Merge pull request #73287 from NixOS/staging-next

Staging next

nixos/doc/manual/release-notes/rl-2003.xml

@@ -135,12 +135,19 @@
       <link linkend="opt-networking.interfaces">networking.interfaces.&lt;name&gt;.…</link> options.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The stdenv now runs all bash with <literal>set -u</literal>, to catch the use of undefined variables.
+      Before, it itself used <literal>set -u</literal> but was careful to unset it so other packages' code ran as before.
+      Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded.
+    </para>
+   </listitem>
    <listitem>
     <para>
      The SLIM Display Manager has been removed, as it has been unmaintained since 2013.
      Consider migrating to a different display manager such as LightDM (current default in NixOS),
      SDDM, GDM, or using the startx module which uses Xinitrc.
-     </para>
+    </para>
    </listitem>
    <listitem>
     <para>

nixos/modules/system/boot/systemd.nix

@@ -63,6 +63,7 @@ let
       "systemd-logind.service"
       "autovt@.service"
       "systemd-user-sessions.service"
+      "dbus-org.freedesktop.import1.service"
       "dbus-org.freedesktop.machine1.service"
       "user@.service"
       "user-runtime-dir@.service"
@@ -145,6 +146,7 @@ let
       "user.slice"
       "machine.slice"
       "machines.target"
+      "systemd-importd.service"
       "systemd-machined.service"
       "systemd-nspawn@.service"
 

nixos/tests/all-tests.nix

@@ -263,6 +263,7 @@ in
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
+  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};

nixos/tests/systemd-nspawn.nix

@@ -0,0 +1,58 @@
+import ./make-test.nix ({pkgs, lib, ...}:
+let
+  gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+    mkdir -p $out
+    export GNUPGHOME=$out
+    cat > foo <<EOF
+      %echo Generating a basic OpenPGP key
+      %no-protection
+      Key-Type: DSA
+      Key-Length: 1024
+      Subkey-Type: ELG-E
+      Subkey-Length: 1024
+      Name-Real: Joe Tester
+      Name-Email: joe@foo.bar
+      Expire-Date: 0
+      # Do a commit here, so that we can later print "done"
+      %commit
+      %echo done
+    EOF
+    gpg --batch --generate-key foo
+    rm $out/S.gpg-agent $out/S.gpg-agent.*
+    gpg --export joe@foo.bar -a > $out/pubkey.gpg
+  '');
+
+  nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } ''
+    mkdir -p $out
+    cd $out
+    dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
+    sha256sum testimage.raw > SHA256SUMS
+    export GNUPGHOME="$(mktemp -d)"
+    cp -R ${gpgKeyring}/* $GNUPGHOME
+    gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
+  '');
+in {
+  name = "opensmtpd";
+
+  nodes = {
+    server = { pkgs, ... }: {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      services.nginx = {
+        enable = true;
+        virtualHosts."server".root = nspawnImages;
+      };
+    };
+    client = { pkgs, ... }: {
+      environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $server->waitForUnit("nginx.service");
+    $client->waitForUnit("network-online.target");
+    $client->succeed("machinectl pull-raw --verify=signature http://server/testimage.raw");
+    $client->succeed("cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw");
+  '';
+})

pkgs/applications/audio/i-score/default.nix

@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    export CMAKE_PREFIX_PATH="$CMAKE_PREFIX_PATH:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
+    export CMAKE_PREFIX_PATH="''${CMAKE_PREFIX_PATH-}:$(echo "${jamomacore}/jamoma/share/cmake/Jamoma")"
   '';
 
   postInstall = ''rm $out/bin/i-score.sh'';

pkgs/applications/audio/mpg123/default.nix

@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.25.12";
+  name = "mpg123-1.25.13";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "1l9iwwgqzw6yg5zk9pqmlbfyq6d8dqysbmj0j3m8dyrxd34wgzhz";
+    sha256 = "02l915jq0ymndb082g6w89bpf66z04ifa1lr7ga3yycw6m46hc4h";
   };
 
   buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;

pkgs/applications/audio/mpg321/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libao, libmad, libid3tag, zlib, alsaLib
+{stdenv, fetchurl, fetchpatch, libao, libmad, libid3tag, zlib, alsaLib
 # Specify default libao output plugin to use (e.g. "alsa", "pulse" …).
 # If null, it will use the libao system default.
 , defaultAudio ? null
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-7263.patch";
+      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
+      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   configureFlags =

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.2188";
+  version = "8.1.2237";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "0ixq96l991b84sj66v63ds61yr75gx5zz411213yn6bz3s2fvlcv";
+    sha256 = "1qwh3cw5zmjmnk07g0nc8nz8k5nlq9ilvvygnfdjy1fqg69q8p0h";
   };
 
   enableParallelBuilding = true;

pkgs/applications/office/zotero/default.nix

@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "5.0.73";
+  version = "5.0.77";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0m2i3l0gy22h6c7rk39cd17vyksyz5l5py2fn9pza8lcbypkwf3l";
+    sha256 = "1dgxzprpb8f5wpmvlvkxix0xxckfgjsi3wfcy9mb221a17cv0029";
   };
 
   buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.23.0";
+  version = "2.24.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0rv0y45gcd3h191isppn77acih695v4pipdj031jvs9rd1ds0kr3";
+    sha256 = "06rpakbwzck85ncfsgv4xmq3iwab9d4f5y6dqhl8nvb2fccxcwcz";
   };
 
   outputs = [ "out" ];
@@ -93,7 +93,7 @@ stdenv.mkDerivation {
   ++ (if perlSupport then ["PERL_PATH=${perlPackages.perl}/bin/perl"] else ["NO_PERL=1"])
   ++ (if pythonSupport then ["PYTHON_PATH=${python}/bin/python"] else ["NO_PYTHON=1"])
   ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
-  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc/"])
+  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc"])
   ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
   ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1";
 

pkgs/applications/video/kodi/default.nix

@@ -8,7 +8,7 @@
 , libXt, libXmu, libXext
 , libXinerama, libXrandr
 , libXtst, libXfixes, systemd
-, alsaLib, libGLU_combined, glew, fontconfig, freetype, ftgl
+, alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
 , libjpeg, jasper, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
@@ -156,7 +156,7 @@ in stdenv.mkDerivation {
       openssl gperf tinyxml2 taglib libssh swig jre
       libX11 xorgproto libXt libXmu libXext
       libXinerama libXrandr libXtst libXfixes
-      alsaLib libGLU_combined glew fontconfig freetype ftgl
+      alsaLib libGL libGLU glew fontconfig freetype ftgl
       libjpeg jasper libpng libtiff
       libmpeg2 libsamplerate libmad
       libogg libvorbis flac libxslt systemd

pkgs/build-support/bintools-wrapper/default.nix

@@ -111,17 +111,13 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
         local dst="$1"
         local wrapper="$2"
         export prog="$3"
-        set +u
         substituteAll "$wrapper" "$out/bin/$dst"
-        set -u
         chmod +x "$out/bin/$dst"
       }
     ''
@@ -163,8 +159,6 @@ stdenv.mkDerivation {
         [[ -e "$underlying" ]] || continue
         wrap ${targetPrefix}$variant ${./ld-wrapper.sh} $underlying
       done
-
-      set +u
     '';
 
   emulation = let
@@ -205,11 +199,7 @@ stdenv.mkDerivation {
   ];
 
   postFixup =
-    ''
+    optionalString (libc != null) (''
-      set -u
-    ''
-
-    + optionalString (libc != null) (''
       ##
       ## General libc support
       ##
@@ -307,7 +297,6 @@ stdenv.mkDerivation {
     ''
 
     + ''
-      set +u
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
       substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
       substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash

pkgs/build-support/bintools-wrapper/setup-hook.sh

@@ -2,8 +2,6 @@
 #
 # See comments in cc-wrapper's setup hook. This works exactly the same way.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -73,4 +71,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post cmd upper_case
-set +u

pkgs/build-support/build-dotnet-package/default.nix

@@ -29,9 +29,9 @@ attrsOrig @
       configurePhase = ''
         runHook preConfigure
 
-        [ -z "$dontPlacateNuget" ] && placate-nuget.sh
+        [ -z "''${dontPlacateNuget-}" ] && placate-nuget.sh
-        [ -z "$dontPlacatePaket" ] && placate-paket.sh
+        [ -z "''${dontPlacatePaket-}" ] && placate-paket.sh
-        [ -z "$dontPatchFSharpTargets" ] && patch-fsharp-targets.sh
+        [ -z "''${dontPatchFSharpTargets-}" ] && patch-fsharp-targets.sh
 
         runHook postConfigure
       '';
@@ -69,7 +69,7 @@ attrsOrig @
 
         cp -rv ${arrayToShell outputFiles} "''${outputFilesArray[@]}" "$target"
 
-        if [ -z "$dontRemoveDuplicatedDlls" ]
+        if [ -z "''${dontRemoveDuplicatedDlls-}" ]
         then
           pushd "$out"
           remove-duplicated-dlls.sh

pkgs/build-support/cc-wrapper/default.nix

@@ -134,8 +134,6 @@ stdenv.mkDerivation {
 
   installPhase =
     ''
-      set -u
-
       mkdir -p $out/bin $out/nix-support
 
       wrap() {
@@ -224,8 +222,6 @@ stdenv.mkDerivation {
 
   postFixup =
     ''
-      set -u
-
       # Backwards compatability for packages expecting this file, e.g. with
       # `$NIX_CC/nix-support/dynamic-linker`.
       #

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -54,8 +54,6 @@
 # For more details, read the individual files where the mechanisms used to
 # accomplish this will be individually documented.
 
