";
+      installPhase = ''
+        touch $foo
+      '';
+    });
+
+    # Assumption: the first output* variable to be configured is
+    #   _overrideFirst outputDev "dev" "out"
+    expectedMsg = "_assignFirst: could not find a non-empty variable to assign to outputDev. The following variables were all unset or empty: dev out.";
+  } ''
+    grep -F "$expectedMsg" $result/testBuildFailure.log >/dev/null
+    touch $out
+  '';
+
   test-env-attrset = testEnvAttrset { name = "test-env-attrset"; stdenv' = bootStdenv; };
 
   # Test compatibility with derivations using `env` as a regular variable.
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index e7f22ad0ff96..f61bc9df66d5 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -51,6 +51,15 @@ stdenv.mkDerivation rec {
       ];
       sha256 = "1h00djdvgjhwfb60wl4qrxbyfsbbnn1qw6l2hkldnif4m8f8r1zj";
     })
+    (fetchurl {
+      urls = [
+        # original link (will be dead eventually):
+        "https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
+
+        "https://web.archive.org/web/20230106200319/https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
+      ];
+      sha256 = "sha256-on79jElQ+z2ULWAq14RpluAqr9d6itHiZwDkKubBzTc=";
+    })
   ] ++ lib.optional enableNLS
     (fetchurl {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/unzip/files/unzip-6.0-natspec.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";
diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix
index ef94eee2429f..03bd62924048 100644
--- a/pkgs/tools/backup/tsm-client/default.nix
+++ b/pkgs/tools/backup/tsm-client/default.nix
@@ -159,16 +159,6 @@ let
         ln --symbolic --force --no-target-directory "$out/$(cut -b 7- <<< "$target")" "$link"
       done
     '';
-
-    # since 7b9fd5d1c9802131ca0a01ff08a3ff64379d2df4
-    # autopatchelf misses to add $out/lib to rpath;
-    # we have to call autopatchelf manually as it would
-    # run too late and overwrite our rpath otherwise
-    dontAutoPatchelf = true;
-    postFixup = ''
-      autoPatchelf $out
-      patchelf --add-rpath $out/lib $out/lib/*
-    '';
   };
 
   binPath = lib.makeBinPath ([ acl gnugrep procps ]
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 771188a98cd9..24f81d99da3c 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchurl
+, makeWrapper
 , xz
-, writeText
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ xz.bin ];
+  nativeBuildInputs = [ xz.bin makeWrapper ];
 
   makeFlags = [
     "SHELL=/bin/sh"
@@ -40,12 +40,13 @@ stdenv.mkDerivation rec {
   preFixup = ''
     sed -i '1{;/#!\/bin\/sh/aPATH="'$out'/bin:$PATH"
     }' $out/bin/*
-  '';
-
-  # set GZIP env variable to "-n" to stop gzip from adding timestamps
+  ''
+  # run gzip with "-n" when $GZIP_NO_TIMESTAMPS (set by stdenv's setup.sh) is set to stop gzip from adding timestamps
   # to archive headers: https://github.com/NixOS/nixpkgs/issues/86348
-  setupHook = writeText "setup-hook" ''
-    export GZIP="-n"
+  # if changing so that there's no longer a .gzip-wrapped then update copy in make-bootstrap-tools.nix
+  + ''
+    wrapProgram $out/bin/gzip \
+      --add-flags "\''${GZIP_NO_TIMESTAMPS:+-n}"
   '';
 
   meta = {
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index 7fa7b4e35c85..b41b3c843da6 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, texinfo }:
+{ lib, stdenv, fetchurl }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
   version = "1.23";
   outputs = [ "out" "man" "info" ];
 
