Merge branch 'staging-next'

Security fixes for a few packages are included.

pkgs/applications/audio/chuck/default.nix

@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, alsaLib, bison, flex, libsndfile, which
+{ stdenv, lib, fetchurl, alsaLib, bison, flex, libsndfile, which
 , AppKit, Carbon, CoreAudio, CoreMIDI, CoreServices, Kernel
+, xcbuild
 }:
 
 stdenv.mkDerivation rec {
@@ -11,31 +12,28 @@ stdenv.mkDerivation rec {
     sha256 = "02z7sglax3j09grj5s1skmw8z6wz7b21hjrm95nrrdpwbxabh079";
   };
 
-  buildInputs = [ bison flex libsndfile which ]
+  nativeBuildInputs = [ flex bison which ];
-    ++ stdenv.lib.optional (!stdenv.isDarwin) alsaLib
+
-    ++ stdenv.lib.optional stdenv.isDarwin [ AppKit Carbon CoreAudio CoreMIDI CoreServices Kernel ];
+  buildInputs = [ libsndfile ]
+    ++ lib.optional (!stdenv.isDarwin) alsaLib
+    ++ lib.optional stdenv.isDarwin [ AppKit Carbon CoreAudio CoreMIDI CoreServices Kernel ];
 
   patches = [ ./clang.patch ./darwin-limits.patch ];
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-Wno-missing-sysroot";
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-missing-sysroot";
-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-framework MultitouchSupport";
+  NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
     substituteInPlace src/makefile --replace "/usr/bin" "$out/bin"
-    substituteInPlace src/makefile.osx --replace "xcodebuild" "/usr/bin/xcodebuild"
+    substituteInPlace src/makefile.osx \
-    substituteInPlace src/makefile.osx --replace "weak_framework" "framework"
+      --replace "weak_framework" "framework" \
-    substituteInPlace src/makefile.osx --replace "MACOSX_DEPLOYMENT_TARGET=10.5" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
+      --replace "MACOSX_DEPLOYMENT_TARGET=10.5" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
   '';
 
-  buildPhase = ''
+  makeFlags = [ "-C src" "DESTDIR=$(out)/bin" ];
-    make -C src ${if stdenv.isDarwin then "osx" else "linux-alsa"}
+  buildFlags = [ (if stdenv.isDarwin then "osx" else "linux-alsa") ];
-  '';
 
-  installPhase = ''
+  meta = with lib; {
-    install -Dm755 ./src/chuck $out/bin/chuck
-  '';
-
-  meta = with stdenv.lib; {
     description = "Programming language for real-time sound synthesis and music creation";
     homepage = http://chuck.cs.princeton.edu;
     license = licenses.gpl2;

pkgs/applications/audio/radiotray-ng/default.nix

@@ -23,7 +23,7 @@
 # rt2rtng
 , python2
 # Testing
-, gmock
+, gtest
 # Fixup
 , wrapGAppsHook
 , makeWrapper
@@ -58,11 +58,10 @@ stdenv.mkDerivation rec {
     libxdg_basedir
     lsb-release
     wxGTK
-  ] ++ stdenv.lib.optional doCheck gmock
+  ] ++ gstInputs
-    ++ gstInputs
     ++ pythonInputs;
 
-  prePatch = ''
+  postPatch = ''
     for x in debian/CMakeLists.txt include/radiotray-ng/common.hpp data/*.desktop; do
       substituteInPlace $x --replace /usr $out
     done
@@ -74,14 +73,16 @@ stdenv.mkDerivation rec {
       --replace radiotray-ng-notification radiotray-ng-on
   '';
 
-  cmakeFlags = stdenv.lib.optional doCheck "-DBUILD_TESTS=ON";
+  cmakeFlags = [
+    "-DBUILD_TESTS=${if doCheck then "ON" else "OFF"}"
+  ];
 
   enableParallelBuilding = true;
 
- # XXX: as of 0.2.2, tries to download gmock instead of checking for provided
+  checkInputs = [ gtest ];
-  doCheck = false;
-
   checkPhase = "ctest";
+  # doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = false; # fails to pick up supplied gtest, tries to download it instead
 
   preFixup = ''
     gappsWrapperArgs+=(--suffix PATH : ${stdenv.lib.makeBinPath [ dbus ]})

pkgs/applications/graphics/exrtools/default.nix

@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0jpkskqs1yjiighab4s91jy0c0qxcscwadfn94xy2mm2bx2qwp4z";
   };
 
+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ stdenv openexr libpng12 libjpeg ];
 

pkgs/applications/graphics/feh/default.nix

@@ -15,8 +15,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" ];
 
-  nativeBuildInputs = [ makeWrapper xorg.libXt ]
+  nativeBuildInputs = [ makeWrapper xorg.libXt ];
-    ++ optionals doCheck [ perlPackages.TestCommand perlPackages.TestHarness ];
 
   buildInputs = [ xorg.libX11 xorg.libXinerama imlib2 libjpeg libpng curl libexif ];
 
@@ -36,8 +35,9 @@ stdenv.mkDerivation rec {
     install -D -m 644 man/*.1 $out/share/man/man1
   '';
 
-  checkPhase = ''
+  checkInputs = [ perlPackages.TestCommand perlPackages.TestHarness ];
-    PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl" make test
+  preCheck = ''
+    export PERL5LIB="${perlPackages.TestCommand}/lib/perl5/site_perl"
   '';
 
   doCheck = true;

pkgs/applications/misc/doomseeker/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, cmake, fetchFromBitbucket, pkgconfig, qtbase, qttools, qtmultimedia, zlib, bzip2 }:
+{ stdenv, cmake, fetchFromBitbucket, pkgconfig, qtbase, qttools, qtmultimedia, zlib, bzip2, xxd }:
 
 stdenv.mkDerivation rec {
   name = "doomseeker-${version}";
@@ -15,10 +15,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qtbase qtmultimedia zlib bzip2 ];
 
-  nativeBuildInputs = [ cmake qttools pkgconfig ];
+  nativeBuildInputs = [ cmake qttools pkgconfig xxd ];
 
   enableParallelBuilding = true;
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional stdenv.cc.isClang "-Wno-error=format-security";
+
   meta = with stdenv.lib; {
     homepage = http://doomseeker.drdteam.org/;
     description = "Multiplayer server browser for many Doom source ports";

pkgs/applications/misc/kiwix/default.nix

@@ -81,6 +81,11 @@ stdenv.mkDerivation rec {
     cd ../../..
   '';
 
+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
   configureFlags = [
     "--disable-static"
     "--disable-staticbins"

pkgs/applications/misc/ranger/default.nix

@@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {
 
     # give image previews out of the box when building with w3m
     substituteInPlace ranger/config/rc.conf \
-      --replace "set preview_images false" "set preview_images true" \
+      --replace "set preview_images false" "set preview_images true"
   '';
 
   meta =  with stdenv.lib; {

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -174,6 +174,7 @@ stdenv.mkDerivation {
       gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
     '';
 
+  passthru.execdir = "/bin";
   passthru.ffmpegSupport = true;
   passthru.gssSupport = true;
   # update with:

pkgs/applications/networking/browsers/firefox/common.nix

@@ -16,7 +16,7 @@
 
 ## optional libraries
 
-, alsaSupport ? true, alsaLib
+, alsaSupport ? stdenv.isLinux, alsaLib
 , pulseaudioSupport ? true, libpulseaudio
 , ffmpegSupport ? true, gstreamer, gst-plugins-base
 , gtk3Support ? !isTorBrowserLike, gtk2, gtk3, wrapGAppsHook
@@ -39,6 +39,10 @@
 , safeBrowsingSupport ? false
 , drmSupport ? false
 
+# macOS dependencies
+, xcbuild, CoreMedia, ExceptionHandling, Kerberos, AVFoundation, MediaToolbox
+, CoreLocation, Foundation, AddressBook, libobjc, cups, rsync
+
 ## other
 
 # As stated by Sylvestre Ledru (@sylvestre) on Nov 22, 2017 at
@@ -66,7 +70,14 @@ assert stdenv.cc.libc or null != null;
 
 let
   flag = tf: x: [(if tf then "--enable-${x}" else "--disable-${x}")];
-  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
+
+  default-toolkit = if stdenv.isDarwin then "cairo-cocoa"
+                    else "cairo-gtk${if gtk3Support then "3" else "2"}";
+
+  execdir = if stdenv.isDarwin
+            then "/Applications/${browserName}.app/Contents/MacOS"
+            else "/bin";
+  browserName = if stdenv.isDarwin then "Firefox" else "firefox";
 in
 
 stdenv.mkDerivation (rec {
@@ -90,13 +101,27 @@ stdenv.mkDerivation (rec {
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optionals ffmpegSupport [ gstreamer gst-plugins-base ]
   ++ lib.optional  gtk3Support gtk3
-  ++ lib.optional  gssSupport kerberos;
+  ++ lib.optional  gssSupport kerberos
+  ++ lib.optionals stdenv.isDarwin [ CoreMedia ExceptionHandling Kerberos
+                                     AVFoundation MediaToolbox CoreLocation
+                                     Foundation libobjc AddressBook cups ];
 
-  NIX_CFLAGS_COMPILE = "-I${nspr.dev}/include/nspr -I${nss.dev}/include/nss -I${glib.dev}/include/gio-unix-2.0";
+  NIX_CFLAGS_COMPILE = [ "-I${nspr.dev}/include/nspr"
+                         "-I${nss.dev}/include/nss"
+                         "-I${glib.dev}/include/gio-unix-2.0" ]
+                      ++ lib.optional stdenv.isDarwin [
+                         "-isystem ${llvmPackages.libcxx}/include/c++/v1"
+                         "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10" ];
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace js/src/jsmath.cpp --replace 'defined(HAVE___SINCOS)' 0
+  '';
 
   nativeBuildInputs =
     [ autoconf213 which gnused pkgconfig perl python2 cargo rustc ]
-    ++ lib.optional gtk3Support wrapGAppsHook ++ extraNativeBuildInputs;
+    ++ lib.optional gtk3Support wrapGAppsHook
+    ++ lib.optionals stdenv.isDarwin [ xcbuild rsync ]
+    ++ extraNativeBuildInputs;
 
   preConfigure = ''
     # remove distributed configuration files
@@ -110,11 +135,23 @@ stdenv.mkDerivation (rec {
   '' else ''
     make -f client.mk configure-files
     configureScript="$(realpath ./configure)"
-  '') + ''
+  '') + lib.optionalString (!isTorBrowserLike && lib.versionAtLeast version "53") ''
-    cxxLib=$( echo -n ${gcc}/include/c++/* )
+    export MOZCONFIG=$(pwd)/mozconfig
-    archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
 
-    test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
+    # Set C flags for Rust's bindgen program. Unlike ordinary C
+    # compilation, bindgen does not invoke $CC directly. Instead it
+    # uses LLVM's libclang. To make sure all necessary flags are
+    # included we need to look in a few places.
+    # TODO: generalize this process for other use-cases.
+
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+      $(< ${stdenv.cc}/nix-support/cc-cflags) \
+      ${stdenv.cc.default_cxx_stdlib_compile} \
+      ${lib.optionalString stdenv.cc.isClang "-idirafter ${stdenv.cc.cc}/lib/clang/${lib.getVersion stdenv.cc.cc}/include"} \
+      ${lib.optionalString stdenv.cc.isGNU "-isystem ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc} -isystem ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/$(cc -dumpmachine)"} \
+      $NIX_CFLAGS_COMPILE"
+
+    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
   '' + lib.optionalString googleAPISupport ''
     # Google API key used by Chromium and Firefox.
     # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
@@ -146,8 +183,9 @@ stdenv.mkDerivation (rec {
     "--enable-jemalloc"
     "--disable-maintenance-service"
     "--disable-gconf"
-    "--enable-default-toolkit=cairo-gtk${if gtk3Support then "3" else "2"}"
+    "--enable-default-toolkit=${default-toolkit}"
   ]
+  ++ lib.optional stdenv.isDarwin "--disable-xcode-checks"
   ++ lib.optional (lib.versionOlder version "61") "--enable-system-hunspell"
   ++ lib.optionals (lib.versionAtLeast version "56" && !stdenv.hostPlatform.isi686) [
     # on i686-linux: --with-libclang-path is not available in this configuration
@@ -223,7 +261,12 @@ stdenv.mkDerivation (rec {
     paxmark m dist/bin/xpcshell
   '';
 
-  postInstall = ''
+  installPhase = if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp -LR dist/Firefox.app $out/Applications
+  '' else null;
+
+  postInstall = lib.optionalString stdenv.isLinux ''
     # For grsecurity kernels
     paxmark m $out/lib/firefox*/{firefox,firefox-bin,plugin-container}
 
@@ -234,7 +277,7 @@ stdenv.mkDerivation (rec {
     gappsWrapperArgs+=(--argv0 "$out/bin/.firefox-wrapped")
   '';
 
-  postFixup = ''
+  postFixup = lib.optionalString stdenv.isLinux ''
     # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
     patchelf --set-rpath "${lib.getLib libnotify
       }/lib:$(patchelf --print-rpath "$out"/lib/firefox*/libxul.so)" \
@@ -244,11 +287,10 @@ stdenv.mkDerivation (rec {
   doInstallCheck = true;
   installCheckPhase = ''
     # Some basic testing
-    "$out/bin/firefox" --version
+    "$out${execdir}/${browserName}" --version
   '';
 
   passthru = {
-    browserName = "firefox";
     inherit version updateScript;
     isFirefox3Like = true;
     inherit isTorBrowserLike;
@@ -256,6 +298,8 @@ stdenv.mkDerivation (rec {
     inherit nspr;
     inherit ffmpegSupport;
     inherit gssSupport;
+    inherit execdir;
+    inherit browserName;
   } // lib.optionalAttrs gtk3Support { inherit gtk3; };
 
 } // overrides)

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -36,7 +36,7 @@ rec {
       description = "A web browser built from Firefox source tree";
       homepage = http://www.mozilla.com/en-US/firefox/;
       maintainers = with lib.maintainers; [ eelco ];
-      platforms = lib.platforms.linux;
+      platforms = lib.platforms.unix;
       license = lib.licenses.mpl20;
     };
     updateScript = callPackage ./update.nix {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -101,24 +101,28 @@ let
         ];
       };
 
-      buildInputs = [makeWrapper]
+      nativeBuildInputs = [ makeWrapper lndir ];
-        ++ lib.optional (browser ? gtk3) browser.gtk3;
+      buildInputs = lib.optional (browser ? gtk3) browser.gtk3;
 
-      buildCommand = ''
+      buildCommand = lib.optionalString stdenv.isDarwin ''
-        if [ ! -x "${browser}/bin/${browserName}" ]
+        mkdir -p $out/Applications
+        cp -R --no-preserve=mode,ownership ${browser}/Applications/${browserName}.app $out/Applications
+        rm -f $out${browser.execdir or "/bin"}/${browserName}
+      '' + ''
+        if [ ! -x "${browser}${browser.execdir or "/bin"}/${browserName}" ]
         then
-            echo "cannot find executable file \`${browser}/bin/${browserName}'"
+            echo "cannot find executable file \`${browser}${browser.execdir or "/bin"}/${browserName}'"
             exit 1
         fi
 
-        makeWrapper "$(readlink -v --canonicalize-existing "${browser}/bin/${browserName}")" \
+        makeWrapper "$(readlink -v --canonicalize-existing "${browser}${browser.execdir or "/bin"}/${browserName}")" \
-            "$out/bin/${browserName}${nameSuffix}" \
+          "$out${browser.execdir or "/bin"}/${browserName}${nameSuffix}" \
             --suffix-each MOZ_PLUGIN_PATH ':' "$plugins" \
             --suffix LD_LIBRARY_PATH ':' "$libs" \
             --suffix-each GTK_PATH ':' "$gtk_modules" \
             --suffix-each LD_PRELOAD ':' "$(cat $(filterExisting $(addSuffix /extra-ld-preload $plugins)))" \
             --prefix-contents PATH ':' "$(filterExisting $(addSuffix /extra-bin-path $plugins))" \
-            --suffix PATH ':' "$out/bin" \
+            --suffix PATH ':' "$out${browser.execdir or "/bin"}" \
             --set MOZ_APP_LAUNCHER "${browserName}${nameSuffix}" \
             --set MOZ_SYSTEM_DIR "$out/lib/mozilla" \
             ${lib.optionalString (browser ? gtk3)
@@ -144,7 +148,7 @@ let
 
         mkdir -p $out/lib/mozilla
         for ext in ${toString nativeMessagingHosts}; do
-            ${lndir}/bin/lndir -silent $ext/lib/mozilla $out/lib/mozilla
+            lndir -silent $ext/lib/mozilla $out/lib/mozilla
         done
 
         # For manpages, in case the program supplies them

pkgs/applications/networking/browsers/tor-browser-bundle/default.nix

@@ -337,6 +337,7 @@ stdenv.mkDerivation rec {
     $out/bin/tor-browser -version >/dev/null
   '';
 
+  passthru.execdir = "/bin";
   meta = with stdenv.lib; {
     description = "An unofficial version of the tor browser bundle, built from source";
     homepage = https://torproject.org/;

pkgs/applications/networking/feedreaders/rsstail/default.nix

@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     owner = "flok99";
   };
 
-  buildInputs = [ libmrss ]
+  buildInputs = [ libmrss ];
-    ++ stdenv.lib.optional doCheck cppcheck;
+  checkInputs = [ cppcheck ];
 
   postPatch = ''
     substituteInPlace Makefile --replace -liconv_hook ""

pkgs/applications/networking/instant-messengers/utox/default.nix

@@ -22,15 +22,16 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    check cmake pkgconfig
+    cmake pkgconfig
   ];
 
   cmakeFlags = [
     "-DENABLE_AUTOUPDATE=OFF"
-  ] ++ lib.optional (doCheck) "-DENABLE_TESTS=ON";
+    "-DENABLE_TESTS=${if doCheck then "ON" else "OFF"}"
-
+  ];
-  doCheck = stdenv.isLinux;
 