-set -u
-
 # Skip setup hook if we're neither a build-time dep, nor, temporarily, doing a
 # native compile.
 #
@@ -120,4 +118,3 @@ export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
 unset -v role_pre role_post
-set +u

pkgs/build-support/emacs/setup-hook.sh

@@ -1,11 +1,11 @@
 addEmacsVars () {
-  if test -d $1/share/emacs/site-lisp; then
+  if [[ -d "$1/share/emacs/site-lisp" ]]; then
-      export EMACSLOADPATH="$1/share/emacs/site-lisp:$EMACSLOADPATH"
+      export EMACSLOADPATH="$1/share/emacs/site-lisp${EMACSLOADPATH:+:}${EMACSLOADPATH-}"
   fi
 }
 
 # If this is for a wrapper derivation, emacs and the dependencies are all
 # run-time dependencies. If this is for precompiling packages into bytecode,
 # emacs is a compile-time dependency of the package.
-addEnvHooks "$targetOffset" addEmacsVars
+addEnvHooks "$hostOffset" addEmacsVars
 addEnvHooks "$targetOffset" addEmacsVars

pkgs/build-support/ocaml/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation (args // {
 
   setupHook = if setupHook == null && hasSharedObjects
   then writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
+    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
     ''
   else setupHook;
 

pkgs/build-support/setup-hooks/audit-tmpdir.sh

@@ -7,7 +7,7 @@
 # the moment that would produce too many spurious errors (e.g. debug
 # info or assertion messages that refer to $TMPDIR).
 
-fixupOutputHooks+=('if [ -z "$noAuditTmpdir" -a -e "$prefix" ]; then auditTmpdir "$prefix"; fi')
+fixupOutputHooks+=('if [[ -z "${noAuditTmpdir-}" && -e "$prefix" ]]; then auditTmpdir "$prefix"; fi')
 
 auditTmpdir() {
     local dir="$1"

pkgs/build-support/setup-hooks/auto-patchelf.sh

@@ -228,7 +228,7 @@ autoPatchelf() {
 # behaviour as fixupOutputHooks because the setup hook for patchelf is run in
 # fixupOutput and the postFixup hook runs later.
 postFixupHooks+=('
-    if [ -z "$dontAutoPatchelf" ]; then
+    if [ -z "${dontAutoPatchelf-}" ]; then
         autoPatchelf -- $(for output in $outputs; do
             [ -e "${!output}" ] || continue
             echo "${!output}"

pkgs/build-support/setup-hooks/compress-man-pages.sh

@@ -1,4 +1,4 @@
-fixupOutputHooks+=('if [ -z "$dontGzipMan" ]; then compressManPages "$prefix"; fi')
+fixupOutputHooks+=('if [ -z "${dontGzipMan-}" ]; then compressManPages "$prefix"; fi')
 
 compressManPages() {
     local dir="$1"

pkgs/build-support/setup-hooks/find-xml-catalogs.sh

@@ -11,12 +11,12 @@ addXMLCatalogs () {
     done
 }
 
-if [ -z "$libxmlHookDone" ]; then
+if [ -z "${libxmlHookDone-}" ]; then
     libxmlHookDone=1
 
     # Set up XML_CATALOG_FILES.  An empty initial value prevents
     # xmllint and xsltproc from looking in /etc/xml/catalog.
-    export XML_CATALOG_FILES
+    export XML_CATALOG_FILES=''
     if [ -z "$XML_CATALOG_FILES" ]; then XML_CATALOG_FILES=" "; fi
     addEnvHooks "$hostOffset" addXMLCatalogs
 fi

pkgs/build-support/setup-hooks/move-lib64.sh

@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_moveLib64)
 
 _moveLib64() {
-    if [ "$dontMoveLib64" = 1 ]; then return; fi
+    if [ "${dontMoveLib64-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/lib64" -o -L "$prefix/lib64" ]; then return; fi
     echo "moving $prefix/lib64/* to $prefix/lib"
     mkdir -p $prefix/lib

pkgs/build-support/setup-hooks/move-sbin.sh

@@ -5,7 +5,7 @@
 fixupOutputHooks+=(_moveSbin)
 
 _moveSbin() {
-    if [ "$dontMoveSbin" = 1 ]; then return; fi
+    if [ "${dontMoveSbin-}" = 1 ]; then return; fi
     if [ ! -e "$prefix/sbin" -o -L "$prefix/sbin" ]; then return; fi
     echo "moving $prefix/sbin/* to $prefix/bin"
     mkdir -p $prefix/bin

pkgs/build-support/setup-hooks/multiple-outputs.sh

@@ -9,8 +9,8 @@ _assignFirst() {
     local varName="$1"
     local REMOVE=REMOVE # slightly hacky - we allow REMOVE (i.e. not a variable name)
     shift
-    while [ $# -ge 1 ]; do
+    while (( $# )); do
-        if [ -n "${!1}" ]; then eval "${varName}"="$1"; return; fi
+        if [ -n "${!1-}" ]; then eval "${varName}"="$1"; return; fi
         shift
     done
     echo "Error: _assignFirst found no valid variant!"
@@ -19,7 +19,7 @@ _assignFirst() {
 
 # Same as _assignFirst, but only if "$1" = ""
 _overrideFirst() {
-    if [ -z "${!1}" ]; then
+    if [ -z "${!1-}" ]; then
         _assignFirst "$@"
     fi
 }

pkgs/build-support/setup-hooks/patch-shebangs.sh

@@ -105,7 +105,7 @@ patchShebangs() {
 }
 
 patchShebangsAuto () {
-    if [ -z "$dontPatchShebangs" -a -e "$prefix" ]; then
+    if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then
 
         # Dev output will end up being run on the build platform. An
         # example case of this is sdl2-config. Otherwise, we can just

pkgs/build-support/setup-hooks/prune-libtool-files.sh

@@ -8,7 +8,7 @@
 fixupOutputHooks+=(_pruneLibtoolFiles)
 
 _pruneLibtoolFiles() {
-    if [ "$dontPruneLibtoolFiles" ] || [ ! -e "$prefix" ]; then
+    if [ "${dontPruneLibtoolFiles-}" ] || [ ! -e "$prefix" ]; then
        return
     fi
 

pkgs/build-support/setup-hooks/strip.sh

@@ -10,7 +10,7 @@ _doStrip() {
     local -ra stripCmds=(STRIP TARGET_STRIP)
 
     # Optimization
-    if [[ "$STRIP" == "$TARGET_STRIP" ]]; then
+    if [[ "${STRIP-}" == "${TARGET_STRIP-}" ]]; then
         dontStripTarget+=1
     fi
 
@@ -20,7 +20,7 @@ _doStrip() {
         local -n stripCmd="${stripCmds[$i]}"
 
         # `dontStrip` disables them all
-        if [[ "$dontStrip" || "$flag" ]] || ! type -f "$stripCmd" 2>/dev/null
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null
         then continue; fi
 
         stripDebugList=${stripDebugList:-lib lib32 lib64 libexec bin sbin}

pkgs/build-support/setup-hooks/update-autotools-gnu-config-scripts.sh

@@ -1,7 +1,7 @@
 preConfigurePhases+=" updateAutotoolsGnuConfigScriptsPhase"
 
 updateAutotoolsGnuConfigScriptsPhase() {
-    if [ -n "$dontUpdateAutotoolsGnuConfigScripts" ]; then return; fi
+    if [ -n "${dontUpdateAutotoolsGnuConfigScripts-}" ]; then return; fi
 
     for script in config.sub config.guess; do
         for f in $(find . -type f -name "$script"); do

pkgs/build-support/setup-hooks/wrap-gapps-hook.sh

@@ -15,7 +15,7 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
-# Note: $gappsWrapperArgs still gets defined even if $dontWrapGApps is set.
+# Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
   # guard against running multiple times (e.g. due to propagation)
   [ -z "$wrapGAppsHookHasRun" ] || return 0

pkgs/desktops/gnome-3/core/mutter/3.28.nix

@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
     })
     # See patch commit message
     ./0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
+    # Fix build with libglvnd provided headers
+    ./libglvnd-328.patch
   ];
 
   configureFlags = [

pkgs/desktops/gnome-3/core/mutter/default.nix

@@ -66,6 +66,11 @@ stdenv.mkDerivation rec {
       src = ./fix-paths.patch;
       inherit zenity;
     })
+    # Fix build with libglvnd provided headers
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/mutter/commit/a444a4c5f58ea516ad3cd9d6ddc0056c3ca9bc90.patch";
+      sha256 = "0imy2j8af9477jliwdq4jc40yw1cifsjjf196gnmwxr9rkj0hbrd";
+    })
   ];
 
   postPatch = ''

pkgs/desktops/gnome-3/core/mutter/libglvnd-328.patch

@@ -0,0 +1,63 @@
+diff --git a/cogl/configure.ac b/cogl/configure.ac
+index 3be282f..d338cd1 100644
+--- a/cogl/configure.ac
++++ b/cogl/configure.ac
+@@ -490,6 +490,11 @@ AS_IF([test "x$enable_gles1" = "xyes"],
+ #include <EGL/eglext.h>"],
+                              [],
+                              [$COGL_EGL_INCLUDES])
++            AC_CHECK_HEADERS([EGL/eglmesaext.h],
++                             [COGL_EGL_INCLUDES="$COGL_EGL_INCLUDE
++#include <EGL/eglmesaext.h>"],
++                             [],
++                             [$COGL_EGL_INCLUDES])
+ 
+             # Check for a GLES 1.x Common Profile library with/without EGL.
+             #
+@@ -759,7 +764,9 @@ AS_IF([test "x$NEED_EGL" = "xyes" && test "x$EGL_CHECKED" != "xyes"],
+           )
+ 
+         COGL_EGL_INCLUDES="#include <EGL/egl.h>
+-#include <EGL/eglext.h>"
++#include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
++"
+         AC_SUBST([COGL_EGL_INCLUDES])
+       ])
+ 
+diff --git a/src/backends/meta-egl-ext.h b/src/backends/meta-egl-ext.h
+index 8705e7d..db0b74f 100644
+--- a/src/backends/meta-egl-ext.h
++++ b/src/backends/meta-egl-ext.h
+@@ -29,6 +29,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ 
+ /*
+  * This is a little different to the tests shipped with EGL implementations,
+diff --git a/src/backends/meta-egl.c b/src/backends/meta-egl.c
+index 755ec49..bd253c9 100644
+--- a/src/backends/meta-egl.c
++++ b/src/backends/meta-egl.c
+@@ -31,6 +31,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <gio/gio.h>
+ #include <glib.h>
+ #include <glib-object.h>
+diff --git a/src/backends/meta-egl.h b/src/backends/meta-egl.h
+index 060c7cd..2fef264 100644
+--- a/src/backends/meta-egl.h
++++ b/src/backends/meta-egl.h
+@@ -27,6 +27,7 @@
+ 
+ #include <EGL/egl.h>
+ #include <EGL/eglext.h>
++#include <EGL/eglmesaext.h>
+ #include <glib-object.h>
+ 
+ #define META_EGL_ERROR meta_egl_error_quark ()

