Merge pull request #75929 from NixOS/staging-next

Staging next

40 files changed, 326 insertions, 140 deletions

diff --git a/nixos/modules/services/x11/extra-layouts.nix b/nixos/modules/services/x11/extra-layouts.nix
index 1af98a1318b..b06bed7c09c 100644
--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@@ -158,6 +158,12 @@ in
 
     });
 
+    environment.sessionVariables = {
+      # runtime override supported by multiple libraries e. g. libxkbcommon
+      # https://xkbcommon.org/doc/current/group__include-path.html
+      XKB_CONFIG_ROOT = "${pkgs.xkb_patched}/etc/X11/xkb";
+    };
+
     services.xserver = {
       xkbDir = "${pkgs.xkb_patched}/etc/X11/xkb";
       exportConfiguration = config.services.xserver.displayManager.startx.enable;
diff --git a/pkgs/applications/misc/polybar/default.nix b/pkgs/applications/misc/polybar/default.nix
index fcc6ead550a..24eb6451088 100644
--- a/pkgs/applications/misc/polybar/default.nix
+++ b/pkgs/applications/misc/polybar/default.nix
@@ -24,8 +24,7 @@ assert nlSupport     -> ! iwSupport && libnl         != null;
 assert i3Support     -> ! i3GapsSupport && jsoncpp != null && i3      != null;
 assert i3GapsSupport -> ! i3Support     && jsoncpp != null && i3-gaps != null;
 
-let xcbproto-py3 = xcbproto.override { python = python3; };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
     pname = "polybar";
     version = "3.4.1";
 
@@ -51,7 +50,7 @@ in stdenv.mkDerivation rec {
     };
 
     buildInputs = [
-      cairo libXdmcp libpthreadstubs libxcb pcre python3 xcbproto-py3 xcbutil
+      cairo libXdmcp libpthreadstubs libxcb pcre python3 xcbproto xcbutil
       xcbutilcursor xcbutilimage xcbutilrenderutil xcbutilwm xcbutilxrm
 
       (if alsaSupport   then alsaLib       else null)
diff --git a/pkgs/data/fonts/monoid/default.nix b/pkgs/data/fonts/monoid/default.nix
index 06fb7499b81..22714170fa4 100644
--- a/pkgs/data/fonts/monoid/default.nix
+++ b/pkgs/data/fonts/monoid/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, python, fontforge }:
+{ stdenv, fetchFromGitHub, python2 }:
+# Python 3 support requires https://github.com/larsenwork/monoid/pull/233 to be merged
 
 stdenv.mkDerivation {
   pname = "monoid";
@@ -11,7 +12,11 @@ stdenv.mkDerivation {
     sha256 = "07h5q6cn6jjpmxp9vyag1bxx481waz344sr2kfs7d37bba8yjydj";
   };
 
-  nativeBuildInputs = [ python fontforge ];
+  nativeBuildInputs = [
+    (python2.withPackages (pp: with pp; [
+      fontforge
+    ]))
+  ];
 
   buildPhase = ''
     local _d=""
diff --git a/pkgs/data/fonts/rictydiminished-with-firacode/default.nix b/pkgs/data/fonts/rictydiminished-with-firacode/default.nix
index 8b6c3749962..bf19fb8238f 100644
--- a/pkgs/data/fonts/rictydiminished-with-firacode/default.nix
+++ b/pkgs/data/fonts/rictydiminished-with-firacode/default.nix
@@ -1,32 +1,40 @@
-{ stdenv, fetchgit, fontforge, python3 }:
+{ stdenv, fetchgit, fontforge, python2, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "rictydiminished-with-firacode";
-  version = "0.0.1";
+  version = "1.2.0";
+
   src = fetchgit {
     url = "https://github.com/hakatashi/RictyDiminished-with-FiraCode.git";
-    rev = "refs/tags/${version}";
-    sha256 = "12lhb0k4d8p4lzw9k6hlsxpfpc15zfshz1h5cbaa88sb8n5jh360";
+    rev = version;
+    sha256 = "1vlzx5dsx6j9d9q84pdnwcxjy7mr1sv8sacx0zgfxhxnj66n1gnn";
     fetchSubmodules = true;
   };
 
-  buildPhase = ''
+  postPatch = ''
+    # Make builds more reproducible
     substituteInPlace apply-feature.py --replace \
       'ricty = ttLib.TTFont(options.in_font)' \
       'ricty = ttLib.TTFont(options.in_font, recalcTimestamp=False)'
     substituteInPlace build-py3.py --replace \
       'datetime.date.today()' \
       'datetime.date.fromtimestamp(float(os.environ["SOURCE_DATE_EPOCH"]))'
-
-    make
   '';
 
   installPhase = ''
+    runHook preInstall
+
     install -m444 -Dt $out/share/fonts/rictydiminished-with-firacode *.ttf
+
+    runHook postInstall
   '';
 
   nativeBuildInputs = [
-    fontforge
+    # Python 3 not supported by parts of the build system
+    # https://github.com/hakatashi/RictyDiminished-with-FiraCode/pull/3
+    (fontforge.override {
+      python = python2;
+    })
     (python3.withPackages (ps: [
       ps.jinja2
       ps.py3to2
@@ -35,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/hakatashi/RictyDiminished-with-FiraCode;
+    homepage = "https://github.com/hakatashi/RictyDiminished-with-FiraCode";
     description = "The best Japanese programming font meets the awesone ligatures of Firacode";
     license = licenses.ofl;
     platforms = platforms.all;
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 99739646a8b..34dd48b897f 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nss, python
+{ stdenv, fetchurl, nss, python3
 , blacklist ? []
 , includeEmail ? false
 }:
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   outputs = [ "out" "unbundled" ];
 
