Merge 'staging' into master

28 files changed, 341 insertions, 46 deletions

diff --git a/pkgs/development/libraries/aacskeys/default.nix b/pkgs/development/libraries/aacskeys/default.nix
index 088f2cc4b1e..0b20d8a41ea 100644
--- a/pkgs/development/libraries/aacskeys/default.nix
+++ b/pkgs/development/libraries/aacskeys/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   buildInputs = [openssl jdk premake3];
 
   installPhase = ''
-    ensureDir $out/{bin,lib,share/${baseName}}
+    mkdir -p $out/{bin,lib,share/${baseName}}
 
     # Install lib
     install -Dm444 lib/linux/libaacskeys.so $out/lib
diff --git a/pkgs/development/libraries/apache-activemq/default.nix b/pkgs/development/libraries/apache-activemq/default.nix
index d55ff9049ed..2f2792dec14 100644
--- a/pkgs/development/libraries/apache-activemq/default.nix
+++ b/pkgs/development/libraries/apache-activemq/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    ensureDir $out
+    mkdir -p $out
     mv * $out/
     for j in `find $out/lib -name "*.jar"`; do
       cp="''${cp:+"$cp:"}$j";
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
new file mode 100644
index 00000000000..416a33b09a2
--- /dev/null
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, python, pkgconfig, popt, atk, libX11, libICE, xlibs, libXi
+, intltool, dbus_glib, at_spi2_core, libSM }:
+
+stdenv.mkDerivation rec {
+  versionMajor = "2.12";
+  versionMinor = "1";
+  moduleName   = "at-spi2-atk";
+  name = "${moduleName}-${versionMajor}.${versionMinor}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
+    sha256 = "5fa9c527bdec028e06797563cd52d49bcf06f638549df983424d88db89bb1336";
+  };
+
+  buildInputs = [ python pkgconfig popt atk libX11 libICE xlibs.libXtst libXi
+                  intltool dbus_glib at_spi2_core libSM ];
+
+  meta = with stdenv.lib; {
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
new file mode 100644
index 00000000000..d60a0ff7480
--- /dev/null
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, python, pkgconfig, popt, intltool, dbus_glib
+, libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:
+
+stdenv.mkDerivation (rec {
+  versionMajor = "2.12";
+  versionMinor = "0";
+  moduleName   = "at-spi2-core";
+  name = "${moduleName}-${versionMajor}.${versionMinor}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
+    sha256 = "12gvsgdaxnxskndlhlmdkc50cfqgmzfc4n8la9944fz5k3fhwmfv";
+  };
+
+  buildInputs = [
+    python pkgconfig popt  intltool dbus_glib
+    libX11 xextproto libSM libICE libXtst libXi
+    gobjectIntrospection
+  ];
+
+  # ToDo: on non-NixOS we create a symlink from there?
+  configureFlags = "--with-dbus-daemondir=/run/current-system/sw/bin/";
+
+  meta = with stdenv.lib; {
+    platforms = platforms.linux;
+  };
+}
+  // stdenv.lib.optionalAttrs stdenv.isDarwin {
+    NIX_LDFLAGS = "-lintl";
+  }
+)
+
diff --git a/pkgs/development/libraries/boost/1.55.nix b/pkgs/development/libraries/boost/1.55.nix
index df29b2402f8..bf355f7169c 100644
--- a/pkgs/development/libraries/boost/1.55.nix
+++ b/pkgs/development/libraries/boost/1.55.nix
@@ -75,6 +75,7 @@ stdenv.mkDerivation {
     ./b2 -j$NIX_BUILD_CORES -sEXPAT_INCLUDE=${expat}/include -sEXPAT_LIBPATH=${expat}/lib --layout=${layout} variant=${variant} threading=${threading} link=${link} ${cflags} install${withToolset}
     rm $out/bin/bjam
     ln -s $out/bin/b2 $out/bin/bjam
+    rm -rf $out/share/boost-build/example
   '';
 
   crossAttrs = rec {
diff --git a/pkgs/development/libraries/bwidget/default.nix b/pkgs/development/libraries/bwidget/default.nix
index 81f4f9a287e..0d1913bc8e7 100644
--- a/pkgs/development/libraries/bwidget/default.nix
+++ b/pkgs/development/libraries/bwidget/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   dontBuild = true;
 
   installPhase = ''
-    ensureDir "$out/lib/${passthru.libPrefix}"
+    mkdir -p "$out/lib/${passthru.libPrefix}"
     cp -R *.tcl lang images "$out/lib/${passthru.libPrefix}"
   '';
 
