treewide: manual fixups for

treewide: use toString on list NIX_CFLAGS_COMPILE
treewide: move NIX_CFLAGS_COMPILE to the env attrset

42 files changed, 72 insertions, 71 deletions

diff --git a/doc/languages-frameworks/emscripten.section.md b/doc/languages-frameworks/emscripten.section.md
index ff622cfb0b5..67c8ed42bfd 100644
--- a/doc/languages-frameworks/emscripten.section.md
+++ b/doc/languages-frameworks/emscripten.section.md
@@ -60,7 +60,7 @@ See the `zlib` example:
     (old: rec {
       buildInputs = old.buildInputs ++ [ pkg-config ];
       # we need to reset this setting!
-      NIX_CFLAGS_COMPILE="";
+      env = (old.env or { }) // { NIX_CFLAGS_COMPILE = ""; };
       configurePhase = ''
         # FIXME: Some tests require writing at $HOME
         HOME=$TMPDIR
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 1488a09982a..b3f9f681da4 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1329,7 +1329,7 @@ bin/blib.a(bios_console.o): In function `bios_handle_cup':
 
 Adds the `-O2 -D_FORTIFY_SOURCE=2` compiler options. During code generation the compiler knows a great deal of information about buffer sizes (where possible), and attempts to replace insecure unlimited length buffer function calls with length-limited ones. This is especially useful for old, crufty code. Additionally, format strings in writable memory that contain `%n` are blocked. If an application depends on such a format string, it will need to be worked around.
 
-Additionally, some warnings are enabled which might trigger build failures if compiler warnings are treated as errors in the package build. In this case, set `NIX_CFLAGS_COMPILE` to `-Wno-error=warning-type`.
+Additionally, some warnings are enabled which might trigger build failures if compiler warnings are treated as errors in the package build. In this case, set `env.NIX_CFLAGS_COMPILE` to `-Wno-error=warning-type`.
 
 This needs to be turned off or fixed for errors similar to:
 
diff --git a/pkgs/applications/audio/littlegptracker/default.nix b/pkgs/applications/audio/littlegptracker/default.nix
index b3bcd593848..846936e65f6 100644
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isLinux  [ "PLATFORM=DEB" ]
     ++ lib.optionals stdenv.isDarwin [ "PLATFORM=OSX" ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ] ++
-    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-fpermissive" ] ++
+    lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing");
 
   NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework Foundation";
 
diff --git a/pkgs/applications/editors/nedit/default.nix b/pkgs/applications/editors/nedit/default.nix
index b49fbc14fad..41c72cc51ea 100644
--- a/pkgs/applications/editors/nedit/default.nix
+++ b/pkgs/applications/editors/nedit/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   # the linux config works fine on darwin too!
   buildFlags = lib.optional (stdenv.isLinux || stdenv.isDarwin) "linux";
 
-  NIX_CFLAGS_COMPILE="-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
+  env.NIX_CFLAGS_COMPILE = "-DBUILD_UNTESTED_NEDIT -L${motif}/lib";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/applications/editors/texmaker/default.nix b/pkgs/applications/editors/texmaker/default.nix
index 693362f95f6..d4bfdebd6a5 100644
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@@ -11,7 +11,7 @@ mkDerivation rec {
 
   buildInputs = [ qtbase qtscript poppler zlib qtwebengine ];
   nativeBuildInputs = [ pkg-config poppler qmake ];
-  NIX_CFLAGS_COMPILE="-I${poppler.dev}/include/poppler";
+  env.NIX_CFLAGS_COMPILE = "-I${poppler.dev}/include/poppler";
 
   qmakeFlags = [
     "DESKTOPDIR=${placeholder "out"}/share/applications"
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index 3787d1ef764..4adedcaffe7 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -33,8 +33,8 @@ mkDerivation rec {
     xsimd
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${ilmbase.dev}/include/OpenEXR" ]
-    ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-I${ilmbase.dev}/include/OpenEXR" ]
+    ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy");
 