pkgs/desktops/plasma-5/default.nix

@@ -43,7 +43,7 @@ let
       propagate = out:
         let setupHook = { writeScript }:
               writeScript "setup-hook" ''
-                if [ "$hookName" != postHook ]; then
+                if [ "${hookName:-}" != postHook ]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
                     # Propagate $${out} output

pkgs/development/compilers/adoptopenjdk-bin/jdk-darwin-base.nix

@@ -37,7 +37,7 @@ let cpuName = stdenv.hostPlatform.parsed.cpu.name;
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 

pkgs/development/compilers/adoptopenjdk-bin/jdk-linux-base.nix

@@ -54,7 +54,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> "$out/nix-support/setup-hook"
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 

pkgs/development/compilers/graalvm/default.nix

@@ -270,7 +270,7 @@ in rec {
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
     postFixup = openjdk.postFixup or null;

pkgs/development/compilers/graalvm/enterprise-edition.nix

@@ -72,7 +72,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 

pkgs/development/compilers/llvm/7/libc++/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -31,7 +32,8 @@ stdenv.mkDerivation {
     "-DLIBCXX_LIBCXXABI_LIB_PATH=${libcxxabi}/lib"
     "-DLIBCXX_LIBCPPABI_VERSION=2"
     "-DLIBCXX_CXX_ABI=libcxxabi"
-  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1";
+  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "-DLIBCXX_HAS_MUSL_LIBC=1"
+  ++ stdenv.lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF" ;
 
   enableParallelBuilding = true;
 

pkgs/development/compilers/llvm/7/libc++abi.nix

@@ -1,4 +1,6 @@
-{ stdenv, cmake, fetch, libcxx, llvm, version }:
+{ stdenv, cmake, fetch, libcxx, llvm, version
+  # on musl the shared objects don't build
+, enableShared ? ! stdenv.hostPlatform.isMusl }:
 
 stdenv.mkDerivation {
   pname = "libc++abi";
@@ -11,13 +13,15 @@ stdenv.mkDerivation {
   postUnpack = ''
     unpackFile ${libcxx.src}
     unpackFile ${llvm.src}
-    export cmakeFlags="-DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*)"
+    cmakeFlagsArray=($cmakeFlagsArray -DLLVM_PATH=$PWD/$(ls -d llvm-*) -DLIBCXXABI_LIBCXX_PATH=$PWD/$(ls -d libcxx-*) )
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     export TRIPLE=x86_64-apple-darwin
   '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
     patch -p1 -d $(ls -d libcxx-*) -i ${../libcxx-0001-musl-hacks.patch}
   '';
 
+  cmakeFlags = stdenv.lib.optional (!enableShared) "-DLIBCXXABI_ENABLE_SHARED=OFF";
+
   installPhase = if stdenv.isDarwin
     then ''
       for file in lib/*.dylib; do
@@ -34,10 +38,10 @@ stdenv.mkDerivation {
     else ''
       install -d -m 755 $out/include $out/lib
       install -m 644 lib/libc++abi.a $out/lib
-      install -m 644 lib/libc++abi.so.1.0 $out/lib
+      ${stdenv.lib.optionalString enableShared "install -m 644 lib/libc++abi.so.1.0 $out/lib"}
       install -m 644 ../include/cxxabi.h $out/include
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so"}
-      ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1
+      ${stdenv.lib.optionalString enableShared "ln -s libc++abi.so.1.0 $out/lib/libc++abi.so.1"}
     '';
 
   meta = {

pkgs/development/compilers/openjdk/11.nix

@@ -106,7 +106,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 

pkgs/development/compilers/openjdk/8.nix

@@ -231,7 +231,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 

pkgs/development/compilers/openjdk/darwin/11.nix

@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 

pkgs/development/compilers/openjdk/darwin/8.nix

@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 

pkgs/development/compilers/openjdk/darwin/default.nix

@@ -44,7 +44,7 @@ let
 
       # Set JAVA_HOME automatically.
       cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
     '';
 

pkgs/development/compilers/openjdk/default.nix

@@ -114,7 +114,7 @@ let
       # Set JAVA_HOME automatically.
       mkdir -p $out/nix-support
       cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
       EOF
     '';
 

pkgs/development/compilers/oraclejdk/jdk-linux-base.nix

@@ -156,7 +156,7 @@ let result = stdenv.mkDerivation rec {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 

pkgs/development/compilers/reason/default.nix

@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/rtop \
       --prefix PATH : "${utop}/bin" \
-      --set CAML_LD_LIBRARY_PATH ${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib:$CAML_LD_LIBRARY_PATH \
+      --prefix CAML_LD_LIBRARY_PATH : "${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib" \
-      --set OCAMLPATH $out/lib/ocaml/${ocaml.version}/site-lib:$OCAMLPATH
+      --prefix OCAMLPATH : "$out/lib/ocaml/${ocaml.version}/site-lib"
   '';
 
   meta = with stdenv.lib; {

pkgs/development/compilers/rust/rustc.nix

@@ -1,6 +1,6 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
 , fetchurl, file, python2
-, llvm_7, darwin, git, cmake, rustPlatform
+, llvm_9, darwin, git, cmake, rustPlatform
 , pkgconfig, openssl
 , which, libffi
 , withBundledLLVM ? false
@@ -12,12 +12,12 @@ let
   inherit (stdenv.lib) optional optionalString;
   inherit (darwin.apple_sdk.frameworks) Security;
 
-  llvmSharedForBuild = pkgsBuildBuild.llvm_7.override { enableSharedLibraries = true; };
+  llvmSharedForBuild = pkgsBuildBuild.llvm_9.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvm_7.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvm_9.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvm_7.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvm_9.override { enableSharedLibraries = true; };
 
   # For use at runtime
-  llvmShared = llvm_7.override { enableSharedLibraries = true; };
+  llvmShared = llvm_9.override { enableSharedLibraries = true; };
 in stdenv.mkDerivation rec {
   pname = "rustc";
   inherit version;

pkgs/development/compilers/rust/setup-hook.sh

@@ -1,4 +1,4 @@
 # Fix 'failed to open: /homeless-shelter/.cargo/.package-cache' in rust 1.36.
-if [[ -z $IN_NIX_SHELL && -z $CARGO_HOME ]]; then
+if [[ -z ${IN_NIX_SHELL-} && -z ${CARGO_HOME-} ]]; then
     export CARGO_HOME=$TMPDIR
 fi

pkgs/development/compilers/zulu/8.nix

@@ -58,7 +58,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 

pkgs/development/compilers/zulu/default.nix

@@ -55,7 +55,7 @@ in stdenv.mkDerivation {
 
     # Set JAVA_HOME automatically.
     cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
     EOF
   '';
 

pkgs/development/interpreters/guile/setup-hook-2.0.sh

@@ -1,12 +1,12 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.0"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.0"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.0"
     elif test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 }
 

pkgs/development/interpreters/guile/setup-hook-2.2.sh

@@ -1,12 +1,12 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site/2.2"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site/2.2"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site/2.2"
     elif test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
-        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
     fi
 }
 

pkgs/development/interpreters/guile/setup-hook.sh

@@ -1,7 +1,7 @@
 addGuileLibPath () {
     if test -d "$1/share/guile/site"
     then
-        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
+        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
     fi
 }
 

pkgs/development/interpreters/lua-5/setup-hook.sh

@@ -20,7 +20,7 @@ addToLuaSearchPathWithCustomDelimiter() {
   if [[ ! -d "$topDir" ]]; then return; fi
 
   # export only if we haven't already got this dir in the search path
-  if [[ ${!varName} == *"$absPattern"* ]]; then return; fi
+  if [[ ${!varName-} == *"$absPattern"* ]]; then return; fi
 
   export "${varName}=${!varName:+${!varName};}${absPattern}"
 }

pkgs/development/interpreters/octave/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, gfortran, readline, ncurses, perl, flex, texinfo, qhull
-, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGLU_combined, fltk
+, libsndfile, portaudio, libX11, graphicsmagick, pcre, pkgconfig, libGL, libGLU, fltk
 , fftw, fftwSinglePrec, zlib, curl, qrupdate, openblas, arpack, libwebp
 , qt ? null, qscintilla ? null, ghostscript ? null, llvm ? null, hdf5 ? null,glpk ? null
 , suitesparse ? null, gnuplot ? null, jdk ? null, python ? null, overridePlatforms ? null
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     ++ (stdenv.lib.optional (jdk != null) jdk)
     ++ (stdenv.lib.optional (gnuplot != null) gnuplot)
     ++ (stdenv.lib.optional (python != null) python)
-    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGLU_combined libX11 ])
+    ++ (stdenv.lib.optionals (!stdenv.isDarwin) [ libGL libGLU libX11 ])
     ;
 
   # makeinfo is required by Octave at runtime to display help

pkgs/development/interpreters/perl/default.nix

@@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, pkgs, buildPackages, callPackage
-, enableThreading ? stdenv ? glibc, makeWrapper
+, enableThreading ? stdenv ? glibc, coreutils, makeWrapper
 }:
 
 with lib;
@@ -35,7 +35,7 @@ let
 
     # TODO: Add a "dev" output containing the header files.
     outputs = [ "out" "man" "devdoc" ] ++
-      stdenv.lib.optional crossCompiling "dev";
+      optional crossCompiling "dev";
     setOutputFlags = false;
 
     disallowedReferences = [ stdenv.cc ];
@@ -57,12 +57,20 @@ let
       ++ optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
       ++ optional crossCompiling ./MakeMaker-cross.patch;
 
-    postPatch = ''
+    # This is not done for native builds because pwd may need to come from
-      pwd="$(type -P pwd)"
+    # bootstrap tools when building bootstrap perl.
+    postPatch = (if crossCompiling then ''
       substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" "$pwd"
+        --replace "/bin/pwd" '${coreutils}/bin/pwd'
-    '' + stdenv.lib.optionalString crossCompiling ''
       substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
+    '' else ''
+      substituteInPlace dist/PathTools/Cwd.pm \
+        --replace "/bin/pwd" "$(type -P pwd)"
+    '') +
+    # Perl's build system uses the src variable, and its value may end up in
+    # the output in some cases (when cross-compiling)
+    ''
+      unset src
     '';
 