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 5e211c74d5e..f0c4da75567 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ pkgconfig expat ];
 
   configureFlags = [
+    "--sysconfdir=/etc"
     "--with-cache-dir=/var/cache/fontconfig"
     "--disable-docs"
     "--with-default-fonts="
@@ -39,7 +40,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   # Don't try to write to /var/cache/fontconfig at install time.
-  installFlags = "fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
+  installFlags = "sysconfdir=$(out)/etc fc_cachedir=$(TMPDIR)/dummy RUN_FC_CACHE_TEST=false";
 
   postInstall = ''
     cd "$out/etc/fonts" && tar xvf ${infinality_patch}
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index c983f9f6a61..06e820633b8 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -1,6 +1,6 @@
 findGdkPixbufLoaders() {
 
-	if [ -z "$IN_NIX_SHELL" ]; then
+	if [ -n "$out" ] && [ -z "$IN_NIX_SHELL" ]; then
 
 		# set pixbuf loaders.cache for this package
 
diff --git a/pkgs/development/libraries/glib/darwin-compilation.patch b/pkgs/development/libraries/glib/darwin-compilation.patch
new file mode 100644
index 00000000000..f215eef798a
--- /dev/null
+++ b/pkgs/development/libraries/glib/darwin-compilation.patch
@@ -0,0 +1,24 @@
+Fix compilation on Mac OS X with gcc 4.8.
+
+diff -ru glib-2.40.0-orig/gio/gdummyfile.c glib-2.40.0/gio/gdummyfile.c
+--- glib-2.40.0-orig/gio/gdummyfile.c   2014-02-03 18:40:41.000000000 +0100
++++ glib-2.40.0/gio/gdummyfile.c        2014-07-15 10:58:31.000000000 +0200
+@@ -454,7 +454,8 @@
+   result = g_malloc (escaped_string_end - escaped_string + 1);
+        
+   out = result;
+-  for (in = escaped_string; in < escaped_string_end; in++) 
++  in = escaped_string;
++  for (; in < escaped_string_end; in++) 
+     {
+       character = *in;
+       if (*in == '%') 
+@@ -551,6 +552,7 @@
+   
+   decoded->scheme = g_malloc (p - uri);
+   out = decoded->scheme;
+-  for (in = uri; in < p - 1; in++)
++  in = uri;
++  for (; in < p - 1; in++)
+     *out++ = g_ascii_tolower (*in);
+   *out = 0;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 9a592d4f954..14e72495968 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -49,6 +49,8 @@ stdenv.mkDerivation rec {
     sha256 = "1d98mbqjmc34s8095lkw1j1bwvnnkw9581yfvjaikjvfjsaz29qd";
   };
 
+  patches = optional stdenv.isDarwin ./darwin-compilation.patch;
+
   setupHook = ./setup-hook.sh;
 
   buildInputs = [ libelf ]
@@ -67,6 +69,11 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = optionalString stdenv.isDarwin " -lintl"
     + optionalString stdenv.isSunOS " -DBSD_COMP";
 
+  preBuild = optionalString stdenv.isDarwin
+    ''
+      export MACOSX_DEPLOYMENT_TARGET=
+    '';
+
   enableParallelBuilding = true;
 
   inherit doCheck;
diff --git a/pkgs/development/libraries/glibc/2.19/common.nix b/pkgs/development/libraries/glibc/2.19/common.nix
index 43ba2a9ca11..cd1ba747d7c 100644
--- a/pkgs/development/libraries/glibc/2.19/common.nix
+++ b/pkgs/development/libraries/glibc/2.19/common.nix
@@ -58,6 +58,8 @@ stdenv.mkDerivation ({
       ./fix_path_attribute_in_getconf.patch
 