   # Krita runs custom python scripts in CMake with custom PYTHONPATH which krita determined in their CMake script.
   # Patch the PYTHONPATH so python scripts can import sip successfully.
diff --git a/pkgs/applications/misc/mysql-workbench/default.nix b/pkgs/applications/misc/mysql-workbench/default.nix
index 79022bc1531..4ba4d992835 100644
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@@ -140,7 +140,7 @@ in stdenv.mkDerivation rec {
     patchShebangs tools/get_wb_version.sh
   '';
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
     "-Wno-error=deprecated-declarations"
   ] ++ lib.optionals stdenv.isAarch64 [
@@ -149,7 +149,7 @@ in stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but problematic with some old GCCs
     "-Wno-error=maybe-uninitalized"
-  ];
+  ]);
 
   cmakeFlags = [
     "-DMySQL_CONFIG_PATH=${mysql}/bin/mysql_config"
diff --git a/pkgs/applications/misc/vp/default.nix b/pkgs/applications/misc/vp/default.nix
index d133331a0a7..5d280292134 100644
--- a/pkgs/applications/misc/vp/default.nix
+++ b/pkgs/applications/misc/vp/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL SDL_image ];
 
-  NIX_CFLAGS_COMPILE="-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${SDL}/include/SDL -I${SDL_image}/include/SDL";
 
   meta = with lib; {
     homepage = "https://brlcad.org/~erik/";
diff --git a/pkgs/applications/networking/browsers/ladybird/default.nix b/pkgs/applications/networking/browsers/ladybird/default.nix
index 6f130f33896..da5f1838679 100644
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@@ -49,13 +49,13 @@ stdenv.mkDerivation {
     "-DENABLE_UNICODE_DATABASE_DOWNLOAD=false"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error"
   ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
     # error: use of undeclared identifier 'aligned_alloc'
     "-include mm_malloc.h"
     "-Daligned_alloc=_mm_malloc"
-  ];
+  ]);
 
   # https://github.com/NixOS/nixpkgs/issues/201254
   NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
diff --git a/pkgs/applications/networking/browsers/netsurf/libcss.nix b/pkgs/applications/networking/browsers/netsurf/libcss.nix
index 7777bb243fa..db5a39f2285 100644
--- a/pkgs/applications/networking/browsers/netsurf/libcss.nix
+++ b/pkgs/applications/networking/browsers/netsurf/libcss.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "NSSHARED=${buildsystem}/share/netsurf-buildsystem"
   ];
 
-  NIX_CFLAGS_COMPILE= [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" "-Wno-error=maybe-uninitialized" ];
 
   meta = with lib; {
     homepage = "https://www.netsurf-browser.org/projects/${libname}/";
diff --git a/pkgs/applications/science/physics/dawncut/default.nix b/pkgs/applications/science/physics/dawncut/default.nix
index 8c0bc1ae639..5c17837d2e9 100644
--- a/pkgs/applications/science/physics/dawncut/default.nix
+++ b/pkgs/applications/science/physics/dawncut/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  NIX_CFLAGS_COMPILE="-std=c++98";
+  env.NIX_CFLAGS_COMPILE = "-std=c++98";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index 01c73a8515e..b40ea68a48a 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   # Do not build static libraries
   cmakeFlags = [ "-DENABLE_STATIC=NO" ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error=cast-function-type"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=format-truncation"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but problematic with some old GCCs and probably clang
     "-Wno-error=use-after-free"
-  ];
+  ]);
 
   propagatedBuildInputs = [ libantlr3c mbedtls_2 bctoolbox belr ];
 
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 98f2e406bc0..e1a427e35b6 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -50,19 +50,21 @@ in
     # invocation does not work.
     hardeningDisable = [ "fortify" "pie" "stackprotector" ];
 