-  nativeBuildInputs = [ texinfo ];
-
   src = fetchurl {
     url = "mirror://savannah/lzip/${pname}-${version}.tar.gz";
     sha256 = "sha256-R5LAR93xXvKdVbqOaKGiHgy3aS2H7N9yBEGYZFgvKA0=";
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index 59f1901bd9fd..d49cc314b4a8 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xz";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "eV6gSUxm1QmwUt3DbcY71jTln/Kg85wWo7VkTdAdh+Y=";
+    sha256 = "3Rcqy1OGemgBL5TBc4lAGy8nShqlro+Ey/uLfjg+qNM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/misc/copier/default.nix b/pkgs/tools/misc/copier/default.nix
new file mode 100644
index 000000000000..55d1ea6693e7
--- /dev/null
+++ b/pkgs/tools/misc/copier/default.nix
@@ -0,0 +1,51 @@
+{ lib, git, python3, fetchFromGitHub }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "copier";
+  version = "7.0.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "copier-org";
+    repo = "copier";
+    rev = "v${version}";
+    sha256 = "sha256-8lTvyyKfAkvnUvw3e+r9C/49QASR8Zeokm509jxGK2g=";
+  };
+
+  POETRY_DYNAMIC_VERSIONING_BYPASS = version;
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+    python3.pkgs.poetry-dynamic-versioning
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    colorama
+    dunamai
+    iteration-utilities
+    jinja2
+    jinja2-ansible-filters
+    mkdocs-material
+    mkdocs-mermaid2-plugin
+    mkdocstrings
+    packaging
+    pathspec
+    plumbum
+    pydantic
+    pygments
+    pyyaml
+    pyyaml-include
+    questionary
+  ];
+
+  makeWrapperArgs = [
+    "--suffix PATH : ${lib.makeBinPath [ git ] }"
+  ];
+
+  meta = with lib; {
+    description = "Library and command-line utility for rendering projects templates";
+    homepage = "https://copier.readthedocs.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
diff --git a/pkgs/tools/networking/openconnect/common.nix b/pkgs/tools/networking/openconnect/common.nix
index 555fd43035e6..146a2fc6ea50 100644
--- a/pkgs/tools/networking/openconnect/common.nix
+++ b/pkgs/tools/networking/openconnect/common.nix
@@ -15,6 +15,8 @@
 , zlib
 , vpnc-scripts
 , PCSC
+, useDefaultExternalBrowser ? true
+, xdg-utils
 , autoreconfHook
 }:
 
@@ -32,7 +34,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gmp libxml2 stoken zlib (if useOpenSSL then openssl else gnutls) ]
     ++ lib.optional stdenv.isDarwin PCSC
-    ++ lib.optional stdenv.isLinux p11-kit;
+    ++ lib.optional stdenv.isLinux p11-kit
+    ++ lib.optional (stdenv.isLinux && useDefaultExternalBrowser) xdg-utils;
   nativeBuildInputs = [ pkg-config autoreconfHook ];
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index e0e0b6078f73..1ea893948dc5 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -26,6 +26,3 @@ in rec {
     useOpenSSL = true;
   };
 }
-
-
-
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 96a71c1aba46..690cf3d97013 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -48,11 +48,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unbound";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${version}.tar.gz";
-    hash = "sha256-3LyV14kdn5EMZuTtyfHy/eTeou7Bjjr591rtRKAvE0E=";
+    hash = "sha256-7kCFzszhJYTmAPPYFKKPqCLfqs7B+UyEv9Z/ilVxpfQ=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/package-management/nix/nix-perl.nix b/pkgs/tools/package-management/nix/nix-perl.nix
index 3c44dbdbe144..0796a0914f1f 100644
--- a/pkgs/tools/package-management/nix/nix-perl.nix
+++ b/pkgs/tools/package-management/nix/nix-perl.nix
@@ -40,6 +40,4 @@ stdenv.mkDerivation {
   ];
 