       ./fix-math.patch
+
+      ./cve-2014-0475.patch
     ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/glibc/2.19/cve-2014-0475.patch b/pkgs/development/libraries/glibc/2.19/cve-2014-0475.patch
new file mode 100644
index 00000000000..a4f983de8f6
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.19/cve-2014-0475.patch
@@ -0,0 +1,170 @@
+Picked from upstream commits, but excluding changes to news and tests:
+d183645616b0533 and 4e8f95a0df7c2
+Also see https://sourceware.org/bugzilla/show_bug.cgi?id=17137
+
+diff --git a/locale/setlocale.c b/locale/setlocale.c
+index 9458468..6455b8b 100644
+--- a/locale/setlocale.c
++++ b/locale/setlocale.c
+@@ -272,6 +272,8 @@ setlocale (int category, const char *locale)
+ 	 of entries of the form `CATEGORY=VALUE'.  */
+       const char *newnames[__LC_LAST];
+       struct __locale_data *newdata[__LC_LAST];
++      /* Copy of the locale argument, for in-place splitting.  */
++      char *locale_copy = NULL;
+ 
+       /* Set all name pointers to the argument name.  */
+       for (category = 0; category < __LC_LAST; ++category)
+@@ -281,7 +283,13 @@ setlocale (int category, const char *locale)
+       if (__glibc_unlikely (strchr (locale, ';') != NULL))
+ 	{
+ 	  /* This is a composite name.  Make a copy and split it up.  */
+-	  char *np = strdupa (locale);
++	  locale_copy = strdup (locale);
++	  if (__glibc_unlikely (locale_copy == NULL))
++	    {
++	      __libc_rwlock_unlock (__libc_setlocale_lock);
++	      return NULL;
++	    }
++	  char *np = locale_copy;
+ 	  char *cp;
+ 	  int cnt;
+ 
+@@ -299,6 +307,7 @@ setlocale (int category, const char *locale)
+ 		{
+ 		error_return:
+ 		  __libc_rwlock_unlock (__libc_setlocale_lock);
++		  free (locale_copy);
+ 
+ 		  /* Bogus category name.  */
+ 		  ERROR_RETURN;
+@@ -391,8 +400,9 @@ setlocale (int category, const char *locale)
+       /* Critical section left.  */
+       __libc_rwlock_unlock (__libc_setlocale_lock);
+ 
+-      /* Free the resources (the locale path variable).  */
++      /* Free the resources.  */
+       free (locale_path);
++      free (locale_copy);
+ 
+       return composite;
+     }
+diff --git a/locale/findlocale.c b/locale/findlocale.c
+index bbaf708..22e8b53 100644
+--- a/locale/findlocale.c
++++ b/locale/findlocale.c
+@@ -17,6 +17,7 @@
+    <http://www.gnu.org/licenses/>.  */
+ 
+ #include <assert.h>
++#include <errno.h>
+ #include <locale.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -57,6 +58,45 @@ struct loaded_l10nfile *_nl_locale_file_list[__LC_LAST];
+ 
+ const char _nl_default_locale_path[] attribute_hidden = LOCALEDIR;
+ 
++/* Checks if the name is actually present, that is, not NULL and not
++   empty.  */
++static inline int
++name_present (const char *name)
++{
++  return name != NULL && name[0] != '\0';
++}
++
++/* Checks that the locale name neither extremely long, nor contains a
++   ".." path component (to prevent directory traversal).  */
++static inline int
++valid_locale_name (const char *name)
++{
++  /* Not set.  */
++  size_t namelen = strlen (name);
++  /* Name too long.  The limit is arbitrary and prevents stack overflow
++     issues later.  */
++  if (__glibc_unlikely (namelen > 255))
++    return 0;
++  /* Directory traversal attempt.  */
++  static const char slashdot[4] = {'/', '.', '.', '/'};
++  if (__glibc_unlikely (memmem (name, namelen,
++				slashdot, sizeof (slashdot)) != NULL))
++    return 0;
++  if (namelen == 2 && __glibc_unlikely (name[0] == '.' && name [1] == '.'))
++    return 0;
++  if (namelen >= 3
++      && __glibc_unlikely (((name[0] == '.'
++			     && name[1] == '.'
++			     && name[2] == '/')
++			    || (name[namelen - 3] == '/'
++				&& name[namelen - 2] == '.'
++				&& name[namelen - 1] == '.'))))
++    return 0;
++  /* If there is a slash in the name, it must start with one.  */
++  if (__glibc_unlikely (memchr (name, '/', namelen) != NULL) && name[0] != '/')
++    return 0;
++  return 1;
++}
+ 
+ struct __locale_data *
+ internal_function
+@@ -65,7 +105,7 @@ _nl_find_locale (const char *locale_path, size_t locale_path_len,
+ {
+   int mask;
+   /* Name of the locale for this category.  */