-    env.NIX_CFLAGS_COMPILE = lib.concatStringsSep " "
-      (builtins.concatLists [
-        (lib.optionals withGd gdCflags)
-        # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
-        # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
-        (lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
-        (lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) || stdenv.hostPlatform.isMusl) [
-          # Ignore "error: '__EI___errno_location' specifies less restrictive attributes than its target '__errno_location'"
-          # New warning as of GCC 9
-          # Same for musl: https://github.com/NixOS/nixpkgs/issues/78805
-          "-Wno-error=missing-attributes"
-        ])
-      ]);
+    env = (previousAttrs.env or { }) // {
+      NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + lib.concatStringsSep " "
+        (builtins.concatLists [
+          (lib.optionals withGd gdCflags)
+          # Fix -Werror build failure when building glibc with musl with GCC >= 8, see:
+          # https://github.com/NixOS/nixpkgs/pull/68244#issuecomment-544307798
+          (lib.optional stdenv.hostPlatform.isMusl "-Wno-error=attribute-alias")
+          (lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) || stdenv.hostPlatform.isMusl) [
+            # Ignore "error: '__EI___errno_location' specifies less restrictive attributes than its target '__errno_location'"
+            # New warning as of GCC 9
+            # Same for musl: https://github.com/NixOS/nixpkgs/issues/78805
+            "-Wno-error=missing-attributes"
+          ])
+        ]);
+    };
 
     # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
     # any program we run, because the gcc will have been placed at a new
diff --git a/pkgs/development/libraries/libiscsi/default.nix b/pkgs/development/libraries/libiscsi/default.nix
index 2c9a232b315..806a9729c57 100644
--- a/pkgs/development/libraries/libiscsi/default.nix
+++ b/pkgs/development/libraries/libiscsi/default.nix
@@ -14,8 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   # This problem is gone on libiscsi master.
-  env.NIX_CFLAGS_COMPILE =
-    lib.optional stdenv.hostPlatform.is32bit "-Wno-error=sign-compare";
+  env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.hostPlatform.is32bit "-Wno-error=sign-compare");
 
   meta = with lib; {
     description = "iscsi client library and utilities";
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index a9382294ebe..408d5f4e1ac 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -103,14 +103,14 @@ stdenv.mkDerivation rec {
       runHook postBuild
     '';
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error"
     "-DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\""
   ] ++ lib.optionals stdenv.hostPlatform.is64bit [
     "-DNSS_USE_64=1"
   ] ++ lib.optionals stdenv.hostPlatform.isILP32 [
     "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
-  ];
+  ]);
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/libraries/openexrid-unstable/default.nix b/pkgs/development/libraries/openexrid-unstable/default.nix
index 47b2f639547..c961dfd069a 100644
--- a/pkgs/development/libraries/openexrid-unstable/default.nix
+++ b/pkgs/development/libraries/openexrid-unstable/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
         --replace g++ c++
   '';
 
-  NIX_CFLAGS_COMPILE=''-I${ilmbase.dev}/include/OpenEXR
+  env.NIX_CFLAGS_COMPILE = ''-I${ilmbase.dev}/include/OpenEXR
                        -I${openexr.dev}/include/OpenEXR
                        -I${openfx.dev}/include/OpenFX
                       '';
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index 1299cd11dd6..a70ebd3fb74 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -35,7 +35,7 @@ qtModule {
       "-DMACOS_FORCE_SYSTEM_XML_LIBRARIES=OFF"
     ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     # with gcc7 this warning blows the log over Hydra's limit
     "-Wno-expansion-to-defined"
   ]
@@ -43,7 +43,7 @@ qtModule {
   ++ lib.optional stdenv.cc.isGNU "-Wno-class-memaccess"
   # with clang this warning blows the log over Hydra's limit
   ++ lib.optional stdenv.isDarwin "-Wno-inconsistent-missing-override"
-  ++ lib.optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${lib.getLib systemd}/lib/libudev"'';
+  ++ lib.optional (!stdenv.isDarwin) ''-DNIXPKGS_LIBUDEV="${lib.getLib systemd}/lib/libudev"'');
 
   doCheck = false; # fails 13 out of 13 tests (ctest)
 
diff --git a/pkgs/development/libraries/qt-mobility/default.nix b/pkgs/development/libraries/qt-mobility/default.nix
index 36e1948f09e..7807e41b606 100644
--- a/pkgs/development/libraries/qt-mobility/default.nix
+++ b/pkgs/development/libraries/qt-mobility/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "14713pbscysd6d0b9rgm7gg145jzwvgdn22778pf2v13qzvfmy1i";
   };
 
-  NIX_CFLAGS_COMPILE="-fpermissive";
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
 
   configurePhase = ''
     ./configure -prefix $out
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 151958dd0e1..91f694649b0 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS="$NIX_LDFLAGS -lm"
 
     echo ""
-    echo "env.NIX_CFLAGS_COMPILE = $NIX_CFLAGS_COMPILE"
+    echo "NIX_CFLAGS_COMPILE = $NIX_CFLAGS_COMPILE"
     echo ""
   '';
 
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 2abc9d29e96..8fe9e1fed62 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -213,11 +213,11 @@ in buildPythonPackage rec {
   #
   # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
   # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-  env.NIX_CFLAGS_COMPILE = lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
+  env.NIX_CFLAGS_COMPILE = toString ((lib.optionals (blas.implementation == "mkl") [ "-Wno-error=array-bounds" ]
   # Suppress gcc regression: avx512 math function raises uninitialized variable warning
   # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105593
   # See also: Fails to compile with GCC 12.1.0 https://github.com/pytorch/pytorch/issues/77939
-  ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=maybe-uninitialized" "-Wno-error=uninitialized" ];
+  ++ lib.optionals stdenv.cc.isGNU [ "-Wno-error=maybe-uninitialized" "-Wno-error=uninitialized" ]));
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/tools/tracy/default.nix b/pkgs/development/tools/tracy/default.nix
index 4d430148500..00e121adc71 100644
--- a/pkgs/development/tools/tracy/default.nix
+++ b/pkgs/development/tools/tracy/default.nix
@@ -21,13 +21,13 @@ in stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin [ Carbon AppKit freetype ]
     ++ lib.optionals stdenv.isLinux [ gtk3 tbb dbus ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ ]
+  env.NIX_CFLAGS_COMPILE = toString ([ ]
     # Apple's compiler finds a format string security error on
     # ../../../server/TracyView.cpp:649:34, preventing building.
     ++ lib.optional stdenv.isDarwin "-Wno-format-security"
     ++ lib.optional stdenv.isLinux "-ltbb"
     ++ lib.optional stdenv.cc.isClang "-faligned-allocation"
-    ++ lib.optional disableLTO "-fno-lto";
+    ++ lib.optional disableLTO "-fno-lto");
 
   NIX_CFLAGS_LINK = lib.optional disableLTO "-fno-lto";
 
diff --git a/pkgs/games/naev/default.nix b/pkgs/games/naev/default.nix
index f359b8c9d98..d23517cfad3 100644
--- a/pkgs/games/naev/default.nix
+++ b/pkgs/games/naev/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
-  NIX_CFLAGS_COMPILE="-include ${zlib.dev}/include/zlib.h";
+  env.NIX_CFLAGS_COMPILE = "-include ${zlib.dev}/include/zlib.h";
 
   postInstall = ''
     mkdir -p $out/share/naev
diff --git a/pkgs/games/tinyfugue/default.nix b/pkgs/games/tinyfugue/default.nix
index 46a5aae09ef..a787d0b25bf 100644
--- a/pkgs/games/tinyfugue/default.nix
+++ b/pkgs/games/tinyfugue/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: world.o:/build/tf-50b8/src/socket.h:24: multiple definition of
   #     `world_decl'; command.o:/build/tf-50b8/src/socket.h:24: first defined here
-  NIX_CFLAGS_COMPILE="-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = {
     homepage = "https://tinyfugue.sourceforge.net/";
diff --git a/pkgs/games/xsok/default.nix b/pkgs/games/xsok/default.nix
index bb749b57d01..53254ba98f9 100644
--- a/pkgs/games/xsok/default.nix
+++ b/pkgs/games/xsok/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libX11 libXt libXaw libXpm libXext];
   nativeBuildInputs = [imake];
 
-  NIX_CFLAGS_COMPILE=" -isystem ${libXpm.dev}/include/X11 ";
+  env.NIX_CFLAGS_COMPILE = " -isystem ${libXpm.dev}/include/X11 ";
 
