summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/gtkpod/default.nix7
-rw-r--r--pkgs/applications/editors/vim/default.nix6
-rw-r--r--pkgs/applications/misc/gammu/default.nix6
-rw-r--r--pkgs/applications/networking/p2p/twister/default.nix6
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix6
-rw-r--r--pkgs/applications/science/math/R/setup-hook.sh2
-rw-r--r--pkgs/applications/version-management/subversion/default.nix10
-rw-r--r--pkgs/applications/video/aegisub/default.nix28
-rw-r--r--pkgs/build-support/cabal/default.nix5
-rw-r--r--pkgs/build-support/clang-wrapper/add-flags24
-rw-r--r--pkgs/build-support/clang-wrapper/builder.sh137
-rw-r--r--pkgs/build-support/clang-wrapper/clang-wrapper.sh150
-rw-r--r--pkgs/build-support/clang-wrapper/default.nix89
-rw-r--r--pkgs/build-support/clang-wrapper/setup-hook.sh36
-rwxr-xr-xpkgs/build-support/fetchgit/nix-prefetch-git1
-rw-r--r--pkgs/build-support/fetchzip/default.nix4
-rw-r--r--pkgs/build-support/gcc-cross-wrapper/gcc-wrapper.sh11
-rw-r--r--pkgs/build-support/gcc-cross-wrapper/setup-hook.sh2
-rw-r--r--pkgs/build-support/gcc-wrapper/add-flags16
-rw-r--r--pkgs/build-support/gcc-wrapper/builder.sh214
-rw-r--r--pkgs/build-support/gcc-wrapper/default.nix246
-rw-r--r--pkgs/build-support/gcc-wrapper/gcc-wrapper.sh89
-rw-r--r--pkgs/build-support/gcc-wrapper/gnat-wrapper.sh50
-rw-r--r--pkgs/build-support/gcc-wrapper/gnatlink-wrapper.sh22
-rw-r--r--pkgs/build-support/gcc-wrapper/ld-solaris-wrapper.sh2
-rw-r--r--pkgs/build-support/gcc-wrapper/ld-wrapper.sh62
-rw-r--r--pkgs/build-support/gcc-wrapper/setup-hook.sh24
-rw-r--r--pkgs/build-support/gcc-wrapper/utils.sh8
-rw-r--r--pkgs/build-support/release/ant-build.nix2
-rw-r--r--pkgs/build-support/release/binary-tarball.nix2
-rw-r--r--pkgs/build-support/release/debian-build.nix2
-rw-r--r--pkgs/build-support/release/functions.sh49
-rw-r--r--pkgs/build-support/release/nix-build.nix7
-rw-r--r--pkgs/build-support/release/rpm-build.nix2
-rw-r--r--pkgs/build-support/setup-hooks/compress-man-pages.sh27
-rw-r--r--pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh6
-rw-r--r--pkgs/build-support/setup-hooks/move-docs.sh50
-rw-r--r--pkgs/build-support/setup-hooks/move-lib64.sh21
-rw-r--r--pkgs/build-support/setup-hooks/move-sbin.sh19
-rw-r--r--pkgs/build-support/setup-hooks/patch-shebangs.sh62
-rw-r--r--pkgs/build-support/setup-hooks/set-java-classpath.sh2
-rw-r--r--pkgs/build-support/setup-hooks/strip.sh36
-rw-r--r--pkgs/build-support/trivial-builders.nix10
-rw-r--r--pkgs/desktops/e17/e_dbus/setup-hook.sh2
-rw-r--r--pkgs/desktops/gnome-3/3.10/default.nix41
-rw-r--r--pkgs/desktops/gnome-3/3.12/default.nix40
-rw-r--r--pkgs/development/compilers/gcc/4.2-apple64/default.nix1
-rw-r--r--pkgs/development/compilers/gcc/4.6/default.nix2
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix2
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix3
-rw-r--r--pkgs/development/compilers/ghc/7.4.2-binary.nix3
-rw-r--r--pkgs/development/compilers/ghc/7.8.3-binary.nix93
-rw-r--r--pkgs/development/compilers/ghc/7.8.3.nix2
-rw-r--r--pkgs/development/compilers/llvm/3.4/clang.nix4
-rw-r--r--pkgs/development/compilers/llvm/3.4/llvm.nix6
-rw-r--r--pkgs/development/compilers/ocaml/4.01.0.nix2
-rw-r--r--pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff20
-rw-r--r--pkgs/development/interpreters/guile/clang.patch14
-rw-r--r--pkgs/development/interpreters/guile/default.nix2
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.0.sh2
-rw-r--r--pkgs/development/interpreters/guile/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/lua-5/5.1.nix2
-rw-r--r--pkgs/development/interpreters/perl/5.14/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/perl/5.16/default.nix22
-rw-r--r--pkgs/development/interpreters/perl/5.16/fixed-man-page-date.patch11
-rw-r--r--pkgs/development/interpreters/perl/5.16/no-date-in-perl-binary.patch11
-rw-r--r--pkgs/development/interpreters/perl/5.16/no-impure-config-time.patch11
-rw-r--r--pkgs/development/interpreters/perl/5.16/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/perl/5.20/default.nix16
-rw-r--r--pkgs/development/interpreters/perl/5.20/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/perl/sys-perl/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/pypy/2.4/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/2.6/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/2.7/default.nix1
-rw-r--r--pkgs/development/interpreters/python/2.7/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/3.2/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/3.3/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/3.4/setup-hook.sh2
-rw-r--r--pkgs/development/interpreters/ruby/ruby-1.9.3.nix8
-rw-r--r--pkgs/development/interpreters/ruby/ruby-2.0.0.nix6
-rw-r--r--pkgs/development/interpreters/ruby/ruby-2.1.0.nix6
-rw-r--r--pkgs/development/interpreters/ruby/ruby-2.1.1.nix6
-rw-r--r--pkgs/development/interpreters/ruby/ruby-2.1.2.nix6
-rw-r--r--pkgs/development/libraries/apr-util/default.nix3
-rw-r--r--pkgs/development/libraries/aspell/clang.patch18
-rw-r--r--pkgs/development/libraries/aspell/default.nix4
-rw-r--r--pkgs/development/libraries/at-spi2-atk/default.nix4
-rw-r--r--pkgs/development/libraries/at-spi2-core/default.nix12
-rw-r--r--pkgs/development/libraries/atk/default.nix4
-rw-r--r--pkgs/development/libraries/boost/boost-155-clang.patch90
-rw-r--r--pkgs/development/libraries/boost/generic.nix6
-rw-r--r--pkgs/development/libraries/cairo/default.nix4
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix9
-rw-r--r--pkgs/development/libraries/db/generic.nix4
-rw-r--r--pkgs/development/libraries/db/osx.patch20
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/fontconfig/2.10.nix61
-rw-r--r--pkgs/development/libraries/fontconfig/builder.sh5
-rw-r--r--pkgs/development/libraries/fontconfig/config-compat.patch28
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix53
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-conf.nix6
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-conf.xsl24
-rw-r--r--pkgs/development/libraries/glib/default.nix7
-rw-r--r--pkgs/development/libraries/glibc/2.19/common.nix21
-rw-r--r--pkgs/development/libraries/glibc/2.19/glibc-remove-date-from-compilation-banner.patch12
-rw-r--r--pkgs/development/libraries/glibc/2.19/glibc-remove-datetime-from-nscd.patch11
-rw-r--r--pkgs/development/libraries/gmp/5.1.x.nix3
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix9
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/gnonlin/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/linux-headers-3.9.patch27
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/python/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix4
-rw-r--r--pkgs/development/libraries/gtk+/2.x.nix4
-rw-r--r--pkgs/development/libraries/libav/default.nix2
-rw-r--r--pkgs/development/libraries/libc++/darwin.patch30
-rw-r--r--pkgs/development/libraries/libc++/default.nix30
-rw-r--r--pkgs/development/libraries/libc++/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/libc++abi/darwin.patch17
-rw-r--r--pkgs/development/libraries/libc++abi/default.nix55
-rw-r--r--pkgs/development/libraries/libc++abi/no-stdc++.patch12
-rw-r--r--pkgs/development/libraries/libdevil/default.nix9
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libedit/default.nix2
-rw-r--r--pkgs/development/libraries/libevdev/default.nix2
-rw-r--r--pkgs/development/libraries/libffi/default.nix5
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix4
-rw-r--r--pkgs/development/libraries/libgcrypt/no-build-timestamp.patch12
-rw-r--r--pkgs/development/libraries/libgpg-error/default.nix27
-rw-r--r--pkgs/development/libraries/libiconv/default.nix4
-rw-r--r--pkgs/development/libraries/libpng/default.nix6
-rw-r--r--pkgs/development/libraries/libunistring/clang.patch14
-rw-r--r--pkgs/development/libraries/libunistring/default.nix2
-rw-r--r--pkgs/development/libraries/libxml2/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/mesa-darwin/default.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix12
-rw-r--r--pkgs/development/libraries/mpc/default.nix2
-rw-r--r--pkgs/development/libraries/mpfr/default.nix2
-rw-r--r--pkgs/development/libraries/ncurses/clang.patch42
-rw-r--r--pkgs/development/libraries/ncurses/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix2
-rw-r--r--pkgs/development/libraries/openssl/no-date-in-library.patch12
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix4
-rw-r--r--pkgs/development/libraries/pango/default.nix25
-rw-r--r--pkgs/development/libraries/pcre/default.nix4
-rw-r--r--pkgs/development/libraries/polkit/default.nix4
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix13
-rw-r--r--pkgs/development/libraries/readline/6.2.nix1
-rw-r--r--pkgs/development/libraries/readline/clang.patch13
-rw-r--r--pkgs/development/libraries/serf/default.nix14
-rw-r--r--pkgs/development/libraries/slib/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/ucommon/default.nix6
-rw-r--r--pkgs/development/libraries/v8/default.nix2
-rw-r--r--pkgs/development/libraries/webkitgtk/2.4.6.nix62
-rw-r--r--pkgs/development/libraries/webkitgtk/default.nix50
-rw-r--r--pkgs/development/libraries/webkitgtk/finding-harfbuzz-icu.patch52
-rw-r--r--pkgs/development/lisp-modules/clwrapper/setup-hook.sh2
-rw-r--r--pkgs/development/ocaml-modules/ocaml-text/default.nix13
-rw-r--r--pkgs/development/ocaml-modules/ocamlmake/setup-hook.sh2
-rw-r--r--pkgs/development/tools/misc/automake/setup-hook.sh2
-rw-r--r--pkgs/development/tools/misc/ccache/default.nix2
-rw-r--r--pkgs/development/tools/misc/distcc/masq.nix4
-rw-r--r--pkgs/development/tools/misc/patchelf/default.nix2
-rw-r--r--pkgs/development/tools/misc/patchelf/setup-hook.sh16
-rw-r--r--pkgs/development/tools/misc/pkgconfig/setup-hook.sh4
-rw-r--r--pkgs/development/tools/misc/sloccount/default.nix1
-rw-r--r--pkgs/development/tools/ocaml/findlib/default.nix4
-rw-r--r--pkgs/development/tools/vagrant/default.nix4
-rw-r--r--pkgs/development/web/nodejs/setup-hook.sh2
-rw-r--r--pkgs/games/spring/default.nix4
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel-headers/3.7.nix4
-rw-r--r--pkgs/os-specific/linux/paxctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/paxctl/setup-hook.sh8
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix37
-rw-r--r--pkgs/os-specific/linux/systemd/fixes.patch2676
-rw-r--r--pkgs/servers/http/nginx/default.nix2
-rw-r--r--pkgs/servers/x11/xorg/default.nix86
-rw-r--r--pkgs/servers/x11/xorg/extra.list6
-rw-r--r--pkgs/servers/x11/xorg/old.list4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix14
-rw-r--r--pkgs/servers/x11/xorg/tarballs-7.7.list16
-rw-r--r--pkgs/servers/x11/xorg/xf86-video-intel-testing.nix14
-rw-r--r--pkgs/shells/bash/bash-4.2-patches.nix2
-rw-r--r--pkgs/stdenv/adapters.nix28
-rw-r--r--pkgs/stdenv/darwin/default.nix43
-rw-r--r--pkgs/stdenv/darwin/prehook.nix9
-rw-r--r--pkgs/stdenv/default.nix26
-rw-r--r--pkgs/stdenv/generic/builder.sh12
-rw-r--r--pkgs/stdenv/generic/default.nix185
-rw-r--r--pkgs/stdenv/generic/setup.sh417
-rw-r--r--pkgs/stdenv/linux/default.nix157
-rw-r--r--pkgs/stdenv/native/default.nix13
-rw-r--r--pkgs/stdenv/nix/default.nix21
-rw-r--r--pkgs/tools/archivers/sharutils/default.nix6
-rw-r--r--pkgs/tools/archivers/unzip/default.nix22
-rw-r--r--pkgs/tools/archivers/unzip/setup-hook.sh5
-rw-r--r--pkgs/tools/compression/bzip2/default.nix2
-rw-r--r--pkgs/tools/compression/xz/default.nix6
-rw-r--r--pkgs/tools/filesystems/netatalk/default.nix4
-rw-r--r--pkgs/tools/misc/coreutils/default.nix16
-rw-r--r--pkgs/tools/misc/coreutils/gets-undeclared.patch71
-rw-r--r--pkgs/tools/misc/coreutils/help2man.patch40
-rw-r--r--pkgs/tools/misc/getopt/default.nix3
-rw-r--r--pkgs/tools/misc/mdbtools/git.nix8
-rw-r--r--pkgs/tools/networking/curl/default.nix4
-rw-r--r--pkgs/tools/networking/isync/default.nix2
-rw-r--r--pkgs/tools/networking/strongswan/default.nix2
-rw-r--r--pkgs/tools/package-management/checkinstall/default.nix3
-rw-r--r--pkgs/tools/package-management/checkinstall/set-buildroot.patch15
-rw-r--r--pkgs/tools/package-management/nix/default.nix3
-rw-r--r--pkgs/tools/package-management/nix/unstable.nix5
-rw-r--r--pkgs/tools/security/clamav/default.nix9
-rw-r--r--pkgs/tools/security/gnupg/20.nix1
-rw-r--r--pkgs/tools/security/gnupg/clang.patch13
-rw-r--r--pkgs/tools/system/tree/default.nix1
-rw-r--r--pkgs/tools/text/gnugrep/default.nix27
-rw-r--r--pkgs/tools/text/gnugrep/test-localeconv.patch18
-rw-r--r--pkgs/tools/text/groff/default.nix8
-rw-r--r--pkgs/tools/text/sgml/opensp/default.nix13
-rw-r--r--pkgs/tools/text/sgml/opensp/setup-hook.sh2
-rw-r--r--pkgs/tools/typesetting/tex/tetex/clang.patch13
-rw-r--r--pkgs/tools/typesetting/tex/tetex/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/tetex/setup-hook.sh2
-rw-r--r--pkgs/tools/typesetting/tex/tex4ht/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/aggregate.nix4
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix1
-rw-r--r--pkgs/tools/typesetting/tex/texlive/setup-hook.sh2
-rw-r--r--pkgs/top-level/all-packages.nix154
-rw-r--r--pkgs/top-level/haskell-defaults.nix4
238 files changed, 2629 insertions, 4706 deletions
diff --git a/pkgs/applications/audio/gtkpod/default.nix b/pkgs/applications/audio/gtkpod/default.nix
index 80a7cf52cd8d..9c08b2ab6d7d 100644
--- a/pkgs/applications/audio/gtkpod/default.nix
+++ b/pkgs/applications/audio/gtkpod/default.nix
@@ -1,11 +1,8 @@
 { stdenv, fetchurl, pkgconfig, makeWrapper, intltool, libgpod, curl, flac,
-  gnome3_12, gtk3, glib, gettext, perl, perlXMLParser , libglade, flex, libid3tag,
+  gnome, gtk3, glib, gettext, perl, perlXMLParser, flex, libglade, libid3tag,
   libvorbis, hicolor_icon_theme, gdk_pixbuf }:
 
-let
-  gnome = gnome3_12;
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   version = "2.1.4";
   name = "gtkpod-${version}";
 
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 95f654eb8cac..8f27f5409975 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation rec {
   name = "vim-${version}";
 
-  version = "7.4.335";
+  version = "7.4.410";
 
   src = fetchhg {
     url = "https://vim.googlecode.com/hg/";
-    rev = "v7-4-335";
-    sha256 = "0qnpzfcbi6fhz82pj68l4vrnigca1akq2ksrxz6krwlfhns6jhhj";
+    rev = "v7-4-410";
+    sha256 = "145llhj6gq2bh9b7p8xkxc388krrximq80b87f3cn4w4d4k9fhqp";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/gammu/default.nix b/pkgs/applications/misc/gammu/default.nix
index 56e45b11c706..b90a243aec4b 100644
--- a/pkgs/applications/misc/gammu/default.nix
+++ b/pkgs/applications/misc/gammu/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, python, pkgconfig, cmake, bluez, libusb1, curl
-, libiconv, gettext, sqlite }:
+, libiconvOrEmpty, gettext, sqlite }:
 
 with stdenv.lib;
 
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./bashcomp-dir.patch ];
 
-  buildInputs = [ python pkgconfig cmake bluez libusb1 curl libiconv
-    gettext sqlite ];
+  buildInputs = [ python pkgconfig cmake bluez libusb1 curl gettext sqlite ]
+    ++ libiconvOrEmpty;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/p2p/twister/default.nix b/pkgs/applications/networking/p2p/twister/default.nix
index 8d47ab2d777d..e6fd674e9e7c 100644
--- a/pkgs/applications/networking/p2p/twister/default.nix
+++ b/pkgs/applications/networking/p2p/twister/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, python
-, boost, db, openssl, geoip, libiconv, miniupnpc
+, boost, db, openssl, geoip, libiconvOrEmpty, miniupnpc
 , srcOnly, fetchgit
 }:
 
@@ -33,8 +33,8 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [
     autoconf automake libtool pkgconfig python
-    boost db openssl geoip libiconv miniupnpc
-  ];
+    boost db openssl geoip miniupnpc
+  ] ++ libiconvOrEmpty;
 
   postPatch = ''
     sed -i -e '/-htmldir/s|(default: [^)]*)|(default: ${twisterHTML})|' \
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 6b84143d0138..d7ae496f5aa6 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, cmake, freetype, libpng, mesa, gettext, openssl, qt4, perl, libiconv }:
+{ stdenv, fetchurl, cmake, freetype, libpng, mesa, gettext, openssl, qt4, perl
+, libiconvOrEmpty }:
 
 stdenv.mkDerivation rec {
   name = "stellarium-0.12.4";
@@ -8,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "11367hv9niyz9v47lf31vjsqkgc8da0vy2nhiyxgmk1i49p1pbhg";
   };
 
-  buildInputs = [ cmake freetype libpng mesa gettext openssl qt4 perl libiconv ];
+  buildInputs = [ cmake freetype libpng mesa gettext openssl qt4 perl ]
+    ++ libiconvOrEmpty;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/science/math/R/setup-hook.sh b/pkgs/applications/science/math/R/setup-hook.sh
index a31289bbfba9..09a775db9bf5 100644
--- a/pkgs/applications/science/math/R/setup-hook.sh
+++ b/pkgs/applications/science/math/R/setup-hook.sh
@@ -2,4 +2,4 @@ addRLibPath () {
     addToSearchPath R_LIBS_SITE $1/library
 }
 
-envHooks=(${envHooks[@]} addRLibPath)
+envHooks+=(addRLibPath)
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index c2a14665a898..1ec4866f1aa4 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -38,16 +38,14 @@ stdenv.mkDerivation rec {
     ${if pythonBindings || perlBindings then "--with-swig=${swig}" else "--without-swig"}
     ${if javahlBindings then "--enable-javahl --with-jdk=${jdk}" else ""}
     ${if stdenv.isDarwin then "--enable-keychain" else "--disable-keychain"}
-    ${if saslSupport then "--enable-sasl --with-sasl=${sasl}" else "--disable-sasl"}
-    ${if httpSupport then "--enable-serf --with-serf=${serf}" else "--disable-serf"}
+    ${if saslSupport then "--with-sasl=${sasl}" else "--without-sasl"}
+    ${if httpSupport then "--with-serf=${serf}" else "--without-serf"}
     --with-zlib=${zlib}
     --with-sqlite=${sqlite}
   '';
 
   preBuild = ''
     makeFlagsArray=(APACHE_LIBEXECDIR=$out/modules)
-  '' + stdenv.lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace "-no-cpp-precomp" ""
   '';
 
   postInstall = ''
@@ -73,10 +71,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Hack to build on Mac OS X. The system header files use C99-style
-  # comments, but Subversion passes -std=c90.
-  NIX_CFLAGS_COMPILE = "-std=c99";
-
   meta = {
     description = "A version control system intended to be a compelling replacement for CVS in the open source community";
     homepage = http://subversion.apache.org/;
diff --git a/pkgs/applications/video/aegisub/default.nix b/pkgs/applications/video/aegisub/default.nix
index 579990746097..c32235a592fd 100644
--- a/pkgs/applications/video/aegisub/default.nix
+++ b/pkgs/applications/video/aegisub/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl
-, libX11, gettext, wxGTK
-, libiconv, fontconfig, freetype
+, libX11, wxGTK
+, libiconvOrEmpty, fontconfig, freetype
 , mesa
 , libass, fftw, ffms
 , ffmpeg, pkgconfig, zlib # Undocumented (?) dependencies
@@ -29,16 +29,20 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = with stdenv.lib;
-  [ intltool libX11 gettext wxGTK libiconv fontconfig freetype mesa libass fftw ffms ffmpeg pkgconfig zlib icu boost ]
-  ++ optional spellChecking hunspell
-  ++ optional automationSupport lua
-  ++ optional openalSupport openal
-  ++ optional alsaSupport alsaLib
-  ++ optional pulseaudioSupport pulseaudio
-  ++ optional portaudioSupport portaudio
-  ;
-
-  NIX_LDFLAGS = "-liconv -lavutil -lavformat -lavcodec -lswscale -lz -lm -lGL";
+  [ pkgconfig intltool libX11 wxGTK fontconfig freetype mesa
+    libass fftw ffms ffmpeg zlib icu boost boost.lib
+  ]
+    ++ libiconvOrEmpty
+    ++ optional spellChecking hunspell
+    ++ optional automationSupport lua
+    ++ optional openalSupport openal
+    ++ optional alsaSupport alsaLib
+    ++ optional pulseaudioSupport pulseaudio
+    ++ optional portaudioSupport portaudio
+    ;
+
+
+  enableParallelBuilding = true;
 
   postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";
 
diff --git a/pkgs/build-support/cabal/default.nix b/pkgs/build-support/cabal/default.nix
index 467b0d155e74..b7c523f71815 100644
--- a/pkgs/build-support/cabal/default.nix
+++ b/pkgs/build-support/cabal/default.nix
@@ -221,6 +221,10 @@ assert !enableStaticLibraries -> versionOlder "7.7" ghc.version;
                 configureFlags+=" --ghc-option=-j$NIX_BUILD_CORES"
               ''}
 
+              ${optionalString self.stdenv.isDarwin ''
+                configureFlags+=" --with-gcc=clang"
+              ''}
+
               echo "configure flags: $extraConfigureFlags $configureFlags"
               ./Setup configure --verbose --prefix="$out" --libdir='$prefix/lib/$compiler' \
                 --libsubdir='$pkgid' $extraConfigureFlags $configureFlags 2>&1 \
@@ -243,6 +247,7 @@ assert !enableStaticLibraries -> versionOlder "7.7" ghc.version;
 
               export GHC_PACKAGE_PATH=$(${ghc.GHCPackages})
               test -n "$noHaddock" || ./Setup haddock --html --hoogle \
+                  --ghc-options=-optP-P \
                   ${optionalString self.hyperlinkSource "--hyperlink-source"}
 
               eval "$postBuild"
diff --git a/pkgs/build-support/clang-wrapper/add-flags b/pkgs/build-support/clang-wrapper/add-flags
deleted file mode 100644
index 7a9711290aa1..000000000000
--- a/pkgs/build-support/clang-wrapper/add-flags
+++ /dev/null
@@ -1,24 +0,0 @@
-# `-B@out@/bin' forces clang to use ld-wrapper.sh when calling ld.
-export NIX_CFLAGS_COMPILE="-B@out@/bin/ $NIX_CFLAGS_COMPILE"
-
-if test -e @out@/nix-support/libc-cflags; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE"
-fi
-
-if test -e @out@/nix-support/clang-cflags; then
-    export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/clang-cflags) $NIX_CFLAGS_COMPILE"
-fi
-
-if test -e @out@/nix-support/libc-ldflags; then
-    export NIX_LDFLAGS="$NIX_LDFLAGS $(cat @out@/nix-support/libc-ldflags)"
-fi
-
-if test -e @out@/nix-support/clang-ldflags; then
-    export NIX_LDFLAGS="$NIX_LDFLAGS $(cat @out@/nix-support/clang-ldflags)"
-fi
-
-if test -e @out@/nix-support/libc-ldflags-before; then
-    export NIX_LDFLAGS_BEFORE="$(cat @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE"
-fi
-
-export NIX_GCC_WRAPPER_FLAGS_SET=1
diff --git a/pkgs/build-support/clang-wrapper/builder.sh b/pkgs/build-support/clang-wrapper/builder.sh
deleted file mode 100644
index 0cdb2b96135e..000000000000
--- a/pkgs/build-support/clang-wrapper/builder.sh
+++ /dev/null
@@ -1,137 +0,0 @@
-source $stdenv/setup
-
-
-mkdir -p $out/bin
-mkdir -p $out/nix-support
-
-
-if test -z "$nativeLibc"; then
-    dynamicLinker="$libc/lib/$dynamicLinker"
-    echo $dynamicLinker > $out/nix-support/dynamic-linker
-
-    if test -e $libc/lib/32/ld-linux.so.2; then
-        echo $libc/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
-    fi
-
-    # The "-B$libc/lib/" flag is a quick hack to force clang to link
-    # against the crt1.o from our own glibc, rather than the one in
-    # /usr/lib.  (This is only an issue when using an `impure'
-    # compiler/linker, i.e., one that searches /usr/lib and so on.)
-    echo "-B$libc/lib/ -idirafter $libc/include" > $out/nix-support/libc-cflags
-
-    echo "-L$libc/lib" > $out/nix-support/libc-ldflags
-
-    # The dynamic linker is passed in `ldflagsBefore' to allow
-    # explicit overrides of the dynamic linker by callers to clang/ld
-    # (the *last* value counts, so ours should come first).
-    echo "-dynamic-linker $dynamicLinker" > $out/nix-support/libc-ldflags-before
-fi
-
-if test -n "$nativeTools"; then
-    clangPath="$nativePrefix/bin"
-    ldPath="$nativePrefix/bin"
-else
-    basePath=`echo $gcc/lib/*/*/*`
-    # Need libgcc until the llvm compiler-rt library is complete
-    clangLDFlags="$clangLDFlags -L$basePath"
-    if test -e "$gcc/lib64"; then
-        clangLDFlags="$clangLDFlags -L$gcc/lib64"
-    else
-        clangLDFlags="$clangLDFlags -L$gcc/lib"
-    fi
-
-    clangLDFlags="$clangLDFlags -L$clang/lib"
-    echo "$clangLDFlags" > $out/nix-support/clang-ldflags
-
-    # Need files like crtbegin.o from gcc
-    # It's unclear if these will ever be provided by an LLVM project
-    clangCFlags="$clangCFlags -B$basePath"
-
-    clangCFlags="$clangCFlags -isystem$clang/lib/clang/$clangVersion/include"
-    echo "$clangCFlags" > $out/nix-support/clang-cflags
-    
-    clangPath="$clang/bin"
-    ldPath="$binutils/bin"
-fi
-
-
-doSubstitute() {
-    local src=$1
-    local dst=$2
-    local uselibcxx=
-    local uselibcxxabi=
-    if test -n "$libcxx" && echo $dst | fgrep ++; then uselibcxx=$libcxx; fi
-    if test -n "$libcxxabi" && echo $dst | fgrep ++; then uselibcxxabi=$libcxxabi; fi
-    # Can't use substitute() here, because replace may not have been
-    # built yet (in the bootstrap).
-    sed \
-        -e "s^@out@^$out^g" \
-        -e "s^@shell@^$shell^g" \
-        -e "s^@libcxx@^$uselibcxx^g" \
-        -e "s^@libcxxabi@^$uselibcxxabi^g" \
-        -e "s^@clang@^$clang^g" \
-        -e "s^@clangProg@^$clangProg^g" \
-        -e "s^@binutils@^$binutils^g" \
-        -e "s^@coreutils@^$coreutils^g" \
-        -e "s^@libc@^$libc^g" \
-        -e "s^@ld@^$ldPath/ld^g" \
-        < "$src" > "$dst" 
-}
-
-
-# Make wrapper scripts around clang and clang++.  Also make symlinks
-# cc and c++
-mkClangWrapper() {
-    local dst=$1
-    local src=$2
-
-    if ! test -f "$src"; then
-        echo "$src does not exist (skipping)"
-        return 1
-    fi
-
-    clangProg="$src"
-    doSubstitute "$clangWrapper" "$dst"
-    chmod +x "$dst"
-}
-
-if mkClangWrapper $out/bin/clang $clangPath/clang
-then
-    ln -sv clang $out/bin/cc
-fi
-
-if mkClangWrapper $out/bin/clang++ $clangPath/clang++
-then
-    ln -sv clang++ $out/bin/c++
-fi
-
-
-# Create a symlink to as (the assembler).  This is useful when a
-# clang-wrapper is installed in a user environment, as it ensures that
-# the right assembler is called.
-ln -s $ldPath/as $out/bin/as
-
-
-# Make a wrapper around the linker.
-doSubstitute "$ldWrapper" "$out/bin/ld"
-chmod +x "$out/bin/ld"
-
-
-# Emit a setup hook.  Also store the path to the original Clang and
-# libc.
-test -n "$clang" && echo $clang > $out/nix-support/orig-clang
-test -n "$libc" && echo $libc > $out/nix-support/orig-libc
-
-doSubstitute "$addFlags" "$out/nix-support/add-flags.sh"
-
-doSubstitute "$setupHook" "$out/nix-support/setup-hook"
-
-cp -p $utils $out/nix-support/utils.sh
-
-
-# Propagate the wrapped clang so that if you install the wrapper, you get
-# llvm tools, the manpages, etc. as well (including for binutils
-# and Glibc).
-if test -z "$nativeTools"; then
-    echo $clang $binutils $libc > $out/nix-support/propagated-user-env-packages
-fi
diff --git a/pkgs/build-support/clang-wrapper/clang-wrapper.sh b/pkgs/build-support/clang-wrapper/clang-wrapper.sh
deleted file mode 100644
index 57715274f1e2..000000000000
--- a/pkgs/build-support/clang-wrapper/clang-wrapper.sh
+++ /dev/null
@@ -1,150 +0,0 @@
-#! @shell@ -e
-
-if test -n "$NIX_GCC_WRAPPER_START_HOOK"; then
-    source "$NIX_GCC_WRAPPER_START_HOOK"
-fi
-
-if test -z "$NIX_GCC_WRAPPER_FLAGS_SET"; then
-    source @out@/nix-support/add-flags.sh
-fi
-
-source @out@/nix-support/utils.sh
-
-
-# Figure out if linker flags should be passed.  Clang prints annoying
-# warnings when they are not needed. (does it really? Copied from gcc-wrapper)
-dontLink=0
-getVersion=0
-nonFlagArgs=0
-
-for i in "$@"; do
-    if test "$i" = "-c"; then
-        dontLink=1
-    elif test "$i" = "-S"; then
-        dontLink=1
-    elif test "$i" = "-E"; then
-        dontLink=1
-    elif test "$i" = "-E"; then
-        dontLink=1
-    elif test "$i" = "-M"; then
-        dontLink=1
-    elif test "$i" = "-MM"; then
-        dontLink=1
-    elif test "$i" = "-x"; then
-        # At least for the cases c-header or c++-header we should set dontLink.
-        # I expect no one use -x other than making precompiled headers.
-        dontLink=1
-    elif test "${i:0:1}" != "-"; then
-        nonFlagArgs=1
-    elif test "$i" = "-m32"; then
-        if test -e @out@/nix-support/dynamic-linker-m32; then
-            NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
-        fi
-    fi
-done
-
-# If we pass a flag like -Wl, then clang will call the linker unless it
-# can figure out that it has to do something else (e.g., because of a
-# "-c" flag).  So if no non-flag arguments are given, don't pass any
-# linker flags.  This catches cases like "clang" (should just print
-# "clang: no input files") and "clang -v" (should print the version).
-if test "$nonFlagArgs" = "0"; then
-    dontLink=1
-fi
-
-# Optionally filter out paths not refering to the store.
-params=("$@")
-if test "$NIX_ENFORCE_PURITY" = "1" -a -n "$NIX_STORE"; then
-    rest=()
-    n=0
-    while test $n -lt ${#params[*]}; do
-        p=${params[n]}
-        p2=${params[$((n+1))]}
-        if test "${p:0:3}" = "-L/" && badPath "${p:2}"; then
-            skip $p
-        elif test "$p" = "-L" && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
-        elif test "${p:0:3}" = "-I/" && badPath "${p:2}"; then
-            skip $p
-        elif test "$p" = "-I" && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
-        elif test "$p" = "-isystem" && badPath "$p2"; then
-            n=$((n + 1)); skip $p2
-        else
-            rest=("${rest[@]}" "$p")
-        fi
-        n=$((n + 1))
-    done
-    params=("${rest[@]}")
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE --sysroot=/var/empty"
-fi
-
-if test -n "@libcxx@"; then
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem@libcxx@/include/c++/v1 -stdlib=libc++"
-    NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK -L@libcxx@/lib -stdlib=libc++ -L@libcxxabi@/lib -lc++abi"
-fi
-
-# Add the flags for the C compiler proper.
-extraAfter=($NIX_CFLAGS_COMPILE)
-extraBefore=()
-
-if test "$dontLink" != "1"; then
-
-    # Add the flags that should only be passed to the compiler when
-    # linking.
-    extraAfter=(${extraAfter[@]} $NIX_CFLAGS_LINK)
-
-    # Add the flags that should be passed to the linker (and prevent
-    # `ld-wrapper' from adding NIX_LDFLAGS again).
-    for i in $NIX_LDFLAGS_BEFORE; do
-        extraBefore=(${extraBefore[@]} "-Wl,$i")
-    done
-    for i in $NIX_LDFLAGS; do
-	if test "${i:0:3}" = "-L/"; then
-	    extraAfter=(${extraAfter[@]} "$i")
-	else
-	    extraAfter=(${extraAfter[@]} "-Wl,$i")
-	fi
-    done
-    export NIX_LDFLAGS_SET=1
-fi
-
-# As a very special hack, if the arguments are just `-v', then don't
-# add anything.  This is to prevent `clang -v' (which normally prints
-# out the version number and returns exit code 0) from printing out
-# `No input files specified' and returning exit code 1.
-if test "$*" = "-v"; then
-    extraAfter=()
-    extraBefore=()
-fi    
-
-# Optionally print debug info.
-if test "$NIX_DEBUG" = "1"; then
-  echo "original flags to @clangProg@:" >&2
-  for i in "${params[@]}"; do
-      echo "  $i" >&2
-  done
-  echo "extraBefore flags to @clangProg@:" >&2
-  for i in ${extraBefore[@]}; do
-      echo "  $i" >&2
-  done
-  echo "extraAfter flags to @clangProg@:" >&2
-  for i in ${extraAfter[@]}; do
-      echo "  $i" >&2
-  done
-fi
-
-if test -n "$NIX_CLANG_WRAPPER_EXEC_HOOK"; then
-    source "$NIX_CLANG_WRAPPER_EXEC_HOOK"
-fi
-
-# Call the real `clang'.  Filter out warnings from stderr about unused
-# `-B' flags, since they confuse some programs.  Deep bash magic to
-# apply grep to stderr (by swapping stdin/stderr twice).
-if test -z "$NIX_CLANG_NEEDS_GREP"; then
-    @clangProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
-else
-    (@clangProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]} 3>&2 2>&1 1>&3- \
-        | (grep -v 'file path prefix' || true); exit ${PIPESTATUS[0]}) 3>&2 2>&1 1>&3-
-    exit $?
-fi    
diff --git a/pkgs/build-support/clang-wrapper/default.nix b/pkgs/build-support/clang-wrapper/default.nix
deleted file mode 100644
index 7a5d87127d90..000000000000
--- a/pkgs/build-support/clang-wrapper/default.nix
+++ /dev/null
@@ -1,89 +0,0 @@
-# The Nix `clang' stdenv.mkDerivation is not directly usable, since it doesn't
-# know where the C library and standard header files are.  Therefore
-# the compiler produced by that package cannot be installed directly
-# in a user environment and used from the command line.  This
-# stdenv.mkDerivation provides a wrapper that sets up the right environment
-# variables so that the compiler and the linker just "work".
-
-{ name ? "", stdenv, nativeTools, nativeLibc, nativePrefix ? ""
-, clang ? null, libc ? null, binutils ? null, coreutils ? null, shell ? ""
-, zlib ? null, libcxx ? null
-}:
-
-assert nativeTools -> nativePrefix != "";
-assert !nativeTools -> clang != null && binutils != null && coreutils != null;
-assert !nativeLibc -> libc != null;
-
-let
-
-  clangVersion = (builtins.parseDrvName clang.name).version;
-  clangName = (builtins.parseDrvName clang.name).name;
-
-in
-
-stdenv.mkDerivation {
-  name =
-    (if name != "" then name else clangName + "-wrapper") +
-    (if clang != null && clangVersion != "" then "-" + clangVersion else "");
-
-  builder = ./builder.sh;
-  setupHook = ./setup-hook.sh;
-  clangWrapper = ./clang-wrapper.sh;
-  ldWrapper = ../gcc-wrapper/ld-wrapper.sh;
-  utils = ../gcc-wrapper/utils.sh;
-  addFlags = ./add-flags;
-
-  inherit nativeTools nativeLibc nativePrefix clang clangVersion libcxx;
-
-  libcxxabi = libcxx.abi or null;
-
-  gcc = clang.gcc;
-  libc = if nativeLibc then null else libc;
-  binutils = if nativeTools then null else binutils;
-  # The wrapper scripts use 'cat', so we may need coreutils
-  coreutils = if nativeTools then null else coreutils;
-
-  langC = true;
-  langCC = true;
-  shell = if shell == "" then stdenv.shell else
-    if builtins.isAttrs shell then (shell + shell.shellPath)
-    else shell;
-
-  crossAttrs = {
-    shell = shell.crossDrv + shell.crossDrv.shellPath;
-    libc = libc.crossDrv;
-    coreutils = coreutils.crossDrv;
-    binutils = binutils.crossDrv;
-    clang = clang.crossDrv;
-    #
-    # This is not the best way to do this. I think the reference should be
-    # the style in the gcc-cross-wrapper, but to keep a stable stdenv now I
-    # do this sufficient if/else.
-    dynamicLinker =
-      (if stdenv.cross.arch == "arm" then "ld-linux.so.3" else
-       if stdenv.cross.arch == "mips" then "ld.so.1" else
-       if stdenv.lib.hasSuffix "pc-gnu" stdenv.cross.config then "ld.so.1" else
-       abort "don't know the name of the dynamic linker for this platform");
-  };
-
-  meta =
-    let clang_ = if clang != null then clang else {}; in
-    (if clang_ ? meta then removeAttrs clang.meta ["priority"] else {}) //
-    { description =
-        stdenv.lib.attrByPath ["meta" "description"] "System C compiler" clang_
-        + " (wrapper script)";
-    };
-
-  # The dynamic linker has different names on different Linux platforms.
-  dynamicLinker =
-    if !nativeLibc then
-      (if stdenv.system == "i686-linux" then "ld-linux.so.2" else
-       if stdenv.system == "x86_64-linux" then "ld-linux-x86-64.so.2" else
-       if stdenv.isArm then "ld-linux.so.3" else
-       if stdenv.system == "powerpc-linux" then "ld.so.1" else
-       if stdenv.system == "mips64el-linux" then "ld.so.1" else
-       abort "don't know the name of the dynamic linker for this platform")
-    else "";
-
-  preferLocalBuild = true;
-}
diff --git a/pkgs/build-support/clang-wrapper/setup-hook.sh b/pkgs/build-support/clang-wrapper/setup-hook.sh
deleted file mode 100644
index f7687651eaf6..000000000000
--- a/pkgs/build-support/clang-wrapper/setup-hook.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-addCVars () {
-    if test -d $1/include; then
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem $1/include"
-    fi
-
-    if test -d $1/lib64; then
-        export NIX_LDFLAGS="$NIX_LDFLAGS -L$1/lib64"
-    fi
-
-    if test -d $1/lib; then
-        export NIX_LDFLAGS="$NIX_LDFLAGS -L$1/lib"
-    fi
-}
-
-envHooks=(${envHooks[@]} addCVars)
-
-# Note: these come *after* $out in the PATH (see setup.sh).
-
-if test -n "@clang@"; then
-    addToSearchPath PATH @clang@/bin
-fi
-
-if test -n "@binutils@"; then
-    addToSearchPath PATH @binutils@/bin
-fi
-
-if test -n "@libc@"; then
-    addToSearchPath PATH @libc@/bin
-fi
-
-if test -n "@coreutils@"; then
-    addToSearchPath PATH @coreutils@/bin
-fi
-
-: ${CXX:=clang++}
-export CXX
diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index ff84f5adce97..7fa76334396a 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -83,6 +83,7 @@ init_remote(){
     local url=$1
     git init
     git remote add origin $url
+    ( [ -n "$http_proxy" ] && git config http.proxy $http_proxy ) || true
 }
 
 # Return the reference of an hash if it exists on the remote repository.
diff --git a/pkgs/build-support/fetchzip/default.nix b/pkgs/build-support/fetchzip/default.nix
index 7c6e16a05892..12fb69ba8efd 100644
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@@ -13,9 +13,7 @@
 , ... } @ args:
 
 fetchurl ({
-  # Remove the extension, because otherwise unpackPhase will get
-  # confused. FIXME: fix unpackPhase.
-  name = args.name or lib.removeSuffix ".zip" (lib.removeSuffix ".tar.gz" (baseNameOf url));
+  name = args.name or (baseNameOf url);
 
   recursiveHash = true;
 
diff --git a/pkgs/build-support/gcc-cross-wrapper/gcc-wrapper.sh b/pkgs/build-support/gcc-cross-wrapper/gcc-wrapper.sh
index f954cae05d86..ec1f6004edd9 100644
--- a/pkgs/build-support/gcc-cross-wrapper/gcc-wrapper.sh
+++ b/pkgs/build-support/gcc-cross-wrapper/gcc-wrapper.sh
@@ -114,13 +114,4 @@ fi
 # We want gcc to call the wrapper linker, not that of binutils.
 export PATH="@ldPath@:$PATH"
 
-# Call the real `gcc'.  Filter out warnings from stderr about unused
-# `-B' flags, since they confuse some programs.  Deep bash magic to
-# apply grep to stderr (by swapping stdin/stderr twice).
-if test -z "$NIX_GCC_NEEDS_GREP"; then
-    @gccProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
-else
-    (@gccProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]} 3>&2 2>&1 1>&3- \
-        | (grep -v 'file path prefix' || true); exit ${PIPESTATUS[0]}) 3>&2 2>&1 1>&3-
-    exit $?
-fi    
+exec @gccProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
diff --git a/pkgs/build-support/gcc-cross-wrapper/setup-hook.sh b/pkgs/build-support/gcc-cross-wrapper/setup-hook.sh
index 433d36ced434..ce5f6e56136e 100644
--- a/pkgs/build-support/gcc-cross-wrapper/setup-hook.sh
+++ b/pkgs/build-support/gcc-cross-wrapper/setup-hook.sh
@@ -11,7 +11,7 @@ crossAddCVars () {
     fi
 }
 
-crossEnvHooks=(${crossEnvHooks[@]} crossAddCVars)
+crossEnvHooks+=(crossAddCVars)
 
 crossStripDirs() {
     local dirs="$1"
diff --git a/pkgs/build-support/gcc-wrapper/add-flags b/pkgs/build-support/gcc-wrapper/add-flags
index 26e536f6d575..d75f378e2c97 100644
--- a/pkgs/build-support/gcc-wrapper/add-flags
+++ b/pkgs/build-support/gcc-wrapper/add-flags
@@ -1,27 +1,27 @@
 # `-B@out@/bin' forces gcc to use ld-wrapper.sh when calling ld.
 export NIX_CFLAGS_COMPILE="-B@out@/bin/ $NIX_CFLAGS_COMPILE"
 
-if test -e @out@/nix-support/libc-cflags; then
+if [ -e @out@/nix-support/libc-cflags ]; then
     export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE"
 fi
 
-if test -e @out@/nix-support/gcc-cflags; then
+if [ -e @out@/nix-support/gcc-cflags ]; then
     export NIX_CFLAGS_COMPILE="$(cat @out@/nix-support/gcc-cflags) $NIX_CFLAGS_COMPILE"
 fi
 
-if test -e @out@/nix-support/gnat-cflags; then
+if [ -e @out@/nix-support/gnat-cflags ]; then
     export NIX_GNATFLAGS_COMPILE="$(cat @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE"
 fi
 
-if test -e @out@/nix-support/libc-ldflags; then
-    export NIX_LDFLAGS="$NIX_LDFLAGS $(cat @out@/nix-support/libc-ldflags)"
+if [ -e @out@/nix-support/libc-ldflags ]; then
+    export NIX_LDFLAGS+=" $(cat @out@/nix-support/libc-ldflags)"
 fi
 
-if test -e @out@/nix-support/gcc-ldflags; then
-    export NIX_LDFLAGS="$NIX_LDFLAGS $(cat @out@/nix-support/gcc-ldflags)"
+if [ -e @out@/nix-support/gcc-ldflags ]; then
+    export NIX_LDFLAGS+=" $(cat @out@/nix-support/gcc-ldflags)"
 fi
 
-if test -e @out@/nix-support/libc-ldflags-before; then
+if [ -e @out@/nix-support/libc-ldflags-before ]; then
     export NIX_LDFLAGS_BEFORE="$(cat @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE"
 fi
 
diff --git a/pkgs/build-support/gcc-wrapper/builder.sh b/pkgs/build-support/gcc-wrapper/builder.sh
deleted file mode 100644
index c79680712ee7..000000000000
--- a/pkgs/build-support/gcc-wrapper/builder.sh
+++ /dev/null
@@ -1,214 +0,0 @@
-source $stdenv/setup
-
-
-mkdir -p $out/bin
-mkdir -p $out/nix-support
-
-
-if test -z "$nativeLibc"; then
-    dynamicLinker="$libc/lib/$dynamicLinker"
-    echo $dynamicLinker > $out/nix-support/dynamic-linker
-
-    if test -e $libc/lib/32/ld-linux.so.2; then
-        echo $libc/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
-    fi
-
-    # The "-B$libc/lib/" flag is a quick hack to force gcc to link
-    # against the crt1.o from our own glibc, rather than the one in
-    # /usr/lib.  (This is only an issue when using an `impure'
-    # compiler/linker, i.e., one that searches /usr/lib and so on.)
-    #
-    # Unfortunately, setting -B appears to override the default search
-    # path. Thus, the gcc-specific "../includes-fixed" directory is
-    # now longer searched and glibc's <limits.h> header fails to
-    # compile, because it uses "#include_next <limits.h>" to find the
-    # limits.h file in ../includes-fixed. To remedy the problem,
-    # another -idirafter is necessary to add that directory again.
-    echo "-B$libc/lib/ -idirafter $libc/include -idirafter $gcc/lib/gcc/*/*/include-fixed" > $out/nix-support/libc-cflags
-
-    echo "-L$libc/lib" > $out/nix-support/libc-ldflags
-
-    # The dynamic linker is passed in `ldflagsBefore' to allow
-    # explicit overrides of the dynamic linker by callers to gcc/ld
-    # (the *last* value counts, so ours should come first).
-    echo "-dynamic-linker" $dynamicLinker > $out/nix-support/libc-ldflags-before
-fi
-
-if test -n "$nativeTools"; then
-    gccPath="$nativePrefix/bin"
-    ldPath="$nativePrefix/bin"
-else
-    if test -e "$gcc/lib64"; then
-        gccLDFlags="$gccLDFlags -L$gcc/lib64"
-    fi
-    gccLDFlags="$gccLDFlags -L$gcc/lib"
-    if [ -n "$langVhdl" ]; then
-        gccLDFlags="$gccLDFlags -L$zlib/lib"
-    fi
-    echo "$gccLDFlags" > $out/nix-support/gcc-ldflags
-
-    # GCC shows $gcc/lib in `gcc -print-search-dirs', but not
-    # $gcc/lib64 (even though it does actually search there...)..
-    # This confuses libtool.  So add it to the compiler tool search
-    # path explicitly.
-    if test -e "$gcc/lib64"; then
-        gccCFlags="$gccCFlags -B$gcc/lib64"
-    fi
-
-    # Find the gcc libraries path (may work only without multilib)
-    if [ -n "$langAda" ]; then
-        basePath=`echo $gcc/lib/*/*/*`
-        gccCFlags="$gccCFlags -B$basePath -I$basePath/adainclude"
-
-        gnatCFlags="-aI$basePath/adainclude -aO$basePath/adalib"
-        echo "$gnatCFlags" > $out/nix-support/gnat-cflags
-    fi
-    echo "$gccCFlags" > $out/nix-support/gcc-cflags
-    
-    gccPath="$gcc/bin"
-    # On Illumos/Solaris we might prefer native ld
-    if test -n "$nativePrefix"; then
-      ldPath="$nativePrefix/bin"
-    else
-      ldPath="$binutils/bin"
-    fi;
-fi
-
-
-doSubstitute() {
-    local src=$1
-    local dst=$2
-    local ld="$ldPath/ld"
-    if $ld -V 2>&1 |grep Solaris; then
-      # Use Solaris specific linker wrapper
-      ld="$out/bin/ld-solaris"
-    fi
-    # Can't use substitute() here, because replace may not have been
-    # built yet (in the bootstrap).
-    sed \
-        -e "s^@out@^$out^g" \
-        -e "s^@shell@^$shell^g" \
-        -e "s^@gcc@^$gcc^g" \
-        -e "s^@gccProg@^$gccProg^g" \
-        -e "s^@gnatProg@^$gnatProg^g" \
-        -e "s^@gnatlinkProg@^$gnatlinkProg^g" \
-        -e "s^@binutils@^$binutils^g" \
-        -e "s^@coreutils@^$coreutils^g" \
-        -e "s^@libc@^$libc^g" \
-        -e "s^@ld@^$ld^g" \
-        < "$src" > "$dst" 
-}
-
-
-# Make wrapper scripts around gcc, g++, and gfortran.  Also make symlinks
-# cc, c++, and f77.
-mkGccWrapper() {
-    local dst=$1
-    local src=$2
-
-    if ! test -f "$src"; then
-        echo "$src does not exist (skipping)"
-        return 1
-    fi
-
-    gccProg="$src"
-    doSubstitute "$gccWrapper" "$dst"
-    chmod +x "$dst"
-}
-
-mkGnatWrapper() {
-    local dst=$1
-    local src=$2
-
-    if ! test -f "$src"; then
-        echo "$src does not exist (skipping)"
-        return 1
-    fi
-
-    gnatProg="$src"
-    doSubstitute "$gnatWrapper" "$dst"
-    chmod +x "$dst"
-}
-
-mkGnatLinkWrapper() {
-    local dst=$1
-    local src=$2
-
-    if ! test -f "$src"; then
-        echo "$src does not exist (skipping)"
-        return 1
-    fi
-
-    gnatlinkProg="$src"
-    doSubstitute "$gnatlinkWrapper" "$dst"
-    chmod +x "$dst"
-}
-
-if mkGccWrapper $out/bin/gcc $gccPath/gcc
-then
-    ln -sv gcc $out/bin/cc
-fi
-
-if mkGccWrapper $out/bin/g++ $gccPath/g++
-then
-    ln -sv g++ $out/bin/c++
-fi
-
-mkGccWrapper $out/bin/cpp $gccPath/cpp || true
-
-if mkGccWrapper $out/bin/gfortran $gccPath/gfortran
-then
-    ln -sv gfortran $out/bin/g77
-    ln -sv gfortran $out/bin/f77
-fi
-
-mkGccWrapper $out/bin/gcj $gccPath/gcj || true
-
-mkGccWrapper $out/bin/gccgo $gccPath/gccgo || true
-
-mkGccWrapper $out/bin/gnatgcc $gccPath/gnatgcc || true
-mkGnatWrapper $out/bin/gnatmake $gccPath/gnatmake || true
-mkGnatWrapper $out/bin/gnatbind $gccPath/gnatbind || true
-mkGnatLinkWrapper $out/bin/gnatlink $gccPath/gnatlink || true
-
-if [ -f $gccPath/ghdl ]; then
-    ln -sf $gccPath/ghdl $out/bin/ghdl
-fi
-
-
-# Create a symlink to as (the assembler).  This is useful when a
-# gcc-wrapper is installed in a user environment, as it ensures that
-# the right assembler is called.
-ln -s $ldPath/as $out/bin/as
-
-
-# Make a wrapper around the linker.
-doSubstitute "$ldWrapper" "$out/bin/ld"
-chmod +x "$out/bin/ld"
-
-# Copy solaris ld wrapper if needed
-if $ldPath/ld -V 2>&1 |grep Solaris; then
-  # Use Solaris specific linker wrapper
-  sed -e "s^@ld@^$ldPath/ld^g" < "$ldSolarisWrapper" > "$out/bin/ld-solaris"
-  chmod +x "$out/bin/ld-solaris"
-fi
-
-
-# Emit a setup hook.  Also store the path to the original GCC and
-# Glibc.
-test -n "$gcc" && echo $gcc > $out/nix-support/orig-gcc
-test -n "$libc" && echo $libc > $out/nix-support/orig-libc
-
-doSubstitute "$addFlags" "$out/nix-support/add-flags.sh"
-
-doSubstitute "$setupHook" "$out/nix-support/setup-hook"
-
-cp -p $utils $out/nix-support/utils.sh
-
-
-# Propagate the wrapped gcc so that if you install the wrapper, you get
-# tools like gcov, the manpages, etc. as well (including for binutils
-# and Glibc).
-if test -z "$nativeTools"; then
-    echo $gcc $binutils $libc > $out/nix-support/propagated-user-env-packages
-fi
diff --git a/pkgs/build-support/gcc-wrapper/default.nix b/pkgs/build-support/gcc-wrapper/default.nix
index 8e8b0b909454..b2f7d07560d3 100644
--- a/pkgs/build-support/gcc-wrapper/default.nix
+++ b/pkgs/build-support/gcc-wrapper/default.nix
@@ -1,28 +1,29 @@
-# The Nix `gcc' stdenv.mkDerivation is not directly usable, since it doesn't
-# know where the C library and standard header files are.  Therefore
-# the compiler produced by that package cannot be installed directly
-# in a user environment and used from the command line.  This
-# stdenv.mkDerivation provides a wrapper that sets up the right environment
-# variables so that the compiler and the linker just "work".
+# The Nixpkgs GCC is not directly usable, since it doesn't know where
+# the C library and standard header files are. Therefore the compiler
+# produced by that package cannot be installed directly in a user
+# environment and used from the command line. So we use a wrapper
+# script that sets up the right environment variables so that the
+# compiler and the linker just "work".
 
 { name ? "", stdenv, nativeTools, nativeLibc, nativePrefix ? ""
-, gcc ? null, libc ? null, binutils ? null, coreutils ? null, shell ? ""
-, zlib ? null
+, gcc ? null, libc ? null, binutils ? null, coreutils ? null, shell ? stdenv.shell
+, zlib ? null, extraPackages ? []
 }:
 
+with stdenv.lib;
+
 assert nativeTools -> nativePrefix != "";
 assert !nativeTools -> gcc != null && binutils != null && coreutils != null;
 assert !nativeLibc -> libc != null;
 
-# For ghdl (the vhdl language provider to gcc) we need zlib in the wrapper
-assert (gcc != null && gcc ? langVhdl && gcc.langVhdl) -> zlib != null;
+# For ghdl (the vhdl language provider to gcc) we need zlib in the wrapper.
+assert gcc.langVhdl or false -> zlib != null;
 
 let
 
   gccVersion = (builtins.parseDrvName gcc.name).version;
   gccName = (builtins.parseDrvName gcc.name).name;
 
-  langGo = if nativeTools then false else gcc ? langGo && gcc.langGo;
 in
 
 stdenv.mkDerivation {
@@ -30,31 +31,198 @@ stdenv.mkDerivation {
     (if name != "" then name else gccName + "-wrapper") +
     (if gcc != null && gccVersion != "" then "-" + gccVersion else "");
 
-  builder = ./builder.sh;
-  setupHook = ./setup-hook.sh;
-  gccWrapper = ./gcc-wrapper.sh;
-  gnatWrapper = ./gnat-wrapper.sh;
-  gnatlinkWrapper = ./gnatlink-wrapper.sh;
-  ldWrapper = ./ld-wrapper.sh;
-  ldSolarisWrapper = ./ld-solaris-wrapper.sh;
-  utils = ./utils.sh;
-  addFlags = ./add-flags;
-
-  inherit nativeTools nativeLibc nativePrefix gcc;
+  preferLocalBuild = true;
+
+  inherit gcc shell;
   libc = if nativeLibc then null else libc;
   binutils = if nativeTools then null else binutils;
-  # The wrapper scripts use 'cat', so we may need coreutils
+  # The wrapper scripts use 'cat', so we may need coreutils.
   coreutils = if nativeTools then null else coreutils;
 
-  langC = if nativeTools then true else gcc.langC;
-  langCC = if nativeTools then true else gcc.langCC;
-  langFortran = if nativeTools then false else gcc ? langFortran;
-  langAda = if nativeTools then false else gcc ? langAda && gcc.langAda;
-  langVhdl = if nativeTools then false else gcc ? langVhdl && gcc.langVhdl;
-  zlib = if gcc != null && gcc ? langVhdl then zlib else null;
-  shell = if shell == "" then stdenv.shell else
-    if builtins.isAttrs shell then (shell + shell.shellPath)
-    else shell;
+  passthru = { inherit nativeTools nativeLibc nativePrefix; };
+
+  buildCommand =
+    ''
+      mkdir -p $out/bin $out/nix-support
+
+      wrap() {
+        local dst="$1"
+        local wrapper="$2"
+        export prog="$3"
+        substituteAll "$wrapper" "$out/bin/$dst"
+        chmod +x "$out/bin/$dst"
+      }
+    ''
+
+    + optionalString (!nativeLibc) ''
+      dynamicLinker="$libc/lib/$dynamicLinker"
+      echo $dynamicLinker > $out/nix-support/dynamic-linker
+
+      if [ -e $libc/lib/32/ld-linux.so.2 ]; then
+        echo $libc/lib/32/ld-linux.so.2 > $out/nix-support/dynamic-linker-m32
+      fi
+
+      # The "-B$libc/lib/" flag is a quick hack to force gcc to link
+      # against the crt1.o from our own glibc, rather than the one in
+      # /usr/lib.  (This is only an issue when using an `impure'
+      # compiler/linker, i.e., one that searches /usr/lib and so on.)
+      #
+      # Unfortunately, setting -B appears to override the default search
+      # path. Thus, the gcc-specific "../includes-fixed" directory is
+      # now longer searched and glibc's <limits.h> header fails to
+      # compile, because it uses "#include_next <limits.h>" to find the
+      # limits.h file in ../includes-fixed. To remedy the problem,
+      # another -idirafter is necessary to add that directory again.
+      echo "-B$libc/lib/ -idirafter $libc/include -idirafter $gcc/lib/gcc/*/*/include-fixed" > $out/nix-support/libc-cflags
+
+      echo "-L$libc/lib" > $out/nix-support/libc-ldflags
+
+      # The dynamic linker is passed in `ldflagsBefore' to allow
+      # explicit overrides of the dynamic linker by callers to gcc/ld
+      # (the *last* value counts, so ours should come first).
+      echo "-dynamic-linker" $dynamicLinker > $out/nix-support/libc-ldflags-before
+
+      echo $libc > $out/nix-support/orig-libc
+    ''
+
+    + (if nativeTools then ''
+      gccPath="${nativePrefix}/bin"
+      ldPath="${nativePrefix}/bin"
+    '' else ''
+      echo $gcc > $out/nix-support/orig-gcc
+
+      # GCC shows $gcc/lib in `gcc -print-search-dirs', but not
+      # $gcc/lib64 (even though it does actually search there...)..
+      # This confuses libtool.  So add it to the compiler tool search
+      # path explicitly.
+      if [ -e "$gcc/lib64" -a ! -L "$gcc/lib64" ]; then
+        gccLDFlags+=" -L$gcc/lib64"
+        gccCFlags+=" -B$gcc/lib64"
+      fi
+      gccLDFlags+=" -L$gcc/lib"
+
+      ${optionalString gcc.langVhdl or false ''
+        gccLDFlags+=" -L${zlib}/lib"
+      ''}
+
+      # Find the gcc libraries path (may work only without multilib).
+      ${optionalString gcc.langAda or false ''
+        basePath=`echo $gcc/lib/*/*/*`
+        gccCFlags+=" -B$basePath -I$basePath/adainclude"
+        gnatCFlags="-aI$basePath/adainclude -aO$basePath/adalib"
+        echo "$gnatCFlags" > $out/nix-support/gnat-cflags
+      ''}
+
+      echo "$gccLDFlags" > $out/nix-support/gcc-ldflags
+      echo "$gccCFlags" > $out/nix-support/gcc-cflags
+
+      gccPath="$gcc/bin"
+      ldPath="$binutils/bin"
+
+      # Propagate the wrapped gcc so that if you install the wrapper,
+      # you get tools like gcov, the manpages, etc. as well (including
+      # for binutils and Glibc).
+      echo $gcc $binutils $libc > $out/nix-support/propagated-user-env-packages
+
+      echo ${toString extraPackages} > $out/nix-support/propagated-native-build-inputs
+    ''
+
+    + optionalString (stdenv.isSunOS && nativePrefix != "") ''
+      # Solaris needs an additional ld wrapper.
+      ldPath="${nativePrefix}/bin"
+      ld="$out/bin/ld-solaris"
+      wrap ld-solaris ${./ld-solaris-wrapper.sh}
+    '')
+
+    + ''
+      # Create a symlink to as (the assembler).  This is useful when a
+      # gcc-wrapper is installed in a user environment, as it ensures that
+      # the right assembler is called.
+      if [ -e $ldPath/as ]; then
+        ln -s $ldPath/as $out/bin/as
+      fi
+
+      wrap ld ${./ld-wrapper.sh} ''${ld:-$ldPath/ld}
+
+      if [ -e $binutils/bin/ld.gold ]; then
+        wrap ld.gold ${./ld-wrapper.sh} $binutils/bin/ld.gold
+      fi
+
+      if [ -e $binutils/bin/ld.bfd ]; then
+        wrap ld.bfd ${./ld-wrapper.sh} $binutils/bin/ld.bfd
+      fi
+
+      if [ -e $gccPath/gcc ]; then
+        wrap gcc ${./gcc-wrapper.sh} $gccPath/gcc
+        ln -s gcc $out/bin/cc
+      elif [ -e $gccPath/clang ]; then
+        wrap clang ${./gcc-wrapper.sh} $gccPath/clang
+        ln -s clang $out/bin/cc
+      fi
+
+      if [ -e $gccPath/g++ ]; then
+        wrap g++ ${./gcc-wrapper.sh} $gccPath/g++
+        ln -s g++ $out/bin/c++
+      elif [ -e $gccPath/clang++ ]; then
+        wrap clang++ ${./gcc-wrapper.sh} $gccPath/clang++
+        ln -s clang++ $out/bin/c++
+      fi
+
+      if [ -e $gccPath/cpp ]; then
+        wrap cpp ${./gcc-wrapper.sh} $gccPath/cpp
+      fi
+    ''
+
+    + optionalString gcc.langFortran or false ''
+      wrap gfortran ${./gcc-wrapper.sh} $gccPath/gfortran
+      ln -sv gfortran $out/bin/g77
+      ln -sv gfortran $out/bin/f77
+    ''
+
+    + optionalString gcc.langJava or false ''
+      wrap gcj ${./gcc-wrapper.sh} $gccPath/gcj
+    ''
+
+    + optionalString gcc.langGo or false ''
+      wrap gccgo ${./gcc-wrapper.sh} $gccPath/gccgo
+    ''
+
+    + optionalString gcc.langAda or false ''
+      wrap gnatgcc ${./gcc-wrapper.sh} $gccPath/gnatgcc
+      wrap gnatmake ${./gnat-wrapper.sh} $gccPath/gnatmake
+      wrap gnatbind ${./gnat-wrapper.sh} $gccPath/gnatbind
+      wrap gnatlink ${./gnatlink-wrapper.sh} $gccPath/gnatlink
+    ''
+
+    + optionalString gcc.langVhdl or false ''
+      ln -s $gccPath/ghdl $out/bin/ghdl
+    ''
+
+    + ''
+      substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
+      substituteAll ${./add-flags} $out/nix-support/add-flags.sh
+      cp -p ${./utils.sh} $out/nix-support/utils.sh
+
+      if [ -e $out/bin/clang ]; then
+        echo 'export CC; : ''${CC:=clang}' >> $out/nix-support/setup-hook
+      fi
+
+      if [ -e $out/bin/clang++ ]; then
+        echo 'export CXX; : ''${CXX:=clang++}' >> $out/nix-support/setup-hook
+      fi
+    '';
+
+  # The dynamic linker has different names on different Linux platforms.
+  dynamicLinker =
+    if !nativeLibc then
+      (if stdenv.system == "i686-linux" then "ld-linux.so.2" else
+       if stdenv.system == "x86_64-linux" then "ld-linux-x86-64.so.2" else
+       # ARM with a wildcard, which can be "" or "-armhf".
+       if stdenv.isArm then "ld-linux*.so.3" else
+       if stdenv.system == "powerpc-linux" then "ld.so.1" else
+       if stdenv.system == "mips64el-linux" then "ld.so.1" else
+       abort "Don't know the name of the dynamic linker for this platform.")
+    else "";
 
   crossAttrs = {
     shell = shell.crossDrv + shell.crossDrv.shellPath;
@@ -73,8 +241,6 @@ stdenv.mkDerivation {
        abort "don't know the name of the dynamic linker for this platform");
   };
 
-  preferLocalBuild = true;
-
   meta =
     let gcc_ = if gcc != null then gcc else {}; in
     (if gcc_ ? meta then removeAttrs gcc.meta ["priority"] else {}) //
@@ -82,16 +248,4 @@ stdenv.mkDerivation {
         stdenv.lib.attrByPath ["meta" "description"] "System C compiler" gcc_
         + " (wrapper script)";
     };
-
-  # The dynamic linker has different names on different Linux platforms.
-  dynamicLinker =
-    if !nativeLibc then
-      (if stdenv.system == "i686-linux" then "ld-linux.so.2" else
-       if stdenv.system == "x86_64-linux" then "ld-linux-x86-64.so.2" else
-       # ARM with a wildcard, which can be "" or "-armhf".
-       if stdenv.isArm then "ld-linux*.so.3" else
-       if stdenv.system == "powerpc-linux" then "ld.so.1" else
-       if stdenv.system == "mips64el-linux" then "ld.so.1" else
-       abort "don't know the name of the dynamic linker for this platform")
-    else "";
 }
diff --git a/pkgs/build-support/gcc-wrapper/gcc-wrapper.sh b/pkgs/build-support/gcc-wrapper/gcc-wrapper.sh
index 2ad7783a442c..d0c82c82dc1c 100644
--- a/pkgs/build-support/gcc-wrapper/gcc-wrapper.sh
+++ b/pkgs/build-support/gcc-wrapper/gcc-wrapper.sh
@@ -1,10 +1,10 @@
 #! @shell@ -e
 
-if test -n "$NIX_GCC_WRAPPER_START_HOOK"; then
+if [ -n "$NIX_GCC_WRAPPER_START_HOOK" ]; then
     source "$NIX_GCC_WRAPPER_START_HOOK"
 fi
 
-if test -z "$NIX_GCC_WRAPPER_FLAGS_SET"; then
+if [ -z "$NIX_GCC_WRAPPER_FLAGS_SET" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -18,26 +18,26 @@ getVersion=0
 nonFlagArgs=0
 
 for i in "$@"; do
-    if test "$i" = "-c"; then
+    if [ "$i" = -c ]; then
         dontLink=1
-    elif test "$i" = "-S"; then
+    elif [ "$i" = -S ]; then
         dontLink=1
-    elif test "$i" = "-E"; then
+    elif [ "$i" = -E ]; then
         dontLink=1
-    elif test "$i" = "-E"; then
+    elif [ "$i" = -E ]; then
         dontLink=1
-    elif test "$i" = "-M"; then
+    elif [ "$i" = -M ]; then
         dontLink=1
-    elif test "$i" = "-MM"; then
+    elif [ "$i" = -MM ]; then
         dontLink=1
-    elif test "$i" = "-x"; then
+    elif [ "$i" = -x ]; then
         # At least for the cases c-header or c++-header we should set dontLink.
         # I expect no one use -x other than making precompiled headers.
         dontLink=1
-    elif test "${i:0:1}" != "-"; then
+    elif [ "${i:0:1}" != - ]; then
         nonFlagArgs=1
-    elif test "$i" = "-m32"; then
-        if test -e @out@/nix-support/dynamic-linker-m32; then
+    elif [ "$i" = -m32 ]; then
+        if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
             NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
@@ -48,28 +48,28 @@ done
 # "-c" flag).  So if no non-flag arguments are given, don't pass any
 # linker flags.  This catches cases like "gcc" (should just print
 # "gcc: no input files") and "gcc -v" (should print the version).
-if test "$nonFlagArgs" = "0"; then
+if [ "$nonFlagArgs" = 0 ]; then
     dontLink=1
 fi
 
 
 # Optionally filter out paths not refering to the store.
 params=("$@")
-if test "$NIX_ENFORCE_PURITY" = "1" -a -n "$NIX_STORE"; then
+if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
     rest=()
     n=0
-    while test $n -lt ${#params[*]}; do
+    while [ $n -lt ${#params[*]} ]; do
         p=${params[n]}
         p2=${params[$((n+1))]}
-        if test "${p:0:3}" = "-L/" && badPath "${p:2}"; then
+        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
             skip $p
-        elif test "$p" = "-L" && badPath "$p2"; then
+        elif [ "$p" = -L ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
-        elif test "${p:0:3}" = "-I/" && badPath "${p:2}"; then
+        elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
             skip $p
-        elif test "$p" = "-I" && badPath "$p2"; then
+        elif [ "$p" = -I ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
-        elif test "$p" = "-isystem" && badPath "$p2"; then
+        elif [ "$p" = -isystem ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
         else
             rest=("${rest[@]}" "$p")
@@ -84,11 +84,20 @@ fi
 extraAfter=($NIX_CFLAGS_COMPILE)
 extraBefore=()
 
-if test "$dontLink" != "1"; then
+# When enforcing purity, pretend gcc can't find the current date and
+# time
+if [ "$NIX_ENFORCE_PURITY" = 1 ]; then
+    extraAfter+=('-D__DATE__="Jan 01 1970"'
+        '-D__TIME__="00:00:01"'
+        -Wno-builtin-macro-redefined)
+fi
+
+
+if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter=(${extraAfter[@]} $NIX_CFLAGS_LINK)
+    extraAfter+=($NIX_CFLAGS_LINK)
 
     # Add the flags that should be passed to the linker (and prevent
     # `ld-wrapper' from adding NIX_LDFLAGS again).
@@ -96,11 +105,11 @@ if test "$dontLink" != "1"; then
         extraBefore=(${extraBefore[@]} "-Wl,$i")
     done
     for i in $NIX_LDFLAGS; do
-	if test "${i:0:3}" = "-L/"; then
-	    extraAfter=(${extraAfter[@]} "$i")
-	else
-	    extraAfter=(${extraAfter[@]} "-Wl,$i")
-	fi
+        if [ "${i:0:3}" = -L/ ]; then
+            extraAfter+=("$i")
+        else
+            extraAfter+=("-Wl,$i")
+        fi
     done
     export NIX_LDFLAGS_SET=1
 fi
@@ -109,39 +118,29 @@ fi
 # add anything.  This is to prevent `gcc -v' (which normally prints
 # out the version number and returns exit code 0) from printing out
 # `No input files specified' and returning exit code 1.
-if test "$*" = "-v"; then
+if [ "$*" = -v ]; then
     extraAfter=()
     extraBefore=()
-fi    
+fi
 
 # Optionally print debug info.
-if test "$NIX_DEBUG" = "1"; then
-  echo "original flags to @gccProg@:" >&2
+if [ -n "$NIX_DEBUG" ]; then
+  echo "original flags to @prog@:" >&2
   for i in "${params[@]}"; do
       echo "  $i" >&2
   done
-  echo "extraBefore flags to @gccProg@:" >&2
+  echo "extraBefore flags to @prog@:" >&2
   for i in ${extraBefore[@]}; do
       echo "  $i" >&2
   done
-  echo "extraAfter flags to @gccProg@:" >&2
+  echo "extraAfter flags to @prog@:" >&2
   for i in ${extraAfter[@]}; do
       echo "  $i" >&2
   done
 fi
 
-if test -n "$NIX_GCC_WRAPPER_EXEC_HOOK"; then
+if [ -n "$NIX_GCC_WRAPPER_EXEC_HOOK" ]; then
     source "$NIX_GCC_WRAPPER_EXEC_HOOK"
 fi
 
-
-# Call the real `gcc'.  Filter out warnings from stderr about unused
-# `-B' flags, since they confuse some programs.  Deep bash magic to
-# apply grep to stderr (by swapping stdin/stderr twice).
-if test -z "$NIX_GCC_NEEDS_GREP"; then
-    @gccProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
-else
-    (@gccProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]} 3>&2 2>&1 1>&3- \
-        | (grep -v 'file path prefix' || true); exit ${PIPESTATUS[0]}) 3>&2 2>&1 1>&3-
-    exit $?
-fi    
+exec @prog@ ${extraBefore[@]} "${params[@]}" "${extraAfter[@]}"
diff --git a/pkgs/build-support/gcc-wrapper/gnat-wrapper.sh b/pkgs/build-support/gcc-wrapper/gnat-wrapper.sh
index f6fa4b18400a..3514ccd67325 100644
--- a/pkgs/build-support/gcc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/gcc-wrapper/gnat-wrapper.sh
@@ -1,10 +1,10 @@
 #! @shell@ -e
 
-if test -n "$NIX_GNAT_WRAPPER_START_HOOK"; then
+if [ -n "$NIX_GNAT_WRAPPER_START_HOOK" ]; then
     source "$NIX_GNAT_WRAPPER_START_HOOK"
 fi
 
-if test -z "$NIX_GNAT_WRAPPER_FLAGS_SET"; then
+if [ -z "$NIX_GNAT_WRAPPER_FLAGS_SET" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -18,14 +18,14 @@ getVersion=0
 nonFlagArgs=0
 
 for i in "$@"; do
-    if test "$i" = "-c"; then
+    if [ "$i" = -c ]; then
         dontLink=1
-    elif test "$i" = "-M"; then
+    elif [ "$i" = -M ]; then
         dontLink=1
-    elif test "${i:0:1}" != "-"; then
+    elif [ "${i:0:1}" != - ]; then
         nonFlagArgs=1
-    elif test "$i" = "-m32"; then
-        if test -e @out@/nix-support/dynamic-linker-m32; then
+    elif [ "$i" = -m32 ]; then
+        if [ -e @out@/nix-support/dynamic-linker-m32 ]; then
             NIX_LDFLAGS="$NIX_LDFLAGS -dynamic-linker $(cat @out@/nix-support/dynamic-linker-m32)"
         fi
     fi
@@ -36,26 +36,26 @@ done
 # "-c" flag).  So if no non-flag arguments are given, don't pass any
 # linker flags.  This catches cases like "gcc" (should just print
 # "gcc: no input files") and "gcc -v" (should print the version).
-if test "$nonFlagArgs" = "0"; then
+if [ "$nonFlagArgs" = 0 ]; then
     dontLink=1
 fi
 
 
 # Optionally filter out paths not refering to the store.
 params=("$@")
-if test "$NIX_ENFORCE_PURITY" = "1" -a -n "$NIX_STORE"; then
+if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
     rest=()
     n=0
-    while test $n -lt ${#params[*]}; do
+    while [ $n -lt ${#params[*]} ]; do
         p=${params[n]}
         p2=${params[$((n+1))]}
-        if test "${p:0:3}" = "-L/" && badPath "${p:2}"; then
+        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
             skip $p
-        elif test "${p:0:3}" = "-I/" && badPath "${p:2}"; then
+        elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
             skip $p
-        elif test "${p:0:4}" = "-aI/" && badPath "${p:3}"; then
+        elif [ "${p:0:4}" = -aI/ ] && badPath "${p:3}"; then
             skip $p
-        elif test "${p:0:4}" = "-aO/" && badPath "${p:3}"; then
+        elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
             skip $p
         else
             rest=("${rest[@]}" "$p")
@@ -81,33 +81,23 @@ fi
 #done
 
 # Optionally print debug info.
-if test "$NIX_DEBUG" = "1"; then
-  echo "original flags to @gnatProg@:" >&2
+if [ -n "$NIX_DEBUG" ]; then
+  echo "original flags to @prog@:" >&2
   for i in "${params[@]}"; do
       echo "  $i" >&2
   done
-  echo "extraBefore flags to @gnatProg@:" >&2
+  echo "extraBefore flags to @prog@:" >&2
   for i in ${extraBefore[@]}; do
       echo "  $i" >&2
   done
-  echo "extraAfter flags to @gnatProg@:" >&2
+  echo "extraAfter flags to @prog@:" >&2
   for i in ${extraAfter[@]}; do
       echo "  $i" >&2
   done
 fi
 
-if test -n "$NIX_GNAT_WRAPPER_EXEC_HOOK"; then
+if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
     source "$NIX_GNAT_WRAPPER_EXEC_HOOK"
 fi
 
-
-# Call the real `gcc'.  Filter out warnings from stderr about unused
-# `-B' flags, since they confuse some programs.  Deep bash magic to
-# apply grep to stderr (by swapping stdin/stderr twice).
-if test -z "$NIX_GNAT_NEEDS_GREP"; then
-    @gnatProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
-else
-    (@gnatProg@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]} 3>&2 2>&1 1>&3- \
-        | (grep -v 'file path prefix' || true); exit ${PIPESTATUS[0]}) 3>&2 2>&1 1>&3-
-    exit $?
-fi
+exec @prog@ ${extraBefore[@]} "${params[@]}" ${extraAfter[@]}
diff --git a/pkgs/build-support/gcc-wrapper/gnatlink-wrapper.sh b/pkgs/build-support/gcc-wrapper/gnatlink-wrapper.sh
index 25907108b4db..c9958dbbb413 100644
--- a/pkgs/build-support/gcc-wrapper/gnatlink-wrapper.sh
+++ b/pkgs/build-support/gcc-wrapper/gnatlink-wrapper.sh
@@ -11,33 +11,23 @@ extraBefore=()
 #done
 
 # Optionally print debug info.
-if test "$NIX_DEBUG" = "1"; then
-  echo "original flags to @gnatlinkProg@:" >&2
+if [ -n "$NIX_DEBUG" ]; then
+  echo "original flags to @prog@:" >&2
   for i in "$@"; do
       echo "  $i" >&2
   done
-  echo "extraBefore flags to @gnatlinkProg@:" >&2
+  echo "extraBefore flags to @prog@:" >&2
   for i in ${extraBefore[@]}; do
       echo "  $i" >&2
   done
-  echo "extraAfter flags to @gnatlinkProg@:" >&2
+  echo "extraAfter flags to @prog@:" >&2
   for i in ${extraAfter[@]}; do
       echo "  $i" >&2
   done
 fi
 
-if test -n "$NIX_GNAT_WRAPPER_EXEC_HOOK"; then
+if [ -n "$NIX_GNAT_WRAPPER_EXEC_HOOK" ]; then
     source "$NIX_GNAT_WRAPPER_EXEC_HOOK"
 fi
 
-
-# Call the real `gcc'.  Filter out warnings from stderr about unused
-# `-B' flags, since they confuse some programs.  Deep bash magic to
-# apply grep to stderr (by swapping stdin/stderr twice).
-if test -z "$NIX_GNAT_NEEDS_GREP"; then
-    @gnatlinkProg@ ${extraBefore[@]} "$@" ${extraAfter[@]}
-else
-    (@gnatlinkProg@ ${extraBefore[@]} "$@" ${extraAfter[@]} 3>&2 2>&1 1>&3- \
-        | (grep -v 'file path prefix' || true); exit ${PIPESTATUS[0]}) 3>&2 2>&1 1>&3-
-    exit $?
-fi
+exec @prog@ ${extraBefore[@]} "$@" ${extraAfter[@]}
diff --git a/pkgs/build-support/gcc-wrapper/ld-solaris-wrapper.sh b/pkgs/build-support/gcc-wrapper/ld-solaris-wrapper.sh
index 5a7b92b5ad7d..9216ea3198dd 100644
--- a/pkgs/build-support/gcc-wrapper/ld-solaris-wrapper.sh
+++ b/pkgs/build-support/gcc-wrapper/ld-solaris-wrapper.sh
@@ -6,7 +6,7 @@ set -u
 # I've also tried adding -z direct and -z lazyload, but it gave too many problems with C++ exceptions :'(
 # Also made sure libgcc would not be lazy-loaded, as suggested here: https://www.illumos.org/issues/2534#note-3
 #   but still no success.
-cmd="@ld@ -z ignore"
+cmd="@prog@ -z ignore"
 
 args=("$@");
 
diff --git a/pkgs/build-support/gcc-wrapper/ld-wrapper.sh b/pkgs/build-support/gcc-wrapper/ld-wrapper.sh
index 822c4a03a218..894dbf9a352c 100644
--- a/pkgs/build-support/gcc-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/gcc-wrapper/ld-wrapper.sh
@@ -1,10 +1,10 @@
 #! @shell@ -e
 
-if test -n "$NIX_LD_WRAPPER_START_HOOK"; then
+if [ -n "$NIX_LD_WRAPPER_START_HOOK" ]; then
     source "$NIX_LD_WRAPPER_START_HOOK"
 fi
 
-if test -z "$NIX_GCC_WRAPPER_FLAGS_SET"; then
+if [ -z "$NIX_GCC_WRAPPER_FLAGS_SET" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -13,26 +13,26 @@ source @out@/nix-support/utils.sh
 
 # Optionally filter out paths not refering to the store.
 params=("$@")
-if test "$NIX_ENFORCE_PURITY" = "1" -a -n "$NIX_STORE" \
-        -a \( -z "$NIX_IGNORE_LD_THROUGH_GCC" -o -z "$NIX_LDFLAGS_SET" \); then
+if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
+        -a \( -z "$NIX_IGNORE_LD_THROUGH_GCC" -o -z "$NIX_LDFLAGS_SET" \) ]; then
     rest=()
     n=0
-    while test $n -lt ${#params[*]}; do
+    while [ $n -lt ${#params[*]} ]; do
         p=${params[n]}
         p2=${params[$((n+1))]}
-        if test "${p:0:3}" = "-L/" && badPath "${p:2}"; then
+        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
             skip $p
-        elif test "$p" = "-L" && badPath "$p2"; then
+        elif [ "$p" = -L ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
-        elif test "$p" = "-rpath" && badPath "$p2"; then
+        elif [ "$p" = -rpath ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
-        elif test "$p" = "-dynamic-linker" && badPath "$p2"; then
+        elif [ "$p" = -dynamic-linker ] && badPath "$p2"; then
             n=$((n + 1)); skip $p2
-        elif test "${p:0:1}" = "/" && badPath "$p"; then
+        elif [ "${p:0:1}" = / ] && badPath "$p"; then
             # We cannot skip this; barf.
             echo "impure path \`$p' used in link" >&2
             exit 1
-        elif test "${p:0:9}" = "--sysroot"; then
+        elif [ "${p:0:9}" = --sysroot ]; then
             # Our ld is not built with sysroot support (Can we fix that?)
             :
         else
@@ -47,7 +47,7 @@ fi
 extra=()
 extraBefore=()
 
-if test -z "$NIX_LDFLAGS_SET"; then
+if [ -z "$NIX_LDFLAGS_SET" ]; then
     extra+=($NIX_LDFLAGS)
     extraBefore+=($NIX_LDFLAGS_BEFORE)
 fi
@@ -56,12 +56,12 @@ extra+=($NIX_LDFLAGS_AFTER)
 
 
 # Add all used dynamic libraries to the rpath.
-if test "$NIX_DONT_SET_RPATH" != "1"; then
+if [ "$NIX_DONT_SET_RPATH" != 1 ]; then
 
     libPath=""
     addToLibPath() {
         local path="$1"
-        if test "${path:0:1}" != "/"; then return 0; fi
+        if [ "${path:0:1}" != / ]; then return 0; fi
         case "$path" in
             *..*|*./*|*/.*|*//*)
                 local path2
@@ -75,12 +75,12 @@ if test "$NIX_DONT_SET_RPATH" != "1"; then
         esac
         libPath="$libPath $path "
     }
-    
+
     addToRPath() {
         # If the path is not in the store, don't add it to the rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib.  If not, we're screwed.
-        if test "${1:0:${#NIX_STORE}}" != "$NIX_STORE"; then return 0; fi
+        if [ "${1:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then return 0; fi
         case $rpath in
             *\ $1\ *) return 0 ;;
         esac
@@ -97,21 +97,21 @@ if test "$NIX_DONT_SET_RPATH" != "1"; then
     # First, find all -L... switches.
     allParams=("${params[@]}" ${extra[@]})
     n=0
-    while test $n -lt ${#allParams[*]}; do
+    while [ $n -lt ${#allParams[*]} ]; do
         p=${allParams[n]}
         p2=${allParams[$((n+1))]}
-        if test "${p:0:3}" = "-L/"; then
+        if [ "${p:0:3}" = -L/ ]; then
             addToLibPath ${p:2}
-        elif test "$p" = "-L"; then
+        elif [ "$p" = -L ]; then
             addToLibPath ${p2}
             n=$((n + 1))
-        elif test "$p" = "-l"; then
+        elif [ "$p" = -l ]; then
             addToLibs ${p2}
             n=$((n + 1))
-        elif test "${p:0:2}" = "-l"; then
+        elif [ "${p:0:2}" = -l ]; then
             addToLibs ${p:2}
-        elif test "$p" = "-dynamic-linker"; then
-            # Ignore the dynamic linker argument, or it 
+        elif [ "$p" = -dynamic-linker ]; then
+            # Ignore the dynamic linker argument, or it
             # will get into the next 'elif'. We don't want
             # the dynamic linker path rpath to go always first.
             n=$((n + 1))
@@ -129,16 +129,16 @@ if test "$NIX_DONT_SET_RPATH" != "1"; then
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-    
+
     for i in $libPath; do
         for j in $libs; do
-            if test -f "$i/lib$j.so"; then
+            if [ -f "$i/lib$j.so" ]; then
                 addToRPath $i
                 break
             fi
         done
     done
-    
+
 
     # Finally, add `-rpath' switches.
     for i in $rpath; do
@@ -148,19 +148,19 @@ fi
 
 
 # Optionally print debug info.
-if test "$NIX_DEBUG" = "1"; then
-  echo "original flags to @ld@:" >&2
+if [ -n "$NIX_DEBUG" ]; then
+  echo "original flags to @prog@:" >&2
   for i in "${params[@]}"; do
       echo "  $i" >&2
   done
-  echo "extra flags to @ld@:" >&2
+  echo "extra flags to @prog@:" >&2
   for i in ${extra[@]}; do
       echo "  $i" >&2
   done
 fi
 
-if test -n "$NIX_LD_WRAPPER_EXEC_HOOK"; then
+if [ -n "$NIX_LD_WRAPPER_EXEC_HOOK" ]; then
     source "$NIX_LD_WRAPPER_EXEC_HOOK"
 fi
 
-exec @ld@ ${extraBefore[@]} "${params[@]}" ${extra[@]}
+exec @prog@ ${extraBefore[@]} "${params[@]}" ${extra[@]}
diff --git a/pkgs/build-support/gcc-wrapper/setup-hook.sh b/pkgs/build-support/gcc-wrapper/setup-hook.sh
index 298ade21d1f5..a6b7edbcb694 100644
--- a/pkgs/build-support/gcc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/gcc-wrapper/setup-hook.sh
@@ -1,33 +1,35 @@
+export NIX_GCC=@out@
+
 addCVars () {
-    if test -d $1/include; then
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem $1/include"
+    if [ -d $1/include ]; then
+        export NIX_CFLAGS_COMPILE+=" -isystem $1/include"
     fi
 
-    if test -d $1/lib64; then
-        export NIX_LDFLAGS="$NIX_LDFLAGS -L$1/lib64"
+    if [ -d $1/lib64 -a ! -L $1/lib64 ]; then
+        export NIX_LDFLAGS+=" -L$1/lib64"
     fi
 
-    if test -d $1/lib; then
-        export NIX_LDFLAGS="$NIX_LDFLAGS -L$1/lib"
+    if [ -d $1/lib ]; then
+        export NIX_LDFLAGS+=" -L$1/lib"
     fi
 }
 
-envHooks=(${envHooks[@]} addCVars)
+envHooks+=(addCVars)
 
 # Note: these come *after* $out in the PATH (see setup.sh).
 
-if test -n "@gcc@"; then
+if [ -n "@gcc@" ]; then
     addToSearchPath PATH @gcc@/bin
 fi
 
-if test -n "@binutils@"; then
+if [ -n "@binutils@" ]; then
     addToSearchPath PATH @binutils@/bin
 fi
 
-if test -n "@libc@"; then
+if [ -n "@libc@" ]; then
     addToSearchPath PATH @libc@/bin
 fi
 
-if test -n "@coreutils@"; then
+if [ -n "@coreutils@" ]; then
     addToSearchPath PATH @coreutils@/bin
 fi
diff --git a/pkgs/build-support/gcc-wrapper/utils.sh b/pkgs/build-support/gcc-wrapper/utils.sh
index 753b3772e956..3ab512d85c4e 100644
--- a/pkgs/build-support/gcc-wrapper/utils.sh
+++ b/pkgs/build-support/gcc-wrapper/utils.sh
@@ -1,5 +1,5 @@
 skip () {
-    if test "$NIX_DEBUG" = "1"; then
+    if [ -n "$NIX_DEBUG" ]; then
         echo "skipping impure path $1" >&2
     fi
 }
@@ -9,11 +9,11 @@ skip () {
 # `/nix/store/.../lib/foo.so' isn't.
 badPath() {
     local p=$1
-    
+
     # Relative paths are okay (since they're presumably relative to
     # the temporary build directory).
-    if test "${p:0:1}" != "/"; then return 1; fi
-    
+    if [ "${p:0:1}" != / ]; then return 1; fi
+
     # Otherwise, the path should refer to the store or some temporary
     # directory (including the build directory).
     test \
diff --git a/pkgs/build-support/release/ant-build.nix b/pkgs/build-support/release/ant-build.nix
index 409c98d8d3a3..346e139d35de 100644
--- a/pkgs/build-support/release/ant-build.nix
+++ b/pkgs/build-support/release/ant-build.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation (
       . ${./functions.sh}
 
       origSrc=$src
-      src=$(findTarballs $src | head -1)
+      src=$(findTarball $src)
     ''; 
   }
 )
diff --git a/pkgs/build-support/release/binary-tarball.nix b/pkgs/build-support/release/binary-tarball.nix
index 41fab231ee34..f691b1bf7356 100644
--- a/pkgs/build-support/release/binary-tarball.nix
+++ b/pkgs/build-support/release/binary-tarball.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (
       . ${./functions.sh}
 
       origSrc=$src
-      src=$(findTarballs $src | head -1)
+      src=$(findTarball $src)
 
       if test -e $origSrc/nix-support/hydra-release-name; then
           releaseName=$(cat $origSrc/nix-support/hydra-release-name)
diff --git a/pkgs/build-support/release/debian-build.nix b/pkgs/build-support/release/debian-build.nix
index 3adfe41031da..7dcc9b9552a4 100644
--- a/pkgs/build-support/release/debian-build.nix
+++ b/pkgs/build-support/release/debian-build.nix
@@ -32,7 +32,7 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
     postHook = ''
       . ${./functions.sh}
       propagateImageName
-      src=$(findTarballs $src | head -1) # Find a tarball.
+      src=$(findTarball $src)
     '';
 
     installExtraDebsPhase = ''
diff --git a/pkgs/build-support/release/functions.sh b/pkgs/build-support/release/functions.sh
index efc4e7970cc5..d3be4084e4f0 100644
--- a/pkgs/build-support/release/functions.sh
+++ b/pkgs/build-support/release/functions.sh
@@ -1,34 +1,37 @@
-findTarballs() {
-    local suffix
-    test -d "$1/tarballs/" && {
+findTarball() {
+    local suffix i
+    if [ -d "$1/tarballs/" ]; then
         for suffix in tar.gz tgz tar.bz2 tbz2 tar.xz tar.lzma; do
-            ls $1/tarballs/*.$suffix 2> /dev/null
-        done | sort
-    }
-    echo "$1"
+            for i in $1/tarballs/*.$suffix; do echo $i; return; done
+        done | sort | head -1
+        return
+    else
+        echo "$1"
+        return
+    fi
 }
 
 canonicalizeJarManifest() {
-	local input=$1
-	# http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Notes_on_Manifest_and_Signature_Files
-	(head -n 1 $input && tail -n +2 $input | sort | grep -v '^\s*$') > $input-tmp
-	mv $input-tmp $input
+    local input=$1
+    # http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Notes_on_Manifest_and_Signature_Files
+    (head -n 1 $input && tail -n +2 $input | sort | grep -v '^\s*$') > $input-tmp
+    mv $input-tmp $input
 }
 
 # Post-process a jar file to contain canonical timestamps and metadata ordering
 canonicalizeJar() {
-	local input=$1
-	local outer=$(pwd)
-	unzip -qq $input -d $input-tmp
-	canonicalizeJarManifest $input-tmp/META-INF/MANIFEST.MF
-	# Set all timestamps to Jan 1 1980, which is the earliest date the zip format supports...
-	find $input-tmp -exec touch -t 198001010000.00 {} +
-	rm $input
-	pushd $input-tmp
-	zip -q -r -o -X $outer/tmp-out.jar . 2> /dev/null
-	popd
-	rm -rf $input-tmp
-	mv $outer/tmp-out.jar $input
+    local input=$1
+    local outer=$(pwd)
+    unzip -qq $input -d $input-tmp
+    canonicalizeJarManifest $input-tmp/META-INF/MANIFEST.MF
+    # Set all timestamps to Jan 1 1980, which is the earliest date the zip format supports...
+    find $input-tmp -exec touch -t 198001010000.00 {} +
+    rm $input
+    pushd $input-tmp
+    zip -q -r -o -X $outer/tmp-out.jar . 2> /dev/null
+    popd
+    rm -rf $input-tmp
+    mv $outer/tmp-out.jar $input
 }
 
 propagateImageName() {
diff --git a/pkgs/build-support/release/nix-build.nix b/pkgs/build-support/release/nix-build.nix
index b80c9242ed23..6e0088adc3fe 100644
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@@ -18,6 +18,8 @@
 , prePhases ? []
 , postPhases ? []
 , buildInputs ? []
+, preHook ? ""
+, postHook ? ""
 , ... } @ args:
 
 let
@@ -89,7 +91,8 @@ stdenv.mkDerivation (
     postHook = ''
       . ${./functions.sh}
       origSrc=$src
-      src=$(findTarballs $src | head -1)
+      src=$(findTarball $src)
+      ${postHook}
     '';
 
     preHook = ''
@@ -105,6 +108,8 @@ stdenv.mkDerivation (
         shopt -s expand_aliases
         alias make="scan-build -o _clang_analyze_$name --html-title='Scan results for $name' make"
       fi
+
+      ${preHook}
     '';
 
     # Clean up after analysis
diff --git a/pkgs/build-support/release/rpm-build.nix b/pkgs/build-support/release/rpm-build.nix
index 9a1c7eeee626..194bbc60534e 100644
--- a/pkgs/build-support/release/rpm-build.nix
+++ b/pkgs/build-support/release/rpm-build.nix
@@ -16,7 +16,7 @@ vmTools.buildRPM (
     preBuild = ''
       . ${./functions.sh}
       propagateImageName
-      src=$(findTarballs $src | head -1) # Pick the first tarball.
+      src=$(findTarball $src)
     '';
 
     postInstall = ''
diff --git a/pkgs/build-support/setup-hooks/compress-man-pages.sh b/pkgs/build-support/setup-hooks/compress-man-pages.sh
new file mode 100644
index 000000000000..1dd9788419b8
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/compress-man-pages.sh
@@ -0,0 +1,27 @@
+fixupOutputHooks+=('if [ -z "$dontGzipMan" ]; then compressManPages "$prefix"; fi')
+
+compressManPages() {
+    local dir="$1"
+
+    echo "gzipping man pages in $dir"
+
+    GLOBIGNORE=.:..:*.gz:*.bz2
+
+    for f in "$dir"/share/man/*/* "$dir"/share/man/*/*/*; do
+        if [ -f "$f" -a ! -L "$f" ]; then
+            if gzip -c -n "$f" > "$f".gz; then
+                rm "$f"
+            else
+                rm "$f".gz
+            fi
+        fi
+    done
+
+    for f in "$dir"/share/man/*/* "$dir"/share/man/*/*/*; do
+        if [ -L "$f" -a -f `readlink -f "$f"`.gz ]; then
+            ln -sf `readlink "$f"`.gz "$f".gz && rm "$f"
+        fi
+    done
+
+    unset GLOBIGNORE
+}
diff --git a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
index 5962bf039069..2b64fbf8f093 100644
--- a/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
+++ b/pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh
@@ -10,6 +10,8 @@
 # their absolute path (using "install_name_tool -id").  It also
 # rewrites references in other dylibs to absolute paths.
 
+postFixupHooks+=('fixDarwinDylibNamesIn $prefix')
+
 fixDarwinDylibNames() {
     local flags=()
     local old_id
@@ -29,7 +31,3 @@ fixDarwinDylibNamesIn() {
     local dir="$1"
     fixDarwinDylibNames $(find "$dir" -name "*.dylib")
 }
-
-postFixup() {
-    fixDarwinDylibNamesIn "$prefix"
-}
diff --git a/pkgs/build-support/setup-hooks/move-docs.sh b/pkgs/build-support/setup-hooks/move-docs.sh
new file mode 100644
index 000000000000..c819ee12a9c9
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/move-docs.sh
@@ -0,0 +1,50 @@
+# This setup hook moves $out/{man,doc,info} to $out/share; moves
+# $out/share/man to $man/share/man; and moves $out/share/doc to
+# $man/share/doc.
+
+preFixupHooks+=(_moveDocs)
+
+_moveToShare() {
+    forceShare=${forceShare:=man doc info}
+    if [ -z "$forceShare" -o -z "$out" ]; then return; fi
+
+    for d in $forceShare; do
+        if [ -d "$out/$d" ]; then
+            if [ -d "$out/share/$d" ]; then
+                echo "both $d/ and share/$d/ exist!"
+            else
+                echo "moving $out/$d to $out/share/$d"
+                mkdir -p $out/share
+                mv $out/$d $out/share/
+            fi
+        fi
+    done
+}
+
+_moveToOutput() {
+    local d="$1"
+    local dst="$2"
+    if [ -z "$dst" -a ! -e $dst/$d ]; then return; fi
+    local output
+    for output in $outputs; do
+        if [ "${!output}" = "$dst" ]; then continue; fi
+        if [ -d "${!output}/$d" ]; then
+            echo "moving ${!output}/$d to $dst/$d"
+            mkdir -p $dst/share
+            mv ${!output}/$d $dst/$d
+            break
+        fi
+    done
+}
+
+_moveDocs() {
+    _moveToShare
+    _moveToOutput share/man "$man"
+    _moveToOutput share/info "$info"
+    _moveToOutput share/doc "$doc"
+
+    # Remove empty share directory.
+    if [ -d "$out/share" ]; then
+        rmdir $out/share 2> /dev/null || true
+    fi
+}
diff --git a/pkgs/build-support/setup-hooks/move-lib64.sh b/pkgs/build-support/setup-hooks/move-lib64.sh
new file mode 100644
index 000000000000..46c90fcea6bd
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/move-lib64.sh
@@ -0,0 +1,21 @@
+# This setup hook, for each output, moves everything in $output/lib64
+# to $output/lib, and replaces $output/lib64 with a symlink to
+# $output/lib. The rationale is that lib64 directories are unnecessary
+# in Nix (since 32-bit and 64-bit builds of a package are in different
+# store paths anyway).
+
+fixupOutputHooks+=(_moveLib64)
+
+_moveLib64() {
+    if [ "$dontMoveLib64" = 1 ]; then return; fi
+    if [ ! -e "$prefix/lib64" -o -L "$prefix/lib64" ]; then return; fi
+    echo "moving $prefix/lib64/* to $prefix/lib"
+    mkdir -p $prefix/lib
+    shopt -s dotglob
+    for i in $prefix/lib64/*; do
+        mv "$i" $prefix/lib
+    done
+    shopt -u dotglob
+    rmdir $prefix/lib64
+    ln -s lib $prefix/lib64
+}
diff --git a/pkgs/build-support/setup-hooks/move-sbin.sh b/pkgs/build-support/setup-hooks/move-sbin.sh
new file mode 100644
index 000000000000..cc51c27cafdf
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/move-sbin.sh
@@ -0,0 +1,19 @@
+# This setup hook, for each output, moves everything in $output/sbin
+# to $output/bin, and replaces $output/sbin with a symlink to
+# $output/bin.
+
+fixupOutputHooks+=(_moveSbin)
+
+_moveSbin() {
+    if [ "$dontMoveSbin" = 1 ]; then return; fi
+    if [ ! -e "$prefix/sbin" -o -L "$prefix/sbin" ]; then return; fi
+    echo "moving $prefix/sbin/* to $prefix/bin"
+    mkdir -p $prefix/bin
+    shopt -s dotglob
+    for i in $prefix/sbin/*; do
+        mv "$i" $prefix/bin
+    done
+    shopt -u dotglob
+    rmdir $prefix/sbin
+    ln -s bin $prefix/sbin
+}
diff --git a/pkgs/build-support/setup-hooks/patch-shebangs.sh b/pkgs/build-support/setup-hooks/patch-shebangs.sh
new file mode 100644
index 000000000000..5a7f23b2d816
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@@ -0,0 +1,62 @@
+# This setup hook causes the fixup phase to rewrite all script
+# interpreter file names (`#!  /path') to paths found in $PATH.  E.g.,
+# /bin/sh will be rewritten to /nix/store/<hash>-some-bash/bin/sh.
+# /usr/bin/env gets special treatment so that ".../bin/env python" is
+# rewritten to /nix/store/<hash>/bin/python.  Interpreters that are
+# already in the store are left untouched.
+
+fixupOutputHooks+=('if [ -z "$dontPatchShebangs" ]; then patchShebangs "$prefix"; fi')
+
+patchShebangs() {
+    local dir="$1"
+    header "patching script interpreter paths in $dir"
+    local f
+    local oldPath
+    local newPath
+    local arg0
+    local args
+    local oldInterpreterLine
+    local newInterpreterLine
+
+    find "$dir" -type f -perm +0100 | while read f; do
+        if [ "$(head -1 "$f" | head -c +2)" != '#!' ]; then
+            # missing shebang => not a script
+            continue
+        fi
+
+        oldInterpreterLine=$(head -1 "$f" | tail -c +3)
+        read -r oldPath arg0 args <<< "$oldInterpreterLine"
+
+        if $(echo "$oldPath" | grep -q "/bin/env$"); then
+            # Check for unsupported 'env' functionality:
+            # - options: something starting with a '-'
+            # - environment variables: foo=bar
+            if $(echo "$arg0" | grep -q -- "^-.*\|.*=.*"); then
+                echo "unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)"
+                exit 1
+            fi
+            newPath="$(command -v "$arg0" || true)"
+        else
+            if [ "$oldPath" = "" ]; then
+                # If no interpreter is specified linux will use /bin/sh. Set
+                # oldpath="/bin/sh" so that we get /nix/store/.../sh.
+                oldPath="/bin/sh"
+            fi
+            newPath="$(command -v "$(basename "$oldPath")" || true)"
+            args="$arg0 $args"
+        fi
+
+        newInterpreterLine="$newPath $args"
+
+        if [ -n "$oldPath" -a "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then
+            if [ -n "$newPath" -a "$newPath" != "$oldPath" ]; then
+                echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
+                # escape the escape chars so that sed doesn't interpret them
+                escapedInterpreterLine=$(echo "$newInterpreterLine" | sed 's|\\|\\\\|g')
+                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
+            fi
+        fi
+    done
+
+    stopNest
+}
diff --git a/pkgs/build-support/setup-hooks/set-java-classpath.sh b/pkgs/build-support/setup-hooks/set-java-classpath.sh
index 76e8e42ca268..047da91bc97c 100644
--- a/pkgs/build-support/setup-hooks/set-java-classpath.sh
+++ b/pkgs/build-support/setup-hooks/set-java-classpath.sh
@@ -10,4 +10,4 @@ addPkgToClassPath () {
     done
 }
 
-envHooks=(''${envHooks[@]} addPkgToClassPath)
+envHooks+=(addPkgToClassPath)
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
new file mode 100644
index 000000000000..6860c9b9cb9a
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -0,0 +1,36 @@
+# This setup hook strips libraries and executables in the fixup phase.
+
+fixupOutputHooks+=(_doStrip)
+
+_doStrip() {
+    if [ -z "$dontStrip" ]; then
+        stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
+        if [ -n "$stripDebugList" ]; then
+            stripDirs "$stripDebugList" "${stripDebugFlags:--S}"
+        fi
+
+        stripAllList=${stripAllList:-}
+        if [ -n "$stripAllList" ]; then
+            stripDirs "$stripAllList" "${stripAllFlags:--s}"
+        fi
+    fi
+}
+
+stripDirs() {
+    local dirs="$1"
+    local stripFlags="$2"
+    local dirsNew=
+
+    for d in ${dirs}; do
+        if [ -d "$prefix/$d" ]; then
+            dirsNew="${dirsNew} $prefix/$d "
+        fi
+    done
+    dirs=${dirsNew}
+
+    if [ -n "${dirs}" ]; then
+        header "stripping (with flags $stripFlags) in$dirs"
+        find $dirs -type f -print0 | xargs -0 ${xargsFlags:--r} strip $commonStripFlags $stripFlags || true
+        stopNest
+    fi
+}
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index c08a6c3a265f..78e671e8d229 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -1,4 +1,4 @@
-{ stdenv, lndir }:
+{ lib, stdenv, lndir }:
 
 rec {
 
@@ -30,7 +30,7 @@ rec {
         (test -n "$executable" && chmod +x "$n") || true
       '';
 
-    
+
   # Shorthands for `writeTextFile'.
   writeText = name: text: writeTextFile {inherit name text;};
   writeTextDir = name: text: writeTextFile {inherit name text; destination = "/${name}";};
@@ -55,9 +55,9 @@ rec {
       (''
         mkdir -p $out/nix-support
         cp ${script} $out/nix-support/setup-hook
-      '' + stdenv.lib.optionalString (deps != []) ''
+      '' + lib.optionalString (deps != []) ''
         echo ${toString deps} > $out/nix-support/propagated-native-build-inputs
-      '' + stdenv.lib.optionalString (substitutions != {}) ''
+      '' + lib.optionalString (substitutions != {}) ''
         substituteAll ${script} $out/nix-support/setup-hook
       '');
 
@@ -80,7 +80,7 @@ rec {
   # Quickly create a set of symlinks to derivations.
   # entries is a list of attribute sets like { name = "name" ; path = "/nix/store/..."; }
   linkFarm = name: entries: runCommand name {} ("mkdir -p $out; cd $out; \n" +
-    (stdenv.lib.concatMapStrings (x: "ln -s '${x.path}' '${x.name}';\n") entries));
+    (lib.concatMapStrings (x: "ln -s '${x.path}' '${x.name}';\n") entries));
 
   # Require file
   requireFile = {name, sha256, url ? null, message ? null} :
diff --git a/pkgs/desktops/e17/e_dbus/setup-hook.sh b/pkgs/desktops/e17/e_dbus/setup-hook.sh
index d98f24b4c04b..33e3a6b0f18e 100644
--- a/pkgs/desktops/e17/e_dbus/setup-hook.sh
+++ b/pkgs/desktops/e17/e_dbus/setup-hook.sh
@@ -5,4 +5,4 @@ addDbusIncludePath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addDbusIncludePath)
+envHooks+=(addDbusIncludePath)
diff --git a/pkgs/desktops/gnome-3/3.10/default.nix b/pkgs/desktops/gnome-3/3.10/default.nix
index ceece3957332..881b478dd297 100644
--- a/pkgs/desktops/gnome-3/3.10/default.nix
+++ b/pkgs/desktops/gnome-3/3.10/default.nix
@@ -1,7 +1,8 @@
-{ callPackage, self, pkgs }:
+{ callPackage, pkgs }:
 
 rec {
   inherit (pkgs) glib gtk2 gtk3 gnome2 upower glib_networking;
+  gnome3 = pkgs.gnome3_10 // { recurseForDerivations = false; };
   gtk = gtk3; # just to be sure
   libcanberra = pkgs.libcanberra_gtk3; # just to be sure
   inherit (pkgs.gnome2) ORBit2;
@@ -16,9 +17,13 @@ rec {
 
   dconf = callPackage ./core/dconf { };
 
-  empathy = callPackage ./core/empathy { };
+  empathy = callPackage ./core/empathy {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
-  epiphany = callPackage ./core/epiphany { };
+  epiphany = callPackage ./core/epiphany {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   evince = callPackage ./core/evince { }; # ToDo: dbus would prevent compilation, enable tests
 
@@ -66,7 +71,9 @@ rec {
 
   folks = callPackage ./core/folks { };
 
-  gnome_online_accounts = callPackage ./core/gnome-online-accounts { };
+  gnome_online_accounts = callPackage ./core/gnome-online-accounts {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
 
@@ -126,7 +133,9 @@ rec {
 
   rest = callPackage ./core/rest { };
 
-  sushi = callPackage ./core/sushi { };
+  sushi = callPackage ./core/sushi {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   totem = callPackage ./core/totem { };
 
@@ -138,7 +147,9 @@ rec {
 
   vino = callPackage ./core/vino { };
 
-  yelp = callPackage ./core/yelp { };
+  yelp = callPackage ./core/yelp {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   yelp_xsl = callPackage ./core/yelp-xsl { };
 
@@ -149,9 +160,13 @@ rec {
 
 #### Apps (http://ftp.acc.umu.se/pub/GNOME/apps/)
 
-  bijiben = callPackage ./apps/bijiben { };
+  bijiben = callPackage ./apps/bijiben {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
-  evolution = callPackage ./apps/evolution { };
+  evolution = callPackage ./apps/evolution {
+    webkitgtk = pkgs.webkitgtk24x;
+   };
 
   file-roller = callPackage ./apps/file-roller { };
 
@@ -161,7 +176,9 @@ rec {
 
   gnome-clocks = callPackage ./apps/gnome-clocks { };
 
-  gnome-documents = callPackage ./apps/gnome-documents { };
+  gnome-documents = callPackage ./apps/gnome-documents {
+    webkitgtk = pkgs.webkitgtk24x;
+   };
 
   gnome-music = callPackage ./apps/gnome-music { };
 
@@ -181,14 +198,16 @@ rec {
 
   goffice = callPackage ./misc/goffice { };
 
-  gitg = callPackage ./misc/gitg { };
+  gitg = callPackage ./misc/gitg {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   libgit2-glib = callPackage ./misc/libgit2-glib {
     libgit2 = pkgs.libgit2.override { libssh2 = null; };
   };
 
   libmediaart = callPackage ./misc/libmediaart { };
-  
+
   gexiv2 = callPackage ./misc/gexiv2 { };
 
   gnome-tweak-tool = callPackage ./misc/gnome-tweak-tool { };
diff --git a/pkgs/desktops/gnome-3/3.12/default.nix b/pkgs/desktops/gnome-3/3.12/default.nix
index 9551e0bae880..85628ff13b24 100644
--- a/pkgs/desktops/gnome-3/3.12/default.nix
+++ b/pkgs/desktops/gnome-3/3.12/default.nix
@@ -22,9 +22,13 @@ rec {
 
   dconf = callPackage ./core/dconf { };
 
-  empathy = callPackage ./core/empathy { };
+  empathy = callPackage ./core/empathy {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
-  epiphany = callPackage ./core/epiphany { };
+  epiphany = callPackage ./core/epiphany {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   evince = callPackage ./core/evince { }; # ToDo: dbus would prevent compilation, enable tests
 
@@ -76,7 +80,9 @@ rec {
 
   folks = callPackage ./core/folks { };
 
-  gnome_online_accounts = callPackage ./core/gnome-online-accounts { };
+  gnome_online_accounts = callPackage ./core/gnome-online-accounts {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   gnome-online-miners = callPackage ./core/gnome-online-miners { };
 
@@ -158,7 +164,9 @@ rec {
 
   rest = callPackage ./core/rest { };
 
-  sushi = callPackage ./core/sushi { };
+  sushi = callPackage ./core/sushi {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   totem = callPackage ./core/totem { };
 
@@ -174,7 +182,9 @@ rec {
 
   vino = callPackage ./core/vino { };
 
-  yelp = callPackage ./core/yelp { };
+  yelp = callPackage ./core/yelp {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   yelp_xsl = callPackage ./core/yelp-xsl { };
 
@@ -185,9 +195,13 @@ rec {
 
 #### Apps (http://ftp.acc.umu.se/pub/GNOME/apps/)
 
-  bijiben = callPackage ./apps/bijiben { };
+  bijiben = callPackage ./apps/bijiben {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
-  evolution = callPackage ./apps/evolution { };
+  evolution = callPackage ./apps/evolution {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   file-roller = callPackage ./apps/file-roller { };
 
@@ -202,7 +216,9 @@ rec {
 
   gnome-clocks = callPackage ./apps/gnome-clocks { };
 
-  gnome-documents = callPackage ./apps/gnome-documents { };
+  gnome-documents = callPackage ./apps/gnome-documents {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   gnome-music = callPackage ./apps/gnome-music { };
 
@@ -225,13 +241,17 @@ rec {
 
 #### Misc -- other packages on http://ftp.gnome.org/pub/GNOME/sources/
 
-  geary = callPackage ./misc/geary { };
+  geary = callPackage ./misc/geary {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   gfbgraph = callPackage ./misc/gfbgraph { };
 
   goffice = callPackage ./misc/goffice { };
 
-  gitg = callPackage ./misc/gitg { };
+  gitg = callPackage ./misc/gitg {
+    webkitgtk = pkgs.webkitgtk24x;
+  };
 
   libgda = callPackage ./misc/libgda { };
 
diff --git a/pkgs/development/compilers/gcc/4.2-apple64/default.nix b/pkgs/development/compilers/gcc/4.2-apple64/default.nix
index b2444ebb9bff..42d9f29e2b5b 100644
--- a/pkgs/development/compilers/gcc/4.2-apple64/default.nix
+++ b/pkgs/development/compilers/gcc/4.2-apple64/default.nix
@@ -4,6 +4,7 @@
 , gmp ? null, mpfr ? null, bison ? null, flex ? null
 }:
 
+assert false;
 assert stdenv.isDarwin;
 assert langF77 -> gmp != null;
 
diff --git a/pkgs/development/compilers/gcc/4.6/default.nix b/pkgs/development/compilers/gcc/4.6/default.nix
index 8528be077295..0f08a908bfd4 100644
--- a/pkgs/development/compilers/gcc/4.6/default.nix
+++ b/pkgs/development/compilers/gcc/4.6/default.nix
@@ -474,6 +474,8 @@ stdenv.mkDerivation ({
 # Strip kills static libs of other archs (hence cross != null)
 // optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
 
+// optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
+
 // optionalAttrs langVhdl rec {
   name = "ghdl-0.29";
 
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index 7166d325b31c..c240acb5e897 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -526,4 +526,6 @@ stdenv.mkDerivation ({
 
 # Strip kills static libs of other archs (hence cross != null)
 // optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+
+// optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 )
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index d38040a48b38..1cda4535efcd 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -153,7 +153,6 @@ let version = "4.9.1";
           " --disable-libssp --disable-nls" +
           " --without-headers" +
           " --disable-threads " +
-          " --disable-libmudflap " +
           " --disable-libgomp " +
           " --disable-libquadmath" +
           " --disable-shared" +
@@ -513,4 +512,6 @@ stdenv.mkDerivation ({
 
 # Strip kills static libs of other archs (hence cross != null)
 // optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+
+// optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 )
diff --git a/pkgs/development/compilers/ghc/7.4.2-binary.nix b/pkgs/development/compilers/ghc/7.4.2-binary.nix
index 7000081e5dbe..f6dc974227cc 100644
--- a/pkgs/development/compilers/ghc/7.4.2-binary.nix
+++ b/pkgs/development/compilers/ghc/7.4.2-binary.nix
@@ -62,7 +62,8 @@ stdenv.mkDerivation rec {
      '' else "");
 
   configurePhase = ''
-    ./configure --prefix=$out --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include
+    ./configure --prefix=$out --with-gmp-libraries=${gmp}/lib --with-gmp-includes=${gmp}/include \
+      --with-clang
   '';
 
   # Stripping combined with patchelf breaks the executables (they die
diff --git a/pkgs/development/compilers/ghc/7.8.3-binary.nix b/pkgs/development/compilers/ghc/7.8.3-binary.nix
new file mode 100644
index 000000000000..f2c65c6ad053
--- /dev/null
+++ b/pkgs/development/compilers/ghc/7.8.3-binary.nix
@@ -0,0 +1,93 @@
+{stdenv, fetchurl, perl, ncurses, gmp}:
+
+stdenv.mkDerivation rec {
+  version = "7.8.3";
+
+  name = "ghc-${version}-binary";
+
+  src =
+    if stdenv.system == "i686-linux" then
+      fetchurl {
+        url = "http://haskell.org/ghc/dist/${version}/ghc-${version}-i386-unknown-linux.tar.bz2";
+        sha256 = "0gny7knhss0w0d9r6jm1gghrcb8kqjvj94bb7hxf9syrk4fxlcxi";
+      }
+    else if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = "http://haskell.org/ghc/dist/${version}/ghc-${version}-x86_64-unknown-linux.tar.bz2";
+        sha256 = "043jabd0lh6n1zlqhysngbpvlsdznsa2mmsj08jyqgahw9sjb5ns";
+      }
+    else if stdenv.system == "i686-darwin" then
+      fetchurl {
+        url = "http://haskell.org/ghc/dist/${version}/ghc-${version}-i386-apple-darwin.tar.bz2";
+        sha256 = "1vrbs3pzki37hzym1f1nh07lrqh066z3ypvm81fwlikfsvk4djc0";
+      }
+    else if stdenv.system == "x86_64-darwin" then
+      fetchurl {
+        url = "http://haskell.org/ghc/dist/${version}/ghc-${version}-x86_64-apple-darwin.tar.bz2";
+        sha256 = "1ja0cq5xyjcvjpvjmm4nzhkpmwfs2kjlldbc48lxcs9rmqi7rnay";
+      }
+    else throw "cannot bootstrap GHC on this platform";
+
+  buildInputs = [perl];
+
+  postUnpack =
+    # Strip is harmful, see also below. It's important that this happens
+    # first. The GHC Cabal build system makes use of strip by default and
+    # has hardcoded paths to /usr/bin/strip in many places. We replace
+    # those below, making them point to our dummy script.
+     ''
+      mkdir "$TMP/bin"
+      for i in strip; do
+        echo '#! ${stdenv.shell}' > "$TMP/bin/$i"
+        chmod +x "$TMP/bin/$i"
+      done
+      PATH="$TMP/bin:$PATH"
+     '' +
+    # We have to patch the GMP paths for the integer-gmp package.
+     ''
+      find . -name integer-gmp.buildinfo \
+          -exec sed -i "s@extra-lib-dirs: @extra-lib-dirs: ${gmp}/lib@" {} \;
+     '' +
+    # On Linux, use patchelf to modify the executables so that they can
+    # find editline/gmp.
+    (if stdenv.isLinux then ''
+      find . -type f -perm +100 \
+          -exec patchelf --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+          --set-rpath "${ncurses}/lib:${gmp}/lib" {} \;
+      sed -i "s|/usr/bin/perl|perl\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
+      sed -i "s|/usr/bin/gcc|gcc\x00        |" ghc-${version}/ghc/stage2/build/tmp/ghc-stage2
+      for prog in ld ar gcc strip ranlib; do
+        find . -name "setup-config" -exec sed -i "s@/usr/bin/$prog@$(type -p $prog)@g" {} \;
+      done
+     '' else "");
+
+  configurePhase = ''
+    ./configure --prefix=$out --with-gmp-libraries=${gmp}/lib \
+      --with-gmp-includes=${gmp}/include
+  '';
+
+  # Stripping combined with patchelf breaks the executables (they die
+  # with a segfault or the kernel even refuses the execve). (NIXPKGS-85)
+  dontStrip = true;
+
+  # No building is necessary, but calling make without flags ironically
+  # calls install-strip ...
+  buildPhase = "true";
+
+  postInstall =
+      ''
+        # Sanity check, can ghc create executables?
+        cd $TMP
+        mkdir test-ghc; cd test-ghc
+        cat > main.hs << EOF
+          module Main where
+          main = putStrLn "yes"
+        EOF
+        $out/bin/ghc --make main.hs
+        echo compilation ok
+        [ $(./main) == "yes" ]
+      '';
+
+  meta.license = stdenv.lib.licenses.bsd3;
+  meta.platforms = ["x86_64-linux" "i686-linux" "i686-darwin" "x86_64-darwin"];
+}
diff --git a/pkgs/development/compilers/ghc/7.8.3.nix b/pkgs/development/compilers/ghc/7.8.3.nix
index 0c142883e65a..9f5fc4b4e50d 100644
--- a/pkgs/development/compilers/ghc/7.8.3.nix
+++ b/pkgs/development/compilers/ghc/7.8.3.nix
@@ -26,8 +26,6 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS="$NIX_LDFLAGS -rpath $out/lib/ghc-${version}"
   '';
 
-  configureFlags = "--with-gcc=${stdenv.gcc}/bin/gcc";
-
   # required, because otherwise all symbols from HSffi.o are stripped, and
   # that in turn causes GHCi to abort
   stripDebugFlags = [ "-S" "--keep-file-symbols" ];
diff --git a/pkgs/development/compilers/llvm/3.4/clang.nix b/pkgs/development/compilers/llvm/3.4/clang.nix
index 6ec3f7bf44a3..fc33a7809a6c 100644
--- a/pkgs/development/compilers/llvm/3.4/clang.nix
+++ b/pkgs/development/compilers/llvm/3.4/clang.nix
@@ -1,5 +1,9 @@
 { stdenv, fetch, cmake, libxml2, libedit, llvm, version, clang-tools-extra_src }:
 
+# be sure not to rebuild clang on darwin; some packages request it specifically
+# we need to fix those
+assert stdenv.isDarwin -> stdenv.gcc.nativeTools;
+
 stdenv.mkDerivation {
   name = "clang-${version}";
 
diff --git a/pkgs/development/compilers/llvm/3.4/llvm.nix b/pkgs/development/compilers/llvm/3.4/llvm.nix
index fbc881fc8e02..d3beb2e7461c 100644
--- a/pkgs/development/compilers/llvm/3.4/llvm.nix
+++ b/pkgs/development/compilers/llvm/3.4/llvm.nix
@@ -27,7 +27,10 @@ in stdenv.mkDerivation rec {
     mv compiler-rt-* $sourceRoot/projects/compiler-rt
   '';
 
-  buildInputs = [ perl groff cmake libxml2 python libffi ] ++ stdenv.lib.optional stdenv.isLinux valgrind;
+  buildInputs =
+    [ perl groff cmake libxml2 libffi ]
+    ++ stdenv.lib.optional (!stdenv.isDarwin) python /*
+    ++ stdenv.lib.optional stdenv.isLinux valgrind */;
 
   propagatedBuildInputs = [ ncurses zlib ];
 
@@ -65,6 +68,5 @@ in stdenv.mkDerivation rec {
     license     = stdenv.lib.licenses.bsd3;
     maintainers = with stdenv.lib.maintainers; [ shlevy lovek323 raskin viric ];
     platforms   = stdenv.lib.platforms.all;
-    broken      = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
index ea3e8d49a4e3..d178285834ff 100644
--- a/pkgs/development/compilers/ocaml/4.01.0.nix
+++ b/pkgs/development/compilers/ocaml/4.01.0.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     sha256 = "b1ca708994180236917ae79e17606da5bd334ca6acd6873a550027e1c0ec874a";
   };
 
+  patches = [ ./fix-clang-build-on-osx.diff ];
+
   prefixKey = "-prefix ";
   configureFlags = ["-no-tk"] ++ optionals useX11 [ "-x11lib" x11lib
                                                     "-x11include" x11inc ];
diff --git a/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff b/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
new file mode 100644
index 000000000000..d7d9c863858f
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
@@ -0,0 +1,20 @@
+diff --git a/configure b/configure
+index d45e88f..25d872b 100755
+--- a/configure
++++ b/configure
+@@ -322,7 +322,14 @@ case "$bytecc,$target" in
+     bytecccompopts="-fno-defer-pop $gcc_warnings -DSHRINKED_GNUC"
+     mathlib="";;
+   *,*-*-darwin*)
+-    bytecccompopts="-fno-defer-pop $gcc_warnings"
++    # On recent version of OSX, gcc is a symlink to clang
++    if $bytecc --version | grep -q clang; then
++        # -fno-defer-pop is not supported by clang, and make recent
++        # versions of clang to fail
++        bytecccompopts="$gcc_warnings"
++    else
++        bytecccompopts="-fno-defer-pop $gcc_warnings"
++    fi
+     mathlib=""
+     mkexe="$mkexe -Wl,-no_compact_unwind"
+     # Tell gcc that we can use 32-bit code addresses for threaded code
diff --git a/pkgs/development/interpreters/guile/clang.patch b/pkgs/development/interpreters/guile/clang.patch
new file mode 100644
index 000000000000..4d0f342b211f
--- /dev/null
+++ b/pkgs/development/interpreters/guile/clang.patch
@@ -0,0 +1,14 @@
+diff --git a/lib/stdint.in.h b/lib/stdint.in.h
+index 889bca7..15d39b0 100644
+--- a/lib/stdint.in.h
++++ b/lib/stdint.in.h
+@@ -74,7 +74,8 @@
+      in <inttypes.h> would reinclude us, skipping our contents because
+      _@GUARD_PREFIX@_STDINT_H is defined.
+      The include_next requires a split double-inclusion guard.  */
+-# @INCLUDE_NEXT@ @NEXT_STDINT_H@
++# include <inttypes.h>
++// # @INCLUDE_NEXT@ @NEXT_STDINT_H@
+ #endif
+ 
+ #if ! defined _@GUARD_PREFIX@_STDINT_H && ! defined _GL_JUST_INCLUDE_SYSTEM_STDINT_H
diff --git a/pkgs/development/interpreters/guile/default.nix b/pkgs/development/interpreters/guile/default.nix
index fcec8dc0398f..c4634de5d3f2 100644
--- a/pkgs/development/interpreters/guile/default.nix
+++ b/pkgs/development/interpreters/guile/default.nix
@@ -31,7 +31,7 @@
   # libguile/vm-i-system.i is not created in time
   enableParallelBuilding = false;
 
-  patches = [ ./disable-gc-sensitive-tests.patch ./eai_system.patch ] ++
+  patches = [ ./disable-gc-sensitive-tests.patch ./eai_system.patch ./clang.patch ] ++
     (stdenv.lib.optional (coverageAnalysis != null) ./gcov-file-name.patch);
 
   # Explicitly link against libgcc_s, to work around the infamous
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index 6994c4cd8dc6..fd1dc944ed44 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -10,4 +10,4 @@ addGuileLibPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addGuileLibPath)
+envHooks+=(addGuileLibPath)
diff --git a/pkgs/development/interpreters/guile/setup-hook.sh b/pkgs/development/interpreters/guile/setup-hook.sh
index 87cb5118506d..c1d19e579ed5 100644
--- a/pkgs/development/interpreters/guile/setup-hook.sh
+++ b/pkgs/development/interpreters/guile/setup-hook.sh
@@ -5,4 +5,4 @@ addGuileLibPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addGuileLibPath)
+envHooks+=(addGuileLibPath)
diff --git a/pkgs/development/interpreters/lua-5/5.1.nix b/pkgs/development/interpreters/lua-5/5.1.nix
index 444ecbc787af..adeaa9fae7bb 100644
--- a/pkgs/development/interpreters/lua-5/5.1.nix
+++ b/pkgs/development/interpreters/lua-5/5.1.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   configurePhase =
     if stdenv.isDarwin
     then ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=macosx CFLAGS="-DLUA_USE_LINUX -fno-common -O2" LDFLAGS="" )
+    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=macosx CFLAGS="-DLUA_USE_LINUX -fno-common -O2" LDFLAGS="" CC="$CC" )
     installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.5.1.5.dylib" INSTALL_DATA='cp -d' )
   '' else ''
     makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=linux CFLAGS="-DLUA_USE_LINUX -O2 -fPIC" LDFLAGS="-fPIC" )
diff --git a/pkgs/development/interpreters/perl/5.14/setup-hook.sh b/pkgs/development/interpreters/perl/5.14/setup-hook.sh
index 6a144a7f7804..a8656b8531db 100644
--- a/pkgs/development/interpreters/perl/5.14/setup-hook.sh
+++ b/pkgs/development/interpreters/perl/5.14/setup-hook.sh
@@ -2,4 +2,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/lib/perl5/site_perl
 }
 
-envHooks=(${envHooks[@]} addPerlLibPath)
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/perl/5.16/default.nix b/pkgs/development/interpreters/perl/5.16/default.nix
index c1a5374c92ea..db9b821b8883 100644
--- a/pkgs/development/interpreters/perl/5.16/default.nix
+++ b/pkgs/development/interpreters/perl/5.16/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, enableThreading ? true }:
 
 let
 
@@ -6,10 +6,6 @@ let
 
 in
 
-with {
-  inherit (stdenv.lib) optional optionalString;
-};
-
 stdenv.mkDerivation rec {
   name = "perl-5.16.3";
 
@@ -21,9 +17,12 @@ stdenv.mkDerivation rec {
   patches =
     [ # Do not look in /usr etc. for dependencies.
       ./no-sys-dirs.patch
+      ./no-impure-config-time.patch
+      ./fixed-man-page-date.patch
+      ./no-date-in-perl-binary.patch
     ]
-    ++ optional stdenv.isSunOS  ./ld-shared.patch
-    ++ stdenv.lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
+    ++ lib.optional stdenv.isSunOS  ./ld-shared.patch
+    ++ lib.optional stdenv.isDarwin [ ./cpp-precomp.patch ./no-libutil.patch ] ;
 
   # Build a thread-safe Perl with a dynamic libperls.o.  We need the
   # "installstyle" option to ensure that modules are put under
@@ -32,14 +31,13 @@ stdenv.mkDerivation rec {
   # Miniperl needs -lm. perl needs -lrt.
   configureFlags =
     [ "-de"
-      "-Dcc=gcc"
       "-Uinstallusrbinperl"
       "-Dinstallstyle=lib/perl5"
       "-Duseshrplib"
       "-Dlocincpth=${libc}/include"
       "-Dloclibpth=${libc}/lib"
     ]
-    ++ optional (stdenv ? glibc) "-Dusethreads";
+    ++ lib.optional enableThreading "-Dusethreads";
 
   configureScript = "${stdenv.shell} ./Configure";
 
@@ -51,18 +49,18 @@ stdenv.mkDerivation rec {
     ''
       configureFlags="$configureFlags -Dprefix=$out -Dman1dir=$out/share/man/man1 -Dman3dir=$out/share/man/man3"
 
-      ${optionalString stdenv.isArm ''
+      ${lib.optionalString stdenv.isArm ''
         configureFlagsArray=(-Dldflags="-lm -lrt")
       ''}
 
-      ${optionalString stdenv.isCygwin ''
+      ${lib.optionalString stdenv.isCygwin ''
         cp cygwin/cygwin.c{,.bak}
         echo "#define PERLIO_NOT_STDIO 0" > tmp
         cat tmp cygwin/cygwin.c.bak > cygwin/cygwin.c
       ''}
     '';
 
-  preBuild = optionalString (!(stdenv ? gcc && stdenv.gcc.nativeTools))
+  preBuild = lib.optionalString (!(stdenv ? gcc && stdenv.gcc.nativeTools))
     ''
       # Make Cwd work on NixOS (where we don't have a /bin/pwd).
       substituteInPlace dist/Cwd/Cwd.pm --replace "'/bin/pwd'" "'$(type -tP pwd)'"
diff --git a/pkgs/development/interpreters/perl/5.16/fixed-man-page-date.patch b/pkgs/development/interpreters/perl/5.16/fixed-man-page-date.patch
new file mode 100644
index 000000000000..79f9bc3658e3
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.16/fixed-man-page-date.patch
@@ -0,0 +1,11 @@
+--- a/cpan/podlators/lib/Pod/Man.pm	2014-04-07 06:25:23.730505243 +0200
++++ b/cpan/podlators/lib/Pod/Man.pm	2014-04-07 06:26:40.816552603 +0200
+@@ -768,7 +768,7 @@
+     } else {
+         ($name, $section) = $self->devise_title;
+     }
+-    my $date = $$self{date} || $self->devise_date;
++    my $date = "1970-01-01"; # Fixed date for NixOS, orig: $$self{date} || $self->devise_date;
+     $self->preamble ($name, $section, $date)
+         unless $self->bare_output or DEBUG > 9;
+ 
diff --git a/pkgs/development/interpreters/perl/5.16/no-date-in-perl-binary.patch b/pkgs/development/interpreters/perl/5.16/no-date-in-perl-binary.patch
new file mode 100644
index 000000000000..00ea47ae45f6
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.16/no-date-in-perl-binary.patch
@@ -0,0 +1,11 @@
+--- a/perl.c	2014-04-07 07:58:01.402831615 +0200
++++ b/perl.c	2014-04-07 07:59:38.556945298 +0200
+@@ -1754,7 +1754,7 @@
+     PUSHs(Perl_newSVpvn_flags(aTHX_ non_bincompat_options,
+ 			      sizeof(non_bincompat_options) - 1, SVs_TEMP));
+ 
+-#ifdef __DATE__
++#if 0
+ #  ifdef __TIME__
+     PUSHs(Perl_newSVpvn_flags(aTHX_
+ 			      STR_WITH_LEN("Compiled at " __DATE__ " " __TIME__),
diff --git a/pkgs/development/interpreters/perl/5.16/no-impure-config-time.patch b/pkgs/development/interpreters/perl/5.16/no-impure-config-time.patch
new file mode 100644
index 000000000000..2bf1841e9dd2
--- /dev/null
+++ b/pkgs/development/interpreters/perl/5.16/no-impure-config-time.patch
@@ -0,0 +1,11 @@
+--- a/Configure	2014-04-05 20:21:33.714635700 +0200
++++ b/Configure	2014-04-05 20:23:23.377441026 +0200
+@@ -3609,6 +3609,8 @@
+ 
+ : who configured the system
+ cf_time=`LC_ALL=C; LANGUAGE=C; export LC_ALL; export LANGUAGE; $date 2>&1`
++cf_time='Thu Jan  1 00:00:00 UTC 1970'
++
+ case "$cf_by" in
+ "")
+ 	cf_by=`(logname) 2>/dev/null`
diff --git a/pkgs/development/interpreters/perl/5.16/setup-hook.sh b/pkgs/development/interpreters/perl/5.16/setup-hook.sh
index 6a144a7f7804..a8656b8531db 100644
--- a/pkgs/development/interpreters/perl/5.16/setup-hook.sh
+++ b/pkgs/development/interpreters/perl/5.16/setup-hook.sh
@@ -2,4 +2,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/lib/perl5/site_perl
 }
 
-envHooks=(${envHooks[@]} addPerlLibPath)
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/perl/5.20/default.nix b/pkgs/development/interpreters/perl/5.20/default.nix
index 2bcfb2787df6..66a9ca597a40 100644
--- a/pkgs/development/interpreters/perl/5.20/default.nix
+++ b/pkgs/development/interpreters/perl/5.20/default.nix
@@ -1,4 +1,16 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, enableThreading ? true }:
+
+# We can only compile perl with threading on platforms where we have a
+# real glibc in the stdenv.
+#
+# Instead of silently building an unthreaded perl if this is not the
+# case, we force callers to disableThreading explicitly, therefore
+# documenting the platforms where the perl is not threaded.
+#
+# In the case of stdenv linux boot stage1 it's not possible to use
+# threading because of the simpleness of the bootstrap glibc, so we
+# use enableThreading = false there.
+assert enableThreading -> (stdenv ? glibc);
 
 let
 
@@ -39,7 +51,7 @@ stdenv.mkDerivation rec {
       "-Dlocincpth=${libc}/include"
       "-Dloclibpth=${libc}/lib"
     ]
-    ++ optional (stdenv ? glibc) "-Dusethreads";
+    ++ optional enableThreading "-Dusethreads";
 
   configureScript = "${stdenv.shell} ./Configure";
 
diff --git a/pkgs/development/interpreters/perl/5.20/setup-hook.sh b/pkgs/development/interpreters/perl/5.20/setup-hook.sh
index 6a144a7f7804..a8656b8531db 100644
--- a/pkgs/development/interpreters/perl/5.20/setup-hook.sh
+++ b/pkgs/development/interpreters/perl/5.20/setup-hook.sh
@@ -2,4 +2,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/lib/perl5/site_perl
 }
 
-envHooks=(${envHooks[@]} addPerlLibPath)
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/perl/sys-perl/setup-hook.sh b/pkgs/development/interpreters/perl/sys-perl/setup-hook.sh
index a46a19602e7a..7b03c15ec5ad 100644
--- a/pkgs/development/interpreters/perl/sys-perl/setup-hook.sh
+++ b/pkgs/development/interpreters/perl/sys-perl/setup-hook.sh
@@ -2,4 +2,4 @@ addPerlLibPath () {
     addToSearchPath PERL5LIB $1/@libPrefix@
 }
 
-envHooks=(${envHooks[@]} addPerlLibPath)
+envHooks+=(addPerlLibPath)
diff --git a/pkgs/development/interpreters/pypy/2.4/setup-hook.sh b/pkgs/development/interpreters/pypy/2.4/setup-hook.sh
index 4cf7247fb9e7..b9f5a38dcc64 100644
--- a/pkgs/development/interpreters/pypy/2.4/setup-hook.sh
+++ b/pkgs/development/interpreters/pypy/2.4/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/python/2.6/setup-hook.sh b/pkgs/development/interpreters/python/2.6/setup-hook.sh
index 290525c35713..4caff9c9d846 100644
--- a/pkgs/development/interpreters/python/2.6/setup-hook.sh
+++ b/pkgs/development/interpreters/python/2.6/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/python/2.7/default.nix b/pkgs/development/interpreters/python/2.7/default.nix
index 8588cd812fc7..3201d7520d13 100644
--- a/pkgs/development/interpreters/python/2.7/default.nix
+++ b/pkgs/development/interpreters/python/2.7/default.nix
@@ -68,6 +68,7 @@ let
     configureFlags = "--enable-shared --with-threads --enable-unicode";
 
     NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin "-msse2";
+    DETERMINISTIC_BUILD = 1;
 
     setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/development/interpreters/python/2.7/setup-hook.sh b/pkgs/development/interpreters/python/2.7/setup-hook.sh
index a393b70afe10..4770eea886f6 100644
--- a/pkgs/development/interpreters/python/2.7/setup-hook.sh
+++ b/pkgs/development/interpreters/python/2.7/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/python/3.2/setup-hook.sh b/pkgs/development/interpreters/python/3.2/setup-hook.sh
index e6fa34bf54ba..e8215ef9877c 100644
--- a/pkgs/development/interpreters/python/3.2/setup-hook.sh
+++ b/pkgs/development/interpreters/python/3.2/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/python/3.3/setup-hook.sh b/pkgs/development/interpreters/python/3.3/setup-hook.sh
index c272c87daf1c..82a8c0abd32f 100644
--- a/pkgs/development/interpreters/python/3.3/setup-hook.sh
+++ b/pkgs/development/interpreters/python/3.3/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/python/3.4/setup-hook.sh b/pkgs/development/interpreters/python/3.4/setup-hook.sh
index ae71b4147ab7..fddcc0b73fe8 100644
--- a/pkgs/development/interpreters/python/3.4/setup-hook.sh
+++ b/pkgs/development/interpreters/python/3.4/setup-hook.sh
@@ -12,4 +12,4 @@ toPythonPath() {
     echo $result
 }
 
-envHooks=(${envHooks[@]} addPythonPath)
+envHooks+=(addPythonPath)
diff --git a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
index 77880870dd95..c812abc70fe5 100644
--- a/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
+++ b/pkgs/development/interpreters/ruby/ruby-1.9.3.nix
@@ -48,12 +48,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Fix a build failure on systems with nix store optimisation.
-  # (The build process attempted to copy file a overwriting file b, where a and
-  # b are hard-linked, which results in cp returning a non-zero exit code.)
-  # https://github.com/NixOS/nixpkgs/issues/4266
-  postUnpack = ''rm "$sourceRoot/enc/unicode/name2ctype.h"'';
-
   patches = [
     ./ruby19-parallel-install.patch
     ./bitperfect-rdoc.patch
@@ -86,6 +80,8 @@ stdenv.mkDerivation rec {
 
   installFlags = stdenv.lib.optionalString docSupport "install-doc";
 
+  CFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.7";
+
   postInstall = ''
     # Bundler tries to create this directory
     mkdir -pv $out/${passthru.gemPath}
diff --git a/pkgs/development/interpreters/ruby/ruby-2.0.0.nix b/pkgs/development/interpreters/ruby/ruby-2.0.0.nix
index 6e85d6c0330f..1e886b0219a1 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.0.0.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.0.0.nix
@@ -50,12 +50,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Fix a build failure on systems with nix store optimisation.
-  # (The build process attempted to copy file a overwriting file b, where a and
-  # b are hard-linked, which results in cp returning a non-zero exit code.)
-  # https://github.com/NixOS/nixpkgs/issues/4266
-  postUnpack = ''rm "$sourceRoot/enc/unicode/name2ctype.h"'';
-
   patches = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.0.0/p481/01-zero-broken-tests.patch"
     "${patchSet}/patches/ruby/2.0.0/p481/02-railsexpress-gc.patch"
diff --git a/pkgs/development/interpreters/ruby/ruby-2.1.0.nix b/pkgs/development/interpreters/ruby/ruby-2.1.0.nix
index 39884745635a..8467bc4eb38d 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.1.0.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.1.0.nix
@@ -51,12 +51,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Fix a build failure on systems with nix store optimisation.
-  # (The build process attempted to copy file a overwriting file b, where a and
-  # b are hard-linked, which results in cp returning a non-zero exit code.)
-  # https://github.com/NixOS/nixpkgs/issues/4266
-  postUnpack = ''rm "$sourceRoot/enc/unicode/name2ctype.h"'';
-
   patches = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.1.0/railsexpress/01-current-2.1.1-fixes.patch"
     "${patchSet}/patches/ruby/2.1.0/railsexpress/02-zero-broken-tests.patch"
diff --git a/pkgs/development/interpreters/ruby/ruby-2.1.1.nix b/pkgs/development/interpreters/ruby/ruby-2.1.1.nix
index eb8239086ea9..e26cdd5b3154 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.1.1.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.1.1.nix
@@ -51,12 +51,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Fix a build failure on systems with nix store optimisation.
-  # (The build process attempted to copy file a overwriting file b, where a and
-  # b are hard-linked, which results in cp returning a non-zero exit code.)
-  # https://github.com/NixOS/nixpkgs/issues/4266
-  postUnpack = ''rm "$sourceRoot/enc/unicode/name2ctype.h"'';
-
   patches = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.1.0/railsexpress/01-zero-broken-tests.patch"
     "${patchSet}/patches/ruby/2.1.0/railsexpress/02-improve-gc-stats.patch"
diff --git a/pkgs/development/interpreters/ruby/ruby-2.1.2.nix b/pkgs/development/interpreters/ruby/ruby-2.1.2.nix
index 2cefa6b002a6..fe03b86d86db 100644
--- a/pkgs/development/interpreters/ruby/ruby-2.1.2.nix
+++ b/pkgs/development/interpreters/ruby/ruby-2.1.2.nix
@@ -51,12 +51,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Fix a build failure on systems with nix store optimisation.
-  # (The build process attempted to copy file a overwriting file b, where a and
-  # b are hard-linked, which results in cp returning a non-zero exit code.)
-  # https://github.com/NixOS/nixpkgs/issues/4266
-  postUnpack = ''rm "$sourceRoot/enc/unicode/name2ctype.h"'';
-
   patches = ops useRailsExpress [
     "${patchSet}/patches/ruby/2.1.2/railsexpress/01-zero-broken-tests.patch"
     "${patchSet}/patches/ruby/2.1.2/railsexpress/02-improve-gc-stats.patch"
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index 6932f389b844..76477d38b6d5 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -2,6 +2,7 @@
 , sslSupport ? true, openssl
 , bdbSupport ? false, db
 , ldapSupport ? true, openldap
+, libiconvOrNull
 }:
 
 assert sslSupport -> openssl != null;
@@ -28,7 +29,7 @@ stdenv.mkDerivation rec {
     ${stdenv.lib.optionalString ldapSupport "--with-ldap"}
   '';
 
-  propagatedBuildInputs = [ makeWrapper apr expat ]
+  propagatedBuildInputs = [ makeWrapper apr expat libiconvOrNull ]
     ++ optional sslSupport openssl
     ++ optional bdbSupport db
     ++ optional ldapSupport openldap;
diff --git a/pkgs/development/libraries/aspell/clang.patch b/pkgs/development/libraries/aspell/clang.patch
new file mode 100644
index 000000000000..c4cfa426588c
--- /dev/null
+++ b/pkgs/development/libraries/aspell/clang.patch
@@ -0,0 +1,18 @@
+--- interfaces/cc/aspell.h	2013-10-13 20:29:33.000000000 +0200
++++ interfaces/cc/aspell.h	2013-10-13 20:30:01.000000000 +0200
+@@ -237,6 +237,7 @@
+ /******************************** errors ********************************/
+ 
+ 
++#ifndef __cplusplus
+ extern const struct AspellErrorInfo * const aerror_other;
+ extern const struct AspellErrorInfo * const aerror_operation_not_supported;
+ extern const struct AspellErrorInfo * const   aerror_cant_copy;
+@@ -322,6 +323,7 @@
+ extern const struct AspellErrorInfo * const   aerror_bad_magic;
+ extern const struct AspellErrorInfo * const aerror_expression;
+ extern const struct AspellErrorInfo * const   aerror_invalid_expression;
++#endif
+ 
+ 
+ /******************************* speller *******************************/
diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
index 4ac6dc58ba93..38d734e902c3 100644
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@@ -8,6 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "1qgn5psfyhbrnap275xjfrzppf5a83fb67gpql0kfqv37al869gm";
   };
 
+  patchPhase = ''
+    patch interfaces/cc/aspell.h < ${./clang.patch}
+  '';
+
   buildInputs = [ perl ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index 416a33b09a24..959e2c8db0a9 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -2,14 +2,14 @@
 , intltool, dbus_glib, at_spi2_core, libSM }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.12";
+  versionMajor = "2.14";
   versionMinor = "1";
   moduleName   = "at-spi2-atk";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "5fa9c527bdec028e06797563cd52d49bcf06f638549df983424d88db89bb1336";
+    sha256 = "1jvvs5bb63xa8ip4cvmpmyyc35gyh39bvwn967wabw7dc3m393q5";
   };
 
   buildInputs = [ python pkgconfig popt atk libX11 libICE xlibs.libXtst libXi
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index d60a0ff7480c..7d2710ee8bb7 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchurl, python, pkgconfig, popt, intltool, dbus_glib
 , libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:
 
-stdenv.mkDerivation (rec {
-  versionMajor = "2.12";
+stdenv.mkDerivation rec {
+  versionMajor = "2.14";
   versionMinor = "0";
   moduleName   = "at-spi2-core";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "12gvsgdaxnxskndlhlmdkc50cfqgmzfc4n8la9944fz5k3fhwmfv";
+    sha256 = "1j0l4l4qx0i4s9zzwhiwvw3hfjnrbmknvwkzvqpvb5gndqpb01sq";
   };
 
   buildInputs = [
@@ -21,12 +21,10 @@ stdenv.mkDerivation (rec {
   # ToDo: on non-NixOS we create a symlink from there?
   configureFlags = "--with-dbus-daemondir=/run/current-system/sw/bin/";
 
+  NIX_LDFLAGS = with stdenv; lib.optionalString isDarwin "-lintl";
+
   meta = with stdenv.lib; {
     platforms = platforms.linux;
   };
 }
-  // stdenv.lib.optionalAttrs stdenv.isDarwin {
-    NIX_LDFLAGS = "-lintl";
-  }
-)
 
diff --git a/pkgs/development/libraries/atk/default.nix b/pkgs/development/libraries/atk/default.nix
index ce7f92a20354..5b67659ad61c 100644
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, perl, glib, libintlOrEmpty, gobjectIntrospection }:
 
 let
-  ver_maj = "2.12";
+  ver_maj = "2.14";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/atk/${ver_maj}/${name}.tar.xz";
-    sha256 = "13zijfcmx7sda83qkryzsmr9hw0r3b73xkagq9cmm733fhcl7a28";
+    sha256 = "1bgvp0isbmf0vb282pncsachqgkrg5zk6an2cv077cdz685wqx98";
   };
 
   buildInputs = libintlOrEmpty;
diff --git a/pkgs/development/libraries/boost/boost-155-clang.patch b/pkgs/development/libraries/boost/boost-155-clang.patch
new file mode 100644
index 000000000000..9c4e3a74cd25
--- /dev/null
+++ b/pkgs/development/libraries/boost/boost-155-clang.patch
@@ -0,0 +1,90 @@
+diff --git a/boost/atomic/detail/cas128strong.hpp b/boost/atomic/detail/cas128strong.hpp
+index 906c13e..dcb4d7d 100644
+--- a/boost/atomic/detail/cas128strong.hpp
++++ b/boost/atomic/detail/cas128strong.hpp
+@@ -196,15 +196,17 @@ class base_atomic<T, void, 16, Sign>
+ 
+ public:
+     BOOST_DEFAULTED_FUNCTION(base_atomic(void), {})
+-    explicit base_atomic(value_type const& v) BOOST_NOEXCEPT : v_(0)
++    explicit base_atomic(value_type const& v) BOOST_NOEXCEPT
+     {
++        memset(&v_, 0, sizeof(v_));
+         memcpy(&v_, &v, sizeof(value_type));
+     }
+ 
+     void
+     store(value_type const& value, memory_order order = memory_order_seq_cst) volatile BOOST_NOEXCEPT
+     {
+-        storage_type value_s = 0;
++        storage_type value_s;
++        memset(&value_s, 0, sizeof(value_s));
+         memcpy(&value_s, &value, sizeof(value_type));
+         platform_fence_before_store(order);
+         platform_store128(value_s, &v_);
+@@ -247,7 +249,9 @@ class base_atomic<T, void, 16, Sign>
+         memory_order success_order,
+         memory_order failure_order) volatile BOOST_NOEXCEPT
+     {
+-        storage_type expected_s = 0, desired_s = 0;
++        storage_type expected_s, desired_s;
++        memset(&expected_s, 0, sizeof(expected_s));
++        memset(&desired_s, 0, sizeof(desired_s));
+         memcpy(&expected_s, &expected, sizeof(value_type));
+         memcpy(&desired_s, &desired, sizeof(value_type));
+
+diff --git a/boost/atomic/detail/gcc-atomic.hpp b/boost/atomic/detail/gcc-atomic.hpp
+index a130590..4af99a1 100644
+--- a/boost/atomic/detail/gcc-atomic.hpp
++++ b/boost/atomic/detail/gcc-atomic.hpp
+@@ -958,14 +958,16 @@ class base_atomic<T, void, 16, Sign>
+ 
+ public:
+     BOOST_DEFAULTED_FUNCTION(base_atomic(void), {})
+-    explicit base_atomic(value_type const& v) BOOST_NOEXCEPT : v_(0)
++    explicit base_atomic(value_type const& v) BOOST_NOEXCEPT
+     {
++        memset(&v_, 0, sizeof(v_));
+         memcpy(&v_, &v, sizeof(value_type));
+     }
+ 
+     void store(value_type const& v, memory_order order = memory_order_seq_cst) volatile BOOST_NOEXCEPT
+     {
+-        storage_type tmp = 0;
++        storage_type tmp;
++        memset(&tmp, 0, sizeof(tmp));
+         memcpy(&tmp, &v, sizeof(value_type));
+         __atomic_store_n(&v_, tmp, atomics::detail::convert_memory_order_to_gcc(order));
+     }
+@@ -980,7 +982,8 @@ class base_atomic<T, void, 16, Sign>
+ 
+     value_type exchange(value_type const& v, memory_order order = memory_order_seq_cst) volatile BOOST_NOEXCEPT
+     {
+-        storage_type tmp = 0;
++        storage_type tmp;
++        memset(&tmp, 0, sizeof(tmp));
+         memcpy(&tmp, &v, sizeof(value_type));
+         tmp = __atomic_exchange_n(&v_, tmp, atomics::detail::convert_memory_order_to_gcc(order));
+         value_type res;
+@@ -994,7 +997,9 @@ class base_atomic<T, void, 16, Sign>
+         memory_order success_order,
+         memory_order failure_order) volatile BOOST_NOEXCEPT
+     {
+-        storage_type expected_s = 0, desired_s = 0;
++        storage_type expected_s, desired_s;
++        memset(&expected_s, 0, sizeof(expected_s));
++        memset(&desired_s, 0, sizeof(desired_s));
+         memcpy(&expected_s, &expected, sizeof(value_type));
+         memcpy(&desired_s, &desired, sizeof(value_type));
+         const bool success = __atomic_compare_exchange_n(&v_, &expected_s, desired_s, false,
+@@ -1010,7 +1015,9 @@ class base_atomic<T, void, 16, Sign>
+         memory_order success_order,
+         memory_order failure_order) volatile BOOST_NOEXCEPT
+     {
+-        storage_type expected_s = 0, desired_s = 0;
++        storage_type expected_s, desired_s;
++        memset(&expected_s, 0, sizeof(expected_s));
++        memset(&desired_s, 0, sizeof(desired_s));
+         memcpy(&expected_s, &expected, sizeof(value_type));
+         memcpy(&desired_s, &desired, sizeof(value_type));
+         const bool success = __atomic_compare_exchange_n(&v_, &expected_s, desired_s, true,
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index c53bb39717e2..2a9cb598f6ea 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -1,5 +1,5 @@
 { stdenv, icu, expat, zlib, bzip2, python, fixDarwinDylibNames
-, toolset ? null
+, toolset ? if stdenv.isDarwin then "clang" else null
 , enableRelease ? true
 , enableDebug ? false
 , enableSingleThreaded ? false
@@ -144,9 +144,7 @@ stdenv.mkDerivation {
     "--with-python=${python}/bin/python"
   ] ++ optional (toolset != null) "--with-toolset=${toolset}";
 
-  buildPhase = ''
-    ${stdenv.lib.optionalString (toolset == "clang") "unset NIX_ENFORCE_PURITY"}
-  '' + builder nativeB2Args;
+  buildPhase = builder nativeB2Args;
 
   installPhase = installer nativeB2Args;
 
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index 6c73b17e6f4e..dd73858c3fc2 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -11,11 +11,11 @@ assert glSupport -> mesa_noglu != null;
 with { inherit (stdenv.lib) optional optionals; };
 
 stdenv.mkDerivation rec {
-  name = "cairo-1.12.16";
+  name = "cairo-1.14.0";
 
   src = fetchurl {
     url = "http://cairographics.org/releases/${name}.tar.xz";
-    sha256 = "0inqwsylqkrzcjivdirkjx5nhdgxbdc62fq284c3xppinfg9a195";
+    sha1 = "53cf589b983412ea7f78feee2e1ba9cea6e3ebae";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ libintlOrEmpty ++ libiconvOrEmpty;
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 712f05b8d651..391638548fb7 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, db, gettext, pam }:
+{ lib, stdenv, fetchurl, openssl, db, gettext, pam, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   name = "cyrus-sasl-2.1.26";
@@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "1hvvbcsg21nlncbgs0cgn3iwlnb3vannzwsp6rwvnn9ba4v53g4g";
   };
 
-  buildInputs = [ openssl db gettext ] ++ stdenv.lib.optional stdenv.isLinux pam;
+  buildInputs =
+    [ openssl db gettext ]
+    ++ lib.optional stdenv.isLinux pam
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
   patches = [ ./missing-size_t.patch ]; # https://bugzilla.redhat.com/show_bug.cgi?id=906519
   patchFlags = "-p0";
@@ -22,7 +25,7 @@ stdenv.mkDerivation rec {
                         )
   '';
 
-  installFlags = if stdenv.isDarwin then [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ] else null;
+  installFlags = lib.optional stdenv.isDarwin [ "framedir=$(out)/Library/Frameworks/SASL2.framework" ];
 
   meta = {
     homepage = "http://cyrusimap.web.cmu.edu/";
diff --git a/pkgs/development/libraries/db/generic.nix b/pkgs/development/libraries/db/generic.nix
index 6217bc461249..9d3f87ad5cb6 100644
--- a/pkgs/development/libraries/db/generic.nix
+++ b/pkgs/development/libraries/db/generic.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
 
   patches = extraPatches;
 
+  patchPhase = ''
+    patch src/dbinc/atomic.h < ${./osx.patch}
+  '';
+
   configureFlags = [
     (if cxxSupport then "--enable-cxx" else "--disable-cxx")
     (if compat185 then "--enable-compat185" else "--disable-compat185")
diff --git a/pkgs/development/libraries/db/osx.patch b/pkgs/development/libraries/db/osx.patch
new file mode 100644
index 000000000000..398aa1d37002
--- /dev/null
+++ b/pkgs/development/libraries/db/osx.patch
@@ -0,0 +1,20 @@
+--- src/dbinc/atomic.h	2013-03-12 14:07:22.000000000 -0400
++++ src/dbinc/atomic.h.change	2013-03-12 14:06:35.000000000 -0400
+@@ -144,7 +144,7 @@
+ #define	atomic_inc(env, p)	__atomic_inc(p)
+ #define	atomic_dec(env, p)	__atomic_dec(p)
+ #define	atomic_compare_exchange(env, p, o, n)	\
+-	__atomic_compare_exchange((p), (o), (n))
++	__atomic_compare_exchange_db((p), (o), (n))
+ static inline int __atomic_inc(db_atomic_t *p)
+ {
+ 	int	temp;
+@@ -176,7 +176,7 @@
+  * http://gcc.gnu.org/onlinedocs/gcc-4.1.0/gcc/Atomic-Builtins.html
+  * which configure could be changed to use.
+  */
+-static inline int __atomic_compare_exchange(
++static inline int __atomic_compare_exchange_db(
+ 	db_atomic_t *p, atomic_value_t oldval, atomic_value_t newval)
+ {
+ 	atomic_value_t was;
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a4505c5ae544..31e271277841 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -3,8 +3,8 @@
 , libX11, libICE, libSM, useX11 ? (stdenv.isLinux || stdenv.isDarwin) }:
 
 let
-  version = "1.8.6";
-  sha256 = "0gyjxd0gfpjs3fq5bx6aljb5f3zxky5zsq0yfqr9ywbv03587vgd";
+  version = "1.8.10";
+  sha256 = "13mgvwigm931r8n9363imnn0vn6dvc0m322k3p8fs5c8nvyqggqh";
 
   inherit (stdenv) lib;
 
diff --git a/pkgs/development/libraries/fontconfig/2.10.nix b/pkgs/development/libraries/fontconfig/2.10.nix
new file mode 100644
index 000000000000..2951dbb44d4f
--- /dev/null
+++ b/pkgs/development/libraries/fontconfig/2.10.nix
@@ -0,0 +1,61 @@
+{ stdenv, fetchurl, pkgconfig, freetype, expat }:
+
+stdenv.mkDerivation rec {
+  name = "fontconfig-2.10.2";
+
+  src = fetchurl {
+    url = "http://fontconfig.org/release/${name}.tar.bz2";
+    sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f";
+  };
+
+  infinality_patch =
+    let subvers = "1";
+      in fetchurl {
+        url = http://www.infinality.net/fedora/linux/zips/fontconfig-infinality-1-20130104_1.tar.bz2;
+        sha256 = "1fm5xx0mx2243jrq5rxk4v0ajw2nawpj23399h710bx6hd1rviq7";
+      }
+    ;
+
+  propagatedBuildInputs = [ freetype ];
+  buildInputs = [ pkgconfig expat ];
+
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--with-cache-dir=/var/cache/fontconfig"
+    "--disable-docs"
+    "--with-default-fonts="
+  ];
+
+  # We should find a better way to access the arch reliably.
+  crossArch = stdenv.cross.arch or null;
+
+  preConfigure = ''
+    if test -n "$crossConfig"; then
+      configureFlags="$configureFlags --with-arch=$crossArch";
+    fi
+  '';
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  # Don't try to write to /var/cache/fontconfig at install time.
+  installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
+
+  postInstall = ''
+    cd "$out/etc/fonts" && tar xvf ${infinality_patch}
+  '';
+
+  passthru = {
+    # Empty for backward compatibility, there was no versioning before 2.11
+    configVersion = "";
+  };
+
+  meta = with stdenv.lib; {
+    description = "A library for font customization and configuration";
+    homepage = http://fontconfig.org/;
+    license = licenses.bsd2; # custom but very bsd-like
+    platforms = platforms.all;
+    maintainers = [ maintainers.vcunat ];
+  };
+}
diff --git a/pkgs/development/libraries/fontconfig/builder.sh b/pkgs/development/libraries/fontconfig/builder.sh
deleted file mode 100644
index d755bca64e32..000000000000
--- a/pkgs/development/libraries/fontconfig/builder.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-source $stdenv/setup
-
-configureFlags="--with-confdir=$out/etc/fonts --disable-docs"
-
-genericBuild
diff --git a/pkgs/development/libraries/fontconfig/config-compat.patch b/pkgs/development/libraries/fontconfig/config-compat.patch
new file mode 100644
index 000000000000..e86f08fb553c
--- /dev/null
+++ b/pkgs/development/libraries/fontconfig/config-compat.patch
@@ -0,0 +1,28 @@
+commit 05c6adf8104b4321d3a3716a7b9feb6bf223ed0c (HEAD, nixpkgs)
+Author: Vladimír Čunát <vcunat@gmail.com>
+Date:   Tue Nov 4 12:24:25 2014 +0100
+
+    add check for /etc/fonts/@configVersion@/fonts.conf
+    
+    It's checked between FONTCONFIG_FILE and the usual /etc/fonts/fonts.conf.
+    Also, hardcode /etc/fonts/fonts.conf to prevent accidental override.
+
+diff --git a/src/fccfg.c b/src/fccfg.c
+index 6377fd7..e9eb10a 100644
+--- a/src/fccfg.c
++++ b/src/fccfg.c
+@@ -2070,8 +2070,13 @@ FcConfigFilename (const FcChar8 *url)
+     if (!url || !*url)
+     {
+ 	url = (FcChar8 *) getenv ("FONTCONFIG_FILE");
++	if (!url) {
++	    static const FcChar8 *cfPath = "/etc/fonts/@configVersion@/fonts.conf";
++	    if (access (cfPath, R_OK) == 0)
++		url = cfPath;
++	}
+ 	if (!url)
+-	    url = (FcChar8 *) FONTCONFIG_FILE;
++	    url = (FcChar8 *) "/etc/fonts/fonts.conf";
+     }
+     file = 0;
+ 
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index f0c4da755673..72906232eff9 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,11 +1,26 @@
-{ stdenv, fetchurl, pkgconfig, freetype, expat }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, freetype, expat, libxslt, fontbhttf
+, substituteAll }:
 
+/** Font configuration scheme
+ - ./config-compat.patch makes fontconfig try the following root configs, in order:
+    $FONTCONFIG_FILE, /etc/fonts/${configVersion}/fonts.conf, /etc/fonts/fonts.conf
+    This is done not to override config of pre-2.11 versions (which just blow up)
+    and still use *global* font configuration at both NixOS or non-NixOS.
+ - NixOS creates /etc/fonts/${configVersion}/fonts.conf link to $out/etc/fonts/fonts.conf,
+    and other modifications should go to /etc/fonts/${configVersion}/conf.d
+ - See ./make-fonts-conf.xsl for config details.
+
+*/
+
+let
+  configVersion = "2.11"; # bump whenever fontconfig breaks compatibility with older configurations
+in
 stdenv.mkDerivation rec {
-  name = "fontconfig-2.10.2";
+  name = "fontconfig-2.11.1";
 
   src = fetchurl {
     url = "http://fontconfig.org/release/${name}.tar.bz2";
-    sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f";
+    sha256 = "16baa4g5lswkyjlyf1h5lwc0zjap7c4d8grw79349a5w6dsl8qnw";
   };
 
   infinality_patch =
@@ -16,14 +31,25 @@ stdenv.mkDerivation rec {
       }
     ;
 
+  patches = [
+    (fetchpatch {
+      url = "http://cgit.freedesktop.org/fontconfig/patch/?id=f44157c809d280e2a0ce87fb078fc4b278d24a67";
+      sha256 = "19s5irclg4irj2yxd7xw9yikbazs9263px8qbv4r21asw06nfalv";
+    })
+    (substituteAll {
+      src = ./config-compat.patch;
+      inherit configVersion;
+    })
+  ];
+
   propagatedBuildInputs = [ freetype ];
   buildInputs = [ pkgconfig expat ];
 
   configureFlags = [
-    "--sysconfdir=/etc"
-    "--with-cache-dir=/var/cache/fontconfig"
+    "--with-cache-dir=/var/cache/fontconfig" # otherwise the fallback is in $out/
     "--disable-docs"
-    "--with-default-fonts="
+    # just ~1MB; this is what you get when loading config fails for some reason
+    "--with-default-fonts=${fontbhttf}"
   ];
 
   # We should find a better way to access the arch reliably.
@@ -40,12 +66,24 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   # Don't try to write to /var/cache/fontconfig at install time.
-  installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
+  installFlags = "fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
 
   postInstall = ''
     cd "$out/etc/fonts" && tar xvf ${infinality_patch}
+    rm conf.d/{50-user,51-local}.conf
+    "${libxslt}/bin/xsltproc" --stringparam fontDirectories "${fontbhttf}" \
+      --stringparam fontconfig "$out" \
+      --stringparam fontconfigConfigVersion "${configVersion}" \
+      --path $out/share/xml/fontconfig \
+      ${./make-fonts-conf.xsl} $out/etc/fonts/fonts.conf \
+      > fonts.conf.tmp
+    mv fonts.conf.tmp $out/etc/fonts/fonts.conf
   '';
 
+  passthru = {
+    inherit configVersion;
+  };
+
   meta = with stdenv.lib; {
     description = "A library for font customization and configuration";
     homepage = http://fontconfig.org/;
@@ -54,3 +92,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.vcunat ];
   };
 }
+
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index f9cd096f559b..2b02e0df7a04 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,13 +1,15 @@
-{ runCommand, libxslt, fontconfig, fontDirectories }:
+{ runCommand, libxslt, fontconfig, fontbhttf, fontDirectories }:
 
 runCommand "fonts.conf"
   {
     buildInputs = [ libxslt fontconfig ];
-    inherit fontDirectories;
+    # Add a default font for non-nixos systems. fontbhttf is only about 1mb.
+    fontDirectories = fontDirectories ++ [ fontbhttf ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \
       --stringparam fontconfig "${fontconfig}" \
+      --stringparam fontconfigConfigVersion "${fontconfig.configVersion}" \
       --path ${fontconfig}/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} ${fontconfig}/etc/fonts/fonts.conf \
       > $out
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index e3938663c9b4..03f7815e38ad 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -16,25 +16,37 @@
 
   <xsl:param name="fontDirectories" />
   <xsl:param name="fontconfig" />
+  <xsl:param name="fontconfigConfigVersion" />
 
   <xsl:template match="/fontconfig">
 
     <fontconfig>
       <xsl:apply-templates select="child::node()[name() != 'dir' and name() != 'cachedir' and name() != 'include']" />
 
-      <include ignore_missing="yes">/etc/fonts/conf.d</include>
+      <!-- fontconfig distribution conf.d -->
       <include><xsl:value-of select="$fontconfig" />/etc/fonts/conf.d</include>
-
+      <!-- versioned system-wide config -->
+      <include ignore_missing="yes">/etc/fonts/<xsl:value-of select="$fontconfigConfigVersion" />/conf.d</include>
+      <!-- look into user config -->
+      <include prefix="xdg" ignore_missing="yes">fontconfig/conf.d</include>
+
+      <!-- the first cachedir will be used to store the cache -->
+      <cachedir prefix="xdg">fontconfig</cachedir>
+      <!-- /var/cache/fontconfig is useful for non-nixos systems -->
       <cachedir>/var/cache/fontconfig</cachedir>
-      <cachedir>~/.fontconfig</cachedir>
 
+      <dir prefix="xdg">fonts</dir>
       <xsl:for-each select="str:tokenize($fontDirectories)">
         <dir><xsl:value-of select="." /></dir>
         <xsl:text>&#0010;</xsl:text>
       </xsl:for-each>
-      <dir prefix="xdg">fonts</dir>
-      <!-- the following element will be removed in the future -->
-      <dir>~/.fonts</dir>
+
+      <!-- nix user profile -->
+      <dir>~/.nix-profile/lib/X11/fonts</dir>
+      <dir>~/.nix-profile/share/fonts</dir>
+      <!-- nix default profile -->
+      <dir>/nix/var/nix/profiles/default/lib/X11/fonts</dir>
+      <dir>/nix/var/nix/profiles/default/share/fonts</dir>
 
     </fontconfig>
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 839ba7cfa951..4df07c8f6b86 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -39,8 +39,8 @@ let
     ln -sr -t "$out/include/" "$out"/lib/*/include/* 2>/dev/null || true
   '';
 
-  ver_maj = "2.40";
-  ver_min = "0";
+  ver_maj = "2.42";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "1d98mbqjmc34s8095lkw1j1bwvnnkw9581yfvjaikjvfjsaz29qd";
+    sha256 = "16pqvikrps1fvwwqvk0qi4a13mfg7gw6w5qfhk7bhi8f51jhhgwg";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
@@ -77,6 +77,7 @@ stdenv.mkDerivation rec {
     '';
 
   enableParallelBuilding = true;
+  DETERMINISTIC_BUILD = 1;
 
   inherit doCheck;
   preCheck = optionalString doCheck
diff --git a/pkgs/development/libraries/glibc/2.19/common.nix b/pkgs/development/libraries/glibc/2.19/common.nix
index a828148c3d5f..23efc01a3975 100644
--- a/pkgs/development/libraries/glibc/2.19/common.nix
+++ b/pkgs/development/libraries/glibc/2.19/common.nix
@@ -61,17 +61,28 @@ stdenv.mkDerivation ({
 
       ./cve-2014-0475.patch
       ./cve-2014-5119.patch
+
+      /* Remove references to the compilation date.  */
+      ./glibc-remove-date-from-compilation-banner.patch
     ];
 
-  postPatch = ''
+  postPatch =
     # Needed for glibc to build with the gnumake 3.82
     # http://comments.gmane.org/gmane.linux.lfs.support/31227
-    sed -i 's/ot \$/ot:\n\ttouch $@\n$/' manual/Makefile
-
+    ''
+      sed -i 's/ot \$/ot:\n\ttouch $@\n$/' manual/Makefile
+    ''
     # nscd needs libgcc, and we don't want it dynamically linked
     # because we don't want it to depend on bootstrap-tools libs.
-    echo "LDFLAGS-nscd += -static-libgcc" >> nscd/Makefile
-  '';
+    + ''
+      echo "LDFLAGS-nscd += -static-libgcc" >> nscd/Makefile
+    ''
+    # Replace the date and time in nscd by $out.
+    #  It is used as a protocol compatibility check.
+    + ''
+      cat ${./glibc-remove-datetime-from-nscd.patch} \
+        | sed "s,@out@,$out," | patch -p1
+    '';
 
   configureFlags =
     [ "-C"
diff --git a/pkgs/development/libraries/glibc/2.19/glibc-remove-date-from-compilation-banner.patch b/pkgs/development/libraries/glibc/2.19/glibc-remove-date-from-compilation-banner.patch
new file mode 100644
index 000000000000..5d0b1a51762e
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.19/glibc-remove-date-from-compilation-banner.patch
@@ -0,0 +1,12 @@
+diff -ur glibc-2.17.orig/csu/Makefile glibc-2.17/csu/Makefile
+--- glibc-2.17.orig/csu/Makefile	2012-12-25 04:02:13.000000000 +0100
++++ glibc-2.17/csu/Makefile	2013-08-19 16:01:57.132378550 +0200
+@@ -172,7 +172,7 @@
+ 		     os=Linux; \
+ 		   fi; \
+ 		   printf '"Compiled on a %s %s system on %s.\\n"\n' \
+-			  "$$os" "$$version" "`date +%Y-%m-%d`";; \
++			  "$$os" "$$version";; \
+ 	   *) ;; \
+ 	 esac; \
+ 	 files="$(all-Banner-files)";				\
diff --git a/pkgs/development/libraries/glibc/2.19/glibc-remove-datetime-from-nscd.patch b/pkgs/development/libraries/glibc/2.19/glibc-remove-datetime-from-nscd.patch
new file mode 100644
index 000000000000..0a5456ea5c42
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.19/glibc-remove-datetime-from-nscd.patch
@@ -0,0 +1,11 @@
+--- a/nscd/nscd_stat.c
++++ b/nscd/nscd_stat.c
+@@ -37,7 +37,7 @@
+ 
+ 
+ /* We use this to make sure the receiver is the same.  */
+-static const char compilation[21] = __DATE__ " " __TIME__;
++static const char compilation[21] = "@out@";
+ 
+ /* Statistic data for one database.  */
+ struct dbstat
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 14a6d34d932b..e9495b796dd2 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -16,10 +16,13 @@ stdenv.mkDerivation (rec {
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
     # See <http://hydra.nixos.org/build/2760931>, for instance.
+    #
+    # no darwin because gmp uses ASM that clang doesn't like
     optional (!stdenv.isSunOS) "--enable-fat"
     ++ (if cxx then [ "--enable-cxx"  ]
                else [ "--disable-cxx" ])
     ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
+    ++ optional stdenv.isDarwin "ABI=64"
     ++ optional stdenv.is64bit "--with-pic"
     ;
 
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 4b7ec1f41163..0d4103640ad0 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -5,7 +5,7 @@
 # In that case its about 6MB which could be separated
 
 let
-  ver_maj = "1.40";
+  ver_maj = "1.42";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${ver_maj}/${name}.tar.xz";
-    sha256 = "162flbzwzz0b8axab2gimc4dglpaw88fh1d177zfg0whczlpbsln";
+    sha256 = "1xwm7wmr9r9wp6xljb3bckx3a4siybavaq39w46ly7gpskxfv8iv";
   };
 
   buildInputs = [ flex bison glib pkgconfig python ]
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index a02af7f0cd75..a573dc561fdc 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -5,12 +5,13 @@
 , openjpeg, libopus, librsvg
 , wildmidi, fluidsynth, libvdpau, wayland
 , libwebp, xvidcore, gnutls
+, mesa
 }:
 
 assert faacSupport -> faac != null;
 
 stdenv.mkDerivation rec {
-  name = "gst-plugins-bad-1.4.1";
+  name = "gst-plugins-bad-1.4.3";
 
   meta = with stdenv.lib; {
     description = "Gstreamer Bad Plugins";
@@ -28,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-plugins-bad/${name}.tar.xz";
-    sha256 = "0268db2faaf0bb22e5b709a11633abbca4f3d289b1f513bb262d0bf3f53e19ae";
+    sha256 = "a6840080c469d0db51d6d4d0f7c42c97b3c8c01942f24401c61b1ad36726b97c";
   };
 
   nativeBuildInputs = [ pkgconfig python ];
@@ -36,9 +37,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gst-plugins-base orc
     faad2 libass libkate libmms
-    libmodplug mpeg2dec mpg123 
+    libmodplug mpeg2dec mpg123
     openjpeg libopus librsvg
     wildmidi fluidsynth libvdpau wayland
-    libwebp xvidcore gnutls
+    libwebp xvidcore gnutls mesa
   ] ++ stdenv.lib.optional faacSupport faac;
 }
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 3b9e94f4c658..854fa8f0c349 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -4,7 +4,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gst-plugins-base-1.4.1";
+  name = "gst-plugins-base-1.4.3";
 
   meta = {
     description = "Base plugins and helper libraries";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-plugins-base/${name}.tar.xz";
-    sha256 = "aea9e25be6691bd3cc0785d005b2b5d70ce313a2c897901680a3f7e7cab5a499";
+    sha256 = "f7b4d2b3ba2bcac485896e2c1c36459cb091ebe8b49e91635c27d40f66792d9d";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 8e9a2b87a017..5ab1ec6a31f5 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -3,7 +3,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gstreamer-1.4.1";
+  name = "gstreamer-1.4.3";
 
   meta = {
     description = "Open source multimedia framework";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gstreamer/${name}.tar.xz";
-    sha256 = "5638f75003282135815c0077d491da11e9a884ad91d4ba6ab3cc78bae0fb452e";
+    sha256 = "11f155784d28b85a12b50d2fc8f91c6b75d9ca325cc76aaffba1a58d4c9549c9";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/core/setup-hook.sh b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
index 04863ab3b612..3dd7812ece6d 100644
--- a/pkgs/development/libraries/gstreamer/core/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/core/setup-hook.sh
@@ -5,5 +5,5 @@ addGstreamer1LibPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addGstreamer1LibPath)
+envHooks+=(addGstreamer1LibPath)
 
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index daf2ba59a406..df7078a1365a 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -3,7 +3,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gstreamer-editing-services-1.2.1";
+  name = "gstreamer-editing-services-1.4.0";
 
   meta = with stdenv.lib; {
     description = "Library for creation of audio/video non-linear editors";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gstreamer-editing-services/${name}.tar.xz";
-    sha256 = "1c20zg272wgzqw4f93f1prkv9a9gdqxmf3kal29l0r2wmwhqnxpy";
+    sha256 = "1cwbh244an6zsxsscvg6xjnb34ylci34g9zx59xjbv5wnw7vj86c";
   };
 
   nativeBuildInputs = [ pkgconfig python gobjectIntrospection ];
diff --git a/pkgs/development/libraries/gstreamer/gnonlin/default.nix b/pkgs/development/libraries/gstreamer/gnonlin/default.nix
index 44bb1c48c81d..05113973a9d1 100644
--- a/pkgs/development/libraries/gstreamer/gnonlin/default.nix
+++ b/pkgs/development/libraries/gstreamer/gnonlin/default.nix
@@ -3,7 +3,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gnonlin-1.2.1";
+  name = "gnonlin-1.4.0";
 
   meta = with stdenv.lib; {
     description = "Gstreamer Non-Linear Multimedia Editing Plugins";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gnonlin/${name}.tar.xz";
-    sha256 = "14zb3bz3xn40a2kns719amrr77cp6wyxddml621kyxc424ihcw3q";
+    sha256 = "0zv60rq2h736a6fivd3a3wp59dj1jar7b2vwzykahvl168b7wrid";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 176814c5ecd1..72a14b50606c 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -7,7 +7,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gst-plugins-good-1.4.1";
+  name = "gst-plugins-good-1.4.3";
 
   meta = with stdenv.lib; {
     description = "Gstreamer Good Plugins";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-plugins-good/${name}.tar.xz";
-    sha256 = "8559d4270065b30ed5c49b826e1b7a3a2bd5ee9a340ae745a2ae3f9718e4c637";
+    sha256 = "5876a74402f2a24d1d3ae9163c32466bdc7a565696dddeef65e6a9a93efc5537";
   };
 
   nativeBuildInputs = [ pkgconfig python ];
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
index c3d2d7016daf..3382ae783f28 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "1ijswgcrdp243mfsyza31fpzq6plz40p4b83vkr2x4x7807889vy";
   };
 
-  patches = [ ./v4l.patch ];
+  patches = [ ./v4l.patch ./linux-headers-3.9.patch ];
 
   configureFlags = "--disable-oss";
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/linux-headers-3.9.patch b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/linux-headers-3.9.patch
new file mode 100644
index 000000000000..f13d3a166714
--- /dev/null
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/linux-headers-3.9.patch
@@ -0,0 +1,27 @@
+http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-plugins/gst-plugins-v4l2/files/gst-plugins-v4l2-0.10.31-linux-headers-3.9.patch
+
+From 8e633d2059cb835448021cf79becb487aff10975 Mon Sep 17 00:00:00 2001
+From: Bastien Nocera <hadess@hadess.net>
+Date: Mon, 18 Mar 2013 14:59:35 +0000
+Subject: v4l2: fix compilation against newer kernel headers as on FC19
+
+---
+diff --git a/sys/v4l2/v4l2_calls.c b/sys/v4l2/v4l2_calls.c
+index 07d390a..4c10f4f 100644
+--- a/sys/v4l2/v4l2_calls.c
++++ b/sys/v4l2/v4l2_calls.c
+@@ -291,8 +291,12 @@ gst_v4l2_fill_lists (GstV4l2Object * v4l2object)
+         break;
+       case V4L2_CID_HFLIP:
+       case V4L2_CID_VFLIP:
++#ifndef V4L2_CID_PAN_RESET
+       case V4L2_CID_HCENTER:
++#endif
++#ifndef V4L2_CID_TILT_RESET
+       case V4L2_CID_VCENTER:
++#endif
+ #ifdef V4L2_CID_PAN_RESET
+       case V4L2_CID_PAN_RESET:
+ #endif
+--
+cgit v0.9.0.2-2-gbebe
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
index 10671f9d227c..e89aeda5bc1c 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh
@@ -5,4 +5,4 @@ addGstreamerLibPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addGstreamerLibPath)
+envHooks+=(addGstreamerLibPath)
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index e25492c1d13b..0e8f0684f7be 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -6,7 +6,7 @@
 assert withSystemLibav -> libav != null;
 
 stdenv.mkDerivation rec {
-  name = "gst-libav-1.4.1";
+  name = "gst-libav-1.4.3";
 
   meta = {
     homepage = "http://gstreamer.freedesktop.org";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-libav/${name}.tar.xz";
-    sha256 = "fc125521187fa84f3210269a0eecc51f8a856802f1ca4bb251f118dab90c5a9d";
+    sha256 = "833229d2b1aad6549ad0297435516508cc3ac47b166d6393ecdffc34c31a01d3";
   };
 
   configureFlags = stdenv.lib.optionalString withSystemLibav
diff --git a/pkgs/development/libraries/gstreamer/python/default.nix b/pkgs/development/libraries/gstreamer/python/default.nix
index fad8308703b3..a91b5d81bb32 100644
--- a/pkgs/development/libraries/gstreamer/python/default.nix
+++ b/pkgs/development/libraries/gstreamer/python/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gst-python-1.2.1";
+  name = "gst-python-1.4.0";
 
   src = fetchurl {
     urls = [
-      "${meta.homepage}/src/gst-python/${name}.tar.bz2"
-      "mirror://gentoo/distfiles/${name}.tar.bz2"
+      "${meta.homepage}/src/gst-python/${name}.tar.xz"
+      "mirror://gentoo/distfiles/${name}.tar.xz"
       ];
-    sha256 = "1m7gh017f70i5pg6k9sx54ihwaizvi2dlli687gi44n5zylya8w8";
+    sha256 = "0gixsp46mv7fvhk669q60wfk9w2lc02sdb1qipq066xlrqlhrr5i";
   };
 
   patches = [ ./different-path-with-pygobject.patch ];
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 6a80514e8a1c..b04c62021e4a 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -5,7 +5,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "gst-plugins-ugly-1.4.1";
+  name = "gst-plugins-ugly-1.4.3";
 
   meta = with stdenv.lib; {
     description = "Gstreamer Ugly Plugins";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-plugins-ugly/${name}.tar.xz";
-    sha256 = "25440435ac4ed795d213f2420a0e7355e4a2e2e76d1f9d020b2073f815e8b071";
+    sha256 = "d581592a82cf3930361430d38436c30a58d8b6c249cad18f7f213b203e206d46";
   };
 
   nativeBuildInputs = [ pkgconfig python ];
diff --git a/pkgs/development/libraries/gtk+/2.x.nix b/pkgs/development/libraries/gtk+/2.x.nix
index ff4d6ca67336..b95de7105be4 100644
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@@ -8,11 +8,11 @@ assert xineramaSupport -> xlibs.libXinerama != null;
 assert cupsSupport -> cups != null;
 
 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.24";
+  name = "gtk+-2.24.25";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "0v9xxpkypizy9k866rvqc36zvj4kj9p8nd1nxf9znay8k3hv5khj";
+    sha256 = "38af1020cb8ff3d10dda2c8807f11e92af9d2fa4045de61c62eedb7fbc7ea5b3";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index ce0b0d5d755f..1313bc3feebc 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -28,7 +28,7 @@ let
   result = {
     libav_0_8 = libavFun "0.8.16" "df88b8f7d04d47edea8b19d80814227f0c058e57";
     libav_9   = libavFun   "9.17" "5899d51947b62f6b0cf9795ec2330d5ed59a3273";
-    libav_10  = libavFun  "10.5"  "925a45d2700a436c28e0b663510fc8df5bb7e861";
+    libav_11  = libavFun  "11"    "21f3c7c2154c0ad703872f2faa65ef20d6b7a14f";
   };
 
   libavFun = version : sha1 : stdenv.mkDerivation rec {
diff --git a/pkgs/development/libraries/libc++/darwin.patch b/pkgs/development/libraries/libc++/darwin.patch
new file mode 100644
index 000000000000..bf83f169cfc3
--- /dev/null
+++ b/pkgs/development/libraries/libc++/darwin.patch
@@ -0,0 +1,30 @@
+diff -ru -x '*~' libcxx-3.4.2.src-orig/lib/CMakeLists.txt libcxx-3.4.2.src/lib/CMakeLists.txt
+--- libcxx-3.4.2.src-orig/lib/CMakeLists.txt	2013-11-15 18:18:57.000000000 +0100
++++ libcxx-3.4.2.src/lib/CMakeLists.txt	2014-09-24 14:04:01.000000000 +0200
+@@ -56,7 +56,7 @@
+       "-compatibility_version 1"
+       "-current_version ${LIBCXX_VERSION}"
+       "-install_name /usr/lib/libc++.1.dylib"
+-      "-Wl,-reexport_library,/usr/lib/libc++abi.dylib"
++      "-Wl,-reexport_library,${LIBCXX_LIBCXXABI_LIB_PATH}/libc++abi.dylib"
+       "-Wl,-unexported_symbols_list,${CMAKE_CURRENT_SOURCE_DIR}/libc++unexp.exp"
+       "/usr/lib/libSystem.B.dylib")
+   else()
+@@ -64,14 +64,14 @@
+       list(FIND ${CMAKE_OSX_ARCHITECTURES} "armv7" OSX_HAS_ARMV7)
+       if (OSX_HAS_ARMV7)
+         set(OSX_RE_EXPORT_LINE
+-          "${CMAKE_OSX_SYSROOT}/usr/lib/libc++abi.dylib"
++          "${CMAKE_OSX_SYSROOT}${LIBCXX_LIBCXXABI_LIB_PATH}/libc++abi.dylib"
+           "-Wl,-reexported_symbols_list,${CMAKE_CURRENT_SOURCE_DIR}/libc++sjlj-abi.exp")
+       else()
+         set(OSX_RE_EXPORT_LINE
+-          "-Wl,-reexport_library,${CMAKE_OSX_SYSROOT}/usr/lib/libc++abi.dylib")
++          "-Wl,-reexport_library,${CMAKE_OSX_SYSROOT}${LIBCXX_LIBCXXABI_LIB_PATH}/libc++abi.dylib")
+       endif()
+     else()
+-      set (OSX_RE_EXPORT_LINE "/usr/lib/libc++abi.dylib -Wl,-reexported_symbols_list,${CMAKE_CURRENT_SOURCE_DIR}/libc++abi${LIBCXX_LIBCPPABI_VERSION}.exp")
++      set (OSX_RE_EXPORT_LINE "${LIBCXX_LIBCXXABI_LIB_PATH}/libc++abi.dylib -Wl,-reexported_symbols_list,${CMAKE_CURRENT_SOURCE_DIR}/libc++abi${LIBCXX_LIBCPPABI_VERSION}.exp")
+     endif()
+ 
+     list(APPEND link_flags
diff --git a/pkgs/development/libraries/libc++/default.nix b/pkgs/development/libraries/libc++/default.nix
index 21a07d6f7d4b..99e9bfe1de2e 100644
--- a/pkgs/development/libraries/libc++/default.nix
+++ b/pkgs/development/libraries/libc++/default.nix
@@ -1,9 +1,8 @@
-{ stdenv, fetchurl, fetchsvn, cmake, libcxxabi, python }:
+{ lib, stdenv, fetchurl, cmake, libcxxabi, fixDarwinDylibNames }:
 
-let
-  version = "3.4.2";
+let version = "3.4.2"; in
 
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   name = "libc++-${version}";
 
   src = fetchurl {
@@ -11,21 +10,32 @@ in stdenv.mkDerivation rec {
     sha256 = "0z3jdvgcq995khkpis5c5vaxhbmvbqjlalbhn09k6pgb5zp46rc2";
   };
 
-  buildInputs = [ cmake libcxxabi python ];
+  patches = [ ./darwin.patch ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release"
-                 "-DLIBCXX_LIBCXXABI_INCLUDE_PATHS=${libcxxabi}/include"
-                 "-DLIBCXX_CXX_ABI=libcxxabi" ];
+  buildInputs = [ cmake libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+
+  cmakeFlags =
+    [ "-DCMAKE_BUILD_TYPE=Release"
+      "-DLIBCXX_LIBCXXABI_INCLUDE_PATHS=${libcxxabi}/include"
+      "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
+      "-DLIBCXX_LIBCPPABI_VERSION=2"
+      "-DLIBCXX_CXX_ABI=libcxxabi"
+    ];
 
   enableParallelBuilding = true;
 
-  passthru.abi = libcxxabi;
+  inherit libcxxabi;
+
+  # Remove a Makefile that causes many retained dependencies.
+  postInstall = "rm $out/include/c++/v1/Makefile";
+
+  setupHook = ./setup-hook.sh;
 
   meta = {
     homepage = http://libcxx.llvm.org/;
     description = "A new implementation of the C++ standard library, targeting C++11";
     license = "BSD";
     maintainers = [ stdenv.lib.maintainers.shlevy ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libc++/setup-hook.sh b/pkgs/development/libraries/libc++/setup-hook.sh
new file mode 100644
index 000000000000..8543d09d8f52
--- /dev/null
+++ b/pkgs/development/libraries/libc++/setup-hook.sh
@@ -0,0 +1,2 @@
+export NIX_CFLAGS_COMPILE+=" -isystem @out@/include/c++/v1 -stdlib=libc++"
+export NIX_CFLAGS_LINK+=" -stdlib=libc++ -Wl,-rpath,@libcxxabi@/lib"
diff --git a/pkgs/development/libraries/libc++abi/darwin.patch b/pkgs/development/libraries/libc++abi/darwin.patch
new file mode 100644
index 000000000000..53ea8783f7a8
--- /dev/null
+++ b/pkgs/development/libraries/libc++abi/darwin.patch
@@ -0,0 +1,17 @@
+diff -ru -x '*~' libcxxabi-orig/lib/buildit libcxxabi/lib/buildit
+--- libcxxabi-orig/lib/buildit	2014-09-18 16:54:14.000000000 +0200
++++ libcxxabi/lib/buildit	2014-09-24 13:22:27.000000000 +0200
+@@ -51,12 +51,8 @@
+         -dynamiclib -nodefaultlibs  \
+         -current_version ${RC_ProjectSourceVersion} \
+         -compatibility_version 1 \
+-        -install_name /usr/lib/libc++abi.dylib \
++        -install_name $out/lib/libc++abi.dylib \
+         -lSystem"
+-	if [ -f "${SDKROOT}/usr/local/lib/libCrashReporterClient.a" ]
+-	then
+-		LDSHARED_FLAGS+=" -lCrashReporterClient"
+-	fi
+     ;;
+   *-*-mingw*)
+     # FIXME: removing libgcc and libsupc++ dependencies means porting libcxxrt and LLVM/compiler-rt
diff --git a/pkgs/development/libraries/libc++abi/default.nix b/pkgs/development/libraries/libc++abi/default.nix
index dd1f46a9ab38..68db6a5dc6c1 100644
--- a/pkgs/development/libraries/libc++abi/default.nix
+++ b/pkgs/development/libraries/libc++abi/default.nix
@@ -1,31 +1,42 @@
-{ stdenv, fetchsvn, libcxx, libunwind }:
-let
-  rev = "199626";
-in stdenv.mkDerivation {
-  name = "libcxxabi-pre-${rev}";
-
-  src = fetchsvn {
-    url = http://llvm.org/svn/llvm-project/libcxxabi/trunk;
-    rev = "199626";
-    sha256 = "0h1x1s40x5r65ar53rv34lmgcfil3zxaknqr64dka1mz29xhhrxy";
+{ lib, stdenv, fetchurl, libcxx, coreutils, gnused }:
+
+let rev = "199626"; in
+
+stdenv.mkDerivation {
+  name = "libc++abi-${rev}";
+
+  src = fetchurl {
+    url = "http://tarballs.nixos.org/libcxxabi-${rev}.tar.bz2";
+    sha256 = "09wr6qwgmdzbmgfkdzfhph9giy0zd6fp3s017fcfy4g0prjn5s4c";
   };
 
-  NIX_CFLAGS_LINK="-L${libunwind}/lib -lunwind";
+  patches = [ ./no-stdc++.patch ./darwin.patch ];
+
+  buildInputs = [ coreutils ];
 
   postUnpack = ''
     unpackFile ${libcxx.src}
-    export NIX_CFLAGS_COMPILE="-I${libunwind}/include -I$PWD/include -I$(readlink -f libcxx-*)/include"
-  '';
-
-  installPhase = ''
-    install -d -m 755 $out/include $out/lib
-    install -m 644 lib/libc++abi.so.1.0 $out/lib
-    install -m 644 include/cxxabi.h $out/include
-    ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
-    ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+  '' + lib.optionalString stdenv.isDarwin ''
+    export TRIPLE=x86_64-apple-darwin
+    # Hack: NIX_CFLAGS_COMPILE doesn't work here because clang++ isn't
+    # wrapped at this point.
+    export CXX="clang++ -D_LIBCXX_DYNAMIC_FALLBACK=1"
+    unset SDKROOT
   '';
 
-  patchPhase = "sed -e s,-lstdc++,, -i lib/buildit";
+  installPhase = if stdenv.isDarwin
+    then ''
+      install -d -m 755 $out/include $out/lib
+      install -m 644 lib/libc++abi.dylib $out/lib
+      install -m 644 include/cxxabi.h $out/include
+    ''
+    else ''
+      install -d -m 755 $out/include $out/lib
+      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      install -m 644 include/cxxabi.h $out/include
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
+      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+    '';
 
   buildPhase = "(cd lib; ./buildit)";
 
@@ -34,6 +45,6 @@ in stdenv.mkDerivation {
     description = "A new implementation of low level support for a standard C++ library";
     license = "BSD";
     maintainers = [ stdenv.lib.maintainers.shlevy ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libc++abi/no-stdc++.patch b/pkgs/development/libraries/libc++abi/no-stdc++.patch
new file mode 100644
index 000000000000..ddc9778a486e
--- /dev/null
+++ b/pkgs/development/libraries/libc++abi/no-stdc++.patch
@@ -0,0 +1,12 @@
+diff -ru -x '*~' libcxxabi-orig/lib/buildit libcxxabi/lib/buildit
+--- libcxxabi-orig/lib/buildit	2014-09-18 16:54:14.000000000 +0200
++++ libcxxabi/lib/buildit	2014-09-24 13:22:27.000000000 +0200
+@@ -70,7 +66,7 @@
+     SOEXT=so
+     LDSHARED_FLAGS="-o libc++abi.so.1.0 \
+         -shared -nodefaultlibs -Wl,-soname,libc++abi.so.1 \
+-        -lpthread -lrt -lc -lstdc++"
++        -lpthread -lrt -lc"
+     ;;
+ esac
+ 
diff --git a/pkgs/development/libraries/libdevil/default.nix b/pkgs/development/libraries/libdevil/default.nix
index d3053b4d2a5f..6cbbddfdba83 100644
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@@ -16,6 +16,15 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--enable-ILU" "--enable-ILUT" ];
 
+  preConfigure = ''
+    sed -i 's, -std=gnu99,,g' configure
+    sed -i 's,malloc.h,stdlib.h,g' src-ILU/ilur/ilur.c
+  '';
+
+  postConfigure = ''
+    sed -i '/RESTRICT_KEYWORD/d' include/IL/config.h
+  '';
+
   patches =
     [ ( fetchurl {
         url = http://patch-tracker.debian.org/patch/series/dl/devil/1.7.8-6.1/03_CVE-2009-3994.diff;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index d7a6f8d54430..12e25b03a7b0 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, udev }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.56";
+  name = "libdrm-2.4.58";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "0c20wpfa94d8kww0f2xinmm4axsl4nhq921xj4i88yhpjbhbn3z2";
+    sha256 = "b155fae6b9c9a3b02ef8b77f58c7c219194c996a4018dc55ba66c03996a365dd";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libedit/default.nix b/pkgs/development/libraries/libedit/default.nix
index 27c803fd81e0..f913ab8e4938 100644
--- a/pkgs/development/libraries/libedit/default.nix
+++ b/pkgs/development/libraries/libedit/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   NROFF = "${groff}/bin/nroff";
 
   postInstall = ''
-    sed -i s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
+    sed -i ${stdenv.lib.optionalString (stdenv.isDarwin && stdenv.gcc.nativeTools) "''"} s/-lncurses/-lncursesw/g $out/lib/pkgconfig/libedit.pc
   '';
 
   configureFlags = [ "--enable-widec" ];
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index 89b276102192..5dac8f888959 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Wrapper library for evdev devices";
-    homepage = http://www.freedesktop.org/software/libevdev/doc/latest/index.html; 
+    homepage = http://www.freedesktop.org/software/libevdev/doc/latest/index.html;
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = [ maintainers.amorsillo ];
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index 6810c8665a77..ded6dbf25c81 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -16,13 +16,14 @@ stdenv.mkDerivation rec {
     "--with-gcc-arch=generic" # no detection of -march= or -mtune=
   ] ++ stdenv.lib.optional (stdenv.needsPax) "--enable-pax_emutramp";
 
-  doCheck = stdenv.isLinux; # until we solve dejagnu problems on darwin and expect on BSD
+  #doCheck = stdenv.isLinux; # until we solve dejagnu problems on darwin and expect on BSD
+  doCheck = false;
 
   dontStrip = stdenv ? cross; # Don't run the native `strip' when cross-compiling.
 
   postInstall =
     # Install headers in the right place.
-    '' ln -s${if stdenv.isFreeBSD then "" else "r"}v "$out/lib/"libffi*/include "$out/include"
+    '' ln -s${if stdenv.isBSD then "" else "r"}v "$out/lib/"libffi*/include "$out/include"
     '';
 
   meta = {
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index ed267e23c87b..af2316320229 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation (rec {
 
   propagatedBuildInputs = [ libgpgerror ];
 
+  configureFlags = stdenv.lib.optional stdenv.isDarwin "--disable-asm";
+
   doCheck = stdenv.system != "i686-linux"; # "basic" test fails after stdenv+glibc-2.18
 
   # For some reason the tests don't find `libgpg-error.so'.
@@ -18,6 +20,8 @@ stdenv.mkDerivation (rec {
     make check
   '';
 
+  patches = [ ./no-build-timestamp.patch ];
+
   meta = {
     description = "General-pupose cryptographic library";
 
diff --git a/pkgs/development/libraries/libgcrypt/no-build-timestamp.patch b/pkgs/development/libraries/libgcrypt/no-build-timestamp.patch
new file mode 100644
index 000000000000..6ae708f059d7
--- /dev/null
+++ b/pkgs/development/libraries/libgcrypt/no-build-timestamp.patch
@@ -0,0 +1,12 @@
+diff -ur libgcrypt-1.5.3.orig/configure libgcrypt-1.5.3/configure
+--- libgcrypt-1.5.3.orig/configure	2013-07-25 11:22:47.000000000 +0200
++++ libgcrypt-1.5.3/configure	2014-04-09 00:17:58.659147199 +0200
+@@ -16520,6 +16520,7 @@
+ 
+ 
+ BUILD_TIMESTAMP=`date -u +%Y-%m-%dT%H:%M+0000 2>/dev/null || date`
++BUILD_TIMESTAMP=1970-01-01T00:00+0000
+ 
+ 
+ cat >>confdefs.h <<_ACEOF
+Only in libgcrypt-1.5.3: out
diff --git a/pkgs/development/libraries/libgpg-error/default.nix b/pkgs/development/libraries/libgpg-error/default.nix
index 143c8c739853..ecea33275fe6 100644
--- a/pkgs/development/libraries/libgpg-error/default.nix
+++ b/pkgs/development/libraries/libgpg-error/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, bash, gettext }:
+{ stdenv, fetchurl, gettext }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   name = "libgpg-error-1.17";
 
   src = fetchurl {
@@ -8,10 +8,21 @@ stdenv.mkDerivation (rec {
     sha256 = "1dapxzxl1naghf342fwfc2w2f2c5hb9gr1a1s4n8dsqn26kybx1z";
   };
 
+  postPatch = "sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:00+0000/' -i ./configure";
+
   # If architecture-dependent MO files aren't available, they're generated
   # during build, so we need gettext for cross-builds.
   crossAttrs.buildInputs = [ gettext ];
 
+  postConfigure =
+    stdenv.lib.optionalString stdenv.isSunOS
+    # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
+    # `config.status' run:
+    #   ./config.status[1401]: shift: (null): bad number
+    # (See <http://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
+    # Thus, re-run it with Bash.
+      "${stdenv.shell} config.status";
+
   doCheck = true;
 
   meta = {
@@ -31,15 +42,3 @@ stdenv.mkDerivation (rec {
   };
 }
 
-//
-
-(stdenv.lib.optionalAttrs stdenv.isSunOS {
-  # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
-  # `config.status' run:
-  #   ./config.status[1401]: shift: (null): bad number
-  # (See <http://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
-  # Thus, re-run it with Bash.
-  postConfigure =
-    '' ${bash}/bin/sh config.status
-    '';
-}))
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index 3bdb85a78ebd..76f7ed31d00a 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "libiconv-1.13.1";
+  name = "libiconv-1.14";
 
   src = fetchurl {
     url = "mirror://gnu/libiconv/${name}.tar.gz";
-    sha256 = "0jcsjk2g28bq20yh7rvbn8xgq6q42g8dkkac0nfh12b061l638sm";
+    sha256 = "04q6lgl3kglmmhw59igq1n7v3rp1rpkypl366cy1k1yn2znlvckj";
   };
 
   # On Cygwin, Libtool produces a `.dll.a', which is not a "real" DLL
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 06fff495f541..001d8094a271 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,11 +3,11 @@
 assert zlib != null;
 
 let
-  version = "1.6.13";
-  sha256 = "09g631h1f1xvrdiy36mh1034r9w46damp9jcg7nm507wlmacxj6r";
+  version = "1.6.14";
+  sha256 = "0i5lwh9xnqj490c3mcx7rxaq4zr3wj27ba7vzfls45aqa2jl714n";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${version}-apng.patch.gz";
-    sha256 = "017pnxp3zhhlh6mg2yqn5xrb6dcxc5p3dp1kr46p8xx052i0hzqb";
+    sha256 = "1gwpm9kb57dknicy9j4mf8g9q5zz4ikhbznlk32jhw2b3l0mn446";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
diff --git a/pkgs/development/libraries/libunistring/clang.patch b/pkgs/development/libraries/libunistring/clang.patch
new file mode 100644
index 000000000000..fdcbc0d528d0
--- /dev/null
+++ b/pkgs/development/libraries/libunistring/clang.patch
@@ -0,0 +1,14 @@
+diff --git a/lib/stdint.in.h b/lib/stdint.in.h
+index 997e406..e0827f5 100644
+--- a/lib/stdint.in.h
++++ b/lib/stdint.in.h
+@@ -53,7 +53,8 @@
+      in <inttypes.h> would reinclude us, skipping our contents because
+      _GL_STDINT_H is defined.
+      The include_next requires a split double-inclusion guard.  */
+-# @INCLUDE_NEXT@ @NEXT_STDINT_H@
++# include <inttypes.h>
++// # @INCLUDE_NEXT@ @NEXT_STDINT_H@
+ #endif
+ 
+ #if ! defined _GL_STDINT_H && ! defined _GL_JUST_INCLUDE_SYSTEM_STDINT_H
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 2a87d7a32490..9470240fc146 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation (rec {
     sha256 = "18q620269xzpw39dwvr9zpilnl2dkw5z5kz3mxaadnpv4k3kw3b1";
   };
 
+  patches = stdenv.lib.optional stdenv.isDarwin [ ./clang.patch ];
+
   propagatedBuildInputs =
     stdenv.lib.optional ((! (stdenv ? glibc))
                          || (stdenv ? cross &&
diff --git a/pkgs/development/libraries/libxml2/setup-hook.sh b/pkgs/development/libraries/libxml2/setup-hook.sh
index 4ab0dadd8b29..4acdd25a6b28 100644
--- a/pkgs/development/libraries/libxml2/setup-hook.sh
+++ b/pkgs/development/libraries/libxml2/setup-hook.sh
@@ -15,5 +15,5 @@ if test -z "$libxmlHookDone"; then
     # xmllint and xsltproc from looking in /etc/xml/catalog.
     export XML_CATALOG_FILES
     if test -z "$XML_CATALOG_FILES"; then XML_CATALOG_FILES=" "; fi
-    envHooks=(${envHooks[@]} addXMLCatalogs)
+    envHooks+=(addXMLCatalogs)
 fi
diff --git a/pkgs/development/libraries/mesa-darwin/default.nix b/pkgs/development/libraries/mesa-darwin/default.nix
index 98936904be59..f259a397c847 100644
--- a/pkgs/development/libraries/mesa-darwin/default.nix
+++ b/pkgs/development/libraries/mesa-darwin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, stdenvAdapters, gccApple, fetchurl, pkgconfig, intltool, flex, bison
+{ stdenv, stdenvAdapters, fetchurl, pkgconfig, intltool, flex, bison
 , python, libxml2Python, file, expat, makedepend, xorg, llvm, libffi, libvdpau
 , enableTextureFloats ? false # Texture floats are patented, see docs/patents.txt
 , enableExtraFeatures ? false # not maintained
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 54fd8d3810e3..842f3dc7d9b8 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -24,7 +24,7 @@ else
 */
 
 let
-  version = "10.2.6";
+  version = "10.2.9";
   # this is the default search path for DRI drivers
   driverLink = "/run/opengl-driver" + stdenv.lib.optionalString stdenv.isi686 "-32";
 in
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
 
   src =  fetchurl {
     url = "ftp://ftp.freedesktop.org/pub/mesa/${version}/MesaLib-${version}.tar.bz2";
-    sha256 = "01n8ib190s12m8hiiyi4wfm9jhkbqjd769npjwvf965smp918cqr";
+    sha256 = "f6031f8b7113a92325b60635c504c510490eebb2e707119bbff7bd86aa34657d";
   };
 
   prePatch = "patchShebangs .";
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
 
     "--with-dri-drivers=i965,r200,radeon"
     "--with-gallium-drivers=i915,nouveau,r300,r600,svga,swrast,radeonsi"
-    "--with-egl-platforms=x11,wayland,drm" "--enable-gbm"
+    "--with-egl-platforms=x11,drm" "--enable-gbm"
   ]
     ++ optional enableTextureFloats "--enable-texture-float"
     ++ optionals enableExtraFeatures [
@@ -97,7 +97,7 @@ stdenv.mkDerivation {
     autoreconfHook intltool expat libxml2Python llvm
     glproto dri2proto dri3proto presentproto
     libX11 libXext libxcb libXt libXfixes libxshmfence
-    libffi wayland libvdpau libelf
+    libffi /* wayland */ libvdpau libelf
   ] ++ optionals enableExtraFeatures [ /*libXvMC*/ ]
     ++ optional stdenv.isLinux udev
     ;
@@ -113,8 +113,8 @@ stdenv.mkDerivation {
   '' + optionalString enableExtraFeatures ''
       `#$out/lib/libXvMC*` \
       $out/lib/gbm $out/lib/libgbm* \
-      $out/lib/gallium-pipe \
   '' + ''
+      $out/lib/gallium-pipe \
       $out/lib/libdricore* \
       $out/lib/libgallium* \
       $out/lib/vdpau \
@@ -134,8 +134,8 @@ stdenv.mkDerivation {
     sed "/^libdir=/s,$out,$drivers," -i \
   '' + optionalString enableExtraFeatures ''
       `#$drivers/lib/libXvMC*.la` \
-      $drivers/lib/gallium-pipe/*.la \
   '' + ''
+      $drivers/lib/gallium-pipe/*.la \
       $drivers/lib/libgallium.la \
       $drivers/lib/vdpau/*.la \
       $drivers/lib/libdricore*.la
diff --git a/pkgs/development/libraries/mpc/default.nix b/pkgs/development/libraries/mpc/default.nix
index 3d05fa2e0405..dd132cfb5b7b 100644
--- a/pkgs/development/libraries/mpc/default.nix
+++ b/pkgs/development/libraries/mpc/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gmp mpfr ];
 
+  CFLAGS = "-I${gmp}/include";
+
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index 653481aeccd6..d999ba0cda5c 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gmp ];
 
+  CFLAGS = "-I${gmp}/include";
+
   configureFlags =
     /* Work around a FreeBSD bug that otherwise leads to segfaults in the test suite:
           http://hydra.bordeaux.inria.fr/build/34862
diff --git a/pkgs/development/libraries/ncurses/clang.patch b/pkgs/development/libraries/ncurses/clang.patch
new file mode 100644
index 000000000000..ce33049bf405
--- /dev/null
+++ b/pkgs/development/libraries/ncurses/clang.patch
@@ -0,0 +1,42 @@
+diff -ruNp ncurses-5.8.orig/c++/cursesf.h ncurses-5.8/c++/cursesf.h
+--- ncurses-5.8.orig/c++/cursesf.h	2005-08-13 21:08:24.000000000 +0300
++++ ncurses-5.8/c++/cursesf.h	2011-04-03 18:29:29.000000000 +0300
+@@ -681,7 +681,7 @@ public:
+ 		   const T* p_UserData = STATIC_CAST(T*)(0),
+ 		   bool with_frame=FALSE,
+ 		   bool autoDelete_Fields=FALSE)
+-    : NCursesForm (Fields, with_frame, autoDelete_Fields) {
++    : NCursesForm (&Fields, with_frame, autoDelete_Fields) {
+       if (form)
+ 	set_user (const_cast<void *>(p_UserData));
+   };
+@@ -694,7 +694,7 @@ public:
+ 		   const T* p_UserData = STATIC_CAST(T*)(0),
+ 		   bool with_frame=FALSE,
+ 		   bool autoDelete_Fields=FALSE)
+-    : NCursesForm (Fields, nlines, ncols, begin_y, begin_x,
++    : NCursesForm (&Fields, nlines, ncols, begin_y, begin_x,
+ 		   with_frame, autoDelete_Fields) {
+       if (form)
+ 	set_user (const_cast<void *>(p_UserData));
+diff -ruNp ncurses-5.8.orig/c++/cursesm.h ncurses-5.8/c++/cursesm.h
+--- ncurses-5.8.orig/c++/cursesm.h	2005-08-13 21:10:36.000000000 +0300
++++ ncurses-5.8/c++/cursesm.h	2011-04-03 18:31:42.000000000 +0300
+@@ -639,7 +639,7 @@ public:
+ 		   const T* p_UserData = STATIC_CAST(T*)(0),
+ 		   bool with_frame=FALSE,
+ 		   bool autoDelete_Items=FALSE)
+-    : NCursesMenu (Items, with_frame, autoDelete_Items) {
++    : NCursesMenu (&Items, with_frame, autoDelete_Items) {
+       if (menu)
+ 	set_user (const_cast<void *>(p_UserData));
+   };
+@@ -651,7 +651,7 @@ public:
+ 		   int begin_x = 0,
+ 		   const T* p_UserData = STATIC_CAST(T*)(0),
+ 		   bool with_frame=FALSE)
+-    : NCursesMenu (Items, nlines, ncols, begin_y, begin_x, with_frame) {
++    : NCursesMenu (&Items, nlines, ncols, begin_y, begin_x, with_frame) {
+       if (menu)
+ 	set_user (const_cast<void *>(p_UserData));
+   };
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 631199bf87c3..3aa27480a0f5 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   };
 
-  patches = [ ./patch-ac ];
+  patches = [ ./patch-ac ./clang.patch ];
 
   configureFlags = ''
     --with-shared --without-debug --enable-pc-files --enable-symlinks
@@ -35,8 +35,6 @@ stdenv.mkDerivation rec {
     export configureFlags="$configureFlags --includedir=$out/include"
     export PKG_CONFIG_LIBDIR="$out/lib/pkgconfig"
     mkdir -p "$PKG_CONFIG_LIBDIR"
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure --replace -no-cpp-precomp ""
   '';
 
   selfNativeBuildInput = true;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2ea94ef50453..29656f7ef888 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -19,6 +19,8 @@ let
       # cannot be overriden per-process.  For security, the
       # environment variable is ignored for setuid binaries.
       ./cert-file.patch
+      # Remove the compilation time from the library
+      ./no-date-in-library.patch
     ]
 
     ++ stdenv.lib.optionals (isCross && opensslCrossSystem == "hurd-x86")
diff --git a/pkgs/development/libraries/openssl/no-date-in-library.patch b/pkgs/development/libraries/openssl/no-date-in-library.patch
new file mode 100644
index 000000000000..3eb501dfa020
--- /dev/null
+++ b/pkgs/development/libraries/openssl/no-date-in-library.patch
@@ -0,0 +1,12 @@
+diff -ur openssl-1.0.1f.orig/crypto/Makefile openssl-1.0.1f/crypto/Makefile
+--- openssl-1.0.1f.orig/crypto/Makefile	2014-01-06 15:35:56.000000000 +0100
++++ openssl-1.0.1f/crypto/Makefile	2014-04-09 13:05:28.071346204 +0200
+@@ -57,7 +57,7 @@
+ 	echo '  /* auto-generated by crypto/Makefile for crypto/cversion.c */'; \
+ 	echo '  #define CFLAGS "$(CC) $(CFLAG)"'; \
+ 	echo '  #define PLATFORM "$(PLATFORM)"'; \
+-	echo "  #define DATE \"`LC_ALL=C LC_TIME=C date`\""; \
++	echo "  #define DATE \"Thu Jan  1 00:00:01 UTC 1970\""; \
+ 	echo '#endif' ) >buildinf.h
+ 
+ x86cpuid.s:	x86cpuid.pl perlasm/x86asm.pl
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index be6216b758c9..d1778093868c 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libiconv, pkgconfig, libffi, libtasn1 }:
+{ stdenv, fetchurl, libiconvOrEmpty, pkgconfig, libffi, libtasn1 }:
 
 stdenv.mkDerivation rec {
   name = "p11-kit-0.20.2";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--without-libtasn1";
 
-  buildInputs = [ libiconv pkgconfig libffi libtasn1 ];
+  buildInputs = [ pkgconfig libffi libtasn1 ] ++ libiconvOrEmpty;
 
   meta = {
     homepage = http://p11-glue.freedesktop.org/;
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 40b02c2afbb2..45ca9cb98e8d 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -1,30 +1,35 @@
-{ stdenv, fetchurl, pkgconfig, gettext, x11, glib, cairo, libpng, harfbuzz, fontconfig
-, libintlOrEmpty, gobjectIntrospection }:
-
+{ stdenv, fetchurl, pkgconfig, x11, glib, cairo, libpng, harfbuzz
+, fontconfig, freetype, libintlOrEmpty, gobjectIntrospection
+}:
+
+let
+  ver_maj = "1.36";
+  ver_min = "8";
+in
 stdenv.mkDerivation rec {
-  name = "pango-1.32.5"; #.6 and higher need fontconfig-2.11.* which is troublesome
+  name = "pango-${ver_maj}.${ver_min}";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/pango/1.32/${name}.tar.xz";
-    sha256 = "08aqis6j8nd1lb4f2h4h9d9kjvp54iwf8zvqzss0qn4v7nfcjyvx";
+    url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
+    sha256 = "01rdzjh68w8l5zn0648yibyarj8p6g7yfn59nw5awaz1i8dvbnqq";
   };
 
   buildInputs = with stdenv.lib;
     optional (!stdenv.isDarwin) gobjectIntrospection # build problems of itself and flex
-    ++ optionals stdenv.isDarwin [ gettext fontconfig ];
-
+    ++ optionals stdenv.isDarwin [ fontconfig ];
   nativeBuildInputs = [ pkgconfig ];
 
-  propagatedBuildInputs = [ x11 glib cairo libpng harfbuzz ] ++ libintlOrEmpty;
+  propagatedBuildInputs = [ x11 glib cairo libpng fontconfig freetype harfbuzz ] ++ libintlOrEmpty;
 
   enableParallelBuilding = true;
 
+  doCheck = false; # test-layout fails on 1.36.8
   # jww (2014-05-05): The tests currently fail on Darwin:
   #
   # ERROR:testiter.c:139:iter_char_test: assertion failed: (extents.width == x1 - x0)
   # .../bin/sh: line 5: 14823 Abort trap: 6 srcdir=. PANGO_RC_FILE=./pangorc ${dir}$tst
   # FAIL: testiter
-  doCheck = !stdenv.isDarwin;
+
   postInstall = "rm -rf $out/share/gtk-doc";
 
   meta = {
diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix
index 930d7b86f063..768e87f5ad29 100644
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -5,11 +5,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "pcre-8.35";
+  name = "pcre-8.36";
 
   src = fetchurl {
     url = "ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/${name}.tar.bz2";
-    sha256 = "0nw66r92dr24vy9k4lw17bkv8x5nlzn6wx9hq4y2dvzgig3w2qd9";
+    sha256 = "1fs5p1z67m9f4xnyil3s4lhgyld78f7m4d1yawpyhh0cvrbk90zg";
   };
 
   # The compiler on Darwin crashes with an internal error while building the
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 6da928a6a23e..7fe16cec56b9 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, glib, expat, pam, intltool, spidermonkey
-, gobjectIntrospection, libxslt, docbook_xsl
+, gobjectIntrospection, libxslt, docbook_xsl, docbook_xml_dtd_412
 , useSystemd ? stdenv.isLinux, systemd }:
 
 let
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ pkgconfig glib expat pam intltool spidermonkey gobjectIntrospection ]
-    ++ [ libxslt docbook_xsl ] # man pages
+    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ] # man pages
     ++ stdenv.lib.optional useSystemd systemd;
 
   # Ugly hack to overwrite hardcoded directories
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 1679b4953e77..943d780473ac 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, substituteAll, libXrender, libXinerama, libXcursor, libXmu, libXv, libXext
+{ stdenv, fetchurl, fetchpatch, substituteAll
+, libXrender, libXinerama, libXcursor, libXmu, libXv, libXext
 , libXfixes, libXrandr, libSM, freetype, fontconfig, zlib, libjpeg, libpng
 , libmng, which, mesaSupported, mesa, mesa_glu, openssl, dbus, cups, pkgconfig
 , libtiff, glib, icu, mysql, postgresql, sqlite, perl, coreutils, libXi
@@ -64,7 +65,13 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional flashplayerFix (substituteAll {
         src = ./dlopen-webkit-nsplugin.diff;
         inherit gtk gdk_pixbuf;
-      });
+      })
+    ++ [(fetchpatch {
+        name = "fix-medium-font.patch";
+        url = "http://anonscm.debian.org/cgit/pkg-kde/qt/qt4-x11.git/plain/debian/patches/"
+          + "kubuntu_39_fix_medium_font.diff?id=21b342d71c19e6d68b649947f913410fe6129ea4";
+        sha256 = "0bli44chn03c2y70w1n8l7ss4ya0b40jqqav8yxrykayi01yf95j";
+      })];
 
   preConfigure = ''
     export LD_LIBRARY_PATH="`pwd`/lib:$LD_LIBRARY_PATH"
@@ -78,8 +85,6 @@ stdenv.mkDerivation rec {
       -translationdir $out/share/${name}/translations
     "
   '' + optionalString stdenv.isDarwin ''
-    export CXX=clang++
-    export CC=clang
     sed -i 's/QMAKE_CC = gcc/QMAKE_CC = clang/' mkspecs/common/g++-base.conf
     sed -i 's/QMAKE_CXX = g++/QMAKE_CXX = clang++/' mkspecs/common/g++-base.conf
   '';
diff --git a/pkgs/development/libraries/readline/6.2.nix b/pkgs/development/libraries/readline/6.2.nix
index d72d6566bbc9..1555f255c51b 100644
--- a/pkgs/development/libraries/readline/6.2.nix
+++ b/pkgs/development/libraries/readline/6.2.nix
@@ -14,6 +14,7 @@ stdenv.mkDerivation (rec {
   patches =
     [ ./link-against-ncurses.patch
       ./no-arch_only.patch
+      ./clang.patch
     ]
     ++
     (let
diff --git a/pkgs/development/libraries/readline/clang.patch b/pkgs/development/libraries/readline/clang.patch
new file mode 100644
index 000000000000..42bb0be09c39
--- /dev/null
+++ b/pkgs/development/libraries/readline/clang.patch
@@ -0,0 +1,13 @@
+diff --git a/support/shobj-conf b/support/shobj-conf
+index 5a63e80..4b2a741 100644
+--- support/shobj-conf
++++ support/shobj-conf
+@@ -189,7 +189,7 @@ darwin*|macosx*)
+ 	darwin[789]*|darwin10*)	SHOBJ_LDFLAGS=''
+ 			SHLIB_XLDFLAGS='-dynamiclib -arch_only `/usr/bin/arch` -install_name $(libdir)/$@ -current_version $(SHLIB_MAJOR)$(SHLIB_MINOR) -compatibility_version $(SHLIB_MAJOR) -v'
+ 			;;
+-	*)		SHOBJ_LDFLAGS='-dynamic'
++	*)		SHOBJ_LDFLAGS='-dynamiclib'
+ 			SHLIB_XLDFLAGS='-arch_only `/usr/bin/arch` -install_name $(libdir)/$@ -current_version $(SHLIB_MAJOR)$(SHLIB_MINOR) -compatibility_version $(SHLIB_MAJOR) -v'
+ 			;;
+ 	esac
diff --git a/pkgs/development/libraries/serf/default.nix b/pkgs/development/libraries/serf/default.nix
index 1e8eec6ae452..49d7cec95901 100644
--- a/pkgs/development/libraries/serf/default.nix
+++ b/pkgs/development/libraries/serf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, apr, scons, openssl, aprutil, zlib, krb5, pkgconfig }:
+{ stdenv, fetchurl, apr, scons, openssl, aprutil, zlib, krb5, pkgconfig, gnused }:
 
 stdenv.mkDerivation rec {
   name = "serf-1.3.7";
@@ -11,16 +11,20 @@ stdenv.mkDerivation rec {
   buildInputs = [ apr scons openssl aprutil zlib krb5 pkgconfig ];
 
   configurePhase = ''
-    sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"PATH":os.environ["PATH"]})' -i SConstruct
-    sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_CFLAGS_COMPILE":os.environ["NIX_CFLAGS_COMPILE"]})' -i SConstruct
-    sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_LDFLAGS":os.environ["NIX_LDFLAGS"]})' -i SConstruct
+    ${gnused}/bin/sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"PATH":os.environ["PATH"]})' -i SConstruct
+    ${gnused}/bin/sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_CFLAGS_COMPILE":os.environ["NIX_CFLAGS_COMPILE"]})' -i SConstruct
+    ${gnused}/bin/sed -e '/^env[.]Append(BUILDERS/ienv.Append(ENV={"NIX_LDFLAGS":os.environ["NIX_LDFLAGS"]})' -i SConstruct
   '';
 
   buildPhase = ''
     scons PREFIX="$out" OPENSSL="${openssl}" ZLIB="${zlib}" APR="$(echo "${apr}"/bin/*-config)" \
-        APU="$(echo "${aprutil}"/bin/*-config)" GSSAPI="${krb5}" CC="${stdenv.gcc}/bin/gcc"
+        APU="$(echo "${aprutil}"/bin/*-config)" GSSAPI="${krb5}" CC="${
+          if stdenv.isDarwin then "clang" else "${stdenv.gcc}/bin/gcc"
+        }"
   '';
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-L/usr/lib";
+
   installPhase = ''
     scons install
   '';
diff --git a/pkgs/development/libraries/slib/setup-hook.sh b/pkgs/development/libraries/slib/setup-hook.sh
index 32dde7d1f7a2..62b72d6dc0ab 100644
--- a/pkgs/development/libraries/slib/setup-hook.sh
+++ b/pkgs/development/libraries/slib/setup-hook.sh
@@ -10,4 +10,4 @@ addSlibPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addSlibPath)
+envHooks+=(addSlibPath)
diff --git a/pkgs/development/libraries/ucommon/default.nix b/pkgs/development/libraries/ucommon/default.nix
index 0e8a95d5ac16..0fc325137179 100644
--- a/pkgs/development/libraries/ucommon/default.nix
+++ b/pkgs/development/libraries/ucommon/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, gnutls, pkgconfig, zlib, libgcrypt }:
 
 stdenv.mkDerivation rec {
-  name = "ucommon-6.0.7";
+  name = "ucommon-6.1.11";
 
   src = fetchurl {
-    url = mirror://gnu/commoncpp/ucommon-6.0.7.tar.gz;
-    sha256 = "1rlvchmg6qq8jq79qjgv0l0wqi1dqhmm4ng1qj9f012dbhwcap3x";
+    url = "mirror://gnu/commoncpp/${name}.tar.gz";
+    sha256 = "0hpwxiyd7c3qnzksk6vw94cdig1v8yy6khgcaa87a7hb3zbkv4zg";
   };
 
   buildInputs = [ pkgconfig gnutls zlib ];
diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index fda32a7ddbd3..3abac0feab38 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Google's open source JavaScript engine";
-    platforms = with platforms; linux ++ darwin;
+    platforms = with platforms; linux;
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/libraries/webkitgtk/2.4.6.nix b/pkgs/development/libraries/webkitgtk/2.4.6.nix
new file mode 100644
index 000000000000..a2344f71f882
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/2.4.6.nix
@@ -0,0 +1,62 @@
+{ stdenv, fetchurl, perl, python, ruby, bison, gperf, flex
+, pkgconfig, which, gettext, gobjectIntrospection
+, gtk2, gtk3, wayland, libwebp, enchant
+, libxml2, libsoup, libsecret, libxslt, harfbuzz
+, gst-plugins-base
+, withGtk2 ? false
+, enableIntrospection ? true
+}:
+
+stdenv.mkDerivation rec {
+  name = "webkitgtk-${version}";
+  version = "2.4.6";
+
+  meta = with stdenv.lib; {
+    description = "Web content rendering engine, GTK+ port";
+    homepage = "http://webkitgtk.org/";
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.iyzsong ];
+  };
+
+  src = fetchurl {
+    url = "http://webkitgtk.org/releases/${name}.tar.xz";
+    sha256 = "0mqlq4ivh921k92xjsp5pdvbg9vf75qjliqmx81qwrm2sjl4mvvg";
+  };
+
+  patches = [ ./webcore-svg-libxml-cflags.patch ];
+
+  CC = "cc";
+
+  prePatch = ''
+    patchShebangs Tools/gtk
+  '';
+
+  configureFlags = with stdenv.lib; [
+    "--disable-geolocation"
+    (optionalString enableIntrospection "--enable-introspection")
+  ] ++ stdenv.lib.optional withGtk2 [
+    "--with-gtk=2.0"
+    "--disable-webkit2"
+  ];
+
+  dontAddDisableDepTrack = true;
+
+  nativeBuildInputs = [
+    perl python ruby bison gperf flex
+    pkgconfig which gettext gobjectIntrospection
+  ];
+
+  buildInputs = [
+    gtk2 wayland libwebp enchant
+    libxml2 libsecret libxslt harfbuzz
+    gst-plugins-base
+  ];
+
+  propagatedBuildInputs = [
+    libsoup
+    (if withGtk2 then gtk2 else gtk3)
+  ];
+
+  #enableParallelBuilding = true; # build problems on Hydra
+}
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index fa3cdc82c41f..08576c2ebc36 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -1,61 +1,45 @@
-{ stdenv, fetchurl, perl, python, ruby, bison, gperf, flex
-, pkgconfig, which, gettext, gobjectIntrospection
+{ stdenv, fetchurl, perl, python, ruby, bison, gperf, cmake
+, pkgconfig, gettext, gobjectIntrospection
 , gtk2, gtk3, wayland, libwebp, enchant
-, libxml2, libsoup, libsecret, libxslt, harfbuzz
+, libxml2, libsoup, libsecret, libxslt, harfbuzz, libpthreadstubs
 , gst-plugins-base
-, withGtk2 ? false
-, enableIntrospection ? true
 }:
 
 stdenv.mkDerivation rec {
-  name = "webkitgtk-2.4.6";
+  name = "webkitgtk-${version}";
+  version = "2.6.2";
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Web content rendering engine, GTK+ port";
     homepage = "http://webkitgtk.org/";
-    license = stdenv.lib.licenses.bsd2;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ iyzsong ];
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ iyzsong koral ];
   };
 
   src = fetchurl {
     url = "http://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "0mqlq4ivh921k92xjsp5pdvbg9vf75qjliqmx81qwrm2sjl4mvvg";
+    sha256 = "1f9qm5g1mbjm2hrnlzymas99piws4h4y3yxz4p6f6gavnsvfjwji";
   };
 
-  patches = [ ./webcore-svg-libxml-cflags.patch ];
+  patches = [ ./finding-harfbuzz-icu.patch ];
 
-  CC = "cc";
-
-  prePatch = ''
-    patchShebangs Tools/gtk
-  '';
-
-  configureFlags = with stdenv.lib; [
-    "--disable-geolocation"
-    (optionalString enableIntrospection "--enable-introspection")
-  ] ++ stdenv.lib.optional withGtk2 [
-    "--with-gtk=2.0"
-    "--disable-webkit2"
-  ];
-
-  dontAddDisableDepTrack = true;
+  cmakeFlags = [ "-DPORT=GTK" ];
 
   nativeBuildInputs = [
-    perl python ruby bison gperf flex
-    pkgconfig which gettext gobjectIntrospection
+    cmake perl python ruby bison gperf
+    pkgconfig gettext gobjectIntrospection
   ];
 
   buildInputs = [
     gtk2 wayland libwebp enchant
-    libxml2 libsecret libxslt harfbuzz
+    libxml2 libsecret libxslt harfbuzz libpthreadstubs
     gst-plugins-base
   ];
 
   propagatedBuildInputs = [
-    libsoup
-    (if withGtk2 then gtk2 else gtk3)
+    libsoup gtk3
   ];
 
-  #enableParallelBuilding = true; # build problems on Hydra
+  # enableParallelBuilding = true; # build problems on Hydra
 }
diff --git a/pkgs/development/libraries/webkitgtk/finding-harfbuzz-icu.patch b/pkgs/development/libraries/webkitgtk/finding-harfbuzz-icu.patch
new file mode 100644
index 000000000000..14d58ef04f68
--- /dev/null
+++ b/pkgs/development/libraries/webkitgtk/finding-harfbuzz-icu.patch
@@ -0,0 +1,52 @@
+--- webkitgtk-2.6.1.orig/Source/cmake/FindHarfBuzz.cmake	2014-10-09 01:54:38.000000000 +0800
++++ webkitgtk-2.6.1/Source/cmake/FindHarfBuzz.cmake	2014-10-15 13:41:29.832290412 +0800
+@@ -34,21 +34,39 @@
+ 
+ pkg_check_modules(PC_HARFBUZZ harfbuzz>=0.9.7)
+ 
+-find_path(HARFBUZZ_INCLUDE_DIRS NAMES hb.h
+-    HINTS ${PC_HARFBUZZ_INCLUDE_DIRS} ${PC_HARFBUZZ_INCLUDEDIR}
+-)
+-
+-find_library(HARFBUZZ_LIBRARIES NAMES harfbuzz
+-    HINTS ${PC_HARFBUZZ_LIBRARY_DIRS} ${PC_HARFBUZZ_LIBDIR}
+-)
+-
+ # HarfBuzz 0.9.18 split ICU support into a separate harfbuzz-icu library.
+ if ("${PC_HARFBUZZ_VERSION}" VERSION_GREATER "0.9.17")
+     pkg_check_modules(PC_HARFBUZZ_ICU harfbuzz-icu>=0.9.18 REQUIRED)
+-    find_library(HARFBUZZ_ICU_LIBRARIES NAMES harfbuzz-icu
++
++    find_path(HARFBUZZ_ICU_INCLUDEDIR NAMES hb-icu.h
++        HINTS ${PC_HARFBUZZ_ICU_INCLUDE_DIRS} ${PC_HARFBUZZ_INCLUDEDIR}
++    )
++
++    find_library(HARFBUZZ_ICU_LIBRARY NAMES harfbuzz-icu
+         HINTS ${PC_HARFBUZZ_ICU_LIBRARY_DIRS} ${PC_HARFBUZZ_ICU_LIBDIR}
+     )
+-    list(APPEND HARFBUZZ_LIBRARIES "${HARFBUZZ_ICU_LIBRARIES}")
++
++    find_library(HARFBUZZ_LIBRARY NAMES harfbuzz
++        HINTS ${PC_HARFBUZZ_LIBRARY_DIRS} ${PC_HARFBUZZ_LIBDIR}
++    )
++
++    set(HARFBUZZ_INCLUDE_DIRS
++        ${PC_HARFBUZZ_INCLUDE_DIRS} ${HARFBUZZ_ICU_INCLUDEDIR}
++        CACHE INTERNAL ""
++    )
++
++    set(HARFBUZZ_LIBRARIES
++        ${HARFBUZZ_LIBRARY} ${HARFBUZZ_ICU_LIBRARY}
++        CACHE INTERNAL ""
++    )
++else ()
++    find_path(HARFBUZZ_INCLUDE_DIRS NAMES hb.h
++        HINTS ${PC_HARFBUZZ_INCLUDE_DIRS} ${PC_HARFBUZZ_INCLUDEDIR}
++    )
++
++    find_library(HARFBUZZ_LIBRARIES NAMES harfbuzz
++        HINTS ${PC_HARFBUZZ_LIBRARY_DIRS} ${PC_HARFBUZZ_LIBDIR}
++    )
+ endif ()
+ 
+ include(FindPackageHandleStandardArgs)
diff --git a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
index b9f7eee3ba24..b48f916ac7a0 100644
--- a/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
+++ b/pkgs/development/lisp-modules/clwrapper/setup-hook.sh
@@ -33,7 +33,7 @@ collectNixLispLDLP () {
 
 export NIX_LISP_COMMAND NIX_LISP CL_SOURCE_REGISTRY NIX_LISP_ASDF
 
-envHooks=(${envHooks[@]} addASDFPaths setLisp collectNixLispLDLP)
+envHooks+=(addASDFPaths setLisp collectNixLispLDLP)
 
 mkdir -p "$HOME"/.cache/common-lisp || HOME="$TMP/.temp-$USER-home"
 mkdir -p "$HOME"/.cache/common-lisp
diff --git a/pkgs/development/ocaml-modules/ocaml-text/default.nix b/pkgs/development/ocaml-modules/ocaml-text/default.nix
index 08136dd2b100..387c5cef19ad 100644
--- a/pkgs/development/ocaml-modules/ocaml-text/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-text/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libiconv, ocaml, findlib, ncurses}:
+{stdenv, fetchurl, libiconvOrNull, ocaml, findlib, ncurses}:
 
 stdenv.mkDerivation {
   name = "ocaml-text-0.6";
@@ -8,9 +8,12 @@ stdenv.mkDerivation {
     sha256 = "0j8gaak0ajnlmn8knvfygqwwzs7awjv5rfn5cbj6qxqbxhjd5m6g";
   };
 
-  buildInputs = [ocaml findlib libiconv ncurses];
+  buildInputs = [ocaml findlib ncurses]
+    ++ stdenv.lib.optional (libiconvOrNull != null) libiconvOrNull;
 
-  configurePhase = "iconv_prefix=${libiconv} ocaml setup.ml -configure";
+  configurePhase =
+    (stdenv.lib.optionalString (libiconvOrNull != null) "iconv_prefix=${libiconvOrNull} ")
+    + "ocaml setup.ml -configure";
 
   createFindlibDestdir = true;
 
@@ -18,9 +21,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "http://ocaml-text.forge.ocamlcore.org/";
     description = "OCaml-Text is a library for dealing with ``text'', i.e. sequence of unicode characters, in a convenient way. ";
-    license = "BSD";
+    license = stdenv.lib.licenses.bsd3;
     platforms = ocaml.meta.platforms;
-    maintainers = [
-    ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/ocamlmake/setup-hook.sh b/pkgs/development/ocaml-modules/ocamlmake/setup-hook.sh
index 876556a7b922..a93a7250bebb 100644
--- a/pkgs/development/ocaml-modules/ocamlmake/setup-hook.sh
+++ b/pkgs/development/ocaml-modules/ocamlmake/setup-hook.sh
@@ -2,4 +2,4 @@ addOcamlMakefile () {
     export OCAMLMAKEFILE="@out@/include/OCamlMakefile"
 }
 
-envHooks=(${envHooks[@]} addOcamlMakefile)
+envHooks+=(addOcamlMakefile)
diff --git a/pkgs/development/tools/misc/automake/setup-hook.sh b/pkgs/development/tools/misc/automake/setup-hook.sh
index 6f34f0d0ae17..5cd8c6229f68 100644
--- a/pkgs/development/tools/misc/automake/setup-hook.sh
+++ b/pkgs/development/tools/misc/automake/setup-hook.sh
@@ -2,4 +2,4 @@ addAclocals () {
     addToSearchPathWithCustomDelimiter : ACLOCAL_PATH $1/share/aclocal
 }
 
-envHooks=(${envHooks[@]} addAclocals)
+envHooks+=(addAclocals)
diff --git a/pkgs/development/tools/misc/ccache/default.nix b/pkgs/development/tools/misc/ccache/default.nix
index 56f8cefe07ca..066087fcd13b 100644
--- a/pkgs/development/tools/misc/ccache/default.nix
+++ b/pkgs/development/tools/misc/ccache/default.nix
@@ -1,5 +1,7 @@
 {stdenv, fetchurl, runCommand, gcc, zlib}:
 
+assert stdenv.isLinux;
+
 let
   ccache =
 stdenv.mkDerivation {
diff --git a/pkgs/development/tools/misc/distcc/masq.nix b/pkgs/development/tools/misc/distcc/masq.nix
index 753c35b5d3a2..28b31cbb48d5 100644
--- a/pkgs/development/tools/misc/distcc/masq.nix
+++ b/pkgs/development/tools/misc/distcc/masq.nix
@@ -3,6 +3,10 @@
 stdenv.mkDerivation {
   name = "distcc-masq-${gccRaw.name}";
 
+  meta = {
+    platforms = stdenv.lib.platforms.linux;
+  };
+
   phases = [ "installPhase" ];
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 06b5c2ef516d..5aa81e46bed1 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "c99f84d124347340c36707089ec8f70530abd56e7827c54d506eb4cc097a17e7";
   };
 
+  setupHook = [ ./setup-hook.sh ];
+
   meta = {
     homepage = http://nixos.org/patchelf.html;
     license = "GPL";
diff --git a/pkgs/development/tools/misc/patchelf/setup-hook.sh b/pkgs/development/tools/misc/patchelf/setup-hook.sh
new file mode 100644
index 000000000000..b0d37b73e2b6
--- /dev/null
+++ b/pkgs/development/tools/misc/patchelf/setup-hook.sh
@@ -0,0 +1,16 @@
+# This setup hook calls patchelf to automatically remove unneeded
+# directories from the RPATH of every library or executable in every
+# output.
+
+fixupOutputHooks+=('if [ -z "$dontPatchELF" ]; then patchELF "$prefix"; fi')
+
+patchELF() {
+    header "patching ELF executables and libraries in $prefix"
+    if [ -e "$prefix" ]; then
+        find "$prefix" \( \
+            \( -type f -a -name "*.so*" \) -o \
+            \( -type f -a -perm +0100 \) \
+            \) -print -exec patchelf --shrink-rpath '{}' \;
+    fi
+    stopNest
+}
diff --git a/pkgs/development/tools/misc/pkgconfig/setup-hook.sh b/pkgs/development/tools/misc/pkgconfig/setup-hook.sh
index 77a69fb18781..1c153976a343 100644
--- a/pkgs/development/tools/misc/pkgconfig/setup-hook.sh
+++ b/pkgs/development/tools/misc/pkgconfig/setup-hook.sh
@@ -4,7 +4,7 @@ addPkgConfigPath () {
 }
 
 if test -n "$crossConfig"; then
-    crossEnvHooks=(${crossEnvHooks[@]} addPkgConfigPath)
+    crossEnvHooks+=(addPkgConfigPath)
 else
-    envHooks=(${envHooks[@]} addPkgConfigPath)
+    envHooks+=(addPkgConfigPath)
 fi
diff --git a/pkgs/development/tools/misc/sloccount/default.nix b/pkgs/development/tools/misc/sloccount/default.nix
index 1aa9a2c058d6..fffb80747482 100644
--- a/pkgs/development/tools/misc/sloccount/default.nix
+++ b/pkgs/development/tools/misc/sloccount/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
 
   configurePhase = ''
     sed -i "makefile" -"es|PREFIX[[:blank:]]*=.*$|PREFIX = $out|g"
+    sed -i "makefile" -"es|gcc|$CC|g"
   '';
 
   doCheck = true;
diff --git a/pkgs/development/tools/ocaml/findlib/default.nix b/pkgs/development/tools/ocaml/findlib/default.nix
index 4afb8bfdbdfd..a9673be26ee3 100644
--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@@ -42,8 +42,8 @@ stdenv.mkDerivation {
           mkdir -p $OCAMLFIND_DESTDIR
         fi
     }
-    
-    envHooks=(''${envHooks[@]} addOCamlPath)
+
+    envHooks+=(addOCamlPath)
   '';
 
   meta = {
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index bd9ccf4947ba..5e15ef64cb2f 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, dpkg, curl, libarchive, openssl, ruby, rubyLibs, libiconv
+{ stdenv, fetchurl, dpkg, curl, libarchive, openssl, ruby, rubyLibs, libiconvOrLibc
 , libxml2, libxslt }:
 
 assert stdenv.system == "x86_64-linux" || stdenv.system == "i686-linux";
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
     # libiconv: iconv
     rm opt/vagrant/embedded/bin/iconv
-    ln -s ${libiconv}/bin/iconv opt/vagrant/embedded/bin
+    ln -s ${libiconvOrLibc}/bin/iconv opt/vagrant/embedded/bin
 
     # libxml: xml2-config, xmlcatalog, xmllint
     rm opt/vagrant/embedded/bin/{xml2-config,xmlcatalog,xmllint}
diff --git a/pkgs/development/web/nodejs/setup-hook.sh b/pkgs/development/web/nodejs/setup-hook.sh
index 41a9746ba424..e1f4d9089f38 100644
--- a/pkgs/development/web/nodejs/setup-hook.sh
+++ b/pkgs/development/web/nodejs/setup-hook.sh
@@ -2,4 +2,4 @@ addNodePath () {
     addToSearchPath NODE_PATH $1/lib/node_modules
 }
 
-envHooks=(${envHooks[@]} addNodePath)
+envHooks+=(addNodePath)
diff --git a/pkgs/games/spring/default.nix b/pkgs/games/spring/default.nix
index f045a8f496bb..f77166721866 100644
--- a/pkgs/games/spring/default.nix
+++ b/pkgs/games/spring/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram "$out/bin/spring" \
-      --prefix LD_LIBRARY_PATH : "${stdenv.gcc.gcc}/lib64:${stdenv.gcc.gcc}/lib::${systemd}/lib"
+      --prefix LD_LIBRARY_PATH : "${stdenv.gcc.gcc}/lib::${systemd}/lib"
   '';
 
   meta = with stdenv.lib; {
@@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
     description = "A powerful real-time strategy (RTS) game engine";
     license = licenses.gpl2;
     maintainers = [ maintainers.phreedom maintainers.qknight maintainers.iElectric ];
-    platforms = platforms.mesaPlatforms;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 98fedb2d3f4f..34eb19380d4a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
   };
 
   configurePhase = ''
+    export KCONFIG_NOTIMESTAMP=1
     make defconfig
     ${configParser}
     cat << EOF | parseconfig
diff --git a/pkgs/os-specific/linux/kernel-headers/3.7.nix b/pkgs/os-specific/linux/kernel-headers/3.7.nix
index e6fbf9bb9bc1..9bf189c40eda 100644
--- a/pkgs/os-specific/linux/kernel-headers/3.7.nix
+++ b/pkgs/os-specific/linux/kernel-headers/3.7.nix
@@ -4,7 +4,7 @@ assert cross == null -> stdenv.isLinux;
 
 let
 
-  version = "3.7.1";
+  version = "3.12.6";
 
   kernelHeadersBaseConfig =
     if cross == null
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.bz2";
-    sha256 = "1bb1dxj1i6j7pj926kfy6pz58kw03swyyikl9f3fq3jnswispaj2";
+    sha256 = "1qh6f1az0flfrbkdjx1i9r7yf31ad0gxigax91nd33z2jmd6h4df";
   };
 
   targetConfig = if cross != null then cross.config else null;
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index 148048f6505b..8402b952ff77 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     "MANDIR=share/man/man1"
   ];
 
+  setupHook = ./setup-hook.sh;
+
   meta = with stdenv.lib; {
     description = "A tool for controlling PaX flags on a per binary basis";
     homepage    = "https://pax.grsecurity.net";
diff --git a/pkgs/os-specific/linux/paxctl/setup-hook.sh b/pkgs/os-specific/linux/paxctl/setup-hook.sh
new file mode 100644
index 000000000000..11a6bb9910f9
--- /dev/null
+++ b/pkgs/os-specific/linux/paxctl/setup-hook.sh
@@ -0,0 +1,8 @@
+# PaX-mark binaries.
+paxmark() {
+    local flags="$1"
+    shift
+
+    paxctl -c "$@"
+    paxctl -zex -${flags} "$@"
+}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 3445c3cd2dd3..879a6e72f537 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,9 +1,8 @@
 { stdenv, fetchurl, pkgconfig, intltool, gperf, libcap, dbus, kmod
 , xz, pam, acl, cryptsetup, libuuid, m4, utillinux
-, glib, kbd, libxslt, coreutils, libgcrypt, sysvtools, docbook_xsl
+, glib, kbd, libxslt, coreutils, libgcrypt, sysvtools
 , kexectools, libmicrohttpd, linuxHeaders
 , pythonPackages ? null, pythonSupport ? false
-, autoreconfHook
 }:
 
 assert stdenv.isLinux;
@@ -11,25 +10,24 @@ assert stdenv.isLinux;
 assert pythonSupport -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
-  version = "212";
+  version = "217";
   name = "systemd-${version}";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/systemd/${name}.tar.xz";
-    sha256 = "1hpjcc42svrs06q3isjm3m5aphgkpfdylmvpnif71zh46ys0cab5";
+    sha256 = "163l1y4p2a564d4ynfq3k3xf53j2v5s81blb6cvpn1y7rpxyccd0";
   };
 
   patches =
     [ # These are all changes between upstream and
-      # https://github.com/edolstra/systemd/tree/nixos-v212.
+      # https://github.com/edolstra/systemd/tree/nixos-v216.
       ./fixes.patch
     ];
 
   buildInputs =
     [ pkgconfig intltool gperf libcap kmod xz pam acl
-      /* cryptsetup */ libuuid m4 glib libxslt libgcrypt docbook_xsl
+      /* cryptsetup */ libuuid m4 glib libxslt libgcrypt
       libmicrohttpd linuxHeaders
-      autoreconfHook
     ] ++ stdenv.lib.optionals pythonSupport [pythonPackages.python pythonPackages.lxml];
 
   configureFlags =
@@ -45,9 +43,23 @@ stdenv.mkDerivation rec {
       "--with-dbussessionservicedir=$(out)/share/dbus-1/services"
       "--with-firmware-path=/root/test-firmware:/run/current-system/firmware"
       "--with-tty-gid=3" # tty in NixOS has gid 3
-      "--disable-networkd" # enable/use eventually
       "--enable-compat-libs" # get rid of this eventually
       "--disable-tests"
+
+      "--disable-hostnamed"
+      "--disable-networkd" # enable/use eventually
+      "--disable-sysusers"
+      "--disable-timedated"
+      "--disable-timesyncd"
+      "--disable-readahead"
+      "--disable-firstboot"
+      "--disable-localed"
+      "--disable-resolved"
+      "--disable-split-usr"
+
+      "--with-sysvinit-path="
+      "--with-sysvrcnd-path="
+      "--with-rc-local-script-path-stop=/etc/halt.local"
     ];
 
   preConfigure =
@@ -88,6 +100,8 @@ stdenv.mkDerivation rec {
       # currently running systemd (/run/current-system/systemd) so
       # that we don't use an obsolete/garbage-collected release agent.
       "-USYSTEMD_CGROUP_AGENT_PATH" "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
+
+      "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
     ];
 
   # Use /var/lib/udev rather than /etc/udev for the generated hardware
@@ -104,9 +118,14 @@ stdenv.mkDerivation rec {
       "pamconfdir=$(out)/etc/pam.d"
     ];
 
-  # Get rid of configuration-specific data.
   postInstall =
     ''
+      # sysinit.target: Don't depend on
+      # systemd-tmpfiles-setup.service. This interferes with NixOps's
+      # send-keys feature (since sshd.service depends indirectly on
+      # sysinit.target).
+      mv $out/lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup-dev.service $out/lib/systemd/system/multi-user.target.wants/
+
       mkdir -p $out/example/systemd
       mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
       mv $out/lib/systemd/{system,user} $out/example/systemd
diff --git a/pkgs/os-specific/linux/systemd/fixes.patch b/pkgs/os-specific/linux/systemd/fixes.patch
index 72cf0e92bb84..592ea59ad6cb 100644
--- a/pkgs/os-specific/linux/systemd/fixes.patch
+++ b/pkgs/os-specific/linux/systemd/fixes.patch
@@ -1,72 +1,5 @@
-diff --git a/Makefile.am b/Makefile.am
-index 3d9e5c1..46487f6 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1095,7 +1095,7 @@ BUILT_SOURCES += \
- 
- src/shared/errno-list.txt:
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
--	$(AM_V_GEN)$(CPP) $(CFLAGS) $(AM_CPPFLAGS) $(CPPFLAGS) -dM -include errno.h - < /dev/null | $(AWK) '/^#define[ \t]+E[^ _]+[ \t]+[0-9]/ { print $$2; }'  > $@
-+	$(AM_V_GEN)$(CPP) $(CFLAGS) $(AM_CPPFLAGS) $(CPPFLAGS) -dM -include errno.h - < /dev/null | $(AWK) '/^#define[ \t]+E[^ _]+[ \t]+/ { print $$2; }'  > $@
- 
- src/shared/errno-from-name.gperf: src/shared/errno-list.txt
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
-@@ -1107,7 +1107,7 @@ src/shared/errno-from-name.h: src/shared/errno-from-name.gperf
- 
- src/shared/errno-to-name.h: src/shared/errno-list.txt
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
--	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const errno_names[] = { "} { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' < $< > $@
-+	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const errno_names[] = { "} !/EDEADLOCK/ && !/EWOULDBLOCK/ && !/ENOTSUP/ { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' < $< > $@
- 
- src/shared/af-list.txt:
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
-@@ -1707,7 +1707,9 @@ dist_tmpfiles_DATA += \
- endif
- 
- SYSINIT_TARGET_WANTS += \
--	systemd-tmpfiles-setup-dev.service \
-+	systemd-tmpfiles-setup-dev.service
-+
-+MULTI_USER_TARGET_WANTS += \
- 	systemd-tmpfiles-setup.service
- 
- dist_zshcompletion_DATA += \
-@@ -1961,6 +1963,7 @@ systemd_cgls_SOURCES = \
- 	src/cgls/cgls.c
- 
- systemd_cgls_LDADD = \
-+	libsystemd-internal.la \
- 	libsystemd-shared.la
- 
- # ------------------------------------------------------------------------------
-diff --git a/TODO b/TODO
-index e2ca1e6..d7efdd5 100644
---- a/TODO
-+++ b/TODO
-@@ -1,4 +1,6 @@
- Bugfixes:
-+* Should systemctl status \* work on all unit types, not just .service?
-+
- * enabling an instance unit creates a pointless link, and
-   the unit will be started with getty@getty.service:
-     $ systemctl enable getty@.service
-diff --git a/rules/42-usb-hid-pm.rules b/rules/42-usb-hid-pm.rules
-index c675b5b..4c300da 100644
---- a/rules/42-usb-hid-pm.rules
-+++ b/rules/42-usb-hid-pm.rules
-@@ -12,10 +12,6 @@ ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Mouse", ATTR{serial}!=
- ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Tablet", ATTR{serial}!="1", TEST=="power/control", ATTR{power/control}="auto"
- ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Keyboard", ATTR{serial}!="1", TEST=="power/control", ATTR{power/control}="auto"
- 
--# Catch-all for Avocent HID devices. Keyed off interface in order to only
--# trigger on HID class devices.
--ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0624", ATTR{bInterfaceClass}=="03", TEST=="../power/control", ATTR{../power/control}="auto"
--
- # Dell DRAC 4
- ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="413c", ATTR{idProduct}=="2500", TEST=="power/control", ATTR{power/control}="auto"
- 
 diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
-index db72373..2875958 100644
+index e30d9a8..a3d399b 100644
 --- a/rules/99-systemd.rules.in
 +++ b/rules/99-systemd.rules.in
 @@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
@@ -80,583 +13,11 @@ index db72373..2875958 100644
  # Ignore raid devices that are not yet assembled and started
  SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
  SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
-@@ -43,7 +39,7 @@ SUBSYSTEM=="net", KERNEL!="lo", TAG+="systemd", ENV{SYSTEMD_ALIAS}+="/sys/subsys
- SUBSYSTEM=="bluetooth", TAG+="systemd", ENV{SYSTEMD_ALIAS}+="/sys/subsystem/bluetooth/devices/%k"
- 
- SUBSYSTEM=="bluetooth", TAG+="systemd", ENV{SYSTEMD_WANTS}+="bluetooth.target"
--ENV{ID_SMARTCARD_READER}=="*?", TAG+="systemd", ENV{SYSTEMD_WANTS}+="smartcard.target"
-+ENV{ID_SMARTCARD_READER}=="?*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="smartcard.target"
- SUBSYSTEM=="sound", KERNEL=="card*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="sound.target"
- 
- SUBSYSTEM=="printer", TAG+="systemd", ENV{SYSTEMD_WANTS}+="printer.target"
-diff --git a/src/cgls/cgls.c b/src/cgls/cgls.c
-index b8e275d..1840594 100644
---- a/src/cgls/cgls.c
-+++ b/src/cgls/cgls.c
-@@ -35,6 +35,10 @@
- #include "build.h"
- #include "output-mode.h"
- #include "fileio.h"
-+#include "sd-bus.h"
-+#include "bus-util.h"
-+#include "bus-error.h"
-+#include "unit-name.h"
- 
- static bool arg_no_pager = false;
- static bool arg_kernel_threads = false;
-@@ -127,6 +131,7 @@ int main(int argc, char *argv[]) {
-         int r = 0, retval = EXIT_FAILURE;
-         int output_flags;
-         char _cleanup_free_ *root = NULL;
-+        _cleanup_bus_unref_ sd_bus *bus = NULL;
- 
-         log_parse_environment();
-         log_open();
-@@ -151,6 +156,12 @@ int main(int argc, char *argv[]) {
-                 arg_all * OUTPUT_SHOW_ALL |
-                 (arg_full > 0) * OUTPUT_FULL_WIDTH;
- 
-+        r = bus_open_transport(BUS_TRANSPORT_LOCAL, NULL, false, &bus);
-+        if (r < 0) {
-+                log_error("Failed to create bus connection: %s", strerror(-r));
-+                goto finish;
-+        }
-+
-         if (optind < argc) {
-                 int i;
- 
-@@ -189,8 +200,52 @@ int main(int argc, char *argv[]) {
-                 } else {
-                         if (arg_machine) {
-                                 char *m;
-+                                const char *cgroup;
-+                                _cleanup_free_ char *scope = NULL;
-+                                _cleanup_free_ char *path = NULL;
-+                                _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
-+                                _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
-+
-                                 m = strappenda("/run/systemd/machines/", arg_machine);
--                                r = parse_env_file(m, NEWLINE, "CGROUP", &root, NULL);
-+                                r = parse_env_file(m, NEWLINE, "SCOPE", &scope, NULL);
-+                                if (r < 0) {
-+                                        log_error("Failed to get machine path: %s", strerror(-r));
-+                                        goto finish;
-+                                }
-+
-+                                path = unit_dbus_path_from_name(scope);
-+                                if (!path) {
-+                                        r = log_oom();
-+                                        goto finish;
-+                                }
-+
-+                                r = sd_bus_get_property(
-+                                                bus,
-+                                                "org.freedesktop.systemd1",
-+                                                path,
-+                                                "org.freedesktop.systemd1.Scope",
-+                                                "ControlGroup",
-+                                                &error,
-+                                                &reply,
-+                                                "s");
-+
-+                                if (r < 0) {
-+                                        log_error("Failed to query ControlGroup: %s", bus_error_message(&error, -r));
-+                                        goto finish;
-+                                }
-+
-+                                r = sd_bus_message_read(reply, "s", &cgroup);
-+                                if (r < 0) {
-+                                        bus_log_parse_error(r);
-+                                        goto finish;
-+                                }
-+
-+                                root = strdup(cgroup);
-+                                if (!root) {
-+                                        r = log_oom();
-+                                        goto finish;
-+                                }
-+
-                         } else
-                                 r = cg_get_root_path(&root);
-                         if (r < 0) {
-diff --git a/src/core/cgroup.c b/src/core/cgroup.c
-index 3dd4c91..4201e1e 100644
---- a/src/core/cgroup.c
-+++ b/src/core/cgroup.c
-@@ -871,7 +871,7 @@ int manager_setup_cgroup(Manager *m) {
-         safe_close(m->pin_cgroupfs_fd);
- 
-         m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
--        if (r < 0) {
-+        if (m->pin_cgroupfs_fd < 0) {
-                 log_error("Failed to open pin file: %m");
-                 return -errno;
-         }
-diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
-index 775825b..5b1c4e3 100644
---- a/src/core/dbus-cgroup.c
-+++ b/src/core/dbus-cgroup.c
-@@ -173,6 +173,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->cpu_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_CPUACCT;
-                         unit_write_drop_in_private(u, mode, name, b ? "CPUAccounting=yes" : "CPUAccounting=no");
-                 }
- 
-@@ -192,6 +193,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->cpu_shares = ul;
-+                        u->cgroup_realized_mask &= ~CGROUP_CPU;
-                         unit_write_drop_in_private_format(u, mode, name, "CPUShares=%lu", ul);
-                 }
- 
-@@ -206,6 +208,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->blockio_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-                         unit_write_drop_in_private(u, mode, name, b ? "BlockIOAccounting=yes" : "BlockIOAccounting=no");
-                 }
- 
-@@ -225,6 +228,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->blockio_weight = ul;
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-                         unit_write_drop_in_private_format(u, mode, name, "BlockIOWeight=%lu", ul);
-                 }
- 
-@@ -294,6 +298,8 @@ int bus_cgroup_set_property(
-                                                 cgroup_context_free_blockio_device_bandwidth(c, a);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-@@ -375,6 +381,8 @@ int bus_cgroup_set_property(
-                                         cgroup_context_free_blockio_device_weight(c, c->blockio_device_weights);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-@@ -398,6 +406,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->memory_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_MEMORY;
-                         unit_write_drop_in_private(u, mode, name, b ? "MemoryAccounting=yes" : "MemoryAccounting=no");
-                 }
- 
-@@ -412,6 +421,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->memory_limit = limit;
-+                        u->cgroup_realized_mask &= ~CGROUP_MEMORY;
-                         unit_write_drop_in_private_format(u, mode, name, "%s=%" PRIu64, name, limit);
-                 }
- 
-@@ -433,6 +443,7 @@ int bus_cgroup_set_property(
-                         char *buf;
- 
-                         c->device_policy = p;
-+                        u->cgroup_realized_mask &= ~CGROUP_DEVICE;
- 
-                         buf = strappenda("DevicePolicy=", policy);
-                         unit_write_drop_in_private(u, mode, name, buf);
-@@ -511,6 +522,8 @@ int bus_cgroup_set_property(
-                                         cgroup_context_free_device_allow(c, c->device_allow);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_DEVICE;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
-index 13b3d0d..37d4154 100644
---- a/src/core/dbus-execute.c
-+++ b/src/core/dbus-execute.c
-@@ -842,7 +842,7 @@ int bus_exec_context_set_transient_property(
-                         strv_free(c->environment);
-                         c->environment = e;
- 
--                        joined = strv_join(c->environment, " ");
-+                        joined = strv_join_quoted(c->environment);
-                         if (!joined)
-                                 return -ENOMEM;
- 
-diff --git a/src/core/job.c b/src/core/job.c
-index 35a9de6..dc4f441 100644
---- a/src/core/job.c
-+++ b/src/core/job.c
-@@ -1060,6 +1060,9 @@ int job_coldplug(Job *j) {
-         if (r < 0)
-                 return r;
- 
-+        if (j->state == JOB_WAITING)
-+                job_add_to_run_queue(j);
-+
-         if (j->begin_usec == 0 || j->unit->job_timeout == 0)
-                 return 0;
- 
-diff --git a/src/core/killall.c b/src/core/killall.c
-index 57ed41c..eab48f7 100644
---- a/src/core/killall.c
-+++ b/src/core/killall.c
-@@ -168,7 +168,7 @@ static int killall(int sig, Set *pids, bool send_sighup) {
-                         continue;
- 
-                 if (sig == SIGKILL) {
--                        _cleanup_free_ char *s;
-+                        _cleanup_free_ char *s = NULL;
- 
-                         get_process_comm(pid, &s);
-                         log_notice("Sending SIGKILL to PID "PID_FMT" (%s).", pid, strna(s));
-diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c
-index d459afe..2a58e48 100644
---- a/src/core/machine-id-setup.c
-+++ b/src/core/machine-id-setup.c
-@@ -93,32 +93,9 @@ static int generate(char id[34], const char *root) {
-                 }
-         }
- 
--        /* If that didn't work, see if we are running in qemu/kvm and a
--         * machine ID was passed in via -uuid on the qemu/kvm command
--         * line */
--
--        r = detect_vm(&vm_id);
--        if (r > 0 && streq(vm_id, "kvm")) {
--                char uuid[37];
--
--                fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
--                if (fd >= 0) {
--                        k = loop_read(fd, uuid, 36, false);
--                        safe_close(fd);
--
--                        if (k >= 36) {
--                                r = shorten_uuid(id, uuid);
--                                if (r >= 0) {
--                                        log_info("Initializing machine ID from KVM UUID.");
--                                        return 0;
--                                }
--                        }
--                }
--        }
--
--        /* If that didn't work either, see if we are running in a
--         * container, and a machine ID was passed in via
--         * $container_uuid the way libvirt/LXC does it */
-+        /* If that didn't work, see if we are running in a container,
-+         * and a machine ID was passed in via $container_uuid the way
-+         * libvirt/LXC does it */
-         r = detect_container(NULL);
-         if (r > 0) {
-                 _cleanup_free_ char *e = NULL;
-@@ -133,6 +110,30 @@ static int generate(char id[34], const char *root) {
-                                 }
-                         }
-                 }
-+
-+        } else {
-+                /* If we are not running in a container, see if we are
-+                 * running in qemu/kvm and a machine ID was passed in
-+                 * via -uuid on the qemu/kvm command line */
-+
-+                r = detect_vm(&vm_id);
-+                if (r > 0 && streq(vm_id, "kvm")) {
-+                        char uuid[37];
-+
-+                        fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
-+                        if (fd >= 0) {
-+                                k = loop_read(fd, uuid, 36, false);
-+                                safe_close(fd);
-+
-+                                if (k >= 36) {
-+                                        r = shorten_uuid(id, uuid);
-+                                        if (r >= 0) {
-+                                                log_info("Initializing machine ID from KVM UUID.");
-+                                                return 0;
-+                                        }
-+                                }
-+                        }
-+                }
-         }
- 
-         /* If that didn't work, generate a random machine id */
-diff --git a/src/core/main.c b/src/core/main.c
-index 41605ee..c65701d 100644
---- a/src/core/main.c
-+++ b/src/core/main.c
-@@ -1840,6 +1840,7 @@ finish:
-         if (reexecute) {
-                 const char **args;
-                 unsigned i, args_size;
-+                sigset_t ss;
- 
-                 /* Close and disarm the watchdog, so that the new
-                  * instance can reinitialize it, but doesn't get
-@@ -1883,7 +1884,7 @@ finish:
-                         char_array_0(sfd);
- 
-                         i = 0;
--                        args[i++] = SYSTEMD_BINARY_PATH;
-+                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
-                         if (switch_root_dir)
-                                 args[i++] = "--switched-root";
-                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
-@@ -1923,6 +1924,13 @@ finish:
-                 args[i++] = NULL;
-                 assert(i <= args_size);
- 
-+                /* reenable any blocked signals, especially important
-+                 * if we switch from initial ramdisk to init=... */
-+                reset_all_signal_handlers();
-+
-+                assert_se(sigemptyset(&ss) == 0);
-+                assert_se(sigprocmask(SIG_SETMASK, &ss, NULL) == 0);
-+
-                 if (switch_root_init) {
-                         args[0] = switch_root_init;
-                         execv(args[0], (char* const*) args);
-diff --git a/src/core/manager.c b/src/core/manager.c
-index 224106c..7342095 100644
---- a/src/core/manager.c
-+++ b/src/core/manager.c
-@@ -422,7 +422,7 @@ int manager_new(SystemdRunningAs running_as, Manager **_m) {
-                 return -ENOMEM;
- 
- #ifdef ENABLE_EFI
--        if (detect_container(NULL) <= 0)
-+        if (running_as == SYSTEMD_SYSTEM && detect_container(NULL) <= 0)
-                 boot_timestamps(&m->userspace_timestamp, &m->firmware_timestamp, &m->loader_timestamp);
- #endif
- 
-@@ -2129,9 +2129,6 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
-                 if (u->id != t)
-                         continue;
- 
--                if (!unit_can_serialize(u))
--                        continue;
--
-                 /* Start marker */
-                 fputs(u->id, f);
-                 fputc('\n', f);
-diff --git a/src/core/namespace.c b/src/core/namespace.c
-index 9f15211..e41cf5b 100644
---- a/src/core/namespace.c
-+++ b/src/core/namespace.c
-@@ -42,6 +42,7 @@
- #include "mkdir.h"
- #include "dev-setup.h"
- #include "def.h"
-+#include "label.h"
- 
- typedef enum MountMode {
-         /* This is ordered by priority! */
-@@ -68,6 +69,7 @@ static int append_mounts(BindMount **p, char **strv, MountMode mode) {
-         STRV_FOREACH(i, strv) {
- 
-                 (*p)->ignore = false;
-+                (*p)->done = false;
- 
-                 if ((mode == INACCESSIBLE || mode == READONLY || mode == READWRITE) && (*i)[0] == '-') {
-                         (*p)->ignore = true;
-@@ -217,7 +219,10 @@ static int mount_dev(BindMount *m) {
-                         goto fail;
-                 }
- 
-+                label_context_set(d, st.st_mode);
-                 r = mknod(dn, st.st_mode, st.st_rdev);
-+                label_context_clear();
-+
-                 if (r < 0) {
-                         r = -errno;
-                         goto fail;
-@@ -350,7 +355,7 @@ int setup_namespace(
-                 private_dev;
- 
-         if (n > 0) {
--                m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
-+                m = mounts = (BindMount *) alloca0(n * sizeof(BindMount));
-                 r = append_mounts(&m, read_write_dirs, READWRITE);
-                 if (r < 0)
-                         return r;
-diff --git a/src/core/service.c b/src/core/service.c
-index ae3695a..6b3aa45 100644
---- a/src/core/service.c
-+++ b/src/core/service.c
-@@ -1096,11 +1096,6 @@ static int service_verify(Service *s) {
-                 return -EINVAL;
-         }
- 
--        if (s->type == SERVICE_ONESHOT && s->restart != SERVICE_RESTART_NO) {
--                log_error_unit(UNIT(s)->id, "%s has Restart setting other than no, which isn't allowed for Type=oneshot services. Refusing.", UNIT(s)->id);
--                return -EINVAL;
--        }
--
-         if (s->type == SERVICE_DBUS && !s->bus_name) {
-                 log_error_unit(UNIT(s)->id, "%s is of type D-Bus but no D-Bus service name has been specified. Refusing.", UNIT(s)->id);
-                 return -EINVAL;
-diff --git a/src/core/socket.c b/src/core/socket.c
-index 7c18a2b..1a560a6 100644
---- a/src/core/socket.c
-+++ b/src/core/socket.c
-@@ -663,16 +663,25 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
-                 int k;
- 
-                 k = getpeercred(fd, &ucred);
--                if (k < 0)
-+                if (k == -ENODATA) {
-+                        /* This handles the case where somebody is
-+                         * connecting from another pid/uid namespace
-+                         * (e.g. from outside of our container). */
-+                        if (asprintf(&r,
-+                                     "%u-unknown",
-+                                     nr) < 0)
-+                                return -ENOMEM;
-+                }
-+                else if (k < 0)
-                         return k;
--
--                if (asprintf(&r,
--                             "%u-%lu-%lu",
--                             nr,
--                             (unsigned long) ucred.pid,
--                             (unsigned long) ucred.uid) < 0)
--                        return -ENOMEM;
--
-+                else {
-+                        if (asprintf(&r,
-+                                     "%u-%lu-%lu",
-+                                     nr,
-+                                     (unsigned long) ucred.pid,
-+                                     (unsigned long) ucred.uid) < 0)
-+                                return -ENOMEM;
-+                }
-                 break;
-         }
- 
-@@ -1242,6 +1251,8 @@ static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
-                        NULL,
-                        s->exec_runtime,
-                        &pid);
-+        if (r < 0)
-+                goto fail;
- 
-         strv_free(argv);
-         if (r < 0)
-@@ -1497,6 +1508,12 @@ static void socket_enter_running(Socket *s, int cfd) {
-                         }
- 
-                 if (!pending) {
-+                        if (!UNIT_ISSET(s->service)) {
-+                                log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
-+                                r = -ENOENT;
-+                                goto fail;
-+                        }
-+
-                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
-                         if (r < 0)
-                                 goto fail;
-diff --git a/src/core/timer.c b/src/core/timer.c
-index 6c85304..720b8af 100644
---- a/src/core/timer.c
-+++ b/src/core/timer.c
-@@ -111,6 +111,23 @@ static int timer_add_default_dependencies(Timer *t) {
-         return unit_add_two_dependencies_by_name(UNIT(t), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
- }
- 
-+static void update_stampfile(Timer *t, usec_t timestamp) {
-+        _cleanup_close_ int fd = -1;
-+
-+        mkdir_parents_label(t->stamp_path, 0755);
-+
-+        /* Update the file atime + mtime, if we can */
-+        fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
-+        if (fd >= 0) {
-+                struct timespec ts[2];
-+
-+                timespec_store(&ts[0], timestamp);
-+                ts[1] = ts[0];
-+
-+                futimens(fd, ts);
-+        }
-+}
-+
- static int timer_setup_persistent(Timer *t) {
-         int r;
- 
-@@ -131,7 +148,7 @@ static int timer_setup_persistent(Timer *t) {
- 
-                 e = getenv("XDG_DATA_HOME");
-                 if (e)
--                        t->stamp_path = strjoin(e, "/systemd/timers/", UNIT(t)->id, NULL);
-+                        t->stamp_path = strjoin(e, "/systemd/timers/stamp-", UNIT(t)->id, NULL);
-                 else {
- 
-                         _cleanup_free_ char *h = NULL;
-@@ -496,22 +513,8 @@ static void timer_enter_running(Timer *t) {
- 
-         dual_timestamp_get(&t->last_trigger);
- 
--        if (t->stamp_path) {
--                _cleanup_close_ int fd = -1;
--
--                mkdir_parents_label(t->stamp_path, 0755);
--
--                /* Update the file atime + mtime, if we can */
--                fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
--                if (fd >= 0) {
--                        struct timespec ts[2];
--
--                        timespec_store(&ts[0], t->last_trigger.realtime);
--                        ts[1] = ts[0];
--
--                        futimens(fd, ts);
--                }
--        }
-+        if (t->stamp_path)
-+                update_stampfile(t, t->last_trigger.realtime);
- 
-         timer_set_state(t, TIMER_RUNNING);
-         return;
-@@ -539,6 +542,11 @@ static int timer_start(Unit *u) {
- 
-                 if (stat(t->stamp_path, &st) >= 0)
-                         t->last_trigger.realtime = timespec_load(&st.st_atim);
-+                else if (errno == ENOENT)
-+                        /* The timer has never run before,
-+                         * make sure a stamp file exists.
-+                         */
-+                        update_stampfile(t, now(CLOCK_REALTIME));
-         }
- 
-         t->result = TIMER_SUCCESS;
-diff --git a/src/core/transaction.c b/src/core/transaction.c
-index d00f427..2befc32 100644
---- a/src/core/transaction.c
-+++ b/src/core/transaction.c
-@@ -378,7 +378,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
-                                       "Found dependency on %s/%s",
-                                       k->unit->id, job_type_to_string(k->type));
- 
--                        if (!delete &&
-+                        if (!delete && hashmap_get(tr->jobs, k->unit) &&
-                             !unit_matters_to_anchor(k->unit, k)) {
-                                 /* Ok, we can drop this one, so let's
-                                  * do so. */
 diff --git a/src/core/umount.c b/src/core/umount.c
-index d1258f0..0311812 100644
+index cffa453..4d1a9ff 100644
 --- a/src/core/umount.c
 +++ b/src/core/umount.c
-@@ -404,6 +404,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
+@@ -385,6 +385,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
                   * anyway, since we are running from it. They have
                   * already been remounted ro. */
                  if (path_equal(m->path, "/")
@@ -665,926 +26,25 @@ index d1258f0..0311812 100644
  #ifndef HAVE_SPLIT_USR
                      || path_equal(m->path, "/usr")
  #endif
-diff --git a/src/core/unit.c b/src/core/unit.c
-index 153b79b..ed52694 100644
---- a/src/core/unit.c
-+++ b/src/core/unit.c
-@@ -2287,25 +2287,25 @@ bool unit_can_serialize(Unit *u) {
- }
- 
- int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs) {
--        ExecRuntime *rt;
-         int r;
- 
-         assert(u);
-         assert(f);
-         assert(fds);
- 
--        if (!unit_can_serialize(u))
--                return 0;
--
--        r = UNIT_VTABLE(u)->serialize(u, f, fds);
--        if (r < 0)
--                return r;
-+        if (unit_can_serialize(u)) {
-+                ExecRuntime *rt;
- 
--        rt = unit_get_exec_runtime(u);
--        if (rt) {
--                r = exec_runtime_serialize(rt, u, f, fds);
-+                r = UNIT_VTABLE(u)->serialize(u, f, fds);
-                 if (r < 0)
-                         return r;
-+
-+                rt = unit_get_exec_runtime(u);
-+                if (rt) {
-+                        r = exec_runtime_serialize(rt, u, f, fds);
-+                        if (r < 0)
-+                                return r;
-+                }
-         }
- 
-         dual_timestamp_serialize(f, "inactive-exit-timestamp", &u->inactive_exit_timestamp);
-@@ -2367,17 +2367,14 @@ void unit_serialize_item(Unit *u, FILE *f, const char *key, const char *value) {
- }
- 
- int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
--        size_t offset;
-         ExecRuntime **rt = NULL;
-+        size_t offset;
-         int r;
- 
-         assert(u);
-         assert(f);
-         assert(fds);
- 
--        if (!unit_can_serialize(u))
--                return 0;
--
-         offset = UNIT_VTABLE(u)->exec_runtime_offset;
-         if (offset > 0)
-                 rt = (ExecRuntime**) ((uint8_t*) u + offset);
-@@ -2487,24 +2484,34 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
-                         if (!s)
-                                 return -ENOMEM;
- 
--                        free(u->cgroup_path);
--                        u->cgroup_path = s;
-+                        if (u->cgroup_path) {
-+                                void *p;
- 
-+                                p = hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
-+                                log_info("Removing cgroup_path %s from hashmap (%p)",
-+                                         u->cgroup_path, p);
-+                                free(u->cgroup_path);
-+                        }
-+
-+                        u->cgroup_path = s;
-                         assert(hashmap_put(u->manager->cgroup_unit, s, u) == 1);
-+
-                         continue;
-                 }
- 
--                if (rt) {
--                        r = exec_runtime_deserialize_item(rt, u, l, v, fds);
-+                if (unit_can_serialize(u)) {
-+                        if (rt) {
-+                                r = exec_runtime_deserialize_item(rt, u, l, v, fds);
-+                                if (r < 0)
-+                                        return r;
-+                                if (r > 0)
-+                                        continue;
-+                        }
-+
-+                        r = UNIT_VTABLE(u)->deserialize_item(u, l, v, fds);
-                         if (r < 0)
-                                 return r;
--                        if (r > 0)
--                                continue;
-                 }
--
--                r = UNIT_VTABLE(u)->deserialize_item(u, l, v, fds);
--                if (r < 0)
--                        return r;
-         }
- }
- 
-diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c
-index 75d56dd..be8fb2f 100644
---- a/src/cryptsetup/cryptsetup-generator.c
-+++ b/src/cryptsetup/cryptsetup-generator.c
-@@ -29,6 +29,7 @@
- #include "mkdir.h"
- #include "strv.h"
- #include "fileio.h"
-+#include "path-util.h"
- 
- static const char *arg_dest = "/tmp";
- static bool arg_enabled = true;
-@@ -144,16 +145,19 @@ static int create_disk(
-                         if (!uu)
-                                 return log_oom();
- 
--                        if (is_device_path(uu)) {
--                                _cleanup_free_ char *dd;
-+                        if (!path_equal(uu, "/dev/null")) {
- 
--                                dd = unit_name_from_path(uu, ".device");
--                                if (!dd)
--                                        return log_oom();
-+                                if (is_device_path(uu)) {
-+                                        _cleanup_free_ char *dd;
- 
--                                fprintf(f, "After=%1$s\nRequires=%1$s\n", dd);
--                        } else
--                                fprintf(f, "RequiresMountsFor=%s\n", password);
-+                                        dd = unit_name_from_path(uu, ".device");
-+                                        if (!dd)
-+                                                return log_oom();
-+
-+                                        fprintf(f, "After=%1$s\nRequires=%1$s\n", dd);
-+                                } else
-+                                        fprintf(f, "RequiresMountsFor=%s\n", password);
-+                        }
-                 }
-         }
- 
-@@ -287,7 +291,7 @@ static int parse_proc_cmdline_item(const char *key, const char *value) {
-         } else if (STR_IN_SET(key, "luks.key", "rd.luks.key") && value) {
- 
-                 free(arg_keyfile);
--                arg_keyfile = strdup(key);
-+                arg_keyfile = strdup(value);
-                 if (!arg_keyfile)
-                         return log_oom();
- 
-diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
-index 9b9074c..ad6c76c 100644
---- a/src/cryptsetup/cryptsetup.c
-+++ b/src/cryptsetup/cryptsetup.c
-@@ -88,6 +88,13 @@ static int parse_one_option(const char *option) {
-                         return 0;
-                 }
- 
-+                if (arg_key_size % 8) {
-+                        log_error("size= not a multiple of 8, ignoring.");
-+                        return 0;
-+                }
-+
-+                arg_key_size /= 8;
-+
-         } else if (startswith(option, "key-slot=")) {
- 
-                 arg_type = CRYPT_LUKS1;
-@@ -404,7 +411,7 @@ static int attach_luks_or_plain(struct crypt_device *cd,
-                 /* for CRYPT_PLAIN limit reads
-                  * from keyfile to key length, and
-                  * ignore keyfile-size */
--                arg_keyfile_size = arg_key_size / 8;
-+                arg_keyfile_size = arg_key_size;
- 
-                 /* In contrast to what the name
-                  * crypt_setup() might suggest this
-@@ -567,7 +574,7 @@ int main(int argc, char *argv[]) {
-                 else
-                         until = 0;
- 
--                arg_key_size = (arg_key_size > 0 ? arg_key_size : 256);
-+                arg_key_size = (arg_key_size > 0 ? arg_key_size : (256 / 8));
- 
-                 if (key_file) {
-                         struct stat st;
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 18f2aca..2a2b1ea 100644
+index 70a5918..1926e52 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -285,7 +285,7 @@ int main(int argc, char *argv[]) {
- 
-         type = udev_device_get_property_value(udev_device, "ID_FS_TYPE");
-         if (type) {
--                const char *checker = strappenda("/sbin/fsck.", type);
-+                const char *checker = strappenda("/run/current-system/sw/sbin/fsck.", type);
-                 r = access(checker, X_OK);
-                 if (r < 0) {
-                         if (errno == ENOENT) {
-@@ -302,7 +302,7 @@ int main(int argc, char *argv[]) {
+@@ -315,8 +315,7 @@ int main(int argc, char *argv[]) {
                          return EXIT_FAILURE;
                  }
  
 -        cmdline[i++] = "/sbin/fsck";
+-        cmdline[i++] =  arg_repair;
 +        cmdline[i++] = "/run/current-system/sw/sbin/fsck";
-         cmdline[i++] = "-a";
          cmdline[i++] = "-T";
-         cmdline[i++] = "-l";
-diff --git a/src/getty-generator/getty-generator.c b/src/getty-generator/getty-generator.c
-index 6a4aa2c..700e90a 100644
---- a/src/getty-generator/getty-generator.c
-+++ b/src/getty-generator/getty-generator.c
-@@ -72,7 +72,7 @@ static int add_serial_getty(const char *tty) {
- 
-         log_debug("Automatically adding serial getty for /dev/%s.", tty);
- 
--        n = unit_name_replace_instance("serial-getty@.service", tty);
-+        n = unit_name_from_path_instance("serial-getty", tty, ".service");
-         if (!n)
-                 return log_oom();
- 
-@@ -86,7 +86,7 @@ static int add_container_getty(const char *tty) {
- 
-         log_debug("Automatically adding container getty for /dev/pts/%s.", tty);
- 
--        n = unit_name_replace_instance("container-getty@.service", tty);
-+        n = unit_name_from_path_instance("container-getty", tty, ".service");
-         if (!n)
-                 return log_oom();
- 
-diff --git a/src/journal/catalog.c b/src/journal/catalog.c
-index 3ed0b7e..02dedc4 100644
---- a/src/journal/catalog.c
-+++ b/src/journal/catalog.c
-@@ -103,7 +103,7 @@ static int finish_item(
-                 const char *payload) {
- 
-         ssize_t offset;
--        CatalogItem *i;
-+        _cleanup_free_ CatalogItem *i = NULL;
-         int r;
- 
-         assert(h);
-@@ -126,13 +126,14 @@ static int finish_item(
-         i->offset = htole64((uint64_t) offset);
- 
-         r = hashmap_put(h, i, i);
--        if (r == EEXIST) {
-+        if (r == -EEXIST) {
-                 log_warning("Duplicate entry for " SD_ID128_FORMAT_STR ".%s, ignoring.",
-                             SD_ID128_FORMAT_VAL(id), language ? language : "C");
--                free(i);
-                 return 0;
--        }
-+        } else if (r < 0)
-+                return r;
- 
-+        i = NULL;
-         return 0;
- }
- 
-@@ -383,8 +384,8 @@ error:
- int catalog_update(const char* database, const char* root, const char* const* dirs) {
-         _cleanup_strv_free_ char **files = NULL;
-         char **f;
--        Hashmap *h;
-         struct strbuf *sb = NULL;
-+        _cleanup_hashmap_free_free_ Hashmap *h = NULL;
-         _cleanup_free_ CatalogItem *items = NULL;
-         CatalogItem *i;
-         Iterator j;
-@@ -406,13 +407,17 @@ int catalog_update(const char* database, const char* root, const char* const* di
-         }
- 
-         STRV_FOREACH(f, files) {
--                log_debug("reading file '%s'", *f);
--                catalog_import_file(h, sb, *f);
-+                log_debug("Reading file '%s'", *f);
-+                r = catalog_import_file(h, sb, *f);
-+                if (r < 0) {
-+                        log_error("Failed to import file '%s': %s.",
-+                                  *f, strerror(-r));
-+                        goto finish;
-+                }
-         }
- 
-         if (hashmap_size(h) <= 0) {
-                 log_info("No items in catalog.");
--                r = 0;
-                 goto finish;
-         } else
-                 log_debug("Found %u items in catalog.", hashmap_size(h));
-@@ -443,11 +448,7 @@ int catalog_update(const char* database, const char* root, const char* const* di
-                 log_debug("%s: wrote %u items, with %zu bytes of strings, %ld total size.",
-                           database, n, sb->len, r);
- 
--        r = 0;
--
- finish:
--        if (h)
--                hashmap_free_free(h);
-         if (sb)
-                 strbuf_cleanup(sb);
- 
-diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
-index f2f1f35..fd9d2a8 100644
---- a/src/journal/journal-file.c
-+++ b/src/journal/journal-file.c
-@@ -274,12 +274,6 @@ static int journal_file_verify_header(JournalFile *f) {
-             !VALID64(le64toh(f->header->entry_array_offset)))
-                 return -ENODATA;
- 
--        if (le64toh(f->header->data_hash_table_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->field_hash_table_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->tail_object_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->entry_array_offset) < le64toh(f->header->header_size))
--                return -ENODATA;
--
-         if (f->writable) {
-                 uint8_t state;
-                 sd_id128_t machine_id;
-diff --git a/src/journal/journal-remote-parse.c b/src/journal/journal-remote-parse.c
-index 142de0e..239ff38 100644
---- a/src/journal/journal-remote-parse.c
-+++ b/src/journal/journal-remote-parse.c
-@@ -40,7 +40,7 @@ void source_free(RemoteSource *source) {
- 
- static int get_line(RemoteSource *source, char **line, size_t *size) {
-         ssize_t n, remain;
--        char *c;
-+        char *c = NULL;
-         char *newbuf = NULL;
-         size_t newsize = 0;
- 
-@@ -49,7 +49,9 @@ static int get_line(RemoteSource *source, char **line, size_t *size) {
-         assert(source->filled <= source->size);
-         assert(source->buf == NULL || source->size > 0);
- 
--        c = memchr(source->buf, '\n', source->filled);
-+        if (source->buf)
-+                c = memchr(source->buf, '\n', source->filled);
-+
-         if (c != NULL)
-                 goto docopy;
- 
-diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c
-index 35948ea..48725e4 100644
---- a/src/journal/journald-kmsg.c
-+++ b/src/journal/journald-kmsg.c
-@@ -152,7 +152,7 @@ static void dev_kmsg_record(Server *s, char *p, size_t l) {
-                 /* Did we lose any? */
-                 if (serial > *s->kernel_seqnum)
-                         server_driver_message(s, SD_MESSAGE_JOURNAL_MISSED, "Missed %"PRIu64" kernel messages",
--                                              serial - *s->kernel_seqnum - 1);
-+                                              serial - *s->kernel_seqnum);
- 
-                 /* Make sure we never read this one again. Note that
-                  * we always store the next message serial we expect
-diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
-index 6da81e7..b6f8e7e 100644
---- a/src/journal/journald-server.c
-+++ b/src/journal/journald-server.c
-@@ -67,6 +67,7 @@
- #define DEFAULT_SYNC_INTERVAL_USEC (5*USEC_PER_MINUTE)
- #define DEFAULT_RATE_LIMIT_INTERVAL (30*USEC_PER_SEC)
- #define DEFAULT_RATE_LIMIT_BURST 1000
-+#define DEFAULT_MAX_FILE_USEC USEC_PER_MONTH
- 
- #define RECHECK_AVAILABLE_SPACE_USEC (30*USEC_PER_SEC)
- 
-@@ -1473,6 +1474,8 @@ int server_init(Server *s) {
-         s->forward_to_syslog = true;
-         s->forward_to_wall = true;
- 
-+        s->max_file_usec = DEFAULT_MAX_FILE_USEC;
-+
-         s->max_level_store = LOG_DEBUG;
-         s->max_level_syslog = LOG_DEBUG;
-         s->max_level_kmsg = LOG_NOTICE;
-diff --git a/src/journal/microhttpd-util.c b/src/journal/microhttpd-util.c
-index f693e0f..9a8d5c6 100644
---- a/src/journal/microhttpd-util.c
-+++ b/src/journal/microhttpd-util.c
-@@ -129,7 +129,7 @@ void log_func_gnutls(int level, const char *message) {
-         if (0 <= level && level < (int) ELEMENTSOF(log_level_map))
-                 ourlevel = log_level_map[level];
-         else
--                level = LOG_DEBUG;
-+                ourlevel = LOG_DEBUG;
- 
-         log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
- }
-diff --git a/src/journal/test-catalog.c b/src/journal/test-catalog.c
-index b087a8b..967ab67 100644
---- a/src/journal/test-catalog.c
-+++ b/src/journal/test-catalog.c
-@@ -157,7 +157,8 @@ int main(int argc, char *argv[]) {
- 
-         setlocale(LC_ALL, "de_DE.UTF-8");
- 
--        log_set_max_level(LOG_DEBUG);
-+        log_parse_environment();
-+        log_open();
- 
-         test_catalog_file_lang();
- 
-diff --git a/src/libsystemd/sd-rtnl/rtnl-message.c b/src/libsystemd/sd-rtnl/rtnl-message.c
-index 84a8ffa..e79b318 100644
---- a/src/libsystemd/sd-rtnl/rtnl-message.c
-+++ b/src/libsystemd/sd-rtnl/rtnl-message.c
-@@ -335,24 +335,28 @@ int sd_rtnl_message_link_get_flags(sd_rtnl_message *m, unsigned *flags) {
- /* If successful the updated message will be correctly aligned, if
-    unsuccessful the old message is untouched. */
- static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data, size_t data_length) {
--        uint32_t rta_length, message_length;
-+        uint32_t rta_length;
-+        size_t message_length, padding_length;
-         struct nlmsghdr *new_hdr;
-         struct rtattr *rta;
-         char *padding;
-         unsigned i;
-+        int offset;
- 
-         assert(m);
-         assert(m->hdr);
-         assert(!m->sealed);
-         assert(NLMSG_ALIGN(m->hdr->nlmsg_len) == m->hdr->nlmsg_len);
--        assert(!data || data_length > 0);
--        assert(data || m->n_containers < RTNL_CONTAINER_DEPTH);
-+        assert(!data || data_length);
-+
-+        /* get offset of the new attribute */
-+        offset = m->hdr->nlmsg_len;
- 
-         /* get the size of the new rta attribute (with padding at the end) */
-         rta_length = RTA_LENGTH(data_length);
- 
-         /* get the new message size (with padding at the end) */
--        message_length = m->hdr->nlmsg_len + RTA_ALIGN(rta_length);
-+        message_length = offset + RTA_ALIGN(rta_length);
- 
-         /* realloc to fit the new attribute */
-         new_hdr = realloc(m->hdr, message_length);
-@@ -361,32 +365,35 @@ static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data,
-         m->hdr = new_hdr;
- 
-         /* get pointer to the attribute we are about to add */
--        rta = (struct rtattr *) ((uint8_t *) m->hdr + m->hdr->nlmsg_len);
-+        rta = (struct rtattr *) ((uint8_t *) m->hdr + offset);
- 
-         /* if we are inside containers, extend them */
-         for (i = 0; i < m->n_containers; i++)
--                GET_CONTAINER(m, i)->rta_len += message_length - m->hdr->nlmsg_len;
-+                GET_CONTAINER(m, i)->rta_len += message_length - offset;
- 
-         /* fill in the attribute */
-         rta->rta_type = type;
-         rta->rta_len = rta_length;
--        if (!data) {
--                /* this is the start of a new container */
--                m->container_offsets[m->n_containers ++] = m->hdr->nlmsg_len;
--        } else {
-+        if (data)
-                 /* we don't deal with the case where the user lies about the type
-                  * and gives us too little data (so don't do that)
--                */
-+                 */
-                 padding = mempcpy(RTA_DATA(rta), data, data_length);
--                /* make sure also the padding at the end of the message is initialized */
--                memzero(padding,
--                        (uint8_t *) m->hdr + message_length - (uint8_t *) padding);
-+        else {
-+                /* if no data was passed, make sure we still initialize the padding
-+                   note that we can have data_length > 0 (used by some containers) */
-+                padding = RTA_DATA(rta);
-+                data_length = 0;
-         }
- 
-+        /* make sure also the padding at the end of the message is initialized */
-+        padding_length = (uint8_t*)m->hdr + message_length - (uint8_t*)padding;
-+        memzero(padding, padding_length);
-+
-         /* update message size */
-         m->hdr->nlmsg_len = message_length;
- 
--        return 0;
-+        return offset;
- }
- 
- int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const char *data) {
-@@ -761,22 +768,29 @@ int sd_rtnl_message_open_container(sd_rtnl_message *m, unsigned short type) {
- 
-         assert_return(m, -EINVAL);
-         assert_return(!m->sealed, -EPERM);
-+        assert_return(m->n_containers < RTNL_CONTAINER_DEPTH, -ERANGE);
- 
-         sd_rtnl_message_get_type(m, &rtm_type);
- 
-+        int r = -ENOTSUP;
-+
-         if (rtnl_message_type_is_link(rtm_type)) {
- 
-                 if ((type == IFLA_LINKINFO && m->n_containers == 0) ||
-                     (type == IFLA_INFO_DATA && m->n_containers == 1 &&
-                      GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO))
--                        return add_rtattr(m, type, NULL, 0);
-+                        r = add_rtattr(m, type, NULL, 0);
-                 else if (type == VETH_INFO_PEER && m->n_containers == 2 &&
-                          GET_CONTAINER(m, 1)->rta_type == IFLA_INFO_DATA &&
-                          GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO)
--                        return add_rtattr(m, type, NULL, sizeof(struct ifinfomsg));
-+                        r=  add_rtattr(m, type, NULL, sizeof(struct ifinfomsg));
-         }
- 
--        return -ENOTSUP;
-+        if (r < 0) return r;
-+
-+        m->container_offsets[m->n_containers ++] = r;
-+
-+        return 0;
- }
- 
- int sd_rtnl_message_close_container(sd_rtnl_message *m) {
-diff --git a/src/libudev/libudev-monitor.c b/src/libudev/libudev-monitor.c
-index ba1b04d..85b1e40 100644
---- a/src/libudev/libudev-monitor.c
-+++ b/src/libudev/libudev-monitor.c
-@@ -108,15 +108,13 @@ static struct udev_monitor *udev_monitor_new(struct udev *udev)
- 
- /* we consider udev running when /dev is on devtmpfs */
- static bool udev_has_devtmpfs(struct udev *udev) {
--        struct file_handle *h;
-+        union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ, };
-         int mount_id;
-         _cleanup_fclose_ FILE *f = NULL;
-         char line[LINE_MAX], *e;
-         int r;
- 
--        h = alloca(MAX_HANDLE_SZ);
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r = name_to_handle_at(AT_FDCWD, "/dev", h, &mount_id, 0);
-+        r = name_to_handle_at(AT_FDCWD, "/dev", &h.handle, &mount_id, 0);
-         if (r < 0)
-                 return false;
- 
-diff --git a/src/login/70-uaccess.rules b/src/login/70-uaccess.rules
-index e1cf897..57f619d 100644
---- a/src/login/70-uaccess.rules
-+++ b/src/login/70-uaccess.rules
-@@ -12,7 +12,7 @@ ENV{MAJOR}=="", GOTO="uaccess_end"
- SUBSYSTEM=="usb", ENV{ID_USB_INTERFACES}=="*:060101:*", TAG+="uaccess"
- 
- # Digicams with proprietary protocol
--ENV{ID_GPHOTO2}=="*?", TAG+="uaccess"
-+ENV{ID_GPHOTO2}=="?*", TAG+="uaccess"
- 
- # SCSI and USB scanners
- ENV{libsane_matched}=="yes", TAG+="uaccess"
-@@ -49,13 +49,13 @@ SUBSYSTEM=="drm", KERNEL=="card*|renderD*", TAG+="uaccess"
- SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"
- 
- # smart-card readers
--ENV{ID_SMARTCARD_READER}=="*?", TAG+="uaccess"
-+ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess"
- 
- # (USB) authentication devices
--ENV{ID_SECURITY_TOKEN}=="*?", TAG+="uaccess"
-+ENV{ID_SECURITY_TOKEN}=="?*", TAG+="uaccess"
- 
- # PDA devices
--ENV{ID_PDA}=="*?", TAG+="uaccess"
-+ENV{ID_PDA}=="?*", TAG+="uaccess"
- 
- # Programmable remote control
- ENV{ID_REMOTE_CONTROL}=="1", TAG+="uaccess"
-@@ -64,10 +64,10 @@ ENV{ID_REMOTE_CONTROL}=="1", TAG+="uaccess"
- SUBSYSTEM=="input", ENV{ID_INPUT_JOYSTICK}=="?*", TAG+="uaccess"
- 
- # color measurement devices
--ENV{COLOR_MEASUREMENT_DEVICE}=="*?", TAG+="uaccess"
-+ENV{COLOR_MEASUREMENT_DEVICE}=="?*", TAG+="uaccess"
- 
- # DDC/CI device, usually high-end monitors such as the DreamColor
--ENV{DDC_DEVICE}=="*?", TAG+="uaccess"
-+ENV{DDC_DEVICE}=="?*", TAG+="uaccess"
- 
- # media player raw devices (for user-mode drivers, Android SDK, etc.)
- SUBSYSTEM=="usb", ENV{ID_MEDIA_PLAYER}=="?*", TAG+="uaccess"
-diff --git a/src/login/logind-acl.c b/src/login/logind-acl.c
-index dc86f0f..4bbeb64 100644
---- a/src/login/logind-acl.c
-+++ b/src/login/logind-acl.c
-@@ -279,7 +279,9 @@ int devnode_acl_all(struct udev *udev,
- 
-                 log_debug("Fixing up ACLs at %s for seat %s", n, seat);
-                 k = devnode_acl(n, flush, del, old_uid, add, new_uid);
--                if (k < 0)
-+                if (k == -ENOENT)
-+                        log_debug("Device %s disappeared while setting ACLs", n);
-+                else if (k < 0)
-                         r = k;
-         }
  
-diff --git a/src/login/logind-action.c b/src/login/logind-action.c
-index 1928f43..d69c7ad 100644
---- a/src/login/logind-action.c
-+++ b/src/login/logind-action.c
-@@ -79,14 +79,12 @@ int manager_handle_action(
-                         return 0;
-                 }
- 
--                /* If we have more than one or no displays connected,
--                 * don't react to lid closing. The no display case we
--                 * treat like this under the assumption that there is
--                 * no modern drm driver available. */
-+                /* If we have more than one display connected,
-+                 * don't react to lid closing. */
-                 n = manager_count_displays(m);
-                 if (n < 0)
-                         log_warning("Display counting failed: %s", strerror(-n));
--                else if (n != 1) {
-+                else if (n > 1) {
-                         log_debug("Ignoring lid switch request, %i displays connected.", n);
-                         return 0;
-                 }
-diff --git a/src/login/logind-seat.c b/src/login/logind-seat.c
-index 3f5efdc..1ee6ced 100644
---- a/src/login/logind-seat.c
-+++ b/src/login/logind-seat.c
-@@ -275,8 +275,13 @@ int seat_switch_to(Seat *s, unsigned int num) {
-         if (!num)
-                 return -EINVAL;
- 
--        if (num >= s->position_count || !s->positions[num])
-+        if (num >= s->position_count || !s->positions[num]) {
-+                /* allow switching to unused VTs to trigger auto-activate */
-+                if (seat_has_vts(s) && num < 64)
-+                        return chvt(num);
-+
-                 return -EINVAL;
-+        }
- 
-         return session_activate(s->positions[num]);
- }
-diff --git a/src/login/logind-session.c b/src/login/logind-session.c
-index 4ca6b5d..02a780d 100644
---- a/src/login/logind-session.c
-+++ b/src/login/logind-session.c
-@@ -213,7 +213,6 @@ int session_save(Session *s) {
- 
-         if (s->scope)
-                 fprintf(f, "SCOPE=%s\n", s->scope);
--
-         if (s->scope_job)
-                 fprintf(f, "SCOPE_JOB=%s\n", s->scope_job);
- 
-@@ -229,17 +228,54 @@ int session_save(Session *s) {
-         if (s->display)
-                 fprintf(f, "DISPLAY=%s\n", s->display);
- 
--        if (s->remote_host)
--                fprintf(f, "REMOTE_HOST=%s\n", s->remote_host);
-+        if (s->remote_host) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(s->remote_host);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "REMOTE_HOST=%s\n", escaped);
-+        }
-+
-+        if (s->remote_user) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(s->remote_user);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "REMOTE_USER=%s\n", escaped);
-+        }
-+
-+        if (s->service) {
-+                _cleanup_free_ char *escaped;
- 
--        if (s->remote_user)
--                fprintf(f, "REMOTE_USER=%s\n", s->remote_user);
-+                escaped = cescape(s->service);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "SERVICE=%s\n", escaped);
-+        }
- 
--        if (s->service)
--                fprintf(f, "SERVICE=%s\n", s->service);
-+        if (s->desktop) {
-+                _cleanup_free_ char *escaped;
- 
--        if (s->desktop)
--                fprintf(f, "DESKTOP=%s\n", s->desktop);
-+
-+                escaped = cescape(s->desktop);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "DESKTOP=%s\n", escaped);
-+        }
- 
-         if (s->seat && seat_has_vts(s->seat))
-                 fprintf(f, "VTNR=%u\n", s->vtnr);
-@@ -972,6 +1008,10 @@ void session_mute_vt(Session *s) {
-         if (vt < 0)
-                 return;
- 
-+        r = fchown(vt, s->user->uid, -1);
-+        if (r < 0)
-+                goto error;
-+
-         r = ioctl(vt, KDSKBMODE, K_OFF);
-         if (r < 0)
-                 goto error;
-@@ -1026,6 +1066,8 @@ void session_restore_vt(Session *s) {
-         mode.mode = VT_AUTO;
-         ioctl(vt, VT_SETMODE, &mode);
- 
-+        fchown(vt, 0, -1);
-+
-         s->vtfd = safe_close(s->vtfd);
- }
- 
-diff --git a/src/login/org.freedesktop.login1.policy.in b/src/login/org.freedesktop.login1.policy.in
-index b96d32d..b8e90f1 100644
---- a/src/login/org.freedesktop.login1.policy.in
-+++ b/src/login/org.freedesktop.login1.policy.in
-@@ -254,7 +254,7 @@
-                 <defaults>
-                         <allow_any>auth_admin_keep</allow_any>
-                         <allow_inactive>auth_admin_keep</allow_inactive>
--                        <allow_active>auth_admin_keep</allow_active>
-+                        <allow_active>yes</allow_active>
-                 </defaults>
-                 <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.hibernate</annotate>
-         </action>
-diff --git a/src/login/pam-module.c b/src/login/pam-module.c
-index 9873dd5..1259457 100644
---- a/src/login/pam-module.c
-+++ b/src/login/pam-module.c
-@@ -475,7 +475,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
-         }
- 
-         if (session_fd >= 0) {
--                session_fd = dup(session_fd);
-+                session_fd = fcntl(session_fd, F_DUPFD_CLOEXEC, 3);
-                 if (session_fd < 0) {
-                         pam_syslog(handle, LOG_ERR, "Failed to dup session fd: %m");
-                         return PAM_SESSION_ERR;
-diff --git a/src/machine/machine.c b/src/machine/machine.c
-index 9a5cc9a..de701ad 100644
---- a/src/machine/machine.c
-+++ b/src/machine/machine.c
-@@ -123,17 +123,42 @@ int machine_save(Machine *m) {
-                 "NAME=%s\n",
-                 m->name);
- 
--        if (m->unit)
--                fprintf(f, "SCOPE=%s\n", m->unit); /* We continue to call this "SCOPE=" because it is internal only, and we want to stay compatible with old files */
-+        if (m->unit) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(m->unit);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "SCOPE=%s\n", escaped); /* We continue to call this "SCOPE=" because it is internal only, and we want to stay compatible with old files */
-+        }
- 
-         if (m->scope_job)
-                 fprintf(f, "SCOPE_JOB=%s\n", m->scope_job);
- 
--        if (m->service)
--                fprintf(f, "SERVICE=%s\n", m->service);
-+        if (m->service) {
-+                _cleanup_free_ char *escaped;
- 
--        if (m->root_directory)
--                fprintf(f, "ROOT=%s\n", m->root_directory);
-+                escaped = cescape(m->service);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+                fprintf(f, "SERVICE=%s\n", escaped);
-+        }
-+
-+        if (m->root_directory) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(m->root_directory);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+                fprintf(f, "ROOT=%s\n", escaped);
-+        }
- 
-         if (!sd_id128_equal(m->id, SD_ID128_NULL))
-                 fprintf(f, "ID=" SD_ID128_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(m->id));
-@@ -330,16 +355,18 @@ static int machine_stop_scope(Machine *m) {
-         if (!m->unit)
-                 return 0;
- 
--        r = manager_stop_unit(m->manager, m->unit, &error, &job);
--        if (r < 0) {
--                log_error("Failed to stop machine scope: %s", bus_error_message(&error, r));
--                return r;
-+        if (!m->registered) {
-+                r = manager_stop_unit(m->manager, m->unit, &error, &job);
-+                if (r < 0) {
-+                        log_error("Failed to stop machine scope: %s", bus_error_message(&error, r));
-+                        return r;
-+                }
-         }
- 
-         free(m->scope_job);
-         m->scope_job = job;
- 
--        return r;
-+        return 0;
- }
- 
- int machine_stop(Machine *m) {
-@@ -415,6 +442,8 @@ int machine_kill(Machine *m, KillWho who, int signo) {
- 
-                 if (kill(m->leader, signo) < 0)
-                         return -errno;
-+
-+                return 0;
-         }
- 
-         /* Otherwise make PID 1 do it for us, for the entire cgroup */
-diff --git a/src/machine/machine.h b/src/machine/machine.h
-index f4aefc5..de3536d 100644
---- a/src/machine/machine.h
-+++ b/src/machine/machine.h
-@@ -72,6 +72,7 @@ struct Machine {
- 
-         bool in_gc_queue:1;
-         bool started:1;
-+        bool registered:1;
- 
-         sd_bus_message *create_message;
- 
-diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
-index 9473105..154a335 100644
---- a/src/machine/machined-dbus.c
-+++ b/src/machine/machined-dbus.c
-@@ -241,6 +241,7 @@ static int method_create_or_register_machine(Manager *manager, sd_bus_message *m
-         m->leader = leader;
-         m->class = c;
-         m->id = id;
-+        m->registered = true;
- 
-         if (!isempty(service)) {
-                 m->service = strdup(service);
+         /*
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 9a9ed9d..c3e6d23 100644
+index b6d9bc6..04fbe57 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -769,6 +769,15 @@ static int setup_resolv_conf(const char *dest) {
-         return 0;
- }
- 
-+static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
-+
-+        snprintf(s, 37,
-+                 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-+                 SD_ID128_FORMAT_VAL(id));
-+
-+        return s;
-+}
-+
- static int setup_boot_id(const char *dest) {
-         _cleanup_free_ char *from = NULL, *to = NULL;
-         sd_id128_t rnd = {};
-@@ -794,10 +803,7 @@ static int setup_boot_id(const char *dest) {
-                 return r;
-         }
- 
--        snprintf(as_uuid, sizeof(as_uuid),
--                 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
--                 SD_ID128_FORMAT_VAL(rnd));
--        char_array_0(as_uuid);
-+        id128_format_as_uuid(rnd, as_uuid);
- 
-         r = write_string_file(from, as_uuid);
-         if (r < 0) {
-@@ -2378,7 +2384,7 @@ static int change_uid_gid(char **_home) {
-         _cleanup_fclose_ FILE *f = NULL;
-         _cleanup_close_ int fd = -1;
-         unsigned n_uids = 0;
--        size_t sz, l;
-+        size_t sz = 0, l;
-         uid_t uid;
-         gid_t gid;
-         pid_t pid;
-@@ -2667,6 +2673,7 @@ int main(int argc, char *argv[]) {
+@@ -3073,6 +3073,7 @@ int main(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -1592,7 +52,7 @@ index 9a9ed9d..c3e6d23 100644
                          const char *p;
  
                          p = strappenda(arg_directory,
-@@ -2676,6 +2683,7 @@ int main(int argc, char *argv[]) {
+@@ -3082,6 +3083,7 @@ int main(int argc, char *argv[]) {
                                  goto finish;
  
                          }
@@ -1600,510 +60,11 @@ index 9a9ed9d..c3e6d23 100644
                  }
          } else {
                  char template[] = "/tmp/nspawn-root-XXXXXX";
-@@ -2748,8 +2756,6 @@ int main(int argc, char *argv[]) {
-                 goto finish;
-         }
- 
--        sd_notify(0, "READY=1");
--
-         assert_se(sigemptyset(&mask) == 0);
-         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
-         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
-@@ -2966,7 +2972,9 @@ int main(int argc, char *argv[]) {
-                         }
- 
-                         if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
--                                if (asprintf((char**)(envp + n_env++), "container_uuid=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid)) < 0) {
-+                                char as_uuid[37];
-+
-+                                if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
-                                         log_oom();
-                                         goto child_fail;
-                                 }
-@@ -3086,6 +3094,8 @@ int main(int argc, char *argv[]) {
-                 if (r < 0)
-                         goto finish;
- 
-+                sd_notify(0, "READY=1");
-+
-                 /* Notify the child that the parent is ready with all
-                  * its setup, and thtat the child can now hand over
-                  * control to the code to run inside the container. */
-@@ -3136,6 +3146,10 @@ int main(int argc, char *argv[]) {
- 
-                         if (!arg_quiet)
-                                 log_info("Container %s is being rebooted.", arg_machine);
-+                        if (getenv("EXIT_ON_REBOOT") != 0) {
-+                                r = 10;
-+                                break;
-+                        }
-                         continue;
-                 } else if (status.si_code == CLD_KILLED ||
-                            status.si_code == CLD_DUMPED) {
-diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
-index d61ecdf..228a3a4 100644
---- a/src/nss-myhostname/netlink.c
-+++ b/src/nss-myhostname/netlink.c
-@@ -112,6 +112,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
-                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
-                         continue;
- 
-+                if (ifaddrmsg->ifa_family == AF_INET6 &&
-+                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
-+                        continue;
-+
-                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
-                         continue;
- 
-diff --git a/src/python-systemd/_reader.c b/src/python-systemd/_reader.c
-index 059b904..9a19a10 100644
---- a/src/python-systemd/_reader.c
-+++ b/src/python-systemd/_reader.c
-@@ -902,7 +902,6 @@ static PyObject* get_catalog(PyObject *self, PyObject *args) {
-         sd_id128_t id;
-         _cleanup_free_ char *msg = NULL;
- 
--        assert(!self);
-         assert(args);
- 
-         if (!PyArg_ParseTuple(args, "z:get_catalog", &id_))
-diff --git a/src/python-systemd/journal.py b/src/python-systemd/journal.py
-index 9c7e004..dd1f229 100644
---- a/src/python-systemd/journal.py
-+++ b/src/python-systemd/journal.py
-@@ -293,7 +293,7 @@ class Reader(_Reader):
-             monotonic = monotonic.totalseconds()
-         monotonic = int(monotonic * 1000000)
-         if isinstance(bootid, _uuid.UUID):
--            bootid = bootid.get_hex()
-+            bootid = bootid.hex
-         return super(Reader, self).seek_monotonic(monotonic, bootid)
- 
-     def log_level(self, level):
-@@ -314,7 +314,7 @@ class Reader(_Reader):
-         Equivalent to add_match(MESSAGE_ID=`messageid`).
-         """
-         if isinstance(messageid, _uuid.UUID):
--            messageid = messageid.get_hex()
-+            messageid = messageid.hex
-         self.add_match(MESSAGE_ID=messageid)
- 
-     def this_boot(self, bootid=None):
-@@ -346,7 +346,7 @@ class Reader(_Reader):
- 
- def get_catalog(mid):
-     if isinstance(mid, _uuid.UUID):
--        mid = mid.get_hex()
-+        mid = mid.hex
-     return _get_catalog(mid)
- 
- def _make_line(field, value):
-diff --git a/src/readahead/readahead-common.c b/src/readahead/readahead-common.c
-index 5ffa88b..49679fc 100644
---- a/src/readahead/readahead-common.c
-+++ b/src/readahead/readahead-common.c
-@@ -75,7 +75,7 @@ int fs_on_ssd(const char *p) {
-         if (major(st.st_dev) == 0) {
-                 _cleanup_fclose_ FILE *f = NULL;
-                 int mount_id;
--                struct file_handle *h;
-+                union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ, };
- 
-                 /* Might be btrfs, which exposes "ssd" as mount flag if it is on ssd.
-                  *
-@@ -83,9 +83,7 @@ int fs_on_ssd(const char *p) {
-                  * and then lookup the mount ID in mountinfo to find
-                  * the mount options. */
- 
--                h = alloca(MAX_HANDLE_SZ);
--                h->handle_bytes = MAX_HANDLE_SZ;
--                r = name_to_handle_at(AT_FDCWD, p, h, &mount_id, AT_SYMLINK_FOLLOW);
-+                r = name_to_handle_at(AT_FDCWD, p, &h.handle, &mount_id, AT_SYMLINK_FOLLOW);
-                 if (r < 0)
-                         return false;
- 
-diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
-index d27b1b7..905a2e1 100644
---- a/src/shared/conf-parser.c
-+++ b/src/shared/conf-parser.c
-@@ -336,8 +336,8 @@ int config_parse(const char *unit,
-         if (!f) {
-                 f = ours = fopen(filename, "re");
-                 if (!f) {
--                        log_error("Failed to open configuration file '%s': %m", filename);
--                        return -errno;
-+                        log_full(errno == ENOENT ? LOG_DEBUG : LOG_ERR, "Failed to open configuration file '%s': %m", filename);
-+                        return errno == ENOENT ? 0 : -errno;
-                 }
-         }
- 
-diff --git a/src/shared/generator.c b/src/shared/generator.c
-index 6110303..e679cb1 100644
---- a/src/shared/generator.c
-+++ b/src/shared/generator.c
-@@ -48,7 +48,7 @@ int generator_write_fsck_deps(
-                 const char *checker;
-                 int r;
- 
--                checker = strappenda("/sbin/fsck.", fstype);
-+                checker = strappenda("/run/current-system/sw/sbin/fsck.", fstype);
-                 r = access(checker, X_OK);
-                 if (r < 0) {
-                         log_warning("Checking was requested for %s, but %s cannot be used: %m", what, checker);
-diff --git a/src/shared/install.c b/src/shared/install.c
-index 7409046..4517c9c 100644
---- a/src/shared/install.c
-+++ b/src/shared/install.c
-@@ -560,7 +560,7 @@ int unit_file_mask(
-                 unsigned *n_changes) {
- 
-         char **i;
--        _cleanup_free_ char *prefix;
-+        _cleanup_free_ char *prefix = NULL;
-         int r;
- 
-         assert(scope >= 0);
-diff --git a/src/shared/log.c b/src/shared/log.c
-index a4b3b68..890a9fa 100644
---- a/src/shared/log.c
-+++ b/src/shared/log.c
-@@ -878,6 +878,9 @@ void log_parse_environment(void) {
-                         if (l == 5 && startswith(w, "debug")) {
-                                 log_set_max_level(LOG_DEBUG);
-                                 break;
-+                        } else if (l == 5 && startswith(w, "quiet")) {
-+                                log_set_max_level(LOG_WARNING);
-+                                break;
-                         }
-                 }
-         }
-diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
-index 9d14933..b0b66f6 100644
---- a/src/shared/logs-show.c
-+++ b/src/shared/logs-show.c
-@@ -547,7 +547,9 @@ static int output_export(
-                     startswith(data, "_BOOT_ID="))
-                         continue;
- 
--                if (!utf8_is_printable(data, length)) {
-+                if (utf8_is_printable_newline(data, length, false))
-+                        fwrite(data, length, 1, f);
-+                else {
-                         const char *c;
-                         uint64_t le64;
- 
-@@ -562,8 +564,7 @@ static int output_export(
-                         le64 = htole64(length - (c - (const char*) data) - 1);
-                         fwrite(&le64, sizeof(le64), 1, f);
-                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
--                } else
--                        fwrite(data, length, 1, f);
-+                }
- 
-                 fputc('\n', f);
-         }
-diff --git a/src/shared/unit-name.c b/src/shared/unit-name.c
-index 6c167b4..d0e71f2 100644
---- a/src/shared/unit-name.c
-+++ b/src/shared/unit-name.c
-@@ -332,7 +332,7 @@ char *unit_name_path_unescape(const char *f) {
- }
- 
- bool unit_name_is_template(const char *n) {
--        const char *p;
-+        const char *p, *e;
- 
-         assert(n);
- 
-@@ -340,11 +340,15 @@ bool unit_name_is_template(const char *n) {
-         if (!p)
-                 return false;
- 
--        return p[1] == '.';
-+        e = strrchr(p+1, '.');
-+        if (!e)
-+                return false;
-+
-+        return e == p + 1;
- }
- 
- bool unit_name_is_instance(const char *n) {
--        const char *p;
-+        const char *p, *e;
- 
-         assert(n);
- 
-@@ -352,7 +356,11 @@ bool unit_name_is_instance(const char *n) {
-         if (!p)
-                 return false;
- 
--        return p[1] != '.';
-+        e = strrchr(p+1, '.');
-+        if (!e)
-+                return false;
-+
-+        return e > p + 1;
- }
- 
- char *unit_name_replace_instance(const char *f, const char *i) {
-diff --git a/src/shared/utf8.c b/src/shared/utf8.c
-index 0b524d8..c559c13 100644
---- a/src/shared/utf8.c
-+++ b/src/shared/utf8.c
-@@ -136,7 +136,7 @@ int utf8_encoded_to_unichar(const char *str) {
-         return unichar;
- }
- 
--bool utf8_is_printable(const char* str, size_t length) {
-+bool utf8_is_printable_newline(const char* str, size_t length, bool newline) {
-         const uint8_t *p;
- 
-         assert(str);
-@@ -145,7 +145,8 @@ bool utf8_is_printable(const char* str, size_t length) {
-                 int encoded_len = utf8_encoded_valid_unichar((const char *)p);
-                 int val = utf8_encoded_to_unichar((const char*)p);
- 
--                if (encoded_len < 0 || val < 0 || is_unicode_control(val))
-+                if (encoded_len < 0 || val < 0 || is_unicode_control(val) ||
-+                    (!newline && val == '\n'))
-                         return false;
- 
-                 length -= encoded_len;
-diff --git a/src/shared/utf8.h b/src/shared/utf8.h
-index c0eb73a..c087995 100644
---- a/src/shared/utf8.h
-+++ b/src/shared/utf8.h
-@@ -31,7 +31,10 @@ const char *utf8_is_valid(const char *s) _pure_;
- char *ascii_is_valid(const char *s) _pure_;
- char *utf8_escape_invalid(const char *s);
- 
--bool utf8_is_printable(const char* str, size_t length) _pure_;
-+bool utf8_is_printable_newline(const char* str, size_t length, bool newline) _pure_;
-+_pure_ static inline bool utf8_is_printable(const char* str, size_t length) {
-+        return utf8_is_printable_newline(str, length, true);
-+}
- 
- char *utf16_to_utf8(const void *s, size_t length);
- 
-diff --git a/src/shared/util.c b/src/shared/util.c
-index ffe6624..2a2b2b2 100644
---- a/src/shared/util.c
-+++ b/src/shared/util.c
-@@ -166,19 +166,19 @@ int close_nointr(int fd) {
- 
-         assert(fd >= 0);
-         r = close(fd);
--
--        /* Just ignore EINTR; a retry loop is the wrong
--         * thing to do on Linux.
--         *
--         * http://lkml.indiana.edu/hypermail/linux/kernel/0509.1/0877.html
--         * https://bugzilla.gnome.org/show_bug.cgi?id=682819
--         * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR
--         * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain
--         */
--        if (_unlikely_(r < 0 && errno == EINTR))
--                return 0;
--        else if (r >= 0)
-+        if (r >= 0)
-                 return r;
-+        else if (errno == EINTR)
-+                /*
-+                 * Just ignore EINTR; a retry loop is the wrong
-+                 * thing to do on Linux.
-+                 *
-+                 * http://lkml.indiana.edu/hypermail/linux/kernel/0509.1/0877.html
-+                 * https://bugzilla.gnome.org/show_bug.cgi?id=682819
-+                 * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR
-+                 * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain
-+                 */
-+                return 0;
-         else
-                 return -errno;
- }
-@@ -195,7 +195,13 @@ int safe_close(int fd) {
- 
-         if (fd >= 0) {
-                 PROTECT_ERRNO;
--                assert_se(close_nointr(fd) == 0);
-+
-+                /* The kernel might return pretty much any error code
-+                 * via close(), but the fd will be closed anyway. The
-+                 * only condition we want to check for here is whether
-+                 * the fd was invalid at all... */
-+
-+                assert_se(close_nointr(fd) != -EBADF);
-         }
- 
-         return -1;
-@@ -1365,7 +1371,7 @@ bool ignore_file(const char *filename) {
-         assert(filename);
- 
-         if (endswith(filename, "~"))
--                return false;
-+                return true;
- 
-         return ignore_file_allow_backup(filename);
- }
-@@ -1495,6 +1501,7 @@ bool fstype_is_network(const char *fstype) {
-         static const char table[] =
-                 "cifs\0"
-                 "smbfs\0"
-+                "sshfs\0"
-                 "ncpfs\0"
-                 "ncp\0"
-                 "nfs\0"
-@@ -1581,8 +1588,9 @@ int read_one_char(FILE *f, char *ret, usec_t t, bool *need_nl) {
-                 if (fd_wait_for_event(fileno(f), POLLIN, t) <= 0)
-                         return -ETIMEDOUT;
- 
-+        errno = 0;
-         if (!fgets(line, sizeof(line), f))
--                return -EIO;
-+                return errno ? -errno : -EIO;
- 
-         truncate_nl(line);
- 
-@@ -5327,6 +5335,9 @@ bool string_is_safe(const char *p) {
-                 if (*t > 0 && *t < ' ')
-                         return false;
- 
-+                if (*t == 127)
-+                        return false;
-+
-                 if (strchr("\\\"\'", *t))
-                         return false;
-         }
-@@ -5343,10 +5354,14 @@ bool string_has_cc(const char *p) {
- 
-         assert(p);
- 
--        for (t = p; *t; t++)
-+        for (t = p; *t; t++) {
-                 if (*t > 0 && *t < ' ' && *t != '\t')
-                         return true;
- 
-+                if (*t == 127)
-+                        return true;
-+        }
-+
-         return false;
- }
- 
-@@ -6391,3 +6406,19 @@ void hexdump(FILE *f, const void *p, size_t s) {
-                 s -= 16;
-         }
- }
-+
-+int update_reboot_param_file(const char *param)
-+{
-+        int r = 0;
-+
-+        if (param) {
-+
-+                r = write_string_file(REBOOT_PARAM_FILE, param);
-+                if (r < 0)
-+                        log_error("Failed to write reboot param to "
-+                                  REBOOT_PARAM_FILE": %s", strerror(-r));
-+        } else
-+                unlink(REBOOT_PARAM_FILE);
-+
-+        return r;
-+}
-diff --git a/src/shared/util.h b/src/shared/util.h
-index 90464c9..122ac91 100644
---- a/src/shared/util.h
-+++ b/src/shared/util.h
-@@ -22,6 +22,7 @@
- ***/
- 
- #include <alloca.h>
-+#include <fcntl.h>
- #include <inttypes.h>
- #include <time.h>
- #include <sys/time.h>
-@@ -922,3 +923,10 @@ uint64_t physical_memory(void);
- char* mount_test_option(const char *haystack, const char *needle);
- 
- void hexdump(FILE *f, const void *p, size_t s);
-+
-+union file_handle_union {
-+        struct file_handle handle;
-+        char padding[sizeof(struct file_handle) + MAX_HANDLE_SZ];
-+};
-+
-+int update_reboot_param_file(const char *param);
-diff --git a/src/shared/virt.c b/src/shared/virt.c
-index ec2ddcf..f03e790 100644
---- a/src/shared/virt.c
-+++ b/src/shared/virt.c
-@@ -149,7 +149,7 @@ static int detect_vm_dmi(const char **_id) {
- 
- /* Returns a short identifier for the various VM implementations */
- int detect_vm(const char **id) {
--        _cleanup_free_ char *hvtype = NULL, *cpuinfo_contents = NULL;
-+        _cleanup_free_ char *domcap = NULL, *cpuinfo_contents = NULL;
-         static thread_local int cached_found = -1;
-         static thread_local const char *cached_id = NULL;
-         const char *_id = NULL;
-@@ -163,17 +163,37 @@ int detect_vm(const char **id) {
-                 return cached_found;
-         }
- 
--        /* Try high-level hypervisor sysfs file first:
-+        /* Try xen capabilities file first, if not found try high-level hypervisor sysfs file:
-          *
--         * https://bugs.freedesktop.org/show_bug.cgi?id=61491 */
--        r = read_one_line_file("/sys/hypervisor/type", &hvtype);
-+         * https://bugs.freedesktop.org/show_bug.cgi?id=77271 */
-+        r = read_one_line_file("/proc/xen/capabilities", &domcap);
-         if (r >= 0) {
--                if (streq(hvtype, "xen")) {
-+                char *cap, *i = domcap;
-+
-+                while ((cap = strsep(&i, ",")))
-+                        if (streq(cap, "control_d"))
-+                                break;
-+
-+                if (!i)  {
-                         _id = "xen";
-                         r = 1;
--                        goto finish;
-                 }
--        } else if (r != -ENOENT)
-+
-+                goto finish;
-+
-+        } else if (r == -ENOENT) {
-+                _cleanup_free_ char *hvtype = NULL;
-+
-+                r = read_one_line_file("/sys/hypervisor/type", &hvtype);
-+                if (r >= 0) {
-+                        if (streq(hvtype, "xen")) {
-+                                _id = "xen";
-+                                r = 1;
-+                                goto finish;
-+                        }
-+                } else if (r != -ENOENT)
-+                        return r;
-+        } else
-                 return r;
- 
-         /* this will set _id to "other" and return 0 for unknown hypervisors */
 diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
-index 0887bc3..d02ee2b 100644
+index 28eaa6a..6292c09 100644
 --- a/src/systemctl/systemctl.c
 +++ b/src/systemctl/systemctl.c
-@@ -461,7 +461,7 @@ static int output_units_list(const UnitInfo *unit_infos, unsigned c) {
-                 }
- 
-                 if (circle_len > 0)
--                        printf("%s%s%s", on_circle, circle ? draw_special_char(DRAW_BLACK_CIRCLE) : "  ", off_circle);
-+                        printf("%s%s%s ", on_circle, circle ? draw_special_char(DRAW_BLACK_CIRCLE) : " ", off_circle);
- 
-                 printf("%s%-*s%s %s%-*s%s %s%-*s %-*s%s %-*s",
-                        on_active, id_len, id, off_active,
-@@ -2561,7 +2561,7 @@ static int start_unit_one(
+@@ -2651,7 +2651,7 @@ static int start_unit_one(
  
                  log_debug("Adding %s to the set", p);
                  r = set_consume(s, p);
@@ -2112,523 +73,6 @@ index 0887bc3..d02ee2b 100644
                          return log_oom();
          }
  
-@@ -4240,7 +4240,7 @@ static int show_all(
-         _cleanup_free_ UnitInfo *unit_infos = NULL;
-         const UnitInfo *u;
-         unsigned c;
--        int r;
-+        int r, ret = 0;
- 
-         r = get_unit_list(bus, NULL, NULL, &unit_infos, 0, &reply);
-         if (r < 0)
-@@ -4262,9 +4262,11 @@ static int show_all(
-                 r = show_one(verb, bus, p, show_properties, new_line, ellipsized);
-                 if (r < 0)
-                         return r;
-+                else if (r > 0 && ret == 0)
-+                        ret = r;
-         }
- 
--        return 0;
-+        return ret;
- }
- 
- static int show_system_status(sd_bus *bus) {
-@@ -4386,7 +4388,12 @@ static int show(sd_bus *bus, char **args) {
-                                 }
-                         }
- 
--                        show_one(args[0], bus, unit, show_properties, &new_line, &ellipsized);
-+                        r = show_one(args[0], bus, unit, show_properties,
-+                                     &new_line, &ellipsized);
-+                        if (r < 0)
-+                                return r;
-+                        else if (r > 0 && ret == 0)
-+                                ret = r;
-                 }
- 
-                 if (!strv_isempty(patterns)) {
-@@ -4403,7 +4410,12 @@ static int show(sd_bus *bus, char **args) {
-                                 if (!unit)
-                                         return log_oom();
- 
--                                show_one(args[0], bus, unit, show_properties, &new_line, &ellipsized);
-+                                r = show_one(args[0], bus, unit, show_properties,
-+                                             &new_line, &ellipsized);
-+                                if (r < 0)
-+                                        return r;
-+                                else if (r > 0 && ret == 0)
-+                                        ret = r;
-                         }
-                 }
-         }
-@@ -5403,15 +5415,15 @@ static int systemctl_help(void) {
-                "                                  otherwise restart if active\n"
-                "  isolate NAME                    Start one unit and stop all others\n"
-                "  kill NAME...                    Send signal to processes of a unit\n"
--               "  is-active NAME...               Check whether units are active\n"
--               "  is-failed NAME...               Check whether units are failed\n"
--               "  status [NAME...|PID...]         Show runtime status of one or more units\n"
--               "  show [NAME...|JOB...]           Show properties of one or more\n"
-+               "  is-active PATTERN...            Check whether units are active\n"
-+               "  is-failed PATTERN...            Check whether units are failed\n"
-+               "  status [PATTERN...|PID...]      Show runtime status of one or more units\n"
-+               "  show [PATTERN...|JOB...]        Show properties of one or more\n"
-                "                                  units/jobs or the manager\n"
--               "  cat NAME...                     Show files and drop-ins of one or more units\n"
-+               "  cat PATTERN...                  Show files and drop-ins of one or more units\n"
-                "  set-property NAME ASSIGNMENT... Sets one or more properties of a unit\n"
--               "  help NAME...|PID...             Show manual for one or more units\n"
--               "  reset-failed [NAME...]          Reset failed state for all, one, or more\n"
-+               "  help PATTERN...|PID...          Show manual for one or more units\n"
-+               "  reset-failed [PATTERN...]       Reset failed state for all, one, or more\n"
-                "                                  units\n"
-                "  list-dependencies [NAME]        Recursively show units which are required\n"
-                "                                  or wanted by this unit or by which this\n"
-@@ -5973,13 +5985,10 @@ static int halt_parse_argv(int argc, char *argv[]) {
-                 }
-         }
- 
--        if (arg_action == ACTION_REBOOT && argc == optind + 1) {
--                r = write_string_file(REBOOT_PARAM_FILE, argv[optind]);
--                if (r < 0) {
--                        log_error("Failed to write reboot param to "
--                                  REBOOT_PARAM_FILE": %s", strerror(-r));
-+        if (arg_action == ACTION_REBOOT && (argc == optind || argc == optind + 1)) {
-+                r = update_reboot_param_file(argc == optind + 1 ? argv[optind] : NULL);
-+                if (r < 0)
-                         return r;
--                }
-         } else if (optind < argc) {
-                 log_error("Too many arguments.");
-                 return -EINVAL;
-diff --git a/src/test/test-udev.c b/src/test/test-udev.c
-index b064744..b057cc8 100644
---- a/src/test/test-udev.c
-+++ b/src/test/test-udev.c
-@@ -155,9 +155,8 @@ int main(int argc, char *argv[]) {
-                 }
-         }
- 
--        err = udev_event_execute_rules(event, rules, &sigmask_orig);
--        if (err == 0)
--                udev_event_execute_run(event, NULL);
-+        udev_event_execute_rules(event, rules, &sigmask_orig);
-+        udev_event_execute_run(event, NULL);
- out:
-         if (event != NULL && event->fd_signal >= 0)
-                 close(event->fd_signal);
-diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
-index 33e7cbc..04b472d 100644
---- a/src/tmpfiles/tmpfiles.c
-+++ b/src/tmpfiles/tmpfiles.c
-@@ -217,19 +217,16 @@ static bool unix_socket_alive(const char *fn) {
- }
- 
- static int dir_is_mount_point(DIR *d, const char *subdir) {
--        struct file_handle *h;
-+        union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ };
-         int mount_id_parent, mount_id;
-         int r_p, r;
- 
--        h = alloca(MAX_HANDLE_SZ);
--
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r_p = name_to_handle_at(dirfd(d), ".", h, &mount_id_parent, 0);
-+        r_p = name_to_handle_at(dirfd(d), ".", &h.handle, &mount_id_parent, 0);
-         if (r_p < 0)
-                 r_p = -errno;
- 
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r = name_to_handle_at(dirfd(d), subdir, h, &mount_id, 0);
-+        h.handle.handle_bytes = MAX_HANDLE_SZ;
-+        r = name_to_handle_at(dirfd(d), subdir, &h.handle, &mount_id, 0);
-         if (r < 0)
-                 r = -errno;
- 
-diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
-index 1d067af..3203474 100644
---- a/src/tty-ask-password-agent/tty-ask-password-agent.c
-+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
-@@ -432,7 +432,7 @@ static int wall_tty_block(void) {
- 
-         r = get_ctty_devnr(0, &devnr);
-         if (r < 0)
--                return -r;
-+                return r;
- 
-         if (asprintf(&p, "/run/systemd/ask-password-block/%u:%u", major(devnr), minor(devnr)) < 0)
-                 return -ENOMEM;
-diff --git a/src/udev/accelerometer/accelerometer.c b/src/udev/accelerometer/accelerometer.c
-index 925d38d..32adf27 100644
---- a/src/udev/accelerometer/accelerometer.c
-+++ b/src/udev/accelerometer/accelerometer.c
-@@ -180,7 +180,7 @@ get_prev_orientation(struct udev_device *dev)
-         return string_to_orientation(value);
- }
- 
--#define SET_AXIS(axis, code_) if (ev[i].code == code_) { if (got_##axis == 0) { axis = ev[i].value; got_##axis = true; } }
-+#define READ_AXIS(axis, var) { memzero(&abs_info, sizeof(abs_info)); r = ioctl(fd, EVIOCGABS(axis), &abs_info); if (r < 0) return; var = abs_info.value; }
- 
- /* accelerometers */
- static void test_orientation(struct udev *udev,
-@@ -189,10 +189,9 @@ static void test_orientation(struct udev *udev,
- {
-         OrientationUp old, new;
-         _cleanup_close_ int fd = -1;
--        struct input_event ev[64];
--        bool got_syn = false;
--        bool got_x = false, got_y = false, got_z = false;
-+        struct input_absinfo abs_info;
-         int x = 0, y = 0, z = 0;
-+        int r;
-         char text[64];
- 
-         old = get_prev_orientation(dev);
-@@ -201,30 +200,10 @@ static void test_orientation(struct udev *udev,
-         if (fd < 0)
-                 return;
- 
--        while (1) {
--                int i, r;
--
--                r = read(fd, ev, sizeof(struct input_event) * 64);
--
--                if (r < (int) sizeof(struct input_event))
--                        return;
--
--                for (i = 0; i < r / (int) sizeof(struct input_event); i++) {
--                        if (got_syn) {
--                                if (ev[i].type == EV_ABS) {
--                                        SET_AXIS(x, ABS_X);
--                                        SET_AXIS(y, ABS_Y);
--                                        SET_AXIS(z, ABS_Z);
--                                }
--                        }
--                        if (ev[i].type == EV_SYN && ev[i].code == SYN_REPORT)
--                                got_syn = true;
--                        if (got_x && got_y && got_z)
--                                goto read_dev;
--                }
--        }
-+        READ_AXIS(ABS_X, x);
-+        READ_AXIS(ABS_Y, y);
-+        READ_AXIS(ABS_Z, z);
- 
--read_dev:
-         new = orientation_calc(old, x, y, z);
-         snprintf(text, sizeof(text),
-                  "ID_INPUT_ACCELEROMETER_ORIENTATION=%s", orientation_to_string(new));
-diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
-index 5bb6b02..b31ad80 100644
---- a/src/udev/net/link-config.c
-+++ b/src/udev/net/link-config.c
-@@ -184,7 +184,7 @@ failure:
- }
- 
- static bool enable_name_policy(void) {
--        _cleanup_free_ char *line;
-+        _cleanup_free_ char *line = NULL;
-         char *w, *state;
-         int r;
-         size_t l;
-@@ -391,7 +391,9 @@ int link_config_apply(link_config_ctx *ctx, link_config *config, struct udev_dev
-                 case MACPOLICY_PERSISTENT:
-                         if (!mac_is_permanent(device)) {
-                                 r = get_mac(device, false, &generated_mac);
--                                if (r < 0)
-+                                if (r == -ENOENT)
-+                                        break;
-+                                else if (r < 0)
-                                         return r;
-                                 mac = &generated_mac;
-                         }
-@@ -399,7 +401,9 @@ int link_config_apply(link_config_ctx *ctx, link_config *config, struct udev_dev
-                 case MACPOLICY_RANDOM:
-                         if (!mac_is_random(device)) {
-                                 r = get_mac(device, true, &generated_mac);
--                                if (r < 0)
-+                                if (r == -ENOENT)
-+                                        break;
-+                                else if (r < 0)
-                                         return r;
-                                 mac = &generated_mac;
-                         }
-diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
-index 5998be2..5213a4a 100644
---- a/src/udev/udev-event.c
-+++ b/src/udev/udev-event.c
-@@ -771,18 +771,17 @@ static int rename_netif(struct udev_event *event)
-                 log_error("error changing net interface name %s to %s: %s",
-                           oldname, name, strerror(-r));
-         else
--                print_kmsg("renamed network interface %s to %s", oldname, name);
-+                print_kmsg("renamed network interface %s to %s\n", oldname, name);
- 
-         return r;
- }
- 
--int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigmask)
-+void udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigmask)
- {
-         struct udev_device *dev = event->dev;
--        int err = 0;
- 
-         if (udev_device_get_subsystem(dev) == NULL)
--                return -1;
-+                return;
- 
-         if (streq(udev_device_get_action(dev), "remove")) {
-                 udev_device_read_db(dev, NULL);
-@@ -816,9 +815,10 @@ int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules,
-                     event->name != NULL && !streq(event->name, udev_device_get_sysname(dev))) {
-                         char syspath[UTIL_PATH_SIZE];
-                         char *pos;
-+                        int r;
- 
--                        err = rename_netif(event);
--                        if (err == 0) {
-+                        r = rename_netif(event);
-+                        if (r >= 0) {
-                                 log_debug("renamed netif to '%s'", event->name);
- 
-                                 /* remember old name */
-@@ -881,7 +881,6 @@ int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules,
-                 udev_device_unref(event->dev_db);
-                 event->dev_db = NULL;
-         }
--        return err;
- }
- 
- void udev_event_execute_run(struct udev_event *event, const sigset_t *sigmask)
-diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
-index 2630264..17f47f2 100644
---- a/src/udev/udev-rules.c
-+++ b/src/udev/udev-rules.c
-@@ -2555,10 +2555,15 @@ int udev_rules_apply_static_dev_perms(struct udev_rules *rules)
-                         struct stat stats;
- 
-                         /* we assure, that the permissions tokens are sorted before the static token */
-+
-                         if (mode == 0 && uid == 0 && gid == 0 && tags == NULL)
-                                 goto next;
- 
-                         strscpyl(device_node, sizeof(device_node), "/dev/", rules_str(rules, cur->key.value_off), NULL);
-+                        if (stat(device_node, &stats) != 0)
-+                                break;
-+                        if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode))
-+                                break;
- 
-                         /* export the tags to a directory as symlinks, allowing otherwise dead nodes to be tagged */
-                         if (tags) {
-@@ -2588,11 +2593,6 @@ int udev_rules_apply_static_dev_perms(struct udev_rules *rules)
-                         if (mode == 0 && uid == 0 && gid == 0)
-                                 break;
- 
--                        if (stat(device_node, &stats) != 0)
--                                break;
--                        if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode))
--                                break;
--
-                         if (mode == 0) {
-                                 if (gid > 0)
-                                         mode = 0660;
-diff --git a/src/udev/udev.h b/src/udev/udev.h
-index 936adfb..62538bc 100644
---- a/src/udev/udev.h
-+++ b/src/udev/udev.h
-@@ -84,7 +84,7 @@ int udev_event_apply_subsys_kernel(struct udev_event *event, const char *string,
- int udev_event_spawn(struct udev_event *event,
-                      const char *cmd, char **envp, const sigset_t *sigmask,
-                      char *result, size_t ressize);
--int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigset);
-+void udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigset);
- void udev_event_execute_run(struct udev_event *event, const sigset_t *sigset);
- int udev_build_argv(struct udev *udev, char *cmd, int *argc, char *argv[]);
- 
-diff --git a/src/udev/udevadm-test.c b/src/udev/udevadm-test.c
-index 6cd311b..6a2f548 100644
---- a/src/udev/udevadm-test.c
-+++ b/src/udev/udevadm-test.c
-@@ -43,7 +43,6 @@ static int adm_test(struct udev *udev, int argc, char *argv[])
-         _cleanup_udev_device_unref_ struct udev_device *dev = NULL;
-         _cleanup_udev_event_unref_ struct udev_event *event = NULL;
-         sigset_t mask, sigmask_orig;
--        int err;
-         int rc = 0, c;
- 
-         static const struct option options[] = {
-@@ -139,18 +138,16 @@ static int adm_test(struct udev *udev, int argc, char *argv[])
-                 goto out;
-         }
- 
--        err = udev_event_execute_rules(event, rules, &sigmask_orig);
-+        udev_event_execute_rules(event, rules, &sigmask_orig);
- 
-         udev_list_entry_foreach(entry, udev_device_get_properties_list_entry(dev))
-                 printf("%s=%s\n", udev_list_entry_get_name(entry), udev_list_entry_get_value(entry));
- 
--        if (err == 0) {
--                udev_list_entry_foreach(entry, udev_list_get_entry(&event->run_list)) {
--                        char program[UTIL_PATH_SIZE];
-+        udev_list_entry_foreach(entry, udev_list_get_entry(&event->run_list)) {
-+                char program[UTIL_PATH_SIZE];
- 
--                        udev_event_apply_format(event, udev_list_entry_get_name(entry), program, sizeof(program));
--                        printf("run: '%s'\n", program);
--                }
-+                udev_event_apply_format(event, udev_list_entry_get_name(entry), program, sizeof(program));
-+                printf("run: '%s'\n", program);
-         }
- out:
-         if (event != NULL && event->fd_signal >= 0)
-diff --git a/src/udev/udevd.c b/src/udev/udevd.c
-index f21c227..93afca1 100644
---- a/src/udev/udevd.c
-+++ b/src/udev/udevd.c
-@@ -288,10 +288,9 @@ static void worker_new(struct event *event)
-                                 udev_event->exec_delay = exec_delay;
- 
-                         /* apply rules, create node, symlinks */
--                        err = udev_event_execute_rules(udev_event, rules, &sigmask_orig);
-+                        udev_event_execute_rules(udev_event, rules, &sigmask_orig);
- 
--                        if (err == 0)
--                                udev_event_execute_run(udev_event, &sigmask_orig);
-+                        udev_event_execute_run(udev_event, &sigmask_orig);
- 
-                         /* apply/restore inotify watch */
-                         if (err == 0 && udev_event->inotify_watch) {
-diff --git a/src/vconsole/vconsole-setup.c b/src/vconsole/vconsole-setup.c
-index 0f2b706..645b1e6 100644
---- a/src/vconsole/vconsole-setup.c
-+++ b/src/vconsole/vconsole-setup.c
-@@ -180,6 +180,10 @@ static int font_load(const char *vc, const char *font, const char *map, const ch
-  */
- static void font_copy_to_all_vcs(int fd) {
-         struct vt_stat vcs = {};
-+        unsigned char map8[E_TABSZ];
-+        unsigned short map16[E_TABSZ];
-+        struct unimapdesc unimapd;
-+        struct unipair unipairs[USHRT_MAX];
-         int i, r;
- 
-         /* get active, and 16 bit mask of used VT numbers */
-@@ -209,17 +213,35 @@ static void font_copy_to_all_vcs(int fd) {
-                 cfo.op = KD_FONT_OP_COPY;
-                 cfo.height = vcs.v_active-1; /* tty1 == index 0 */
-                 ioctl(vcfd, KDFONTOP, &cfo);
-+
-+                /* copy map of 8bit chars */
-+                if (ioctl(fd, GIO_SCRNMAP, map8) >= 0)
-+                    ioctl(vcfd, PIO_SCRNMAP, map8);
-+
-+                /* copy map of 8bit chars -> 16bit Unicode values */
-+                if (ioctl(fd, GIO_UNISCRNMAP, map16) >= 0)
-+                    ioctl(vcfd, PIO_UNISCRNMAP, map16);
-+
-+                /* copy unicode translation table */
-+                /* unimapd is a ushort count and a pointer to an
-+                   array of struct unipair { ushort, ushort } */
-+                unimapd.entries  = unipairs;
-+                unimapd.entry_ct = USHRT_MAX;
-+                if (ioctl(fd, GIO_UNIMAP, &unimapd) >= 0) {
-+                        struct unimapinit adv = { 0, 0, 0 };
-+
-+                        ioctl(vcfd, PIO_UNIMAPCLR, &adv);
-+                        ioctl(vcfd, PIO_UNIMAP, &unimapd);
-+                }
-         }
- }
- 
- int main(int argc, char **argv) {
-         const char *vc;
--        char *vc_keymap = NULL;
--        char *vc_keymap_toggle = NULL;
--        char *vc_font = NULL;
--        char *vc_font_map = NULL;
--        char *vc_font_unimap = NULL;
--        int fd = -1;
-+        _cleanup_free_ char
-+                *vc_keymap = NULL, *vc_keymap_toggle = NULL,
-+                *vc_font = NULL, *vc_font_map = NULL, *vc_font_unimap = NULL;
-+        _cleanup_close_ int fd = -1;
-         bool utf8;
-         pid_t font_pid = 0, keymap_pid = 0;
-         bool font_copy = false;
-@@ -241,12 +263,12 @@ int main(int argc, char **argv) {
-         fd = open_terminal(vc, O_RDWR|O_CLOEXEC);
-         if (fd < 0) {
-                 log_error("Failed to open %s: %m", vc);
--                goto finish;
-+                return EXIT_FAILURE;
-         }
- 
-         if (!is_vconsole(fd)) {
-                 log_error("Device %s is not a virtual console.", vc);
--                goto finish;
-+                return EXIT_FAILURE;
-         }
- 
-         utf8 = is_locale_utf8();
-@@ -281,27 +303,27 @@ int main(int argc, char **argv) {
-         else
-                 disable_utf8(fd);
- 
--        r = EXIT_FAILURE;
--        if (keymap_load(vc, vc_keymap, vc_keymap_toggle, utf8, &keymap_pid) >= 0 &&
--            font_load(vc, vc_font, vc_font_map, vc_font_unimap, &font_pid) >= 0)
--                r = EXIT_SUCCESS;
--
--finish:
--        if (keymap_pid > 0)
--                wait_for_terminate_and_warn(KBD_LOADKEYS, keymap_pid);
-+        r = font_load(vc, vc_font, vc_font_map, vc_font_unimap, &font_pid);
-+        if (r < 0) {
-+                log_error("Failed to start " KBD_SETFONT ": %s", strerror(-r));
-+                return EXIT_FAILURE;
-+        }
- 
--        if (font_pid > 0) {
-+        if (font_pid > 0)
-                 wait_for_terminate_and_warn(KBD_SETFONT, font_pid);
--                if (font_copy)
--                        font_copy_to_all_vcs(fd);
-+
-+        r = keymap_load(vc, vc_keymap, vc_keymap_toggle, utf8, &keymap_pid);
-+        if (r < 0) {
-+                log_error("Failed to start " KBD_LOADKEYS ": %s", strerror(-r));
-+                return EXIT_FAILURE;
-         }
- 
--        free(vc_keymap);
--        free(vc_font);
--        free(vc_font_map);
--        free(vc_font_unimap);
-+        if (keymap_pid > 0)
-+                wait_for_terminate_and_warn(KBD_LOADKEYS, keymap_pid);
- 
--        safe_close(fd);
-+        /* Only copy the font when we started setfont successfully */
-+        if (font_copy && font_pid > 0)
-+                font_copy_to_all_vcs(fd);
- 
--        return r;
-+        return EXIT_SUCCESS;
- }
-diff --git a/tmpfiles.d/systemd.conf b/tmpfiles.d/systemd.conf
-index 7c6d6b9..c470045 100644
---- a/tmpfiles.d/systemd.conf
-+++ b/tmpfiles.d/systemd.conf
-@@ -23,6 +23,6 @@ d /run/systemd/machines 0755 root root -
- d /run/systemd/shutdown 0755 root root -
- 
- m /var/log/journal 2755 root systemd-journal - -
--m /var/log/journal/%m 2755 root systemd-journal - -
-+Z /var/log/journal/%m 2755 root systemd-journal - -
- m /run/log/journal 2755 root systemd-journal - -
--m /run/log/journal/%m 2755 root systemd-journal - -
-+Z /run/log/journal/%m 2755 root systemd-journal - -
 diff --git a/units/console-getty.service.m4.in b/units/console-getty.service.m4.in
 index 8ac51a4..cae9fb5 100644
 --- a/units/console-getty.service.m4.in
@@ -2654,19 +98,19 @@ index 4f7794b..bad2a9a 100644
  Restart=always
  RestartSec=0
 diff --git a/units/emergency.service.in b/units/emergency.service.in
-index 94c090f..0d20640 100644
+index 18973e7..3a99660 100644
 --- a/units/emergency.service.in
 +++ b/units/emergency.service.in
-@@ -15,7 +15,6 @@ Before=shutdown.target
+@@ -16,7 +16,6 @@ Before=shutdown.target
  [Service]
  Environment=HOME=/root
  WorkingDirectory=/root
 -ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=@SYSTEMCTL@ --fail --no-block default
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" or ^D to\\ntry again to boot into default mode.'
+ ExecStart=-/bin/sh -c "/sbin/sulogin; @SYSTEMCTL@ --fail --no-block default"
+ Type=idle
 diff --git a/units/getty@.service.m4 b/units/getty@.service.m4
-index aa853b8..8bcc647 100644
+index 46164ab..f194a31 100644
 --- a/units/getty@.service.m4
 +++ b/units/getty@.service.m4
 @@ -23,11 +23,12 @@ IgnoreOnIsolate=yes
@@ -2685,23 +129,23 @@ index aa853b8..8bcc647 100644
  Restart=always
  RestartSec=0
 diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index 368f980..d0c1bd2 100644
+index 0934a87..7e30c9e 100644
 --- a/units/kmod-static-nodes.service.in
 +++ b/units/kmod-static-nodes.service.in
 @@ -10,7 +10,6 @@ Description=Create list of required static device nodes for the current kernel
  DefaultDependencies=no
  Before=sysinit.target systemd-tmpfiles-setup-dev.service
- ConditionCapability=CAP_MKNOD
+ ConditionCapability=CAP_SYS_MODULE
 -ConditionPathExists=/lib/modules/%v/modules.devname
  
  [Service]
  Type=oneshot
 diff --git a/units/local-fs.target b/units/local-fs.target
-index ae3cedc..0e36840 100644
+index d2e5429..d26984b 100644
 --- a/units/local-fs.target
 +++ b/units/local-fs.target
-@@ -13,3 +13,5 @@ DefaultDependencies=no
- Conflicts=shutdown.target
+@@ -13,3 +13,5 @@ Conflicts=shutdown.target
+ After=local-fs-pre.target
  OnFailure=emergency.target
  OnFailureJobMode=replace-irreversibly
 +
@@ -2718,47 +162,43 @@ index 43ffa5c..156a681 100644
 +
  [Install]
  WantedBy=multi-user.target
-diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
-index 552ef89..af3915f 100644
---- a/units/rescue.service.m4.in
-+++ b/units/rescue.service.m4.in
+diff --git a/units/rescue.service.in b/units/rescue.service.in
+index fc93f1e..3c87cf8 100644
+--- a/units/rescue.service.in
++++ b/units/rescue.service.in
 @@ -16,7 +16,6 @@ Before=shutdown.target
  [Service]
  Environment=HOME=/root
  WorkingDirectory=/root
 -ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" or ^D to\\nboot into default mode.'
+ ExecStart=-/bin/sh -c "/sbin/sulogin; @SYSTEMCTL@ --fail --no-block default"
+ Type=idle
 diff --git a/units/serial-getty@.service.m4 b/units/serial-getty@.service.m4
-index 4ac51e7..96daa5c 100644
+index 4522d0d..96daa5c 100644
 --- a/units/serial-getty@.service.m4
 +++ b/units/serial-getty@.service.m4
-@@ -22,10 +22,8 @@ Before=getty.target
+@@ -22,7 +22,6 @@ Before=getty.target
  IgnoreOnIsolate=yes
  
  [Service]
 -ExecStart=-/sbin/agetty --keep-baud 115200,38400,9600 %I $TERM
  Type=idle
  Restart=always
--RestartSec=0
  UtmpIdentifier=%I
- TTYPath=/dev/%I
- TTYReset=yes
 diff --git a/units/sysinit.target b/units/sysinit.target
-index 8f4fb8f..e0f0147 100644
+index ec33503..4ac47b9 100644
 --- a/units/sysinit.target
 +++ b/units/sysinit.target
-@@ -9,6 +9,5 @@
+@@ -9,5 +9,4 @@
  Description=System Initialization
  Documentation=man:systemd.special(7)
  Conflicts=emergency.service emergency.target
 -Wants=local-fs.target swap.target
 -After=local-fs.target swap.target emergency.service emergency.target
 +After=emergency.service emergency.target
- RefuseManualStart=yes
 diff --git a/units/systemd-backlight@.service.in b/units/systemd-backlight@.service.in
-index e945d87..77728f2 100644
+index ecf3de4..7e83446 100644
 --- a/units/systemd-backlight@.service.in
 +++ b/units/systemd-backlight@.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2767,7 +207,7 @@ index e945d87..77728f2 100644
  ExecStop=@rootlibexecdir@/systemd-backlight save %i
 +X-RestartIfChanged=false
 diff --git a/units/systemd-journal-flush.service.in b/units/systemd-journal-flush.service.in
-index 503e8a6..fe23b8b 100644
+index 699670b..2612220 100644
 --- a/units/systemd-journal-flush.service.in
 +++ b/units/systemd-journal-flush.service.in
 @@ -10,8 +10,9 @@ Description=Trigger Flushing of Journal to Persistent Storage
@@ -2776,16 +216,16 @@ index 503e8a6..fe23b8b 100644
  Requires=systemd-journald.service
 -After=systemd-journald.service local-fs.target remote-fs.target
 +After=systemd-journald.service
- Before=systemd-user-sessions.service
+ Before=systemd-user-sessions.service systemd-tmpfiles-setup.service
 +RequiresMountsFor=/var/log/journal
  
  [Service]
- ExecStart=@rootbindir@/systemctl kill --kill-who=main --signal=SIGUSR1 systemd-journald.service
+ ExecStart=@rootbindir@/journalctl --flush
 diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
-index de93879..c9a49f3 100644
+index 4de38fa..4b6daea 100644
 --- a/units/systemd-journald.service.in
 +++ b/units/systemd-journald.service.in
-@@ -25,3 +25,8 @@ WatchdogSec=1min
+@@ -26,3 +26,8 @@ WatchdogSec=1min
  # Increase the default a bit in order to allow many simultaneous
  # services being run since we keep one fd open per service.
  LimitNOFILE=16384
@@ -2794,20 +234,8 @@ index de93879..c9a49f3 100644
 +# journald to stop logging (see
 +# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
 +X-RestartIfChanged=no
-diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in
-index ff36e90..e373628 100644
---- a/units/systemd-nspawn@.service.in
-+++ b/units/systemd-nspawn@.service.in
-@@ -11,6 +11,7 @@ Documentation=man:systemd-nspawn(1)
- 
- [Service]
- ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=guest --directory=/var/lib/container/%i
-+KillMode=mixed
- Type=notify
- 
- [Install]
 diff --git a/units/systemd-random-seed.service.in b/units/systemd-random-seed.service.in
-index 1879b2f..9b895b9 100644
+index b55844b..3ef9fc6 100644
 --- a/units/systemd-random-seed.service.in
 +++ b/units/systemd-random-seed.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2816,7 +244,7 @@ index 1879b2f..9b895b9 100644
  ExecStop=@rootlibexecdir@/systemd-random-seed save
 +X-RestartIfChanged=false
 diff --git a/units/systemd-rfkill@.service.in b/units/systemd-rfkill@.service.in
-index 9d264a2..c505535 100644
+index 0e9851b..9f8fa0d 100644
 --- a/units/systemd-rfkill@.service.in
 +++ b/units/systemd-rfkill@.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2825,28 +253,28 @@ index 9d264a2..c505535 100644
  ExecStop=@rootlibexecdir@/systemd-rfkill save %I
 +X-RestartIfChanged=false
 diff --git a/units/systemd-tmpfiles-setup.service.in b/units/systemd-tmpfiles-setup.service.in
-index 01043b7..507f820 100644
+index e895cda..194146f 100644
 --- a/units/systemd-tmpfiles-setup.service.in
 +++ b/units/systemd-tmpfiles-setup.service.in
-@@ -12,7 +12,7 @@ DefaultDependencies=no
- Wants=local-fs.target
+@@ -11,7 +11,7 @@ Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)
+ DefaultDependencies=no
  Conflicts=shutdown.target
- After=systemd-readahead-collect.service systemd-readahead-replay.service local-fs.target
+ After=local-fs.target systemd-sysusers.service
 -Before=sysinit.target shutdown.target
 +Before=shutdown.target
- ConditionDirectoryNotEmpty=|/usr/lib/tmpfiles.d
- ConditionDirectoryNotEmpty=|/lib/tmpfiles.d
- ConditionDirectoryNotEmpty=|/usr/local/lib/tmpfiles.d
+ RefuseManualStop=yes
+ 
+ [Service]
 diff --git a/units/systemd-update-utmp.service.in b/units/systemd-update-utmp.service.in
-index da7dda7..e638145 100644
+index 163eccd..7357c12 100644
 --- a/units/systemd-update-utmp.service.in
 +++ b/units/systemd-update-utmp.service.in
 @@ -11,7 +11,7 @@ Documentation=man:systemd-update-utmp.service(8) man:utmp(5)
  DefaultDependencies=no
  RequiresMountsFor=/var/log/wtmp
  Conflicts=shutdown.target
--After=systemd-readahead-collect.service systemd-readahead-replay.service systemd-remount-fs.service systemd-tmpfiles-setup.service auditd.service
-+After=systemd-readahead-collect.service systemd-readahead-replay.service systemd-remount-fs.service auditd.service
+-After=systemd-remount-fs.service systemd-tmpfiles-setup.service auditd.service
++After=systemd-remount-fs.service auditd.service
  Before=sysinit.target shutdown.target
  
  [Service]
diff --git a/pkgs/servers/http/nginx/default.nix b/pkgs/servers/http/nginx/default.nix
index e5c9b9b9456f..1d2887bcc210 100644
--- a/pkgs/servers/http/nginx/default.nix
+++ b/pkgs/servers/http/nginx/default.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
     ++ optional (elem stdenv.system (with platforms; linux ++ freebsd)) "--with-file-aio";
 
 
-  additionalFlags = optionalString stdenv.isDarwin "-Wno-error=deprecated-declarations";
+  additionalFlags = optionalString stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized";
 
   preConfigure = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${libxml2}/include/libxml2 $additionalFlags"
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 5dd7c0fa75dd..efe35b42b40d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -435,11 +435,11 @@ let
   }) // {inherit bdftopcf mkfontdir ;};
 
   fontsproto = (mkDerivation "fontsproto" {
-    name = "fontsproto-2.1.2";
+    name = "fontsproto-2.1.3";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/X11R7.7/src/everything/fontsproto-2.1.2.tar.bz2;
-      sha256 = "1ab8mbqxdwvdz4k5x4xb9c4n5w7i1xw276cbpk4z7a1nlpjrg746";
+      url = mirror://xorg/individual/proto/fontsproto-2.1.3.tar.bz2;
+      sha256 = "1f2sdsd74y34nnaf4m1zlcbhyv8xb6irnisc99f84c4ivnq4d415";
     };
     buildInputs = [pkgconfig ];
   }) // {inherit ;};
@@ -705,11 +705,11 @@ let
   }) // {inherit fixesproto libX11 xextproto xproto ;};
 
   libXfont = (mkDerivation "libXfont" {
-    name = "libXfont-1.4.8";
+    name = "libXfont-1.5.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/libXfont-1.4.8.tar.bz2;
-      sha256 = "01fh2hnnaby8x6mv57x78nsqwhls70gwykldzd8b43vrpzzd8s2m";
+      url = mirror://xorg/individual/lib/libXfont-1.5.0.tar.bz2;
+      sha256 = "0py2c498lrq6wrj9al6nj57v2ypid9cz0zzhc0hjndgrmp254g1s";
     };
     buildInputs = [pkgconfig libfontenc fontsproto freetype xproto xtrans zlib ];
   }) // {inherit libfontenc fontsproto freetype xproto xtrans zlib ;};
@@ -1185,31 +1185,31 @@ let
   }) // {inherit python ;};
 
   xcbutil = (mkDerivation "xcbutil" {
-    name = "xcb-util-0.3.9";
+    name = "xcb-util-0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = http://xcb.freedesktop.org/dist/xcb-util-0.3.9.tar.bz2;
-      sha256 = "1i0qbhqkcdlbbsj7ifkyjsffl61whj24d3zlg5pxf3xj1af2a4f6";
+      url = http://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2;
+      sha256 = "1sahmrgbpyki4bb72hxym0zvxwnycmswsxiisgqlln9vrdlr9r26";
     };
     buildInputs = [pkgconfig gperf m4 libxcb xproto ];
   }) // {inherit gperf m4 libxcb xproto ;};
 
   xcbutilimage = (mkDerivation "xcbutilimage" {
-    name = "xcb-util-image-0.3.9";
+    name = "xcb-util-image-0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = http://xcb.freedesktop.org/dist/xcb-util-image-0.3.9.tar.bz2;
-      sha256 = "1pr1l1nkg197gyl9d0fpwmn72jqpxjfgn9y13q4gawg1m873qnnk";
+      url = http://xcb.freedesktop.org/dist/xcb-util-image-0.4.0.tar.bz2;
+      sha256 = "1z1gxacg7q4cw6jrd26gvi5y04npsyavblcdad1xccc8swvnmf9d";
     };
     buildInputs = [pkgconfig gperf m4 libxcb xcbutil xproto ];
   }) // {inherit gperf m4 libxcb xcbutil xproto ;};
 
   xcbutilkeysyms = (mkDerivation "xcbutilkeysyms" {
-    name = "xcb-util-keysyms-0.3.9";
+    name = "xcb-util-keysyms-0.4.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = http://xcb.freedesktop.org/dist/xcb-util-keysyms-0.3.9.tar.bz2;
-      sha256 = "0vjwk7vrcfnlhiadv445c6skfxmdrg5v4qf81y8s2s5xagqarqbv";
+      url = http://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2;
+      sha256 = "1nbd45pzc1wm6v5drr5338j4nicbgxa5hcakvsvm5pnyy47lky0f";
     };
     buildInputs = [pkgconfig gperf m4 libxcb xproto ];
   }) // {inherit gperf m4 libxcb xproto ;};
@@ -1415,11 +1415,11 @@ let
   }) // {inherit inputproto xorgserver xproto ;};
 
   xf86inputsynaptics = (mkDerivation "xf86inputsynaptics" {
-    name = "xf86-input-synaptics-1.7.6";
+    name = "xf86-input-synaptics-1.8.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-input-synaptics-1.7.6.tar.bz2;
-      sha256 = "0ls8f7gy92f54hdqsa19vypg0xm496jrgdhdn4qphycxwn3gwkbm";
+      url = mirror://xorg/individual/driver/xf86-input-synaptics-1.8.1.tar.bz2;
+      sha256 = "16phzd7yhl4wns957c35qz2nahmjvnlx05jf975s524qkvrdlkyp";
     };
     buildInputs = [pkgconfig inputproto randrproto recordproto libX11 libXi xorgserver xproto libXtst ];
   }) // {inherit inputproto randrproto recordproto libX11 libXi xorgserver xproto libXtst ;};
@@ -1475,11 +1475,11 @@ let
   }) // {inherit fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ;};
 
   xf86videoati = (mkDerivation "xf86videoati" {
-    name = "xf86-video-ati-7.4.0";
+    name = "xf86-video-ati-7.5.0";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-ati-7.4.0.tar.bz2;
-      sha256 = "1nbnvxlyn75bcf23m39p7yw80kilgdxmjdvzgcs3walshnlhq8wn";
+      url = mirror://xorg/individual/driver/xf86-video-ati-7.5.0.tar.bz2;
+      sha256 = "0dkrw036ikym8aacl43lnf04q0wbms5498xg5b3l16ngnq36ygpc";
     };
     buildInputs = [pkgconfig fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ];
   }) // {inherit fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto videoproto xextproto xf86driproto xorgserver xproto ;};
@@ -1555,14 +1555,14 @@ let
   }) // {inherit fontsproto libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ;};
 
   xf86videointel = (mkDerivation "xf86videointel" {
-    name = "xf86-video-intel-2.21.15";
+    name = "xf86-video-intel-2.99.916";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-intel-2.21.15.tar.bz2;
-      sha256 = "1z6ncmpszmwqi9xr590c4kp4gjjf7mndcr56r35x2bx7h87i8nkx";
+      url = mirror://xorg/individual/driver/xf86-video-intel-2.99.916.tar.bz2;
+      sha256 = "00gd3v3xgrmj8aliwjxkml13gfqvcbjazb6l5m1wkry39agq36j0";
     };
-    buildInputs = [pkgconfig dri2proto fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto libX11 xcbutil libxcb libXext xextproto xf86driproto xorgserver xproto libXrender libXvMC ];
-  }) // {inherit dri2proto fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto libX11 xcbutil libxcb libXext xextproto xf86driproto xorgserver xproto libXrender libXvMC ;};
+    buildInputs = [pkgconfig dri2proto dri3proto fontsproto glamoregl libdrm libpng udev libpciaccess presentproto randrproto renderproto libX11 xcbutil libxcb libXext xextproto xf86driproto libXfixes xorgserver xproto libXrandr libXrender libxshmfence libXvMC ];
+  }) // {inherit dri2proto dri3proto fontsproto glamoregl libdrm libpng udev libpciaccess presentproto randrproto renderproto libX11 xcbutil libxcb libXext xextproto xf86driproto libXfixes xorgserver xproto libXrandr libXrender libxshmfence libXvMC ;};
 
   xf86videomach64 = (mkDerivation "xf86videomach64" {
     name = "xf86-video-mach64-6.9.4";
@@ -1615,11 +1615,11 @@ let
   }) // {inherit fontsproto randrproto renderproto videoproto xorgserver xproto ;};
 
   xf86videonouveau = (mkDerivation "xf86videonouveau" {
-    name = "xf86-video-nouveau-1.0.10";
+    name = "xf86-video-nouveau-1.0.11";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/driver/xf86-video-nouveau-1.0.10.tar.bz2;
-      sha256 = "17fvjplzfx86099sqys0bfl8lfbmjz8li84kzj2x95mf1cbb7fn1";
+      url = mirror://xorg/individual/driver/xf86-video-nouveau-1.0.11.tar.bz2;
+      sha256 = "0j3847rnffy81iaxxi6vnd8saadrc9jahfmckr0sjgkzg2rf4kzq";
     };
     buildInputs = [pkgconfig dri2proto fontsproto libdrm udev libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ];
   }) // {inherit dri2proto fontsproto libdrm udev libpciaccess randrproto renderproto videoproto xextproto xorgserver xproto ;};
@@ -1805,11 +1805,11 @@ let
   }) // {inherit ;};
 
   xfs = (mkDerivation "xfs" {
-    name = "xfs-1.1.3";
+    name = "xfs-1.1.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xfs-1.1.3.tar.bz2;
-      sha256 = "1dwnf5gncpnjsbh9bdrc665kfnclhzzcpwpfnprvrnq4mlr4mx3v";
+      url = mirror://xorg/individual/app/xfs-1.1.4.tar.bz2;
+      sha256 = "1ylz4r7adf567rnlbb52yi9x3qi4pyv954kkhm7ld4f0fkk7a2x4";
     };
     buildInputs = [pkgconfig libXfont xproto xtrans ];
   }) // {inherit libXfont xproto xtrans ;};
@@ -1845,11 +1845,11 @@ let
   }) // {inherit ;};
 
   xinit = (mkDerivation "xinit" {
-    name = "xinit-1.3.3";
+    name = "xinit-1.3.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/app/xinit-1.3.3.tar.bz2;
-      sha256 = "1bq0mqy7y305g2rds1g5443f3d2kgxzafqhmiyabbmg3ws6qgckl";
+      url = mirror://xorg/individual/app/xinit-1.3.4.tar.bz2;
+      sha256 = "1cq2g469mb2cfgr8k57960yrn90bl33vfqri4pdh2zm0jxrqvn3m";
     };
     buildInputs = [pkgconfig libX11 xproto ];
   }) // {inherit libX11 xproto ;};
@@ -1985,14 +1985,14 @@ let
   }) // {inherit ;};
 
   xorgserver = (mkDerivation "xorgserver" {
-    name = "xorg-server-1.14.7";
+    name = "xorg-server-1.16.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/xserver/xorg-server-1.14.7.tar.bz2;
-      sha256 = "07s54g9q1bry1050dsa7x6hy55yjvq9sxs6ks89pc8l6mnk6zxpw";
+      url = mirror://xorg/individual/xserver/xorg-server-1.16.1.tar.bz2;
+      sha256 = "0q706wdbwipyfcvywl7apih3p5mrms3p0wr1hdj5jyzvr5p7qrzl";
     };
-    buildInputs = [pkgconfig renderproto libdrm openssl libX11 libXau libXaw libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt libXv ];
-  }) // {inherit renderproto libdrm openssl libX11 libXau libXaw libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt libXv ;};
+    buildInputs = [pkgconfig renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt ];
+  }) // {inherit renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libxshmfence libXt ;};
 
   xorgsgmldoctools = (mkDerivation "xorgsgmldoctools" {
     name = "xorg-sgml-doctools-1.11";
@@ -2085,11 +2085,11 @@ let
   }) // {inherit libX11 xbitmaps libXcursor libXmu ;};
 
   xtrans = (mkDerivation "xtrans" {
-    name = "xtrans-1.3.4";
+    name = "xtrans-1.3.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = mirror://xorg/individual/lib/xtrans-1.3.4.tar.bz2;
-      sha256 = "0fjq9xa37k1czkidj3c5sads51gibrjvrxz9ag3hh9fmxzilwk85";
+      url = mirror://xorg/individual/lib/xtrans-1.3.5.tar.bz2;
+      sha256 = "00c3ph17acnsch3gbdmx33b9ifjnl5w7vx8hrmic1r1cjcv3pgdd";
     };
     buildInputs = [pkgconfig ];
   }) // {inherit ;};
diff --git a/pkgs/servers/x11/xorg/extra.list b/pkgs/servers/x11/xorg/extra.list
index 84795ed980b3..703c920c98ea 100644
--- a/pkgs/servers/x11/xorg/extra.list
+++ b/pkgs/servers/x11/xorg/extra.list
@@ -1,8 +1,8 @@
 http://xcb.freedesktop.org/dist/libpthread-stubs-0.3.tar.bz2
 http://xcb.freedesktop.org/dist/libxcb-1.11.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-proto-1.11.tar.bz2
-http://xcb.freedesktop.org/dist/xcb-util-0.3.9.tar.bz2
-http://xcb.freedesktop.org/dist/xcb-util-image-0.3.9.tar.bz2
-http://xcb.freedesktop.org/dist/xcb-util-keysyms-0.3.9.tar.bz2
+http://xcb.freedesktop.org/dist/xcb-util-0.4.0.tar.bz2
+http://xcb.freedesktop.org/dist/xcb-util-image-0.4.0.tar.bz2
+http://xcb.freedesktop.org/dist/xcb-util-keysyms-0.4.0.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-renderutil-0.3.9.tar.bz2
 http://xcb.freedesktop.org/dist/xcb-util-wm-0.4.1.tar.bz2
diff --git a/pkgs/servers/x11/xorg/old.list b/pkgs/servers/x11/xorg/old.list
index 19cf79ca796b..2c2d6e0e4c4f 100644
--- a/pkgs/servers/x11/xorg/old.list
+++ b/pkgs/servers/x11/xorg/old.list
@@ -2,8 +2,8 @@ mirror://xorg/individual/app/twm-1.0.8.tar.bz2
 mirror://xorg/individual/app/xclock-1.0.7.tar.bz2
 mirror://xorg/individual/app/xdm-1.1.11.tar.bz2
 mirror://xorg/individual/app/xeyes-1.1.1.tar.bz2
-mirror://xorg/individual/app/xfs-1.1.3.tar.bz2
-mirror://xorg/individual/app/xinit-1.3.3.tar.bz2
+mirror://xorg/individual/app/xfs-1.1.4.tar.bz2
+mirror://xorg/individual/app/xinit-1.3.4.tar.bz2
 mirror://xorg/individual/app/xmessage-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXp-1.0.2.tar.bz2
 mirror://xorg/individual/lib/libXxf86misc-1.0.3.tar.bz2
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 93afa06a7f24..a29d184e48c6 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -69,12 +69,15 @@ in
   };
 
   libX11 = attrs: attrs // {
-    preConfigure = setMalloc0ReturnsNullCrossCompiling;
+    preConfigure = setMalloc0ReturnsNullCrossCompiling + ''
+      sed 's,^as_dummy.*,as_dummy="\$PATH",' -i configure
+    '';
     postInstall =
       ''
         # Remove useless DocBook XML files.
         rm -rf $out/share/doc
       '';
+    CPP = stdenv.lib.optionalString stdenv.isDarwin "clang -E -";
   };
 
   libXfont = attrs: attrs // {
@@ -99,8 +102,11 @@ in
   # Note: most of these are in Requires.private, so maybe builder.sh
   # should propagate them automatically.
   libXt = attrs: attrs // {
-    preConfigure = setMalloc0ReturnsNullCrossCompiling;
+    preConfigure = setMalloc0ReturnsNullCrossCompiling + ''
+      sed 's,^as_dummy.*,as_dummy="\$PATH",' -i configure
+    '';
     propagatedBuildInputs = [ xorg.libSM ];
+    CPP = stdenv.lib.optionalString stdenv.isDarwin "clang -E -";
   };
 
   # See https://bugs.freedesktop.org/show_bug.cgi?id=47792
@@ -178,7 +184,7 @@ in
   };
 
   xf86inputsynaptics = attrs: attrs // {
-    buildInputs = attrs.buildInputs ++ [args.mtdev];
+    buildInputs = attrs.buildInputs ++ [args.mtdev args.libevdev];
     installFlags = "sdkdir=\${out}/include/xorg configdir=\${out}/share/X11/xorg.conf.d";
   };
 
@@ -248,7 +254,7 @@ in
         dmxproto /*libdmx not used*/ xf86vidmodeproto
         recordproto libXext pixman libXfont
         damageproto xcmiscproto  bigreqsproto
-        libpciaccess inputproto xextproto randrproto renderproto
+        libpciaccess inputproto xextproto randrproto renderproto presentproto
         dri2proto kbproto xineramaproto resourceproto scrnsaverproto videoproto
       ];
       commonPatches = [ ./xorgserver-xkbcomp-path.patch ];
diff --git a/pkgs/servers/x11/xorg/tarballs-7.7.list b/pkgs/servers/x11/xorg/tarballs-7.7.list
index 1cc028e60d76..d3a2f1b45f96 100644
--- a/pkgs/servers/x11/xorg/tarballs-7.7.list
+++ b/pkgs/servers/x11/xorg/tarballs-7.7.list
@@ -41,7 +41,7 @@ mirror://xorg/X11R7.7/src/everything/font-mutt-misc-1.0.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-schumacher-misc-1.1.2.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-screen-cyrillic-1.0.4.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-sony-misc-1.0.3.tar.bz2
-mirror://xorg/X11R7.7/src/everything/fontsproto-2.1.2.tar.bz2
+mirror://xorg/X11R7.7/src/everything/fontsproto-2.1.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-sun-misc-1.0.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-util-1.3.0.tar.bz2
 mirror://xorg/X11R7.7/src/everything/font-winitzki-cyrillic-1.0.3.tar.bz2
@@ -68,7 +68,7 @@ mirror://xorg/individual/lib/libXdamage-1.1.4.tar.bz2
 mirror://xorg/X11R7.7/src/everything/libXdmcp-1.1.1.tar.bz2
 mirror://xorg/individual/lib/libXext-1.3.3.tar.bz2
 mirror://xorg/individual/lib/libXfixes-5.0.1.tar.bz2
-mirror://xorg/individual/lib/libXfont-1.4.8.tar.bz2
+mirror://xorg/individual/lib/libXfont-1.5.0.tar.bz2
 mirror://xorg/individual/lib/libXft-2.3.2.tar.bz2
 mirror://xorg/individual/lib/libXi-1.7.4.tar.bz2
 mirror://xorg/individual/lib/libXinerama-1.1.3.tar.bz2
@@ -119,14 +119,14 @@ mirror://xorg/individual/driver/xf86-input-evdev-2.8.4.tar.bz2
 mirror://xorg/individual/driver/xf86-input-joystick-1.6.2.tar.bz2
 mirror://xorg/individual/driver/xf86-input-keyboard-1.8.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-mouse-1.9.1.tar.bz2
-mirror://xorg/individual/driver/xf86-input-synaptics-1.7.6.tar.bz2
+mirror://xorg/individual/driver/xf86-input-synaptics-1.8.1.tar.bz2
 mirror://xorg/individual/driver/xf86-input-vmmouse-13.0.0.tar.bz2
 mirror://xorg/individual/driver/xf86-input-void-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ark-0.7.5.tar.bz2
 mirror://xorg/individual/driver/xf86-video-ast-0.98.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-ati-7.4.0.tar.bz2
+mirror://xorg/individual/driver/xf86-video-ati-7.5.0.tar.bz2
 mirror://xorg/individual/driver/glamor-egl-0.6.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-nouveau-1.0.10.tar.bz2
+mirror://xorg/individual/driver/xf86-video-nouveau-1.0.11.tar.bz2
 mirror://xorg/individual/driver/xf86-video-cirrus-1.5.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-dummy-0.3.7.tar.bz2
 mirror://xorg/individual/driver/xf86-video-fbdev-0.4.4.tar.bz2
@@ -134,7 +134,7 @@ mirror://xorg/individual/driver/xf86-video-geode-2.11.16.tar.bz2
 mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-glint-1.2.8.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i128-1.3.6.tar.bz2
-mirror://xorg/individual/driver/xf86-video-intel-2.21.15.tar.bz2
+mirror://xorg/individual/driver/xf86-video-intel-2.99.916.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mach64-6.9.4.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mga-1.6.3.tar.bz2
 mirror://xorg/individual/driver/xf86-video-modesetting-0.9.0.tar.bz2
@@ -171,7 +171,7 @@ mirror://xorg/X11R7.7/src/everything/xlsatoms-1.1.1.tar.bz2
 mirror://xorg/individual/app/xlsclients-1.1.3.tar.bz2
 mirror://xorg/individual/app/xmodmap-1.0.8.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xorg-docs-1.7.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.14.7.tar.bz2
+mirror://xorg/individual/xserver/xorg-server-1.16.1.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xorg-sgml-doctools-1.11.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xpr-1.0.4.tar.bz2
 mirror://xorg/individual/app/xprop-1.2.2.tar.bz2
@@ -181,7 +181,7 @@ mirror://xorg/individual/app/xrdb-1.1.0.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.5.tar.bz2
 mirror://xorg/individual/app/xset-1.2.3.tar.bz2
 mirror://xorg/X11R7.7/src/everything/xsetroot-1.1.0.tar.bz2
-mirror://xorg/individual/lib/xtrans-1.3.4.tar.bz2
+mirror://xorg/individual/lib/xtrans-1.3.5.tar.bz2
 mirror://xorg/individual/app/xvinfo-1.1.2.tar.bz2
 mirror://xorg/individual/app/xwd-1.0.6.tar.bz2
 mirror://xorg/individual/app/xwininfo-1.1.3.tar.bz2
diff --git a/pkgs/servers/x11/xorg/xf86-video-intel-testing.nix b/pkgs/servers/x11/xorg/xf86-video-intel-testing.nix
deleted file mode 100644
index bee394e99638..000000000000
--- a/pkgs/servers/x11/xorg/xf86-video-intel-testing.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, libdrm, udev, xorg }:
-
-with xorg;
-
-(stdenv.mkDerivation ({
-  name = "xf86-video-intel-2.99.912";
-  builder = ./builder.sh;
-  src = fetchurl {
-    url = mirror://xorg/individual/driver/xf86-video-intel-2.99.912.tar.bz2;
-    sha256 = "00cmvs5jxaqnl1pwqvj1rwir4kbvf5qfng89cjn4rwsr5m4zr3vw";
-  };
-  buildInputs = [pkgconfig dri2proto fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto libX11 xcbutil libxcb libXcursor libXdamage libXext xextproto xf86driproto libXfixes libXinerama xorgserver xproto libXrandr libXrender libXtst libXvMC ];
-})) // {inherit dri2proto fontsproto glamoregl libdrm udev libpciaccess randrproto renderproto libX11 xcbutil libxcb libXcursor libXdamage libXext xextproto xf86driproto libXfixes libXinerama xorgserver xproto libXrandr libXrender libXtst libXvMC ;}
-
diff --git a/pkgs/shells/bash/bash-4.2-patches.nix b/pkgs/shells/bash/bash-4.2-patches.nix
index 0941252ef3ee..8ec6bf738352 100644
--- a/pkgs/shells/bash/bash-4.2-patches.nix
+++ b/pkgs/shells/bash/bash-4.2-patches.nix
@@ -52,4 +52,6 @@ patch: [
 (patch "049" "03jipi8qz5baf1dyhld7yvazkkad7lz5czchrjsrnglzvm6df74h")
 (patch "050" "19lb9nh0x5siwf21xkga3khy5pa3srfrlx97mby4cfz8am2bh68s")
 (patch "051" "0705948wzi27zxphkh5vx4n62i671afyrb4qx276n49sq9xk859y")
+(patch "052" "036wc4azli48ri7641fflxh6j95fnsma2167hbn80v7p91qzm67h")
+(patch "053" "1pnkzx8bj8rz219wk8kxs8iga1k2wn13g1yvg3dci19qakbr7ri0")
 ]
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 09c92b552d48..cf95a5edfadf 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -8,14 +8,14 @@ rec {
 
 
   # Override the compiler in stdenv for specific packages.
-  overrideGCC = stdenv: gcc: stdenv.override { inherit gcc; };
+  overrideGCC = stdenv: gcc: stdenv.override { allowedRequisites = null; inherit gcc; };
 
 
   # Add some arbitrary packages to buildInputs for specific packages.
   # Used to override packages in stdenv like Make.  Should not be used
   # for other dependencies.
   overrideInStdenv = stdenv: pkgs:
-    stdenv.override (prev: { extraBuildInputs = prev.extraBuildInputs or [] ++ pkgs; });
+    stdenv.override (prev: { allowedRequisites = null; extraBuildInputs = prev.extraBuildInputs or [] ++ pkgs; });
 
 
   # Override the setup script of stdenv.  Useful for testing new
@@ -285,18 +285,16 @@ rec {
     };
 
 
-  /* Modify a stdenv so that it uses the Gold linker. FIXME: should
-     use -fuse-ld=gold instead, but then the ld-wrapper won't be
-     invoked. */
-  useGoldLinker = stdenv:
-    let
-      binutils = stdenv.gcc.binutils;
-      binutils' = pkgs.runCommand "${binutils.name}-gold" { }
-        ''
-          mkdir -p $out/bin
-          ln -s ${binutils}/bin/* $out/bin/
-          ln -sfn ${binutils}/bin/ld.gold $out/bin/ld
-        ''; # */
-    in overrideGCC stdenv (stdenv.gcc.override { binutils = binutils'; });
+  /* Modify a stdenv so that it uses the Gold linker. */
+  useGoldLinker = stdenv: stdenv //
+    { mkDerivation = args: stdenv.mkDerivation (args // {
+        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_COMPILE or "") + " -fuse-ld=gold";
+      });
+    };
 
+  dropCxx = drv: drv.override {
+    stdenv = if pkgs.stdenv.isDarwin
+      then pkgs.allStdenvs.stdenvDarwinNaked
+      else pkgs.stdenv;
+  };
 }
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
new file mode 100644
index 000000000000..45d417cdce73
--- /dev/null
+++ b/pkgs/stdenv/darwin/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, pkgs, config
+, haveLibCxx ? true
+, useClang33 ? true }:
+
+import ../generic rec {
+  inherit config;
+
+  preHook =
+    ''
+      export NIX_ENFORCE_PURITY=
+      export NIX_IGNORE_LD_THROUGH_GCC=1
+      export NIX_DONT_SET_RPATH=1
+      export NIX_NO_SELF_RPATH=1
+      ${import ./prehook.nix}
+    '';
+
+  initialPath = (import ../common-path.nix) {pkgs = pkgs;};
+
+  system = stdenv.system;
+
+  gcc = import ../../build-support/gcc-wrapper {
+    nativeTools = false;
+    nativeLibc = true;
+    inherit stdenv;
+    extraPackages = stdenv.lib.optional haveLibCxx pkgs.libcxx;
+    binutils = import ../../build-support/native-darwin-cctools-wrapper {inherit stdenv;};
+    gcc = if useClang33 then pkgs.clang_33.gcc else pkgs.clang.gcc;
+    coreutils = pkgs.coreutils;
+    shell = pkgs.bash + "/bin/sh";
+  };
+
+  shell = pkgs.bash + "/bin/sh";
+
+  fetchurlBoot = stdenv.fetchurlBoot;
+
+  overrides = pkgs_: {
+    inherit gcc;
+    inherit (gcc) binutils;
+    inherit (pkgs)
+      gzip bzip2 xz bash coreutils diffutils findutils gawk
+      gnumake gnused gnutar gnugrep gnupatch perl libcxx libcxxabi;
+  };
+}
diff --git a/pkgs/stdenv/darwin/prehook.nix b/pkgs/stdenv/darwin/prehook.nix
new file mode 100644
index 000000000000..f38cd517f00e
--- /dev/null
+++ b/pkgs/stdenv/darwin/prehook.nix
@@ -0,0 +1,9 @@
+''
+  dontFixLibtool=1
+  stripAllFlags=" " # the Darwin "strip" command doesn't know "-s"
+  xargsFlags=" "
+  export MACOSX_DEPLOYMENT_TARGET=10.9
+  export SDKROOT=$(/usr/bin/xcrun --sdk macosx10.9 --show-sdk-path 2> /dev/null || true)
+  export NIX_CFLAGS_COMPILE+=" --sysroot=/var/empty -idirafter $SDKROOT/usr/include -F$SDKROOT/System/Library/Frameworks -Wno-multichar -Wno-deprecated-declarations"
+  export NIX_LDFLAGS_AFTER+=" -L$SDKROOT/usr/lib"
+''
diff --git a/pkgs/stdenv/default.nix b/pkgs/stdenv/default.nix
index 47d1fb6d9f75..de0042a9adb6 100644
--- a/pkgs/stdenv/default.nix
+++ b/pkgs/stdenv/default.nix
@@ -5,7 +5,7 @@
 # Posix utilities, the GNU C compiler, and so on.  On other systems,
 # we use the native C library.
 
-{ system, allPackages ? import ../.., platform, config }:
+{ system, allPackages ? import ../.., platform, config, lib }:
 
 
 rec {
@@ -28,14 +28,34 @@ rec {
 
   # The Nix build environment.
   stdenvNix = import ./nix {
+    inherit config lib;
+    stdenv = stdenvNative;
+    pkgs = stdenvNativePkgs;
+  };
+
+  stdenvDarwin = import ./darwin {
+    inherit config;
+    stdenv = stdenvNative;
+    pkgs = stdenvNativePkgs;
+  };
+
+  stdenvDarwinNaked = import ./darwin {
+    inherit config;
+    stdenv = stdenvNative;
+    pkgs = stdenvNativePkgs;
+    haveLibCxx = false;
+  };
+
+  stdenvDarwin33 = import ./darwin {
     inherit config;
     stdenv = stdenvNative;
     pkgs = stdenvNativePkgs;
+    useClang33 = true;
   };
 
 
   # Linux standard environment.
-  stdenvLinux = (import ./linux { inherit system allPackages platform config;}).stdenvLinux;
+  stdenvLinux = (import ./linux { inherit system allPackages platform config lib; }).stdenvLinux;
 
 
   # Select the appropriate stdenv for the platform `system'.
@@ -47,7 +67,7 @@ rec {
     if system == "armv7l-linux" then stdenvLinux else
     if system == "mips64el-linux" then stdenvLinux else
     if system == "powerpc-linux" then /* stdenvLinux */ stdenvNative else
-    if system == "x86_64-darwin" then stdenvNix else
+    if system == "x86_64-darwin" then stdenvDarwin else
     if system == "x86_64-solaris" then stdenvNix else
     stdenvNative;
 }
diff --git a/pkgs/stdenv/generic/builder.sh b/pkgs/stdenv/generic/builder.sh
index 60360e7b8256..a46c46c2db50 100644
--- a/pkgs/stdenv/generic/builder.sh
+++ b/pkgs/stdenv/generic/builder.sh
@@ -6,16 +6,12 @@ done
 
 mkdir $out
 
-echo "$preHook" > $out/setup
+echo "export SHELL=$shell" > $out/setup
+echo "initialPath=\"$initialPath\"" >> $out/setup
+echo "defaultNativeBuildInputs=\"$defaultNativeBuildInputs\"" >> $out/setup
+echo "$preHook" >> $out/setup
 cat "$setup" >> $out/setup
 
-sed -e "s^@initialPath@^$initialPath^g" \
-    -e "s^@gcc@^$gcc^g" \
-    -e "s^@shell@^$shell^g" \
-    -e "s^@needsPax@^$needsPax^g" \
-    < $out/setup > $out/setup.tmp
-mv $out/setup.tmp $out/setup
-
 # Allow the user to install stdenv using nix-env and get the packages
 # in stdenv.
 mkdir $out/nix-support
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 8b269ffb5252..f41515154c65 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -1,7 +1,7 @@
 let lib = import ../../../lib; in lib.makeOverridable (
 
 { system, name ? "stdenv", preHook ? "", initialPath, gcc, shell
-, extraAttrs ? {}, overrides ? (pkgs: {}), config
+, allowedRequisites ? null, extraAttrs ? {}, overrides ? (pkgs: {}), config
 
 , # The `fetchurl' to use for downloading curl and its dependencies
   # (see all-packages.nix).
@@ -10,8 +10,6 @@ let lib = import ../../../lib; in lib.makeOverridable (
 , setupScript ? ./setup.sh
 
 , extraBuildInputs ? []
-
-, skipPaxMarking ? false
 }:
 
 let
@@ -23,7 +21,7 @@ let
   # {pkgs, ...}:
   # {
   #   allowUnfree = false;
-  #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "flashplayero-" x.name);
+  #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "flashplayer-" x.name);
   # }
   allowUnfreePredicate = config.allowUnfreePredicate or (x: false);
 
@@ -36,111 +34,108 @@ let
         { nixpkgs.config.allow${unfreeOrBroken} = true; }
       in configuration.nix to override this. If you use Nix standalone, you can add
         { allow${unfreeOrBroken} = true; }
-      to ~/.nixpkgs/config.nix.
-    '';
+      to ~/.nixpkgs/config.nix.'';
 
   unsafeGetAttrPos = builtins.unsafeGetAttrPos or (n: as: null);
 
   isUnfree = licenses: lib.lists.any (l:
     !l.free or true || l == "unfree" || l == "unfree-redistributable") licenses;
 
+  defaultNativeBuildInputs = extraBuildInputs ++
+    [ ../../build-support/setup-hooks/move-docs.sh
+      ../../build-support/setup-hooks/compress-man-pages.sh
+      ../../build-support/setup-hooks/strip.sh
+      ../../build-support/setup-hooks/patch-shebangs.sh
+      ../../build-support/setup-hooks/move-sbin.sh
+      ../../build-support/setup-hooks/move-lib64.sh
+      gcc
+    ];
+
+  # Add a utility function to produce derivations that use this
+  # stdenv and its shell.
+  mkDerivation = attrs:
+    let
+      pos =
+        if attrs.meta.description or null != null then
+          unsafeGetAttrPos "description" attrs.meta
+        else
+          unsafeGetAttrPos "name" attrs;
+      pos' = if pos != null then "‘" + pos.file + ":" + toString pos.line + "’" else "«unknown-file»";
+    in
+    if !allowUnfree && isUnfree (lib.lists.toList attrs.meta.license or []) && !allowUnfreePredicate attrs then
+      throw ''
+        Package ‘${attrs.name}’ in ${pos'} has an unfree license, refusing to evaluate.
+        ${forceEvalHelp "Unfree"}''
+    else if !allowBroken && attrs.meta.broken or false then
+      throw ''
+        Package ‘${attrs.name}’ in ${pos'} is marked as broken, refusing to evaluate.
+        ${forceEvalHelp "Broken"}''
+    else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then
+      throw ''
+        Package ‘${attrs.name}’ in ${pos'} is not supported on ‘${result.system}’, refusing to evaluate.
+        ${forceEvalHelp "Broken"}''
+    else
+      lib.addPassthru (derivation (
+        (removeAttrs attrs ["meta" "passthru" "crossAttrs"])
+        // (let
+          buildInputs = attrs.buildInputs or [];
+          nativeBuildInputs = attrs.nativeBuildInputs or [];
+          propagatedBuildInputs = attrs.propagatedBuildInputs or [];
+          propagatedNativeBuildInputs = attrs.propagatedNativeBuildInputs or [];
+          crossConfig = attrs.crossConfig or null;
+        in
+        {
+          builder = attrs.realBuilder or shell;
+          args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
+          stdenv = result;
+          system = result.system;
+          userHook = config.stdenv.userHook or null;
+          __ignoreNulls = true;
+
+          # Inputs built by the cross compiler.
+          buildInputs = if crossConfig != null then buildInputs else [];
+          propagatedBuildInputs = if crossConfig != null then propagatedBuildInputs else [];
+          # Inputs built by the usual native compiler.
+          nativeBuildInputs = nativeBuildInputs ++ (if crossConfig == null then buildInputs else []);
+          propagatedNativeBuildInputs = propagatedNativeBuildInputs ++
+            (if crossConfig == null then propagatedBuildInputs else []);
+        }))) (
+      {
+        # The meta attribute is passed in the resulting attribute set,
+        # but it's not part of the actual derivation, i.e., it's not
+        # passed to the builder and is not a dependency.  But since we
+        # include it in the result, it *is* available to nix-env for
+        # queries.  We also a meta.position attribute here to
+        # identify the source location of the package.
+        meta = attrs.meta or {} // (if pos != null then {
+          position = pos.file + ":" + (toString pos.line);
+        } else {});
+        passthru = attrs.passthru or {};
+      } //
+      # Pass through extra attributes that are not inputs, but
+      # should be made available to Nix expressions using the
+      # derivation (e.g., in assertions).
+      (attrs.passthru or {}));
+
   # The stdenv that we are producing.
   result =
-
-    derivation {
+    derivation (
+    (if isNull allowedRequisites then {} else { allowedRequisites = allowedRequisites ++ defaultNativeBuildInputs; }) //
+    {
       inherit system name;
 
       builder = shell;
 
       args = ["-e" ./builder.sh];
-      /* TODO: special-cased @var@ substitutions are ugly.
-          However, using substituteAll* from setup.sh seems difficult,
-          as setup.sh can't be directly sourced.
-          Suggestion: split similar utility functions into a separate script.
-      */
 
       setup = setupScript;
 
-      inherit preHook initialPath gcc shell;
-
-      # Whether we should run paxctl to pax-mark binaries
-      needsPax = result.isLinux && !skipPaxMarking;
-
-      propagatedUserEnvPkgs = [gcc] ++
-        lib.filter lib.isDerivation initialPath;
-    }
+      inherit preHook initialPath shell defaultNativeBuildInputs;
+    })
 
     // rec {
 
-      meta = {
-        description = "The default build environment for Unix packages in Nixpkgs";
-      };
-
-      # Add a utility function to produce derivations that use this
-      # stdenv and its shell.
-      mkDerivation = attrs:
-        let
-          pos =
-            if attrs.meta.description or null != null then
-              unsafeGetAttrPos "description" attrs.meta
-            else
-              unsafeGetAttrPos "name" attrs;
-          pos' = if pos != null then "‘" + pos.file + ":" + toString pos.line + "’" else "«unknown-file»";
-        in
-        if !allowUnfree && isUnfree (lib.lists.toList attrs.meta.license or []) && !allowUnfreePredicate attrs then
-          throw ''
-            Package ‘${attrs.name}’ in ${pos'} has an unfree license, refusing to evaluate.
-            ${forceEvalHelp "Unfree"}''
-        else if !allowBroken && attrs.meta.broken or false then
-          throw ''
-            Package ‘${attrs.name}’ in ${pos'} is marked as broken, refusing to evaluate.
-            ${forceEvalHelp "Broken"}''
-        else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then
-          throw ''
-            Package ‘${attrs.name}’ in ${pos'} is not supported on ‘${result.system}’, refusing to evaluate.
-            ${forceEvalHelp "Broken"}''
-        else
-          lib.addPassthru (derivation (
-            (removeAttrs attrs ["meta" "passthru" "crossAttrs"])
-            // (let
-              buildInputs = attrs.buildInputs or [];
-              nativeBuildInputs = attrs.nativeBuildInputs or [];
-              propagatedBuildInputs = attrs.propagatedBuildInputs or [];
-              propagatedNativeBuildInputs = attrs.propagatedNativeBuildInputs or [];
-              crossConfig = attrs.crossConfig or null;
-            in
-            {
-              builder = attrs.realBuilder or shell;
-              args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
-              stdenv = result;
-              system = result.system;
-              userHook = config.stdenv.userHook or null;
-              __ignoreNulls = true;
-
-              # Inputs built by the cross compiler.
-              buildInputs = if crossConfig != null then buildInputs ++ extraBuildInputs else [];
-              propagatedBuildInputs = if crossConfig != null then propagatedBuildInputs else [];
-              # Inputs built by the usual native compiler.
-              nativeBuildInputs = nativeBuildInputs ++ (if crossConfig == null then buildInputs ++ extraBuildInputs else []);
-              propagatedNativeBuildInputs = propagatedNativeBuildInputs ++
-                (if crossConfig == null then propagatedBuildInputs else []);
-          }))) (
-          {
-            # The meta attribute is passed in the resulting attribute set,
-            # but it's not part of the actual derivation, i.e., it's not
-            # passed to the builder and is not a dependency.  But since we
-            # include it in the result, it *is* available to nix-env for
-            # queries.  We also a meta.position attribute here to
-            # identify the source location of the package.
-            meta = attrs.meta or {} // (if pos != null then {
-              position = pos.file + ":" + (toString pos.line);
-            } else {});
-            passthru = attrs.passthru or {};
-          } //
-          # Pass through extra attributes that are not inputs, but
-          # should be made available to Nix expressions using the
-          # derivation (e.g., in assertions).
-          (attrs.passthru or {}));
+      meta.description = "The default build environment for Unix packages in Nixpkgs";
 
       # Utility flags to test the type of platform.
       isDarwin = system == "x86_64-darwin";
@@ -166,7 +161,8 @@ let
       isBSD = system == "i686-freebsd"
            || system == "x86_64-freebsd"
            || system == "i686-openbsd"
-           || system == "x86_64-openbsd";
+           || system == "x86_64-openbsd"
+           || system == "x86_64-darwin";
       isi686 = system == "i686-linux"
             || system == "i686-gnu"
             || system == "i686-freebsd"
@@ -189,6 +185,11 @@ let
            || system == "armv7l-linux";
       isBigEndian = system == "powerpc-linux";
 
+      # Whether we should run paxctl to pax-mark binaries.
+      needsPax = isLinux;
+
+      inherit mkDerivation;
+
       # For convenience, bring in the library functions in lib/ so
       # packages don't have to do that themselves.
       inherit lib;
@@ -196,6 +197,8 @@ let
       inherit fetchurlBoot;
 
       inherit overrides;
+
+      inherit gcc;
     }
 
     # Propagate any extra attributes.  For instance, we use this to
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index c3b9033b49a6..904cc13e06c7 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1,18 +1,80 @@
-# Run the named hook, either by calling the function with that name or
-# by evaluating the variable with that name.  This allows convenient
-# setting of hooks both from Nix expressions (as attributes /
-# environment variables) and from shell scripts (as functions).
+set -e
+set -o pipefail
+
+: ${outputs:=out}
+
+
+######################################################################
+# Hook handling.
+
+
+# Run all hooks with the specified name in the order in which they
+# were added, stopping if any fails (returns a non-zero exit
+# code). The hooks for <hookName> are the shell function or variable
+# <hookName>, and the values of the shell array ‘<hookName>Hooks’.
 runHook() {
     local hookName="$1"
+    shift
+    local var="$hookName"
+    if [[ "$hookName" =~ Hook$ ]]; then var+=s; else var+=Hooks; fi
+    eval "local -a dummy=(\"\${$var[@]}\")"
+    for hook in "_callImplicitHook 0 $hookName" "${dummy[@]}"; do
+        if ! _eval "$hook" "$@"; then return 1; fi
+    done
+    return 0
+}
+
+
+# Run all hooks with the specified name, until one succeeds (returns a
+# zero exit code). If none succeed, return a non-zero exit code.
+runOneHook() {
+    local hookName="$1"
+    shift
+    local var="$hookName"
+    if [[ "$hookName" =~ Hook$ ]]; then var+=s; else var+=Hooks; fi
+    eval "local -a dummy=(\"\${$var[@]}\")"
+    for hook in "_callImplicitHook 1 $hookName" "${dummy[@]}"; do
+        if _eval "$hook" "$@"; then
+            return 0
+        fi
+    done
+    return 1
+}
+
+
+# Run the named hook, either by calling the function with that name or
+# by evaluating the variable with that name. This allows convenient
+# setting of hooks both from Nix expressions (as attributes /
+# environment variables) and from shell scripts (as functions). If you
+# want to allow multiple hooks, use runHook instead.
+_callImplicitHook() {
+    local def="$1"
+    local hookName="$2"
     case "$(type -t $hookName)" in
         (function|alias|builtin) $hookName;;
         (file) source $hookName;;
         (keyword) :;;
-        (*) eval "${!hookName}";;
+        (*) if [ -z "${!hookName}" ]; then return "$def"; else eval "${!hookName}"; fi;;
     esac
 }
 
 
+# A function wrapper around ‘eval’ that ensures that ‘return’ inside
+# hooks exits the hook, not the caller.
+_eval() {
+    local code="$1"
+    shift
+    if [ "$(type -t $code)" = function ]; then
+        eval "$code \"\$@\""
+    else
+        eval "$code"
+    fi
+}
+
+
+######################################################################
+# Error handling.
+
 exitHandler() {
     exitCode=$?
     set +e
@@ -40,7 +102,7 @@ exitHandler() {
         if [ -n "$succeedOnFailure" ]; then
             echo "build failed with exit code $exitCode (ignored)"
             mkdir -p "$out/nix-support"
-            echo -n $exitCode > "$out/nix-support/failed"
+            printf "%s" $exitCode > "$out/nix-support/failed"
             exit 0
         fi
 
@@ -55,7 +117,7 @@ trap "exitHandler" EXIT
 
 
 ######################################################################
-# Helper functions that might be useful in setup hooks.
+# Helper functions.
 
 
 addToSearchPathWithCustomDelimiter() {
@@ -74,12 +136,23 @@ addToSearchPath() {
 }
 
 
-######################################################################
-# Initialisation.
+ensureDir() {
+    echo "warning: ‘ensureDir’ is deprecated; use ‘mkdir’ instead" >&2
+    local dir
+    for dir in "$@"; do
+        if ! [ -x "$dir" ]; then mkdir -p "$dir"; fi
+    done
+}
 
-set -e
 
-[ -z $NIX_GCC ] && NIX_GCC=@gcc@
+installBin() {
+    mkdir -p $out/bin
+    cp "$@" $out/bin
+}
+
+
+######################################################################
+# Initialisation.
 
 
 # Wildcard expansions that don't match should expand to an empty list.
@@ -90,7 +163,7 @@ shopt -s nullglob
 
 # Set up the initial path.
 PATH=
-for i in $NIX_GCC @initialPath@; do
+for i in $initialPath; do
     if [ "$i" = / ]; then i=; fi
     addToSearchPath PATH $i/bin
     addToSearchPath PATH $i/sbin
@@ -101,37 +174,14 @@ if [ "$NIX_DEBUG" = 1 ]; then
 fi
 
 
-# Execute the pre-hook.
-export SHELL=@shell@
-export CONFIG_SHELL="$SHELL"
-if [ -z "$shell" ]; then export shell=@shell@; fi
-runHook preHook
-
-
 # Check that the pre-hook initialised SHELL.
 if [ -z "$SHELL" ]; then echo "SHELL not set"; exit 1; fi
 
-# Hack: run gcc's setup hook.
-envHooks=()
-crossEnvHooks=()
-if [ -f $NIX_GCC/nix-support/setup-hook ]; then
-    source $NIX_GCC/nix-support/setup-hook
-fi
-
 
-# Ensure that the given directories exists.
-ensureDir() {
-    echo "warning: ‘ensureDir’ is deprecated; use ‘mkdir’ instead" >&2
-    local dir
-    for dir in "$@"; do
-        if ! [ -x "$dir" ]; then mkdir -p "$dir"; fi
-    done
-}
-
-installBin() {
-    mkdir -p $out/bin
-    cp "$@" $out/bin
-}
+# Execute the pre-hook.
+export CONFIG_SHELL="$SHELL"
+if [ -z "$shell" ]; then export shell=$SHELL; fi
+runHook preHook
 
 
 # Allow the caller to augment buildInputs (it's not always possible to
@@ -154,6 +204,10 @@ findInputs() {
 
     eval $var="'${!var} $pkg '"
 
+    if [ -f $pkg ]; then
+        source $pkg
+    fi
+
     if [ -f $pkg/nix-support/setup-hook ]; then
         source $pkg/nix-support/setup-hook
     fi
@@ -166,19 +220,19 @@ findInputs() {
 }
 
 crossPkgs=""
-for i in $buildInputs $propagatedBuildInputs; do
+for i in $buildInputs $defaultBuildInputs $propagatedBuildInputs; do
     findInputs $i crossPkgs propagated-build-inputs
 done
 
 nativePkgs=""
-for i in $nativeBuildInputs $propagatedNativeBuildInputs; do
+for i in $nativeBuildInputs $defaultNativeBuildInputs $propagatedNativeBuildInputs; do
     findInputs $i nativePkgs propagated-native-build-inputs
 done
 
 
 # Set the relevant environment variables to point to the build inputs
 # found above.
-addToNativeEnv() {
+_addToNativeEnv() {
     local pkg=$1
 
     if [ -d $1/bin ]; then
@@ -186,16 +240,14 @@ addToNativeEnv() {
     fi
 
     # Run the package-specific hooks set by the setup-hook scripts.
-    for i in "${envHooks[@]}"; do
-        $i $pkg
-    done
+    runHook envHook "$pkg"
 }
 
 for i in $nativePkgs; do
-    addToNativeEnv $i
+    _addToNativeEnv $i
 done
 
-addToCrossEnv() {
+_addToCrossEnv() {
     local pkg=$1
 
     # Some programs put important build scripts (freetype-config and similar)
@@ -206,13 +258,11 @@ addToCrossEnv() {
     fi
 
     # Run the package-specific hooks set by the setup-hook scripts.
-    for i in "${crossEnvHooks[@]}"; do
-        $i $pkg
-    done
+    runHook crossEnvHook "$pkg"
 }
 
 for i in $crossPkgs; do
-    addToCrossEnv $i
+    _addToCrossEnv $i
 done
 
 
@@ -273,41 +323,10 @@ fi
 export NIX_BUILD_CORES
 
 
-######################################################################
-# Misc. helper functions.
-
-
-stripDirs() {
-    local dirs="$1"
-    local stripFlags="$2"
-    local dirsNew=
-
-    for d in ${dirs}; do
-        if [ -d "$prefix/$d" ]; then
-            dirsNew="${dirsNew} $prefix/$d "
-        fi
-    done
-    dirs=${dirsNew}
-
-    if [ -n "${dirs}" ]; then
-        header "stripping (with flags $stripFlags) in $dirs"
-        find $dirs -type f -print0 | xargs -0 ${xargsFlags:--r} strip $commonStripFlags $stripFlags || true
-        stopNest
-    fi
-}
-
-# PaX-mark binaries
-paxmark() {
-    local flags="$1"
-    shift
-
-    if [ -z "@needsPax@" ]; then
-        return
-    fi
+# Dummy implementation of the paxmark function. On Linux, this is
+# overwritten by paxctl's setup hook.
+paxmark() { true; }
 
-    paxctl -c "$@"
-    paxctl -zex -${flags} "$@"
-}
 
 ######################################################################
 # Textual substitution functions.
@@ -322,7 +341,7 @@ substitute() {
     local n p pattern replacement varName content
 
     # a slightly hacky way to keep newline at the end
-    content="$(cat $input; echo -n X)"
+    content="$(cat "$input"; printf "%s" X)"
     content="${content%X}"
 
     for ((n = 2; n < ${#params[*]}; n += 1)); do
@@ -350,8 +369,7 @@ substitute() {
         content="${content//"$pattern"/$replacement}"
     done
 
-    # !!! This doesn't work properly if $content is "-n".
-    echo -n "$content" > "$output".tmp
+    printf "%s" "$content" > "$output".tmp
     if [ -x "$output" ]; then chmod +x "$output".tmp; fi
     mv -f "$output".tmp "$output"
 }
@@ -439,39 +457,45 @@ stripHash() {
 }
 
 
-unpackFile() {
-    curSrc="$1"
-    local cmd
+unpackCmdHooks+=(_defaultUnpack)
+_defaultUnpack() {
+    local fn="$1"
 
-    header "unpacking source archive $curSrc" 3
+    if [ -d "$fn" ]; then
 
-    case "$curSrc" in
-        *.tar.xz | *.tar.lzma)
-            # Don't rely on tar knowing about .xz.
-            xz -d < $curSrc | tar xf -
-            ;;
-        *.tar | *.tar.* | *.tgz | *.tbz2)
-            # GNU tar can automatically select the decompression method
-            # (info "(tar) gzip").
-            tar xf $curSrc
-            ;;
-        *.zip)
-            unzip -qq $curSrc
-            ;;
-        *)
-            if [ -d "$curSrc" ]; then
-                stripHash $curSrc
-                cp -prd --no-preserve=timestamps $curSrc $strippedName
-            else
-                if [ -z "$unpackCmd" ]; then
-                    echo "source archive $curSrc has unknown type"
-                    exit 1
-                fi
-                runHook unpackCmd
-            fi
-            ;;
-    esac
+        stripHash "$fn"
+        # We can't preserve hardlinks because they may have been introduced by
+        # store optimization, which might break things in the build
+        cp -pr --reflink=auto --no-preserve=timestamps "$fn" $strippedName
+
+    else
+
+        case "$fn" in
+            *.tar.xz | *.tar.lzma)
+                # Don't rely on tar knowing about .xz.
+                xz -d < "$fn" | tar xf -
+                ;;
+            *.tar | *.tar.* | *.tgz | *.tbz2)
+                # GNU tar can automatically select the decompression method
+                # (info "(tar) gzip").
+                tar xf "$fn"
+                ;;
+            *)
+                return 1
+                ;;
+        esac
 
+    fi
+}
+
+
+unpackFile() {
+    curSrc="$1"
+    header "unpacking source archive $curSrc" 3
+    if ! runOneHook unpackCmd "$curSrc"; then
+        echo "do not know how to unpack source archive $curSrc"
+        exit 1
+    fi
     stopNest
 }
 
@@ -505,7 +529,7 @@ unpackPhase() {
 
     # Find the source directory.
     if [ -n "$setSourceRoot" ]; then
-        runHook setSourceRoot
+        runOneHook setSourceRoot
     elif [ -z "$sourceRoot" ]; then
         sourceRoot=
         for i in *; do
@@ -549,7 +573,7 @@ patchPhase() {
     for i in $patches; do
         header "applying patch $i" 3
         local uncompress=cat
-        case $i in
+        case "$i" in
             *.gz)
                 uncompress="gzip -d"
                 ;;
@@ -564,7 +588,7 @@ patchPhase() {
                 ;;
         esac
         # "2>&1" is a hack to make patch fail if the decompressor fails (nonexistent patch, etc.)
-        $uncompress < $i 2>&1 | patch ${patchFlags:--p1}
+        $uncompress < "$i" 2>&1 | patch ${patchFlags:--p1}
         stopNest
     done
 
@@ -654,80 +678,6 @@ checkPhase() {
 }
 
 
-patchELF() {
-    # Patch all ELF executables and shared libraries.
-    header "patching ELF executables and libraries"
-    if [ -e "$prefix" ]; then
-        find "$prefix" \( \
-            \( -type f -a -name "*.so*" \) -o \
-            \( -type f -a -perm +0100 \) \
-            \) -print -exec patchelf --shrink-rpath '{}' \;
-    fi
-    stopNest
-}
-
-
-patchShebangs() {
-    # Rewrite all script interpreter file names (`#! /path') under the
-    # specified  directory tree to paths found in $PATH.  E.g.,
-    # /bin/sh will be rewritten to /nix/store/<hash>-some-bash/bin/sh.
-    # /usr/bin/env gets special treatment so that ".../bin/env python" is
-    # rewritten to /nix/store/<hash>/bin/python.
-    # Interpreters that are already in the store are left untouched.
-    header "patching script interpreter paths"
-    local dir="$1"
-    local f
-    local oldPath
-    local newPath
-    local arg0
-    local args
-    local oldInterpreterLine
-    local newInterpreterLine
-
-    find "$dir" -type f -perm +0100 | while read f; do
-        if [ "$(head -1 "$f" | head -c +2)" != '#!' ]; then
-            # missing shebang => not a script
-            continue
-        fi
-
-        oldInterpreterLine=$(head -1 "$f" | tail -c +3)
-        read -r oldPath arg0 args <<< "$oldInterpreterLine"
-
-        if $(echo "$oldPath" | grep -q "/bin/env$"); then
-            # Check for unsupported 'env' functionality:
-            # - options: something starting with a '-'
-            # - environment variables: foo=bar
-            if $(echo "$arg0" | grep -q -- "^-.*\|.*=.*"); then
-                echo "unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)"
-                exit 1
-            fi
-            newPath="$(command -v "$arg0" || true)"
-        else
-            if [ "$oldPath" = "" ]; then
-                # If no interpreter is specified linux will use /bin/sh. Set
-                # oldpath="/bin/sh" so that we get /nix/store/.../sh.
-                oldPath="/bin/sh"
-            fi
-            newPath="$(command -v "$(basename "$oldPath")" || true)"
-            args="$arg0 $args"
-        fi
-
-        newInterpreterLine="$newPath $args"
-
-        if [ -n "$oldPath" -a "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then
-            if [ -n "$newPath" -a "$newPath" != "$oldPath" ]; then
-                echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
-                # escape the escape chars so that sed doesn't interpret them
-                escapedInterpreterLine=$(echo "$newInterpreterLine" | sed 's|\\|\\\\|g')
-                sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
-            fi
-        fi
-    done
-
-    stopNest
-}
-
-
 installPhase() {
     runHook preInstall
 
@@ -743,74 +693,22 @@ installPhase() {
 }
 
 
-# The fixup phase performs generic, package-independent, Nix-related
-# stuff, like running patchelf and setting the
-# propagated-build-inputs.  It should rarely be overriden.
+# The fixup phase performs generic, package-independent stuff, like
+# stripping binaries, running patchelf and setting
+# propagated-build-inputs.
 fixupPhase() {
-    runHook preFixup
-
     # Make sure everything is writable so "strip" et al. work.
-    if [ -e "$prefix" ]; then chmod -R u+w "$prefix"; fi
-
-    # Put man/doc/info under $out/share.
-    forceShare=${forceShare:=man doc info}
-    if [ -n "$forceShare" ]; then
-        for d in $forceShare; do
-            if [ -d "$prefix/$d" ]; then
-                if [ -d "$prefix/share/$d" ]; then
-                    echo "both $d/ and share/$d/ exists!"
-                else
-                    echo "fixing location of $d/ subdirectory"
-                    mkdir -p $prefix/share
-                    if [ -w $prefix/share ]; then
-                        mv -v $prefix/$d $prefix/share
-                        ln -sv share/$d $prefix
-                    fi
-                fi
-            fi
-        done;
-    fi
-
-    if [ -z "$dontGzipMan" ]; then
-        echo "gzipping man pages"
-        GLOBIGNORE=.:..:*.gz:*.bz2
-        for f in "$out"/share/man/*/* "$out"/share/man/*/*/*; do
-            if [ -f "$f" -a ! -L "$f" ]; then
-                if gzip -c -n "$f" > "$f".gz; then
-                    rm "$f"
-                else
-                    rm "$f".gz
-                fi
-            fi
-        done
-        for f in "$out"/share/man/*/* "$out"/share/man/*/*/*; do
-            if [ -L "$f" -a -f `readlink -f "$f"`.gz ]; then
-                ln -sf `readlink "$f"`.gz "$f".gz && rm "$f"
-            fi
-        done
-        unset GLOBIGNORE
-    fi
-
-    # TODO: strip _only_ ELF executables, and return || fail here...
-    if [ -z "$dontStrip" ]; then
-        stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}
-        if [ -n "$stripDebugList" ]; then
-            stripDirs "$stripDebugList" "${stripDebugFlags:--S}"
-        fi
-
-        stripAllList=${stripAllList:-}
-        if [ -n "$stripAllList" ]; then
-            stripDirs "$stripAllList" "${stripAllFlags:--s}"
-        fi
-    fi
+    for output in $outputs; do
+        if [ -e "${!output}" ]; then chmod -R u+w "${!output}"; fi
+    done
 
-    if [ "$havePatchELF" = 1 -a -z "$dontPatchELF" ]; then
-        patchELF "$prefix"
-    fi
+    runHook preFixup
 
-    if [ -z "$dontPatchShebangs" ]; then
-        patchShebangs "$prefix"
-    fi
+    # Apply fixup to each output.
+    local output
+    for output in $outputs; do
+        prefix=${!output} runHook fixupOutput
+    done
 
     if [ -n "$propagatedBuildInputs" ]; then
         mkdir -p "$out/nix-support"
@@ -935,7 +833,6 @@ genericBuild() {
 
 
 # Execute the post-hooks.
-for i in "${postHooks[@]}"; do $i; done
 runHook postHook
 
 
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 6f8b42c2266a..76849c2c61ab 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -7,12 +7,10 @@
 # The function defaults are for easy testing.
 { system ? builtins.currentSystem
 , allPackages ? import ../../top-level/all-packages.nix
-, platform ? null, config ? {} }:
+, platform ? null, config ? {}, lib ? (import ../../../lib) }:
 
 rec {
 
-  lib = import ../../../lib;
-
   bootstrapFiles =
     if system == "i686-linux" then import ./bootstrap/i686.nix
     else if system == "x86_64-linux" then import ./bootstrap/x86_64.nix
@@ -26,7 +24,6 @@ rec {
   commonPreHook =
     ''
       export NIX_ENFORCE_PURITY=1
-      havePatchELF=1
       ${if system == "x86_64-linux" then "NIX_LIB64_IN_SELF_RPATH=1" else ""}
       ${if system == "mips64el-linux" then "NIX_LIB32_IN_SELF_RPATH=1" else ""}
     '';
@@ -66,28 +63,16 @@ rec {
   };
 
 
-  # A helper function to call gcc-wrapper.
-  wrapGCC =
-    { gcc, libc, binutils, coreutils, name }:
-
-    lib.makeOverridable (import ../../build-support/gcc-wrapper) {
-      nativeTools = false;
-      nativeLibc = false;
-      inherit gcc binutils coreutils libc name;
-      stdenv = stage0.stdenv;
-    };
-
-
   # This function builds the various standard environments used during
   # the bootstrap.  In all stages, we build an stdenv and the package
   # set that can be built with that stdenv.
   stageFun =
-    {gcc, extraAttrs ? {}, overrides ? (pkgs: {}), extraPath ? []}:
+    {gccPlain, glibc, binutils, coreutils, name, overrides ? (pkgs: {}), extraBuildInputs ? []}:
 
     let
 
       thisStdenv = import ../generic {
-        inherit system config;
+        inherit system config extraBuildInputs;
         name = "stdenv-linux-boot";
         preHook =
           ''
@@ -97,15 +82,33 @@ rec {
             ${commonPreHook}
           '';
         shell = "${bootstrapTools}/bin/sh";
-        initialPath = [bootstrapTools] ++ extraPath;
+        initialPath = [bootstrapTools];
         fetchurlBoot = import ../../build-support/fetchurl {
           stdenv = stage0.stdenv;
           curl = bootstrapTools;
         };
-        inherit gcc;
-        # Having the proper 'platform' in all the stdenvs allows getting proper
-        # linuxHeaders for example.
-        extraAttrs = extraAttrs // { inherit platform; };
+
+        gcc = if isNull gccPlain
+              then "/no-such-path"
+              else lib.makeOverridable (import ../../build-support/gcc-wrapper) {
+          nativeTools = false;
+          nativeLibc = false;
+          gcc = gccPlain;
+          libc = glibc;
+          inherit binutils coreutils;
+          name = name;
+          stdenv = stage0.stdenv;
+        };
+
+        extraAttrs = {
+          # Having the proper 'platform' in all the stdenvs allows getting proper
+          # linuxHeaders for example.
+          inherit platform;
+
+          # stdenv.glibc is used by GCC build to figure out the system-level
+          # /usr/include directory.
+          inherit glibc;
+        };
         overrides = pkgs: (overrides pkgs) // { fetchurl = thisStdenv.fetchurlBoot; };
       };
 
@@ -120,7 +123,11 @@ rec {
   # Build a dummy stdenv with no GCC or working fetchurl.  This is
   # because we need a stdenv to build the GCC wrapper and fetchurl.
   stage0 = stageFun {
-    gcc = "/no-such-path";
+    gccPlain = null;
+    glibc = null;
+    binutils = null;
+    coreutils = null;
+    name = null;
 
     overrides = pkgs: {
       # The Glibc include directory cannot have the same prefix as the
@@ -151,17 +158,23 @@ rec {
   # simply re-export those packages in the middle stage(s) using the
   # overrides attribute and the inherit syntax.
   stage1 = stageFun {
-    gcc = wrapGCC {
-      gcc = bootstrapTools;
-      libc = stage0.pkgs.glibc;
-      binutils = bootstrapTools;
-      coreutils = bootstrapTools;
-      name = "bootstrap-gcc-wrapper";
-    };
+    gccPlain = bootstrapTools;
+    inherit (stage0.pkgs) glibc;
+    binutils = bootstrapTools;
+    coreutils = bootstrapTools;
+    name = "bootstrap-gcc-wrapper";
+
     # Rebuild binutils to use from stage2 onwards.
     overrides = pkgs: {
       binutils = pkgs.binutils.override { gold = false; };
       inherit (stage0.pkgs) glibc;
+
+      # A threaded perl build needs glibc/libpthread_nonshared.a,
+      # which is not included in bootstrapTools, so disable threading.
+      # This is not an issue for the final stdenv, because this perl
+      # won't be included in the final stdenv and won't be exported to
+      # top-level pkgs as an override either.
+      perl = pkgs.perl.override { enableThreading = false; };
     };
   };
 
@@ -169,13 +182,12 @@ rec {
   # 2nd stdenv that contains our own rebuilt binutils and is used for
   # compiling our own Glibc.
   stage2 = stageFun {
-    gcc = wrapGCC {
-      gcc = bootstrapTools;
-      libc = stage1.pkgs.glibc;
-      binutils = stage1.pkgs.binutils;
-      coreutils = bootstrapTools;
-      name = "bootstrap-gcc-wrapper";
-    };
+    gccPlain = bootstrapTools;
+    inherit (stage1.pkgs) glibc;
+    binutils = stage1.pkgs.binutils;
+    coreutils = bootstrapTools;
+    name = "bootstrap-gcc-wrapper";
+
     overrides = pkgs: {
       inherit (stage1.pkgs) perl binutils paxctl;
       # This also contains the full, dynamically linked, final Glibc.
@@ -187,15 +199,13 @@ rec {
   # one uses the rebuilt Glibc from stage2.  It still uses the recent
   # binutils and rest of the bootstrap tools, including GCC.
   stage3 = stageFun {
-    gcc = wrapGCC {
-      gcc = bootstrapTools;
-      libc = stage2.pkgs.glibc;
-      binutils = stage2.pkgs.binutils;
-      coreutils = bootstrapTools;
-      name = "bootstrap-gcc-wrapper";
-    };
+    gccPlain = bootstrapTools;
+    inherit (stage2.pkgs) glibc binutils;
+    coreutils = bootstrapTools;
+    name = "bootstrap-gcc-wrapper";
+
     overrides = pkgs: {
-      inherit (stage2.pkgs) binutils glibc perl;
+      inherit (stage2.pkgs) binutils glibc perl patchelf linuxHeaders;
       # Link GCC statically against GMP etc.  This makes sense because
       # these builds of the libraries are only used by GCC, so it
       # reduces the size of the stdenv closure.
@@ -204,33 +214,38 @@ rec {
       mpc = pkgs.mpc.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
       isl = pkgs.isl.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
       cloog = pkgs.cloog.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
-      ppl = pkgs.ppl.override { stdenv = pkgs.makeStaticLibraries pkgs.stdenv; };
-    };
-    extraAttrs = {
-      glibc = stage2.pkgs.glibc;  # Required by gcc47 build
+      gccPlain = pkgs.gcc.gcc;
     };
-    extraPath = [ stage2.pkgs.paxctl ];
+    extraBuildInputs = [ stage2.pkgs.patchelf stage2.pkgs.paxctl ];
   };
 
 
   # Construct a fourth stdenv that uses the new GCC.  But coreutils is
   # still from the bootstrap tools.
   stage4 = stageFun {
-    gcc = wrapGCC {
-      gcc = stage3.pkgs.gcc.gcc;
-      libc = stage3.pkgs.glibc;
-      binutils = stage3.pkgs.binutils;
-      coreutils = bootstrapTools;
-      name = "";
-    };
-    extraPath = [ stage3.pkgs.xz ];
+    inherit (stage3.pkgs) gccPlain glibc binutils;
+    coreutils = bootstrapTools;
+    name = "";
+
     overrides = pkgs: {
       # Zlib has to be inherited and not rebuilt in this stage,
       # because gcc (since JAR support) already depends on zlib, and
       # then if we already have a zlib we want to use that for the
       # other purposes (binutils and top-level pkgs) too.
-      inherit (stage3.pkgs) gettext gnum4 gmp perl glibc zlib;
+      inherit (stage3.pkgs) gettext gnum4 gmp perl glibc zlib linuxHeaders;
+
+      gcc = lib.makeOverridable (import ../../build-support/gcc-wrapper) {
+        nativeTools = false;
+        nativeLibc = false;
+        gcc = stage4.stdenv.gcc.gcc;
+        libc = stage4.pkgs.glibc;
+        inherit (stage4.pkgs) binutils coreutils;
+        name = "";
+        stdenv = stage4.stdenv;
+        shell = stage4.pkgs.bash + "/bin/bash";
+      };
     };
+    extraBuildInputs = [ stage3.pkgs.patchelf stage3.pkgs.xz ];
   };
 
 
@@ -253,17 +268,13 @@ rec {
       '';
 
     initialPath =
-      ((import ../common-path.nix) {pkgs = stage4.pkgs;})
-      ++ [stage4.pkgs.patchelf stage4.pkgs.paxctl ];
+      ((import ../common-path.nix) {pkgs = stage4.pkgs;});
+
+    extraBuildInputs = [ stage4.pkgs.patchelf stage4.pkgs.paxctl ];
 
-    shell = stage4.pkgs.bash + "/bin/bash";
+    gcc = stage4.pkgs.gcc;
 
-    gcc = (wrapGCC rec {
-      gcc = stage4.stdenv.gcc.gcc;
-      libc = stage4.pkgs.glibc;
-      inherit (stage4.pkgs) binutils coreutils;
-      name = "";
-    }).override { inherit shell; };
+    shell = gcc.shell;
 
     inherit (stage4.stdenv) fetchurlBoot;
 
@@ -273,12 +284,18 @@ rec {
       shellPackage = stage4.pkgs.bash;
     };
 
+    allowedRequisites = with stage4.pkgs;
+      [ gzip bzip2 xz bash binutils coreutils diffutils findutils gawk
+        glibc gnumake gnused gnutar gnugrep gnupatch patchelf attr acl
+        paxctl zlib pcre linuxHeaders ed gcc gcc.gcc libsigsegv
+      ];
+
     overrides = pkgs: {
       inherit gcc;
       inherit (stage4.pkgs)
         gzip bzip2 xz bash binutils coreutils diffutils findutils gawk
         glibc gnumake gnused gnutar gnugrep gnupatch patchelf
-        attr acl paxctl zlib;
+        attr acl paxctl zlib pcre;
     };
   };
 
diff --git a/pkgs/stdenv/native/default.nix b/pkgs/stdenv/native/default.nix
index 715bc02758bc..213f844365e1 100644
--- a/pkgs/stdenv/native/default.nix
+++ b/pkgs/stdenv/native/default.nix
@@ -22,9 +22,7 @@ rec {
     ${prehookBase}
     export NIX_DONT_SET_RPATH=1
     export NIX_NO_SELF_RPATH=1
-    dontFixLibtool=1
-    stripAllFlags=" " # the Darwin "strip" command doesn't know "-s"
-    xargsFlags=" "
+    ${import ../darwin/prehook.nix}
   '';
 
   prehookFreeBSD = ''
@@ -35,9 +33,6 @@ rec {
     alias sed=gsed
     export MAKE=gmake
     shopt -s expand_aliases
-
-    # Filter out stupid GCC warnings (in gcc-wrapper).
-    export NIX_GCC_NEEDS_GREP=1
   '';
 
   prehookOpenBSD = ''
@@ -52,9 +47,6 @@ rec {
 
     export MAKE=gmake
     shopt -s expand_aliases
-
-    # Filter out stupid GCC warnings (in gcc-wrapper).
-    export NIX_GCC_NEEDS_GREP=1
   '';
 
   prehookNetBSD = ''
@@ -65,9 +57,6 @@ rec {
     alias tar=gtar
     export MAKE=gmake
     shopt -s expand_aliases
-
-    # Filter out stupid GCC warnings (in gcc-wrapper).
-    export NIX_GCC_NEEDS_GREP=1
   '';
 
   prehookCygwin = ''
diff --git a/pkgs/stdenv/nix/default.nix b/pkgs/stdenv/nix/default.nix
index a496a819a6df..476e0eae3970 100644
--- a/pkgs/stdenv/nix/default.nix
+++ b/pkgs/stdenv/nix/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, pkgs, config }:
+{ stdenv, pkgs, config, lib }:
 
 import ../generic rec {
   inherit config;
@@ -7,18 +7,7 @@ import ../generic rec {
     ''
       export NIX_ENFORCE_PURITY=1
       export NIX_IGNORE_LD_THROUGH_GCC=1
-    '' + (if stdenv.isDarwin then ''
-      export NIX_ENFORCE_PURITY=
-      export NIX_DONT_SET_RPATH=1
-      export NIX_NO_SELF_RPATH=1
-      dontFixLibtool=1
-      stripAllFlags=" " # the Darwin "strip" command doesn't know "-s"
-      xargsFlags=" "
-      export MACOSX_DEPLOYMENT_TARGET=10.6
-      export SDKROOT=$(/usr/bin/xcrun --show-sdk-path 2> /dev/null || true)
-      export NIX_CFLAGS_COMPILE+=" --sysroot=/var/empty -idirafter $SDKROOT/usr/include -F$SDKROOT/System/Library/Frameworks -Wno-multichar -Wno-deprecated-declarations"
-      export NIX_LDFLAGS_AFTER+=" -L$SDKROOT/usr/lib"
-    '' else "");
+    '';
 
   initialPath = (import ../common-path.nix) {pkgs = pkgs;};
 
@@ -29,11 +18,7 @@ import ../generic rec {
     nativePrefix = stdenv.lib.optionalString stdenv.isSunOS "/usr";
     nativeLibc = true;
     inherit stdenv;
-    binutils =
-      if stdenv.isDarwin then
-        import ../../build-support/native-darwin-cctools-wrapper {inherit stdenv;}
-      else
-        pkgs.binutils;
+    binutils = pkgs.binutils;
     gcc = pkgs.gcc.gcc;
     coreutils = pkgs.coreutils;
     shell = pkgs.bash + "/bin/sh";
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index f19564e4ad91..281a148a5ca4 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext }:
+{ stdenv, fetchurl, gettext, coreutils }:
 
 stdenv.mkDerivation rec {
   name = "sharutils-4.11.1";
@@ -12,11 +12,11 @@ stdenv.mkDerivation rec {
     ''
        # Fix for building on Glibc 2.16.  Won't be needed once the
        # gnulib in sharutils is updated.
-       sed -i '/gets is a security hole/d' lib/stdio.in.h
+       sed -i ${stdenv.lib.optionalString (stdenv.isBSD && stdenv.gcc.nativeTools) "''"} '/gets is a security hole/d' lib/stdio.in.h
     '';
 
   # GNU Gettext is needed on non-GNU platforms.
-  buildInputs = [ gettext ];
+  buildInputs = [ gettext coreutils ];
 
   doCheck = true;
 
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index f19a2f0c5d35..0466b817f1b6 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, bzip2
 , enableNLS ? false, libnatspec }:
 
-stdenv.mkDerivation ({
+stdenv.mkDerivation {
   name = "unzip-6.0";
 
   src = fetchurl {
@@ -9,6 +9,13 @@ stdenv.mkDerivation ({
     sha256 = "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83";
   };
 
+  patches = stdenv.lib.optional enableNLS
+    (fetchurl {
+      url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";
+      name = "unzip-6.0-natspec.patch";
+      sha256 = "67ab260ae6adf8e7c5eda2d1d7846929b43562943ec4aff629bd7018954058b1";
+    });
+
   nativeBuildInputs = [ bzip2 ];
   buildInputs = [ bzip2 ] ++ stdenv.lib.optional enableNLS libnatspec;
 
@@ -24,19 +31,12 @@ stdenv.mkDerivation ({
 
   installFlags = "prefix=$(out)";
 
+  setupHook = ./setup-hook.sh;
+
   meta = {
     homepage = http://www.info-zip.org;
     description = "An extraction utility for archives compressed in .zip format";
     license = stdenv.lib.licenses.free; # http://www.info-zip.org/license.html
     platforms = stdenv.lib.platforms.all;
   };
-} // (if enableNLS then {
-  patches =
-    [ ( fetchurl {
-        url =
-        "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";
-        name = "unzip-6.0-natspec.patch";
-        sha256 = "67ab260ae6adf8e7c5eda2d1d7846929b43562943ec4aff629bd7018954058b1";
-      })
-    ];
-} else {}))
+}
diff --git a/pkgs/tools/archivers/unzip/setup-hook.sh b/pkgs/tools/archivers/unzip/setup-hook.sh
new file mode 100644
index 000000000000..4055d2fab512
--- /dev/null
+++ b/pkgs/tools/archivers/unzip/setup-hook.sh
@@ -0,0 +1,5 @@
+unpackCmdHooks+=(_tryUnzip)
+_tryUnzip() {
+    if ! [[ "$curSrc" =~ \.zip$ ]]; then return 1; fi
+    unzip -qq "$curSrc"
+}
diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index 55fca6ca3cb9..256f574c2e0c 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation {
   sharedLibrary =
     !stdenv.isDarwin && !(stdenv ? isDietLibC) && !(stdenv ? isStatic) && stdenv.system != "i686-cygwin" && !linkStatic;
 
+  patchPhase = stdenv.lib.optionalString stdenv.isDarwin "substituteInPlace Makefile --replace 'CC=gcc' 'CC=clang'";
+
   preConfigure = "substituteInPlace Makefile --replace '$(PREFIX)/man' '$(PREFIX)/share/man'";
 
   makeFlags = if linkStatic then "LDFLAGS=-static" else "";
diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/tools/compression/xz/default.nix
index e1d7c26fa430..70c3f260e3c8 100644
--- a/pkgs/tools/compression/xz/default.nix
+++ b/pkgs/tools/compression/xz/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "xz-5.0.5";
+  name = "xz-5.0.7";
 
   src = fetchurl {
     url = "http://tukaani.org/xz/${name}.tar.bz2";
-    sha256 = "1404i59bp6rzxya0br1q9njdv32z4sggyfrkjr7vq695hk94hv0n";
+    sha256 = "05nnxl19a49h15lxzpn3fd76izrycnr7qaf9qvd408yz973iv1g8";
   };
 
   doCheck = true;
 
   # In stdenv-linux, prevent a dependency on bootstrap-tools.
-  preHook = "unset CONFIG_SHELL";
+  preConfigure = "unset CONFIG_SHELL";
 
   meta = {
     homepage = http://tukaani.org/xz/;
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index 850e16812488..61afe6ffb90c 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, db, libgcrypt, avahi, libiconv, pam, openssl }:
+{ fetchurl, stdenv, pkgconfig, db, libgcrypt, avahi, libiconvOrEmpty, pam, openssl }:
 
 stdenv.mkDerivation rec {
   name = "netatalk-3.1.0";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1d8dc8ysslkis4yl1xab1w9p0pz7a1kg0i6fds4wxsp4fhb6wqhq";
   };
 
-  buildInputs = [ pkgconfig db libgcrypt avahi libiconv pam openssl ];
+  buildInputs = [ pkgconfig db libgcrypt avahi pam openssl ] ++ libiconvOrEmpty;
 
   configureFlags = [
     "--with-bdb=${db}"
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 8844fe9c57cc..5be34ad5f310 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -10,16 +10,14 @@ assert selinuxSupport -> libselinux != null && libsepol != null;
 with { inherit (stdenv.lib) optional optionals optionalString optionalAttrs; };
 
 let
-  self = stdenv.mkDerivation (rec {
-    name = "coreutils-8.21";
+  self = stdenv.mkDerivation rec {
+    name = "coreutils-8.23";
 
     src = fetchurl {
       url = "mirror://gnu/coreutils/${name}.tar.xz";
-      sha256 = "064f512185iysqqcvhnhaf3bfmzrvcgs7n405qsyp99zmfyl9amd";
+      sha256 = "0bdq6yggyl7nkc2pbl6pxhhyx15nyqhz3ds6rfn448n6rxdwlhzc";
     };
 
-    patches = [ ./help2man.patch ];
-
     nativeBuildInputs = [ perl ];
     buildInputs = [ gmp ]
       ++ optional aclSupport acl
@@ -64,6 +62,8 @@ let
 
     NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
 
+    makeFlags = optionalString stdenv.isDarwin "CFLAGS=-D_FORTIFY_SOURCE=0";
+
     meta = {
       homepage = http://www.gnu.org/software/coreutils/;
       description = "The basic file, shell and text manipulation utilities of the GNU operating system";
@@ -77,11 +77,9 @@ let
 
       license = stdenv.lib.licenses.gpl3Plus;
 
-      maintainers = [ ];
+      maintainers = [ stdenv.lib.maintainers.eelco ];
     };
-  } // optionalAttrs stdenv.isDarwin {
-    makeFlags = "CFLAGS=-D_FORTIFY_SOURCE=0";
-  });
+  };
 in
   self
   // stdenv.lib.optionalAttrs (stdenv.system == "armv7l-linux" || stdenv.isSunOS) {
diff --git a/pkgs/tools/misc/coreutils/gets-undeclared.patch b/pkgs/tools/misc/coreutils/gets-undeclared.patch
deleted file mode 100644
index b6cdc77caa84..000000000000
--- a/pkgs/tools/misc/coreutils/gets-undeclared.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-This patch is needed to allow builds with newer versions of
-the GNU libc (2.16+).
-
-
-commit 66712c23388e93e5c518ebc8515140fa0c807348
-Author: Eric Blake <eblake@redhat.com>
-Date:   Thu Mar 29 13:30:41 2012 -0600
-
-    stdio: don't assume gets any more
-    
-    Gnulib intentionally does not have a gets module, and now that C11
-    and glibc have dropped it, we should be more proactive about warning
-    any user on a platform that still has a declaration of this dangerous
-    interface.
-    
-    * m4/stdio_h.m4 (gl_STDIO_H, gl_STDIO_H_DEFAULTS): Drop gets
-    support.
-    * modules/stdio (Makefile.am): Likewise.
-    * lib/stdio-read.c (gets): Likewise.
-    * tests/test-stdio-c++.cc: Likewise.
-    * m4/warn-on-use.m4 (gl_WARN_ON_USE_PREPARE): Fix comment.
-    * lib/stdio.in.h (gets): Make warning occur in more places.
-    * doc/posix-functions/gets.texi (gets): Update documentation.
-    Reported by Christer Solskogen.
-    
-    Signed-off-by: Eric Blake <eblake@redhat.com>
-
-diff --git a/lib/stdio.in.h b/lib/stdio.in.h
-index aa7b599..c377b6e 100644
---- a/lib/stdio.in.h
-+++ b/lib/stdio.in.h
-@@ -698,22 +698,11 @@ _GL_WARN_ON_USE (getline, "getline is unportable - "
- # endif
- #endif
- 
--#if @GNULIB_GETS@
--# if @REPLACE_STDIO_READ_FUNCS@ && @GNULIB_STDIO_H_NONBLOCKING@
--#  if !(defined __cplusplus && defined GNULIB_NAMESPACE)
--#   undef gets
--#   define gets rpl_gets
--#  endif
--_GL_FUNCDECL_RPL (gets, char *, (char *s) _GL_ARG_NONNULL ((1)));
--_GL_CXXALIAS_RPL (gets, char *, (char *s));
--# else
--_GL_CXXALIAS_SYS (gets, char *, (char *s));
--#  undef gets
--# endif
--_GL_CXXALIASWARN (gets);
- /* It is very rare that the developer ever has full control of stdin,
--   so any use of gets warrants an unconditional warning.  Assume it is
--   always declared, since it is required by C89.  */
-+   so any use of gets warrants an unconditional warning; besides, C11
-+   removed it.  */
-+#undef gets
-+#if HAVE_RAW_DECL_GETS
- _GL_WARN_ON_USE (gets, "gets is a security hole - use fgets instead");
- #endif
- 
-@@ -1053,9 +1042,9 @@ _GL_WARN_ON_USE (snprintf, "snprintf is unportable - "
- # endif
- #endif
- 
--/* Some people would argue that sprintf should be handled like gets
--   (for example, OpenBSD issues a link warning for both functions),
--   since both can cause security holes due to buffer overruns.
-+/* Some people would argue that all sprintf uses should be warned about
-+   (for example, OpenBSD issues a link warning for it),
-+   since it can cause security holes due to buffer overruns.
-    However, we believe that sprintf can be used safely, and is more
-    efficient than snprintf in those safe cases; and as proof of our
-    belief, we use sprintf in several gnulib modules.  So this header
diff --git a/pkgs/tools/misc/coreutils/help2man.patch b/pkgs/tools/misc/coreutils/help2man.patch
deleted file mode 100644
index 9f3cbaa40ff1..000000000000
--- a/pkgs/tools/misc/coreutils/help2man.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-Although the above man pages depend on src/md5sum.c as a shared
-source, the build of the man pages directly requires their own
-executables to exist.
-
-* man/local.mk (man/sha1sum.1): Change the dependency from
-'src/md5sum' to 'src/sha1sum'.
-(man/sha224sum.1): s/md5sum/sha224sum/
-(man/sha256sum.1): s/md5sum/sha256sum/
-(man/sha384sum.1): s/md5sum/sha384sum/
-(man/sha512sum.1): s/md5sum/sha512sum/
-
-Reported by Pádraig Brady in
-http://lists.gnu.org/archive/html/coreutils/2013-11/msg00006.html
----
- man/local.mk | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/man/local.mk b/man/local.mk
-index 266b780..45dbcb9 100644
---- a/man/local.mk
-+++ b/man/local.mk
-@@ -131,11 +131,11 @@ man/rm.1:        src/rm
- man/rmdir.1:     src/rmdir
- man/runcon.1:    src/runcon
- man/seq.1:       src/seq
--man/sha1sum.1:   src/md5sum
--man/sha224sum.1: src/md5sum
--man/sha256sum.1: src/md5sum
--man/sha384sum.1: src/md5sum
--man/sha512sum.1: src/md5sum
-+man/sha1sum.1:   src/sha1sum
-+man/sha224sum.1: src/sha224sum
-+man/sha256sum.1: src/sha256sum
-+man/sha384sum.1: src/sha384sum
-+man/sha512sum.1: src/sha512sum
- man/shred.1:     src/shred
- man/shuf.1:      src/shuf
- man/sleep.1:     src/sleep
--- 
-1.8.3.1
diff --git a/pkgs/tools/misc/getopt/default.nix b/pkgs/tools/misc/getopt/default.nix
index d181388f6c7b..ed4cde69eda7 100644
--- a/pkgs/tools/misc/getopt/default.nix
+++ b/pkgs/tools/misc/getopt/default.nix
@@ -7,4 +7,7 @@ stdenv.mkDerivation {
     url = http://tarballs.nixos.org/getopt-1.1.4.tar.gz;
     sha256 = "1arvjfzw6p310zbgv629w5hkyslrj44imf3r3s2r4ry2jfcks221";
   };
+  preBuild = ''
+    export buildFlags=CC="$CC" # for darwin
+  '';
 }
diff --git a/pkgs/tools/misc/mdbtools/git.nix b/pkgs/tools/misc/mdbtools/git.nix
index b97af331093b..11b5520c7bb2 100644
--- a/pkgs/tools/misc/mdbtools/git.nix
+++ b/pkgs/tools/misc/mdbtools/git.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchgit, glib, readline, bison, flex, pkgconfig,
-  libiconv, autoconf, automake, libtool, which, txt2man, gnome_doc_utils,
+  libiconvOrEmpty, autoconf, automake, libtool, which, txt2man, gnome_doc_utils,
   scrollkeeper}:
 
 stdenv.mkDerivation {
@@ -12,8 +12,10 @@ stdenv.mkDerivation {
     name = "mdbtools-git-export";
   };
 
-  buildInputs = [glib readline bison flex pkgconfig libiconv autoconf automake
-    libtool which txt2man gnome_doc_utils scrollkeeper ];
+  buildInputs = [
+    glib readline bison flex pkgconfig autoconf automake
+    libtool which txt2man gnome_doc_utils scrollkeeper
+  ] ++ libiconvOrEmpty;
 
   preConfigure = ''
     sed -e 's@static \(GHashTable [*]mdb_backends;\)@\1@' -i src/libmdb/backend.c
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index e12db01ae726..85b935ebd767 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -13,11 +13,11 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.38.0";
+  name = "curl-7.39.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "1flybwbdahx0sm9ipgp9k60wlrpkrmfflk1zf5j4w6mak4gd8nq3";
+    sha256 = "1q545q853i2dadz6kiybq6613bk0ncs6dp81nc0rgkc7f1p5c8mj";
   };
 
   # Zlib and OpenSSL must be propagated because `libcurl.la' contains
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 2d3ffb2cb0a8..021f470af241 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -16,6 +16,6 @@ stdenv.mkDerivation rec {
     license = [ "GPLv2+" ];
 
     maintainers = with stdenv.lib.maintainers; [ the-kenny viric ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index fe698b6e3be2..490e690e1205 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -21,6 +21,6 @@ stdenv.mkDerivation rec {
     description = "OpenSource IPsec-based VPN Solution";
     homepage = https://www.strongswan.org;
     license = stdenv.lib.licenses.gpl2Plus;
-    inherit (stdenv.gcc.clang.meta) platforms;
+    inherit (stdenv.gcc.gcc.meta) platforms;
   };
 }
diff --git a/pkgs/tools/package-management/checkinstall/default.nix b/pkgs/tools/package-management/checkinstall/default.nix
index 1320720ed170..dc3373c3b6fc 100644
--- a/pkgs/tools/package-management/checkinstall/default.nix
+++ b/pkgs/tools/package-management/checkinstall/default.nix
@@ -32,6 +32,9 @@ stdenv.mkDerivation {
 
     # Fix a `conflicting types for 'readlink'' error since Glibc 2.19
     ./readlink-types.patch
+
+    # Fix BuildRoot handling in RPM builds.
+    ./set-buildroot.patch
   ]
 
   ++ stdenv.lib.optional (stdenv.system == "x86_64-linux") 
diff --git a/pkgs/tools/package-management/checkinstall/set-buildroot.patch b/pkgs/tools/package-management/checkinstall/set-buildroot.patch
new file mode 100644
index 000000000000..58840f491ecf
--- /dev/null
+++ b/pkgs/tools/package-management/checkinstall/set-buildroot.patch
@@ -0,0 +1,15 @@
+https://build.opensuse.org/package/view_file/openSUSE:13.1/checkinstall/checkinstall-set_buildroot.patch
+
+Index: checkinstall
+===================================================================
+--- a/checkinstall	2009-12-26 20:17:24.000000000 +0100
++++ b/checkinstall	2011-01-31 18:17:56.171593541 +0100
+@@ -2463,7 +2463,7 @@ cd "$DIRECTORIO_FUENTE"
+ 
+ echo
+ echogn "Building RPM package..."
+-$RPMBUILD -bb ${RPM_TARGET_FLAG}${ARCHITECTURE} "$SPEC_PATH" &> ${TMP_DIR}/rpmbuild.log
++$RPMBUILD --buildroot ${BUILDROOT} -bb ${RPM_TARGET_FLAG}${ARCHITECTURE} "$SPEC_PATH" &> ${TMP_DIR}/rpmbuild.log
+ okfail
+ 
+ if [ $? -gt 0 ]; then
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 6631214f39ab..55f5b0aedc9c 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -66,6 +66,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
+    # due to builder args bug; see
+    # https://github.com/NixOS/nix/commit/b224ac15201c57b40ea855f5a98b1bd166c1c7f6
+    broken = stdenv.isDarwin;
     description = "Powerful package manager that makes package management reliable and reproducible";
     longDescription = ''
       Nix is a powerful package manager for Linux and other Unix systems that
diff --git a/pkgs/tools/package-management/nix/unstable.nix b/pkgs/tools/package-management/nix/unstable.nix
index 23ecf9ac6e03..e3126fd40a3d 100644
--- a/pkgs/tools/package-management/nix/unstable.nix
+++ b/pkgs/tools/package-management/nix/unstable.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, perl, curl, bzip2, sqlite, openssl ? null
-, pkgconfig, boehmgc, perlPackages
+, pkgconfig, boehmgc, perlPackages, bash
 , storeDir ? "/nix/store"
 , stateDir ? "/nix/var"
 }:
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   postUnpack =
     '' export CPATH="${bzip2}/include"
        export LIBRARY_PATH="${bzip2}/lib"
+       export CXXFLAGS="-O3 -Wno-error=reserved-user-defined-literal"
     '';
 
   configureFlags =
@@ -34,7 +35,7 @@ stdenv.mkDerivation rec {
       --with-www-curl=${perlPackages.WWWCurl}/${perl.libPrefix}
       --disable-init-state
       --enable-gc
-      CFLAGS=-O3 CXXFLAGS=-O3
+      CFLAGS=-O3
     '';
 
   makeFlags = "profiledir=$(out)/etc/profile.d";
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 7dc13b3d11b2..6cbc82b26953 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib, bzip2, libiconv, libxml2, openssl, ncurses, curl }:
+{ stdenv, fetchurl, zlib, bzip2, libiconvOrNull, libxml2, openssl, ncurses, curl }:
 stdenv.mkDerivation rec {
   name = "clamav-${version}";
   version = "0.98.4";
@@ -8,12 +8,15 @@ stdenv.mkDerivation rec {
     sha256 = "071yzamalj3rf7kl2jvc35ipnk1imdkq5ylbb8whyxfgmd3nf06k";
   };
 
-  buildInputs = [ zlib bzip2 libiconv libxml2 openssl ncurses curl ];
+  buildInputs = [ zlib bzip2 libxml2 openssl ncurses curl ]
+    ++ stdenv.lib.optional (libiconvOrNull != null) libiconvOrNull;
 
   configureFlags = [
     "--with-zlib=${zlib}"
     "--with-libbz2-prefix=${bzip2}"
-    "--with-iconv-dir=${libiconv}"
+  ] ++ (stdenv.lib.optional (libiconvOrNull != null)
+       "--with-iconv-dir=${libiconvOrNull}")
+  ++ [
     "--with-xml=${libxml2}"
     "--with-openssl=${openssl}"
     "--with-libncurses-prefix=${ncurses}"
diff --git a/pkgs/tools/security/gnupg/20.nix b/pkgs/tools/security/gnupg/20.nix
index 45a25d7e2422..58a7cb7e34c0 100644
--- a/pkgs/tools/security/gnupg/20.nix
+++ b/pkgs/tools/security/gnupg/20.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     find tests -type f | xargs sed -e 's@/bin/pwd@${coreutils}&@g' -i
+    patch gl/stdint_.h < ${./clang.patch}
   '';
 
   configureFlags =
diff --git a/pkgs/tools/security/gnupg/clang.patch b/pkgs/tools/security/gnupg/clang.patch
new file mode 100644
index 000000000000..842785e5c932
--- /dev/null
+++ b/pkgs/tools/security/gnupg/clang.patch
@@ -0,0 +1,13 @@
+diff --git a/gl/stdint_.h b/gl/stdint_.h
+index bc27595..303e81a 100644
+--- a/gl/stdint_.h
++++ b/gl/stdint_.h
+@@ -62,7 +62,7 @@
+      int{8,16,32,64}_t, uint{8,16,32,64}_t and __BIT_TYPES_DEFINED__.
+      <inttypes.h> also defines intptr_t and uintptr_t.  */
+ # define _GL_JUST_INCLUDE_ABSOLUTE_INTTYPES_H
+-# include <inttypes.h>
++// # include <inttypes.h>
+ # undef _GL_JUST_INCLUDE_ABSOLUTE_INTTYPES_H
+ #elif @HAVE_SYS_INTTYPES_H@
+   /* Solaris 7 <sys/inttypes.h> has the types except the *_fast*_t types, and
diff --git a/pkgs/tools/system/tree/default.nix b/pkgs/tools/system/tree/default.nix
index e108589aaefe..eca8882643d1 100644
--- a/pkgs/tools/system/tree/default.nix
+++ b/pkgs/tools/system/tree/default.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation {
       prefix=$out
       MANDIR=$out/share/man/man1
       ${systemFlags}
+      CC="$CC"
     )
   '';
 
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index 6e83bd357b27..8be986e0cbb7 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -1,21 +1,18 @@
-{ stdenv, fetchurl, pcre, libiconv ? null }:
+{ stdenv, fetchurl, pcre, libiconvOrNull }:
 
-let version = "2.14"; in
+let version = "2.20"; in
 
 stdenv.mkDerivation {
   name = "gnugrep-${version}";
 
   src = fetchurl {
     url = "mirror://gnu/grep/grep-${version}.tar.xz";
-    sha256 = "1qbjb1l7f9blckc5pqy8jlf6482hpx4awn2acmhyf5mv9wfq03p7";
+    sha256 = "0rcs0spsxdmh6yz8y4frkqp6f5iw19mdbdl9s2v6956hq0mlbbzh";
   };
 
-  buildInputs = [ pcre ]
-    ++ stdenv.lib.optional (libiconv != null) libiconv;
+  buildInputs = [ pcre libiconvOrNull ];
 
-  patches = [ ./test-localeconv.patch ];
-
-  NIX_LDFLAGS = stdenv.lib.optionalString (libiconv != null) "-L${libiconv}/lib -liconv";
+  NIX_LDFLAGS = stdenv.lib.optionalString (libiconvOrNull != null) "-L${libiconvOrNull}/lib -liconv";
 
   doCheck = !stdenv.isDarwin;
 
@@ -25,6 +22,18 @@ stdenv.mkDerivation {
     export MKDIR_P="mkdir -p"
   '';
 
+  # Fix reference to sh in bootstrap-tools, and invoke grep via
+  # absolute path rather than looking at argv[0].
+  postInstall =
+    ''
+      rm $out/bin/egrep $out/bin/fgrep
+      echo "#! /bin/sh" > $out/bin/egrep
+      echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
+      echo "#! /bin/sh" > $out/bin/fgrep
+      echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
+      chmod +x $out/bin/egrep $out/bin/fgrep
+    '';
+
   meta = {
     homepage = http://www.gnu.org/software/grep/;
     description = "GNU implementation of the Unix grep command";
@@ -37,7 +46,7 @@ stdenv.mkDerivation {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    maintainers = [ ];
+    maintainers = [ stdenv.lib.maintainers.eelco ];
     platforms = stdenv.lib.platforms.all;
   };
 
diff --git a/pkgs/tools/text/gnugrep/test-localeconv.patch b/pkgs/tools/text/gnugrep/test-localeconv.patch
deleted file mode 100644
index f5efaf222217..000000000000
--- a/pkgs/tools/text/gnugrep/test-localeconv.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- grep-2.14/gnulib-tests/test-localeconv.c.orig	2013-02-15 18:41:50.213433059 +0000
-+++ grep-2.14/gnulib-tests/test-localeconv.c	2013-02-15 18:50:33.964751303 +0000
-@@ -37,13 +37,13 @@
- 
-     ASSERT (STREQ (l->decimal_point, "."));
-     ASSERT (STREQ (l->thousands_sep, ""));
--#if !defined __FreeBSD__
-+#if !(defined __FreeBSD__ || defined __sun)
-     ASSERT (STREQ (l->grouping, ""));
- #endif
- 
-     ASSERT (STREQ (l->mon_decimal_point, ""));
-     ASSERT (STREQ (l->mon_thousands_sep, ""));
--#if !defined __FreeBSD__
-+#if !(defined __FreeBSD__ || defined __sun)
-     ASSERT (STREQ (l->mon_grouping, ""));
- #endif
-     ASSERT (STREQ (l->positive_sign, ""));
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 97cc3c611733..cd1d719bdaf5 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -28,6 +28,14 @@ stdenv.mkDerivation rec {
     '';
   };
 
+  postInstall = ''
+      # Remove example output with (random?) colors to 
+      # avoid non-determinism in the output
+      rm $out/share/doc/${name}/examples/hdtbl/*color*ps
+      # Remove creation date
+      find $out/share/doc/${name} -type f -print0 | xargs -0 sed -i -e 's/%%CreationDate: .*//'
+    '';
+
   meta = {
     homepage = "http://www.gnu.org/software/groff/";
     description = "GNU Troff, a typesetting package that reads plain text and produces formatted output";
diff --git a/pkgs/tools/text/sgml/opensp/default.nix b/pkgs/tools/text/sgml/opensp/default.nix
index 59b9b7bc13d1..4b807718baae 100644
--- a/pkgs/tools/text/sgml/opensp/default.nix
+++ b/pkgs/tools/text/sgml/opensp/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, xmlto, docbook_xml_dtd_412, libxslt, docbook_xsl}:
+{ lib, stdenv, fetchurl, xmlto, docbook_xml_dtd_412, libxslt, docbook_xsl }:
 
 stdenv.mkDerivation {
   name = "opensp-1.5.2";
@@ -13,8 +13,19 @@ stdenv.mkDerivation {
       docsrc/*.xml
   '';
 
+  configureFlags = lib.optional stdenv.isDarwin [
+    "--with-libintl-prefix=/usr"
+    "--with-libiconv-prefix=/usr"
+  ];
+
   setupHook = ./setup-hook.sh;
 
+  postFixup = ''
+    # Remove random ids in the release notes
+    sed -i -e 's/href="#idm.*"//g' $out/share/doc/OpenSP/releasenotes.html
+    sed -i -e 's/name="idm.*"//g' $out/share/doc/OpenSP/releasenotes.html
+    '';
+
   buildInputs = [ xmlto docbook_xml_dtd_412 libxslt docbook_xsl ];
 
   meta = {
diff --git a/pkgs/tools/text/sgml/opensp/setup-hook.sh b/pkgs/tools/text/sgml/opensp/setup-hook.sh
index 72751b85ef60..5775832789a1 100644
--- a/pkgs/tools/text/sgml/opensp/setup-hook.sh
+++ b/pkgs/tools/text/sgml/opensp/setup-hook.sh
@@ -10,5 +10,5 @@ if test -z "$sgmlHookDone"; then
     sgmlHookDone=1
 
     export SGML_CATALOG_FILES
-    envHooks=(${envHooks[@]} addSGMLCatalogs)
+    envHooks+=(addSGMLCatalogs)
 fi
diff --git a/pkgs/tools/typesetting/tex/tetex/clang.patch b/pkgs/tools/typesetting/tex/tetex/clang.patch
new file mode 100644
index 000000000000..50d83f624437
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/tetex/clang.patch
@@ -0,0 +1,13 @@
+diff --git a/texk/ps2pkm/type1.c b/texk/ps2pkm/type1.c
+index 027bf1f..4dcbad0 100644
+--- a/texk/ps2pkm/type1.c
++++ b/texk/ps2pkm/type1.c
+@@ -800,7 +800,7 @@ static void PSFakePush(Num)
+ static DOUBLE PSFakePop ()
+ {
+   if (PSFakeTop >= 0) return(PSFakeStack[PSFakeTop--]);
+-  else Error0("PSFakePop : Stack empty\n");
++  else { CC; IfTrace0(TRUE, "PSFakePop : Stack empty\n"); errflag = TRUE; return 0; }
+   /*NOTREACHED*/
+ }
+  
diff --git a/pkgs/tools/typesetting/tex/tetex/default.nix b/pkgs/tools/typesetting/tex/tetex/default.nix
index 5cd3228aced3..173571eda23c 100644
--- a/pkgs/tools/typesetting/tex/tetex/default.nix
+++ b/pkgs/tools/typesetting/tex/tetex/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     sed -i 57d texk/kpathsea/c-std.h
   '';
 
-  patches = [ ./environment.patch ./getline.patch ];
+  patches = [ ./environment.patch ./getline.patch ./clang.patch ];
 
   setupHook = ./setup-hook.sh;
 
diff --git a/pkgs/tools/typesetting/tex/tetex/setup-hook.sh b/pkgs/tools/typesetting/tex/tetex/setup-hook.sh
index d79c4fae4196..9c5424e881e3 100644
--- a/pkgs/tools/typesetting/tex/tetex/setup-hook.sh
+++ b/pkgs/tools/typesetting/tex/tetex/setup-hook.sh
@@ -4,4 +4,4 @@ addTeXMFPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addTeXMFPath)
+envHooks+=(addTeXMFPath)
diff --git a/pkgs/tools/typesetting/tex/tex4ht/default.nix b/pkgs/tools/typesetting/tex/tex4ht/default.nix
index e3e19d82b4ec..9790c8a5faca 100644
--- a/pkgs/tools/typesetting/tex/tex4ht/default.nix
+++ b/pkgs/tools/typesetting/tex/tex4ht/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     cd src
     for f in tex4ht t4ht htcmd ; do
       # -DENVFILE="$out/share/texmf-nix/tex4ht/base/unix/tex4ht.env"
-      gcc -o $f $f.c -I${tetex}/include -L${tetex}/lib  -DHAVE_DIRENT_H -DHAVE_DIRENT_H -DKPATHSEA -lkpathsea
+      $CC -o $f $f.c -I${tetex}/include -L${tetex}/lib  -DHAVE_DIRENT_H -DHAVE_DIRENT_H -DKPATHSEA -lkpathsea
     done
     cd -
   '';
diff --git a/pkgs/tools/typesetting/tex/texlive/aggregate.nix b/pkgs/tools/typesetting/tex/texlive/aggregate.nix
index e001a36cab03..d19ff39e2a48 100644
--- a/pkgs/tools/typesetting/tex/texlive/aggregate.nix
+++ b/pkgs/tools/typesetting/tex/texlive/aggregate.nix
@@ -9,13 +9,15 @@ rec {
   phaseNames = [ "doAggregate" ];
 
   doAggregate = fullDepEntry (''
+    set +o pipefail
+
     mkdir -p $out/bin
     for currentPath in ${lib.concatStringsSep " " buildInputs}; do
         echo Symlinking "$currentPath"
         find $currentPath/share/info $currentPath/share/man $(echo $currentPath/texmf*/) -type d | while read; do
             REPLY="''${REPLY#$currentPath}"
             mkdir -p $out/"$REPLY"
-	done
+        done
         find $currentPath/share/info $currentPath/share/man $(echo $currentPath/texmf*/) ! -type d | while read; do
             REPLY="''${REPLY#$currentPath}"
             ln -fs $currentPath/"$REPLY" $out/"$REPLY"
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index c89ef6b7f531..b21c937e785f 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -22,7 +22,6 @@ rec {
   setupHook = ./setup-hook.sh;
 
   doMainBuild = fullDepEntry ( stdenv.lib.optionalString stdenv.isDarwin ''
-    export MACOSX_DEPLOYMENT_TARGET=10.9
     export DYLD_LIBRARY_PATH="${poppler}/lib"
   '' + ''
     mkdir -p $out
diff --git a/pkgs/tools/typesetting/tex/texlive/setup-hook.sh b/pkgs/tools/typesetting/tex/texlive/setup-hook.sh
index d79c4fae4196..9c5424e881e3 100644
--- a/pkgs/tools/typesetting/tex/texlive/setup-hook.sh
+++ b/pkgs/tools/typesetting/tex/texlive/setup-hook.sh
@@ -4,4 +4,4 @@ addTeXMFPath () {
     fi
 }
 
-envHooks=(${envHooks[@]} addTeXMFPath)
+envHooks+=(addTeXMFPath)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6d0284a6bad4..ef6f903a94b7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -85,7 +85,7 @@ let
   # Helper functions that are exported through `pkgs'.
   helperFunctions =
     stdenvAdapters //
-    (import ../build-support/trivial-builders.nix { inherit (pkgs) stdenv; inherit (pkgs.xorg) lndir; });
+    (import ../build-support/trivial-builders.nix { inherit lib; inherit (pkgs) stdenv; inherit (pkgs.xorg) lndir; });
 
   stdenvAdapters =
     import ../stdenv/adapters.nix pkgs;
@@ -205,7 +205,7 @@ let
 
 
   allStdenvs = import ../stdenv {
-    inherit system platform config;
+    inherit system platform config lib;
     allPackages = args: import ./all-packages.nix ({ inherit config system; } // args);
   };
 
@@ -231,8 +231,6 @@ let
       else
         defaultStdenv;
 
-  stdenvApple = stdenvAdapters.overrideGCC allStdenvs.stdenvNative gccApple;
-
   forceNativeDrv = drv : if crossSystem == null then drv else
     (drv // { crossDrv = drv.nativeDrv; });
 
@@ -1269,9 +1267,7 @@ let
     guile = guile_1_8;
   };
 
-  gnugrep = callPackage ../tools/text/gnugrep {
-    libiconv = libiconvOrNull;
-  };
+  gnugrep = callPackage ../tools/text/gnugrep { };
 
   gnulib = callPackage ../development/tools/gnulib { };
 
@@ -1968,7 +1964,11 @@ let
 
   openssh_with_kerberos = pkgs.appendToName "with-kerberos" (openssh.override { withKerberos = true; });
 
-  opensp = callPackage ../tools/text/sgml/opensp { };
+  opensp = callPackage ../tools/text/sgml/opensp {
+    stdenv = if stdenv.isDarwin
+      then allStdenvs.stdenvDarwinNaked
+      else stdenv;
+  };
 
   spCompat = callPackage ../tools/text/sgml/opensp/compat.nix { };
 
@@ -2905,10 +2905,10 @@ let
 
   ccl = builderDefsPackage ../development/compilers/ccl {};
 
-  clang = wrapClang llvmPackages.clang;
+  clang = wrapGCC llvmPackages.clang;
 
-  clang_34 = wrapClang llvmPackages_34.clang;
-  clang_33 = wrapClang (clangUnwrapped llvm_33 ../development/compilers/llvm/3.3/clang.nix);
+  clang_34 = wrapGCC llvmPackages_34.clang;
+  clang_33 = wrapGCC (clangUnwrapped llvm_33 ../development/compilers/llvm/3.3/clang.nix);
 
   clangAnalyzer = callPackage ../development/tools/analysis/clang-analyzer {
     clang = clang_34;
@@ -2916,25 +2916,24 @@ let
   };
 
   clangUnwrapped = llvm: pkg: callPackage pkg {
-    stdenv = if stdenv.isDarwin then stdenvApple else stdenv;
-    inherit llvm;
+    inherit stdenv llvm;
   };
 
   clangSelf = clangWrapSelf llvmPackagesSelf.clang;
 
-  clangWrapSelf = build: (import ../build-support/clang-wrapper) {
-    clang = build;
+  clangWrapSelf = build: (import ../build-support/gcc-wrapper) {
+    gcc = build;
     stdenv = clangStdenv;
     libc = glibc;
     binutils = binutils;
-    shell = bash;
-    inherit libcxx coreutils zlib;
+    inherit coreutils zlib;
+    extraPackages = [ libcxx ];
     nativeTools = false;
     nativeLibc = false;
   };
 
   #Use this instead of stdenv to build with clang
-  clangStdenv = lowPrio (stdenvAdapters.overrideGCC stdenv clang);
+  clangStdenv = if stdenv.isDarwin then stdenv else lowPrio (stdenvAdapters.overrideGCC stdenv clang);
   libcxxStdenv = stdenvAdapters.overrideGCC stdenv (clangWrapSelf llvmPackages.clang);
 
   clean = callPackage ../development/compilers/clean { };
@@ -2971,6 +2970,8 @@ let
   gcc       = gcc48;
   gcc_multi = gcc48_multi;
 
+  gccApple = throw "gccApple is no longer supported";
+
   gcc33 = wrapGCC (import ../development/compilers/gcc/3.3 {
     inherit fetchurl stdenv noSysDirs;
   });
@@ -3141,16 +3142,6 @@ let
       else null;
   }));
 
-  gccApple =
-    assert stdenv.isDarwin;
-    wrapGCC (makeOverridable (import ../development/compilers/gcc/4.2-apple64) {
-      inherit fetchurl noSysDirs;
-      profiledCompiler = true;
-      # Since it fails to build with GCC 4.6, build it with the "native"
-      # Apple-GCC.
-      stdenv = allStdenvs.stdenvNative;
-    });
-
   gfortran = gfortran48;
 
   gfortran48 = wrapGCC (gcc48.gcc.override {
@@ -3477,15 +3468,9 @@ let
   llvm_34 = llvmPackages_34.llvm;
   llvm_33 = llvm_v ../development/compilers/llvm/3.3/llvm.nix;
 
-  llvm_v = path: callPackage path {
-    stdenv = if stdenv.isDarwin then stdenvApple else stdenv;
-  };
+  llvm_v = path: callPackage path { };
 
-  llvmPackages = if !stdenv.isDarwin then llvmPackages_34 else llvmPackages_34 // {
-    # until someone solves build problems with _34
-    llvm = llvm_33;
-    clang = clang_33;
-  };
+  llvmPackages = llvmPackages_34;
 
   llvmPackages_34 = recurseIntoAttrs (import ../development/compilers/llvm/3.4 {
     inherit stdenv newScope fetchurl;
@@ -3879,28 +3864,14 @@ let
   win32hello = callPackage ../development/compilers/visual-c++/test { };
 
   wrapGCCWith = gccWrapper: glibc: baseGCC: gccWrapper {
-    nativeTools = stdenv ? gcc && stdenv.gcc.nativeTools;
-    nativeLibc = stdenv ? gcc && stdenv.gcc.nativeLibc;
-    nativePrefix = if stdenv ? gcc then stdenv.gcc.nativePrefix else "";
-    gcc = baseGCC;
-    libc = glibc;
-    shell = bash;
-    inherit stdenv binutils coreutils zlib;
-  };
-
-  wrapClangWith = clangWrapper: glibc: baseClang: clangWrapper {
     nativeTools = stdenv.gcc.nativeTools or false;
     nativeLibc = stdenv.gcc.nativeLibc or false;
     nativePrefix = stdenv.gcc.nativePrefix or "";
-    clang = baseClang;
+    gcc = baseGCC;
     libc = glibc;
-    shell = bash;
-    binutils = stdenv.gcc.binutils;
-    inherit stdenv coreutils zlib;
+    inherit stdenv binutils coreutils zlib;
   };
 
-  wrapClang = wrapClangWith (makeOverridable (import ../build-support/clang-wrapper)) glibc;
-
   wrapGCC = wrapGCCWith (makeOverridable (import ../build-support/gcc-wrapper)) glibc;
 
   wrapGCCCross =
@@ -4340,7 +4311,7 @@ let
   bam = callPackage ../development/tools/build-managers/bam {};
 
   binutils = if stdenv.isDarwin
-    then stdenv.gcc.binutils
+    then import ../build-support/native-darwin-cctools-wrapper {inherit stdenv;}
     else callPackage ../development/tools/misc/binutils {
       inherit noSysDirs;
     };
@@ -4486,10 +4457,12 @@ let
      wrapGCC (distcc.links extraConfig)) {};
   distccStdenv = lowPrio (overrideGCC stdenv distccWrapper);
 
-  distccMasquerade = callPackage ../development/tools/misc/distcc/masq.nix {
-    gccRaw = gcc.gcc;
-    binutils = binutils;
-  };
+  distccMasquerade = if stdenv.isDarwin
+    then null
+    else callPackage ../development/tools/misc/distcc/masq.nix {
+      gccRaw = gcc.gcc;
+      binutils = binutils;
+    };
 
   docutils = builderDefsPackage (import ../development/tools/documentation/docutils) {
     inherit python pil makeWrapper;
@@ -5000,7 +4973,7 @@ let
 
   coredumper = callPackage ../development/libraries/coredumper { };
 
-  ctl = callPackage ../development/libraries/ctl { };
+  ctl = dropCxx (callPackage ../development/libraries/ctl { });
 
   cpp-netlib = callPackage ../development/libraries/cpp-netlib { };
 
@@ -5154,6 +5127,8 @@ let
 
   cfitsio = callPackage ../development/libraries/cfitsio { };
 
+  fontconfig_210 = callPackage ../development/libraries/fontconfig/2.10.nix { };
+
   fontconfig = callPackage ../development/libraries/fontconfig { };
 
   folly = callPackage ../development/libraries/folly { };
@@ -5161,6 +5136,7 @@ let
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     import ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit runCommand libxslt fontconfig fontDirectories;
+      inherit (xorg) fontbhttf;
     };
 
   freealut = callPackage ../development/libraries/freealut { };
@@ -5320,7 +5296,7 @@ let
   gperftools = callPackage ../development/libraries/gperftools { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = pkgs.newScope (pkgs // { libav = pkgs.libav_10; });
+    callPackage = pkgs.newScope (pkgs // { inherit (pkgs) libav; });
   });
 
   gst_all = {
@@ -5488,6 +5464,10 @@ let
   heimdal = callPackage ../development/libraries/kerberos/heimdal.nix { };
 
   harfbuzz = callPackage ../development/libraries/harfbuzz { };
+  harfbuzz-icu = callPackage ../development/libraries/harfbuzz {
+    withIcu = true;
+    withGraphite2 = true;
+  };
 
   hawknl = callPackage ../development/libraries/hawknl { };
 
@@ -5527,7 +5507,7 @@ let
 
   ilixi = callPackage ../development/libraries/ilixi { };
 
-  ilmbase = callPackage ../development/libraries/ilmbase { };
+  ilmbase = dropCxx (callPackage ../development/libraries/ilmbase { });
 
   imlib = callPackage ../development/libraries/imlib {
     libpng = libpng12;
@@ -5642,9 +5622,9 @@ let
 
   libatomic_ops = callPackage ../development/libraries/libatomic_ops {};
 
-  libav = libav_10;
+  libav = libav_11; # branch 11 is API-compatible with branch 10
   libav_all = callPackage ../development/libraries/libav { };
-  inherit (libav_all) libav_0_8 libav_9 libav_10;
+  inherit (libav_all) libav_0_8 libav_9 libav_11;
 
   libavc1394 = callPackage ../development/libraries/libavc1394 { };
 
@@ -5716,7 +5696,7 @@ let
 
   libdc1394avt = callPackage ../development/libraries/libdc1394avt { };
 
-  libdevil = callPackage ../development/libraries/libdevil { };
+  libdevil = dropCxx (callPackage ../development/libraries/libdevil { });
 
   libdiscid = callPackage ../development/libraries/libdiscid { };
 
@@ -6393,12 +6373,10 @@ let
 
   mlt-qt4 = callPackage ../development/libraries/mlt {
     qt = qt4;
-    SDL = SDL_pulseaudio;
   };
 
   mlt-qt5 = callPackage ../development/libraries/mlt {
     qt = qt5;
-    SDL = SDL_pulseaudio;
   };
 
   movit = callPackage ../development/libraries/movit { };
@@ -6509,7 +6487,7 @@ let
   # this ctl version is needed by openexr_viewers
   openexr_ctl = callPackage ../development/libraries/openexr_ctl { };
 
-  openexr = callPackage ../development/libraries/openexr { };
+  openexr = dropCxx (callPackage ../development/libraries/openexr { });
 
   openldap = callPackage ../development/libraries/openldap {
     stdenv = if stdenv.isDarwin
@@ -6771,7 +6749,7 @@ let
     openglSupport = mesaSupported;
     alsaSupport = (!stdenv.isDarwin);
     x11Support = true;
-    pulseaudioSupport = stdenv.isDarwin; # better go through ALSA
+    pulseaudioSupport = true;
 
     # resolve the unrecognized -fpascal-strings option error
     stdenv = if stdenv.isDarwin
@@ -6779,9 +6757,6 @@ let
       else stdenv;
   };
 
-  # Fixes major problems with choppy sound in MLT / Kdenlive / Shotcut
-  SDL_pulseaudio = SDL.override { pulseaudioSupport = true; };
-
   SDL_gfx = callPackage ../development/libraries/SDL_gfx { };
 
   SDL_image = callPackage ../development/libraries/SDL_image {
@@ -7024,13 +6999,17 @@ let
   webkit = webkitgtk;
 
   webkitgtk = callPackage ../development/libraries/webkitgtk {
-    harfbuzz = harfbuzz.override {
-      withIcu = true;
-    };
+    harfbuzz = harfbuzz-icu;
+    inherit (xorg) libpthreadstubs;
     gst-plugins-base = gst_all_1.gst-plugins-base;
   };
 
-  webkitgtk2 = webkitgtk.override {
+  webkitgtk24x = callPackage ../development/libraries/webkitgtk/2.4.6.nix {
+    harfbuzz = harfbuzz-icu;
+    gst-plugins-base = gst_all_1.gst-plugins-base;
+  };
+
+  webkitgtk2 = webkitgtk24x.override {
     withGtk2 = true;
     enableIntrospection = false;
   };
@@ -7607,7 +7586,7 @@ let
   nginx = callPackage ../servers/http/nginx {
     rtmp        = true;
     fullWebDAV  = true;
-    syslog      = true;
+    syslog      = false; # the patch is not found
     moreheaders = true;
   };
   nginxUnstable = callPackage ../servers/http/nginx/unstable.nix {
@@ -7827,13 +7806,11 @@ let
   xorg = recurseIntoAttrs (import ../servers/x11/xorg/default.nix {
     inherit clangStdenv fetchurl fetchgit fetchpatch stdenv pkgconfig intltool freetype fontconfig
       libxslt expat libpng zlib perl mesa_drivers spice_protocol
-      dbus libuuid openssl gperf m4
+      dbus libuuid openssl gperf m4 libevdev
       autoconf automake libtool xmlto asciidoc flex bison python mtdev pixman;
     mesa = mesa_noglu;
     udev = if stdenv.isLinux then udev else null;
     libdrm = if stdenv.isLinux then libdrm else null;
-  } // {
-    xf86videointel-testing = callPackage ../servers/x11/xorg/xf86-video-intel-testing.nix { };
   });
 
   xorgReplacements = callPackage ../servers/x11/xorg/replacements.nix { };
@@ -9770,6 +9747,7 @@ let
   };
 
   gtkpod = callPackage ../applications/audio/gtkpod {
+    gnome = gnome3;
     inherit (gnome) libglade;
   };
 
@@ -10019,7 +9997,9 @@ let
     };
   };
 
-  liferea = callPackage ../applications/networking/newsreaders/liferea { };
+  liferea = callPackage ../applications/networking/newsreaders/liferea {
+    webkitgtk = webkitgtk24x;
+  };
 
   lingot = callPackage ../applications/audio/lingot {
     inherit (gnome) libglade;
@@ -10055,7 +10035,9 @@ let
 
   lxdvdrip = callPackage ../applications/video/lxdvdrip { };
 
-  handbrake = callPackage ../applications/video/handbrake { };
+  handbrake = callPackage ../applications/video/handbrake {
+    webkitgtk = webkitgtk24x;
+  };
 
   lilyterm = callPackage ../applications/misc/lilyterm {
     inherit (gnome) vte;
@@ -10096,7 +10078,9 @@ let
 
   mid2key = callPackage ../applications/audio/mid2key { };
 
-  midori = callPackage ../applications/networking/browsers/midori { };
+  midori = callPackage ../applications/networking/browsers/midori {
+    webkitgtk = webkitgtk24x;
+  };
 
   midoriWrapper = wrapFirefox
     { browser = midori; browserName = "midori"; desktopName = "Midori";
@@ -11414,7 +11398,6 @@ let
   hedgewars = callPackage ../games/hedgewars {
     inherit (haskellPackages) ghc network vector utf8String bytestringShow
       random hslogger dataenc;
-    SDL = SDL_pulseaudio;
   };
 
   hexen = callPackage ../games/hexen { };
@@ -11697,15 +11680,16 @@ let
     inherit (pkgs) libsoup libwnck gtk_doc gnome_doc_utils;
   };
 
-  gnome3 = recurseIntoAttrs (callPackage ../desktops/gnome-3/3.10 {
-    callPackage = pkgs.newScope pkgs.gnome3;
-    self = pkgs.gnome3;
+  gnome3_10 = recurseIntoAttrs (callPackage ../desktops/gnome-3/3.10 {
+    callPackage = pkgs.newScope pkgs.gnome3_10;
   });
 
   gnome3_12 = recurseIntoAttrs (callPackage ../desktops/gnome-3/3.12 {
     callPackage = pkgs.newScope pkgs.gnome3_12;
   });
 
+  gnome3 = gnome3_12;
+
   gnome = recurseIntoAttrs gnome2;
 
   hsetroot = callPackage ../tools/X11/hsetroot { };
diff --git a/pkgs/top-level/haskell-defaults.nix b/pkgs/top-level/haskell-defaults.nix
index 50f1177e07ae..9edabc13037f 100644
--- a/pkgs/top-level/haskell-defaults.nix
+++ b/pkgs/top-level/haskell-defaults.nix
@@ -203,6 +203,8 @@
     gmp = pkgs.gmp4;
   });
 
+  ghc783Binary = lowPrio (callPackage ../development/compilers/ghc/7.8.3-binary.nix {});
+
   ghc6101BinaryDarwin = if stdenv.isDarwin then ghc704Binary else ghc6101Binary;
   ghc6121BinaryDarwin = if stdenv.isDarwin then ghc704Binary else ghc6121Binary;
 
@@ -223,7 +225,7 @@
 
   packages_ghc783 =
     packages { ghcPath = ../development/compilers/ghc/7.8.3.nix;
-               ghcBinary = ghc742Binary;
+               ghcBinary = if stdenv.isDarwin then ghc783Binary else ghc742Binary;
                prefFun = ghc783Prefs;
              };