   preConfigure = "export NIX_STATE_DIR=$TMPDIR";
-
-  preBuild = "unset NIX_INDENT_MAKE";
 }
diff --git a/pkgs/tools/package-management/pkg/default.nix b/pkgs/tools/package-management/pkg/default.nix
new file mode 100644
index 000000000000..a2bac43e5924
--- /dev/null
+++ b/pkgs/tools/package-management/pkg/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub, m4, pkg-config, tcl
+, bzip2, libarchive, libbsd, lzma, openssl, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pkg";
+  version = "1.19.0";
+
+  src = fetchFromGitHub {
+    owner = "freebsd";
+    repo = "pkg";
+    rev = finalAttrs.version;
+    sha256 = "W66g8kVvaPJSyOZcgyDcUBrWQQ5YDkRqofSWfIsjd+k=";
+  };
+
+  setOutputFlags = false;
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ m4 pkg-config tcl ];
+  buildInputs = [ bzip2 libarchive lzma openssl zlib ]
+    ++ lib.optional stdenv.isLinux libbsd;
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $out/etc
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/freebsd/pkg";
+    description = "Package management tool for FreeBSD";
+    maintainers = with maintainers; [ qyliss ];
+    platforms = with platforms; darwin ++ freebsd ++ linux ++ netbsd ++ openbsd;
+    license = licenses.bsd2;
+  };
+})
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index a85e91b1a0c1..c376411e6f7f 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -16,7 +16,7 @@
 
 assert (doCheck && stdenv.isLinux) -> glibcLocales != null;
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   pname = "gawk" + lib.optionalString interactive "-interactive";
   version = "5.2.1";
 
@@ -31,13 +31,19 @@ stdenv.mkDerivation (rec {
     ./darwin-no-pma.patch
   ];
 
+  # PIE is incompatible with the "persistent malloc" ("pma") feature.
+  # While build system attempts to pass -no-pie to gcc. nixpkgs' `ld`
+  # wrapped still passes `-pie` flag to linker and breaks linkage.
+  # Let's disable "pie" until `ld` is fixed to do the right thing.
+  hardeningDisable = [ "pie" ];
+
   # When we do build separate interactive version, it makes sense to always include man.
   outputs = [ "out" "info" ]
     ++ lib.optional (!interactive) "man";
 
-  nativeBuildInputs = lib.optional (doCheck && stdenv.isLinux) glibcLocales
-    # no-pma fix
-    ++ [ autoreconfHook ];
+  # no-pma fix
+  nativeBuildInputs = [ autoreconfHook ]
+    ++ lib.optional (doCheck && stdenv.isLinux) glibcLocales;
 
   buildInputs = lib.optional withSigsegv libsigsegv
     ++ lib.optional interactive readline
@@ -83,8 +89,4 @@ stdenv.mkDerivation (rec {
     platforms = platforms.unix ++ platforms.windows;
     maintainers = [ ];
   };
-} // lib.optionalAttrs stdenv.hostPlatform.isMusl {
-  # PIE is incompatible with the "persistent malloc" ("pma") feature.
-  # FIXME: make unconditional in staging (added to avoid rebuilds in staging-next)
-  hardeningDisable = [ "pie" ];
-})
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index afab231cfb9b..eb8535094edb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -159,9 +159,10 @@ with pkgs;
 
   autoreconfHook = callPackage (
     { makeSetupHook, autoconf, automake, gettext, libtool }:
-    makeSetupHook
-      { deps = [ autoconf automake gettext libtool ]; }
-      ../build-support/setup-hooks/autoreconf.sh
+    makeSetupHook {
+      name = "autoreconf-hook";
+      deps = [ autoconf automake gettext libtool ];
+    } ../build-support/setup-hooks/autoreconf.sh
   ) { };
 
   autoreconfHook264 = autoreconfHook.override {
@@ -203,8 +204,9 @@ with pkgs;
     substitutions = { canonicalize_jar = canonicalize-jar; };
   } ../build-support/setup-hooks/canonicalize-jars.sh;
 
-  ensureNewerSourcesHook = { year }: makeSetupHook {}
-    (writeScript "ensure-newer-sources-hook.sh" ''
+  ensureNewerSourcesHook = { year }: makeSetupHook {
+    name = "ensure-newer-sources-hook";
+  } (writeScript "ensure-newer-sources-hook.sh" ''
       postUnpackHooks+=(_ensureNewerSources)
       _ensureNewerSources() {
         '${findutils}/bin/find' "$sourceRoot" \
@@ -337,9 +339,10 @@ with pkgs;
   # ValueError: ZIP does not support timestamps before 1980
   ensureNewerSourcesForZipFilesHook = ensureNewerSourcesHook { year = "1980"; };
 
-  updateAutotoolsGnuConfigScriptsHook = makeSetupHook
-    { substitutions = { gnu_config = gnu-config;}; }
-    ../build-support/setup-hooks/update-autotools-gnu-config-scripts.sh;
+  updateAutotoolsGnuConfigScriptsHook = makeSetupHook {
+    name = "update-autotools-gnu-config-scripts-hook";
+    substitutions = { gnu_config = gnu-config; };
+  } ../build-support/setup-hooks/update-autotools-gnu-config-scripts.sh;
 
   gogUnpackHook = makeSetupHook {
     name = "gog-unpack-hook";
@@ -608,7 +611,9 @@ with pkgs;
 
   diffPlugins = (callPackage ../build-support/plugins.nix {}).diffPlugins;
 
-  dieHook = makeSetupHook {} ../build-support/setup-hooks/die.sh;
+  dieHook = makeSetupHook {
+    name = "die-hook";
+  } ../build-support/setup-hooks/die.sh;
 
   archiver = callPackage ../applications/misc/archiver { };
 
@@ -959,11 +964,15 @@ with pkgs;
 
   madonctl = callPackage ../applications/misc/madonctl { };
 
-  copyDesktopItems = makeSetupHook { } ../build-support/setup-hooks/copy-desktop-items.sh;
+  copyDesktopItems = makeSetupHook {
+    name = "copy-desktop-items-hook";
+  } ../build-support/setup-hooks/copy-desktop-items.sh;
 
   makeDesktopItem = callPackage ../build-support/make-desktopitem { };
 
-  copyPkgconfigItems = makeSetupHook { } ../build-support/setup-hooks/copy-pkgconfig-items.sh;
+  copyPkgconfigItems = makeSetupHook {
+    name = "copy-pkg-config-items-hook";
+  } ../build-support/setup-hooks/copy-pkgconfig-items.sh;
 
   makePkgconfigItem = callPackage ../build-support/make-pkgconfigitem { };
 
@@ -980,17 +989,17 @@ with pkgs;
 
   makeWrapper = makeShellWrapper;
 
-  makeShellWrapper = makeSetupHook
-    { deps = [ dieHook ];
-      substitutions = {
-        # targetPackages.runtimeShell only exists when pkgs == targetPackages (when targetPackages is not  __raw)
-        shell = if targetPackages ? runtimeShell then targetPackages.runtimeShell else throw "makeWrapper/makeShellWrapper must be in nativeBuildInputs";
-      };
-      passthru = {
-        tests = tests.makeWrapper;
-      };
-    }
-    ../build-support/setup-hooks/make-wrapper.sh;
+  makeShellWrapper = makeSetupHook {
+    name = "make-shell-wrapper-hook";
+    deps = [ dieHook ];
+    substitutions = {
+      # targetPackages.runtimeShell only exists when pkgs == targetPackages (when targetPackages is not  __raw)
+      shell = if targetPackages ? runtimeShell then targetPackages.runtimeShell else throw "makeWrapper/makeShellWrapper must be in nativeBuildInputs";
+    };
+    passthru = {
+      tests = tests.makeWrapper;
+    };
+  } ../build-support/setup-hooks/make-wrapper.sh;
 
   makeBinaryWrapper = callPackage ../build-support/setup-hooks/make-binary-wrapper { };
 