   preConfigure = ''
     sed -e "s@/usr/@$out/share/@g" -i src/Imakefile
diff --git a/pkgs/games/zaz/default.nix b/pkgs/games/zaz/default.nix
index ebc7dff5406..84db2a1356c 100644
--- a/pkgs/games/zaz/default.nix
+++ b/pkgs/games/zaz/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   # Fix SDL include problems
-  NIX_CFLAGS_COMPILE="-I${lib.getDev SDL}/include/SDL -I${SDL_image}/include/SDL";
+  env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL}/include/SDL -I${SDL_image}/include/SDL";
   # Fix linking errors
   makeFlags = [
     "ZAZ_LIBS+=-lSDL"
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 16ebb2e7188..0c40bc3b186 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -12,7 +12,7 @@ appleDerivation {
   # env.NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
   #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
-  env.NIX_CFLAGS_COMPILE = toString [ "-DDAEMON_UID=1"
+  env.NIX_CFLAGS_COMPILE = toString ([ "-DDAEMON_UID=1"
                          "-DDAEMON_GID=1"
                          "-DDEFAULT_AT_QUEUE='a'"
                          "-DDEFAULT_BATCH_QUEUE='b'"
@@ -28,7 +28,7 @@ appleDerivation {
                          "-DAHZV1=64 "
                          "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
                          "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
-                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ");
 
   patchPhase = ''
     substituteInPlace login.tproj/login.c \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
index 672bb443242..c99523d6c86 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -20,7 +20,7 @@ appleDerivation {
     done
   '';
 
-  NIX_CFLAGS_COMPILE=[ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=format-security" ]; # hardeningDisable doesn't cut it
 
   meta = {
     platforms = lib.platforms.darwin;
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index 96dc2e6ffad..0eedc5e08a1 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./pci.patch ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=implicit-fallthrough";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
 
   postInstall = ''
     cd ../
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 7ba338d3785..c709c702f93 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" "format" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 821d5113308..f5153eb5abc 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation {
   # gcc-10. Otherwise build fails as:
   #   ld: acpi/xsdt.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: multiple definition of
   #     `e820_types'; memory.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: first defined here
-  NIX_CFLAGS_COMPILE="-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   makeFlags = [
     "BINDIR=$(out)/bin"
diff --git a/pkgs/servers/mail/archiveopteryx/default.nix b/pkgs/servers/mail/archiveopteryx/default.nix
index 22bd985e983..99e482323a4 100644
--- a/pkgs/servers/mail/archiveopteryx/default.nix
+++ b/pkgs/servers/mail/archiveopteryx/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   # fix build on gcc7+ and gcc11+
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-std=c++11" # c++17+ has errors
     "-Wno-error=builtin-declaration-mismatch"
     "-Wno-error=deprecated-copy"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "-Wno-error=nonnull"
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
     "-Wno-error=mismatched-new-delete"
-  ];
+  ]);
 
   buildPhase = ''jam "-j$NIX_BUILD_CORES" '';
   installPhase = ''
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 2eb98168214..aa7e4136017 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningEnable = [ "pie" ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=deprecated-declarations" ]
-    ++ lib.optional stdenv.isDarwin "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = toString ([ "-Wno-error=deprecated-declarations" ]
+    ++ lib.optional stdenv.isDarwin "-Wno-error");
 
   meta = with lib; {
     description = "A distributed memory object caching system";
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 8b2e22d0380..75466c0ee21 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -75,13 +75,13 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-Wno-error=format-truncation"
     "-Wno-error=stringop-truncation"
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but unrecognized with GCC 9
     "-Wno-error=use-after-free"
-  ];
+  ]);
 
   configureFlags = [
     # disable dvbscan, as having it enabled causes a network download which
diff --git a/pkgs/tools/audio/mpris-scrobbler/default.nix b/pkgs/tools/audio/mpris-scrobbler/default.nix
index 13128367d3a..ba80aa6ad0e 100644
--- a/pkgs/tools/audio/mpris-scrobbler/default.nix
+++ b/pkgs/tools/audio/mpris-scrobbler/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     "-Dversion=${version}"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     # Needed with GCC 12
     "-Wno-error=address"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     "-Wno-array-bounds"
     "-Wno-free-nonheap-object"
     "-Wno-stringop-truncation"
-  ];
+  ]);
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/filesystems/svnfs/default.nix b/pkgs/tools/filesystems/svnfs/default.nix
index cd6cbe5e799..e892d89dc3b 100644
--- a/pkgs/tools/filesystems/svnfs/default.nix
+++ b/pkgs/tools/filesystems/svnfs/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: svnclient.o:/build/svnfs-0.4/src/svnfs.h:40: multiple definition of
   #     `dirbuf'; svnfs.o:/build/svnfs-0.4/src/svnfs.h:40: first defined here
-  NIX_CFLAGS_COMPILE="-I ${subversion.dev}/include/subversion-1 -fcommon";
+  env.NIX_CFLAGS_COMPILE = "-I ${subversion.dev}/include/subversion-1 -fcommon";
   NIX_LDFLAGS="-lsvn_client-1 -lsvn_subr-1";
 
   meta = {
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index cd890d6e835..8ecbe342034 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -149,10 +149,10 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
-  env.NIX_CFLAGS_COMPILE = toString []
+  env.NIX_CFLAGS_COMPILE = toString ([]
     # Work around a bogus warning in conjunction with musl.
     ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
-    ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0";
+    ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0");
 
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 7f06eb6b3ef..45e6a33e3c8 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -35,14 +35,14 @@ rustPlatform.buildRustPackage rec {
     libuv
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-O2"
     "-Wno-error=array-bounds"
     "-Wno-error=stringop-overflow"
     "-Wno-error=stringop-truncation"
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
     "-Wno-error=stringop-overread"
-  ];
+  ]);
 
   passthru.tests.basic = nixosTests.cjdns;
 
diff --git a/pkgs/tools/networking/libnids/default.nix b/pkgs/tools/networking/libnids/default.nix
index f02e3bef9e1..e6df2850a1c 100644
--- a/pkgs/tools/networking/libnids/default.nix
+++ b/pkgs/tools/networking/libnids/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   this is necessary for dsniff to compile; otherwise g_thread_init is a missing
   symbol when linking (?!?)
   */
-  NIX_CFLAGS_COMPILE="-Dg_thread_init= ";
+  env.NIX_CFLAGS_COMPILE = "-Dg_thread_init= ";
 
   meta = with lib; {
     description = "An E-component of Network Intrusion Detection System which emulates the IP stack of Linux 2.0.x";
diff --git a/pkgs/tools/networking/ripmime/default.nix b/pkgs/tools/networking/ripmime/default.nix
index 0dfeb900c9a..6584edca5e6 100644
--- a/pkgs/tools/networking/ripmime/default.nix
+++ b/pkgs/tools/networking/ripmime/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/bin" "$out/share/man/man1"
   '';
 
-  NIX_CFLAGS_COMPILE=" -Wno-error ";
+  env.NIX_CFLAGS_COMPILE = " -Wno-error ";
 
   meta = with lib; {
     description = "Attachment extractor for MIME messages";
diff --git a/pkgs/tools/networking/tftp-hpa/default.nix b/pkgs/tools/networking/tftp-hpa/default.nix
index 987315b8351..15fd0473532 100644
--- a/pkgs/tools/networking/tftp-hpa/default.nix
+++ b/pkgs/tools/networking/tftp-hpa/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: main.o:/build/tftp-hpa-5.2/tftp/main.c:98: multiple definition of
   #     `toplevel'; tftp.o:/build/tftp-hpa-5.2/tftp/tftp.c:51: first defined here
-  NIX_CFLAGS_COMPILE="-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   meta = with lib; {
     description = "TFTP tools - a lot of fixes on top of BSD TFTP";
diff --git a/pkgs/tools/system/testdisk/default.nix b/pkgs/tools/system/testdisk/default.nix
index 10cbed47068..8bc290d6a67 100644
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -41,7 +41,7 @@ assert enableQt -> qwt != null;
 
   nativeBuildInputs = [ pkg-config ];
 
-  NIX_CFLAGS_COMPILE="-Wno-unused";
+  env.NIX_CFLAGS_COMPILE = "-Wno-unused";
 
   meta = with lib; {
     homepage = "https://www.cgsecurity.org/wiki/Main_Page";
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index d5f820d0d60..5e64739b865 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -142,7 +142,7 @@ rec {
     (old: {
       nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkg-config ];
       # we need to reset this setting!
-      NIX_CFLAGS_COMPILE="";
+      env = (old.env or { }) // { NIX_CFLAGS_COMPILE = ""; };
       dontStrip = true;
       outputs = [ "out" ];
       buildPhase = ''