     # Build a thread-safe Perl with a dynamic libperls.o.  We need the
@@ -85,7 +93,7 @@ let
       ++ optional stdenv.isSunOS "-Dcc=gcc"
       ++ optional enableThreading "-Dusethreads";
 
-    configureScript = stdenv.lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
+    configureScript = optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
 
     dontAddPrefix = !crossCompiling;
 
@@ -140,7 +148,7 @@ let
             }" /no-such-path \
           --replace "${stdenv.cc}" /no-such-path \
           --replace "$man" /no-such-path
-      '' + stdenv.lib.optionalString crossCompiling
+      '' + optionalString crossCompiling
       ''
         mkdir -p $dev/lib/perl5/cross_perl/${version}
         for dir in cnf/{stub,cpan}; do
@@ -172,7 +180,7 @@ let
       platforms = platforms.all;
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
     };
-  } // stdenv.lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
+  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
     crossVersion = "980998f7d11baf97284426ca91f84681d49a08f5"; # Jul 20, 2019
 
     perl-cross-src = fetchurl {

pkgs/development/interpreters/python/hooks/flit-build-hook.sh

@@ -9,7 +9,7 @@ flitBuildPhase () {
     echo "Finished executing flitBuildPhase"
 }
 
-if [ -z "$dontUseFlitBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseFlitBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using flitBuildPhase"
     buildPhase=flitBuildPhase
 fi

pkgs/development/interpreters/python/hooks/pip-build-hook.sh

@@ -31,12 +31,12 @@ pipShellHook() {
     echo "Finished executing pipShellHook"
 }
 
-if [ -z "$dontUsePipBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUsePipBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using pipBuildPhase"
     buildPhase=pipBuildPhase
 fi
 
-if [ -z "$shellHook" ]; then
+if [ -z "${shellHook-}" ]; then
     echo "Using pipShellHook"
     shellHook=pipShellHook
 fi

pkgs/development/interpreters/python/hooks/pip-install-hook.sh

@@ -18,7 +18,7 @@ pipInstallPhase() {
     echo "Finished executing pipInstallPhase"
 }
 
-if [ -z "$dontUsePipInstall" ] && [ -z "$installPhase" ]; then
+if [ -z "${dontUsePipInstall-}" ] && [ -z "${installPhase-}" ]; then
     echo "Using pipInstallPhase"
     installPhase=pipInstallPhase
 fi

pkgs/development/interpreters/python/hooks/pytest-check-hook.sh

@@ -43,7 +43,7 @@ function pytestCheckPhase() {
     echo "Finished executing pytestCheckPhase"
 }
 
-if [ -z "$dontUsePytestCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUsePytestCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using pytestCheckPhase"
     preDistPhases+=" pytestCheckPhase"
 fi

pkgs/development/interpreters/python/hooks/python-catch-conflicts-hook.sh

@@ -5,6 +5,6 @@ pythonCatchConflictsPhase() {
     @pythonInterpreter@ @catchConflicts@
 }
 
-if [ -z "$dontUsePythonCatchConflicts" ]; then
+if [ -z "${dontUsePythonCatchConflicts-}" ]; then
     preDistPhases+=" pythonCatchConflictsPhase"
 fi

pkgs/development/interpreters/python/hooks/python-imports-check-hook.sh

@@ -10,7 +10,7 @@ pythonImportsCheckPhase () {
     fi
 }
 
-if [ -z "$dontUsePythonImportsCheck" ]; then
+if [ -z "${dontUsePythonImportsCheck-}" ]; then
     echo "Using pythonImportsCheckPhase"
     preDistPhases+=" pythonImportsCheckPhase"
 fi

pkgs/development/interpreters/python/hooks/python-remove-bin-bytecode-hook.sh

@@ -12,6 +12,6 @@ pythonRemoveBinBytecodePhase () {
     fi
 }
 
-if [ -z "$dontUsePythonRemoveBinBytecode" ]; then
+if [ -z "${dontUsePythonRemoveBinBytecode-}" ]; then
     preDistPhases+=" pythonRemoveBinBytecodePhase"
 fi

pkgs/development/interpreters/python/hooks/setuptools-build-hook.sh

@@ -36,12 +36,12 @@ setuptoolsShellHook() {
     echo "Finished executing setuptoolsShellHook"
 }
 
-if [ -z "$dontUseSetuptoolsBuild" ] && [ -z "$buildPhase" ]; then
+if [ -z "${dontUseSetuptoolsBuild-}" ] && [ -z "${buildPhase-}" ]; then
     echo "Using setuptoolsBuildPhase"
     buildPhase=setuptoolsBuildPhase
 fi
 
-if [ -z "$dontUseSetuptoolsShellHook" ] && [ -z "$shellHook" ]; then
+if [ -z "${dontUseSetuptoolsShellHook-}" ] && [ -z "${shellHook-}" ]; then
     echo "Using setuptoolsShellHook"
     shellHook=setuptoolsShellHook
 fi

pkgs/development/interpreters/python/hooks/setuptools-check-hook.sh

@@ -12,7 +12,7 @@ setuptoolsCheckPhase() {
     echo "Finished executing setuptoolsCheckPhase"
 }
 
-if [ -z "$dontUseSetuptoolsCheck" ] && [ -z "$installCheckPhase" ]; then
+if [ -z "${dontUseSetuptoolsCheck-}" ] && [ -z "${installCheckPhase-}" ]; then
     echo "Using setuptoolsCheckPhase"
     preDistPhases+=" setuptoolsCheckPhase"
 fi

pkgs/development/interpreters/python/hooks/wheel-unpack-hook.sh

@@ -12,7 +12,7 @@ wheelUnpackPhase(){
     echo "Finished executing wheelUnpackPhase"
 }
 
-if [ -z "$dontUseWheelUnpack" ] && [ -z "$unpackPhase" ]; then
+if [ -z "${dontUseWheelUnpack-}" ] && [ -z "${unpackPhase-}" ]; then
     echo "Using wheelUnpackPhase"
     unpackPhase=wheelUnpackPhase
 fi

pkgs/development/libraries/SDL/setup-hook.sh

@@ -1,7 +1,9 @@
 addSDLPath () {
   if [ -e "$1/include/SDL" ]; then
-    export SDL_PATH="$SDL_PATH $1/include/SDL"
+    export SDL_PATH="${SDL_PATH-}${SDL_PATH:+ }$1/include/SDL"
-    export SDL_LIB_PATH="$SDL_LIB_PATH -L$1/lib"
+  fi
+  if [ -e "$1/lib" ]; then
+    export SDL_LIB_PATH="${SDL_LIB_PATH-}${SDL_LIB_PATH:+ }-L$1/lib"
   fi
 }
 

pkgs/development/libraries/SDL2/default.nix

@@ -75,9 +75,21 @@ stdenv.mkDerivation rec {
     ++ optional alsaSupport "--with-alsa-prefix=${alsaLib.out}/lib"
     ++ optional stdenv.isDarwin "--disable-sdltest";
 
+  # We remove libtool .la files when static libs are requested,
+  # because they make the builds of downstream libs like `SDL_tff`
+  # fail with `cannot find -lXext, `-lXcursor` etc. linker errors
+  # because the `.la` files are not pruned if static libs exist
+  # (see https://github.com/NixOS/nixpkgs/commit/fd97db43bcb05e37f6bb77f363f1e1e239d9de53)
+  # and they also don't carry the necessary `-L` paths of their
+  # X11 dependencies.
+  # For static linking, it is better to rely on `pkg-config` `.pc`
+  # files.
   postInstall = ''
-    moveToOutput lib/libSDL2main.a "$dev"
+    if [ "$dontDisableStatic" -eq "1" ]; then
-    rm $out/lib/*.a
+      rm $out/lib/*.la
+    else
+      rm $out/lib/*.a
+    fi
     moveToOutput bin/sdl2-config "$dev"
   '';
 

pkgs/development/libraries/SDL2/setup-hook.sh

@@ -1,6 +1,6 @@
 addSDL2Path () {
   if [ -e "$1/include/SDL2" ]; then
-    export SDL2_PATH="$SDL2_PATH $1/include/SDL2"
+    export SDL2_PATH="${SDL2_PATH-}${SDL2_PATH:+ }$1/include/SDL2"
   fi
 }
 

pkgs/development/libraries/clutter/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libGLU_combined, libX11, libXext, libXfixes
+{ stdenv, fetchurl, pkgconfig, libGLU, libGL, libX11, libXext, libXfixes
 , libXdamage, libXcomposite, libXi, libxcb, cogl, pango, atk, json-glib
 , gobject-introspection, gtk3, gnome3, libinput, libgudev, libxkbcommon
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gtk3 ];
   nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs =
-    [ libX11 libGLU_combined libXext libXfixes libXdamage libXcomposite libXi cogl pango
+    [ libX11 libGL libGLU libXext libXfixes libXdamage libXcomposite libXi cogl pango
       atk json-glib gobject-introspection libxcb libinput libgudev libxkbcommon
     ];
 

pkgs/development/libraries/cogl/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, libGL, glib, gdk-pixbuf, xorg, libintl
 , pangoSupport ? true, pango, cairo, gobject-introspection, wayland, gnome3
-, mesa
+, mesa, automake, autoconf
 , gstreamerSupport ? true, gst_all_1 }:
 
 let
@@ -29,11 +29,17 @@ in stdenv.mkDerivation rec {
       url = https://bug787443.bugzilla-attachments.gnome.org/attachment.cgi?id=361056;
       sha256 = "09fyrdci4727fg6qm5aaapsbv71sf4wgfaqz8jqlyy61dibgg490";
     })
+
+    # Fix build with libglvnd headers (these headers used to be provided by mesa)
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/cogl/commit/9c4764224aded552fb855b1c2b85b26d2b894adf.patch";
+      sha256 = "1v9drpzgcd5pq2shhdcw5px7mdiggk6ga13qjbklq8xpd92ac0i1";
+    })
   ];
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig libintl ];
+  nativeBuildInputs = [ pkgconfig libintl automake autoconf ];
 
   configureFlags = [
     "--enable-introspection"
@@ -41,7 +47,7 @@ in stdenv.mkDerivation rec {
     "--enable-wayland-egl-platform"
     "--enable-wayland-egl-server"
   ] ++ stdenv.lib.optional gstreamerSupport "--enable-cogl-gst"
-    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
+  ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
 
   propagatedBuildInputs = with xorg; [
       glib gdk-pixbuf gobject-introspection wayland mesa

pkgs/development/libraries/coin3d/default.nix

@@ -1,4 +1,4 @@
-{ fetchFromBitbucket, stdenv, boost, cmake, libGLU_combined }:
+{ fetchFromBitbucket, stdenv, boost, cmake, libGL, libGLU }:
 
 stdenv.mkDerivation {
   pname = "coin";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ boost libGLU_combined ];
+  buildInputs = [ boost libGL libGLU ];
 
   meta = {
     homepage = "https://bitbucket.org/Coin3D/coin/wiki/Home";

pkgs/development/libraries/dleyna-core/setup-hook.sh

@@ -1,7 +1,7 @@
 addDleynaConnectorPath () {
     if test -d "$1/lib/dleyna-1.0/connectors"
     then
-        export DLEYNA_CONNECTOR_PATH="${DLEYNA_CONNECTOR_PATH}${DLEYNA_CONNECTOR_PATH:+:}$1/lib/dleyna-1.0/connectors"
+        export DLEYNA_CONNECTOR_PATH="${DLEYNA_CONNECTOR_PATH-}${DLEYNA_CONNECTOR_PATH:+:}$1/lib/dleyna-1.0/connectors"
     fi
 }
 

pkgs/development/libraries/ffmpeg/generic.nix

@@ -3,6 +3,8 @@
 , libssh, libtheora, libva, libdrm, libvorbis, libvpx, lzma, libpulseaudio, soxr
 , x264, x265, xvidcore, zlib, libopus, speex, nv-codec-headers, dav1d
 , openglSupport ? false, libGLU_combined ? null
+, libmfxSupport ? false, intel-media-sdk ? null
+, libaomSupport ? false, libaom ? null
 # Build options
 , runtimeCpuDetectBuild ? true # Detect CPU capabilities at runtime
 , multithreadBuild ? true # Multithreading via pthreads/win32 threads
@@ -62,6 +64,8 @@ let
 in
 
 assert openglSupport -> libGLU_combined != null;
+assert libmfxSupport -> intel-media-sdk != null;
+assert libaomSupport -> libaom != null;
 
 stdenv.mkDerivation rec {
 
@@ -135,6 +139,8 @@ stdenv.mkDerivation rec {
       (ifMinVer "0.6" (enableFeature vpxSupport "libvpx"))
       (ifMinVer "2.4" "--enable-lzma")
       (ifMinVer "2.2" (enableFeature openglSupport "opengl"))
+      (ifMinVer "4.2" (enableFeature libmfxSupport "libmfx"))
+      (ifMinVer "4.2" (enableFeature libaomSupport "libaom"))
       (disDarwinOrArmFix (ifMinVer "0.9" "--enable-libpulse") "0.9" "--disable-libpulse")
       (ifMinVer "2.5" (if sdlSupport && reqMin "3.2" then "--enable-sdl2" else if sdlSupport then "--enable-sdl" else null)) # autodetected before 2.5, SDL1 support removed in 3.2 for SDL2
       (ifMinVer "1.2" "--enable-libsoxr")
@@ -163,6 +169,8 @@ stdenv.mkDerivation rec {
     bzip2 fontconfig freetype gnutls libiconv lame libass libogg libssh libtheora
     libvdpau libvorbis lzma soxr x264 x265 xvidcore zlib libopus speex nv-codec-headers
   ] ++ optional openglSupport libGLU_combined
+    ++ optional libmfxSupport intel-media-sdk
+    ++ optional vpxSupport libaom
     ++ optional vpxSupport libvpx
     ++ optionals (!isDarwin && !isAarch32) [ libpulseaudio ] # Need to be fixed on Darwin and ARM
     ++ optional ((isLinux || isFreeBSD) && !isAarch32) libva

pkgs/development/libraries/fltk/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, xlibsWrapper, xorgproto, libXi
-, freeglut, libGLU_combined, libjpeg, zlib, libXft, libpng
+, freeglut, libGL, libGLU, libjpeg, zlib, libXft, libpng
 , libtiff, freetype, Cocoa, AGL, GLUT
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./nsosv.patch ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libGLU_combined libjpeg zlib libpng libXft ]
+  buildInputs = [ libGLU libGL libjpeg zlib libpng libXft ]
     ++ stdenv.lib.optional stdenv.isDarwin [ AGL Cocoa GLUT ];
 
   propagatedBuildInputs = [ xorgproto ]

pkgs/development/libraries/ftgl/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, freetype, libGLU_combined, OpenGL }:
+{ stdenv, fetchurl, freetype, libGL, libGLU, OpenGL }:
 
 let
   name = "ftgl-2.1.3-rc5";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
     ++ (if stdenv.isDarwin then
       [ OpenGL ]
     else
-      [ libGLU_combined ])
+      [ libGL libGLU ])
     ;
 
   enableParallelBuilding = true;

pkgs/development/libraries/gcr/default.nix

@@ -1,49 +1,84 @@
-{ stdenv, fetchurl, pkgconfig, gettext, gnupg, p11-kit, glib
+{ stdenv
-, libgcrypt, libtasn1, dbus-glib, gtk3, pango, gdk-pixbuf, atk
+, fetchurl
-, gobject-introspection, makeWrapper, libxslt, vala, gnome3
+, pkgconfig
-, python3 }:
+, gettext
+, gnupg
+, p11-kit
+, glib
+, libgcrypt
+, libtasn1
+, gtk3
+, pango
+, gobject-introspection
+, makeWrapper
+, libxslt
+, vala
+, gnome3
+, python3
+}:
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "3.33.4";
+  version = "3.34.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1hf06p4qfyywnb6334ysnr6aqxik3srb37glclvr4yhb3wzrjqnm";
+    sha256 = "0925snsixzkwh49xiayqmj6fcrmklqk8kyy0jkv7m64h9abm1pr9";
-  };
-
-  passthru = {
-    updateScript = gnome3.updateScript { packageName = pname; };
   };
 
   postPatch = ''
-    patchShebangs .
+    patchShebangs build/ gcr/fixtures/
   '';
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig gettext gobject-introspection libxslt makeWrapper vala ];
+  nativeBuildInputs = [
+    pkgconfig
+    gettext
+    gobject-introspection
+    libxslt
+    makeWrapper
+    vala
+  ];
 
-  buildInputs = [ gnupg libgcrypt libtasn1 dbus-glib pango gdk-pixbuf atk ];
+  buildInputs = [
+    gnupg
+    libgcrypt
+    libtasn1
+    pango
+  ];
 
-  propagatedBuildInputs = [ glib gtk3 p11-kit ];
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    p11-kit
+  ];
+
+  checkInputs = [
+    python3
+  ];
 
-  checkInputs = [ python3 ];
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
 
-  #enableParallelBuilding = true; issues on hydra
+  enableParallelBuilding = true;
 
   preFixup = ''
     wrapProgram "$out/bin/gcr-viewer" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
   '';
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;
     description = "GNOME crypto services (daemon and tools)";
-    homepage    = https://gitlab.gnome.org/GNOME/gcr;
+    homepage = "https://gitlab.gnome.org/GNOME/gcr";
-    license     = licenses.gpl2;
+    license = licenses.lgpl2Plus;
 
     longDescription = ''
       GCR is a library for displaying certificates, and crypto UI, accessing

pkgs/development/libraries/gdk-pixbuf/setup-hook.sh

@@ -2,9 +2,9 @@ findGdkPixbufLoaders() {
 
 	# choose the longest loaders.cache
 	local loadersCache="$1/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache"
-	if [ -f "$loadersCache" ]; then
+	if [[ -f "$loadersCache" ]]; then
-		if [ -f "$GDK_PIXBUF_MODULE_FILE" ]; then
+		if [[ -f "${GDK_PIXBUF_MODULE_FILE-}" ]]; then
-			if [ $(cat "$loadersCache"|wc -l) -gt $(cat "$GDK_PIXBUF_MODULE_FILE"|wc -l) ]; then
+			if [[ "$(cat "$loadersCache" | wc -l)" > "$(cat "$GDK_PIXBUF_MODULE_FILE" | wc -l)" ]]; then
 				export GDK_PIXBUF_MODULE_FILE="$loadersCache"
 			fi
 		else

pkgs/development/libraries/gettext/CVE-2018-18751-bison.patch

@@ -1,323 +0,0 @@
-This patch was generated by re-running Bison 3.0.4 on pro-gram-gen.y after
-applying CVE-2018-18751.patch. This patch removes the need to add bison to
-nativeBuildInputs.
-
---- a/gettext-tools/src/po-gram-gen.c
-+++ b/gettext-tools/src/po-gram-gen.c
-@@ -568,9 +568,9 @@ static const yytype_uint8 yytranslate[] =
- static const yytype_uint16 yyrline[] =
- {
-        0,   169,   169,   171,   172,   173,   174,   179,   187,   195,
--     216,   240,   249,   258,   269,   278,   292,   301,   315,   321,
--     332,   338,   350,   361,   372,   376,   391,   414,   422,   434,
--     442
-+     216,   237,   246,   255,   266,   275,   289,   298,   312,   318,
-+     329,   335,   347,   358,   369,   373,   388,   411,   419,   431,
-+     439
- };
- #endif
-
-@@ -1419,14 +1419,11 @@ yyreduce:
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[-1].string));
-                   check_obsolete ((yyvsp[-3].message_intro), (yyvsp[0].rhs));
-                   if (!(yyvsp[-3].message_intro).obsolete || pass_obsolete_entries)
--                    {
--                      do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
--                                           (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
--                                           (yyvsp[-3].message_intro).prev_ctxt,
--                                           (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
--                                           (yyvsp[-3].message_intro).obsolete);
--                      free ((yyvsp[-1].string).string);
--                    }
-+                    do_callback_message ((yyvsp[-3].message_intro).ctxt, string2, &(yyvsp[-3].message_intro).pos, (yyvsp[-1].string).string,
-+                                         (yyvsp[0].rhs).rhs.msgstr, (yyvsp[0].rhs).rhs.msgstr_len, &(yyvsp[0].rhs).pos,
-+                                         (yyvsp[-3].message_intro).prev_ctxt,
-+                                         (yyvsp[-3].message_intro).prev_id, (yyvsp[-3].message_intro).prev_id_plural,
-+                                         (yyvsp[-3].message_intro).obsolete);
-                   else
-                     {
-                       free_message_intro ((yyvsp[-3].message_intro));
-@@ -1435,11 +1432,11 @@ yyreduce:
-                       free ((yyvsp[0].rhs).rhs.msgstr);
-                     }
-                 }
--#line 1439 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1436 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 11:
--#line 241 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 238 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].string));
-@@ -1448,11 +1445,11 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].string).string);
-                 }
--#line 1452 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1449 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 12:
--#line 250 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 247 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].message_intro), (yyvsp[0].rhs));
-@@ -1461,22 +1458,22 @@ yyreduce:
-                   string_list_destroy (&(yyvsp[-1].stringlist).stringlist);
-                   free ((yyvsp[0].rhs).rhs.msgstr);
-                 }
--#line 1465 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1462 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 13:
--#line 259 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 256 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].message_intro), (yyvsp[0].stringlist));
-                   po_gram_error_at_line (&(yyvsp[-1].message_intro).pos, _("missing 'msgstr' section"));
-                   free_message_intro ((yyvsp[-1].message_intro));
-                   string_list_destroy (&(yyvsp[0].stringlist).stringlist);
-                 }
--#line 1476 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1473 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 14:
--#line 270 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 267 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.message_intro).prev_ctxt = NULL;
-                   (yyval.message_intro).prev_id = NULL;
-@@ -1485,11 +1482,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1489 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1486 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 15:
--#line 279 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 276 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].prev), (yyvsp[0].string));
-                   (yyval.message_intro).prev_ctxt = (yyvsp[-1].prev).ctxt;
-@@ -1499,11 +1496,11 @@ yyreduce:
-                   (yyval.message_intro).pos = (yyvsp[0].string).pos;
-                   (yyval.message_intro).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1503 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1500 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 16:
--#line 293 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 290 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].string), (yyvsp[0].stringlist));
-                   (yyval.prev).ctxt = (yyvsp[-1].string).string;
-@@ -1512,11 +1509,11 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-1].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-1].string).obsolete;
-                 }
--#line 1516 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1513 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 17:
--#line 302 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 299 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].string), (yyvsp[0].string));
-@@ -1526,21 +1523,21 @@ yyreduce:
-                   (yyval.prev).pos = (yyvsp[-2].string).pos;
-                   (yyval.prev).obsolete = (yyvsp[-2].string).obsolete;
-                 }
--#line 1530 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1527 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 18:
--#line 316 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 313 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1540 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1537 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 19:
--#line 322 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 319 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1548,21 +1545,21 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1552 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1549 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 20:
--#line 333 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 330 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.string).string = NULL;
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1562 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1559 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 21:
--#line 339 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 336 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[-1].stringlist));
-                   check_obsolete ((yyvsp[-2].pos), (yyvsp[0].pos));
-@@ -1570,11 +1567,11 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[0].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[0].pos).obsolete;
-                 }
--#line 1574 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1571 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 22:
--#line 351 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 348 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   plural_counter = 0;
-@@ -1582,30 +1579,30 @@ yyreduce:
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1586 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1583 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 23:
--#line 362 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 359 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].pos), (yyvsp[0].stringlist));
-                   (yyval.string).string = string_list_concat_destroy (&(yyvsp[0].stringlist).stringlist);
-                   (yyval.string).pos = (yyvsp[-1].pos).pos;
-                   (yyval.string).obsolete = (yyvsp[-1].pos).obsolete;
-                 }
--#line 1597 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1594 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 24:
--#line 373 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 370 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   (yyval.rhs) = (yyvsp[0].rhs);
-                 }
--#line 1605 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1602 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 25:
--#line 377 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 374 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].rhs), (yyvsp[0].rhs));
-                   (yyval.rhs).rhs.msgstr = XNMALLOC ((yyvsp[-1].rhs).rhs.msgstr_len + (yyvsp[0].rhs).rhs.msgstr_len, char);
-@@ -1617,11 +1614,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-1].rhs).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-1].rhs).obsolete;
-                 }
--#line 1621 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1618 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 26:
--#line 392 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 389 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-3].pos));
-                   check_obsolete ((yyvsp[-4].pos), (yyvsp[-2].number));
-@@ -1640,11 +1637,11 @@ yyreduce:
-                   (yyval.rhs).pos = (yyvsp[-4].pos).pos;
-                   (yyval.rhs).obsolete = (yyvsp[-4].pos).obsolete;
-                 }
--#line 1644 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1641 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 27:
--#line 415 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 412 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1652,11 +1649,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1656 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1653 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 28:
--#line 423 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 420 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1665,11 +1662,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1669 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1666 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 29:
--#line 435 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 432 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   string_list_init (&(yyval.stringlist).stringlist);
-                   string_list_append (&(yyval.stringlist).stringlist, (yyvsp[0].string).string);
-@@ -1677,11 +1674,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[0].string).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[0].string).obsolete;
-                 }
--#line 1681 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1678 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-   case 30:
--#line 443 "po-gram-gen.y" /* yacc.c:1646  */
-+#line 440 "po-gram-gen.y" /* yacc.c:1646  */
-     {
-                   check_obsolete ((yyvsp[-1].stringlist), (yyvsp[0].string));
-                   (yyval.stringlist).stringlist = (yyvsp[-1].stringlist).stringlist;
-@@ -1690,11 +1687,11 @@ yyreduce:
-                   (yyval.stringlist).pos = (yyvsp[-1].stringlist).pos;
-                   (yyval.stringlist).obsolete = (yyvsp[-1].stringlist).obsolete;
-                 }
--#line 1694 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1691 "po-gram-gen.c" /* yacc.c:1646  */
-     break;
-
-
--#line 1698 "po-gram-gen.c" /* yacc.c:1646  */
-+#line 1695 "po-gram-gen.c" /* yacc.c:1646  */
-       default: break;
-     }
-   /* User semantic actions sometimes alter yychar, and that requires

pkgs/development/libraries/gettext/default.nix

@@ -1,24 +1,16 @@
-{ stdenv, lib, fetchurl, libiconv, xz, bison, automake115x, autoconf }:
+{ stdenv, lib, fetchurl, libiconv, xz }:
 
-let allowBisonDependency = !stdenv.isDarwin; in
 stdenv.mkDerivation rec {
   pname = "gettext";
-  version = "0.19.8.1";
+  version = "0.20.1";
 
   src = fetchurl {
     url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
-    sha256 = "0hsw28f9q9xaggjlsdp2qmbp2rbd1mp0njzan2ld9kiqwkq2m57z";
+    sha256 = "0p3zwkk27wm2m2ccfqm57nj7vqkmfpn7ja1nf65zmhz8qqs5chb6";
   };
   patches = [
     ./absolute-paths.diff
-    (fetchurl {
+    ./gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch
-      name = "CVE-2018-18751.patch";
-      url = "https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=patch;h=dce3a16e5e9368245735e29bf498dcd5e3e474a4";
-      sha256 = "1lpjwwcjr1sb879faj0xyzw02kma0ivab6xwn3qciy13qy6fq5xn";
-    })
-  ] ++ lib.optionals (!allowBisonDependency) [
-    # Only necessary for CVE-2018-18751.patch:
-    ./CVE-2018-18751-bison.patch
   ];
 
   outputs = [ "out" "man" "doc" "info" ];
@@ -29,10 +21,6 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
      "--disable-csharp" "--with-xz"
-     # avoid retaining reference to CF during stdenv bootstrap
-  ] ++ lib.optionals stdenv.isDarwin [
-    "gt_cv_func_CFPreferencesCopyAppValue=no"
-    "gt_cv_func_CFLocaleCopyCurrent=no"
   ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # On cross building, gettext supposes that the wchar.h from libc
     # does not fulfill gettext needs, so it tries to work with its
@@ -54,14 +42,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     xz
     xz.bin
-  ]
-  # Only necessary for CVE-2018-18751.patch (unless CVE-2018-18751-bison.patch
-  # is also applied):
-  ++ lib.optional allowBisonDependency bison
-  ++ [
-    # Only necessary for CVE-2018-18751.patch:
-    automake115x
-    autoconf
   ];
   # HACK, see #10874 (and 14664)
   buildInputs = stdenv.lib.optional (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) libiconv;

pkgs/development/libraries/gettext/gettext-setup-hook.sh

@@ -10,7 +10,7 @@ addEnvHooks "$hostOffset" gettextDataDirsHook
 
 # libintl must be listed in load flags on non-Glibc
 # it doesn't hurt to have it in Glibc either though
-if [ -n "@gettextNeedsLdflags@" -a -z "$dontAddExtraLibs" ]; then
+if [ -n "@gettextNeedsLdflags@" -a -z "${dontAddExtraLibs-}" ]; then
     # See pkgs/build-support/setup-hooks/role.bash
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -lintl"

pkgs/development/libraries/gettext/gettext.git-2336451ed68d91ff4b5ae1acbc1eca30e47a86a9.patch