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  checkInputs = [ check ];
   checkPhase = ''
     runHook preCheck
     ctest -VV

pkgs/applications/networking/sniffers/wireshark/cmake.patch

@@ -1,19 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -19,6 +19,7 @@
- # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- #
- 
-+cmake_minimum_required(VERSION 3.7)
- project(Wireshark C CXX)
- 
- # Updated by make-version.pl
-@@ -40,7 +41,7 @@
- 	# Needed for GREATER_EQUAL operator
- 	cmake_minimum_required(VERSION 3.7)
- else()
--	cmake_minimum_required(VERSION 2.8.8)
-+	cmake_minimum_required(VERSION 3.7)
- endif()
- 
- # Needs to be set after cmake_minimum_required or cmake_policy(VERSION)

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -49,8 +49,11 @@ in stdenv.mkDerivation {
       name = "fix-timeout.patch";
       url = "https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff_plain;h=8b5b843fcbc3e03e0fc45f3caf8cf5fc477e8613;hp=94af9724d140fd132896b650d10c4d060788e4f0";
       sha256 = "1g2dm7lwsnanwp68b9xr9swspx7hfj4v3z44sz3yrfmynygk8zlv";
-    })
+    });
-    ++ stdenv.lib.optional stdenv.isDarwin ./cmake.patch;
+
+  postPatch = ''
+    sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
+  '';
 
   preBuild = ''
     export LD_LIBRARY_PATH="$PWD/run"

pkgs/applications/science/logic/aiger/default.nix

@@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   configurePhase = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+
     # Set up picosat, so we can build 'aigbmc'
     mkdir ../picosat
     ln -s ${picosat}/include/picosat/picosat.h ../picosat/picosat.h

pkgs/applications/science/logic/verit/default.nix

@@ -15,6 +15,11 @@ stdenv.mkDerivation rec {
   # --disable-static actually enables static linking here...
   dontDisableStatic = true;
 
+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}gcc
+    CXX=${stdenv.cc.targetPrefix}g++
+  '';
+
   makeFlags = [ "LEX=${flex}/bin/flex" ];
 
   preInstall = ''

pkgs/applications/version-management/fossil/default.nix

@@ -21,10 +21,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ tcl ];
 
   doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
-
+  preCheck = ''
-  checkTarget = "test";
-
-  preCheck = stdenv.lib.optional doCheck ''
     export TCLLIBPATH="${tcllib}/lib/tcllib${tcllib.version}"
   '';
   configureFlags = stdenv.lib.optional withJson "--json";

pkgs/applications/version-management/mr/default.nix

@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "15i9bs2i25l7ibv530ghy8280kklcgm5kr6j86s7iwcqqckd0czp";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   buildInputs = [ perl ];
 
   makeFlags = "PREFIX=$(out)";

pkgs/applications/version-management/subversion/default.nix

@@ -91,6 +91,7 @@ let
 
     enableParallelBuilding = true;
 
+    checkInputs = [ python ];
     doCheck = false; # fails 10 out of ~2300 tests
 
     meta = with stdenv.lib; {

pkgs/applications/virtualization/open-vm-tools/default.nix

@@ -41,6 +41,11 @@ stdenv.mkDerivation rec {
      sed -i 's,/sbin/shutdown,shutdown,' lib/system/systemLinux.c
   '';
 
+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
   configureFlags = [ "--without-kernel-modules" "--without-xmlsecurity" ]
     ++ lib.optional (!withX) "--without-x";
 

pkgs/applications/window-managers/velox/default.nix

@@ -47,7 +47,7 @@ in with self; stdenv.mkDerivation rec {
       --prefix PATH : "${stdenv.lib.makeBinPath [ dmenu-velox st-velox ]}"
   '';
 
-  enableParallelBuilding = true;
+  enableParallelBuilding = false; # https://hydra.nixos.org/build/79799608
 
   meta = {
     description = "velox window manager";

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -59,11 +59,11 @@ for cmd in \
     ar as ld nm objcopy objdump readelf ranlib strip strings size windres
 do
     if
-        PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
+        cmd_path=$(PATH=$_PATH command -v "@targetPrefix@${cmd}")
     then
         upper_case="$(echo "$cmd" | tr "[:lower:]" "[:upper:]")"
-        export "${role_pre}${upper_case}=@targetPrefix@${cmd}";
+        export "${role_pre}${upper_case}=${cmd_path}";
-        export "${upper_case}${role_post}=@targetPrefix@${cmd}";
+        export "${upper_case}${role_post}=${cmd_path}";
     fi
 done
 
@@ -72,5 +72,5 @@ done
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
-unset -v role_pre role_post cmd upper_case
+unset -v role_pre role_post cmd cmd_path upper_case
 set +u

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -109,10 +109,10 @@ fi
 
 export NIX_${role_pre}CC=@out@
 
-export ${role_pre}CC=@named_cc@
+export ${role_pre}CC=@out@/bin/@named_cc@
-export ${role_pre}CXX=@named_cxx@
+export ${role_pre}CXX=@out@/bin/@named_cxx@
-export CC${role_post}=@named_cc@
+export CC${role_post}=@out@/bin/@named_cc@
-export CXX${role_post}=@named_cxx@
+export CXX${role_post}=@out@/bin/@named_cxx@
 
 # If unset, assume the default hardening flags.
 : ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}

pkgs/desktops/gnome-3/core/gcr/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnupg, p11-kit, glib
 , libgcrypt, libtasn1, dbus-glib, gtk, pango, gdk_pixbuf, atk
-, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3 }:
+, gobjectIntrospection, makeWrapper, libxslt, vala, gnome3
+, python2 }:
 
 stdenv.mkDerivation rec {
   name = "gcr-${version}";
@@ -15,6 +16,10 @@ stdenv.mkDerivation rec {
     updateScript = gnome3.updateScript { packageName = "gcr"; attrPath = "gnome3.gcr"; };
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection libxslt makeWrapper vala ];
@@ -27,7 +32,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ glib gtk p11-kit ];
 
-  #doCheck = true;
+  checkInputs = [ python2 ];
+  doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
 
   #enableParallelBuilding = true; issues on hydra
 

pkgs/desktops/gnome-3/core/gnome-keyring/default.nix

@@ -22,14 +22,11 @@ stdenv.mkDerivation rec {
     pango gcr gdk_pixbuf atk p11-kit
   ];
 
-  # In 3.20.1, tests do not support Python 3
-  checkInputs = [ dbus python2 ];
-
   propagatedBuildInputs = [ glib libtasn1 libxslt ];
 
   nativeBuildInputs = [
     pkgconfig intltool docbook_xsl docbook_xml_dtd_42 wrapGAppsHook
-  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  ];
 
   configureFlags = [
     "--with-pkcs11-config=$$out/etc/pkcs11/" # installation directories
@@ -41,6 +38,9 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
+  # In 3.20.1, tests do not support Python 3
+  checkInputs = [ dbus python2 ];
+
   checkPhase = ''
     export HOME=$(mktemp -d)
     dbus-run-session \

pkgs/development/compilers/cmdstan/default.nix

@@ -10,10 +10,10 @@ stdenv.mkDerivation rec {
 
   buildFlags = "build";
   enableParallelBuilding = true;
-  nativeBuildInputs = stdenv.lib.optional doCheck python;
 
   doCheck = true;
-  checkPhase = "python ./runCmdStanTests.py src/test/interface";  # see #5368
+  checkInputs = [ python ];
+  checkPhase = "python ./runCmdStanTests.py src/test/interface"; # see #5368
 
   installPhase = ''
     mkdir -p $out/opt $out/bin

pkgs/development/compilers/ghc/8.0.2.nix

@@ -102,15 +102,16 @@ stdenv.mkDerivation rec {
     done
     # GHC is a bit confused on its cross terminology, as these would normally be
     # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CC="$CC_FOR_TARGET"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CXX="$CXX_FOR_TARGET"
-    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld"
+    # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export AS="$AS_FOR_TARGET"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export AR="$AR_FOR_TARGET"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export NM="$NM_FOR_TARGET"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export RANLIB="$RANLIB_FOR_TARGET"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export READELF="$READELF_FOR_TARGET"
+    export STRIP="$STRIP_FOR_TARGET"
 
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure

pkgs/development/compilers/ghc/8.2.2.nix

@@ -134,16 +134,16 @@ stdenv.mkDerivation rec {
     done
     # GHC is a bit confused on its cross terminology, as these would normally be
     # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CC="$CC_FOR_TARGET"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CXX="$CXX_FOR_TARGET"
     # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
     export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export AS="$AS_FOR_TARGET"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export AR="$AR_FOR_TARGET"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export NM="$NM_FOR_TARGET"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export RANLIB="$RANLIB_FOR_TARGET"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export READELF="$READELF_FOR_TARGET"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export STRIP="$STRIP_FOR_TARGET"
 
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure

pkgs/development/compilers/ghc/8.4.3.nix

@@ -114,16 +114,16 @@ stdenv.mkDerivation (rec {
     done
     # GHC is a bit confused on its cross terminology, as these would normally be
     # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CC="$CC_FOR_TARGET"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CXX="$CXX_FOR_TARGET"
     # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
     export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export AS="$AS_FOR_TARGET"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export AR="$AR_FOR_TARGET"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export NM="$NM_FOR_TARGET"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export RANLIB="$RANLIB_FOR_TARGET"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export READELF="$READELF_FOR_TARGET"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export STRIP="$STRIP_FOR_TARGET"
 
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure

pkgs/development/compilers/ghc/8.6.1.nix

@@ -98,16 +98,16 @@ stdenv.mkDerivation (rec {
     done
     # GHC is a bit confused on its cross terminology, as these would normally be
     # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CC="$CC_FOR_TARGET"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CXX="$CXX_FOR_TARGET"
     # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
     export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export AS="$AS_FOR_TARGET"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export AR="$AR_FOR_TARGET"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export NM="$NM_FOR_TARGET"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export RANLIB="$RANLIB_FOR_TARGET"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export READELF="$READELF_FOR_TARGET"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export STRIP="$STRIP_FOR_TARGET"
 
     echo -n "${buildMK}" > mk/build.mk
     sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure

pkgs/development/compilers/ghc/head.nix

@@ -100,16 +100,16 @@ stdenv.mkDerivation rec {
     done
     # GHC is a bit confused on its cross terminology, as these would normally be
     # the *host* tools.
-    export CC="${targetCC}/bin/${targetCC.targetPrefix}cc"
+    export CC="$CC_FOR_TARGET"
-    export CXX="${targetCC}/bin/${targetCC.targetPrefix}cxx"
+    export CXX="$CXX_FOR_TARGET"
     # Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177
     export LD="${targetCC.bintools}/bin/${targetCC.bintools.targetPrefix}ld${stdenv.lib.optionalString targetPlatform.isAarch32 ".gold"}"
-    export AS="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}as"
+    export AS="$AS_FOR_TARGET"
-    export AR="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ar"
+    export AR="$AR_FOR_TARGET"
-    export NM="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}nm"
+    export NM="$NM_FOR_TARGET"
-    export RANLIB="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}ranlib"
+    export RANLIB="$RANLIB_FOR_TARGET"
-    export READELF="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}readelf"
+    export READELF="$READELF_FOR_TARGET"
-    export STRIP="${targetCC.bintools.bintools}/bin/${targetCC.bintools.targetPrefix}strip"
+    export STRIP="$STRIP_FOR_TARGET"
 
     echo -n "${buildMK}" > mk/build.mk
     echo ${version} >VERSION

pkgs/development/compilers/glslang/default.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
     fi
   '';
 
+  doCheck = false; # fails 3 out of 3 tests (ctest)
+
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
     description = "Khronos reference front-end for GLSL and ESSL";

pkgs/development/compilers/openjdk/8.nix

@@ -106,6 +106,12 @@ let
     # https://github.com/JetBrains/jdk8u/commit/eaa5e0711a43d64874111254d74893fa299d5716
     + stdenv.lib.optionalString stdenv.cc.isGNU ''
       NIX_CFLAGS_COMPILE+=" -fno-lifetime-dse -fno-delete-null-pointer-checks -std=gnu++98 -Wno-error"
+    ''
+    # The configure script was confused by our passing these with full paths,
+    # so we explicitly override them to short variants.
+    + ''
+      CC=${stdenv.cc.targetPrefix}cc
+      CXX=${stdenv.cc.targetPrefix}c++
     '';
 
     configureFlags = [

pkgs/development/compilers/vala/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, flex, bison, libxslt, autoconf, graphviz
+{ stdenv, lib, fetchurl, pkgconfig, flex, bison, libxslt, autoconf, automake, graphviz
 , glib, libiconv, libintl, libtool, expat
 }:
 
@@ -7,13 +7,18 @@ let
   let
     atLeast = lib.versionAtLeast "${major}.${minor}";
   in stdenv.mkDerivation rec {
-    name = "vala-${major}.${minor}";
+    name = "vala-${version}";
+    version = "${major}.${minor}";
 
     src = fetchurl {
       url = "mirror://gnome/sources/vala/${major}/${name}.tar.xz";
       inherit sha256;
     };
 
+    postPatch = ''
+      patchShebangs tests
+    '';
+
     outputs = [ "out" "devdoc" ];
 
     nativeBuildInputs = [
@@ -26,6 +31,8 @@ let
     ] ++ lib.optional (atLeast "0.38") graphviz
       ++ extraBuildInputs;
 
+    doCheck = false; # fails, requires dbus daemon
+
     meta = with stdenv.lib; {
       description = "Compiler for GObject type system";
       homepage = https://wiki.gnome.org/Projects/Vala;

pkgs/development/guile-modules/guile-cairo/default.nix

@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ guile cairo expat ]
+  buildInputs = [ guile cairo expat ];
-    ++ stdenv.lib.optional doCheck guile-lib;
+  checkInputs = [ guile-lib ];
 
   doCheck = true;
 

pkgs/development/libraries/apr/default.nix

@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./is-this-a-compiler-bug.patch ];
 
+  # This test needs the net
+  postPatch = ''
+    rm test/testsock.*
+  '';
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 

pkgs/development/libraries/clucene-core/2.x.nix

@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
         $out/lib/libclucene-core.1.dylib
   '';
 
+  doCheck = false; # fails with "Unable to find executable: /build/clucene-core-2.3.3.4/build/bin/cl_test"
+
   meta = {
     description = "Core library for full-featured text search engine";
     longDescription = ''

pkgs/development/libraries/expat/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "expat-2.2.5";
+  name = "expat-2.2.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/expat/${name}.tar.bz2";
-    sha256 = "1xpd78sp7m34jqrw5x13bz7kgz0n6aj15wn4zj4gfx3ypbpk5p6r";
+    sha256 = "1wl1x93b5w457ddsdgj0lh7yjq4q6l7wfbgwhagkc8fm2qkkrd0p";
   };
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers

pkgs/development/libraries/fftw/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, lib, precision ? "double" }:
+{ fetchurl, stdenv, lib, precision ? "double", perl }:
 
 with lib;
 
@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  checkInputs = [ perl ];
+
   meta = with stdenv.lib; {
     description = "Fastest Fourier Transform in the West library";
     homepage = http://www.fftw.org/;

pkgs/development/libraries/gcc/libgcc/default.nix

@@ -46,22 +46,16 @@ stdenvNoLibs.mkDerivation rec {
     mkdir -p "$buildRoot/gcc"
     cd "$buildRoot/gcc"
     (
-      export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-      export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-      export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-      export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-      export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
       export AS=$AS_FOR_BUILD
       export CC=$CC_FOR_BUILD
       export CPP=$CPP_FOR_BUILD
       export CXX=$CXX_FOR_BUILD
       export LD=$LD_FOR_BUILD
 
-      export AS_FOR_TARGET=${stdenvNoLibs.cc}/bin/$AS
+      export AS_FOR_TARGET=$AS
-      export CC_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CC
+      export CC_FOR_TARGET=$CC
-      export CPP_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CPP
+      export CPP_FOR_TARGET=$CPP
-      export LD_FOR_TARGET=${stdenvNoLibs.cc.bintools}/bin/$LD
+      export LD_FOR_TARGET=$LD
 
       export NIX_BUILD_CFLAGS_COMPILE+=' -DGENERATOR_FILE=1'
 
@@ -87,23 +81,6 @@ stdenvNoLibs.mkDerivation rec {
     cd "$buildRoot/gcc/${hostPlatform.config}/libgcc"
     configureScript=$sourceRoot/configure
     chmod +x "$configureScript"
-
-    export AS_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$AS_FOR_BUILD
-    export CC_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CC_FOR_BUILD
-    export CPP_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CPP_FOR_BUILD
-    export CXX_FOR_BUILD=${buildPackages.stdenv.cc}/bin/$CXX_FOR_BUILD
-    export LD_FOR_BUILD=${buildPackages.stdenv.cc.bintools}/bin/$LD_FOR_BUILD
-
-    export AS=${stdenvNoLibs.cc}/bin/$AS
-    export CC=${stdenvNoLibs.cc}/bin/$CC
-    export CPP=${stdenvNoLibs.cc}/bin/$CPP
-    export CXX=${stdenvNoLibs.cc}/bin/$CXX
-    export LD=${stdenvNoLibs.cc.bintools}/bin/$LD
-
-    export AS_FOR_TARGET=${stdenvNoLibs.cc}/bin/$AS_FOR_TARGET
-    export CC_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CC_FOR_TARGET
-    export CPP_FOR_TARGET=${stdenvNoLibs.cc}/bin/$CPP_FOR_TARGET
-    export LD_FOR_TARGET=${stdenvNoLibs.cc.bintools}/bin/$LD_FOR_TARGET
   '';
 
   gccConfigureFlags = [

pkgs/development/libraries/gd/default.nix

@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # fails 2 tests
+
   meta = with stdenv.lib; {
     homepage = https://libgd.github.io/;
     description = "A dynamic image creation library";

pkgs/development/libraries/git2/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation (rec {
   name = "libgit2-${version}";
-  version = "0.26.0";
+  version = "0.26.6";
   # keep the version in sync with pythonPackages.pygit2 and gnome3.libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "0zrrmfkfhd2xb4879z5khjb6xsdklrm01f1lscrs2ks68v25fk78";
+    sha256 = "17pjvprmdrx4h6bb1hhc98w9qi6ki7yl57f090n9kbhswxqfs7s3";
   };
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];

pkgs/development/libraries/glibmm/default.nix

@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib libsigcxx ];
 
   enableParallelBuilding = true;
-  #doCheck = true; # some tests need network
+
+  doCheck = false; # fails. one test needs the net, another /etc/fstab
 
   meta = with stdenv.lib; {
     description = "C++ interface to the GLib library";

pkgs/development/libraries/glog/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, autoreconfHook, perl }:
 
 stdenv.mkDerivation rec {
   name = "glog-${version}";
@@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  checkInputs = [ perl ];
+  doCheck = false; # fails with "Mangled symbols (28 out of 380) found in demangle.dm"
+
   meta = with stdenv.lib; {
     homepage = https://github.com/google/glog;
     license = licenses.bsd3;

pkgs/development/libraries/gmime/2.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, zlib, libgpgerror, gobjectIntrospection }:
+{ stdenv, fetchurl, pkgconfig, glib, zlib, gnupg, libgpgerror, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   version = "2.6.23";
@@ -15,6 +15,17 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib zlib libgpgerror ];
   configureFlags = [ "--enable-introspection=yes" ];
 