-  nativeBuildInputs = [ python ];
+  nativeBuildInputs = [ python3 ];
 
   configurePhase = ''
     ln -s nss/lib/ckfw/builtins/certdata.txt
diff --git a/pkgs/desktops/gnome-2/platform/GConf/default.nix b/pkgs/desktops/gnome-2/platform/GConf/default.nix
index 1a1848491b1..f13ff571242 100644
--- a/pkgs/desktops/gnome-2/platform/GConf/default.nix
+++ b/pkgs/desktops/gnome-2/platform/GConf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, dbus-glib, glib, ORBit2, libxml2, polkit, python2, intltool }:
+{ stdenv, fetchurl, pkgconfig, dbus-glib, glib, ORBit2, libxml2, polkit, python3, intltool }:
 
 stdenv.mkDerivation rec {
   pname = "gconf";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ ORBit2 libxml2 python2 ]
+  buildInputs = [ ORBit2 libxml2 python3 ]
     # polkit requires pam, which requires shadow.h, which is not available on
     # darwin
     ++ stdenv.lib.optional (!stdenv.isDarwin) polkit;
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     # fixes the "libgconfbackend-oldxml.so is not portable" error on darwin
     stdenv.lib.optional stdenv.isDarwin [ "--enable-static" ];
 
+  postPatch = ''
+    2to3 --write --nobackup gsettings/gsettings-schema-convert
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://projects.gnome.org/gconf/;
     description = "Deprecated system for storing application preferences";
diff --git a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
index f7f83b56932..6e777636747 100644
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, substituteAll, pkgconfig, libxslt, ninja, libX11, gnome3, gtk3, glib
+{ stdenv, fetchurl, fetchpatch, substituteAll, pkgconfig, libxslt, ninja, libX11, gnome3, gtk3, glib
 , gettext, libxml2, xkeyboard_config, isocodes, meson, wayland
 , libseccomp, systemd, bubblewrap, gobject-introspection, gtk-doc, docbook_xsl, gsettings-desktop-schemas }:
 
@@ -30,6 +30,14 @@ stdenv.mkDerivation rec {
       bubblewrap_bin = "${bubblewrap}/bin/bwrap";
       inherit (builtins) storeDir;
     })
+
+    # honor $XKB_CONFIG_ROOT
+    # addresses #76590: services.xserver.extraLayouts aren't honored by GNOME3
+    # NOTE: should be merged upstream in 3.36.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-desktop/commit/450446b5353e8231edded4d5b5db90a67a9fa9b7.diff";
+      sha256 = "07y989x7mbgn3rsm2qfdi8qkkc8i60k28hw87l744nlkydn78kq5";
+    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome-3/core/zenity/default.nix b/pkgs/desktops/gnome-3/core/zenity/default.nix
index 5023ffce6b9..16ef06d8d9d 100644
--- a/pkgs/desktops/gnome-3/core/zenity/default.nix
+++ b/pkgs/desktops/gnome-3/core/zenity/default.nix
@@ -1,5 +1,15 @@
-{ stdenv, fetchurl, pkgconfig, libxml2, libxslt, gnome3, gtk3
-, gnome-doc-utils, intltool, libX11, which, itstool, wrapGAppsHook }:
+{ stdenv
+, fetchurl
+, pkgconfig
+, libxml2
+, gnome3
+, gtk3
+, yelp-tools
+, gettext
+, libX11
+, itstool
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "zenity";
@@ -10,13 +20,19 @@ stdenv.mkDerivation rec {
     sha256 = "15fdh8xfdhnwcynyh4byx3mrjxbyprqnwxzi7qn3g5wwaqryg1p7";
   };
 
-  preBuild = ''
-    mkdir -p $out/include
-  '';
+  nativeBuildInputs = [
+    pkgconfig
+    gettext
+    yelp-tools
+    itstool
+    libxml2
+    wrapGAppsHook
+  ];
 
-  buildInputs = [ gtk3 libxml2 libxslt libX11 itstool ];
-
-  nativeBuildInputs = [ pkgconfig intltool gnome-doc-utils which wrapGAppsHook ];
+  buildInputs = [
+    gtk3
+    libX11
+  ];
 
   passthru = {
     updateScript = gnome3.updateScript {
@@ -26,6 +42,8 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
+    description = "Tool to display dialogs from the commandline and shell scripts";
+    homepage = "https://wiki.gnome.org/Projects/Zenity";
     platforms = platforms.linux;
     maintainers = gnome3.maintainers;
   };
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 91a31be9f8d..f639d330566 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -1,4 +1,4 @@
-{ stdenv, file, curl, pkgconfig, python, openssl, cmake, zlib
+{ stdenv, file, curl, pkgconfig, python3, openssl, cmake, zlib
 , makeWrapper, libiconv, cacert, rustPlatform, rustc, libgit2
 , CoreFoundation, Security
 }:
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
   dontUpdateAutotoolsGnuConfigScripts = true;
 
   nativeBuildInputs = [ pkgconfig cmake makeWrapper ];
-  buildInputs = [ cacert file curl python openssl zlib libgit2 ]
+  buildInputs = [ cacert file curl python3 openssl zlib libgit2 ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation Security libiconv ];
 
   LIBGIT2_SYS_USE_PKG_CONFIG = 1;
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index ca9bf05b7e7..49eaeef0d9c 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,5 +1,5 @@
 { stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget
-, fetchurl, file, python2
+, fetchurl, file, python3
 , llvm_9, darwin, git, cmake, rust, rustPlatform
 , pkgconfig, openssl
 , which, libffi
@@ -121,7 +121,7 @@ in stdenv.mkDerivation rec {
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [
-    file python2 rustPlatform.rust.rustc git cmake
+    file python3 rustPlatform.rust.rustc git cmake
     which libffi removeReferencesTo pkgconfig
   ];
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index de980f1ca68..e6b3dff433b 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -234,9 +234,6 @@ in with passthru; stdenv.mkDerivation ({
         ln -s $out/lib/${libPrefix}/pdb.py $out/bin/pdb${sourceVersion.major}.${sourceVersion.minor}
         ln -s $out/share/man/man1/{python2.7.1.gz,python.1.gz}
 
-        # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
-        echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
-
         rm "$out"/lib/python*/plat-*/regen # refers to glibc.dev
 
         # Determinism: Windows installers were not deterministic.
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 43d2d159e36..e75bd0a0987 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -208,9 +208,6 @@ in with passthru; stdenv.mkDerivation {
 
     ln -s "$out/include/${executable}m" "$out/include/${executable}"
 
-    # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
-    echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
-
     # Determinism: Windows installers were not deterministic.
     # We're also not interested in building Windows installers.
     find "$out" -name 'wininst*.exe' | xargs -r rm -f
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 8154a87f667..b220bfa0f93 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -137,9 +137,6 @@ in with passthru; stdenv.mkDerivation rec {
     # verify cffi modules
     $out/bin/${executable} -c ${if isPy3k then "'import tkinter;import sqlite3;import curses;import lzma'" else "'import Tkinter;import sqlite3;import curses'"}
 
-    # Python on Nix is not manylinux1 compatible. https://github.com/NixOS/nixpkgs/issues/18484
-    echo "manylinux1_compatible=False" >> $out/lib/${libPrefix}/_manylinux.py
-
     # Include a sitecustomize.py file
     cp ${../sitecustomize.py} $out/lib/${libPrefix}/${sitePackages}/sitecustomize.py
   '';
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 04752fd2951..8d429987ad8 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lv2, pkgconfig, python, serd, sord, sratom, wafHook }:
+{ stdenv, fetchurl, lv2, pkgconfig, python3, serd, sord, sratom, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "lilv";
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0f24cd7wkk5l969857g2ydz2kjjrkvvddg1g87xzzs78lsvq8fy3";
   };
 
-  nativeBuildInputs = [ pkgconfig wafHook ];
-  buildInputs = [ lv2 python serd sord sratom ];
+  nativeBuildInputs = [ pkgconfig python3 wafHook ];
+  buildInputs = [ lv2 serd sord sratom ];
 
   meta = with stdenv.lib; {
     homepage = http://drobilla.net/software/lilv;
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 50593cab647..ad450b53d12 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gtk2, libsndfile, pkgconfig, python, wafHook }:
+{ stdenv, fetchurl, gtk2, libsndfile, pkgconfig, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "lv2";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig wafHook ];
-  buildInputs = [ gtk2 libsndfile python ];
+  buildInputs = [ gtk2 libsndfile python3 ];
 
   meta = with stdenv.lib; {
     homepage = http://lv2plug.in;
diff --git a/pkgs/development/libraries/audio/sratom/default.nix b/pkgs/development/libraries/audio/sratom/default.nix
index 21d6cdfb5d4..d7353af0d3d 100644
--- a/pkgs/development/libraries/audio/sratom/default.nix
+++ b/pkgs/development/libraries/audio/sratom/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lv2, pkgconfig, python, serd, sord, wafHook }:
+{ stdenv, fetchurl, lv2, pkgconfig, python3, serd, sord, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "sratom";
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0lz883ravxjf7r9wwbx2gx9m8vhyiavxrl9jdxfppjxnsralll8a";
   };
 
-  nativeBuildInputs = [ pkgconfig wafHook ];
-  buildInputs = [ lv2 python serd sord ];
+  nativeBuildInputs = [ pkgconfig wafHook python3 ];
+  buildInputs = [ lv2 serd sord ];
 
   meta = with stdenv.lib; {
     homepage = http://drobilla.net/software/sratom;
diff --git a/pkgs/development/libraries/epoxy/default.nix b/pkgs/development/libraries/epoxy/default.nix
index aa7b2ee9a05..362607eed18 100644
--- a/pkgs/development/libraries/epoxy/default.nix
+++ b/pkgs/development/libraries/epoxy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, utilmacros, python
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, utilmacros, python3
 , libGL, libX11
 }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig utilmacros python ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig utilmacros python3 ];
   buildInputs = [ libGL libX11 ];
 
   preConfigure = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/farstream/default.nix b/pkgs/development/libraries/farstream/default.nix
index e884bb41e20..763caa811e3 100644
--- a/pkgs/development/libraries/farstream/default.nix
+++ b/pkgs/development/libraries/farstream/default.nix
@@ -1,11 +1,19 @@
-{ stdenv, fetchurl, libnice, pkgconfig, pythonPackages, gstreamer, gst-plugins-base
-, gst-python, gupnp-igd, gobject-introspection
-, gst-plugins-good, gst-plugins-bad, gst-libav
+{ stdenv
+, fetchurl
+, fetchpatch
+, libnice
+, pkgconfig
+, autoreconfHook
+, gstreamer
+, gst-plugins-base
+, gupnp-igd
+, gobject-introspection
+, gst-plugins-good
+, gst-plugins-bad
+, gst-libav
 }:
 
-let
-  inherit (pythonPackages) python pygobject2;
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   name = "farstream-0.2.8";
 
   outputs = [ "out" "dev" ];
@@ -15,17 +23,36 @@ in stdenv.mkDerivation rec {
     sha256 = "0249ncd20x5mf884fd8bw75c3118b9fdml837v4fib349xmrqfrb";
   };
 
-  buildInputs = [ libnice python pygobject2 gupnp-igd libnice ];
+  patches = [
+    # Python has not been used for ages
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/farstream/farstream/commit/73891c28fa27d5e65a71762e826f13747d743588.patch";
+      sha256 = "19pw1m8xhxyf5yhl6k898w240ra2k0m28gfv858x70c4wl786lrn";
+    })
+  ];
+
+  buildInputs = [
+    libnice
+    gupnp-igd
+    libnice
+  ];
 
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+  nativeBuildInputs = [
+    pkgconfig
+    autoreconfHook
+    gobject-introspection
+  ];
 
   propagatedBuildInputs = [
-    gstreamer gst-plugins-base gst-python
-    gst-plugins-good gst-plugins-bad gst-libav
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-libav
   ];
 
   meta = with stdenv.lib; {
-    homepage = https://www.freedesktop.org/wiki/Software/Farstream;
+    homepage = "https://www.freedesktop.org/wiki/Software/Farstream";
     description = "Audio/Video Communications Framework formely known as farsight";
     platforms = platforms.linux;
     license = licenses.lgpl21;
diff --git a/pkgs/development/libraries/gamin/default.nix b/pkgs/development/libraries/gamin/default.nix
index 4cff2245740..611c9faa851 100644
--- a/pkgs/development/libraries/gamin/default.nix
+++ b/pkgs/development/libraries/gamin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, python, pkgconfig, glib }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, glib }:
 
 stdenv.mkDerivation (rec {
   name = "gamin-0.1.10";
@@ -10,13 +10,13 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ python glib ];
+  buildInputs = [ glib ];
 
   # `_GNU_SOURCE' is needed, e.g., to get `struct ucred' from
   # <sys/socket.h> with Glibc 2.9.
   configureFlags = [
     "--disable-debug"
-    "--with-python=${python}"
+    "--without-python" # python3 not supported
     "CPPFLAGS=-D_GNU_SOURCE"
   ];
 
@@ -44,4 +44,3 @@ stdenv.mkDerivation (rec {
     sed -i 's/,--version-script=.*$/\\/' libgamin/Makefile
   '';
 })
-
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index 514d21def1e..2d89355cffe 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python3
 , zlib, libssh2, openssl, http-parser, curl
 , libiconv, Security
 }:
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];
 
-  nativeBuildInputs = [ cmake python pkgconfig ];
+  nativeBuildInputs = [ cmake python3 pkgconfig ];
 
   buildInputs = [ zlib libssh2 openssl http-parser curl ]
     ++ stdenv.lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 136dd1e1712..a7c2bcf838e 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -3,7 +3,7 @@
 , meson
 , ninja
 , pkgconfig
-, python
+, python3
 , gst-plugins-base
 , orc
 , bzip2
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     pkgconfig
-    python
+    python3
     meson
     ninja
     gettext
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 35fbdfe488a..2dff3bafdd3 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python, autoconf }:
+{ stdenv, fetchurl, python3, autoconf }:
 
 stdenv.mkDerivation rec {
   name = "jbig2dec-0.17";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ autoconf ];
 
-  checkInputs = [ python ];
+  checkInputs = [ python3 ];
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/libdbusmenu/default.nix b/pkgs/development/libraries/libdbusmenu/default.nix
index a7bfe7f17a2..770e95472ea 100644
--- a/pkgs/development/libraries/libdbusmenu/default.nix
+++ b/pkgs/development/libraries/libdbusmenu/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, lib, file
 , pkgconfig, intltool
 , glib, dbus-glib, json-glib
-, gobject-introspection, vala, gnome-doc-utils
+, gobject-introspection, vala
 , gtkVersion ? null, gtk2 ? null, gtk3 ? null }:
 
 with lib;
@@ -18,11 +18,10 @@ stdenv.mkDerivation rec {
     sha256 = "12l7z8dhl917iy9h02sxmpclnhkdjryn08r8i4sr8l3lrlm4mk5r";
   };
 
-  nativeBuildInputs = [ vala pkgconfig intltool ];
+  nativeBuildInputs = [ vala pkgconfig intltool gobject-introspection ];
 
   buildInputs = [
     glib dbus-glib json-glib
-    gobject-introspection gnome-doc-utils
   ] ++ optional (gtkVersion != null) (if gtkVersion == "2" then gtk2 else gtk3);
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index 47d99f3d6c6..7a61437b5ee 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python }:
+{ stdenv, fetchurl, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "04a2klvii0in9ln8r85mk2cm73jq8ry2m3yzmf2z8xyjxzjcmlr0";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
 
   meta = with stdenv.lib; {
     description = "Wrapper library for evdev devices";
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 5df1246a0eb..c2a5cfbed74 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, python2, pkgconfig, libX11, libXext, xorgproto, addOpenGLRunpath }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, python3, pkgconfig, libX11, libXext, xorgproto, addOpenGLRunpath }:
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1hyywwjsmvsd7di603f7iznjlccqlc7yvz0j59gax7bljm9wb6ni";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig python2 addOpenGLRunpath ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig python3 addOpenGLRunpath ];
   buildInputs = [ libX11 libXext xorgproto ];
 
   # The following 3 patches should be removed once libglvnd >1.2.0 is released
diff --git a/pkgs/development/libraries/libgsf/default.nix b/pkgs/development/libraries/libgsf/default.nix
index 89a72bba872..a60d3a16533 100644
--- a/pkgs/development/libraries/libgsf/default.nix
+++ b/pkgs/development/libraries/libgsf/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig, intltool, gettext, glib, libxml2, zlib, bzip2
-, python, perl, gdk-pixbuf, libiconv, libintl, gnome3 }:
+, perl, gdk-pixbuf, libiconv, libintl, gnome3 }:
 
 stdenv.mkDerivation rec {
   pname = "libgsf";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig intltool libintl ];
 
-  buildInputs = [ gettext bzip2 zlib python ];
+  buildInputs = [ gettext bzip2 zlib ];
   checkInputs = [ perl ];
 
   propagatedBuildInputs = [ libxml2 glib gdk-pixbuf libiconv ];
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index c9b08079c38..8d4febcde28 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -11,7 +11,6 @@
 , gsettings-desktop-schemas
 , glib
 , makeWrapper
-, python2
 , python3
 , SystemConfiguration
 , CoreFoundation
@@ -29,7 +28,7 @@ stdenv.mkDerivation rec {
     sha256 = "10swd3x576pinx33iwsbd4h15fbh2snmfxzcmab4c56nb08qlbrs";
   };
 
-  outputs = [ "out" "dev" "py2" "py3" ];
+  outputs = [ "out" "dev" "py3" ];
 
   nativeBuildInputs = [
     pkgconfig
@@ -39,7 +38,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     pcre
-    python2
     python3
     zlib
   ] ++ (if stdenv.hostPlatform.isDarwin then [
@@ -55,7 +53,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DWITH_MOZJS=ON"
-    "-DPYTHON2_SITEPKG_DIR=${placeholder "py2"}/${python2.sitePackages}"
+    "-DWITH_PYTHON2=OFF"
     "-DPYTHON3_SITEPKG_DIR=${placeholder "py3"}/${python3.sitePackages}"
   ];
 
diff --git a/pkgs/development/libraries/libxklavier/default.nix b/pkgs/development/libraries/libxklavier/default.nix
index 9408b0c4587..b088ba198b2 100644
--- a/pkgs/development/libraries/libxklavier/default.nix
+++ b/pkgs/development/libraries/libxklavier/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sha256 = "1w1x5mrgly2ldiw3q2r6y620zgd89gk7n90ja46775lhaswxzv7a";
   };
 
+  patches = [ ./honor-XKB_CONFIG_ROOT.patch ];
+
   outputs = [ "out" "dev" "devdoc" ];
 
   # TODO: enable xmodmap support, needs xmodmap DB
diff --git a/pkgs/development/libraries/libxklavier/honor-XKB_CONFIG_ROOT.patch b/pkgs/development/libraries/libxklavier/honor-XKB_CONFIG_ROOT.patch
new file mode 100644
index 00000000000..93b768eeb20
--- /dev/null
+++ b/pkgs/development/libraries/libxklavier/honor-XKB_CONFIG_ROOT.patch
@@ -0,0 +1,89 @@
+From 999a419f4b36764a7269650a7f965d48bd4b73f7 Mon Sep 17 00:00:00 2001
+From: Louis Bettens <louis@bettens.info>
+Date: Sat, 28 Dec 2019 14:30:58 +0100
+Subject: [PATCH] honor $XKB_CONFIG_ROOT
+
+---
+ libxklavier/xklavier_config_xkb.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/libxklavier/xklavier_config_xkb.c b/libxklavier/xklavier_config_xkb.c
+index baec569..00e8de5 100644
+--- a/libxklavier/xklavier_config_xkb.c
++++ b/libxklavier/xklavier_config_xkb.c
+@@ -45,6 +45,18 @@
+ #define XK_XKB_KEYS
+ #include <X11/keysymdef.h>
+ 
++static const gchar *
++xkl_xkb_get_base_path(void)
++{
++	const gchar *base_path;
++
++	base_path = g_getenv ("XKB_CONFIG_ROOT");
++	if (!base_path)
++		base_path = XKB_BASE;
++
++	return base_path;
++}
++
+ #ifdef LIBXKBFILE_PRESENT
+ static XkbRF_RulesPtr xkl_rules;
+ 
+@@ -65,7 +77,8 @@ xkl_rules_set_load(XklEngine * engine)
+ 
+ 	locale = setlocale(LC_ALL, NULL);
+ 
+-	g_snprintf(file_name, sizeof file_name, XKB_BASE "/rules/%s", rf);
++	g_snprintf(file_name, sizeof file_name, "%s/rules/%s",
++		   xkl_xkb_get_base_path(), rf);
+ 	xkl_debug(160, "Loading rules from [%s]\n", file_name);
+ 
+ 	rules_set = XkbRF_Load(file_name, locale, True, True);
+@@ -98,10 +111,14 @@ gboolean
+ xkl_xkb_load_config_registry(XklConfigRegistry * config,
+ 			     gboolean if_extras_needed)
+ {
+-	return xkl_config_registry_load_helper(config,
++	const gchar *rules_path = g_strdup_printf("%s/rules",
++					  xkl_xkb_get_base_path());
++	gboolean ok = xkl_config_registry_load_helper(config,
+ 					       XKB_DEFAULT_RULESET,
+-					       XKB_BASE "/rules",
++					       rules_path,
+ 					       if_extras_needed);
++	g_free(rules_path);
++	return ok;
+ }
+ 
+ #ifdef LIBXKBFILE_PRESENT
+@@ -249,6 +266,7 @@ xkl_config_get_keyboard(XklEngine * engine,
+ 		pid_t cpid, pid;
+ 		int status = 0;
+ 		FILE *tmpxkb;
++		const gchar *opt_I;
+ 
+ 		xkl_debug(150, "tmp XKB/XKM file names: [%s]/[%s]\n",
+ 			  xkb_fn, xkm_fn);
+@@ -296,14 +314,16 @@ xkl_config_get_keyboard(XklEngine * engine,
+ 				break;
+ 			case 0:
+ 				/* child */
++				opt_I = g_strdup_printf("-I%s", xkl_xkb_get_base_path());
+ 				xkl_debug(160, "Executing %s\n", XKBCOMP);
+ 				xkl_debug(160, "%s %s %s %s %s %s %s %s\n",
+ 					  XKBCOMP, XKBCOMP, "-w0", "-I",
+-					  "-I" XKB_BASE, "-xkm", xkb_fn,
++					  opt_I, "-xkm", xkb_fn,
+ 					  xkm_fn);
+ 				execl(XKBCOMP, XKBCOMP, "-w0", "-I",
+-				      "-I" XKB_BASE, "-xkm", xkb_fn,
++				      opt_I, "-xkm", xkb_fn,
+ 				      xkm_fn, NULL);
++				g_free(opt_I);
+ 				xkl_debug(0, "Could not exec %s: %d\n",
+ 					  XKBCOMP, errno);
+ 				exit(1);
+-- 
+2.24.1
+
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 3dbdb2a9770..c7cb6d509dc 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -2,7 +2,7 @@
   stdenv, lib,
   src, patches, version, qtCompatVersion,
 
-  coreutils, bison, flex, gdb, gperf, lndir, perl, pkgconfig, python2,
+  coreutils, bison, flex, gdb, gperf, lndir, perl, pkgconfig, python3,
   which,
   # darwin support
   darwin, libiconv,
@@ -75,7 +75,8 @@ stdenv.mkDerivation {
     );
 
   buildInputs =
-    lib.optionals (!stdenv.isDarwin)
+    [ python3 ]
+    ++ lib.optionals (!stdenv.isDarwin)
     (
       [ libinput ]
       ++ lib.optional withGtk3 gtk3
@@ -86,7 +87,7 @@ stdenv.mkDerivation {
     ++ lib.optional (postgresql != null) postgresql;
 
   nativeBuildInputs =
-    [ bison flex gperf lndir perl pkgconfig python2 which ];
+    [ bison flex gperf lndir perl pkgconfig which ];
 
   propagatedNativeBuildInputs = [ lndir ];
 
diff --git a/pkgs/development/libraries/serd/default.nix b/pkgs/development/libraries/serd/default.nix
index 63b6ae94a38..c390603c51d 100644
--- a/pkgs/development/libraries/serd/default.nix
+++ b/pkgs/development/libraries/serd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, python, wafHook }:
+{ stdenv, fetchurl, pkgconfig, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "serd";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yyfyvc6kwagi5w43ljp1bbjdvdpmgpds74lmjxycm91bkx0xyvf";
   };
 
-  nativeBuildInputs = [ pkgconfig python wafHook ];
+  nativeBuildInputs = [ pkgconfig python3 wafHook ];
 
   meta = with stdenv.lib; {
     homepage = http://drobilla.net/software/serd;
diff --git a/pkgs/development/libraries/sord/default.nix b/pkgs/development/libraries/sord/default.nix
index c1c22cb910d..38636776e9d 100644
--- a/pkgs/development/libraries/sord/default.nix
+++ b/pkgs/development/libraries/sord/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, python, serd, pcre, wafHook }:
+{ stdenv, fetchurl, pkgconfig, python3, serd, pcre, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "sord";
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "13fshxwpipjrvsah1m2jw1kf022z2q5vpw24bzcznglgvms13x89";
   };
 
-  nativeBuildInputs = [ pkgconfig wafHook ];
-  buildInputs = [ python serd pcre ];
+  nativeBuildInputs = [ pkgconfig python3 wafHook ];
+  buildInputs = [ serd pcre ];
 
   meta = with stdenv.lib; {
     homepage = http://drobilla.net/software/sord;
diff --git a/pkgs/development/python-modules/anytree/default.nix b/pkgs/development/python-modules/anytree/default.nix
index 638b2c2baa3..712944568f2 100644
--- a/pkgs/development/python-modules/anytree/default.nix
+++ b/pkgs/development/python-modules/anytree/default.nix
@@ -1,26 +1,25 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
+, fetchPypi
 , substituteAll
 , fetchpatch
 , nose
 , six
+, withGraphviz ? true
 , graphviz
 , fontconfig
 }:
 
 buildPythonPackage rec {
   pname = "anytree";
-  version = "2.7.2";
+  version = "2.7.3";
 
-  src = fetchFromGitHub {
-    owner = "c0fec0de";
-    repo = pname;
-    rev = version;
-    sha256 = "0ag5ir9h5p7rbm2pmpxlkflwigrm7z4afh24jvbhqj7pyrbjmk9w";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "05736hamjv4f38jw6z9y4wckc7mz18ivbizm1s3pb0n6fp1sy4zk";
   };
 
-  patches = [
+  patches = lib.optionals withGraphviz [
     (substituteAll {
       src = ./graphviz.patch;
       inherit graphviz;
@@ -35,11 +34,14 @@ buildPythonPackage rec {
     six
   ];
 
-  # Fontconfig error: Cannot load default config file
-  preCheck = ''
+  # tests print “Fontconfig error: Cannot load default config file”
+  preCheck = lib.optionalString withGraphviz ''
     export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
   '';
 
+  # circular dependency anytree → graphviz → pango → glib → gtk-doc → anytree
+  doCheck = withGraphviz;
+
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index d7dcb425963..0e20d690fd7 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, cmake, fetchurl, perl, python, flex, bison, qt4, CoreServices, libiconv }:
+{ stdenv, cmake, fetchurl, python3, flex, bison, qt4, CoreServices, libiconv }:
 
 stdenv.mkDerivation rec {
 
@@ -12,11 +12,15 @@ stdenv.mkDerivation rec {
     sha256 = "bd9c0ec462b6a9b5b41ede97bede5458e0d7bb40d4cfa27f6f622eb33c59245d";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    python3
+    flex
+    bison
+  ];
 
   buildInputs =
-    [ perl python flex bison ]
-    ++ stdenv.lib.optional (qt4 != null) qt4
+       stdenv.lib.optional (qt4 != null) qt4
     ++ stdenv.lib.optional stdenv.isSunOS libiconv
     ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices libiconv ];
 
diff --git a/pkgs/development/tools/documentation/gtk-doc/default.nix b/pkgs/development/tools/documentation/gtk-doc/default.nix
index 35d718ecd67..3c0b0cff548 100644
--- a/pkgs/development/tools/documentation/gtk-doc/default.nix
+++ b/pkgs/development/tools/documentation/gtk-doc/default.nix
@@ -2,9 +2,8 @@
 , fetchFromGitLab
 , meson
 , ninja
-, pkgconfig
+, pkg-config
 , python3
-, libxml2Python
 , docbook_xml_dtd_43
 , docbook_xsl
 , libxslt
@@ -13,10 +12,12 @@
 , withDblatex ? false, dblatex
 }:
 
-stdenv.mkDerivation rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
   version = "1.32";
 
+  format = "other";
+
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
@@ -32,37 +33,41 @@ stdenv.mkDerivation rec {
   outputDevdoc = "out";
 
   nativeBuildInputs = [
+    pkg-config
     gettext
     meson
     ninja
+    libxslt # for xsltproc
   ];
 
   buildInputs = [
     docbook_xml_dtd_43
     docbook_xsl
     libxslt
-    pkgconfig
-    python3
-    python3.pkgs.pygments # Needed for https://gitlab.gnome.org/GNOME/gtk-doc/blob/GTK_DOC_1_32/meson.build#L42
-    libxml2Python
-  ]
-  ++ stdenv.lib.optional withDblatex dblatex
-  ;
+  ] ++ stdenv.lib.optionals withDblatex [
+    dblatex
+  ];
+
+  pythonPath = with python3.pkgs; [
+    pygments # Needed for https://gitlab.gnome.org/GNOME/gtk-doc/blob/GTK_DOC_1_32/meson.build#L42
+    (anytree.override { withGraphviz = false; })
+    lxml
+  ];
 
   mesonFlags = [
     "-Dtests=false"
     "-Dyelp_manual=false"
   ];
 
-  # Make pygments available for binaries, python.withPackages creates a wrapper
-  # but scripts are not allowed in shebangs so we link it into sys.path.
-  postInstall = ''
-    ln -s ${python3.pkgs.pygments}/${python3.sitePackages}/* $out/share/gtk-doc/python/
-  '';
-
   doCheck = false; # requires a lot of stuff
   doInstallCheck = false; # fails
 
+  postFixup = ''
+    # Do not propagate Python
+    substituteInPlace $out/nix-support/propagated-build-inputs \
+      --replace "${python3}" ""
+  '';
+
   passthru = {
     # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
     respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
diff --git a/pkgs/development/web/nodejs/v13.nix b/pkgs/development/web/nodejs/v13.nix
index f5e9952233b..d649e80b340 100644
--- a/pkgs/development/web/nodejs/v13.nix
+++ b/pkgs/development/web/nodejs/v13.nix
@@ -5,8 +5,8 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "13.3.0";
-    sha256 = "0j36jf0ybq470w91kzg28bcmxlml7ccl4swwklb6x1ibkz697np7";
+    version = "13.5.0";
+    sha256 = "1ng959fm8ls222mmn2vpkw4n4jba02qigpxc8p85jxfj36dsq4ak";
 
     patches = stdenv.lib.optionals stdenv.isDarwin [ ./disable-libatomic-darwin.patch ];
   }
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d206910732c..0538511c528 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -164,6 +164,10 @@ let
       ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
       ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware";
 
+      preInstall = ''
+        installFlagsArray+=("-j$NIX_BUILD_CORES")
+      '';
+
       # Some image types need special install targets (e.g. uImage is installed with make uinstall)
       installTargets = [ (
         if platform ? kernelInstallTarget then platform.kernelInstallTarget
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index c334365d8b5..1e891092f7c 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -4,7 +4,7 @@
   freetype, tradcpp, fontconfig, meson, ninja, ed,
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
-  mcpp, epoxy, openssl, pkgconfig, llvm_6,
+  mcpp, epoxy, openssl, pkgconfig, llvm_6, python3,
   ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
@@ -72,7 +72,9 @@ self: super:
 
   mkfontdir = self.mkfontscale;
 
-  libxcb = super.libxcb.overrideAttrs (attrs: {
+  libxcb = (super.libxcb.override {
+    python = python3;
+  }).overrideAttrs (attrs: {
     configureFlags = [ "--enable-xkb" "--enable-xinput" ];
     outputs = [ "out" "dev" "man" "doc" ];
   });
@@ -308,6 +310,10 @@ self: super:
     buildInputs = attrs.buildInputs ++ [ freetype fontconfig ];
   });
 
+  xcbproto = super.xcbproto.override {
+    python = python3;
+  };
+
   xcbutil = super.xcbutil.overrideAttrs (attrs: {
     outputs = [ "out" "dev" ];
   });
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 324ac46b084..1280b4bd3f1 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, python, pythonPackages, gamin }:
+{ stdenv, fetchFromGitHub, fetchpatch, python3, gamin }:
 
 let version = "0.10.4"; in
 
-pythonPackages.buildPythonApplication {
+python3.pkgs.buildPythonApplication {
   pname = "fail2ban";
   inherit version;
 
@@ -13,8 +13,19 @@ pythonPackages.buildPythonApplication {
     sha256 = "07ik6rm856q0ic2r7vbg6j3hsdcdgkv44hh5ck0c2y21fqwrck3l";
   };
 
-  propagatedBuildInputs = [ gamin ]
-    ++ (stdenv.lib.optional stdenv.isLinux pythonPackages.systemd);
+  patches = [
+    # 0.10.3 supports Python 3 but somehow this got into the way
+    # https://github.com/fail2ban/fail2ban/issues/2255
+    (fetchpatch {
+      url = "https://github.com/fail2ban/fail2ban/commit/657b147c0d7830f3600f3dc7feaa4815a7e19fde.patch";
+      sha256 = "1hrk2x7ssrfhab1wrjk5xw1sxhiv2735glfcp6qcj8x4dss3q7f7";
+    })
+  ];
+
+  pythonPath = with python3.pkgs;
+    stdenv.lib.optionals stdenv.isLinux [
+      systemd
+    ];
 
   preConfigure = ''
     for i in config/action.d/sendmail*.conf; do
@@ -33,11 +44,11 @@ pythonPackages.buildPythonApplication {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python}/bin/${python.executable} setup.py install_data --install-dir=$out --root=$out
+    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
   '';
 
   postInstall = let
-    sitePackages = "$out/lib/${python.libPrefix}/site-packages";
+    sitePackages = "$out/${python3.sitePackages}";
   in ''
     # see https://github.com/NixOS/nixpkgs/issues/4968
     rm -rf ${sitePackages}/etc ${sitePackages}/usr ${sitePackages}/var;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index abbb02329e7..d88da5d2a98 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3307,6 +3307,7 @@ in
 
   fontforge = lowPrio (callPackage ../tools/misc/fontforge {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
+    python = python3;
   });
   fontforge-gtk = fontforge.override {
     withSpiro = true;
@@ -11204,7 +11205,6 @@ in
     inherit (gst_all_1)
       gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad
       gst-libav;
-    inherit (pythonPackages) gst-python;
   };
 
   fcgi = callPackage ../development/libraries/fcgi { };
@@ -16633,9 +16633,13 @@ in
 
   keyutils = callPackage ../os-specific/linux/keyutils { };
 
-  libselinux = callPackage ../os-specific/linux/libselinux { };
+  libselinux = callPackage ../os-specific/linux/libselinux {
+    python = python3;
+  };
 
-  libsemanage = callPackage ../os-specific/linux/libsemanage { };
+  libsemanage = callPackage ../os-specific/linux/libsemanage {
+    python = python3;
+  };
 
   libraw = callPackage ../development/libraries/libraw { };
 
@@ -25178,11 +25182,7 @@ in
   seafile-shared = callPackage ../misc/seafile-shared { };
 
   serviio = callPackage ../servers/serviio {};
-  selinux-python = callPackage ../os-specific/linux/selinux-python {
-    # needs python3 bindings
-    libselinux = libselinux.override { python = python3; };
-    libsemanage = libsemanage.override { python = python3; };
-  };
+  selinux-python = callPackage ../os-specific/linux/selinux-python { };
 
   slock = callPackage ../misc/screensavers/slock {
     conf = config.slock.conf or null;