@@ -0,0 +1,82 @@
+From 2336451ed68d91ff4b5ae1acbc1eca30e47a86a9 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sun, 19 May 2019 13:10:06 +0200
+Subject: [PATCH] msgmerge: Fix behaviour of --for-msgfmt on PO files with no
+ translations.
+
+Reported by Don Lawrence <dlawrence@iecok.com>
+in <https://lists.freedesktop.org/archives/p11-glue/2019-May/000700.html>
+via Daiki Ueno
+in <https://lists.gnu.org/archive/html/bug-gettext/2019-05/msg00124.html>.
+
+* gettext-tools/src/msgmerge.c (main): Treat force_po like true if for_msgfmt
+is true.
+* gettext-tools/tests/msgmerge-26: Add test of PO file with no translations.
+---
+ gettext-tools/src/msgmerge.c    |  4 ++--
+ gettext-tools/tests/msgmerge-26 | 36 +++++++++++++++++++++++++++++++++---
+ 2 files changed, 35 insertions(+), 5 deletions(-)
+
+diff --git a/gettext-tools/src/msgmerge.c b/gettext-tools/src/msgmerge.c
+index cd762c0..92c9b7a 100644
+--- a/gettext-tools/src/msgmerge.c
++++ b/gettext-tools/src/msgmerge.c
+@@ -520,8 +520,8 @@ There is NO WARRANTY, to the extent permitted by law.\n\
+   else
+     {
+       /* Write the merged message list out.  */
+-      msgdomain_list_print (result, output_file, output_syntax, force_po,
+-                            false);
++      msgdomain_list_print (result, output_file, output_syntax,
++                            for_msgfmt || force_po, false);
+     }
+ 
+   exit (EXIT_SUCCESS);
+diff --git a/gettext-tools/tests/msgmerge-26 b/gettext-tools/tests/msgmerge-26
+index cd3862e..b86f7a0 100755
+--- a/gettext-tools/tests/msgmerge-26
++++ b/gettext-tools/tests/msgmerge-26
+@@ -73,7 +73,37 @@ msgstr "Papaya"
+ EOF
+ 
+ : ${DIFF=diff}
+-${DIFF} mm-test26.ok mm-test26.out
+-result=$?
++${DIFF} mm-test26.ok mm-test26.out || Exit 1
+ 
+-exit $result
++# Test with a PO file that has no translated messages.
++
++cat <<\EOF > mm-test26a.in1
++msgid ""
++msgstr ""
++"Content-Type: text/plain; charset=UTF-8\n"
++
++msgid "Hello world"
++msgstr "Hallo Welt"
++EOF
++
++cat <<\EOF > mm-test26a.in2
++msgid ""
++msgstr ""
++"Content-Type: text/plain; charset=ASCII\n"
++
++msgid "Hello, world!"
++msgstr ""
++EOF
++
++: ${MSGMERGE=msgmerge}
++${MSGMERGE} --for-msgfmt -o mm-test26a.tmp mm-test26a.in1 mm-test26a.in2 \
++    || Exit 1
++LC_ALL=C tr -d '\r' < mm-test26a.tmp > mm-test26a.out || Exit 1
++
++cat <<\EOF > mm-test26a.ok
++msgid ""
++msgstr "Content-Type: text/plain; charset=UTF-8\n"
++EOF
++
++: ${DIFF=diff}
++${DIFF} mm-test26a.ok mm-test26a.out || Exit 1
+-- 
+1.9.1
+

pkgs/development/libraries/gle/default.nix

@@ -1,7 +1,7 @@
-{stdenv, fetchurl, libGLU_combined, freeglut, libX11, libXt, libXmu, libXi, libXext}:
+{stdenv, fetchurl, freeglut, libX11, libXt, libXmu, libXi, libXext, libGL, libGLU}:
 stdenv.mkDerivation {
   name = "gle-3.1.0";
-  buildInputs = [libGLU_combined freeglut libX11 libXt libXmu libXi libXext];
+  buildInputs = [libGLU libGL freeglut libX11 libXt libXmu libXi libXext];
   src = fetchurl {
     urls = [
       "mirror://sourceforge/project/gle/gle/gle-3.1.0/gle-3.1.0.tar.gz"

pkgs/development/libraries/glib/setup-hook.sh

@@ -1,9 +1,11 @@
 
 make_glib_find_gsettings_schemas() {
     # For packages that need gschemas of other packages (e.g. empathy)
-    if [ -d "$1"/share/gsettings-schemas/*/glib-2.0/schemas ]; then
+    for maybe_dir in "$1"/share/gsettings-schemas/*/glib-2.0; do
-        addToSearchPath GSETTINGS_SCHEMAS_PATH "$1/share/gsettings-schemas/"*
+        if [[ -d "$maybe_dir/schemas" ]]; then
-    fi
+            addToSearchPath GSETTINGS_SCHEMAS_PATH "$maybe_dir"
+        fi
+    done
 }
 addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
 

pkgs/development/libraries/gnu-efi/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, fetchurl, pciutils }:
+{ stdenv, buildPackages, fetchurl, fetchpatch, pciutils }:
 
 with stdenv.lib;
 
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ffnc4xbzfggs37ymrgfx76j56kk2644c081ivhr2bjkla9ag3gj";
   };
 
+  patches = [
+    # Fix build on armv6l
+    (fetchpatch {
+      url = "https://sourceforge.net/p/gnu-efi/patches/_discuss/thread/25bb273a18/9c4d/attachment/0001-Fix-ARCH-on-armv6-and-other-32-bit-ARM-platforms.patch";
+      sha256 = "0pj03h20g2bbz6fr753bj1scry6919h57l1h86z3b6q7hqfj0b4r";
+    })
+  ];
+
   buildInputs = [ pciutils ];
 
   hardeningDisable = [ "stackprotector" ];

pkgs/development/libraries/gstreamer/core/setup-hook.sh

@@ -1,7 +1,7 @@
 addGstreamer1LibPath () {
     if test -d "$1/lib/gstreamer-1.0"
     then
-        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
+        export GST_PLUGIN_SYSTEM_PATH_1_0="${GST_PLUGIN_SYSTEM_PATH_1_0-}${GST_PLUGIN_SYSTEM_PATH_1_0:+:}$1/lib/gstreamer-1.0"
     fi
 }
 

pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
+{ fetchurl, fetchpatch, stdenv, pkgconfig, gstreamer, xorg, alsaLib, cdparanoia
 , libogg, libtheora, libvorbis, freetype, pango, liboil, glib, cairo, orc
 , libintl
 , ApplicationServices
@@ -20,10 +20,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gcc-4.9.patch
-    (fetchurl {
+    (fetchpatch {
       url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/f672277509705c4034bc92a141eefee4524d15aa.patch";
       name = "CVE-2019-9928.patch";
-      sha256 = "0hz3lsq3ppmaf329sbyi05y1qniqfj9vlp2f3z918383pvrcms4i";
+      sha256 = "1dlamsmyr7chrb6vqqmwikqvvqcx5l7k72p98448qm6k59ndnimc";
     })
   ];
 

pkgs/development/libraries/gstreamer/legacy/gstreamer/setup-hook.sh

@@ -1,7 +1,7 @@
 addGstreamerLibPath () {
     if test -d "$1/lib/gstreamer-0.10"
     then
-        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
+        export GST_PLUGIN_SYSTEM_PATH="${GST_PLUGIN_SYSTEM_PATH-}${GST_PLUGIN_SYSTEM_PATH:+:}$1/lib/gstreamer-0.10"
     fi
 }
 

pkgs/development/libraries/gtk/hooks/drop-icon-theme-cache.sh

@@ -16,4 +16,4 @@ dropIconThemeCache() {
     fi
 }
 
-preFixupPhases="$preFixupPhases dropIconThemeCache"
+preFixupPhases="${preFixupPhases-} dropIconThemeCache"

pkgs/development/libraries/icu/base.nix

@@ -63,10 +63,16 @@ let
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
       sed -i 's/INSTALL_CMD=.*install/INSTALL_CMD=install/' $out/lib/icu/${version}/pkgdata.inc
-    '' + ''
+    '' + (let
+      replacements = [
+        { from = "\${prefix}/include"; to = "${placeholder "dev"}/include"; } # --cppflags-searchpath
+        { from = "\${pkglibdir}/Makefile.inc"; to = "${placeholder "dev"}/lib/icu/Makefile.inc"; } # --incfile
+        { from = "\${pkglibdir}/pkgdata.inc"; to = "${placeholder "dev"}/lib/icu/pkgdata.inc"; } # --incpkgdatafile
+      ];
+    in ''
       substituteInPlace "$dev/bin/icu-config" \
-        --replace \''${pkglibdir}/Makefile.inc "$dev/lib/icu/Makefile.inc"
+        ${lib.concatMapStringsSep " " (r: "--replace '${r.from}' '${r.to}'") replacements}
-    '';
+    '');
 
     postFixup = ''moveToOutput lib/icu "$dev" '';
   };

pkgs/development/libraries/kde-frameworks/default.nix

@@ -42,7 +42,7 @@ let
       propagate = out:
         let setupHook = { writeScript }:
               writeScript "setup-hook" ''
-                if [ "$hookName" != postHook ]; then
+                if [ "${hookName:-}" != postHook ]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
                     # Propagate $dev so that this setup hook is propagated

pkgs/development/libraries/leptonica/default.nix

@@ -16,7 +16,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   checkInputs = [ which gnuplot ];
-  doCheck = !stdenv.isDarwin;
+
+  # Fails on pngio_reg for unknown reason
+  doCheck = false; # !stdenv.isDarwin;
 
   meta = {
     description = "Image processing and analysis library";

pkgs/development/libraries/libglvnd/default.nix

@@ -14,6 +14,22 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 addOpenGLRunpath ];
   buildInputs = [ libX11 libXext xorgproto ];
 
+  # The following 3 patches should be removed once libglvnd >1.2.0 is released
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/6f52473dac08c44b081b792874b4ce73122096da.patch";
+      sha256 = "0rd9ihl8n33cm0rya5a7ki0hn31fh52r0gaj5d4w80jrsah2ayij";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/51233cc52cbcbe25f8461830913c06f5b5bc9508.patch";
+      sha256 = "1qx3nw8vq5xcrixmi7xw1vpy4gbf7kmx38rx8wg8x046g4mv8ijj";
+    })
+    (fetchpatch {
+      url = "https://github.com/NVIDIA/libglvnd/commit/5dfdc5a6dc60a3bdc63cd4510dabacba388da13a.patch";
+      sha256 = "0gmb3619yz3z7n22afjh8p2y13bmsky4r0z0csm14is3wvdi64ya";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/GLX/Makefile.am \
       --replace "-Wl,-Bsymbolic " ""

pkgs/development/libraries/libiconv/setup-hook.sh

@@ -2,7 +2,7 @@
 # it doesn't hurt to have it in Glibc either though
 
 # See pkgs/build-support/setup-hooks/role.bash
-if [ -z "$dontAddExtraLibs" ]; then
+if [ -z "${dontAddExtraLibs-}" ]; then
     getHostRole
     export NIX_${role_pre}LDFLAGS+=" -liconv"
 fi

pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch

@@ -1,73 +0,0 @@
-Taken from openwrt:
-https://dev.openwrt.org/browser/packages/libs/libmad/patches/001-mips_removal_h_constraint.patch?rev=18548
-
-diff -ur libmad-0.15.1b-orig/fixed.h libmad-0.15.1b/fixed.h
---- libmad-0.15.1b-orig/fixed.h	2004-02-17 12:32:03.000000000 +1030
-+++ libmad-0.15.1b/fixed.h	2009-08-05 10:46:30.000000000 +0930
-@@ -299,6 +299,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -328,6 +345,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
-diff -ur libmad-0.15.1b-orig/mad.h libmad-0.15.1b/mad.h
---- libmad-0.15.1b-orig/mad.h	2004-02-17 13:25:44.000000000 +1030
-+++ libmad-0.15.1b/mad.h	2009-08-05 10:42:40.000000000 +0930
-@@ -344,6 +344,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -373,6 +390,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \

pkgs/development/libraries/libmad/default.nix

@@ -1,27 +1,57 @@
-{stdenv, fetchurl, autoconf}:
+{ stdenv, fetchurl, fetchpatch, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "libmad-0.15.1b";
+  pname = "libmad";
-  
+  version = "0.15.1b";
+
   src = fetchurl {
-    url = "mirror://sourceforge/mad/${name}.tar.gz";
+    url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
-    sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
+    sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
-  patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
+      sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
+      sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
+      sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8372-CVE-2017-8373.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
+      sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8374.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
+      sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
+    })
+  ]
   # optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
   # It is included here in order to fix a build failure in Clang
   # But it may be useful to fix other, currently unknown problems as well
-  ++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
+  ++ stdenv.lib.optionals stdenv.cc.isClang [
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
+      sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
+    })
+  ];
+
+  # The -fforce-mem flag has been removed in GCC 4.3.
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-fforce-mem" ""
+    substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
+  '';
 
   nativeBuildInputs = [ autoconf ];
 
-  # The -fforce-mem flag has been removed in GCC 4.3.
+  preConfigure = "autoconf";
-  preConfigure = ''
-    autoconf
-    substituteInPlace configure --replace "-fforce-mem" ""
-    substituteInPlace configure --replace "arch=\"-march=i486\"" ""
-  '';
 
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mad/;

pkgs/development/libraries/libmad/optimize.diff

@@ -1,77 +0,0 @@
-Index: libmad-0.15.1b/configure.ac
-===================================================================
---- libmad-0.15.1b.orig/configure.ac	2008-03-07 20:31:23.000000000 +0000
-+++ libmad-0.15.1b/configure.ac	2008-03-07 20:34:26.000000000 +0000
-@@ -124,71 +124,7 @@
- 
- if test "$GCC" = yes
- then
--    if test -z "$arch"
--    then
--	case "$host" in
--	    i386-*)           ;;
--	    i?86-*)           arch="-march=i486" ;;
--	    arm*-empeg-*)     arch="-march=armv4 -mtune=strongarm1100" ;;
--	    armv4*-*)         arch="-march=armv4 -mtune=strongarm" ;;
--	    powerpc-*)        ;;
--	    mips*-agenda-*)   arch="-mcpu=vr4100" ;;
--	    mips*-luxsonor-*) arch="-mips1 -mcpu=r3000 -Wa,-m4010" ;;
--	esac
--    fi
--
--    case "$optimize" in
--	-O|"-O "*)
--	    optimize="-O"
--	    optimize="$optimize -fforce-mem"
--	    optimize="$optimize -fforce-addr"
--	    : #x optimize="$optimize -finline-functions"
--	    : #- optimize="$optimize -fstrength-reduce"
--	    optimize="$optimize -fthread-jumps"
--	    optimize="$optimize -fcse-follow-jumps"
--	    optimize="$optimize -fcse-skip-blocks"
--	    : #x optimize="$optimize -frerun-cse-after-loop"
--	    : #x optimize="$optimize -frerun-loop-opt"
--	    : #x optimize="$optimize -fgcse"
--	    optimize="$optimize -fexpensive-optimizations"
--	    optimize="$optimize -fregmove"
--	    : #* optimize="$optimize -fdelayed-branch"
--	    : #x optimize="$optimize -fschedule-insns"
--	    optimize="$optimize -fschedule-insns2"
--	    : #? optimize="$optimize -ffunction-sections"
--	    : #? optimize="$optimize -fcaller-saves"
--	    : #> optimize="$optimize -funroll-loops"
--	    : #> optimize="$optimize -funroll-all-loops"
--	    : #x optimize="$optimize -fmove-all-movables"
--	    : #x optimize="$optimize -freduce-all-givs"
--	    : #? optimize="$optimize -fstrict-aliasing"
--	    : #* optimize="$optimize -fstructure-noalias"
--
--	    case "$host" in
--		arm*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		mips*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    optimize="$optimize -finline-functions"
--		    ;;
--		i?86-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		powerpc-apple-*)
--		    # this triggers an internal compiler error with gcc2
--		    : #optimize="$optimize -fstrength-reduce"
--
--		    # this is really only beneficial with gcc3
--		    : #optimize="$optimize -finline-functions"
--		    ;;
--		*)
--		    # this sometimes provokes bugs in gcc 2.95.2
--		    : #optimize="$optimize -fstrength-reduce"
--		    ;;
--	    esac
--	    ;;
--    esac
-+    optimize="-O2"
- fi
- 
- case "$host" in

pkgs/development/libraries/libmad/pkgconfig.patch

@@ -1,117 +0,0 @@
-diff -ruN libmad-0.15.1b.orig/Makefile.am libmad-0.15.1b/Makefile.am
---- libmad-0.15.1b.orig/Makefile.am	2004-02-17 02:02:03.000000000 +0000
-+++ libmad-0.15.1b/Makefile.am	2005-08-25 12:08:04.000000000 +0000
-@@ -33,9 +33,12 @@
- minimad_INCLUDES =	
- minimad_LDADD =		libmad.la
- 
--EXTRA_DIST =		mad.h.sed  \
-+EXTRA_DIST =		mad.h.sed mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA= mad.pc
-+
- exported_headers =	version.h fixed.h bit.h timer.h stream.h frame.h  \
- 			synth.h decoder.h
- 
-diff -ruN libmad-0.15.1b.orig/Makefile.in libmad-0.15.1b/Makefile.in
---- libmad-0.15.1b.orig/Makefile.in	2004-02-17 02:33:23.000000000 +0000
-+++ libmad-0.15.1b/Makefile.in	2005-08-25 12:09:34.000000000 +0000
-@@ -14,6 +14,8 @@
- 
- @SET_MAKE@
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA = mad.pc
- 
- SOURCES = $(libmad_la_SOURCES) $(EXTRA_libmad_la_SOURCES) $(minimad_SOURCES)
- 
-@@ -43,7 +45,7 @@
- 	$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
- 	$(srcdir)/config.h.in $(srcdir)/libmad.list.in \
- 	$(top_srcdir)/configure COPYING INSTALL TODO config.guess \
--	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs
-+	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs mad.pc.in
- subdir = .
- ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
- am__aclocal_m4_deps = $(top_srcdir)/configure.ac
-@@ -53,7 +55,7 @@
-  configure.lineno configure.status.lineno
- mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
- CONFIG_HEADER = config.h
--CONFIG_CLEAN_FILES = libmad.list
-+CONFIG_CLEAN_FILES = libmad.list mad.pc
- am__installdirs = $(DESTDIR)$(libdir) $(DESTDIR)$(includedir)
- libLTLIBRARIES_INSTALL = $(INSTALL)
- LTLIBRARIES = $(lib_LTLIBRARIES)
-@@ -218,7 +220,7 @@
- minimad_SOURCES = minimad.c
- minimad_INCLUDES = 
- minimad_LDADD = libmad.la
--EXTRA_DIST = mad.h.sed  \
-+EXTRA_DIST = mad.h.sed  mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
- exported_headers = version.h fixed.h bit.h timer.h stream.h frame.h  \
-@@ -298,6 +300,28 @@
- 	rm -f stamp-h1
- 	touch $@
- 
-+mad.pc: $(top_builddir)/config.status mad.pc.in
-+	cd $(top_builddir) && CONFIG_FILES=$@ CONFIG_HEADERS= $(SHELL) ./config.status
-+
-+install-pkgconfigDATA: $(pkgconfig_DATA)
-+	@$(NORMAL_INSTALL)
-+	$(mkinstalldirs) $(DESTDIR)$(pkgconfigdir)
-+	@list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  if test -f $(srcdir)/$$p; then \
-+	    echo " $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  else if test -f $$p; then \
-+	    echo " $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  fi; fi; \
-+	done
-+
-+uninstall-pkgconfigDATA:
-+	@$(NORMAL_UNINSTALL)
-+	list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  rm -f $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	done
-+
- distclean-hdr:
- 	-rm -f config.h stamp-h1
- libmad.list: $(top_builddir)/config.status $(srcdir)/libmad.list.in
-@@ -726,7 +750,7 @@
- 
- info-am:
- 
--install-data-am: install-includeHEADERS
-+install-data-am: install-includeHEADERS install-pkgconfigDATA
- 
- install-exec-am: install-libLTLIBRARIES
- 
-@@ -757,7 +781,7 @@
- ps-am:
- 
- uninstall-am: uninstall-includeHEADERS uninstall-info-am \
--	uninstall-libLTLIBRARIES
-+	uninstall-libLTLIBRARIES install-pkgconfigDATA
- 
- uninstall-info: uninstall-info-recursive
- 
-diff -ruN libmad-0.15.1b.orig/mad.pc.in libmad-0.15.1b/mad.pc.in
---- libmad-0.15.1b.orig/mad.pc.in	1970-01-01 00:00:00.000000000 +0000
-+++ libmad-0.15.1b/mad.pc.in	2005-08-25 12:08:04.000000000 +0000
-@@ -0,0 +1,10 @@
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+libdir=@libdir@
-+includedir=@includedir@
-+
-+Name: MAD
-+Description: libmad - MPEG audio decoder library
-+Version: @VERSION@
-+Libs: -L${libdir} -lmad
-+Cflags: