about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/editors/mg/default.nix2
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/graphics/ImageMagick/7.0.nix2
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/misc/stupidterm/default.nix2
-rw-r--r--pkgs/applications/science/math/mxnet/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/default.nix8
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix4
-rw-r--r--pkgs/applications/video/mplayer/default.nix2
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix46
-rw-r--r--pkgs/applications/virtualization/qemu/fix-qemu-ga.patch30
-rw-r--r--pkgs/build-support/bintools-wrapper/add-flags.sh26
-rw-r--r--pkgs/build-support/bintools-wrapper/add-hardening.sh2
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix13
-rw-r--r--pkgs/build-support/bintools-wrapper/ld-wrapper.sh20
-rw-r--r--pkgs/build-support/bintools-wrapper/setup-hook.sh11
-rw-r--r--pkgs/build-support/build-fhs-userenv/env.nix2
-rw-r--r--pkgs/build-support/cc-wrapper/add-flags.sh32
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh24
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix8
-rw-r--r--pkgs/build-support/cc-wrapper/gnat-wrapper.sh10
-rw-r--r--pkgs/build-support/cc-wrapper/setup-hook.sh26
-rw-r--r--pkgs/build-support/dotnetbuildhelpers/default.nix2
-rw-r--r--pkgs/build-support/pkg-config-wrapper/add-flags.sh12
-rw-r--r--pkgs/build-support/pkg-config-wrapper/default.nix126
-rw-r--r--pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh21
-rw-r--r--pkgs/build-support/pkg-config-wrapper/setup-hook.sh29
-rw-r--r--pkgs/build-support/setup-hooks/role.bash14
-rw-r--r--pkgs/build-support/wrapper-common/utils.bash32
-rw-r--r--pkgs/development/compilers/fpc/lazarus.nix2
-rw-r--r--pkgs/development/compilers/gcc/10/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/4.8/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/4.9/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/7/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/8/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/builder.sh48
-rw-r--r--pkgs/development/compilers/gcc/common/extra-target-flags.nix4
-rw-r--r--pkgs/development/compilers/gcc/libstdc++-hook.sh2
-rw-r--r--pkgs/development/compilers/go/1.14.nix6
-rw-r--r--pkgs/development/compilers/go/1.4.nix2
-rw-r--r--pkgs/development/compilers/go/setup-hook.sh5
-rw-r--r--pkgs/development/compilers/graalvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/10/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/compilers/llvm/5/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/libc++/setup-hook.sh4
-rw-r--r--pkgs/development/idris-modules/idris-wrapper.nix2
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/sitecustomize.py12
-rw-r--r--pkgs/development/interpreters/python/tests.nix10
-rw-r--r--pkgs/development/interpreters/python/tests/test_python.py4
-rw-r--r--pkgs/development/libraries/audio/lilv/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix8
-rw-r--r--pkgs/development/libraries/freetype/default.nix4
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix76
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/xlib.nix55
-rw-r--r--pkgs/development/libraries/gettext/gettext-setup-hook.sh2
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/gobject-introspection/absolute_shlib_path.patch43
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix110
-rw-r--r--pkgs/development/libraries/gobject-introspection/test_shlibs.patch43
-rw-r--r--pkgs/development/libraries/gtkd/default.nix2
-rw-r--r--pkgs/development/libraries/iso-codes/default.nix4
-rw-r--r--pkgs/development/libraries/jansson/default.nix4
-rw-r--r--pkgs/development/libraries/libaom/default.nix30
-rw-r--r--pkgs/development/libraries/libaom/outputs.patch45
-rw-r--r--pkgs/development/libraries/libarchive/default.nix8
-rw-r--r--pkgs/development/libraries/libbytesize/default.nix4
-rw-r--r--pkgs/development/libraries/libiconv/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/libqmi/default.nix4
-rw-r--r--pkgs/development/libraries/libuv/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix12
-rw-r--r--pkgs/development/libraries/nss/default.nix8
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix5
-rw-r--r--pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0014-qtbase-pkg-config.patch14
-rw-r--r--pkgs/development/libraries/serd/default.nix4
-rw-r--r--pkgs/development/libraries/wavpack/default.nix4
-rw-r--r--pkgs/development/libraries/wayland/default.nix7
-rw-r--r--pkgs/development/libraries/wayland/fix-wayland-cross-compilation.patch14
-rw-r--r--pkgs/development/python-modules/pkgconfig/default.nix4
-rw-r--r--pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch37
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix4
-rw-r--r--pkgs/development/python-modules/zstd/default.nix2
-rw-r--r--pkgs/development/tools/build-managers/cmake/default.nix6
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/more-env-vars.patch9
-rw-r--r--pkgs/development/tools/misc/pkg-config/default.nix9
-rw-r--r--pkgs/development/tools/misc/pkg-config/setup-hook.sh6
-rw-r--r--pkgs/development/tools/misc/pkgconf/default.nix29
-rw-r--r--pkgs/development/tools/misc/texinfo/cross-tools-flags.patch2
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix4
-rw-r--r--pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh6
-rw-r--r--pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh2
-rw-r--r--pkgs/os-specific/linux/batman-adv/alfred.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix2
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix3
-rw-r--r--pkgs/os-specific/linux/kexectools/default.nix3
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix4
-rw-r--r--pkgs/servers/pulseaudio/default.nix4
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_1.nix4
-rw-r--r--pkgs/stdenv/darwin/default.nix13
-rw-r--r--pkgs/stdenv/generic/default.nix4
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix10
-rw-r--r--pkgs/test/cross/default.nix16
-rw-r--r--pkgs/test/kernel.nix90
-rw-r--r--pkgs/tools/compression/zstd/default.nix9
-rw-r--r--pkgs/tools/networking/modem-manager/default.nix4
-rw-r--r--pkgs/tools/networking/openconnect_pa/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix33
122 files changed, 1024 insertions, 527 deletions
diff --git a/pkgs/applications/editors/mg/default.nix b/pkgs/applications/editors/mg/default.nix
index 612cdcc7f881..ef6943001b9c 100644
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  makeFlags = [ "PKG_CONFIG=${buildPackages.pkgconfig}/bin/pkg-config" ];
+  makeFlags = [ "PKG_CONFIG=${buildPackages.pkgconfig}/bin/${buildPackages.pkgconfig.targetPrefix}pkg-config" ];
 
   installPhase = ''
     install -m 555 -Dt $out/bin mg
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 8bdc0c0753c0..47e71e2da4d1 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.0510";
+  version = "8.2.0701";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "16ggwf238pzzkn3ng6n09qz9cgdzha9vc0ghlcxhwilnjh12l7p9";
+    sha256 = "1cbh2nhbvhp4kclc9fd8gqij2vi11c5zwdwn1nzg805k06hwmsrp";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index c227416b0214..4472e41e9d1a 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
     moveToOutput "lib/ImageMagick-*/config-Q16HDRI" "$dev" # includes configure params
     for file in "$dev"/bin/*-config; do
       substituteInPlace "$file" --replace pkg-config \
-        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkgconfig}/bin/pkg-config'"
+        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config'"
     done
   '' + lib.optionalString (ghostscript != null) ''
     for la in $out/lib/*.la; do
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 56f88fc4ef73..7a2ae8e4d66f 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,9 +85,9 @@ stdenv.mkDerivation {
     moveToOutput "lib/ImageMagick-*/config-Q16" "$dev" # includes configure params
     for file in "$dev"/bin/*-config; do
       substituteInPlace "$file" --replace "${pkgconfig}/bin/pkg-config -config" \
-        ${pkgconfig}/bin/pkg-config
+        ${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config
       substituteInPlace "$file" --replace ${pkgconfig}/bin/pkg-config \
-        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkgconfig}/bin/pkg-config'"
+        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config'"
     done
   '' + lib.optionalString (ghostscript != null) ''
     for la in $out/lib/*.la; do
diff --git a/pkgs/applications/misc/stupidterm/default.nix b/pkgs/applications/misc/stupidterm/default.nix
index 0a6e947f15c2..2016059d81e7 100644
--- a/pkgs/applications/misc/stupidterm/default.nix
+++ b/pkgs/applications/misc/stupidterm/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     sha256 = "1f73wvqqvj5pr3fvb7jjc4bi1iwgkkknz24k8n69mdb75jnfjipp";
   };
 
-  makeFlags = [ "PKGCONFIG=${pkgconfig}/bin/pkg-config" "binary=stupidterm" ];
+  makeFlags = [ "PKGCONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config" "binary=stupidterm" ];
 
   installPhase = ''
     install -D stupidterm $out/bin/stupidterm
diff --git a/pkgs/applications/science/math/mxnet/default.nix b/pkgs/applications/science/math/mxnet/default.nix
index b006a9dd18d1..3d74421669ea 100644
--- a/pkgs/applications/science/math/mxnet/default.nix
+++ b/pkgs/applications/science/math/mxnet/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake perl ];
 
-  buildInputs = [ opencv3 gtest blas ]
+  buildInputs = [ opencv3 gtest blas.provider ]
               ++ lib.optionals cudaSupport [ cudatoolkit nvidia_x11 ]
               ++ lib.optional cudnnSupport cudnn;
 
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index 9c0e0d74d221..e3cfc231dc10 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -82,6 +82,14 @@ let
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
+  git-doc = lib.addMetaAttrs {
+    description = "Additional documentation for Git";
+    longDescription = ''
+      This package contains additional documentation (HTML and text files) that
+      is referenced in the man pages of Git.
+    '';
+  } gitFull.doc;
+
   git-extras = callPackage ./git-extras { };
 
   git-fame = callPackage ./git-fame {};
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 9c1a01f42ae8..140a273e342e 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     sha256 = "0j685w6pzkn926z5nf5r8fij4ziipvw4c9yb0wc577nzf4j16rbd";
   };
 
-  outputs = [ "out" ];
+  outputs = [ "out" "doc" ];
 
   hardeningDisable = [ "format" ];
 
@@ -234,7 +234,7 @@ stdenv.mkDerivation {
       '')
 
    + stdenv.lib.optionalString withManual ''# Install man pages and Info manual
-       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-info \
+       make -j $NIX_BUILD_CORES -l $NIX_BUILD_CORES PERL_PATH="${buildPackages.perl}/bin/perl" cmd-list.made install install-html install-info \
          -C Documentation ''
 
    + (if guiSupport then ''
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index 5a72fe91ddde..1dd6b593f0fc 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -182,7 +182,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     configureFlagsArray+=(
       "--cc=$CC"
-      "--host-cc=$BUILD_CC"
+      "--host-cc=$CC_FOR_BUILD"
       "--as=$AS"
       "--nm=$NM"
       "--ar=$AR"
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index d6611e20a9c1..6498f720463b 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -35,15 +35,15 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "5.0.0";
   pname = "qemu"
     + stdenv.lib.optionalString xenSupport "-xen"
     + stdenv.lib.optionalString hostCpuOnly "-host-cpu-only"
     + stdenv.lib.optionalString nixosTestRunner "-for-vm-tests";
 
   src = fetchurl {
-    url = "https://wiki.qemu.org/download/qemu-${version}.tar.bz2";
-    sha256 = "1gczv8hn3wqci86css3mhzrppp3z8vppxw25l08j589k6bvz7x1w";
+    url= "https://download.qemu.org/qemu-${version}.tar.xz";
+    sha256 = "1dlcwyshdp94fwd30pddxf9bn2q8dfw5jsvry2gvdj551wmaj4rg";
   };
 
   nativeBuildInputs = [ python python.pkgs.sphinx pkgconfig flex bison ];
@@ -77,44 +77,6 @@ stdenv.mkDerivation rec {
     ./no-etc-install.patch
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
-    (fetchpatch {
-      name = "CVE-2019-15890.patch";
-      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=c59279437eda91841b9d26079c70b8a540d41204";
-      sha256 = "1q2rc67mfdz034mk81z9bw105x9zad7n954sy3kq068b1svrf7iy";
-      stripLen = 1;
-      extraPrefix = "slirp/";
-    })
-    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7039
-    (fetchpatch {
-      name = "CVE-2020-7039-1.patch";
-      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=2655fffed7a9e765bcb4701dd876e9dab975f289";
-      sha256 = "1jh0k3lg3553c2x1kq1kl3967jabhba5gm584wjpmr5mjqk3lnz1";
-      stripLen = 1;
-      extraPrefix = "slirp/";
-      excludes = ["slirp/CHANGELOG.md"];
-    })
-    (fetchpatch {
-      name = "CVE-2020-7039-2.patch";
-      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=82ebe9c370a0e2970fb5695aa19aa5214a6a1c80";
-      sha256 = "08ccxcmrhzknnzd1a1q2brszv3a7h02n26r73kpli10b0hn12r2l";
-      stripLen = 1;
-      extraPrefix = "slirp/";
-    })
-    (fetchpatch {
-      name = "CVE-2020-7039-3.patch";
-      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9";
-      sha256 = "18ypj9an2jmsmdn58853rbz42r10587h7cz5fdws2x4635778ibd";
-      stripLen = 1;
-      extraPrefix = "slirp/";
-    })
-    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7211
-    (fetchpatch {
-      name = "CVE-2020-7211.patch";
-      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=14ec36e107a8c9af7d0a80c3571fe39b291ff1d4";
-      sha256 = "1lc8zabqs580iqrsr5k7zwgkx6qjmja7apwfbc36lkvnrxwfzmrc";
-      stripLen = 1;
-      extraPrefix = "slirp/";
-    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
@@ -145,6 +107,8 @@ stdenv.mkDerivation rec {
       "--sysconfdir=/etc"
       "--localstatedir=/var"
       "--enable-docs"
+      "--enable-tools"
+      "--enable-guest-agent"
     ]
     # disable sysctl check on darwin.
     ++ optional stdenv.isDarwin "--cpu=x86_64"
diff --git a/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch b/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
index c2f051e2b944..0b2dd0ee5ece 100644
--- a/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
+++ b/pkgs/applications/virtualization/qemu/fix-qemu-ga.patch
@@ -1,22 +1,36 @@
-diff --git a/qga/commands-posix.c b/qga/commands-posix.c
-index 0dc219d..9d020d3 100644
+diff -Naur a/qga/commands-posix.c b/qga/commands-posix.c
 --- a/qga/commands-posix.c
 +++ b/qga/commands-posix.c
-@@ -102,6 +102,8 @@ void qmp_guest_shutdown(bool has_mode, const char *mode, Error **errp)
+@@ -109,6 +109,8 @@
          reopen_fd_to_null(1);
          reopen_fd_to_null(2);
-
+ 
 +        execle("/run/current-system/sw/bin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
 +               "hypervisor initiated shutdown", (char*)NULL, environ);
          execle("/sbin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
                 "hypervisor initiated shutdown", (char*)NULL, environ);
          _exit(EXIT_FAILURE);
-@@ -189,6 +191,8 @@ void qmp_guest_set_time(bool has_time, int64_t time_ns, Error **errp)
-
+@@ -157,11 +159,13 @@
+     pid_t pid;
+     Error *local_err = NULL;
+     struct timeval tv;
++    static const char hwclock_path_nix[] = "/run/current-system/sw/bin/hwclock";
+     static const char hwclock_path[] = "/sbin/hwclock";
+     static int hwclock_available = -1;
+ 
+     if (hwclock_available < 0) {
+-        hwclock_available = (access(hwclock_path, X_OK) == 0);
++        hwclock_available = (access(hwclock_path_nix, X_OK) == 0) ||
++                            (access(hwclock_path, X_OK) == 0);
+     }
+ 
+     if (!hwclock_available) {
+@@ -207,6 +211,8 @@
+ 
          /* Use '/sbin/hwclock -w' to set RTC from the system time,
           * or '/sbin/hwclock -s' to set the system time from RTC. */
-+        execle("/run/current-system/sw/bin/hwclock", "hwclock", has_time ? "-w" : "-s",
++        execle(hwclock_path_nix, "hwclock", has_time ? "-w" : "-s",
 +               NULL, environ);
-         execle("/sbin/hwclock", "hwclock", has_time ? "-w" : "-s",
+         execle(hwclock_path, "hwclock", has_time ? "-w" : "-s",
                 NULL, environ);
          _exit(EXIT_FAILURE);
diff --git a/pkgs/build-support/bintools-wrapper/add-flags.sh b/pkgs/build-support/bintools-wrapper/add-flags.sh
index e5c0556556c7..e99beb381586 100644
--- a/pkgs/build-support/bintools-wrapper/add-flags.sh
+++ b/pkgs/build-support/bintools-wrapper/add-flags.sh
@@ -1,32 +1,32 @@
 # See cc-wrapper for comments.
 var_templates_list=(
-    NIX+IGNORE_LD_THROUGH_GCC
-    NIX+LDFLAGS
-    NIX+LDFLAGS_BEFORE
-    NIX+LDFLAGS_AFTER
-    NIX+LDFLAGS_HARDEN
-    NIX+HARDENING_ENABLE
+    NIX_IGNORE_LD_THROUGH_GCC
+    NIX_LDFLAGS
+    NIX_LDFLAGS_BEFORE
+    NIX_LDFLAGS_AFTER
+    NIX_LDFLAGS_HARDEN
+    NIX_HARDENING_ENABLE
 )
 var_templates_bool=(
-    NIX+SET_BUILD_ID
-    NIX+DONT_SET_RPATH
+    NIX_SET_BUILD_ID
+    NIX_DONT_SET_RPATH
 )
 
 accumulateRoles
 
 for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarList "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarBool "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 
 if [ -e @out@/nix-support/libc-ldflags ]; then
-    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/libc-ldflags)"
+    NIX_LDFLAGS_@suffixSalt@+=" $(< @out@/nix-support/libc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/libc-ldflags-before ]; then
-    NIX_@infixSalt@_LDFLAGS_BEFORE="$(< @out@/nix-support/libc-ldflags-before) $NIX_@infixSalt@_LDFLAGS_BEFORE"
+    NIX_LDFLAGS_BEFORE_@suffixSalt@="$(< @out@/nix-support/libc-ldflags-before) $NIX_LDFLAGS_BEFORE_@suffixSalt@"
 fi
 
-export NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET=1
+export NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@=1
diff --git a/pkgs/build-support/bintools-wrapper/add-hardening.sh b/pkgs/build-support/bintools-wrapper/add-hardening.sh
index b7180870860a..5e49b7bd9053 100644
--- a/pkgs/build-support/bintools-wrapper/add-hardening.sh
+++ b/pkgs/build-support/bintools-wrapper/add-hardening.sh
@@ -5,7 +5,7 @@ declare -A hardeningEnableMap=()
 # Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
 # array expansion also prevents undefined variables from causing trouble with
 # `set -u`.
-for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
+for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do
   hardeningEnableMap["$flag"]=1
 done
 
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 5cc99c6412a7..9e31ca6a8a21 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -45,7 +45,7 @@ let
   coreutils_bin = if nativeTools then "" else getBin coreutils;
 
   # See description in cc-wrapper.
-  infixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
+  suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
   # The dynamic linker has different names on different platforms. This is a
   # shell glob that ought to match it.
@@ -83,7 +83,7 @@ stdenv.mkDerivation {
   shell = getBin shell + shell.shellPath or "";
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
-  inherit targetPrefix infixSalt;
+  inherit targetPrefix suffixSalt;
 
   outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (bintools ? info) "info");
 
@@ -95,9 +95,9 @@ stdenv.mkDerivation {
       (mapc
         (lambda (arg)
           (when (file-directory-p (concat arg "/lib"))
-            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib")))
+            (setenv "NIX_LDFLAGS_${suffixSalt}" (concat (getenv "NIX_LDFLAGS_${suffixSalt}") " -L" arg "/lib")))
           (when (file-directory-p (concat arg "/lib64"))
-            (setenv "NIX_${infixSalt}_LDFLAGS" (concat (getenv "NIX_${infixSalt}_LDFLAGS") " -L" arg "/lib64"))))
+            (setenv "NIX_LDFLAGS_${suffixSalt}" (concat (getenv "NIX_LDFLAGS_${suffixSalt}") " -L" arg "/lib64"))))
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
   };
@@ -248,6 +248,11 @@ stdenv.mkDerivation {
       printWords "''${ldflagsBefore[@]}" > $out/nix-support/libc-ldflags-before
     '')
 
+    + optionalString stdenv.targetPlatform.isMacOS ''
+      # Ensure consistent LC_VERSION_MIN_MACOSX and remove LC_UUID.
+      echo "-macosx_version_min 10.12 -sdk_version 10.12 -no_uuid" >> $out/nix-support/libc-ldflags-before
+    ''
+
     + optionalString (!nativeTools) ''
       ##
       ## User env support
diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index ed2f00a8974e..81b5a90edd5c 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -16,7 +16,7 @@ fi
 
 source @out@/nix-support/utils.bash
 
-if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -24,7 +24,7 @@ fi
 # Optionally filter out paths not refering to the store.
 expandResponseParams "$@"
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
-        && ( -z "$NIX_@infixSalt@_IGNORE_LD_THROUGH_GCC" || -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ) ]]; then
+        && ( -z "$NIX_IGNORE_LD_THROUGH_GCC_@suffixSalt@" || -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ) ]]; then
     rest=()
     nParams=${#params[@]}
     declare -i n=0
@@ -60,12 +60,12 @@ source @out@/nix-support/add-hardening.sh
 extraAfter=()
 extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
 
-if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
-    extraAfter+=($NIX_@infixSalt@_LDFLAGS)
-    extraBefore+=($NIX_@infixSalt@_LDFLAGS_BEFORE)
+if [ -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ]; then
+    extraAfter+=($NIX_LDFLAGS_@suffixSalt@)
+    extraBefore+=($NIX_LDFLAGS_BEFORE_@suffixSalt@)
 fi
 
-extraAfter+=($NIX_@infixSalt@_LDFLAGS_AFTER)
+extraAfter+=($NIX_LDFLAGS_AFTER_@suffixSalt@)
 
 # Specify the target emulation if nothing is passed in ("-m" overrides this
 # environment variable). Ensures we never blindly fallback on targeting the host
@@ -84,8 +84,8 @@ declare -A libs
 declare -i relocatable=0 link32=0
 
 if
-    [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ] \
-        || [ "$NIX_@infixSalt@_SET_BUILD_ID" = 1 ] \
+    [ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 ] \
+        || [ "$NIX_SET_BUILD_ID_@suffixSalt@" = 1 ] \
         || [ -e @out@/nix-support/dynamic-linker-m32 ]
 then
     prev=
@@ -144,7 +144,7 @@ if [ -e "@out@/nix-support/dynamic-linker-m32" ] && (( "$link32" )); then
 fi
 
 # Add all used dynamic libraries to the rpath.
-if [ "$NIX_@infixSalt@_DONT_SET_RPATH" != 1 ]; then
+if [ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 ]; then
     # For each directory in the library search path (-L...),
     # see if it contains a dynamic library used by a -l... flag.  If
     # so, add the directory to the rpath.
@@ -186,7 +186,7 @@ fi
 
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
-if [ "$NIX_@infixSalt@_SET_BUILD_ID" = 1 ] && ! (( "$relocatable" )); then
+if [ "$NIX_SET_BUILD_ID_@suffixSalt@" = 1 ] && ! (( "$relocatable" )); then
     extraAfter+=(--build-id)
 fi
 
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index a714bd151c90..7e9547b96c25 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -10,11 +10,11 @@
 
 bintoolsWrapper_addLDVars () {
     # See ../setup-hooks/role.bash
-    local role_post role_pre
+    local role_post
     getHostRoleEnvHook
 
     if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
-        export NIX_${role_pre}LDFLAGS+=" -L$1/lib64"
+        export NIX_LDFLAGS${role_post}+=" -L$1/lib64"
     fi
 
     if [[ -d "$1/lib" ]]; then
@@ -24,7 +24,7 @@ bintoolsWrapper_addLDVars () {
         # directories and bloats the size of the environment variable space.
         local -a glob=( $1/lib/lib* )
         if [ "${#glob[*]}" -gt 0 ]; then
-            export NIX_${role_pre}LDFLAGS+=" -L$1/lib"
+            export NIX_LDFLAGS${role_post}+=" -L$1/lib"
         fi
     fi
 }
@@ -52,7 +52,7 @@ fi
 
 # Export tool environment variables so various build systems use the right ones.
 
-export NIX_${role_pre}BINTOOLS=@out@
+export NIX_BINTOOLS${role_post}=@out@
 
 for cmd in \
     ar as ld nm objcopy objdump readelf ranlib strip strings size windres
@@ -60,7 +60,6 @@ do
     if
         PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
     then
-        export "${role_pre}${cmd^^}=@targetPrefix@${cmd}";
         export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
     fi
 done
@@ -70,4 +69,4 @@ done
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
-unset -v role_pre role_post cmd upper_case
+unset -v role_post cmd upper_case
diff --git a/pkgs/build-support/build-fhs-userenv/env.nix b/pkgs/build-support/build-fhs-userenv/env.nix
index 8de43d5a9195..083e7617b502 100644
--- a/pkgs/build-support/build-fhs-userenv/env.nix
+++ b/pkgs/build-support/build-fhs-userenv/env.nix
@@ -58,7 +58,7 @@ let
 
     # Force compilers and other tools to look in default search paths
     unset NIX_ENFORCE_PURITY
-    export NIX_CC_WRAPPER_${stdenv.cc.infixSalt}_TARGET_HOST=1
+    export NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}=1
     export NIX_CFLAGS_COMPILE='-idirafter /usr/include'
     export NIX_CFLAGS_LINK='-L/usr/lib -L/usr/lib32'
     export NIX_LDFLAGS='-L/usr/lib -L/usr/lib32'
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 323ea5bfd772..3398f11e8c21 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -5,15 +5,15 @@
 # wrapped binary just inherit the work of the forker's wrapper script.
 
 var_templates_list=(
-    NIX+CFLAGS_COMPILE
-    NIX+CFLAGS_COMPILE_BEFORE
-    NIX+CFLAGS_LINK
-    NIX+CXXSTDLIB_COMPILE
-    NIX+CXXSTDLIB_LINK
-    NIX+GNATFLAGS_COMPILE
+    NIX_CFLAGS_COMPILE
+    NIX_CFLAGS_COMPILE_BEFORE
+    NIX_CFLAGS_LINK
+    NIX_CXXSTDLIB_COMPILE
+    NIX_CXXSTDLIB_LINK
+    NIX_GNATFLAGS_COMPILE
 )
 var_templates_bool=(
-    NIX+ENFORCE_NO_NATIVE
+    NIX_ENFORCE_NO_NATIVE
 )
 
 accumulateRoles
@@ -21,37 +21,37 @@ accumulateRoles
 # We need to mangle names for hygiene, but also take parameters/overrides
 # from the environment.
 for var in "${var_templates_list[@]}"; do
-    mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarList "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 for var in "${var_templates_bool[@]}"; do
-    mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
+    mangleVarBool "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 
 # `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
-NIX_@infixSalt@_CFLAGS_COMPILE="-B@out@/bin/ $NIX_@infixSalt@_CFLAGS_COMPILE"
+NIX_CFLAGS_COMPILE_@suffixSalt@="-B@out@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
 
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
 
 if [ -e @out@/nix-support/libc-cflags ]; then
-    NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/libc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
+    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/libc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
 
 if [ -e @out@/nix-support/cc-cflags ]; then
-    NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/cc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
+    NIX_CFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/cc-cflags) $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
 
 if [ -e @out@/nix-support/gnat-cflags ]; then
-    NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
+    NIX_GNATFLAGS_COMPILE_@suffixSalt@="$(< @out@/nix-support/gnat-cflags) $NIX_GNATFLAGS_COMPILE_@suffixSalt@"
 fi
 
 if [ -e @out@/nix-support/cc-ldflags ]; then
-    NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
+    NIX_LDFLAGS_@suffixSalt@+=" $(< @out@/nix-support/cc-ldflags)"
 fi
 
 if [ -e @out@/nix-support/cc-cflags-before ]; then
-    NIX_@infixSalt@_CFLAGS_COMPILE_BEFORE="$(< @out@/nix-support/cc-cflags-before) $NIX_@infixSalt@_CFLAGS_COMPILE_BEFORE"
+    NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@="$(< @out@/nix-support/cc-cflags-before) $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@"
 fi
 
 # That way forked processes will not extend these environment variables again.
-export NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET=1
+export NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@=1
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index fc40fe7408b6..8e2fe6c407ea 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -5,7 +5,7 @@ declare -A hardeningEnableMap=()
 # Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
 # array expansion also prevents undefined variables from causing trouble with
 # `set -u`.
-for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
+for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do
   hardeningEnableMap["$flag"]=1
 done
 
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index ba3dfc96f5c4..cf00202221e6 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -18,12 +18,12 @@ fi
 source @out@/nix-support/utils.bash
 
 # Flirting with a layer violation here.
-if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @bintools@/nix-support/add-flags.sh
 fi
 
 # Put this one second so libc ldflags take priority.
-if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -113,7 +113,7 @@ fi
 
 
 # Clear march/mtune=native -- they bring impurity.
-if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
+if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
     rest=()
     # Old bash empty array hack
     for p in ${params+"${params[@]}"}; do
@@ -129,36 +129,36 @@ fi
 
 if [[ "$isCpp" = 1 ]]; then
     if [[ "$cppInclude" = 1 ]]; then
-        NIX_@infixSalt@_CFLAGS_COMPILE+=" ${NIX_@infixSalt@_CXXSTDLIB_COMPILE:-@default_cxx_stdlib_compile@}"
+        NIX_CFLAGS_COMPILE_@suffixSalt@+=" ${NIX_CXXSTDLIB_COMPILE_@suffixSalt@:-@default_cxx_stdlib_compile@}"
     fi
-    NIX_@infixSalt@_CFLAGS_LINK+=" $NIX_@infixSalt@_CXXSTDLIB_LINK"
+    NIX_CFLAGS_LINK_@suffixSalt@+=" $NIX_CXXSTDLIB_LINK_@suffixSalt@"
 fi
 
 source @out@/nix-support/add-hardening.sh
 
 # Add the flags for the C compiler proper.
-extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE)
-extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_@infixSalt@_CFLAGS_COMPILE_BEFORE)
+extraAfter=($NIX_CFLAGS_COMPILE_@suffixSalt@)
+extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
 
 if [ "$dontLink" != 1 ]; then
 
     # Add the flags that should only be passed to the compiler when
     # linking.
-    extraAfter+=($NIX_@infixSalt@_CFLAGS_LINK)
+    extraAfter+=($NIX_CFLAGS_LINK_@suffixSalt@)
 
     # Add the flags that should be passed to the linker (and prevent
-    # `ld-wrapper' from adding NIX_@infixSalt@_LDFLAGS again).
-    for i in $NIX_@infixSalt@_LDFLAGS_BEFORE; do
+    # `ld-wrapper' from adding NIX_LDFLAGS_@suffixSalt@ again).
+    for i in $NIX_LDFLAGS_BEFORE_@suffixSalt@; do
         extraBefore+=("-Wl,$i")
     done
-    for i in $NIX_@infixSalt@_LDFLAGS; do
+    for i in $NIX_LDFLAGS_@suffixSalt@; do
         if [ "${i:0:3}" = -L/ ]; then
             extraAfter+=("$i")
         else
             extraAfter+=("-Wl,$i")
         fi
     done
-    export NIX_@infixSalt@_LDFLAGS_SET=1
+    export NIX_LDFLAGS_SET_@suffixSalt@=1
 fi
 
 # As a very special hack, if the arguments are just `-v', then don't
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 36177ec2e358..da16a23f9dff 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -54,12 +54,12 @@ let
     "-isystem ${libcxx}/include/c++/v1"
   else "";
 
-  # The "infix salt" is a arbitrary string added in the middle of env vars
+  # The "suffix salt" is a arbitrary string added in the end of env vars
   # defined by cc-wrapper's hooks so that multiple cc-wrappers can be used
   # without interfering. For the moment, it is defined as the target triple,
   # adjusted to be a valid bash identifier. This should be considered an
   # unstable implementation detail, however.
-  infixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
+  suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
   expand-response-params =
     if buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null"
@@ -106,7 +106,7 @@ stdenv.mkDerivation {
   shell = getBin shell + shell.shellPath or "";
   gnugrep_bin = if nativeTools then "" else gnugrep;
 
-  inherit targetPrefix infixSalt;
+  inherit targetPrefix suffixSalt;
 
   outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
 
@@ -123,7 +123,7 @@ stdenv.mkDerivation {
       (mapc
         (lambda (arg)
           (when (file-directory-p (concat arg "/include"))
-            (setenv "NIX_${infixSalt}_CFLAGS_COMPILE" (concat (getenv "NIX_${infixSalt}_CFLAGS_COMPILE") " -isystem " arg "/include"))))
+            (setenv "NIX_CFLAGS_COMPILE_${suffixSalt}" (concat (getenv "NIX_CFLAGS_COMPILE_${suffixSalt}") " -isystem " arg "/include"))))
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
   };
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
index 15b53d76c630..d3f7d382c19a 100644
--- a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -18,12 +18,12 @@ fi
 source @out@/nix-support/utils.bash
 
 # Flirting with a layer violation here.
-if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_BINTOOLS_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @bintools@/nix-support/add-flags.sh
 fi
 
 # Put this one second so libc ldflags take priority.
-if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+if [ -z "${NIX_CC_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
     source @out@/nix-support/add-flags.sh
 fi
 
@@ -108,7 +108,7 @@ fi
 
 
 # Clear march/mtune=native -- they bring impurity.
-if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
+if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
     rest=()
     # Old bash empty array hack
     for p in ${params+"${params[@]}"}; do
@@ -124,12 +124,12 @@ fi
 
 if [ "$(basename $0)x" = "gnatmakex" ]; then
     extraBefore=("--GNATBIND=@out@/bin/gnatbind" "--GNATLINK=@out@/bin/gnatlink")
-    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+    extraAfter=($NIX_GNATFLAGS_COMPILE_@suffixSalt@)
 fi
 
 if [ "$(basename $0)x" = "gnatbindx" ]; then
     extraBefore=()
-    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+    extraAfter=($NIX_GNATFLAGS_COMPILE_@suffixSalt@)
 fi
 
 if [ "$(basename $0)x" = "gnatlinkx" ]; then
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 5b13f2683097..6a913cc4eac7 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -6,9 +6,9 @@
 # tools. For example:
 #
 #   # Flags for compiling (whether or not linking) C code for the...
-#   NIX_BUILD_CFLAGS_COMPILE  # ...build platform
-#   NIX_CFLAGS_COMPILE        # ...host platform
-#   NIX_TARGET_CFLAGS_COMPILE # ...target platform
+#   NIX_CFLAGS_COMPILE_FOR_BUILD  # ...build platform
+#   NIX_CFLAGS_COMPILE            # ...host platform
+#   NIX_CFLAGS_COMPILE_FOR_TARGET # ...target platform
 #
 # Notice that these platforms are the 3 *relative* to the package using
 # cc-wrapper, not absolute like `x86_64-pc-linux-gnu`.
@@ -33,12 +33,12 @@
 # The basic strategy is:
 #
 #  - Everyone exclusively *adds information* to relative-platform-specific
-#    environment variables, like `NIX_TARGET_CFLAGS_COMPILE`, to communicate
+#    environment variables, like `NIX_CFLAGS_COMPILE_FOR_TARGET`, to communicate
 #    with the wrapped binaries.
 #
 #  - The wrapped binaries will exclusively *read* cc-wrapper-derivation-specific
-#    environment variables distinguished with with `infixSalt`, like
-#    `NIX_@infixSalt@_CFLAGS_COMPILE`.
+#    environment variables distinguished with with `suffixSalt`, like
+#    `NIX_CFLAGS_COMPILE_@suffixSalt@`.
 #
 #  - `add-flags`, beyond its old task of reading extra flags stuck inside the
 #    cc-wrapper derivation, will convert the relative-platform-specific
@@ -65,15 +65,15 @@
 # function is guaranteed to be exactly the same.
 ccWrapper_addCVars () {
     # See ../setup-hooks/role.bash
-    local role_post role_pre
+    local role_post
     getHostRoleEnvHook
 
     if [ -d "$1/include" ]; then
-        export NIX_${role_pre}CFLAGS_COMPILE+=" -isystem $1/include"
+        export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
     fi
 
     if [ -d "$1/Library/Frameworks" ]; then
-        export NIX_${role_pre}CFLAGS_COMPILE+=" -iframework $1/Library/Frameworks"
+        export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
     fi
 }
 
@@ -105,10 +105,10 @@ fi
 
 # Export tool environment variables so various build systems use the right ones.
 
-export NIX_${role_pre}CC=@out@
+export NIX_CC${role_post}=@out@
 
-export ${role_pre}CC=@named_cc@
-export ${role_pre}CXX=@named_cxx@
+export CC${role_post}=@named_cc@
+export CXX${role_post}=@named_cxx@
 export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
@@ -117,4 +117,4 @@ export CXX${role_post}=@named_cxx@
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
-unset -v role_pre role_post
+unset -v role_post
diff --git a/pkgs/build-support/dotnetbuildhelpers/default.nix b/pkgs/build-support/dotnetbuildhelpers/default.nix
index 0edfd0b467ab..809619ed55d9 100644
--- a/pkgs/build-support/dotnetbuildhelpers/default.nix
+++ b/pkgs/build-support/dotnetbuildhelpers/default.nix
@@ -12,7 +12,7 @@
         cp -v "$script" "$target"/"$scriptName"
         chmod 755 "$target"/"$scriptName"
         patchShebangs "$target"/"$scriptName"
-        substituteInPlace "$target"/"$scriptName" --replace pkg-config ${pkgconfig}/bin/pkg-config
+        substituteInPlace "$target"/"$scriptName" --replace pkg-config ${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config
         substituteInPlace "$target"/"$scriptName" --replace monodis ${mono}/bin/monodis
       done
     ''
diff --git a/pkgs/build-support/pkg-config-wrapper/add-flags.sh b/pkgs/build-support/pkg-config-wrapper/add-flags.sh
new file mode 100644
index 000000000000..35ecf62ca230
--- /dev/null
+++ b/pkgs/build-support/pkg-config-wrapper/add-flags.sh
@@ -0,0 +1,12 @@
+# See cc-wrapper for comments.
+var_templates_list=(
+    PKG_CONFIG_PATH
+)
+
+accumulateRoles
+
+for var in "${var_templates_list[@]}"; do
+    mangleVarList "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
+done
+
+export NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@=1
diff --git a/pkgs/build-support/pkg-config-wrapper/default.nix b/pkgs/build-support/pkg-config-wrapper/default.nix
new file mode 100644
index 000000000000..e01df107dd17
--- /dev/null
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@@ -0,0 +1,126 @@
+# The wrapper script ensures variables like PKG_CONFIG_PATH and
+# PKG_CONFIG_PATH_FOR_BUILD work properly.
+
+{ stdenvNoCC
+, buildPackages
+, pkg-config
+, baseBinName ? "pkg-config"
+, propagateDoc ? pkg-config != null && pkg-config ? man
+, extraPackages ? [], extraBuildCommands ? ""
+}:
+
+with stdenvNoCC.lib;
+
+let
+  stdenv = stdenvNoCC;
+  inherit (stdenv) hostPlatform targetPlatform;
+
+  # Prefix for binaries. Customarily ends with a dash separator.
+  #
+  # TODO(@Ericson2314) Make unconditional, or optional but always true by
+  # default.
+  targetPrefix = stdenv.lib.optionalString (targetPlatform != hostPlatform)
+                                        (targetPlatform.config + "-");
+
+  # See description in cc-wrapper.
+  suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
+
+in
+
+stdenv.mkDerivation {
+  pname = targetPrefix + pkg-config.pname + "-wrapper";
+  inherit (pkg-config) version;
+
+  preferLocalBuild = true;
+
+  shell = getBin stdenvNoCC.shell + stdenvNoCC.shell.shellPath or "";
+
+  inherit targetPrefix suffixSalt baseBinName;
+
+  outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (pkg-config ? doc) "doc");
+
+  passthru = {
+    inherit pkg-config;
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    src=$PWD
+  '';
+
+  installPhase =
+    ''
+      mkdir -p $out/bin $out/nix-support
+
+      wrap() {
+        local dst="$1"
+        local wrapper="$2"
+        export prog="$3"
+        substituteAll "$wrapper" "$out/bin/$dst"
+        chmod +x "$out/bin/$dst"
+      }
+
+      echo $pkg-config > $out/nix-support/orig-pkg-config
+
+      wrap ${targetPrefix}${baseBinName} ${./pkg-config-wrapper.sh} "${getBin pkg-config}/bin/${baseBinName}"
+    ''
+    # symlink in share for autoconf to find macros
+
+    # TODO(@Ericson2314): in the future just make the unwrapped pkg-config a
+    # propagated dep once we can rely on downstream deps comming first in
+    # search paths. (https://github.com/NixOS/nixpkgs/pull/31414 took a crack
+    # at this.)
+    + ''
+      ln -s ${pkg-config}/share $out/share
+    '';
+
+  strictDeps = true;
+
+  wrapperName = "PKG_CONFIG_WRAPPER";
+
+  setupHooks = [
+    ../setup-hooks/role.bash
+    ./setup-hook.sh
+  ];
+
+  postFixup =
+    ##
+    ## User env support
+    ##
+
+    # Propagate the underling unwrapped pkg-config so that if you
+    # install the wrapper, you get anything else it might provide.
+    ''
+      printWords ${pkg-config} > $out/nix-support/propagated-user-env-packages
+    ''
+
+    ##
+    ## Man page and doc support
+    ##
+    + optionalString propagateDoc (''
+      ln -s ${pkg-config.man} $man
+    '' + optionalString (pkg-config ? doc) ''
+      ln -s ${pkg-config.doc} $doc
+    '')
+
+    + ''
+      substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
+      substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
+    ''
+
+    ##
+    ## Extra custom steps
+    ##
+    + extraBuildCommands;
+
+  meta =
+    let pkg-config_ = if pkg-config != null then pkg-config else {}; in
+    (if pkg-config_ ? meta then removeAttrs pkg-config.meta ["priority"] else {}) //
+    { description =
+        stdenv.lib.attrByPath ["meta" "description"] "pkg-config" pkg-config_
+        + " (wrapper script)";
+      priority = 10;
+  };
+}
diff --git a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
new file mode 100644
index 000000000000..f7c7429eb0b3
--- /dev/null
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@@ -0,0 +1,21 @@
+#! @shell@
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+source @out@/nix-support/utils.bash
+
+if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
+    source @out@/nix-support/add-flags.sh
+fi
+
+if (( ${#role_suffixes[@]} > 0 )); then
+	# replace env var with nix-modified one
+    PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
+else
+	# pkg-config isn't a bonafied dependency so ignore setup hook entirely
+	exec @prog@ "$@"
+fi
diff --git a/pkgs/build-support/pkg-config-wrapper/setup-hook.sh b/pkgs/build-support/pkg-config-wrapper/setup-hook.sh
new file mode 100644
index 000000000000..34f1a999a82e
--- /dev/null
+++ b/pkgs/build-support/pkg-config-wrapper/setup-hook.sh
@@ -0,0 +1,29 @@
+# pkg-config Wrapper hygiene
+#
+# See comments in cc-wrapper's setup hook. This works exactly the same way.
+
+# Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
+# native compile.
+#
+# TODO(@Ericson2314): No native exception
+[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
+
+pkgConfigWrapper_addPkgConfigPath () {
+    # See ../setup-hooks/role.bash
+    local role_post
+    getHostRoleEnvHook
+
+    addToSearchPath "PKG_CONFIG_PATH${role_post}" "$1/lib/pkgconfig"
+    addToSearchPath "PKG_CONFIG_PATH${role_post}" "$1/share/pkgconfig"
+}
+
+# See ../setup-hooks/role.bash
+getTargetRole
+getTargetRoleWrapper
+
+addEnvHooks "$targetOffset" pkgConfigWrapper_addPkgConfigPath
+
+export PKG_CONFIG${role_post}=@targetPrefix@@baseBinName@
+
+# No local scope in sourced file
+unset -v role_post
diff --git a/pkgs/build-support/setup-hooks/role.bash b/pkgs/build-support/setup-hooks/role.bash
index 6f1c36f5c050..cf69e732e7c3 100644
--- a/pkgs/build-support/setup-hooks/role.bash
+++ b/pkgs/build-support/setup-hooks/role.bash
@@ -3,21 +3,17 @@
 # derivation) in which the derivation is used.
 #
 # The role is intened to be use as part of other variables names like
-#  - $NIX_${role_pre}_SOMETHING
-#  - $NIX_SOMETHING_${role_post}
+#  - $NIX_SOMETHING${role_post}
 
 function getRole() {
     case $1 in
         -1)
-            role_pre='BUILD_'
             role_post='_FOR_BUILD'
             ;;
         0)
-            role_pre=''
             role_post=''
             ;;
         1)
-            role_pre='TARGET_'
             role_post='_FOR_TARGET'
             ;;
         *)
@@ -54,18 +50,18 @@ function getTargetRoleEnvHook() {
 }
 
 # This variant is inteneded specifically for code-prodocing tool wrapper scripts
-# `NIX_@wrapperName@_@infixSalt@_TARGET_*` tracks this (needs to be an exported
+# `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
 # env var so can't use fancier data structures).
 function getTargetRoleWrapper() {
     case $targetOffset in
         -1)
-            export NIX_@wrapperName@_@infixSalt@_TARGET_BUILD=1
+            export NIX_@wrapperName@_TARGET_BUILD_@suffixSalt@=1
             ;;
         0)
-            export NIX_@wrapperName@_@infixSalt@_TARGET_HOST=1
+            export NIX_@wrapperName@_TARGET_HOST_@suffixSalt@=1
             ;;
         1)
-            export NIX_@wrapperName@_@infixSalt@_TARGET_TARGET=1
+            export NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@=1
             ;;
         *)
             echo "@name@: used as improper sort of dependency" >2
diff --git a/pkgs/build-support/wrapper-common/utils.bash b/pkgs/build-support/wrapper-common/utils.bash
index 4fd57162072e..8c4680a8e446 100644
--- a/pkgs/build-support/wrapper-common/utils.bash
+++ b/pkgs/build-support/wrapper-common/utils.bash
@@ -1,29 +1,29 @@
-# Accumulate infixes for taking in the right input parameters with the `mangle*`
+# Accumulate suffixes for taking in the right input parameters with the `mangle*`
 # functions below. See setup-hook for details.
 accumulateRoles() {
-    declare -ga role_infixes=()
-    if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_BUILD:-}" ]; then
-        role_infixes+=(_BUILD_)
+    declare -ga role_suffixes=()
+    if [ "${NIX_@wrapperName@_TARGET_BUILD_@suffixSalt@:-}" ]; then
+        role_suffixes+=('_FOR_BUILD')
     fi
-    if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_HOST:-}" ]; then
-        role_infixes+=(_)
+    if [ "${NIX_@wrapperName@_TARGET_HOST_@suffixSalt@:-}" ]; then
+        role_suffixes+=('')
     fi
-    if [ "${NIX_@wrapperName@_@infixSalt@_TARGET_TARGET:-}" ]; then
-        role_infixes+=(_TARGET_)
+    if [ "${NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@:-}" ]; then
+        role_suffixes+=('_FOR_TARGET')
     fi
 }
 
 mangleVarList() {
     local var="$1"
     shift
-    local -a role_infixes=("$@")
+    local -a role_suffixes=("$@")
 
-    local outputVar="${var/+/_@infixSalt@_}"
+    local outputVar="${var}_@suffixSalt@"
     declare -gx ${outputVar}+=''
     # For each role we serve, we accumulate the input parameters into our own
     # cc-wrapper-derivation-specific environment variables.
-    for infix in "${role_infixes[@]}"; do
-        local inputVar="${var/+/${infix}}"
+    for suffix in "${role_suffixes[@]}"; do
+        local inputVar="${var}${suffix}"
         if [ -v "$inputVar" ]; then
             export ${outputVar}+="${!outputVar:+ }${!inputVar}"
         fi
@@ -33,12 +33,12 @@ mangleVarList() {
 mangleVarBool() {
     local var="$1"
     shift
-    local -a role_infixes=("$@")
+    local -a role_suffixes=("$@")
 
-    local outputVar="${var/+/_@infixSalt@_}"
+    local outputVar="${var}_@suffixSalt@"
     declare -gxi ${outputVar}+=0
-    for infix in "${role_infixes[@]}"; do
-        local inputVar="${var/+/${infix}}"
+    for suffix in "${role_suffixes[@]}"; do
+        local inputVar="${var}${suffix}"
         if [ -v "$inputVar" ]; then
             # "1" in the end makes `let` return success error code when
             # expression itself evaluates to zero.
diff --git a/pkgs/development/compilers/fpc/lazarus.nix b/pkgs/development/compilers/fpc/lazarus.nix
index 701dcae2fcfe..31a0727da90b 100644
--- a/pkgs/development/compilers/fpc/lazarus.nix
+++ b/pkgs/development/compilers/fpc/lazarus.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/startlazarus --prefix NIX_LDFLAGS ' ' \
       "$(echo "$NIX_LDFLAGS" | sed -re 's/-rpath [^ ]+//g')" \
-      --prefix NIX_${binutils.infixSalt}_LDFLAGS ' ' \
+      --prefix NIX_LDFLAGS_${binutils.suffixSalt} ' ' \
       "$(echo "$NIX_LDFLAGS" | sed -re 's/-rpath [^ ]+//g')" \
       --prefix LCL_PLATFORM ' ' "$LCL_PLATFORM" \
       --prefix PATH ':' "${fpc}/bin:${gdb}/bin:${gnumake}/bin:${binutils}/bin"
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index 4a4cfce5cc47..ae723a145313 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -239,8 +239,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index b35b69e87e1e..6a2c506b1bf3 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -264,8 +264,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index f7fbe1ec554b..0a35ed023c6f 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -276,8 +276,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 173ca128ee0b..f3b15eac55d2 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -292,8 +292,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 9153268a12b3..89933c22edd4 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -247,8 +247,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index e3091a062be8..5a6e20c0f412 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -234,8 +234,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index fadfdfa47a89..978ad75a3d26 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -242,8 +242,8 @@ stdenv.mkDerivation ({
     (import ../common/extra-target-flags.nix {
       inherit stdenv crossStageStatic langD libcCross threadsCross;
     })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
+    EXTRA_FLAGS_FOR_TARGET
+    EXTRA_LDFLAGS_FOR_TARGET
     ;
 
   passthru = {
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index b806f5a6e503..4b14cdb94cdd 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -25,12 +25,12 @@ echo "\$LIBRARY_PATH is \`${LIBRARY_PATH-}'"
 if test "$noSysDirs" = "1"; then
 
     declare \
-        EXTRA_BUILD_FLAGS EXTRA_FLAGS EXTRA_TARGET_FLAGS \
-        EXTRA_BUILD_LDFLAGS EXTRA_TARGET_LDFLAGS
+        EXTRA_FLAGS_FOR_BUILD EXTRA_FLAGS EXTRA_FLAGS_FOR_TARGET \
+        EXTRA_LDFLAGS_FOR_BUILD EXTRA_LDFLAGS_FOR_TARGET
 
     # Extract flags from Bintools Wrappers
-    for pre in 'BUILD_' ''; do
-        curBintools="NIX_${pre}BINTOOLS"
+    for post in '_FOR_BUILD' ''; do
+        curBintools="NIX_BINTOOLS${post}"
 
         declare -a extraLDFlags=()
         if [[ -e "${!curBintools}/nix-support/orig-libc" ]]; then
@@ -48,14 +48,14 @@ if test "$noSysDirs" = "1"; then
         extraLDFlags=("-L$libc_libdir" "-rpath" "$libc_libdir"
                       "${extraLDFlags[@]}")
         for i in "${extraLDFlags[@]}"; do
-            declare EXTRA_${pre}LDFLAGS+=" -Wl,$i"
+            declare EXTRA_LDFLAGS${post}+=" -Wl,$i"
         done
     done
 
     # Extract flags from CC Wrappers
-    for pre in 'BUILD_' ''; do
-        curCC="NIX_${pre}CC"
-        curFIXINC="NIX_${pre}FIXINC_DUMMY"
+    for post in '_FOR_BUILD' ''; do
+        curCC="NIX_CC${post}"
+        curFIXINC="NIX_FIXINC_DUMMY${post}"
 
         declare -a extraFlags=()
         if [[ -e "${!curCC}/nix-support/orig-libc" ]]; then
@@ -69,11 +69,11 @@ if test "$noSysDirs" = "1"; then
             # Use *real* header files, otherwise a limits.h is generated that
             # does not include Libc's limits.h (notably missing SSIZE_MAX,
             # which breaks the build).
-            declare NIX_${pre}FIXINC_DUMMY="$libc_devdir/include"
+            declare NIX_FIXINC_DUMMY${post}="$libc_devdir/include"
         else
             # Hack: support impure environments.
             extraFlags=("-isystem" "/usr/include")
-            declare NIX_${pre}FIXINC_DUMMY=/usr/include
+            declare NIX_FIXINC_DUMMY${post}=/usr/include
         fi
 
         extraFlags=("-I${!curFIXINC}" "${extraFlags[@]}")
@@ -89,13 +89,13 @@ if test "$noSysDirs" = "1"; then
             extraFlags=("-O2" "${extraFlags[@]}")
         fi
 
-        declare EXTRA_${pre}FLAGS="${extraFlags[*]}"
+        declare EXTRA_FLAGS${post}="${extraFlags[*]}"
     done
 
     if test -z "${targetConfig-}"; then
         # host = target, so the flags are the same
-        EXTRA_TARGET_FLAGS="$EXTRA_FLAGS"
-        EXTRA_TARGET_LDFLAGS="$EXTRA_LDFLAGS"
+        EXTRA_FLAGS_FOR_TARGET="$EXTRA_FLAGS"
+        EXTRA_LDFLAGS_FOR_TARGET="$EXTRA_LDFLAGS"
     fi
 
     # CFLAGS_FOR_TARGET are needed for the libstdc++ configure script to find
@@ -103,31 +103,31 @@ if test "$noSysDirs" = "1"; then
     # FLAGS_FOR_TARGET are needed for the target libraries to receive the -Bxxx
     # for the startfiles.
     makeFlagsArray+=(
-        "BUILD_SYSTEM_HEADER_DIR=$NIX_BUILD_FIXINC_DUMMY"
-        "SYSTEM_HEADER_DIR=$NIX_BUILD_FIXINC_DUMMY"
+        "BUILD_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
+        "SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
         "NATIVE_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY"
 
-        "LDFLAGS_FOR_BUILD=$EXTRA_BUILD_LDFLAGS"
+        "LDFLAGS_FOR_BUILD=$EXTRA_LDFLAGS_FOR_BUILD"
         #"LDFLAGS=$EXTRA_LDFLAGS"
-        "LDFLAGS_FOR_TARGET=$EXTRA_TARGET_LDFLAGS"
+        "LDFLAGS_FOR_TARGET=$EXTRA_LDFLAGS_FOR_TARGET"
 
-        "CFLAGS_FOR_BUILD=$EXTRA_BUILD_FLAGS $EXTRA_BUILD_LDFLAGS"
-        "CXXFLAGS_FOR_BUILD=$EXTRA_BUILD_FLAGS $EXTRA_BUILD_LDFLAGS"
-        "FLAGS_FOR_BUILD=$EXTRA_BUILD_FLAGS $EXTRA_BUILD_LDFLAGS"
+        "CFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
+        "CXXFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
+        "FLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
 
         # It seems there is a bug in GCC 5
         #"CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
         #"CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
 
-        "CFLAGS_FOR_TARGET=$EXTRA_TARGET_FLAGS $EXTRA_TARGET_LDFLAGS"
-        "CXXFLAGS_FOR_TARGET=$EXTRA_TARGET_FLAGS $EXTRA_TARGET_LDFLAGS"
-        "FLAGS_FOR_TARGET=$EXTRA_TARGET_FLAGS $EXTRA_TARGET_LDFLAGS"
+        "CFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+        "CXXFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+        "FLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
     )
 
     if test -z "${targetConfig-}"; then
         makeFlagsArray+=(
             "BOOT_CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-            "BOOT_LDFLAGS=$EXTRA_TARGET_FLAGS $EXTRA_TARGET_LDFLAGS"
+            "BOOT_LDFLAGS=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
         )
     fi
 
diff --git a/pkgs/development/compilers/gcc/common/extra-target-flags.nix b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
index 62d9818ca957..0a5a7a1bc1cb 100644
--- a/pkgs/development/compilers/gcc/common/extra-target-flags.nix
+++ b/pkgs/development/compilers/gcc/common/extra-target-flags.nix
@@ -8,7 +8,7 @@ in
   # For non-cross builds these flags are currently assigned in builder.sh.
   # It would be good to consolidate the generation of makeFlags
   # ({C,CXX,LD}FLAGS_FOR_{BUILD,TARGET}, etc...) at some point.
-  EXTRA_TARGET_FLAGS = let
+  EXTRA_FLAGS_FOR_TARGET = let
       mkFlags = dep: langD: lib.optionals (targetPlatform != hostPlatform && dep != null && !langD) ([
         "-O2 -idirafter ${lib.getDev dep}${dep.incdir or "/include"}"
       ] ++ stdenv.lib.optionals (! crossStageStatic) [
@@ -18,7 +18,7 @@ in
     ++ lib.optionals (!crossStageStatic) (mkFlags threadsCross langD)
     ;
 
-  EXTRA_TARGET_LDFLAGS = let
+  EXTRA_LDFLAGS_FOR_TARGET = let
       mkFlags = dep: lib.optionals (targetPlatform != hostPlatform && dep != null) ([
         "-Wl,-L${lib.getLib dep}${dep.libdir or "/lib"}"
       ] ++ (if crossStageStatic then [
diff --git a/pkgs/development/compilers/gcc/libstdc++-hook.sh b/pkgs/development/compilers/gcc/libstdc++-hook.sh
index 60c610a8e7a8..f5b4123b64d9 100644
--- a/pkgs/development/compilers/gcc/libstdc++-hook.sh
+++ b/pkgs/development/compilers/gcc/libstdc++-hook.sh
@@ -1,4 +1,4 @@
 # See pkgs/build-support/setup-hooks/role.bash
 getHostRole
 
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem $(echo -n @gcc@/include/c++/*) -isystem $(echo -n @gcc@/include/c++/*)/@targetConfig@"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem $(echo -n @gcc@/include/c++/*) -isystem $(echo -n @gcc@/include/c++/*)/@targetConfig@"
diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 9ee5b6fa6242..9aaf85c598fc 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0z3zxsnhmsxplnwfw1l9gr6jgglwp50sr3p5njknv9i6jzk89plq";
+    sha256 = "0mmgf74snprdiajgh99jjliwjl5im71qcgm5qrxpnyfisiw3f0lk";
   };
 
   # perl is used for testing go vet
@@ -229,8 +229,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  setupHook = ./setup-hook.sh;
-
   disallowedReferences = [ goBootstrap ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
index fc3fb0ad0e5a..af125d60ed0a 100644
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@@ -151,8 +151,6 @@ stdenv.mkDerivation rec {
     ./all.bash
   '';
 
-  setupHook = ./setup-hook.sh;
-
   meta = with stdenv.lib; {
     branch = "1.4";
     homepage = "http://golang.org/";
diff --git a/pkgs/development/compilers/go/setup-hook.sh b/pkgs/development/compilers/go/setup-hook.sh
deleted file mode 100644
index 7dce15eeb102..000000000000
--- a/pkgs/development/compilers/go/setup-hook.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-addToGoPath() {
-    addToSearchPath GOPATH $1/share/go
-}
-
-addEnvHooks "$targetOffset" addToGoPath
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 244ee4c010ea..337e0f735ebe 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -462,7 +462,7 @@ in rec {
         export CC="gcc"
         export CPP="gcc -E"
         export NIX_CXXSTDLIB_LINK=""
-        export NIX_TARGET_CXXSTDLIB_LINK=""
+        export NIX_CXXSTDLIB_LINK_FOR_TARGET=""
         export OPENSSL_PREFIX=$(realpath openssl)
         # this fixes error: impure path 'LibFFIHeaderDirectives' used in link
         export NIX_ENFORCE_PURITY=0
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt.nix b/pkgs/development/compilers/llvm/10/compiler-rt.nix
index 68f64ef42560..00c4f0677ebc 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/10/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/10/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/10/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/10/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/compilers/llvm/5/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/5/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/5/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/5/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt.nix b/pkgs/development/compilers/llvm/6/compiler-rt.nix
index 5ae8bb01f050..13abf6d95611 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/6/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/6/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/6/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/6/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt.nix b/pkgs/development/compilers/llvm/7/compiler-rt.nix
index e9853c58ca57..84ca6af3b36d 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/7/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/7/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/7/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/7/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt.nix b/pkgs/development/compilers/llvm/8/compiler-rt.nix
index 1f58cb98e3d3..15e55800dc8e 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/8/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/8/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/8/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/8/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt.nix b/pkgs/development/compilers/llvm/9/compiler-rt.nix
index 3b92264ad692..0183754a2fd4 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (!stdenv.isDarwin) ''
     substituteInPlace cmake/builtin-config-ix.cmake \
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/llvm/9/libc++/setup-hook.sh b/pkgs/development/compilers/llvm/9/libc++/setup-hook.sh
index 6611259165ae..3a274aecc23d 100644
--- a/pkgs/development/compilers/llvm/9/libc++/setup-hook.sh
+++ b/pkgs/development/compilers/llvm/9/libc++/setup-hook.sh
@@ -2,5 +2,5 @@
 getHostRole
 
 linkCxxAbi="@linkCxxAbi@"
-export NIX_${role_pre}CXXSTDLIB_COMPILE+=" -isystem @out@/include/c++/v1"
-export NIX_${role_pre}CXXSTDLIB_LINK=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
+export NIX_CXXSTDLIB_COMPILE${role_post}+=" -isystem @out@/include/c++/v1"
+export NIX_CXXSTDLIB_LINK${role_post}=" -stdlib=libc++${linkCxxAbi:+" -lc++abi"}"
diff --git a/pkgs/development/idris-modules/idris-wrapper.nix b/pkgs/development/idris-modules/idris-wrapper.nix
index 4e1d2f9c82eb..68a1a0f267ad 100644
--- a/pkgs/development/idris-modules/idris-wrapper.nix
+++ b/pkgs/development/idris-modules/idris-wrapper.nix
@@ -7,7 +7,7 @@ symlinkJoin {
   postBuild = ''
     wrapProgram $out/bin/idris \
       --run 'export IDRIS_CC=''${IDRIS_CC:-${stdenv.cc}/bin/cc}' \
-      --set NIX_CC_WRAPPER_${stdenv.cc.infixSalt}_TARGET_HOST 1 \
+      --set 'NIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}' 1 \
       --prefix NIX_CFLAGS_COMPILE " " "-I${lib.getDev gmp}/include" \
       --prefix NIX_CFLAGS_LINK " " "-L${lib.getLib gmp}/lib"
   '';
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2def54de12d1..a3ba72a27b27 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -107,10 +107,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "8";
-      patch = "2";
+      patch = "3";
       suffix = "";
     };
-    sha256 = "1ps5v323cp5czfshqjmbsqw7nvrdpcbk06f62jbzaqik4gfffii6";
+    sha256 = "0r2qg4pdvv52ld5dd95fl6lzzsxxxhbsxmymwcphh6624g3mxayz";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/interpreters/python/sitecustomize.py b/pkgs/development/interpreters/python/sitecustomize.py
index 72ce951328f1..d79a4696d8ea 100644
--- a/pkgs/development/interpreters/python/sitecustomize.py
+++ b/pkgs/development/interpreters/python/sitecustomize.py
@@ -21,9 +21,11 @@ paths = os.environ.pop('NIX_PYTHONPATH', None)
 if paths:
     functools.reduce(lambda k, p: site.addsitedir(p, k), paths.split(':'), site._init_pathinfo())
 
-# Check whether we are in a venv. 
-# Note Python 2 does not support base_prefix so we assume we are not in a venv.
-in_venv = sys.version_info.major == 3 and sys.prefix != sys.base_prefix
+# Check whether we are in a venv or virtualenv. 
+# For Python 3 we check whether our `base_prefix` is different from our current `prefix`.
+# For Python 2 we check whether the non-standard `real_prefix` is set.
+# https://stackoverflow.com/questions/1871549/determine-if-python-is-running-inside-virtualenv
+in_venv = (sys.version_info.major == 3 and sys.prefix != sys.base_prefix) or (sys.version_info.major == 2 and hasattr(sys, "real_prefix"))
 
 if not in_venv:
     executable = os.environ.pop('NIX_PYTHONEXECUTABLE', None)
@@ -32,8 +34,6 @@ if not in_venv:
     if 'PYTHONEXECUTABLE' not in os.environ and executable is not None:
         sys.executable = executable
     if prefix is not None:
-        # Because we cannot check with Python 2 whether we are in a venv, 
-        # creating a venv from a Nix env won't work as well with Python 2.
-        # Also, note that sysconfig does not like it when sys.prefix is set to None
+        # Sysconfig does not like it when sys.prefix is set to None
         sys.prefix = sys.exec_prefix = prefix
         site.PREFIXES.insert(0, prefix)
diff --git a/pkgs/development/interpreters/python/tests.nix b/pkgs/development/interpreters/python/tests.nix
index 6c4a6ae8e21c..03a3b9537090 100644
--- a/pkgs/development/interpreters/python/tests.nix
+++ b/pkgs/development/interpreters/python/tests.nix
@@ -19,10 +19,8 @@ let
       is_nixenv = "False";
       is_virtualenv = "False";
     };
-  } // lib.optionalAttrs (python.isPy3k && !python.isPyPy) {
+  } // lib.optionalAttrs (!python.isPyPy) {
     # Use virtualenv from a Nix env.
-    # Does not function with Python 2
-    # ValueError: source and destination is the same /nix/store/38kz3j1a87cq5y59k5w7k9yk4cqgc5b2-python-2.7.18/lib/python2.7/os.py
     nixenv-virtualenv = rec {
       env = runCommand "${python.name}-virtualenv" {} ''
         ${pythonVirtualEnv.interpreter} -m virtualenv $out
@@ -39,7 +37,7 @@ let
       interpreter = env.interpreter;
       is_venv = "False";
       is_nixenv = "True";
-      is_virtualenv = "True";
+      is_virtualenv = "False";
     };
   } // lib.optionalAttrs (python.isPy3k && (!python.isPyPy)) rec {
     # Venv built using plain Python
@@ -52,7 +50,7 @@ let
       interpreter = "${env}/bin/${python.executable}";
       is_venv = "True";
       is_nixenv = "False";
-      is_virtualenv = "True";
+      is_virtualenv = "False";
     };
 
   } // lib.optionalAttrs (python.pythonAtLeast "3.8") {
@@ -66,7 +64,7 @@ let
       interpreter = "${env}/bin/${pythonEnv.executable}";
       is_venv = "True";
       is_nixenv = "True";
-      is_virtualenv = "True";
+      is_virtualenv = "False";
     };
   };
 
diff --git a/pkgs/development/interpreters/python/tests/test_python.py b/pkgs/development/interpreters/python/tests/test_python.py
index 41a7e687d263..0fc4b8a9e91c 100644
--- a/pkgs/development/interpreters/python/tests/test_python.py
+++ b/pkgs/development/interpreters/python/tests/test_python.py
@@ -43,6 +43,10 @@ class TestCasePython(unittest.TestCase):
         else:
             self.assertEqual(sys.prefix, sys.base_prefix)
 
+    @unittest.skipIf(sys.version_info.major==3, "sys.real_prefix is only set by virtualenv in case of Python 2.")
+    def test_real_prefix(self):
+        self.assertTrue(hasattr(sys, "real_prefix") == IS_VIRTUALENV)
+
     def test_python_version(self):
         self.assertTrue(platform.python_version().startswith(PYTHON_VERSION))
 
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 831cd8c2054f..124828b0ff5f 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.6";
+  version = "0.24.8";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "1p3hafsxgs5d4za7n66lf5nz74qssfqpmk520cm7iq2njvvlqm2z";
+    sha256 = "0063i5zgf3d3accwmyx651hw0wh5ik7kji2hvfkcdbl1qia3dp6a";
   };
 
   patches = [ ./lilv-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index f56447668ea6..5b98884c1fc5 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -163,7 +163,6 @@ stdenv.mkDerivation rec {
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "--cross-prefix=${stdenv.cc.targetPrefix}"
       "--enable-cross-compile"
-      "--pkg-config=pkg-config" # Override ffmpeg's ./configure assumption that pkg-config is prefixed by the architecture. (e.g. aarch64-unknown-linux-gnu-pkg-config)
   ] ++ optional stdenv.cc.isClang "--cc=clang");
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -174,7 +173,7 @@ stdenv.mkDerivation rec {
     libvorbis lzma soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
   ] ++ optionals openglSupport [ libGL libGLU ]
     ++ optional libmfxSupport intel-media-sdk
-    ++ optional vpxSupport libaom
+    ++ optional libaomSupport libaom
     ++ optional vpxSupport libvpx
     ++ optionals (!isDarwin && !isAarch32) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
     ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva
@@ -199,9 +198,10 @@ stdenv.mkDerivation rec {
         --replace "includedir=$out" "includedir=''${!outputInclude}"
     done
   '' + optionalString stdenv.isLinux ''
-    # Set RUNPATH so that libnvcuvid in /run/opengl-driver(-32)/lib can be found.
+    # Set RUNPATH so that libnvcuvid and libcuda in /run/opengl-driver(-32)/lib can be found.
     # See the explanation in addOpenGLRunpath.
-    addOpenGLRunpath $out/lib/libavcodec.so*
+    addOpenGLRunpath $out/lib/libavcodec.so
+    addOpenGLRunpath $out/lib/libavutil.so
   '';
 
   installFlags = [ "install-man" ];
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 408578d9c939..24757af09e3d 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -14,7 +14,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "freetype";
-  version = "2.10.1";
+  version = "2.10.2";
 
   meta = with stdenv.lib; {
     description = "A font rendering engine";
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0vx2dg1jh5kq34dd6ifpjywkpapp8a7p1bvyq9yq5zi1i94gmnqn";
+    sha256 = "12rd181yzz6952cyjqaa4253f5szam93cmhw18p33rnj4l8dchqm";
   };
 
   propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 82fbbc967efc..08b8f70b2d9a 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -1,23 +1,43 @@
-{ stdenv, fetchurl, nixosTests, fixDarwinDylibNames, meson, ninja, pkgconfig, gettext, python3, libxml2, libxslt, docbook_xsl
-, docbook_xml_dtd_43, gtk-doc, glib, libtiff, libjpeg, libpng, libX11, gnome3
-, gobject-introspection, doCheck ? false, makeWrapper
+{ stdenv
+, fetchurl
+, nixosTests
+, fixDarwinDylibNames
+, meson
+, ninja
+, pkg-config
+, gettext
+, python3
+, libxml2
+, libxslt
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gtk-doc
+, glib
+, libtiff
+, libjpeg
+, libpng
+, gnome3
+, gobject-introspection
+, doCheck ? false
+, makeWrapper
 , fetchpatch
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "gdk-pixbuf";
   version = "2.40.0";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+
+  outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "1rnlx9yfw970maxi2x6niaxmih5la11q1ilr7gzshz2kk585k0hm";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
+
     # Temporary until the fix is released.
     (fetchpatch {
       name = "tests-circular-table.patch";
@@ -26,24 +46,34 @@ in stdenv.mkDerivation rec {
     })
   ];
 
-  outputs = [ "out" "dev" "man" "devdoc" "installedTests" ];
-
-  setupHook = ./setup-hook.sh;
-
-  # !!! We might want to factor out the gdk-pixbuf-xlib subpackage.
-  buildInputs = [ libX11 ];
-
   nativeBuildInputs = [
-    meson ninja pkgconfig gettext python3 libxml2 libxslt docbook_xsl docbook_xml_dtd_43
-    gtk-doc gobject-introspection makeWrapper glib
-  ]
-    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    meson
+    ninja
+    pkg-config
+    gettext
+    python3
+    libxml2
+    libxslt
+    docbook-xsl-nons
+    docbook_xml_dtd_43
+    gtk-doc
+    gobject-introspection
+    makeWrapper
+    glib
+  ] ++ stdenv.lib.optional stdenv.isDarwin [
+    fixDarwinDylibNames
+  ];
 
-  propagatedBuildInputs = [ glib libtiff libjpeg libpng ];
+  propagatedBuildInputs = [
+    glib
+    libtiff
+    libjpeg
+    libpng
+  ];
 
   mesonFlags = [
     "-Ddocs=true"
-    "-Dx11=true"
+    "-Dx11=false" # use gdk-pixbuf-xlib
     "-Dgir=${if gobject-introspection != null then "true" else "false"}"
     "-Dgio_sniffing=false"
   ];
@@ -87,6 +117,8 @@ in stdenv.mkDerivation rec {
   # The tests take an excessive amount of time (> 1.5 hours) and memory (> 6 GB).
   inherit doCheck;
 
+  setupHook = ./setup-hook.sh;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -102,8 +134,8 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A library for image loading and manipulation";
-    homepage = "http://library.gnome.org/devel/gdk-pixbuf/";
-    maintainers = [ maintainers.eelco ];
+    homepage = "https://gitlab.gnome.org/GNOME/gdk-pixbuf";
+    maintainers = [ maintainers.eelco ] ++ teams.gnome.members;
     license = licenses.lgpl21;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/gdk-pixbuf/xlib.nix b/pkgs/development/libraries/gdk-pixbuf/xlib.nix
new file mode 100644
index 000000000000..e5f1718f0751
--- /dev/null
+++ b/pkgs/development/libraries/gdk-pixbuf/xlib.nix
@@ -0,0 +1,55 @@
+{ stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gtk-doc
+, gdk-pixbuf
+, libX11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gdk-pixbuf-xlib";
+  version = "2019-10-19-unstable";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "Archive";
+    repo = "gdk-pixbuf-xlib";
+    rev = "dc22ea36f69755007c66877284596df270532cc1";
+    sha256 = "XhBQ4wano+MtGaqF6JNKoWgYQN6eBW+b8ZCGEBGt8IM=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    docbook-xsl-nons
+    docbook_xml_dtd_43
+    gtk-doc
+  ];
+
+  buildInputs = [
+    libX11
+  ];
+
+  propagatedBuildInputs = [
+    gdk-pixbuf
+  ];
+
+  mesonFlags = [
+    "-Dgtk_doc=true"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Deprecated API for integrating GdkPixbuf with Xlib data types";
+    homepage = "https://gitlab.gnome.org/Archive/gdk-pixbuf-xlib";
+    maintainers = teams.gnome.members;
+    license = licenses.lgpl21Plus;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/gettext/gettext-setup-hook.sh b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
index 69020146f84d..5cc9655a89bc 100644
--- a/pkgs/development/libraries/gettext/gettext-setup-hook.sh
+++ b/pkgs/development/libraries/gettext/gettext-setup-hook.sh
@@ -13,5 +13,5 @@ addEnvHooks "$hostOffset" gettextDataDirsHook
 if [ -n "@gettextNeedsLdflags@" -a -z "${dontAddExtraLibs-}" ]; then
     # See pkgs/build-support/setup-hooks/role.bash
     getHostRole
-    export NIX_${role_pre}LDFLAGS+=" -lintl"
+    export NIX_LDFLAGS${role_post}+=" -lintl"
 fi
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index d74bd0c4067a..47e372cf9a36 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "glib";
-  version = "2.64.1";
+  version = "2.64.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ixvjmsrj45xq9bq3chhj98jhgcsqa08v627mjx6sjxlph1pd5hp";
+    sha256 = "08pbgiv5m3rica4ydvwvpq5mrxbyswx7l1jzjc2ch52xjabvr77y";
   };
 
   patches = optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/gobject-introspection/absolute_shlib_path.patch b/pkgs/development/libraries/gobject-introspection/absolute_shlib_path.patch
index 6e56d3fab411..775c29855301 100644
--- a/pkgs/development/libraries/gobject-introspection/absolute_shlib_path.patch
+++ b/pkgs/development/libraries/gobject-introspection/absolute_shlib_path.patch
@@ -140,3 +140,46 @@
  
  
  def extract_libtool(la_file):
+--- a/tests/scanner/test_shlibs.py
++++ b/tests/scanner/test_shlibs.py
+@@ -7,6 +7,30 @@ from giscanner.shlibs import resolve_from_ldd_output, sanitize_shlib_path
+ 
+ class TestLddParser(unittest.TestCase):
+ 
++    def test_resolve_from_ldd_output_nix(self):
++        output = '''\
++            libglib-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libglib-2.0.so.0 (0x00007f0ee1b28000)
++            libgobject-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgobject-2.0.so.0 (0x00007f0ee18cf000)
++            libgio-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgio-2.0.so.0 (0x00007f0ee1502000)
++            libxml2.so.2 => @nixStoreDir@/72mxkk74cv266snkjpz1kwl1i2rg8rpc-libxml2-2.9.8/lib/libxml2.so.2 (0x00007f0ee119c000)
++            libsqlite3.so.0 => @nixStoreDir@/ck5ay23hsmlc67pg3m34kzd1k2hhvww0-sqlite-3.24.0/lib/libsqlite3.so.0 (0x00007f0ee0e98000)
++            libpsl.so.5 => @nixStoreDir@/qn3l2gn7m76f318676wflrs2z6d4rrkj-libpsl-0.20.2-list-2017-02-03/lib/libpsl.so.5 (0x00007f0ee0c88000)
++            libc.so.6 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/libc.so.6 (0x00007f0ee08d4000)
++            libpcre.so.1 => @nixStoreDir@/hxbq8lpc53qsf1bc0dfcsm47wmcxzjvh-pcre-8.42/lib/libpcre.so.1 (0x00007f0ee0662000)
++            @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib64/ld-linux-x86-64.so.2 (0x00007f0ee20ff000)
++            libblkid.so.1 => @nixStoreDir@/q0kgnq21j0l2yd77gdlld371246cwghh-util-linux-2.32.1/lib/libblkid.so.1 (0x00007f0edd0cd000)
++            libuuid.so.1 => @nixStoreDir@/q0kgnq21j0l2yd77gdlld371246cwghh-util-linux-2.32.1/lib/libuuid.so.1 (0x00007f0edcec5000)
++            librt.so.1 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/librt.so.1 (0x00007f0edccbd000)
++            libstdc++.so.6 => @nixStoreDir@/3v5r7fkrbkw2qajadvjbf6p6qriz9p1i-gcc-7.3.0-lib/lib/libstdc++.so.6 (0x00007f0edc936000)
++            libgcc_s.so.1 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/libgcc_s.so.1 (0x00007f0edc720000)
++        '''
++        libraries = ['glib-2.0', 'gio-2.0']
++
++        self.assertEqual(
++            ['@nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libglib-2.0.so.0',
++             '@nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgio-2.0.so.0'],
++            resolve_from_ldd_output(libraries, output))
++
+     def test_resolve_from_ldd_output(self):
+         output = '''\
+             libglib-2.0.so.0 => /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007fbe12d68000)
+@@ -40,7 +64,8 @@ class TestLddParser(unittest.TestCase):
+ 
+         self.assertEqual(
+             sanitize_shlib_path('/foo/bar'),
+-            '/foo/bar' if sys.platform == 'darwin' else 'bar')
++            # NixOS always want the absolute path
++            '/foo/bar')
+ 
+     def test_unresolved_library(self):
+         output = ''
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 0d514c3fd7d8..03b0d1767d9f 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -1,61 +1,97 @@
-{ stdenv, fetchurl, glib, flex, bison, meson, ninja, pkgconfig, libffi, python3
-, libintl, cctools, cairo, gnome3, glibcLocales
-, substituteAll, nixStoreDir ? builtins.storeDir
+{ stdenv
+, fetchurl
+, glib
+, flex
+, bison
+, meson
+, ninja
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, docbook_xml_dtd_45
+, pkg-config
+, libffi
+, python3
+, cctools
+, cairo
+, gnome3
+, substituteAll
+, nixStoreDir ? builtins.storeDir
 , x11Support ? true
 }:
+
 # now that gobject-introspection creates large .gir files (eg gtk3 case)
 # it may be worth thinking about using multiple derivation outputs
 # In that case its about 6MB which could be separated
 
-with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "gobject-introspection";
   version = "1.64.1";
 
+  # outputs TODO: share/gobject-introspection-1.0/tests is needed during build
+  # by pygobject3 (and maybe others), but it's only searched in $out
+  outputs = [ "out" "dev" "devdoc" "man" ];
+  outputBin = "dev";
+
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "19vz7vp10h0zj3f491yk72dp89bix6rgkzxg4qcm4d6151ksxgl0";
   };
 
-  outputs = [ "out" "dev" "man" ];
-  outputBin = "dev";
+  patches = [
+    # Make g-ir-scanner put absolute path to GIR files it generates
+    # so that programs can just dlopen them without having to muck
+    # with LD_LIBRARY_PATH environment variable.
+    (substituteAll {
+      src = ./absolute_shlib_path.patch;
+      inherit nixStoreDir;
+    })
+  ] ++ stdenv.lib.optionals x11Support [
+    # Hardcode the cairo shared library path in the Cairo gir shipped with this package.
+    # https://github.com/NixOS/nixpkgs/issues/34080
+    (substituteAll {
+      src = ./absolute_gir_path.patch;
+      cairoLib = "${stdenv.lib.getLib cairo}/lib";
+    })
+  ];
 
-  LC_ALL = "en_US.UTF-8"; # for tests
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    flex
+    bison
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43 # FIXME: remove in next release
+    docbook_xml_dtd_45
+    python3
+    setupHook # move .gir files
+  ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig libintl glibcLocales ];
-  buildInputs = [ flex bison python3 setupHook/*move .gir*/ ]
-    ++ stdenv.lib.optional stdenv.isDarwin cctools;
-  propagatedBuildInputs = [ libffi glib ];
+  buildInputs = [
+    python3
+  ];
+
+  checkInputs = stdenv.lib.optionals stdenv.isDarwin [
+    cctools # for otool
+  ];
+
+  propagatedBuildInputs = [
+    libffi
+    glib
+  ];
 
   mesonFlags = [
     "--datadir=${placeholder "dev"}/share"
     "-Ddoctool=disabled"
     "-Dcairo=disabled"
+    "-Dgtk_doc=true"
   ];
 
-  # outputs TODO: share/gobject-introspection-1.0/tests is needed during build
-  # by pygobject3 (and maybe others), but it's only searched in $out
-
-  setupHook = ./setup-hook.sh;
-
-  patches = [
-    (substituteAll {
-      src = ./test_shlibs.patch;
-      inherit nixStoreDir;
-    })
-    (substituteAll {
-      src = ./absolute_shlib_path.patch;
-      inherit nixStoreDir;
-    })
-  ] ++ stdenv.lib.optional x11Support # https://github.com/NixOS/nixpkgs/issues/34080
-    (substituteAll {
-      src = ./absolute_gir_path.patch;
-      cairoLib = "${getLib cairo}/lib";
-    });
-
   doCheck = !stdenv.isAarch64;
 
-  preBuild = ''
+  preCheck = ''
     # Our gobject-introspection patches make the shared library paths absolute
     # in the GIR files. When running tests, the library is not yet installed,
     # though, so we need to replace the absolute path with a local one during build.
@@ -64,10 +100,12 @@ stdenv.mkDerivation rec {
     ln -s $PWD/tests/scanner/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary} $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
   '';
 
-  preInstall = ''
+  postCheck = ''
     rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
   '';
 
+  setupHook = ./setup-hook.sh;
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -76,9 +114,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A middleware layer between C libraries and language bindings";
-    homepage    = "http://live.gnome.org/GObjectIntrospection";
-    maintainers = with maintainers; [ lovek323 lethalman ];
-    platforms   = platforms.unix;
+    homepage = "https://gi.readthedocs.io/";
+    maintainers = teams.gnome.members ++ (with maintainers; [ lovek323 ]);
+    platforms = platforms.unix;
     license = with licenses; [ gpl2 lgpl2 ];
 
     longDescription = ''
diff --git a/pkgs/development/libraries/gobject-introspection/test_shlibs.patch b/pkgs/development/libraries/gobject-introspection/test_shlibs.patch
deleted file mode 100644
index 65b5a1a13b91..000000000000
--- a/pkgs/development/libraries/gobject-introspection/test_shlibs.patch
+++ /dev/null
@@ -1,43 +0,0 @@
---- a/tests/scanner/test_shlibs.py
-+++ b/tests/scanner/test_shlibs.py
-@@ -7,6 +7,30 @@ from giscanner.shlibs import resolve_from_ldd_output, sanitize_shlib_path
- 
- class TestLddParser(unittest.TestCase):
- 
-+    def test_resolve_from_ldd_output_nix(self):
-+        output = '''\
-+            libglib-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libglib-2.0.so.0 (0x00007f0ee1b28000)
-+            libgobject-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgobject-2.0.so.0 (0x00007f0ee18cf000)
-+            libgio-2.0.so.0 => @nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgio-2.0.so.0 (0x00007f0ee1502000)
-+            libxml2.so.2 => @nixStoreDir@/72mxkk74cv266snkjpz1kwl1i2rg8rpc-libxml2-2.9.8/lib/libxml2.so.2 (0x00007f0ee119c000)
-+            libsqlite3.so.0 => @nixStoreDir@/ck5ay23hsmlc67pg3m34kzd1k2hhvww0-sqlite-3.24.0/lib/libsqlite3.so.0 (0x00007f0ee0e98000)
-+            libpsl.so.5 => @nixStoreDir@/qn3l2gn7m76f318676wflrs2z6d4rrkj-libpsl-0.20.2-list-2017-02-03/lib/libpsl.so.5 (0x00007f0ee0c88000)
-+            libc.so.6 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/libc.so.6 (0x00007f0ee08d4000)
-+            libpcre.so.1 => @nixStoreDir@/hxbq8lpc53qsf1bc0dfcsm47wmcxzjvh-pcre-8.42/lib/libpcre.so.1 (0x00007f0ee0662000)
-+            @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib64/ld-linux-x86-64.so.2 (0x00007f0ee20ff000)
-+            libblkid.so.1 => @nixStoreDir@/q0kgnq21j0l2yd77gdlld371246cwghh-util-linux-2.32.1/lib/libblkid.so.1 (0x00007f0edd0cd000)
-+            libuuid.so.1 => @nixStoreDir@/q0kgnq21j0l2yd77gdlld371246cwghh-util-linux-2.32.1/lib/libuuid.so.1 (0x00007f0edcec5000)
-+            librt.so.1 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/librt.so.1 (0x00007f0edccbd000)
-+            libstdc++.so.6 => @nixStoreDir@/3v5r7fkrbkw2qajadvjbf6p6qriz9p1i-gcc-7.3.0-lib/lib/libstdc++.so.6 (0x00007f0edc936000)
-+            libgcc_s.so.1 => @nixStoreDir@/g2yk54hifqlsjiha3szr4q3ccmdzyrdv-glibc-2.27/lib/libgcc_s.so.1 (0x00007f0edc720000)
-+        '''
-+        libraries = ['glib-2.0', 'gio-2.0']
-+
-+        self.assertEqual(
-+            ['@nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libglib-2.0.so.0',
-+             '@nixStoreDir@/gmrf09y7sfxrr0mcx90dba7w41jj2kzk-glib-2.58.1/lib/libgio-2.0.so.0'],
-+            resolve_from_ldd_output(libraries, output))
-+
-     def test_resolve_from_ldd_output(self):
-         output = '''\
-             libglib-2.0.so.0 => /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007fbe12d68000)
-@@ -40,7 +64,8 @@ class TestLddParser(unittest.TestCase):
- 
-         self.assertEqual(
-             sanitize_shlib_path('/foo/bar'),
--            '/foo/bar' if sys.platform == 'darwin' else 'bar')
-+            # NixOS always want the absolute path
-+            '/foo/bar')
- 
-     def test_unresolved_library(self):
-         output = ''
diff --git a/pkgs/development/libraries/gtkd/default.nix b/pkgs/development/libraries/gtkd/default.nix
index a03dc51f00c5..5cef820db149 100644
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@@ -117,7 +117,7 @@ in stdenv.mkDerivation rec {
 
   makeFlags  = [
     "prefix=${placeholder "out"}"
-    "PKG_CONFIG=${pkgconfig}/bin/pkg-config"
+    "PKG_CONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
   ];
 
   # The .pc files does not declare an `includedir=`, so the multiple
diff --git a/pkgs/development/libraries/iso-codes/default.nix b/pkgs/development/libraries/iso-codes/default.nix
index 9ab25b410b4a..8ba9ea31b801 100644
--- a/pkgs/development/libraries/iso-codes/default.nix
+++ b/pkgs/development/libraries/iso-codes/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iso-codes";
-  version = "4.4";
+  version = "4.5.0";
 
   src = fetchurl {
     url = "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.bz2";
-    sha256 = "02x0wcz783ammkdrmrh31wsmww481xbkbz70vf766ivbnn5sfxn6";
+    sha256 = "17nnyx07q8vbyqsxbvp4m5s2nrc4fxl3dvgbgmkqww2wl4x1fv9y";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/jansson/default.nix b/pkgs/development/libraries/jansson/default.nix
index c1653ea5d1be..7ecf7579a307 100644
--- a/pkgs/development/libraries/jansson/default.nix
+++ b/pkgs/development/libraries/jansson/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "jansson-2.12";
+  name = "jansson-2.13.1";
 
   src = fetchurl {
     url = "http://www.digip.org/jansson/releases/${name}.tar.gz";
-    sha256 = "1jfj4xq3rdgnkxval1x2gqwhaam34qdxbplsj5fsrvs8a1vfr3az";
+    sha256 = "0ks7gbs0j8p4dmmi2sq129mxy5gfg0z6220i1jk020mi2zd7gwzl";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 04b1c810c085..2c67e6ac1588 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -2,14 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "1.0.0-errata1";
+  version = "2.0.0";
 
   src = fetchgit {
     url = "https://aomedia.googlesource.com/aom";
     rev	= "v${version}";
-    sha256 = "090phh4jl9z6m2pwpfpwcjh6iyw0byngb2n112qxkg6a3gsaa62f";
+    sha256 = "1616xjhj6770ykn82ml741h8hx44v507iky3s9h7a5lnk9d4cxzy";
   };
 
+  patches = [ ./outputs.patch ];
+
   nativeBuildInputs = [
     yasm perl cmake pkgconfig python3
   ];
@@ -24,10 +26,30 @@ stdenv.mkDerivation rec {
     export PATH=$NIX_BUILD_TOP:$PATH
   '';
 
+  # Configuration options:
+  # https://aomedia.googlesource.com/aom/+/refs/heads/master/build/cmake/aom_config_defaults.cmake
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DENABLE_TESTS=OFF"
+  ];
+
+  postFixup = ''
+    moveToOutput lib/libaom.a "$static"
+  '';
+
+  outputs = [ "out" "bin" "dev" "static" ];
+
   meta = with stdenv.lib; {
-    description = "AV1 Bitstream and Decoding Library";
+    description = "Alliance for Open Media AV1 codec library";
+    longDescription = ''
+      Libaom is the reference implementation of the AV1 codec from the Alliance
+      for Open Media. It contains an AV1 library as well as applications like
+      an encoder (aomenc) and a decoder (aomdec).
+    '';
     homepage    = "https://aomedia.org/av1-features/get-started/";
-    maintainers = with maintainers; [ kiloreux ];
+    changelog   = "https://aomedia.googlesource.com/aom/+/refs/tags/v${version}/CHANGELOG";
+    maintainers = with maintainers; [ primeos kiloreux ];
     platforms   = platforms.all;
     license = licenses.bsd2;
   };
diff --git a/pkgs/development/libraries/libaom/outputs.patch b/pkgs/development/libraries/libaom/outputs.patch
new file mode 100644
index 000000000000..7c0ff397dfee
--- /dev/null
+++ b/pkgs/development/libraries/libaom/outputs.patch
@@ -0,0 +1,45 @@
+--- a/build/cmake/aom_install.cmake
++++ b/build/cmake/aom_install.cmake
+@@ -45,2 +45,2 @@ macro(setup_aom_install_targets)
+-              -DCMAKE_INSTALL_INCLUDEDIR=${CMAKE_INSTALL_INCLUDEDIR}
+-              -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
++              -DCMAKE_INSTALL_FULL_INCLUDEDIR=${CMAKE_INSTALL_FULL_INCLUDEDIR}
++              -DCMAKE_INSTALL_FULL_LIBDIR=${CMAKE_INSTALL_FULL_LIBDIR}
+@@ -82,14 +82,14 @@ macro(setup_aom_install_targets)
+     install(
+       FILES ${AOM_INSTALL_INCS}
+-      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/aom")
++      DESTINATION "${CMAKE_INSTALL_FULL_INCLUDEDIR}/aom")
+     install(
+       FILES "${AOM_PKG_CONFIG_FILE}"
+-      DESTINATION "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/pkgconfig")
++      DESTINATION "${CMAKE_INSTALL_FULL_LIBDIR}/pkgconfig")
+     install(TARGETS ${AOM_INSTALL_LIBS} DESTINATION
+-                    "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}")
++                    "${CMAKE_INSTALL_FULL_LIBDIR}")
+ 
+     if(ENABLE_EXAMPLES)
+       install(TARGETS ${AOM_INSTALL_BINS} DESTINATION
+-                      "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}")
++                      "${CMAKE_INSTALL_FULL_BINDIR}")
+     endif()
+   endif()
+--- a/build/cmake/pkg_config.cmake
++++ b/build/cmake/pkg_config.cmake
+@@ -14,2 +14,2 @@
+-                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_INCLUDEDIR"
+-                  "CMAKE_INSTALL_LIBDIR" "CMAKE_PROJECT_NAME"
++                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_FULL_INCLUDEDIR"
++                  "CMAKE_INSTALL_FULL_LIBDIR" "CMAKE_PROJECT_NAME"
+@@ -38,4 +38,4 @@ endif()
+-set(prefix "${CMAKE_INSTALL_PREFIX}")
+-set(bindir "${CMAKE_INSTALL_BINDIR}")
+-set(includedir "${CMAKE_INSTALL_INCLUDEDIR}")
+-set(libdir "${CMAKE_INSTALL_LIBDIR}")
++get_filename_component(prefix "${CMAKE_INSTALL_FULL_INCLUDEDIR}" DIRECTORY)
++get_filename_component(exec_prefix "${CMAKE_INSTALL_FULL_LIBDIR}" DIRECTORY)
++get_filename_component(includedir "${CMAKE_INSTALL_FULL_INCLUDEDIR}" NAME)
++get_filename_component(libdir "${CMAKE_INSTALL_FULL_LIBDIR}" NAME)
+@@ -46 +46 @@ file(APPEND "${pkgconfig_file}" "prefix=${prefix}\n")
+-file(APPEND "${pkgconfig_file}" "exec_prefix=\${prefix}\n")
++file(APPEND "${pkgconfig_file}" "exec_prefix=${exec_prefix}\n")
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 0f6b196d1507..d1917de37d6a 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,6 +1,6 @@
 {
   fetchFromGitHub, stdenv, pkgconfig, autoreconfHook,
-  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib,
+  acl, attr, bzip2, e2fsprogs, libxml2, lzo, openssl, sharutils, xz, zlib, zstd,
 
   # Optional but increases closure only negligibly.
   xarSupport ? true,
@@ -10,19 +10,19 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   pname = "libarchive";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${version}";
-    sha256 = "0mjm77wbqs8sbn9j44lj39nwbg6anmgz6pkyfxsww54a4rs0p3iz";
+    sha256 = "1y0v03p6zyv6plr2p0pid1qfgmk8hd427spj8xa93mcdmq5yc3s0";
   };
 
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ sharutils zlib bzip2 openssl xz lzo ]
+  buildInputs = [ sharutils zlib bzip2 openssl xz lzo zstd ]
     ++ stdenv.lib.optionals stdenv.isLinux [ e2fsprogs attr acl ]
     ++ stdenv.lib.optional xarSupport libxml2;
 
diff --git a/pkgs/development/libraries/libbytesize/default.nix b/pkgs/development/libraries/libbytesize/default.nix
index 5e293c163a9b..ec14b2a6091e 100644
--- a/pkgs/development/libraries/libbytesize/default.nix
+++ b/pkgs/development/libraries/libbytesize/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.2";
+  version = "2.3";
 in stdenv.mkDerivation rec {
   pname = "libbytesize";
   inherit version;
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
     owner = "storaged-project";
     repo = "libbytesize";
     rev = version;
-    sha256 = "0n4gmn68ypsk3gcw6akcghlgk3aj3wskwg3mlg93cw5y3a33nbhm";
+    sha256 = "1nrlmn63k0ix1yzn8v4lni5n5b4c0b6w9f33p1ig113ymmdvcc0h";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libiconv/setup-hook.sh b/pkgs/development/libraries/libiconv/setup-hook.sh
index 120cf06c61b5..3d9656ffe5d6 100644
--- a/pkgs/development/libraries/libiconv/setup-hook.sh
+++ b/pkgs/development/libraries/libiconv/setup-hook.sh
@@ -4,5 +4,5 @@
 # See pkgs/build-support/setup-hooks/role.bash
 if [ -z "${dontAddExtraLibs-}" ]; then
     getHostRole
-    export NIX_${role_pre}LDFLAGS+=" -liconv"
+    export NIX_LDFLAGS${role_post}+=" -liconv"
 fi
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 33b4983b015a..ec72578ba278 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.24.10";
+  version = "1.24.12";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libqmi/${pname}-${version}.tar.xz";
-    sha256 = "1rzxapr6hb18ccvqh5fizx7zk63l47bs0p3gizycz2ysnm1i44n2";
+    sha256 = "0scb8a2kh0vnzx6kxanfy2s2slnfppvrwg202rxv30m8p2i92frd";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 9f6adeb65b0b..e22bcdd86b4f 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.37.0";
+  version = "1.38.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0iy25w4wy9f5y7i7aqidhqz93qi00lv7vhx6s521n0kphvaj8ijz";
+    sha256 = "04598jglikma5plfiprnw4pcxwp7b6aqxphxs65pdd5xira6dz0s";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 7eb18dd31c1b..aa70e9e5a549 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, fetchpatch
+{ stdenv, lib, fetchurl, fetchpatch, buildPackages
 , pkgconfig, intltool, ninja, meson
 , file, flex, bison, expat, libdrm, xorg, wayland, wayland-protocols, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva-minimal
@@ -73,6 +73,12 @@ stdenv.mkDerivation {
       })
     ];
 
+  postPatch = ''
+    substituteInPlace meson.build --replace \
+      "find_program('pkg-config')" \
+      "find_program('${buildPackages.pkg-config.targetPrefix}pkg-config')"
+  '';
+
   outputs = [ "out" "dev" "drivers" "osmesa" ];
 
   # TODO: Figure out how to enable opencl without having a runtime dependency on clang
@@ -112,10 +118,14 @@ stdenv.mkDerivation {
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal ]
     ++ lib.optional withValgrind valgrind-light;
 
+  depsBuildBuild = [ pkgconfig ];
+
   nativeBuildInputs = [
     pkgconfig meson ninja
     intltool bison flex file
     python3Packages.python python3Packages.Mako
+  ] ++ lib.optionals (elem "wayland" eglPlatforms) [
+    wayland # For wayland-scanner during the build
   ];
 
   propagatedBuildInputs = with xorg; [
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index d48b5a6ba735..5251c680361a 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -53,7 +53,9 @@ in stdenv.mkDerivation rec {
   preConfigure = "cd nss";
 
   makeFlags = let
-    cpu = stdenv.hostPlatform.parsed.cpu.name;
+    # NSS's build systems expects aarch32 to be called arm; if we pass in armv6l/armv7l, it
+    # fails with a linker error
+    cpu = if stdenv.hostPlatform.isAarch32 then "arm" else stdenv.hostPlatform.parsed.cpu.name;
   in [
     "NSPR_INCLUDE_DIR=${nspr.dev}/include"
     "NSPR_LIB_DIR=${nspr.out}/lib"
@@ -64,9 +66,11 @@ in stdenv.mkDerivation rec {
     "USE_SYSTEM_ZLIB=1"
     "NSS_USE_SYSTEM_SQLITE=1"
     "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # Pass in CPU even if we're not cross compiling, because otherwise it tries to guess with
+    # uname, which can be wrong if e.g. we're compiling for aarch32 on aarch64
     "OS_TEST=${cpu}"
     "CPU_ARCH=${cpu}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=1"
     "NSS_DISABLE_GTESTS=1" # don't want to build tests when cross-compiling
   ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index afca6c7969b4..bdefca45a9af 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -67,6 +67,11 @@ let
         ./qtbase.patch.d/0010-qtbase-qtpluginpath.patch
         ./qtbase.patch.d/0011-qtbase-assert.patch
         ./qtbase.patch.d/0012-fix-header_module.patch
+
+        # Ensure -I${includedir} is added to Cflags in pkg-config files.
+        # See https://github.com/NixOS/nixpkgs/issues/52457
+        ./qtbase.patch.d/0014-qtbase-pkg-config.patch
+
         # https://bugreports.qt.io/browse/QTBUG-81715
         # remove after updating to qt > 5.12.7
         (fetchpatch {
diff --git a/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0014-qtbase-pkg-config.patch b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0014-qtbase-pkg-config.patch
new file mode 100644
index 000000000000..90caaea1cf4d
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtbase.patch.d/0014-qtbase-pkg-config.patch
@@ -0,0 +1,14 @@
+diff --git a/qmake/generators/makefile.cpp b/qmake/generators/makefile.cpp
+--- a/qmake/generators/makefile.cpp
++++ b/qmake/generators/makefile.cpp
+@@ -3390,8 +3390,7 @@ MakefileGenerator::writePkgConfigFile()
+       << varGlue("QMAKE_PKGCONFIG_CFLAGS", "", " ", " ")
+         //      << varGlue("DEFINES","-D"," -D"," ")
+          ;
+-    if (!project->values("QMAKE_DEFAULT_INCDIRS").contains(includeDir))
+-        t << "-I${includedir}";
++    t << "-I${includedir}";
+     if (target_mode == TARG_MAC_MODE && project->isActiveConfig("lib_bundle")
+         && libDir != QLatin1String("/Library/Frameworks")) {
+             t << " -F${libdir}";
+
diff --git a/pkgs/development/libraries/serd/default.nix b/pkgs/development/libraries/serd/default.nix
index 9e83bdae28ed..6829275e99e4 100644
--- a/pkgs/development/libraries/serd/default.nix
+++ b/pkgs/development/libraries/serd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "serd";
-  version = "0.30.2";
+  version = "0.30.4";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "00kjjgs5a8r72khgpya14scvl3n58wqwl5927y14z03j25q04ccx";
+    sha256 = "168rn3m32c59qbar120f83ibcnnd987ij9p053kybgl7cmm6358c";
   };
 
   nativeBuildInputs = [ pkgconfig python3 wafHook ];
diff --git a/pkgs/development/libraries/wavpack/default.nix b/pkgs/development/libraries/wavpack/default.nix
index 329de97d39e1..78794430860c 100644
--- a/pkgs/development/libraries/wavpack/default.nix
+++ b/pkgs/development/libraries/wavpack/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wavpack";
-  version = "5.2.0";
+  version = "5.3.0";
 
   enableParallelBuilding = true;
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://www.wavpack.com/${pname}-${version}.tar.bz2";
-    sha256 = "062f97bvm466ygvix3z0kbgffvvrc5cg2ak568jaq8r56v28q8rw";
+    sha256 = "00baiag7rlkzc6545dqdp4p5sr7xc3n97n7qdkgx58c544x0pw5n";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index e3b2941e8eee..402177b899c3 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -23,16 +23,17 @@ in stdenv.mkDerivation rec {
 
   mesonFlags = [ "-Ddocumentation=${lib.boolToString withDocumentation}" ];
 
-  patches = lib.optional isCross ./fix-wayland-cross-compilation.patch;
-
   postPatch = lib.optionalString withDocumentation ''
     patchShebangs doc/doxygen/gen-doxygen.py
-  '' + lib.optionalString isCross ''
     substituteInPlace egl/meson.build --replace \
       "find_program('nm').path()" \
       "find_program('${stdenv.cc.targetPrefix}nm').path()"
   '';
 
+  depsBuildBuild = [
+    pkgconfig
+  ];
+
   nativeBuildInputs = [
     meson pkgconfig ninja
   ] ++ lib.optionals isCross [
diff --git a/pkgs/development/libraries/wayland/fix-wayland-cross-compilation.patch b/pkgs/development/libraries/wayland/fix-wayland-cross-compilation.patch
deleted file mode 100644
index 77639acb6530..000000000000
--- a/pkgs/development/libraries/wayland/fix-wayland-cross-compilation.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/meson.build b/src/meson.build
-index 3e8c9bf..75241cb 100644
---- a/src/meson.build
-+++ b/src/meson.build
-@@ -55,8 +55,7 @@ pkgconfig.generate(
- )
- 
- if meson.is_cross_build()
--	scanner_dep = dependency('wayland-scanner', native: true, version: '>=1.14.0')
--	wayland_scanner_for_build = find_program(scanner_dep.get_pkgconfig_variable('wayland_scanner'))
-+	wayland_scanner_for_build = find_program('wayland-scanner', native: true, version: '>=1.14.0')
- else
- 	wayland_scanner_for_build = wayland_scanner
- endif
diff --git a/pkgs/development/python-modules/pkgconfig/default.nix b/pkgs/development/python-modules/pkgconfig/default.nix
index 2e6fb7c47058..ff9e3cc39aa3 100644
--- a/pkgs/development/python-modules/pkgconfig/default.nix
+++ b/pkgs/development/python-modules/pkgconfig/default.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   pname = "pkgconfig";
   version = "1.5.1";
 
-  setupHook = pkgconfig.setupHook;
+  setupHooks = pkgconfig.setupHooks;
 
   src = fetchPypi {
     inherit pname version;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   patches = [ ./executable.patch ];
   postPatch = ''
-    substituteInPlace pkgconfig/pkgconfig.py --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkgconfig}/bin/pkg-config"'
+    substituteInPlace pkgconfig/pkgconfig.py --replace 'PKG_CONFIG_EXE = "pkg-config"' 'PKG_CONFIG_EXE = "${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"'
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch b/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
new file mode 100644
index 000000000000..2b34da289e2d
--- /dev/null
+++ b/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
@@ -0,0 +1,37 @@
+From 21563405d6e2348ee457187f7fb61beb102bb367 Mon Sep 17 00:00:00 2001
+From: Frederik Rietdijk <fridh@fridh.nl>
+Date: Sun, 24 May 2020 09:33:13 +0200
+Subject: [PATCH] Check base_prefix and base_exec_prefix for Python 2
+
+This is a Nixpkgs-specific change so it can support virtualenvs from Nix envs.
+---
+ src/virtualenv/discovery/py_info.py | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/virtualenv/discovery/py_info.py b/src/virtualenv/discovery/py_info.py
+index 6f12128..74e9218 100644
+--- a/src/virtualenv/discovery/py_info.py
++++ b/src/virtualenv/discovery/py_info.py
+@@ -51,13 +51,17 @@ class PythonInfo(object):
+         self.version = u(sys.version)
+         self.os = u(os.name)
+ 
++        config_vars = {} if sys.version_info.major is not 2 else sysconfig._CONFIG_VARS
++        base_prefix = config_vars.get("prefix")
++        base_exec_prefix = config_vars.get("exec_prefix")
++
+         # information about the prefix - determines python home
+         self.prefix = u(abs_path(getattr(sys, "prefix", None)))  # prefix we think
+-        self.base_prefix = u(abs_path(getattr(sys, "base_prefix", None)))  # venv
++        self.base_prefix = u(abs_path(getattr(sys, "base_prefix", base_prefix)))  # venv
+         self.real_prefix = u(abs_path(getattr(sys, "real_prefix", None)))  # old virtualenv
+ 
+         # information about the exec prefix - dynamic stdlib modules
+-        self.base_exec_prefix = u(abs_path(getattr(sys, "base_exec_prefix", None)))
++        self.base_exec_prefix = u(abs_path(getattr(sys, "base_exec_prefix", base_exec_prefix)))
+         self.exec_prefix = u(abs_path(getattr(sys, "exec_prefix", None)))
+ 
+         self.executable = u(abs_path(sys.executable))  # the executable we were invoked via
+-- 
+2.25.1
+
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index ff5172d415f7..5ca27330103d 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -43,6 +43,10 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
+  patches = lib.optionals (isPy27) [
+    ./0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
+  ];
+
   meta = {
     description = "A tool to create isolated Python environments";
     homepage = "http://www.virtualenv.org";
diff --git a/pkgs/development/python-modules/zstd/default.nix b/pkgs/development/python-modules/zstd/default.nix
index 75856a88b7e0..c96e08ccb513 100644
--- a/pkgs/development/python-modules/zstd/default.nix
+++ b/pkgs/development/python-modules/zstd/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "/usr/bin/pkg-config" "${pkgconfig}/bin/pkg-config"
+      --replace "/usr/bin/pkg-config" "${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
   '';
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 05c7a55b9d2b..17362702e322 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -63,8 +63,10 @@ stdenv.mkDerivation rec {
       --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
     substituteInPlace Modules/FindCxxTest.cmake \
       --replace "$""{PYTHON_EXECUTABLE}" ${stdenv.shell}
-    # BUILD_CC and BUILD_CXX are used to bootstrap cmake
-    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$BUILD_CC CXX=$BUILD_CXX $configureFlags"
+  ''
+  # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
+  + ''
+    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags"
   '';
 
   configureFlags = [
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index a2dc1424d65f..0a61b8d02a99 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -8,11 +8,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "meson";
-  version = "0.54.1";
+  version = "0.54.2";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "L3b7RXJ2K+E+5HkpJhAJG0UJr1eIvM6zkf4iK80Cltw=";
+    sha256 = "p3Fu6uj43/AC5BR2Qliatklv+DnkN2pa7XYfg8H6BFU=";
   };
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/meson/more-env-vars.patch b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
index a8f860f03cc7..6326f5ec3cfb 100644
--- a/pkgs/development/tools/build-managers/meson/more-env-vars.patch
+++ b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
@@ -1,16 +1,13 @@
 diff --git a/mesonbuild/envconfig.py b/mesonbuild/envconfig.py
-index ac13a710..e0d07c51 100644
+index 17058df6b..7a68b7f15 100644
 --- a/mesonbuild/envconfig.py
 +++ b/mesonbuild/envconfig.py
-@@ -119,9 +119,9 @@ def get_env_var_pair(for_machine: MachineChoice,
+@@ -120,7 +120,7 @@ def get_env_var_pair(for_machine: MachineChoice,
          # compiling we fall back on the unprefixed host version. This
          # allows native builds to never need to worry about the 'BUILD_*'
          # ones.
 -        ([var_name + '_FOR_BUILD'] if is_cross else [var_name]),
 +        [var_name + '_FOR_BUILD'] + ([] if is_cross else [var_name]),
          # Always just the unprefixed host verions
--        ([] if is_cross else [var_name]),
-+        [var_name],
+         [var_name]
      )[for_machine]
-     for var in candidates:
-         value = os.environ.get(var)
diff --git a/pkgs/development/tools/misc/pkg-config/default.nix b/pkgs/development/tools/misc/pkg-config/default.nix
index 494b8d893d42..84f6c330f8c5 100644
--- a/pkgs/development/tools/misc/pkg-config/default.nix
+++ b/pkgs/development/tools/misc/pkg-config/default.nix
@@ -6,20 +6,21 @@ stdenv.mkDerivation rec {
   pname = "pkg-config";
   version = "0.29.2";
 
-  setupHook = ./setup-hook.sh;
-
   src = fetchurl {
     url = "https://pkgconfig.freedesktop.org/releases/${pname}-${version}.tar.gz";
     sha256 = "14fmwzki1rlz8bs2p810lk6jqdxsk966d8drgsjmi54cd00rrikg";
   };
 
+  outputs = [ "out" "man" "doc" ];
+
   # Process Requires.private properly, see
-  # http://bugs.freedesktop.org/show_bug.cgi?id=4738.
+  # http://bugs.freedesktop.org/show_bug.cgi?id=4738, migrated to
+  # https://gitlab.freedesktop.org/pkg-config/pkg-config/issues/28
   patches = optional (!vanilla) ./requires-private.patch
     ++ optional stdenv.isCygwin ./2.36.3-not-win32.patch;
 
   # These three tests fail due to a (desired) behavior change from our ./requires-private.patch
-  postPatch = ''
+  postPatch = if vanilla then null else ''
     rm -f check/check-requires-private check/check-gtk check/missing
   '';
 
diff --git a/pkgs/development/tools/misc/pkg-config/setup-hook.sh b/pkgs/development/tools/misc/pkg-config/setup-hook.sh
deleted file mode 100644
index 34a9b9f1173b..000000000000
--- a/pkgs/development/tools/misc/pkg-config/setup-hook.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-addPkgConfigPath () {
-    addToSearchPath PKG_CONFIG_PATH $1/lib/pkgconfig
-    addToSearchPath PKG_CONFIG_PATH $1/share/pkgconfig
-}
-
-addEnvHooks "$targetOffset" addPkgConfigPath
diff --git a/pkgs/development/tools/misc/pkgconf/default.nix b/pkgs/development/tools/misc/pkgconf/default.nix
index e3729994375b..153257c85ae1 100644
--- a/pkgs/development/tools/misc/pkgconf/default.nix
+++ b/pkgs/development/tools/misc/pkgconf/default.nix
@@ -1,14 +1,41 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, removeReferencesTo }:
 
 stdenv.mkDerivation rec {
   pname = "pkgconf";
   version = "1.7.0";
 
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  outputs = [ "out" "lib" "dev" "man" "doc" ];
+
+  enableParallelBuilding = true;
+
   src = fetchurl {
     url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
     sha256 = "0sb1a2lgiqaninv5s3zq09ilrkpsamcl68dyhqyz7yi9vsgb0vhy";
   };
 
+  # Debian has outputs like these too:
+  # https://packages.debian.org/source/buster/pkgconf, so take it this
+  # reference removing is safe.
+  postFixup = ''
+    remove-references-to \
+      -t "${placeholder "dev"}" \
+      "${placeholder "lib"}"/lib/* \
+      "${placeholder "out"}"/bin/*
+    remove-references-to \
+      -t "${placeholder "out"}" \
+      "${placeholder "lib"}"/lib/*
+  ''
+  # Move back share/aclocal. Yes, this normally goes in the dev output for good
+  # reason, but in this case the dev output is for the `libpkgconf` library,
+  # while the aclocal stuff is for the tool. The tool is already for use during
+  # development, so there is no reason to have separate "dev-bin" and "dev-lib"
+  # outputs or someting.
+  + ''
+    mv ${placeholder "dev"}/share ${placeholder "out"}
+  '';
+
   meta = with stdenv.lib; {
     description = "Package compiler and linker metadata toolkit";
     homepage = "https://git.dereferenced.org/pkgconf/pkgconf";
diff --git a/pkgs/development/tools/misc/texinfo/cross-tools-flags.patch b/pkgs/development/tools/misc/texinfo/cross-tools-flags.patch
index f0e4230d7ec2..da28a309719e 100644
--- a/pkgs/development/tools/misc/texinfo/cross-tools-flags.patch
+++ b/pkgs/development/tools/misc/texinfo/cross-tools-flags.patch
@@ -4,7 +4,7 @@ diff -ur texinfo-6.5/configure texinfo-6.5-patched/configure
 @@ -23281,7 +23281,7 @@
    # env -i gives this build host configure a clean environment;
    # consequently, we have to re-initialize $PATH.
-   env -i CC="$BUILD_CC" AR="$BUILD_AR" RANLIB="$BUILD_RANLIB" \
+   env -i CC="$CC_FOR_BUILD" AR="$AR_FOR_BUILD" RANLIB="$RANLIB_FOR_BUILD" \
 -      PATH="$PATH" \
 +      PATH="$PATH" CFLAGS="$NATIVE_TOOLS_CFLAGS" LDFLAGS="$NATIVE_TOOLS_LDFLAGS" \
        tools_only=1 \
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index c9758fe21e31..5302f7ca6441 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.5.4";
+  version = "3.6.2";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0a2cbrqh7mgx2dwf5qm10v68iakv1i0dqh9di4x5aqxsz96ibpf0";
+    sha256 = "16h8panwpljwdq902v9x7inpnks51fn0kqlbyqfjvpilv6md73p2";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
index 81df09eba176..3c49337a937c 100644
--- a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -1,6 +1,6 @@
 # See pkgs/build-support/setup-hooks/role.bash
 getHostRole
 
-export NIX_${role_pre}LDFLAGS+=" -lnbcompat"
-export NIX_${role_pre}CFLAGS_COMPILE+=" -DHAVE_NBTOOL_CONFIG_H"
-export NIX_${role_pre}CFLAGS_COMPILE+=" -include nbtool_config.h"
+export NIX_LDFLAGS${role_post}+=" -lnbcompat"
+export NIX_CFLAGS_COMPILE${role_post}+=" -DHAVE_NBTOOL_CONFIG_H"
+export NIX_CFLAGS_COMPILE${role_post}+=" -include nbtool_config.h"
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
index 5cf8c753aec3..b6cb5aaca05b 100644
--- a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
+++ b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
@@ -1,4 +1,4 @@
 # See pkgs/build-support/setup-hooks/role.bash
 getHostRole
 
-export NIX_${role_pre}LDFLAGS+=" -lfts"
+export NIX_LDFLAGS${role_post}+=" -lfts"
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index c1fb3ef5ee1a..04217b8989bc 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gpsd libcap libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/pkg-config"
+    makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index 5767c4aa72c4..3b1cf183e08e 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/pkg-config"
+    makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 52b280c30261..59656f54db28 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -29,8 +29,8 @@ let
       "cc-version:=9999"
       "cc-fullversion:=999999"
       # `$(..)` expanded by make alone
-      "HOSTCC:=$(BUILD_CC)"
-      "HOSTCXX:=$(BUILD_CXX)"
+      "HOSTCC:=$(CC_FOR_BUILD)"
+      "HOSTCXX:=$(CXX_FOR_BUILD)"
     ];
 
     # Skip clean on darwin, case-sensitivity issues.
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c715c7baf787..d239455ad344 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -42,7 +42,7 @@ let
       TIMER_STATS               = whenOlder "4.11" yes;
       DEBUG_NX_TEST             = whenOlder "4.11" no;
       DEBUG_STACK_USAGE         = no;
-      DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) no;
+      DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) (option no);
       RCU_TORTURE_TEST          = no;
       SCHEDSTATS                = no;
       DETECT_HUNG_TASK          = yes;
@@ -184,7 +184,6 @@ let
 
       # needed for ss
       INET_DIAG         = yes;
-      INET_TCP_DIAG     = module;
       INET_UDP_DIAG     = module;
       INET_RAW_DIAG     = whenAtLeast "4.14" module;
       INET_DIAG_DESTROY = whenAtLeast "4.9" yes;
@@ -365,7 +364,7 @@ let
       CIFS_STATS        = whenOlder "4.19" yes;
       CIFS_WEAK_PW_HASH = yes;
       CIFS_UPCALL       = yes;
-      CIFS_ACL          = yes;
+      CIFS_ACL          = option yes;
       CIFS_DFS_UPCALL   = yes;
       CIFS_SMB2         = whenOlder "4.13" yes;
 
@@ -396,7 +395,7 @@ let
       DEBUG_SET_MODULE_RONX            = { optional = true; tristate = whenOlder "4.11" "y"; };
       RANDOMIZE_BASE                   = option yes;
       STRICT_DEVMEM                    = option yes; # Filter access to /dev/mem
-      SECURITY_SELINUX_BOOTPARAM_VALUE = freeform "0"; # Disable SELinux by default
+      SECURITY_SELINUX_BOOTPARAM_VALUE = option (freeform "0"); # Disable SELinux by default
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
       DEVKMEM                          = mkIf (!features.grsecurity) no; # Disable /dev/kmem
@@ -709,7 +708,7 @@ let
       KEXEC_JUMP      = option yes;
 
       # Windows Logical Disk Manager (Dynamic Disk) support
-      LDM_PARTITION         = yes;
+      LDM_PARTITION         = option yes;
       LOGIRUMBLEPAD2_FF     = yes; # Logitech Rumblepad 2 force feedback
       LOGO                  = no; # not needed
       MEDIA_ATTACH          = yes;
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index e6e1bd842363..a9d0cf451688 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -158,11 +158,8 @@ let
         ;
       }).config;
 
-      #
       structuredConfig = moduleStructuredConfig.settings;
     };
-
-
   }; # end of configfile derivation
 
   kernel = (callPackage ./manual-config.nix {}) {
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index b1abf50f5f1f..a70cb2e087fc 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -14,6 +14,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" "pic" "relro" "pie" ];
 
+  # Prevent kexec-tools from using uname to detect target, which is wrong in
+  # cases like compiling for aarch32 on aarch64
+  configurePlatforms = [ "build" "host" ];
   configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ zlib ];
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index a27f65852023..258da07c40b6 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-12.3.1";
+  name = "sysstat-12.3.2";
 
   src = fetchurl {
     url = "http://pagesperso-orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "1hf1sy7akribmgavadqccxpy49yv0zfb3m81d2bj6jf8pyzwcrbq";
+    sha256 = "0gaas16q2f7qmrv4sbqk2l2mrc7yr64s33bzw4094p59fkylm7k4";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 73944bd6eb70..c23c37aa56d0 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "03c80acbv2znfxs1l32yx30znmjrqq7kxhiwl2309lpf5s10vdkc";
+    sha256 = "0hpkqm2bpg1ma2shjzcf6xsrpyjd8h5cakgh8a3iyh126wjl5z15";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index b9fb104d5f6c..e15efd4b47d1 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -3,7 +3,7 @@
 , xorg, libcap, alsaLib, glib, dconf
 , avahi, libjack2, libasyncns, lirc, dbus
 , sbc, bluez5, udev, openssl, fftwFloat
-, speexdsp, systemd, webrtc-audio-processing
+, soxr, speexdsp, systemd, webrtc-audio-processing
 
 , x11Support ? false
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     lib.optionals stdenv.isLinux [ libcap ];
 
   buildInputs =
-    [ libtool libsndfile speexdsp fftwFloat ]
+    [ libtool libsndfile soxr speexdsp fftwFloat ]
     ++ lib.optionals stdenv.isLinux [ glib dbus ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices AudioUnit Cocoa ]
     ++ lib.optionals (!libOnly) (
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index e3fc66045301..fb6835775fbf 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./. (args // {
-  version = "3.1.7";
-  sha256 = "16pmdms454jbralaw6rpx0rjlf2297p6h3q8wfk0n87kbn7vrxv4";
+  version = "3.1.8";
+  sha256 = "0yrzhsxmjiwkhchagx8dymzhvxl3k5h40wn9wpicqjvgjb9k8523";
 })
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ef1ebfc32c1b..b69de041fd23 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -36,9 +36,7 @@ in rec {
     export NIX_IGNORE_LD_THROUGH_GCC=1
     export SDKROOT=
 
-    # Ensure consistent LC_VERSION_MIN_MACOSX and remove LC_UUID.
     export MACOSX_DEPLOYMENT_TARGET=${macosVersionMin}
-    export NIX_LDFLAGS+=" -macosx_version_min ${macosVersionMin} -sdk_version ${appleSdkVersion} -no_uuid"
 
     # Workaround for https://openradar.appspot.com/22671534 on 10.11.
     export gl_cv_func_getcwd_abort_bug=no
@@ -307,7 +305,7 @@ in rec {
       inherit
         gnumake gzip gnused bzip2 gawk ed xz patch bash python3
         ncurses libffi zlib gmp pcre gnugrep
-        coreutils findutils diffutils patchutils ninja;
+        coreutils findutils diffutils patchutils ninja libxml2;
 
       # Hack to make sure we don't link ncurses in bootstrap tools. The proper
       # solution is to avoid passing -L/nix-store/...-bootstrap-tools/lib,
@@ -321,7 +319,7 @@ in rec {
       llvmPackages_7 = super.llvmPackages_7 // (let
         tools = super.llvmPackages_7.tools.extend (llvmSelf: _: {
           clang-unwrapped = llvmPackages_7.clang-unwrapped.override { llvm = llvmSelf.llvm; };
-          llvm = llvmPackages_7.llvm.override { libxml2 = self.darwin.libxml2-nopython; };
+          llvm = llvmPackages_7.llvm.override { inherit libxml2; };
         });
         libraries = super.llvmPackages_7.libraries.extend (llvmSelf: _: {
           inherit (llvmPackages_7) libcxx libcxxabi compiler-rt;
@@ -332,9 +330,8 @@ in rec {
         inherit (darwin) dyld Libsystem libiconv locale;
 
         cctools = super.darwin.cctools.override { enableTapiSupport = false; };
-        libxml2-nopython = super.libxml2.override { pythonSupport = false; };
         CF = super.darwin.CF.override {
-          libxml2 = libxml2-nopython;
+          inherit libxml2;
           python3 = prevStage.python3;
         };
       };
@@ -419,9 +416,9 @@ in rec {
       gnugrep llvmPackages.clang-unwrapped llvmPackages.clang-unwrapped.lib patch pcre.out gettext
       binutils.bintools darwin.binutils darwin.binutils.bintools
       curl.out openssl.out libssh2.out nghttp2.lib libkrb5
-      cc.expand-response-params
+      cc.expand-response-params libxml2.out
     ]) ++ (with pkgs.darwin; [
-      dyld Libsystem CF cctools ICU libiconv locale libxml2-nopython.out
+      dyld Libsystem CF cctools ICU libiconv locale
     ]);
 
     overrides = lib.composeExtensions persistent (self: super: {
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 77d70e84258d..e17b41eab320 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -98,7 +98,7 @@ let
       # TODO: This really wants to be in stdenv/darwin but we don't have hostPlatform
       # there (yet?) so it goes here until then.
       preHook = preHook+ lib.optionalString buildPlatform.isDarwin ''
-        export NIX_BUILD_DONT_SET_RPATH=1
+        export NIX_DONT_SET_RPATH_FOR_BUILD=1
       '' + lib.optionalString (hostPlatform.isDarwin || (hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.elf && hostPlatform.parsed.kernel.execFormat != lib.systems.parse.execFormats.macho)) ''
         export NIX_DONT_SET_RPATH=1
         export NIX_NO_SELF_RPATH=1
@@ -107,7 +107,7 @@ let
       # think the best solution would just be to fixup linux RPATHs so we don't
       # need to set `-rpath` anywhere.
       # + lib.optionalString targetPlatform.isDarwin ''
-      #   export NIX_TARGET_DONT_SET_RPATH=1
+      #   export NIX_DONT_SET_RPATH_FOR_TARGET=1
       # ''
       ;
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 09879451d8e4..993ae68e9e81 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -262,7 +262,7 @@ in rec {
               else if isx86_32  then "x86"
               else if isx86_64  then "x86_64"
               else platform.parsed.cpu.family + builtins.toString platform.parsed.cpu.bits;
-            crossFile = builtins.toFile "cross-file.conf" (''
+            crossFile = builtins.toFile "cross-file.conf" ''
               [properties]
               needs_exe_wrapper = true
 
@@ -271,13 +271,7 @@ in rec {
               cpu_family = '${cpuFamily stdenv.targetPlatform}'
               cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
               endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
-            ''
-            # TODO should have target prefix too, issue #86077
-            + ''
-
-              [binaries]
-              pkgconfig = 'pkg-config'
-            '');
+            '';
           in [ "--cross-file=${crossFile}" ] ++ mesonFlags;
         } // lib.optionalAttrs (attrs.enableParallelBuilding or false) {
           enableParallelChecking = attrs.enableParallelChecking or true;
diff --git a/pkgs/test/cross/default.nix b/pkgs/test/cross/default.nix
index 6c31a16f2fd5..c5a241437732 100644
--- a/pkgs/test/cross/default.nix
+++ b/pkgs/test/cross/default.nix
@@ -13,7 +13,7 @@ let
   compareTest = { emulator, pkgFun, hostPkgs, crossPkgs, exec, args ? [] }: let
     pkgName = (pkgFun hostPkgs).name;
     args' = lib.concatStringsSep " " args;
-  in pkgs.runCommand "test-${pkgName}-${crossPkgs.hostPlatform.config}" {
+  in crossPkgs.runCommand "test-${pkgName}-${crossPkgs.hostPlatform.config}" {
     nativeBuildInputs = [ pkgs.dos2unix ];
   } ''
     # Just in case we are using wine, get rid of that annoying extra
@@ -91,6 +91,20 @@ let
       pkgFun = pkgs: pkgs.hello;
     };
 
+    pkg-config = {platformFun, crossPkgs, emulator}: crossPkgs.runCommand
+      "test-pkg-config-${crossPkgs.hostPlatform.config}"
+    {
+      depsBuildBuild = [ crossPkgs.pkgsBuildBuild.pkg-config ];
+      nativeBuildInputs = [ crossPkgs.pkgsBuildHost.pkg-config crossPkgs.buildPackages.zlib ];
+      depsBuildTarget = [ crossPkgs.pkgsBuildTarget.pkg-config ];
+      buildInputs = [ crossPkgs.zlib ];
+      NIX_DEBUG = 7;
+    } ''
+       mkdir $out
+       ${crossPkgs.pkgsBuildBuild.pkg-config.targetPrefix}pkg-config --cflags zlib > "$out/for-build"
+       ${crossPkgs.pkgsBuildHost.pkg-config.targetPrefix}pkg-config --cflags zlib > "$out/for-host"
+       ! diff "$out/for-build" "$out/for-host"
+    '';
   };
 
 in {
diff --git a/pkgs/test/kernel.nix b/pkgs/test/kernel.nix
index 86f1b8d8e9ac..a4da10030332 100644
--- a/pkgs/test/kernel.nix
+++ b/pkgs/test/kernel.nix
@@ -1,53 +1,79 @@
+# to run these tests:
+# nix-instantiate --eval --strict . -A tests.kernel-config
+#
+# make sure to use NON EXISTING kernel settings else they may conflict with
+# common-config.nix
 { lib, pkgs }:
 
-with lib.kernel;
-with lib.asserts;
-with lib.modules;
+with lib;
+with kernel;
 
-# To test nixos/modules/system/boot/kernel_config.nix;
 let
-  # copied from release-lib.nix
-  assertTrue = bool:
-    if bool
-    then pkgs.runCommand "evaluated-to-true" {} "touch $out"
-    else pkgs.runCommand "evaluated-to-false" {} "false";
-
   lts_kernel = pkgs.linuxPackages.kernel;
 
-  kernelTestConfig = structuredConfig: (lts_kernel.override {
-    structuredExtraConfig = structuredConfig;
-  }).configfile.structuredConfig;
+  # to see the result once the module transformed the lose structured config
+  getConfig = structuredConfig:
+    (lts_kernel.override {
+      structuredExtraConfig = structuredConfig;
+    }).configfile.structuredConfig;
 
   mandatoryVsOptionalConfig = mkMerge [
-    { USB_DEBUG = option yes;}
-    { USB_DEBUG = yes;}
+    { NIXOS_FAKE_USB_DEBUG = yes;}
+    { NIXOS_FAKE_USB_DEBUG = option yes; }
   ];
 
   freeformConfig = mkMerge [
-    { MMC_BLOCK_MINORS = freeform "32"; } # same as default, won't trigger any error
-    { MMC_BLOCK_MINORS = freeform "64"; } # will trigger an error but the message is not great:
+    { NIXOS_FAKE_MMC_BLOCK_MINORS = freeform "32"; } # same as default, won't trigger any error
+    { NIXOS_FAKE_MMC_BLOCK_MINORS = freeform "64"; } # will trigger an error but the message is not great:
   ];
 
   yesWinsOverNoConfig = mkMerge [
-    # default for "8139TOO_PIO" is no
-    { "8139TOO_PIO"  = yes; } # yes wins over no by default
-    { "8139TOO_PIO"  = no; }
+    # default for "NIXOS_TEST_BOOLEAN" is no
+    { "NIXOS_TEST_BOOLEAN"  = yes; } # yes wins over no by default
+    { "NIXOS_TEST_BOOLEAN"  = no; }
+  ];
+
+  optionalNoWins = mkMerge [
+    { NIXOS_FAKE_USB_DEBUG = option yes;}
+    { NIXOS_FAKE_USB_DEBUG = yes;}
+  ];
+
+  allOptionalRemainOptional = mkMerge [
+    { NIXOS_FAKE_USB_DEBUG = option yes;}
+    { NIXOS_FAKE_USB_DEBUG = option yes;}
   ];
+
 in
-{
+runTests {
+  testEasy = {
+    expr = (getConfig { NIXOS_FAKE_USB_DEBUG = yes;}).NIXOS_FAKE_USB_DEBUG;
+    expected = { tristate = "y"; optional = false; freeform = null; };
+  };
+
   # mandatory flag should win over optional
-  mandatoryCheck = (kernelTestConfig mandatoryVsOptionalConfig);
+  testMandatoryCheck = {
+    expr = (getConfig mandatoryVsOptionalConfig).NIXOS_FAKE_USB_DEBUG.optional;
+    expected = false;
+  };
+
+  testYesWinsOverNo = {
+    expr = (getConfig yesWinsOverNoConfig)."NIXOS_TEST_BOOLEAN".tristate;
+    expected = "y";
+  };
+
+  testAllOptionalRemainOptional = {
+    expr = (getConfig allOptionalRemainOptional)."NIXOS_FAKE_USB_DEBUG".optional;
+    expected = true;
+  };
 
   # check that freeform options are unique
   # Should trigger
-  # > The option `settings.MMC_BLOCK_MINORS.freeform' has conflicting definitions, in `<unknown-file>' and `<unknown-file>'
-  freeformCheck = let
-    res = builtins.tryEval ( (kernelTestConfig freeformConfig).MMC_BLOCK_MINORS.freeform);
-  in
-    assertTrue (res.success == false);
-
-  yesVsNoCheck = let
-    res = kernelTestConfig yesWinsOverNoConfig;
-  in
-    assertTrue (res."8139TOO_PIO".tristate == "y");
+  # > The option `settings.NIXOS_FAKE_MMC_BLOCK_MINORS.freeform' has conflicting definitions, in `<unknown-file>' and `<unknown-file>'
+  testTreeform = let
+    res = builtins.tryEval ( (getConfig freeformConfig).NIXOS_FAKE_MMC_BLOCK_MINORS.freeform);
+  in {
+    expr = res.success;
+    expected = false;
+  };
+
 }
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 2f89331f92c6..f919fb92ed1d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DZSTD_BUILD_SHARED:BOOL=${if enableShared then "ON" else "OFF"}"
+    # They require STATIC for bin/zstd and tests.
     "-DZSTD_LEGACY_SUPPORT:BOOL=${if legacySupport then "ON" else "OFF"}"
     "-DZSTD_BUILD_TESTS:BOOL=ON"
   ];
@@ -50,11 +51,15 @@ stdenv.mkDerivation rec {
   preInstall = ''
     substituteInPlace ../programs/zstdgrep \
       --replace ":-grep" ":-${gnugrep}/bin/grep" \
-      --replace ":-zstdcat" ":-$out/bin/zstdcat"
+      --replace ":-zstdcat" ":-$bin/bin/zstdcat"
 
     substituteInPlace ../programs/zstdless \
-      --replace "zstdcat" "$out/bin/zstdcat"
+      --replace "zstdcat" "$bin/bin/zstdcat"
   '';
+  # Don't duplicate the library code in runtime closures.
+  postInstall = stdenv.lib.optionalString enableShared ''rm "$out"/lib/libzstd.a'';
+
+  outputs = [ "bin" "dev" "man" "out" ];
 
   meta = with stdenv.lib; {
     description = "Zstandard real-time compression algorithm";
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index 7329d78c2c83..c3981b902f2b 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.8";
+  version = "1.12.10";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "1zrsf57bn9rmaa2qvavr1aisci76vwlx0viqpwmkw3ds2l33vdb8";
+    sha256 = "1apq9camys2gaw6y6ic1ld20cncfwpmxnzvh4j5zkbbjpf5hbcxj";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/openconnect_pa/default.nix b/pkgs/tools/networking/openconnect_pa/default.nix
index 2c452847aa3b..4b108dc303e8 100644
--- a/pkgs/tools/networking/openconnect_pa/default.nix
+++ b/pkgs/tools/networking/openconnect_pa/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   };
 
   preConfigure = ''
-      export PKG_CONFIG=${pkgconfig}/bin/pkg-config
+      export PKG_CONFIG=${pkgconfig}/bin/${pkgconfig.targetPrefix}pkg-config
       export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
       export LIBXML2_LIBS="-L${libxml2.out}/lib -lxml2"
   '';
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c95d210ffe5d..092b44bf984d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -335,7 +335,11 @@ in
       # break dependency cycles
       fetchurl = stdenv.fetchurlBoot;
       zlib = buildPackages.zlib.override { fetchurl = stdenv.fetchurlBoot; };
-      pkgconfig = buildPackages.pkgconfig.override { fetchurl = stdenv.fetchurlBoot; };
+      pkgconfig = buildPackages.pkgconfig.override (old: {
+        pkg-config = old.pkg-config.override {
+          fetchurl = stdenv.fetchurlBoot;
+        };
+      });
       perl = buildPackages.perl.override { fetchurl = stdenv.fetchurlBoot; };
       openssl = buildPackages.openssl.override {
         fetchurl = stdenv.fetchurlBoot;
@@ -7916,7 +7920,11 @@ in
 
   zssh = callPackage ../tools/networking/zssh { };
 
-  zstd = callPackage ../tools/compression/zstd { };
+  zstd = callPackage ../tools/compression/zstd {
+    cmake = cmake.override {
+      libarchive = libarchive.override { zstd = null; };
+    };
+  };
 
   zsync = callPackage ../tools/compression/zsync { };
 
@@ -10810,12 +10818,23 @@ in
 
   pmccabe = callPackage ../development/tools/misc/pmccabe { };
 
-  pkgconf = callPackage ../development/tools/misc/pkgconf {};
+  pkgconf-unwrapped = callPackage ../development/tools/misc/pkgconf {};
+  pkgconf = callPackage ../build-support/pkg-config-wrapper {
+    pkg-config = pkgconf-unwrapped;
+    baseBinName = "pkgconf";
+  };
 
-  pkg-config = callPackage ../development/tools/misc/pkg-config { };
+  pkg-config-unwrapped = callPackage ../development/tools/misc/pkg-config { };
+  pkg-config = callPackage ../build-support/pkg-config-wrapper {
+    pkg-config = pkg-config-unwrapped;
+  };
   pkgconfig = pkg-config; # added 2018-02-02
 
-  pkg-configUpstream = lowPrio (pkg-config.override { vanilla = true; });
+  pkg-configUpstream = lowPrio (pkg-config.override (old: {
+    pkg-config = old.pkg-config.override {
+      vanilla = true;
+    };
+  }));
   pkgconfigUpstream = pkg-configUpstream; # added 2018-02-02
 
   inherit (nodePackages) postcss-cli;
@@ -12180,6 +12199,8 @@ in
 
   gdk-pixbuf = callPackage ../development/libraries/gdk-pixbuf { };
 
+  gdk-pixbuf-xlib = callPackage ../development/libraries/gdk-pixbuf/xlib.nix { };
+
   gnome-sharp = callPackage ../development/libraries/gnome-sharp { };
 
   gnome-menus = callPackage ../development/libraries/gnome-menus { };
@@ -19805,7 +19826,7 @@ in
 
   gitAndTools = recurseIntoAttrs (callPackage ../applications/version-management/git-and-tools {});
 
-  inherit (gitAndTools) git gitFull gitSVN git-cola svn2git git-radar git-secret git-secrets transcrypt git-crypt ghq;
+  inherit (gitAndTools) git gitFull gitSVN git-cola git-doc svn2git git-radar git-secret git-secrets transcrypt git-crypt ghq;
 
   gitMinimal = git.override {
     withManual = false;