+  postPatch = ''
+    substituteInPlace tests/testsuite.c \
+      --replace /bin/rm rm \
+      --replace /bin/mkdir mkdir
+
+    substituteInPlace tests/test-pkcs7.c \
+      --replace /bin/mkdir mkdir
+  '';
+
+  checkInputs = [ gnupg ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {

pkgs/development/libraries/gmime/3.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, zlib, gpgme, libidn, gobjectIntrospection }:
+{ stdenv, fetchurl, pkgconfig, glib, zlib, gnupg, gpgme, libidn, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   version = "3.2.0";
@@ -16,6 +16,13 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib ];
   configureFlags = [ "--enable-introspection=yes" ];
 
+  postPatch = ''
+    substituteInPlace tests/testsuite.c \
+      --replace /bin/rm rm
+  '';
+
+  checkInputs = [ gnupg ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {

pkgs/development/libraries/gpgme/default.nix

@@ -44,6 +44,10 @@ stdenv.mkDerivation rec {
     # https://www.gnupg.org/documentation/manuals/gpgme/Largefile-Support-_0028LFS_0029.html
     ++ lib.optional (system == "i686-linux") "-D_FILE_OFFSET_BITS=64";
 
+  checkInputs = [ which ];
+
+  doCheck = false; # fails 8 out of 26 tests with "GPGME: Decryption failed". Spooky!
+
   meta = with stdenv.lib; {
     homepage = https://gnupg.org/software/gpgme/index.html;
     description = "Library for making GnuPG easier to use";

pkgs/development/libraries/gstreamer/base/default.nix

@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = false; # fails, wants DRI access for OpenGL
+
   patches = [
     (fetchpatch {
         url = "https://bug794856.bugzilla-attachments.gnome.org/attachment.cgi?id=370414";

pkgs/development/libraries/gstreamer/good/default.nix

@@ -54,4 +54,7 @@ stdenv.mkDerivation rec {
   ++ optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
   ++ optionals stdenv.isLinux [ libv4l libpulseaudio libavc1394 libiec61883 ];
 
+  # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
+  doCheck = false;
+
 }

pkgs/development/libraries/gstreamer/legacy/gst-plugins-good/default.nix

@@ -36,6 +36,9 @@ stdenv.mkDerivation rec {
       --replace "${ncurses.dev}/lib" "${ncurses.out}/lib"
   '';
 
+  # fails 1 out of 65 tests with "Could not read TLS certificate from '../../tests/files/test-cert.pem': TLS support is not available"
+  doCheck = false;
+
   meta = {
     homepage = https://gstreamer.freedesktop.org;
 

pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix

@@ -17,23 +17,22 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl bison flex ];
   propagatedBuildInputs = [ glib libxml2 ];
 
-  patchPhase = ''
+  # See https://trac.macports.org/ticket/40783 for explanation of patch
+  patches = stdenv.lib.optional stdenv.isDarwin ./darwin.patch;
+
+  postPatch = ''
     sed -i -e 's/^   /\t/' docs/gst/Makefile.in docs/libs/Makefile.in docs/plugins/Makefile.in
-  ''
-  + stdenv.lib.optionalString stdenv.isDarwin ''
-    # Applying this patch manually to avoid a rebuild on Linux. Feel free to refactor later
-    # See https://trac.macports.org/ticket/40783 for explanation of patch
-    patch -p1 < ${./darwin.patch}
   '';
 
   configureFlags = [
     "--disable-examples"
-    "--enable-failing-tests"
     "--localstatedir=/var"
     "--disable-gtk-doc"
     "--disable-docbook"
   ];
 
+  doCheck = false; # fails. 2 tests crash
+
   postInstall = ''
     # Hm, apparently --disable-gtk-doc is ignored...
     rm -rf $out/share/gtk-doc

pkgs/development/libraries/harfbuzz/default.nix

@@ -2,10 +2,11 @@
 , icu, graphite2, harfbuzz # The icu variant uses and propagates the non-icu one.
 , withIcu ? false # recommended by upstream as default, but most don't needed and it's big
 , withGraphite2 ? true # it is small and major distros do include it
+, python
 }:
 
 let
-  version = "1.8.2";
+  version = "1.8.8";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -14,9 +15,14 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "0my6m9aqv4a8fc2pjwqx9pfdfh3a9mqvas4si4psi1b1867zi8y8";
+    sha256 = "1ag3scnm1fcviqgx2p4858y433mr0ndqw6zccnccrqcr9mpcird8";
   };
 
+  postPatch = ''
+    patchShebangs src/gen-def.py
+    patchShebangs test
+  '';
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
@@ -29,8 +35,10 @@ stdenv.mkDerivation {
   buildInputs = [ glib freetype cairo ]; # recommended by upstream
   propagatedBuildInputs = []
     ++ optional withGraphite2 graphite2
-    ++ optionals withIcu [ icu harfbuzz ]
+    ++ optionals withIcu [ icu harfbuzz ];
-    ;
+
+  checkInputs = [ python ];
+  doInstallCheck = false; # fails, probably a bug
 
   # Slightly hacky; some pkgs expect them in a single directory.
   postInstall = optionalString withIcu ''

pkgs/development/libraries/hunspell/default.nix

@@ -14,6 +14,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses readline ];
   nativeBuildInputs = [ autoreconfHook ];
 
+  postPatch = ''
+    patchShebangs tests
+  '';
+
   autoreconfFlags = "-vfi";
 
   configureFlags = [ "--with-ui" "--with-readline" ];

pkgs/development/libraries/jbig2dec/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, python }:
 
 stdenv.mkDerivation rec {
   name = "jbig2dec-0.14";
@@ -8,6 +8,13 @@ stdenv.mkDerivation rec {
     sha256 = "0k01hp0q4275fj4rbr1gy64svfraw5w7wvwl08yjhvsnpb1rid11";
   };
 
+  postPatch = ''
+    patchShebangs test_jbig2dec.py
+  '';
+
+  checkInputs = [ python ];
+  doCheck = false; # fails 1 of 4 tests
+
   meta = {
     homepage = https://www.ghostscript.com/jbig2dec.html;
     description = "Decoder implementation of the JBIG2 image compression format";

pkgs/development/libraries/ldns/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, openssl, perl, dns-root-data }:
+{ stdenv, fetchurl, fetchpatch, openssl, perl, which, dns-root-data }:
 
 stdenv.mkDerivation rec {
   pname = "ldns";
@@ -45,6 +45,9 @@ stdenv.mkDerivation rec {
     "ac_cv_func_realloc_0_nonnull=yes"
   ];
 
+  checkInputs = [ which ];
+  doCheck = false; # fails. missing some files
+
   postInstall = ''
     moveToOutput "bin/ldns-config" "$dev"
 

pkgs/development/libraries/libappindicator/default.nix

@@ -61,6 +61,8 @@ in stdenv.mkDerivation rec {
       --replace /usr/bin/file ${file}/bin/file
   '';
 
+  doCheck = false; # generates shebangs in check phase, too lazy to fix
+
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"

pkgs/development/libraries/libcdio/default.nix

@@ -8,12 +8,15 @@ stdenv.mkDerivation rec {
     sha256 = "0jr8ppdm80c533nzmrpz3iffnpc6nhvsria1di9f4jg1l19a03fd";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libcddb ncurses help2man ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Carbon IOKit ];
 
-  # Disabled due to several spurious test failures.
+  doCheck = true;
-  # doCheck = true;
 
   meta = with stdenv.lib; {
     description = "A library for OS-independent CD-ROM and CD image access";

pkgs/development/libraries/libdbusmenu/default.nix

@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
     "--disable-scrollkeeper"
   ] ++ optional (gtkVersion != "2") "--disable-dumper";
 
+  doCheck = false; # generates shebangs in check phase, too lazy to fix
+
   installFlags = [
     "sysconfdir=\${out}/etc"
     "localstatedir=\${TMPDIR}"

pkgs/development/libraries/libdevil/default.nix

@@ -42,6 +42,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postPatch = ''
+    for a in test/Makefile.in test/format_test/format_checks.sh.in ; do
+      substituteInPlace $a \
+        --replace /bin/bash ${stdenv.shell}
+    done
+  '';
+
   meta = with stdenv.lib; {
     homepage = http://openil.sourceforge.net/;
     description = "An image library which can can load, save, convert, manipulate, filter and display a wide variety of image formats";

pkgs/development/libraries/libdrm/default.nix

@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optional stdenv.isDarwin ./libdrm-apple.patch;
 
+  postPatch = ''
+    for a in */*-symbol-check ; do
+      patchShebangs $a
+    done
+  '';
+
   preConfigure = stdenv.lib.optionalString stdenv.isDarwin
     "echo : \\\${ac_cv_func_clock_gettime=\'yes\'} > config.cache";
 

pkgs/development/libraries/libfaketime/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, bash, perl }:
 
 stdenv.mkDerivation rec {
   name = "libfaketime-${version}";
@@ -13,10 +13,20 @@ stdenv.mkDerivation rec {
     ./no-date-in-gzip-man-page.patch
   ];
 
+  postPatch = ''
+    patchShebangs test src
+    for a in test/functests/test_exclude_mono.sh src/faketime.c ; do
+      substituteInPlace $a \
+        --replace /bin/bash ${stdenv.shell}
+    done
+  '';
+
   preBuild = ''
     makeFlagsArray+=(PREFIX="$out" LIBDIRNAME=/lib)
   '';
 
+  checkInputs = [ perl ];
+
   meta = with stdenv.lib; {
     description = "Report faked system time to programs without having to change the system-wide time";
     homepage = "https://github.com/wolfcw/libfaketime/";

pkgs/development/libraries/libglvnd/default.nix

@@ -16,11 +16,18 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 ];
   buildInputs = [ libX11 libXext glproto ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/GLX/Makefile.am \
+      --replace "-Wl,-Bsymbolic " ""
+    substituteInPlace src/EGL/Makefile.am \
+      --replace "-Wl,-Bsymbolic " ""
+  '';
+
   NIX_CFLAGS_COMPILE = [
     "-UDEFAULT_EGL_VENDOR_CONFIG_DIRS"
     # FHS paths are added so that non-NixOS applications can find vendor files.
     "-DDEFAULT_EGL_VENDOR_CONFIG_DIRS=\"${driverLink}/share/glvnd/egl_vendor.d:/etc/glvnd/egl_vendor.d:/usr/share/glvnd/egl_vendor.d\""
-  ];
+  ] ++ lib.optional stdenv.cc.isClang "-Wno-error";
 
   # Indirectly: https://bugs.freedesktop.org/show_bug.cgi?id=35268
   configureFlags  = stdenv.lib.optional stdenv.hostPlatform.isMusl "--disable-tls";
@@ -40,6 +47,6 @@ in stdenv.mkDerivation rec {
     description = "The GL Vendor-Neutral Dispatch library";
     homepage = https://github.com/NVIDIA/libglvnd;
     license = licenses.bsd2;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

pkgs/development/libraries/libgsf/default.nix

@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
 
-  buildInputs = [ gettext bzip2 zlib python ]
+  buildInputs = [ gettext bzip2 zlib python ];
-    ++ stdenv.lib.optional doCheck perl;
+  checkInputs = [ perl ];
 
   propagatedBuildInputs = [ libxml2 glib gdk_pixbuf libiconv ];
 

pkgs/development/libraries/libminc/default.nix

@@ -14,21 +14,26 @@ stdenv.mkDerivation rec {
     sha256 = "0mn4n3ihzcr1jw2g1vy6c8p4lkc88jwljk04argmj7k4djrgpxpa";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib netcdf nifticlib hdf5 ];
 
-  cmakeFlags = [ "-DBUILD_TESTING=${if doCheck then "TRUE" else "FALSE"}"
+  cmakeFlags = [
-                 "-DLIBMINC_MINC1_SUPPORT=TRUE"
+    "-DBUILD_TESTING=${if doCheck then "ON" else "OFF"}"
-                 "-DLIBMINC_BUILD_SHARED_LIBS=TRUE"
+    "-DLIBMINC_MINC1_SUPPORT=ON"
-                 "-DLIBMINC_USE_SYSTEM_NIFTI=TRUE" ];
+    "-DLIBMINC_BUILD_SHARED_LIBS=ON"
-
+    "-DLIBMINC_USE_SYSTEM_NIFTI=ON"
+  ];
 
+  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
   checkPhase = ''
     export LD_LIBRARY_PATH="$(pwd)"  # see #22060
     ctest -E 'ezminc_rw_test|minc_conversion' --output-on-failure
     # ezminc_rw_test can't find libminc_io.so.5.2.0; minc_conversion hits netcdf compilation issue
   '';
-  doCheck = true;
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/libmspack/default.nix

@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "libmspack-0.6alpha";
+  name = "libmspack-0.7.1alpha";
 
   src = fetchurl {
     url = "https://www.cabextract.org.uk/libmspack/${name}.tar.gz";
-    sha256 = "08gr2pcinas6bdqz3k0286g5cnksmcx813skmdwyca6bmj1fxnqy";
+    sha256 = "0zn4vwzk5ankgd0l88cipan19pzbzv0sm3fba17lvqwka3dp1acp";
   };
 
   meta = {

pkgs/development/libraries/libndctl/default.nix

@@ -31,6 +31,10 @@ in stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    patchShebangs test
+  '';
+
   preAutoreconf = ''
     substituteInPlace configure.ac --replace "which" "${which}/bin/which"
     substituteInPlace git-version --replace /bin/bash ${stdenv.shell}

pkgs/development/libraries/libosinfo/default.nix

@@ -14,9 +14,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkgconfig vala intltool gobjectIntrospection gtk-doc docbook_xsl
-  ] ++ stdenv.lib.optionals doCheck checkInputs;
+  ];
-  checkInputs = [ check curl perl ];
   buildInputs = [ glib libsoup libxml2 libxslt ];
+  checkInputs = [ check curl perl ];
 
   patches = [
     ./osinfo-db-data-dir.patch

pkgs/development/libraries/libpng/default.nix

@@ -3,9 +3,7 @@
 assert zlib != null;
 
 let
-  version = "1.6.34";
   patchVersion = "1.6.34";
-  sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
     sha256 = "1ha4npf9mfrzp0srg8a5amks5ww84xzfpjbsj8k3yjjpai798qg6";
@@ -14,10 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "libpng" + whenPatched "-apng" + "-${version}";
+  version = "1.6.34";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    inherit sha256;
+    sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
@@ -26,9 +25,7 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ zlib ];
 
-  # it's hard to cross-run tests and some check programs didn't compile anyway
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
-  makeFlags = stdenv.lib.optional (!doCheck) "check_PROGRAMS=";
-  doCheck = true; # not cross;
 
   passthru = { inherit zlib; };
 

pkgs/development/libraries/librdf/redland.nix

@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # Fix broken DT_NEEDED in lib/redland/librdf_storage_sqlite.so.
   NIX_CFLAGS_LINK = "-lraptor2";
 
+  doCheck = false; # fails 1 out of 17 tests with a segmentation fault
+
   meta = {
     homepage = http://librdf.org/;
     platforms = stdenv.lib.platforms.unix;

pkgs/development/libraries/libseccomp/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, getopt, makeWrapper }:
+{ stdenv, fetchurl, getopt, makeWrapper, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "libseccomp-${version}";
@@ -17,6 +17,9 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
+  checkInputs = [ utillinux ];
+  doCheck = false; # dependency cycle
+
   # Hack to ensure that patchelf --shrink-rpath get rids of a $TMPDIR reference.
   preFixup = "rm -rfv src";
 

pkgs/development/libraries/libsecret/default.nix

@@ -1,10 +1,9 @@
 { stdenv, fetchurl, glib, pkgconfig, intltool, libxslt, docbook_xsl
 , libgcrypt, gobjectIntrospection, vala_0_38, gnome3, libintl }:
-let
+
+stdenv.mkDerivation rec {
   pname = "libsecret";
   version = "0.18.5";
-in
-stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
@@ -12,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "1cychxc3ff8fp857iikw0n2s13s2mhw2dn1mr632f7w3sn6vvrww";
   };
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   outputs = [ "out" "dev" ];
 
   propagatedBuildInputs = [ glib ];
@@ -19,6 +22,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ libgcrypt gobjectIntrospection vala_0_38 ];
   # optional: build docs with gtk-doc? (probably needs a flag as well)
 
+  # checkInputs = [ python2 ];
+
+  doCheck = false; # fails. with python3 tests fail to evaluate, with python2 they fail to run python3
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;

pkgs/development/libraries/libsoup/default.nix

@@ -3,22 +3,19 @@
 , valaSupport ? true, vala_0_40
 , intltool, python3 }:
 
-let
-  pname = "libsoup";
-  version = "2.62.2";
-in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
+  pname = "libsoup";
+  version = "2.62.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
     sha256 = "1dkrz1iwsswscayfmjxqv2q00b87snlq9nxdccn5vck0vbinylwy";
   };
 
-  prePatch = ''
+  postPatch = ''
     patchShebangs libsoup/
-  '' + stdenv.lib.optionalString valaSupport
+  '' + stdenv.lib.optionalString valaSupport ''
-  ''
      substituteInPlace libsoup/Makefile.in --replace "\$(DESTDIR)\$(vapidir)" "\$(DESTDIR)\$(girdir)/../vala/vapi"
   '';
 

pkgs/development/libraries/libtoxcore/default.nix

@@ -30,8 +30,6 @@ let
     enableParallelBuilding = true;
 
     doCheck = false; # hangs, tries to access the net?
-
-    # for some reason the tests are not running - it says "No tests found!!"
     checkInputs = [ check ];
     checkPhase = "ctest";
 

pkgs/development/libraries/liburcu/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "01pbg67qy5hcssy2yi0ckqapzfclgdq93li2rmzw4pa3wh5j42cw";
   };
 
-  nativeBuildInputs = stdenv.lib.optional doCheck perl;
+  checkInputs = [ perl ];
 
   preCheck = "patchShebangs tests/unit";
   doCheck = true;

pkgs/development/libraries/libxml2/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl
+{ stdenv, lib, fetchurl, fetchpatch
 , zlib, xz, python2, findXMLCatalogs
 , buildPlatform, hostPlatform
 , pythonSupport ? buildPlatform == hostPlatform
@@ -20,9 +20,15 @@ in stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchurl { # CVE-2018-9251
+    (fetchpatch {
-      url = https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74.diff;
+      name = "CVE-2018-14567_CVE-2018-9251.patch";
-      sha256 = "01c5dnipz2rmv2dgma1ycvhyiyfvy9makyn6ywahm10jwk5chn3i";
+      url = https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74.patch;
+      sha256 = "1xpqsfkzhrqasza51c821mnds5l317djrz8086fmzpyf68vld03h";
+    })
+    (fetchpatch {
+      name = "CVE-2018-14404.patch";
+      url = https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594.patch;
+      sha256 = "19vp7p32vrninnfa7vk9ipw7n4cl1gg16xxbhjy2d0kwp1crvzqh";
     })
   ];
 

pkgs/development/libraries/libyaml/default.nix

@@ -1,5 +1,6 @@
 { stdenv, fetchurl }:
 let
+  # 0.2.1 broke the tests of pythonPackages.pyyaml 3.13
   version = "0.1.7";
 in
 stdenv.mkDerivation {

pkgs/development/libraries/libzip/default.nix

@@ -9,13 +9,19 @@ stdenv.mkDerivation rec {
     sha256 = "1633dvjc08zwwhzqhnv62rjf1abx8y5njmm8y16ik9iwd07ka6d9";
   };
 
+  postPatch = ''
+    patchShebangs test-driver
+    patchShebangs man/handle_links
+  '';
+
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ perl ];
   propagatedBuildInputs = [ zlib ];
 
-  preInstall = ''
+  preCheck = ''
-    patchShebangs man/handle_links
+    # regress/runtests is a generated file
+    patchShebangs regress
   '';
 
   # At least mysqlWorkbench cannot find zipconf.h; I think also openoffice

pkgs/development/libraries/lightning/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0sbs2lm8b9in2m8d52zf0x9gpp40x6r7sl6sha92yq3pr78rwa4v";
   };
 
-  buildInputs = stdenv.lib.optional doCheck libopcodes;
+  checkInputs = [ libopcodes ];
 
   doCheck = true;
 

pkgs/development/libraries/ncurses/default.nix

@@ -21,7 +21,9 @@ stdenv.mkDerivation rec {
     sha256 = "05qdmbmrrn88ii9f66rkcmcyzp1kb1ymkx7g040lfkd1nkp7w1da";
   };
 
-  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
+  # The patch st-0.7.patch needs to be removed, if ncurses is upgraded in the future.
+  # It is necessary for the 6.1 version of ncurses.
+  patches = [ ./st-0.7.patch ] ++ lib.optional (!stdenv.cc.isClang) ./clang.patch;
 
   outputs = [ "out" "dev" "man" ];
   setOutputFlags = false; # some aren't supported

pkgs/development/libraries/ncurses/st-0.7.patch

@@ -0,0 +1,13 @@
+diff --git a/misc/terminfo.src b/misc/terminfo.src
+index 84f4810..ac300a7 100644
+--- a/misc/terminfo.src
++++ b/misc/terminfo.src
+@@ -6260,7 +6260,7 @@ st-0.7|simpleterm 0.7,
+ 	     %=%t3%e%p1%d%;m,
+ 	sgr=%?%p9%t\E(0%e\E(B%;\E[0%?%p6%t;1%;%?%p2%t;4%;%?%p1%p3%|
+ 	    %t;7%;%?%p4%t;5%;%?%p5%t;2%;%?%p7%t;8%;m,
+-	Ss=\E]52;%p1%s;%p2%s\007, kDN3=\E[1;3B, kDN5=\E[1;5B,
++	Ms=\E]52;%p1%s;%p2%s\007, kDN3=\E[1;3B, kDN5=\E[1;5B,
+ 	kLFT3=\E[1;3D, kLFT5=\E[1;5D, kNXT3=\E[6;3~,
+ 	kNXT5=\E[6;5~, kPRV3=\E[5;3~, kPRV5=\E[5;5~,
+ 	kRIT3=\E[1;3C, kRIT5=\E[1;5C, kUP3=\E[1;3A, kUP5=\E[1;5A,

pkgs/development/libraries/netcdf/default.nix

@@ -16,6 +16,15 @@ in stdenv.mkDerivation rec {
     sha256 = "0hi61cdihwwvz5jz1l7yq712j7ca1cj4bhr8x0x7c2vlb1s9biw9";
   };
 
+  postPatch = ''
+    patchShebangs .
+
+    # this test requires the net
+    for a in ncdap_test/Makefile.am ncdap_test/Makefile.in; do
+      substituteInPlace $a --replace testurl.sh " "
+    done
+  '';
+
   nativeBuildInputs = [ m4 ];
   buildInputs = [ hdf5 curl mpi ];
 

pkgs/development/libraries/nlohmann_json/default.nix

@@ -15,9 +15,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
-  checkTarget = "test";
-
   enableParallelBuilding = true;
 
   cmakeFlags = [
@@ -26,6 +23,8 @@ stdenv.mkDerivation rec {
     "-DCMAKE_SYSTEM_NAME=Windows"
   ];
 
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+
   meta = with stdenv.lib; {
     description = "Header only C++ library for the JSON file format";
     homepage = https://github.com/nlohmann/json;

pkgs/development/libraries/nss/default.nix

@@ -55,6 +55,11 @@ in stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
 
+  # TODO(@oxij): investigate this: `make -n check` works but `make
+  # check` fails with "no rule", same for "installcheck".
+  doCheck = false;
+  doInstallCheck = false;
+
   postInstall = ''
     rm -rf $out/private
     mv $out/public $out/include

pkgs/development/libraries/openssl/default.nix

@@ -24,11 +24,19 @@ let
       ++ optional (versionOlder version "1.0.2" && hostPlatform.isDarwin)
            ./darwin-arch.patch;
 
-  postPatch = if (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) then ''
+    postPatch = ''
-    substituteInPlace crypto/async/arch/async_posix.h \
+      patchShebangs Configure
-      --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
+    '' + optionalString (versionOlder version "1.1.0") ''
-                '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+      patchShebangs test/*
-  '' else null;
+      for a in test/t* ; do
+        substituteInPlace "$a" \
+          --replace /bin/rm rm
+      done
+    '' + optionalString (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) ''
+      substituteInPlace crypto/async/arch/async_posix.h \
+        --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
+                  '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+    '';
 
     outputs = [ "bin" "dev" "out" "man" ];
     setOutputFlags = false;
@@ -38,6 +46,7 @@ let
     buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
 
     # TODO(@Ericson2314): Improve with mass rebuild
+    configurePlatforms = [];
     configureScript = {
         "x86_64-darwin"  = "./Configure darwin64-x86_64-cc";
         "x86_64-solaris" = "./Configure solaris64-x86_64-gcc";
@@ -56,13 +65,6 @@ let
           throw "Not sure what configuration to use for ${hostPlatform.config}"
       );
 
-    # TODO(@Ericson2314): Make unconditional on mass rebuild
-    ${if buildPlatform != hostPlatform then "configurePlatforms" else null} = [];
-
-    preConfigure = ''
-      patchShebangs Configure
-    '';
-
     configureFlags = [
       "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
@@ -120,8 +122,8 @@ let
 in {
 
   openssl_1_0_2 = common {
-    version = "1.0.2o";
+    version = "1.0.2p";
-    sha256 = "0kcy13l701054nhpbd901mz32v1kn4g311z0nifd83xs2jbmqgzc";
+    sha256 = "003xh9f898i56344vpvpxxxzmikivxig4xwlm7vbi7m8n43qxaah";
   };
 
   openssl_1_1_0 = common {

pkgs/development/libraries/p11-kit/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "p11-kit-${version}";
-  version = "0.23.12";
+  version = "0.23.13";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
     rev = version;
-    sha256 = "0pb3qlddzbw7dglwnrl7fs9g71vhqk7qzxnb1i4nw633qgy21ga1";
+    sha256 = "1z2rbw2qbwj64i88llc1mkf0263qa0kxc2350kg25r7mghxbw1y6";
   };
 
   outputs = [ "out" "dev"];

pkgs/development/libraries/pango/default.nix

@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = optional stdenv.isDarwin "--without-x";
 
+  doCheck = false; # fails 1 out of 12 tests with "Fontconfig error: Cannot load default config file"
+
   meta = with stdenv.lib; {
     description = "A library for laying out and rendering of text, with an emphasis on internationalization";
 

pkgs/development/libraries/pcre2/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "doc" "man" "devdoc" ];
 
+  doCheck = false; # fails 1 out of 3 tests, looks like a bug
+
   postFixup = ''
     moveToOutput bin/pcre2-config "$dev"
   '';

pkgs/development/libraries/pixman/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ]
     ++ stdenv.lib.optionals stdenv.cc.isClang [ autoconf automake libtool autoreconfHook ];
 
-  buildInputs = stdenv.lib.optional doCheck libpng;
+  buildInputs = [ libpng ];
 
   configureFlags = stdenv.lib.optional stdenv.isAarch32 "--disable-arm-iwmmxt";
 

pkgs/development/libraries/podofo/default.nix

@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
   # TODO(@Dridus) remove the ++ libc at next hash break
   buildInputs = [ lua5 ] ++ stdenv.lib.optional stdenv.isLinux stdenv.cc.libc;
 
+  preConfigure = ''
+    CC=${stdenv.cc.targetPrefix}cc
+    CXX=${stdenv.cc.targetPrefix}c++
+  '';
+
   cmakeFlags = "-DPODOFO_BUILD_SHARED=ON -DPODOFO_BUILD_STATIC=OFF";
 
   meta = {

pkgs/development/libraries/qca2/default.nix

@@ -10,16 +10,23 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ (stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security) qt ];
+  buildInputs = [ qt ]
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   enableParallelBuilding = true;
 
   # tells CMake to use this CA bundle file if it is accessible
-  preConfigure = ''export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt'';
+  preConfigure = ''
+    export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt
+  '';
 
   # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
   cmakeFlags = [ "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt" ];
 
+  postPatch = ''
+    sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
+  '';
+
   meta = with stdenv.lib; {
     description = "Qt Cryptographic Architecture";
     license = "LGPL";

pkgs/development/libraries/qt-5/modules/qtwebkit.nix

@@ -17,6 +17,9 @@ let
       url = "http://dev-www.libreoffice.org/src/5ade6ae2a99bc1e9e57031ca88d36dad-${name}.tar.gz";
       sha256 = "304636d4eccd81a14b6914d07b84c79ebb815288c76fe027b9ebff6ff24d5705";
     };
+    postPatch = ''
+      patchShebangs tests
+    '';
     buildInputs = [ perl ];
   };
 in
@@ -60,6 +63,8 @@ qtModule {
       ]
     ++ optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${getLib systemd}/lib/libudev"'';
 
+  doCheck = false; # fails 13 out of 13 tests (ctest)
+
   # Hack to avoid TMPDIR in RPATHs.
   preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
 

pkgs/development/libraries/science/biology/nifticlib/default.nix

@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib ];
 
   checkPhase = "ctest";
+  doCheck = false; # fails 7 out of 293 tests
 
   meta = with stdenv.lib; {
     homepage = https://sourceforge.net/projects/niftilib;

pkgs/development/libraries/silgraphite/graphite2.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, freetype, cmake }:
+{ stdenv, fetchurl, pkgconfig, freetype, cmake, python }:
 
 stdenv.mkDerivation rec {
   version = "1.3.6";
@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./macosx.patch ];
 
+  checkInputs = [ python ];
+  doCheck = false; # fails, probably missing something
+
   meta = {
     description = "An advanced font engine";
     maintainers = [ stdenv.lib.maintainers.raskin ];

pkgs/development/libraries/sqlite/default.nix

@@ -71,6 +71,8 @@ stdenv.mkDerivation rec {
     sed -i $out/lib/libsqlite3.la -e "s/dependency_libs=.*/dependency_libs='''/"
   '';
 
+  doCheck = false; # fails to link against tcl
+
   meta = {
     description = "A self-contained, serverless, zero-configuration, transactional SQL database engine";
     downloadPage = http://sqlite.org/download.html;

pkgs/development/libraries/twolame/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ libsndfile ];
 
+  doCheck = false; # fails with "../build-scripts/test-driver: line 107: -Mstrict: command not found"
+
   meta = with stdenv.lib;{
     description = "A MP2 encoder";
     longDescription = ''

pkgs/development/libraries/uthash/default.nix

@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   dontBuild = false;
 
-  buildInputs = stdenv.lib.optional doCheck perl;
-
   doCheck = true;
+  checkInputs = [ perl ];
   checkTarget = "-C tests/";
 
   installPhase = ''
@@ -30,4 +29,3 @@ stdenv.mkDerivation rec {
     platforms   = platforms.all;
   };
 }
-

pkgs/development/libraries/v8/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchgit, fetchFromGitHub, gyp, readline, python, which, icu
-, patchelf, coreutils, cctools
+, patchelf, coreutils, xcbuild
 , doCheck ? false
 , static ? false
 }:
@@ -124,13 +124,7 @@ stdenv.mkDerivation rec {
 
   # Patch based off of:
   # https://github.com/cowboyd/libv8/tree/v5.1.281.67.0/patches
-  patches = lib.optional (!doCheck) ./libv8-5.4.232.patch
+  patches = lib.optional (!doCheck) ./libv8-5.4.232.patch;
-  ++ stdenv.lib.optionals stdenv.isDarwin [ ./no-xcode.patch ];
-
-  prePatch = ''
-    chmod +w tools/gyp/pylib/gyp
-    chmod +w tools/gyp/pylib/gyp/xcode_emulation.py
-  '';
 
   postPatch = ''
     sed -i 's,#!/usr/bin/env python,#!${python}/bin/python,' gypfiles/gyp_v8
@@ -157,7 +151,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ which ];
   buildInputs = [ readline python icu ]
-    ++ stdenv.lib.optional stdenv.isDarwin cctools
+    ++ stdenv.lib.optional stdenv.isDarwin xcbuild
     ++ stdenv.lib.optional stdenv.isLinux patchelf;
 
   NIX_CFLAGS_COMPILE = "-Wno-error=strict-overflow -Wno-error=unused-function -Wno-error=attributes"

pkgs/development/libraries/v8/no-xcode.patch

@@ -1,64 +0,0 @@
---- a/tools/gyp/pylib/gyp/xcode_emulation.py
-+++ a/tools/gyp/pylib/gyp/xcode_emulation.py
-@@ -473,10 +473,16 @@
- 
-   def _XcodeSdkPath(self, sdk_root):
-     if sdk_root not in XcodeSettings._sdk_path_cache:
--      sdk_path = self._GetSdkVersionInfoItem(sdk_root, '--show-sdk-path')
--      XcodeSettings._sdk_path_cache[sdk_root] = sdk_path
--      if sdk_root:
--        XcodeSettings._sdk_root_cache[sdk_path] = sdk_root
-+      try:
-+        sdk_path = self._GetSdkVersionInfoItem(sdk_root, '--show-sdk-path')
-+        XcodeSettings._sdk_path_cache[sdk_root] = sdk_path
-+        if sdk_root:
-+          XcodeSettings._sdk_root_cache[sdk_path] = sdk_root
-+      except:
-+        # if this fails it's because xcodebuild failed, which means
-+        # the user is probably on a CLT-only system, where there
-+        # is no valid SDK root
-+        XcodeSettings._sdk_path_cache[sdk_root] = None
-     return XcodeSettings._sdk_path_cache[sdk_root]
- 
-   def _AppendPlatformVersionMinFlags(self, lst):
-@@ -606,10 +612,11 @@
-       framework_root = sdk_root
-     else:
-       framework_root = ''
--    config = self.spec['configurations'][self.configname]
--    framework_dirs = config.get('mac_framework_dirs', [])
--    for directory in framework_dirs:
--      cflags.append('-F' + directory.replace('$(SDKROOT)', framework_root))
-+    if 'SDKROOT' in self._Settings():
-+      config = self.spec['configurations'][self.configname]
-+      framework_dirs = config.get('mac_framework_dirs', [])
-+      for directory in framework_dirs:
-+        cflags.append('-F' + directory.replace('$(SDKROOT)', framework_root))
- 
-     self.configname = None
-     return cflags
-@@ -861,10 +868,11 @@
-     sdk_root = self._SdkPath()
-     if not sdk_root:
-       sdk_root = ''
--    config = self.spec['configurations'][self.configname]
--    framework_dirs = config.get('mac_framework_dirs', [])
--    for directory in framework_dirs:
--      ldflags.append('-F' + directory.replace('$(SDKROOT)', sdk_root))
-+    if 'SDKROOT' in self._Settings():
-+      config = self.spec['configurations'][self.configname]
-+      framework_dirs = config.get('mac_framework_dirs', [])
-+      for directory in framework_dirs:
-+        ldflags.append('-F' + directory.replace('$(SDKROOT)', sdk_root))
- 
-     platform_root = self._XcodePlatformPath(configname)
-     if sdk_root and platform_root and self._IsXCTest():
-@@ -1358,7 +1366,7 @@
-     if version:
-       version = re.match(r'(\d\.\d\.?\d*)', version).groups()[0]
-     else:
--      raise GypError("No Xcode or CLT version detected!")
-+      version = "7.0.0"
-     # The CLT has no build information, so we return an empty string.
-     version_list = [version, '']
-   version = version_list[0]