@@ -1031,9 +1040,10 @@ with pkgs;
 
   setupSystemdUnits = callPackage ../build-support/setup-systemd-units.nix { };
 
-  shortenPerlShebang = makeSetupHook
-    { deps = [ dieHook ]; }
-    ../build-support/setup-hooks/shorten-perl-shebang.sh;
+  shortenPerlShebang = makeSetupHook {
+    name = "shorten-perl-shebang-hook";
+    deps = [ dieHook ];
+  } ../build-support/setup-hooks/shorten-perl-shebang.sh;
 
   singularity-tools = callPackage ../build-support/singularity-tools { };
 
@@ -1070,7 +1080,9 @@ with pkgs;
 
   inherit (lib.systems) platforms;
 
-  setJavaClassPath = makeSetupHook { } ../build-support/setup-hooks/set-java-classpath.sh;
+  setJavaClassPath = makeSetupHook {
+    name = "set-java-classpath-hook";
+  } ../build-support/setup-hooks/set-java-classpath.sh;
 
   fixDarwinDylibNames = makeSetupHook {
     name = "fix-darwin-dylib-names-hook";
@@ -1081,23 +1093,31 @@ with pkgs;
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
 
   desktopToDarwinBundle = makeSetupHook {
+    name = "desktop-to-darwin-bundle-hook";
     deps = [ writeDarwinBundle librsvg imagemagick python3Packages.icnsutil ];
   } ../build-support/setup-hooks/desktop-to-darwin-bundle.sh;
 
-  keepBuildTree = makeSetupHook { } ../build-support/setup-hooks/keep-build-tree.sh;
+  keepBuildTree = makeSetupHook {
+    name = "keep-build-tree-hook";
+  } ../build-support/setup-hooks/keep-build-tree.sh;
 
-  enableGCOVInstrumentation = makeSetupHook { } ../build-support/setup-hooks/enable-coverage-instrumentation.sh;
+  enableGCOVInstrumentation = makeSetupHook {
+    name = "enable-gcov-instrumentation-hook";
+  } ../build-support/setup-hooks/enable-coverage-instrumentation.sh;
 
-  makeGCOVReport = makeSetupHook
-    { deps = [ lcov enableGCOVInstrumentation ]; }
-    ../build-support/setup-hooks/make-coverage-analysis-report.sh;
+  makeGCOVReport = makeSetupHook {
+    name = "make-gcov-report-hook";
+    deps = [ lcov enableGCOVInstrumentation ];
+  } ../build-support/setup-hooks/make-coverage-analysis-report.sh;
 
   makeHardcodeGsettingsPatch = callPackage ../build-support/make-hardcode-gsettings-patch { };
 
   # intended to be used like nix-build -E 'with import <nixpkgs> {}; enableDebugging fooPackage'
   enableDebugging = pkg: pkg.override { stdenv = stdenvAdapters.keepDebugInfo pkg.stdenv; };
 
-  findXMLCatalogs = makeSetupHook { } ../build-support/setup-hooks/find-xml-catalogs.sh;
+  findXMLCatalogs = makeSetupHook {
+    name = "find-xml-catalogs-hook";
+  } ../build-support/setup-hooks/find-xml-catalogs.sh;
 
   wrapGAppsHook = callPackage ../build-support/setup-hooks/wrap-gapps-hook {
     makeWrapper = makeBinaryWrapper;
@@ -1107,11 +1127,17 @@ with pkgs;
 
   wrapGAppsNoGuiHook = wrapGAppsHook.override { isGraphical = false; };
 
-  separateDebugInfo = makeSetupHook { } ../build-support/setup-hooks/separate-debug-info.sh;
+  separateDebugInfo = makeSetupHook {
+    name = "separate-debug-info-hook";
+  } ../build-support/setup-hooks/separate-debug-info.sh;
 
-  setupDebugInfoDirs = makeSetupHook { } ../build-support/setup-hooks/setup-debug-info-dirs.sh;
+  setupDebugInfoDirs = makeSetupHook {
+    name = "setup-debug-info-dirs-hook";
+  } ../build-support/setup-hooks/setup-debug-info-dirs.sh;
 
-  useOldCXXAbi = makeSetupHook { } ../build-support/setup-hooks/use-old-cxx-abi.sh;
+  useOldCXXAbi = makeSetupHook {
+    name = "use-old-cxx-abi-hook";
+  } ../build-support/setup-hooks/use-old-cxx-abi.sh;
 
   iconConvTools = callPackage ../build-support/icon-conv-tools {};
 
@@ -1368,6 +1394,8 @@ with pkgs;
 
   dwarfs = callPackage ../tools/filesystems/dwarfs { };
 
+  copier = callPackage ../tools/misc/copier { };
+
   gamemode = callPackage ../tools/games/gamemode {
     libgamemode32 = pkgsi686Linux.gamemode.lib;
   };
@@ -3734,7 +3762,9 @@ with pkgs;
   brutespray = callPackage ../tools/security/brutespray { };
 
   breakpointHook = assert stdenv.buildPlatform.isLinux;
-    makeSetupHook { } ../build-support/setup-hooks/breakpoint-hook.sh;
+    makeSetupHook {
+      name = "breakpoint-hook";
+    } ../build-support/setup-hooks/breakpoint-hook.sh;
 
   btrfs-progs = callPackage ../tools/filesystems/btrfs-progs { };
 
@@ -5278,6 +5308,8 @@ with pkgs;
 
   pika = callPackage ../applications/graphics/pika { };
 
+  pkg = callPackage ../tools/package-management/pkg { };
+
   playerctl = callPackage ../tools/audio/playerctl { };
 
   pn = callPackage ../tools/text/pn { };
@@ -15844,7 +15876,10 @@ with pkgs;
 
   svdtools = callPackage ../development/embedded/svdtools { };
 
-  swift = callPackage ../development/compilers/swift { };
+  swiftPackages = recurseIntoAttrs (callPackage ../development/compilers/swift { });
+  inherit (swiftPackages) swift swiftpm sourcekit-lsp;
+
+  swiftpm2nix = callPackage ../development/tools/swiftpm2nix { };
 
   swiProlog = callPackage ../development/compilers/swi-prolog {
     openssl = openssl_1_1;
@@ -18626,11 +18661,13 @@ with pkgs;
   xcodebuild6 = xcodebuild.override { stdenv = llvmPackages_6.stdenv; };
   xcbuild = xcodebuild;
   xcbuildHook = makeSetupHook {
+    name = "xcbuild-hook";
     deps = [ xcbuild ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
   # xcbuild with llvm 6
   xcbuild6Hook = makeSetupHook {
+    name = "xcbuild6-hook";
     deps = [ xcodebuild6 ];
   } ../development/tools/xcbuild/setup-hook.sh  ;
 
@@ -21888,6 +21925,7 @@ with pkgs;
 
   memorymapping = callPackage ../development/libraries/memorymapping { };
   memorymappingHook = makeSetupHook {
+    name = "memorymapping-hook";
     deps = [ memorymapping ];
   } ../development/libraries/memorymapping/setup-hook.sh;
 
@@ -21895,6 +21933,7 @@ with pkgs;
 
   memstream = callPackage ../development/libraries/memstream { };
   memstreamHook = makeSetupHook {
+    name = "memstream-hook";
     deps = [ memstream ];
   } ../development/libraries/memstream/setup-hook.sh;
 
@@ -22573,9 +22612,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices OpenGL Cocoa AGL;
   };
 
-  qmake48Hook = makeSetupHook
-    { substitutions = { qt4 = qt48; }; }
-    ../development/libraries/qt-4.x/4.8/qmake-hook.sh;
+  qmake48Hook = makeSetupHook {
+    name = "qmake4.8-hook";
+    substitutions = { qt4 = qt48; };
+  } ../development/libraries/qt-4.x/4.8/qmake-hook.sh;
 
   qmake4Hook = qmake48Hook;
 
@@ -25471,6 +25511,8 @@ with pkgs;
 
   erofs-utils = callPackage ../os-specific/linux/erofs-utils { };
 
+  evdev-proto = callPackage ../os-specific/bsd/freebsd/evdev-proto { };
+
   fscryptctl = callPackage ../os-specific/linux/fscryptctl { };
   # unstable until the first 1.x release
   fscrypt-experimental = callPackage ../os-specific/linux/fscrypt { };
@@ -38682,7 +38724,7 @@ with pkgs;
 
   mictray = callPackage ../tools/audio/mictray { };
 
-  swift-corelibs-libdispatch = callPackage ../development/libraries/swift-corelibs-libdispatch { };
+  swift-corelibs-libdispatch = swiftPackages.Dispatch;
 
   swaysettings = callPackage ../applications/misc/swaysettings { };
 
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index cb32a46ca25d..cf00c3da93cf 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -120,6 +120,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
   rewrite-tbd = callPackage ../os-specific/darwin/rewrite-tbd { };
 
   checkReexportsHook = pkgs.makeSetupHook {
+    name = "darwin-check-reexports-hook";
     deps = [ pkgs.darwin.print-reexports ];
   } ../os-specific/darwin/print-reexports/setup-hook.sh;
 
@@ -140,6 +141,7 @@ impure-cmds // appleSourcePackages // chooseLibs // {
   signingUtils = callPackage ../os-specific/darwin/signing-utils { };
 
   autoSignDarwinBinariesHook = pkgs.makeSetupHook {
+    name = "auto-sign-darwin-binaries-hook";
     deps = [ self.signingUtils ];
   } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 6858e37fabeb..dbe96bd096f8 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -47,10 +47,10 @@ pkgs.releaseTools.sourceTarball {
     opts=(--option build-users-group "")
     nix-store --init
 
-    header "checking eval-release.nix"
+    echo "checking eval-release.nix"
     nix-instantiate --eval --strict --show-trace ./maintainers/scripts/eval-release.nix > /dev/null
 
-    header "checking find-tarballs.nix"
+    echo "checking find-tarballs.nix"
     nix-instantiate --readonly-mode --eval --strict --show-trace --json \
        ./maintainers/scripts/find-tarballs.nix \
       --arg expr 'import ./maintainers/scripts/all-tarballs.nix' > $TMPDIR/tarballs.json
@@ -61,7 +61,7 @@ pkgs.releaseTools.sourceTarball {
       exit 1
     fi
 
-    header "generating packages.json"
+    echo "generating packages.json"
     mkdir -p $out/nix-support
     echo -n '{"version":2,"packages":' > tmp
     nix-env -f . -I nixpkgs=$src -qa --meta --json --arg config 'import ${./packages-config.nix}' "''${opts[@]}" >> tmp
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index e2b81b20c5b0..ab9dac4b380c 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -32,7 +32,7 @@ pkgs.runCommand "nixpkgs-release-checks" { src = nixpkgs; buildInputs = [nix]; }
 
     # Check that all-packages.nix evaluates on a number of platforms without any warnings.
     for platform in ${pkgs.lib.concatStringsSep " " supportedSystems}; do
-        header "checking Nixpkgs on $platform"
+        echo "checking Nixpkgs on $platform"
 
         # To get a call trace; see https://nixos.org/manual/nixpkgs/stable/#function-library-lib.trivial.warn
         # Relies on impure eval
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c6af3091cf24..d73859a0dd18 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4751,6 +4751,8 @@ self: super: with self; {
 
   itemloaders = callPackage ../development/python-modules/itemloaders { };
 
+  iteration-utilities = callPackage ../development/python-modules/iteration-utilities { };
+
   iterm2 = callPackage ../development/python-modules/iterm2 { };
 
   itsdangerous = callPackage ../development/python-modules/itsdangerous { };
@@ -4846,6 +4848,8 @@ self: super: with self; {
 
   jinja2 = callPackage ../development/python-modules/jinja2 { };
 
+  jinja2-ansible-filters = callPackage ../development/python-modules/jinja2-ansible-filters { };
+
   jinja2-git = callPackage ../development/python-modules/jinja2-git { };
 
   jinja2_pluralize = callPackage ../development/python-modules/jinja2_pluralize { };
@@ -5909,6 +5913,8 @@ self: super: with self; {
 
   mkdocstrings-python = callPackage ../development/python-modules/mkdocstrings-python { };
 
+  mkdocs-mermaid2-plugin = callPackage ../development/python-modules/mkdocs-mermaid2-plugin { };
+
   mkl-service = callPackage ../development/python-modules/mkl-service { };
 
   ml-collections = callPackage ../development/python-modules/ml-collections { };
@@ -9638,6 +9644,8 @@ self: super: with self; {
 
   pyyaml-env-tag = callPackage ../development/python-modules/pyyaml-env-tag { };
 
+  pyyaml-include = callPackage ../development/python-modules/pyyaml-include { };
+
   pyzerproc = callPackage ../development/python-modules/pyzerproc { };
 
   pyzmq = callPackage ../development/python-modules/pyzmq { };
@@ -10732,6 +10740,8 @@ self: super: with self; {
 
   sphinx-book-theme = callPackage ../development/python-modules/sphinx-book-theme { };
 
+  sphinx-codeautolink = callPackage ../development/python-modules/sphinx-codeautolink { };
+
   sphinx-comments = callPackage ../development/python-modules/sphinx-comments { };
 
   sphinx-design = callPackage ../development/python-modules/sphinx-design { };
@@ -10740,14 +10750,22 @@ self: super: with self; {
 
   sphinx-fortran = callPackage ../development/python-modules/sphinx-fortran { };
 
+  sphinx-hoverxref = callPackage ../development/python-modules/sphinx-hoverxref { };
+
   sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { };
 
   sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { };
 
+  sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { };
+
   sphinx-pytest = callPackage ../development/python-modules/sphinx-pytest { };
 
+  sphinx-prompt = callPackage ../development/python-modules/sphinx-prompt { };
+
   sphinx-thebe = callPackage ../development/python-modules/sphinx-thebe { };
 
+  sphinx-tabs = callPackage ../development/python-modules/sphinx-tabs { };
+
   sphinx-togglebutton = callPackage ../development/python-modules/sphinx-togglebutton { };
 
   sphinxcontrib-actdiag = callPackage ../development/python-modules/sphinxcontrib-actdiag { };
@@ -10816,6 +10834,8 @@ self: super: with self; {
 
   sphinx-argparse = callPackage ../development/python-modules/sphinx-argparse { };
 
+  sphinx-jquery = callPackage ../development/python-modules/sphinx-jquery { };
+
   sphinx-autobuild = callPackage ../development/python-modules/sphinx-autobuild { };
 
   sphinx-autodoc-typehints = callPackage ../development/python-modules/sphinx-autodoc-typehints { };
@@ -10848,6 +10868,8 @@ self: super: with self; {
 
   sphinx-testing = callPackage ../development/python-modules/sphinx-testing { };
 
+  sphinx-version-warning = callPackage ../development/python-modules/sphinx-version-warning { };
+
   sphinxext-opengraph = callPackage ../development/python-modules/sphinxext-opengraph { };
 
   spidev = callPackage ../development/python-modules/spidev { };