+-  char *loc_name;
++  char *loc_name = (char *) *name;
+   const char *language;
+   const char *modifier;
+   const char *territory;
+@@ -73,31 +113,39 @@ _nl_find_locale (const char *locale_path, size_t locale_path_len,
+   const char *normalized_codeset;
+   struct loaded_l10nfile *locale_file;
+ 
+-  if ((*name)[0] == '\0')
++  if (loc_name[0] == '\0')
+     {
+       /* The user decides which locale to use by setting environment
+ 	 variables.  */
+-      *name = getenv ("LC_ALL");
+-      if (*name == NULL || (*name)[0] == '\0')
+-	*name = getenv (_nl_category_names.str
++      loc_name = getenv ("LC_ALL");
++      if (!name_present (loc_name))
++	loc_name = getenv (_nl_category_names.str
+ 			+ _nl_category_name_idxs[category]);
+-      if (*name == NULL || (*name)[0] == '\0')
+-	*name = getenv ("LANG");
++      if (!name_present (loc_name))
++	loc_name = getenv ("LANG");
++      if (!name_present (loc_name))
++	loc_name = (char *) _nl_C_name;
+     }
+ 
+-  if (*name == NULL || (*name)[0] == '\0'
+-      || (__builtin_expect (__libc_enable_secure, 0)
+-	  && strchr (*name, '/') != NULL))
+-    *name = (char *) _nl_C_name;
++  /* We used to fall back to the C locale if the name contains a slash
++     character '/', but we now check for directory traversal in
++     valid_locale_name, so this is no longer necessary.  */
+ 
+-  if (__builtin_expect (strcmp (*name, _nl_C_name), 1) == 0
+-      || __builtin_expect (strcmp (*name, _nl_POSIX_name), 1) == 0)
++  if (__builtin_expect (strcmp (loc_name, _nl_C_name), 1) == 0
++      || __builtin_expect (strcmp (loc_name, _nl_POSIX_name), 1) == 0)
+     {
+       /* We need not load anything.  The needed data is contained in
+ 	 the library itself.  */
+       *name = (char *) _nl_C_name;
+       return _nl_C[category];
+     }
++  else if (!valid_locale_name (loc_name))
++    {
++      __set_errno (EINVAL);
++      return NULL;
++    }
++
++  *name = loc_name;
+ 
+   /* We really have to load some data.  First we try the archive,
+      but only if there was no LOCPATH environment variable specified.  */
diff --git a/pkgs/development/libraries/haskell/ghc-heap-view/default.nix b/pkgs/development/libraries/haskell/ghc-heap-view/default.nix
index c32d3be5308..1df6885280c 100644
--- a/pkgs/development/libraries/haskell/ghc-heap-view/default.nix
+++ b/pkgs/development/libraries/haskell/ghc-heap-view/default.nix
@@ -8,7 +8,7 @@ cabal.mkDerivation (self: {
   sha256 = "1qi7f3phj2j63x1wd2cvk36945cxd84s12zs03hlrn49wzx2pf1n";
   buildDepends = [ binary transformers ];
   postInstall = ''
-    ensureDir "$out/share/ghci"
+    mkdir -p "$out/share/ghci"
     ln -s "$out/share/$pname-$version/ghci" "$out/share/ghci/$pname"
   '';
   meta = {
diff --git a/pkgs/development/libraries/haskell/ghc-mod/default.nix b/pkgs/development/libraries/haskell/ghc-mod/default.nix
index f876fb5aba8..a9c06e80f8a 100644
--- a/pkgs/development/libraries/haskell/ghc-mod/default.nix
+++ b/pkgs/development/libraries/haskell/ghc-mod/default.nix
@@ -26,7 +26,7 @@ cabal.mkDerivation (self: {
     make
     rm Makefile
     cd ..
-    ensureDir "$out/share/emacs"
+    mkdir -p "$out/share/emacs"
     mv $pname-$version emacs/site-lisp
     mv $out/bin/ghc-mod $out/bin/.ghc-mod-wrapped
     cat - > $out/bin/ghc-mod <<EOF
diff --git a/pkgs/development/libraries/haskell/ghc-vis/default.nix b/pkgs/development/libraries/haskell/ghc-vis/default.nix
index bfcc3e70472..2a4badd91e3 100644
--- a/pkgs/development/libraries/haskell/ghc-vis/default.nix
+++ b/pkgs/development/libraries/haskell/ghc-vis/default.nix
@@ -14,7 +14,7 @@ cabal.mkDerivation (self: {
   ];
   jailbreak = true;
   postInstall = ''
-    ensureDir "$out/share/ghci"
+    mkdir -p "$out/share/ghci"
     ln -s "$out/share/$pname-$version/ghci" "$out/share/ghci/$pname"
   '';
   meta = {
diff --git a/pkgs/development/libraries/haskell/hoogle/local.nix b/pkgs/development/libraries/haskell/hoogle/local.nix
index 67f38f260e0..eebfd0224d2 100644
--- a/pkgs/development/libraries/haskell/hoogle/local.nix
+++ b/pkgs/development/libraries/haskell/hoogle/local.nix
@@ -65,7 +65,7 @@ cabal.mkDerivation (self: rec {
         exit 1
     fi
 
-    ensureDir $out/share/hoogle/doc
+    mkdir -p $out/share/hoogle/doc
     export HOOGLE_DOC_PATH=$out/share/hoogle/doc
 
     cd $out/share/hoogle
diff --git a/pkgs/development/libraries/java/junixsocket/default.nix b/pkgs/development/libraries/java/junixsocket/default.nix
index e49e626aa00..317ba601cfb 100644
--- a/pkgs/development/libraries/java/junixsocket/default.nix
+++ b/pkgs/development/libraries/java/junixsocket/default.nix
@@ -14,9 +14,6 @@ stdenv.mkDerivation rec {
 
   preConfigure =
     ''
-      substituteInPlace build.xml \
-        --replace /usr/bin/ "" \
-        --replace macosx darwin
       substituteInPlace src/main/org/newsclub/net/unix/NativeUnixSocketConfig.java \
         --replace /opt/newsclub/lib-native $out/lib
     '';
@@ -25,7 +22,7 @@ stdenv.mkDerivation rec {
 
   ANT_ARGS =
     # Note that our OpenJDK on Darwin is currently 32-bit, so we have to build a 32-bit dylib.
-    (if stdenv.is64bit && !stdenv.isDarwin then [ "-Dskip32=true" ] else [ "-Dskip64=true" ])
+    (if stdenv.is64bit then [ "-Dskip32=true" ] else [ "-Dskip64=true" ])
     ++ [ "-Dgcc=cc" "-Dant.build.javac.source=1.6" ]
     ++ stdenv.lib.optional stdenv.isDarwin "-DisMac=true";
 
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index 247c3666e15..679b091ce72 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -28,7 +28,7 @@ let
   result = {
     libav_0_8 = libavFun "0.8.13" "1fr3rzykrlm1cla0csm9hqa3gcqp19hf5rgn70nyb9w92r67v685";
     libav_9   = libavFun   "9.14" "07gn4lbqx6wfhb2h2ddj88hcsacwmzb4syalg211m55xmp1g1fp4";
-    libav_10  = libavFun  "10.2"  "06wvk51cnllw6367qagc90sva4jr5d0r6jx8183wcwzwzgv01w29";
+    libav_10  = libavFun  "10.3"  "1fq83rc5534fjqjlhkw5i9k54dmyqn2pgvyillm6pws8rkn9yb5r";
   };
 
   libavFun = version : sha256 : stdenv.mkDerivation rec {
diff --git a/pkgs/development/libraries/libsamplerate/default.nix b/pkgs/development/libraries/libsamplerate/default.nix
index 708d8989304..85d51d0ad71 100644
--- a/pkgs/development/libraries/libsamplerate/default.nix
+++ b/pkgs/development/libraries/libsamplerate/default.nix
@@ -15,10 +15,14 @@ stdenv.mkDerivation rec {
   #--disable-fftw          disable usage of FFTW
   #--disable-cpu-clip      disable tricky cpu specific clipper
 
-  # need headers from the Carbon.framework in /System/Library/Frameworks to
-  # compile this on darwin -- not sure how to handle
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
-    "-I/System/Library/Frameworks/Carbon.framework/Versions/A/Headers";
+  postConfigure = stdenv.lib.optionalString stdenv.isDarwin
+    ''
+      # need headers from the Carbon.framework in /System/Library/Frameworks to
+      # compile this on darwin -- not sure how to handle
+      NIX_CFLAGS_COMPILE+=" -I$SDKROOT/System/Library/Frameworks/Carbon.framework/Versions/A/Headers"
+
+      substituteInPlace examples/Makefile --replace "-fpascal-strings" ""
+    '';
 
   meta = with stdenv.lib; {
     description = "Sample Rate Converter for audio";
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 8b0eeeb8e57..74140d5f335 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -12,8 +12,13 @@ stdenv.mkDerivation rec {
 
   # need headers from the Carbon.framework in /System/Library/Frameworks to
   # compile this on darwin -- not sure how to handle
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
-    "-I/System/Library/Frameworks/Carbon.framework/Versions/A/Headers";
+  preConfigure = stdenv.lib.optionalString stdenv.isDarwin
+    ''
+      NIX_CFLAGS_COMPILE+=" -I$SDKROOT/System/Library/Frameworks/Carbon.framework/Versions/A/Headers"
+    '';
+
+  # Needed on Darwin.
+  NIX_CFLAGS_LINK = "-logg -lvorbis";
 
   meta = with stdenv.lib; {
     description = "A C library for reading and writing files containing sampled sound";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 5695967bc3d..bbad10898bf 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -24,7 +24,7 @@ else
 */
 
 let
-  version = "10.2.4";
+  version = "10.2.5";
   # this is the default search path for DRI drivers
   driverLink = "/run/opengl-driver" + stdenv.lib.optionalString stdenv.isi686 "-32";
 in
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
 
   src =  fetchurl {
     url = "ftp://ftp.freedesktop.org/pub/mesa/${version}/MesaLib-${version}.tar.bz2";
-    sha256 = "06l18j9vshq2xzhnp6zd6pw0dlfy0qg1cw4zyn1w51gb8h9398h6";
+    sha256 = "039is15p8pkhf8m0yiyb72zybl63xb9ckqzcg3xwi8zlyw5ryidl";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 7627fb79e99..87953c1158d 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, unicode ? true}:
+{ lib, stdenv, fetchurl, unicode ? true }:
 
 let
   /* C++ bindings fail to build on `i386-pc-solaris2.11' with GCC 3.4.3:
@@ -10,7 +10,7 @@ let
      So disable them for now.  */
   cxx = !stdenv.isSunOS;
 in
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   name = "ncurses-5.9";
 
   src = fetchurl {
@@ -18,13 +18,7 @@ stdenv.mkDerivation (rec {
     sha256 = "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh";
   };
 
-  clangPatch = fetchurl {
-    # Patch referenced from https://github.com/Homebrew/homebrew-dupes/issues/43
-    url = "http://lists.gnu.org/archive/html/bug-ncurses/2011-04/txtkWQqiQvcZe.txt";
-    sha256 = "03lrwqvb0r2qgi8hz7ayd3g26d6xilr3c92j8li3b77kdc0w0rlv";
-  };
-
-  patches = [ ./patch-ac ] ++ stdenv.lib.optional stdenv.isDarwin clangPatch;
+  patches = [ ./patch-ac ];
 
   configureFlags = ''
     --with-shared --without-debug --enable-pc-files --enable-symlinks
@@ -41,6 +35,8 @@ stdenv.mkDerivation (rec {
     export configureFlags="$configureFlags --includedir=$out/include"
     export PKG_CONFIG_LIBDIR="$out/lib/pkgconfig"
     mkdir -p "$PKG_CONFIG_LIBDIR"
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure --replace -no-cpp-precomp ""
   '';
 
   selfNativeBuildInput = true;
@@ -50,8 +46,8 @@ stdenv.mkDerivation (rec {
   preBuild =
     # On Darwin, we end up using the native `sed' during bootstrap, and it
     # fails to run this command, which isn't needed anyway.
-    stdenv.lib.optionalString (!stdenv.isDarwin)
-    ''sed -e "s@\([[:space:]]\)sh @\1''${SHELL} @" -i */Makefile Makefile'';
+    lib.optionalString (!stdenv.isDarwin)
+      ''sed -e "s@\([[:space:]]\)sh @\1''${SHELL} @" -i */Makefile Makefile'';
 
   # When building a wide-character (Unicode) build, create backward
   # compatibility links from the the "normal" libraries to the
@@ -71,6 +67,8 @@ stdenv.mkDerivation (rec {
     ln -svf ncursesw5-config $out/bin/ncurses5-config
   '' else "";
 
+  postFixup = lib.optionalString stdenv.isDarwin "rm $out/lib/*.so";
+
   meta = {
     description = "GNU Ncurses, a free software emulation of curses in SVR4 and more";
 
@@ -90,9 +88,9 @@ stdenv.mkDerivation (rec {
 
     homepage = http://www.gnu.org/software/ncurses/;
 
-    license = stdenv.lib.licenses.mit;
+    license = lib.licenses.mit;
 
-    maintainers = [ stdenv.lib.maintainers.ludo ];
-    platforms = stdenv.lib.platforms.all;
+    maintainers = [ lib.maintainers.ludo ];
+    platforms = lib.platforms.all;
   };
-} // ( if stdenv.isDarwin then { postFixup = "rm $out/lib/*.so"; } else { } ) )
+}
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index ea858417b2f..7dafcfce948 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, cmake, gtk, libjpeg, libpng, libtiff, jasper, ffmpeg
-, pkgconfig, gstreamer, xineLib, glib, python27, python27Packages }:
+{ lib, stdenv, fetchurl, cmake, gtk, libjpeg, libpng, libtiff, jasper, ffmpeg
+, pkgconfig, gstreamer, xineLib, glib, python27, python27Packages
+, enableBloat ? false }:
 
 let v = "2.4.7"; in
 
@@ -11,8 +12,9 @@ stdenv.mkDerivation rec {
     sha256 = "0hravl3yhyv4r4n7vb055d4qnp893q2hc0fcmmncfh7sbdrnr3f4";
   };
 
-  buildInputs = [ gtk glib libjpeg libpng libtiff jasper ffmpeg xineLib gstreamer
-    python27 python27Packages.numpy ];
+  buildInputs =
+    [ libjpeg libpng libtiff ]
+    ++ lib.optionals enableBloat [ gtk glib jasper ffmpeg xineLib gstreamer python27 python27Packages.numpy ];
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 93f7cbe1a1f..8c88df984f0 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -2,7 +2,7 @@
 , withCryptodev ? false, cryptodevHeaders }:
 
 let
-  name = "openssl-1.0.1h";
+  name = "openssl-1.0.1i";
 
   opensslCrossSystem = stdenv.lib.attrByPath [ "openssl" "system" ]
     (throw "openssl needs its platform name cross building" null)
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
       "http://www.openssl.org/source/${name}.tar.gz"
       "http://openssl.linux-mirror.org/source/${name}.tar.gz"
     ];
-    sha256 = "14yhsgag5as7nhxnw7f0vklwjwa3pmn1i15nmp3f4qxa6sc8l74x";
+    sha256 = "1izwv1wzqdw8aqnvb70jcqpqp0rvkcm22w5c1dm9l1kpr939y5rw";
   };
 
   patches = patchesCross false;
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
   makeFlags = "MANDIR=$(out)/share/man";
 
   # Parallel building is broken in OpenSSL.
-  #enableParallelBuilding = true;
+  enableParallelBuilding = false;
 
   postInstall =
     ''
diff --git a/pkgs/development/libraries/readline/no-arch_only-6.3.patch b/pkgs/development/libraries/readline/no-arch_only-6.3.patch
new file mode 100644
index 00000000000..7c46dbad962
--- /dev/null
+++ b/pkgs/development/libraries/readline/no-arch_only-6.3.patch
@@ -0,0 +1,13 @@
+diff -ru -x '*~' readline-6.3-orig/support/shobj-conf readline-6.3/support/shobj-conf
+--- support/shobj-conf	2014-02-24 03:06:29.000000000 +0100
++++ support/shobj-conf	2014-07-22 11:18:52.000000000 +0200
+@@ -194,9 +194,6 @@
+ 	# Darwin 8 == Mac OS X 10.4; Mac OS X 10.N == Darwin N+4
+ 	*)
+ 		case "${host_os}" in
+-		darwin[89]*|darwin1[012]*)
+-			SHOBJ_ARCHFLAGS='-arch_only `/usr/bin/arch`'
+-			;;
+ 		 *) 	# Mac OS X 10.9 (Mavericks) and later
+ 			SHOBJ_ARCHFLAGS=
+ 			# for 32 and 64bit universal library
diff --git a/pkgs/development/libraries/readline/no-arch_only.patch b/pkgs/development/libraries/readline/no-arch_only.patch
new file mode 100644
index 00000000000..b23eab5d9d7
--- /dev/null
+++ b/pkgs/development/libraries/readline/no-arch_only.patch
@@ -0,0 +1,14 @@
+diff -ru -x '*~' readline-6.2-orig/support/shobj-conf readline-6.2/support/shobj-conf
+--- support/shobj-conf	2009-10-28 14:20:21.000000000 +0100
++++ support/shobj-conf	2014-07-01 13:03:28.000000000 +0200
+@@ -168,8 +168,8 @@
+ 	SHLIB_LIBVERSION='$(SHLIB_MAJOR)$(SHLIB_MINOR).$(SHLIB_LIBSUFF)'
+ 	SHLIB_LIBSUFF='dylib'
+ 
+-	SHOBJ_LDFLAGS='-dynamiclib -dynamic -undefined dynamic_lookup -arch_only `/usr/bin/arch`'
+-	SHLIB_XLDFLAGS='-dynamiclib -arch_only `/usr/bin/arch` -install_name $(libdir)/$@ -current_version $(SHLIB_MAJOR)$(SHLIB_MINOR) -compatibility_version $(SHLIB_MAJOR) -v'
++	SHOBJ_LDFLAGS='-dynamiclib -dynamic -undefined dynamic_lookup'
++	SHLIB_XLDFLAGS='-dynamiclib -install_name $(libdir)/$@ -current_version $(SHLIB_MAJOR)$(SHLIB_MINOR) -compatibility_version $(SHLIB_MAJOR) -v'
+ 
+ 	SHLIB_LIBS='-lncurses'	# see if -lcurses works on MacOS X 10.1 
+ 	;;
diff --git a/pkgs/development/libraries/readline/readline6.3.nix b/pkgs/development/libraries/readline/readline6.3.nix
index dd39804983a..9f5c9f7b581 100644
--- a/pkgs/development/libraries/readline/readline6.3.nix
+++ b/pkgs/development/libraries/readline/readline6.3.nix
@@ -13,7 +13,9 @@ stdenv.mkDerivation (rec {
   patchFlags = "-p0";
 
   patches =
-    [ ./link-against-ncurses.patch ];
+    [ ./link-against-ncurses.patch
+      ./no-arch_only-6.3.patch
+    ];
 
   meta = {
     description = "GNU Readline, a library for interactive line editing";
diff --git a/pkgs/development/libraries/readline/readline6.nix b/pkgs/development/libraries/readline/readline6.nix
index 05500f345ac..0559113285c 100644
--- a/pkgs/development/libraries/readline/readline6.nix
+++ b/pkgs/development/libraries/readline/readline6.nix
@@ -12,7 +12,9 @@ stdenv.mkDerivation (rec {
 
   patchFlags = "-p0";
   patches =
-    [ ./link-against-ncurses.patch ]
+    [ ./link-against-ncurses.patch
+      ./no-arch_only.patch
+    ]
     ++
     (let
        patch = nr: sha256: