summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
authorFrederik Rietdijk <fridh@fridh.nl>2019-05-14 10:23:13 +0200
committerFrederik Rietdijk <fridh@fridh.nl>2019-05-14 10:23:13 +0200
commit8abe5ee07ee6b23fb014709f01bb161a62407a44 (patch)
tree23fe6fb06258812145de6c5c2c41bf83b887af72 /pkgs
parentef0dbef7f15f962f9fedfd86563664bc95e6e2f9 (diff)
parentf2affe03443d916d1c693dc246e48985bc2222d4 (diff)
downloadnixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar.gz
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar.bz2
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar.lz
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar.xz
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.tar.zst
nixpkgs-8abe5ee07ee6b23fb014709f01bb161a62407a44.zip
Merge master into staging-next
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/qmmp/default.nix8
-rw-r--r--pkgs/applications/audio/vcv-rack/default.nix5
-rw-r--r--pkgs/applications/graphics/openscad/default.nix25
-rw-r--r--pkgs/applications/kde/kgpg.nix6
-rw-r--r--pkgs/applications/misc/bemenu/default.nix45
-rw-r--r--pkgs/applications/misc/electrum/default.nix10
-rw-r--r--pkgs/applications/misc/k2pdfopt/default.nix23
-rw-r--r--pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch95
-rw-r--r--pkgs/applications/misc/kitty/default.nix15
-rw-r--r--pkgs/applications/misc/octoprint/default.nix19
-rw-r--r--pkgs/applications/misc/playonlinux/default.nix4
-rw-r--r--pkgs/applications/misc/tilix/default.nix4
-rw-r--r--pkgs/applications/misc/tzupdate/default.nix4
-rw-r--r--pkgs/applications/misc/zathura/core/default.nix10
-rw-r--r--pkgs/applications/misc/zathura/default.nix3
-rw-r--r--pkgs/applications/misc/zathura/pdf-mupdf/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/qbittorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix6
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/science/biology/eggnog-mapper/default.nix4
-rw-r--r--pkgs/applications/science/logic/symbiyosys/default.nix5
-rw-r--r--pkgs/applications/science/math/cbc/default.nix10
-rw-r--r--pkgs/applications/science/math/pynac/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/fast-export/default.nix51
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-crypt/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix4
-rw-r--r--pkgs/applications/version-management/src/default.nix14
-rw-r--r--pkgs/applications/video/mkclean/default.nix37
-rw-r--r--pkgs/applications/virtualization/rkt/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/wk-switch.nix15
-rw-r--r--pkgs/build-support/docker/default.nix21
-rw-r--r--pkgs/build-support/docker/examples.nix39
-rw-r--r--pkgs/data/fonts/agave/default.nix27
-rw-r--r--pkgs/data/fonts/aileron/default.nix4
-rw-r--r--pkgs/data/fonts/andagii/default.nix4
-rw-r--r--pkgs/data/fonts/andika/default.nix4
-rw-r--r--pkgs/data/fonts/ankacoder/condensed.nix4
-rw-r--r--pkgs/data/fonts/ankacoder/default.nix4
-rw-r--r--pkgs/data/fonts/anonymous-pro/default.nix4
-rw-r--r--pkgs/data/fonts/arkpandora/default.nix3
-rw-r--r--pkgs/data/fonts/arphic/default.nix6
-rw-r--r--pkgs/data/fonts/aurulent-sans/default.nix17
-rw-r--r--pkgs/data/fonts/b612/default.nix17
-rw-r--r--pkgs/data/fonts/babelstone-han/default.nix8
-rw-r--r--pkgs/data/fonts/baekmuk-ttf/default.nix8
-rw-r--r--pkgs/data/fonts/bakoma-ttf/default.nix3
-rw-r--r--pkgs/data/fonts/behdad-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/cabin/default.nix18
-rw-r--r--pkgs/data/fonts/caladea/default.nix4
-rw-r--r--pkgs/data/fonts/camingo-code/default.nix12
-rw-r--r--pkgs/data/fonts/carlito/default.nix4
-rw-r--r--pkgs/data/fonts/charis-sil/default.nix4
-rw-r--r--pkgs/data/fonts/clearlyU/default.nix20
-rw-r--r--pkgs/data/fonts/cm-unicode/default.nix10
-rw-r--r--pkgs/data/fonts/comfortaa/default.nix5
-rw-r--r--pkgs/data/fonts/comic-neue/default.nix4
-rw-r--r--pkgs/data/fonts/comic-relief/default.nix4
-rw-r--r--pkgs/data/fonts/cooper-hewitt/default.nix6
-rw-r--r--pkgs/data/fonts/corefonts/default.nix6
-rw-r--r--pkgs/data/fonts/crimson/default.nix11
-rw-r--r--pkgs/data/fonts/culmus/default.nix19
-rw-r--r--pkgs/data/fonts/d2coding/default.nix6
-rw-r--r--pkgs/data/fonts/dina-pcf/default.nix1
-rw-r--r--pkgs/data/fonts/dina/default.nix7
-rw-r--r--pkgs/data/fonts/dosemu-fonts/default.nix1
-rw-r--r--pkgs/data/fonts/dosis/default.nix18
-rw-r--r--pkgs/data/fonts/doulos-sil/default.nix4
-rw-r--r--pkgs/data/fonts/eb-garamond/default.nix4
-rw-r--r--pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix4
-rw-r--r--pkgs/data/fonts/emojione/default.nix1
-rw-r--r--pkgs/data/fonts/encode-sans/default.nix4
-rw-r--r--pkgs/data/fonts/eunomia/default.nix4
-rw-r--r--pkgs/data/fonts/f5_6/default.nix4
-rw-r--r--pkgs/data/fonts/fantasque-sans-mono/default.nix6
-rw-r--r--pkgs/data/fonts/ferrum/default.nix4
-rw-r--r--pkgs/data/fonts/fira/default.nix19
-rw-r--r--pkgs/data/fonts/fixedsys-excelsior/default.nix32
-rw-r--r--pkgs/data/fonts/font-awesome-5/default.nix14
-rw-r--r--pkgs/data/fonts/fontconfig-penultimate/default.nix4
-rw-r--r--pkgs/data/fonts/freefont-ttf/default.nix6
-rw-r--r--pkgs/data/fonts/gandom-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/gdouros/default.nix36
-rw-r--r--pkgs/data/fonts/gentium-book-basic/default.nix5
-rw-r--r--pkgs/data/fonts/gentium/default.nix4
-rw-r--r--pkgs/data/fonts/go-font/default.nix22
-rw-r--r--pkgs/data/fonts/gohufont/default.nix1
-rw-r--r--pkgs/data/fonts/gyre/default.nix8
-rw-r--r--pkgs/data/fonts/hack/default.nix4
-rw-r--r--pkgs/data/fonts/hanazono/default.nix4
-rw-r--r--pkgs/data/fonts/hasklig/default.nix7
-rw-r--r--pkgs/data/fonts/helvetica-neue-lt-std/default.nix8
-rw-r--r--pkgs/data/fonts/hermit/default.nix23
-rw-r--r--pkgs/data/fonts/hyperscrypt/default.nix4
-rw-r--r--pkgs/data/fonts/inriafonts/default.nix26
-rw-r--r--pkgs/data/fonts/inter-ui/default.nix4
-rw-r--r--pkgs/data/fonts/inter/default.nix4
-rw-r--r--pkgs/data/fonts/ipaexfont/default.nix9
-rw-r--r--pkgs/data/fonts/ipafont/default.nix7
-rw-r--r--pkgs/data/fonts/ir-standard-fonts/default.nix27
-rw-r--r--pkgs/data/fonts/iwona/default.nix25
-rw-r--r--pkgs/data/fonts/junicode/default.nix5
-rw-r--r--pkgs/data/fonts/kawkab-mono/default.nix5
-rw-r--r--pkgs/data/fonts/kochi-substitute-naga10/default.nix6
-rw-r--r--pkgs/data/fonts/kochi-substitute/default.nix1
-rw-r--r--pkgs/data/fonts/lalezar-fonts/default.nix22
-rw-r--r--pkgs/data/fonts/lato/default.nix4
-rw-r--r--pkgs/data/fonts/liberastika/default.nix4
-rw-r--r--pkgs/data/fonts/liberation-sans-narrow/default.nix7
-rw-r--r--pkgs/data/fonts/libertinus/default.nix32
-rw-r--r--pkgs/data/fonts/libre-baskerville/default.nix18
-rw-r--r--pkgs/data/fonts/libre-bodoni/default.nix18
-rw-r--r--pkgs/data/fonts/libre-franklin/default.nix18
-rw-r--r--pkgs/data/fonts/lm-math/default.nix26
-rw-r--r--pkgs/data/fonts/lmodern/default.nix3
-rw-r--r--pkgs/data/fonts/lmodern/lmmath.nix3
-rw-r--r--pkgs/data/fonts/lobster-two/default.nix3
-rw-r--r--pkgs/data/fonts/lohit-fonts/default.nix3
-rw-r--r--pkgs/data/fonts/manrope/default.nix22
-rw-r--r--pkgs/data/fonts/marathi-cursive/default.nix12
-rw-r--r--pkgs/data/fonts/material-design-icons/default.nix23
-rw-r--r--pkgs/data/fonts/material-icons/default.nix24
-rw-r--r--pkgs/data/fonts/medio/default.nix4
-rw-r--r--pkgs/data/fonts/migmix/default.nix4
-rw-r--r--pkgs/data/fonts/migu/default.nix1
-rw-r--r--pkgs/data/fonts/mononoki/default.nix4
-rw-r--r--pkgs/data/fonts/montserrat/default.nix4
-rw-r--r--pkgs/data/fonts/mph-2b-damase/default.nix3
-rw-r--r--pkgs/data/fonts/mplus-outline-fonts/default.nix4
-rw-r--r--pkgs/data/fonts/mro-unicode/default.nix2
-rw-r--r--pkgs/data/fonts/nahid-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/nanum-gothic-coding/default.nix4
-rw-r--r--pkgs/data/fonts/nerdfonts/default.nix1
-rw-r--r--pkgs/data/fonts/nika-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/norwester/default.nix4
-rw-r--r--pkgs/data/fonts/noto-fonts/tools.nix1
-rw-r--r--pkgs/data/fonts/office-code-pro/default.nix30
-rw-r--r--pkgs/data/fonts/oldsindhi/default.nix12
-rw-r--r--pkgs/data/fonts/oldstandard/default.nix30
-rw-r--r--pkgs/data/fonts/open-dyslexic/default.nix4
-rw-r--r--pkgs/data/fonts/open-sans/default.nix26
-rw-r--r--pkgs/data/fonts/orbitron/default.nix18
-rw-r--r--pkgs/data/fonts/overpass/default.nix4
-rw-r--r--pkgs/data/fonts/oxygenfonts/default.nix15
-rw-r--r--pkgs/data/fonts/parastoo-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/paratype-pt/mono.nix7
-rw-r--r--pkgs/data/fonts/paratype-pt/sans.nix7
-rw-r--r--pkgs/data/fonts/paratype-pt/serif.nix7
-rw-r--r--pkgs/data/fonts/pecita/default.nix6
-rw-r--r--pkgs/data/fonts/penna/default.nix4
-rw-r--r--pkgs/data/fonts/poly/default.nix1
-rw-r--r--pkgs/data/fonts/powerline-fonts/default.nix30
-rw-r--r--pkgs/data/fonts/profont/default.nix8
-rw-r--r--pkgs/data/fonts/public-sans/default.nix4
-rw-r--r--pkgs/data/fonts/quattrocento-sans/default.nix6
-rw-r--r--pkgs/data/fonts/quattrocento/default.nix6
-rw-r--r--pkgs/data/fonts/raleway/default.nix18
-rw-r--r--pkgs/data/fonts/ricty/default.nix1
-rw-r--r--pkgs/data/fonts/roboto/default.nix8
-rw-r--r--pkgs/data/fonts/rounded-mgenplus/default.nix28
-rw-r--r--pkgs/data/fonts/route159/default.nix4
-rw-r--r--pkgs/data/fonts/sahel-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/samim-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix12
-rw-r--r--pkgs/data/fonts/scheherazade/default.nix4
-rw-r--r--pkgs/data/fonts/seshat/default.nix4
-rw-r--r--pkgs/data/fonts/shabnam-fonts/default.nix26
-rw-r--r--pkgs/data/fonts/shrikhand/default.nix4
-rw-r--r--pkgs/data/fonts/siji/default.nix8
-rw-r--r--pkgs/data/fonts/source-code-pro/default.nix8
-rw-r--r--pkgs/data/fonts/source-han-code-jp/default.nix8
-rw-r--r--pkgs/data/fonts/source-han-sans/default.nix7
-rw-r--r--pkgs/data/fonts/source-han-serif/default.nix7
-rw-r--r--pkgs/data/fonts/source-sans-pro/default.nix4
-rw-r--r--pkgs/data/fonts/source-serif-pro/default.nix4
-rw-r--r--pkgs/data/fonts/spleen/default.nix22
-rw-r--r--pkgs/data/fonts/stix-otf/default.nix6
-rw-r--r--pkgs/data/fonts/stix-two/default.nix4
-rw-r--r--pkgs/data/fonts/sudo/default.nix4
-rw-r--r--pkgs/data/fonts/tamsyn/default.nix7
-rw-r--r--pkgs/data/fonts/tempora-lgc/default.nix1
-rw-r--r--pkgs/data/fonts/tenderness/default.nix4
-rw-r--r--pkgs/data/fonts/terminus-font-ttf/default.nix5
-rw-r--r--pkgs/data/fonts/terminus-font/default.nix1
-rw-r--r--pkgs/data/fonts/tewi/default.nix1
-rw-r--r--pkgs/data/fonts/tex-gyre-math/default.nix24
-rw-r--r--pkgs/data/fonts/tex-gyre/default.nix2
-rw-r--r--pkgs/data/fonts/theano/default.nix4
-rw-r--r--pkgs/data/fonts/tipa/default.nix1
-rw-r--r--pkgs/data/fonts/tlwg/default.nix1
-rw-r--r--pkgs/data/fonts/ttf-bitstream-vera/default.nix7
-rw-r--r--pkgs/data/fonts/ttf-envy-code-r/default.nix5
-rw-r--r--pkgs/data/fonts/twemoji-color-font/default.nix1
-rw-r--r--pkgs/data/fonts/ubuntu-font-family/default.nix10
-rw-r--r--pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix5
-rw-r--r--pkgs/data/fonts/undefined-medium/default.nix6
-rw-r--r--pkgs/data/fonts/uni-vga/default.nix3
-rw-r--r--pkgs/data/fonts/unifont/default.nix8
-rw-r--r--pkgs/data/fonts/unifont_upper/default.nix8
-rwxr-xr-xpkgs/data/fonts/vazir-fonts/default.nix27
-rw-r--r--pkgs/data/fonts/vdrsymbols/default.nix4
-rw-r--r--pkgs/data/fonts/vegur/default.nix25
-rw-r--r--pkgs/data/fonts/vista-fonts-chs/default.nix10
-rw-r--r--pkgs/data/fonts/vista-fonts/default.nix2
-rw-r--r--pkgs/data/fonts/weather-icons/default.nix6
-rw-r--r--pkgs/data/fonts/wqy-microhei/default.nix8
-rw-r--r--pkgs/data/fonts/wqy-zenhei/default.nix8
-rw-r--r--pkgs/data/fonts/xkcd-font/default.nix23
-rw-r--r--pkgs/data/fonts/yanone-kaffeesatz/default.nix8
-rw-r--r--pkgs/data/fonts/zilla-slab/default.nix7
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/development/compilers/ghc/8.6.4.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.5.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.8.1.nix5
-rw-r--r--pkgs/development/compilers/ghc/head.nix5
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix6
-rw-r--r--pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch36
-rw-r--r--pkgs/development/compilers/mruby/default.nix10
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix42
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix.yaml17
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix20
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix115
-rw-r--r--pkgs/development/libraries/alkimia/default.nix11
-rw-r--r--pkgs/development/libraries/ctl/default.nix35
-rw-r--r--pkgs/development/libraries/ctl/source.nix11
-rw-r--r--pkgs/development/libraries/gtksourceview/3.x.nix4
-rw-r--r--pkgs/development/libraries/java/lombok/default.nix4
-rw-r--r--pkgs/development/libraries/libdazzle/default.nix4
-rw-r--r--pkgs/development/libraries/libgda/default.nix4
-rw-r--r--pkgs/development/libraries/linbox/default.nix5
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix4
-rw-r--r--pkgs/development/libraries/portaudio/default.nix2
-rw-r--r--pkgs/development/libraries/range-v3/default.nix4
-rw-r--r--pkgs/development/libraries/tbb/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix4
-rw-r--r--pkgs/development/python-modules/av/default.nix7
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/latexcodec/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/py-radix/default.nix28
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix15
-rw-r--r--pkgs/development/python-modules/python-gnupg/default.nix6
-rw-r--r--pkgs/development/python-modules/qdarkstyle/default.nix4
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix4
-rw-r--r--pkgs/development/python-modules/qtpy/default.nix4
-rw-r--r--pkgs/development/python-modules/shodan/default.nix4
-rw-r--r--pkgs/development/python-modules/smart_open/default.nix4
-rw-r--r--pkgs/development/python-modules/typed-ast/default.nix4
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix12
-rw-r--r--pkgs/development/tools/build-managers/bazel/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/buck/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/leiningen/default.nix4
-rw-r--r--pkgs/development/tools/chit/default.nix47
-rw-r--r--pkgs/development/tools/react-native-debugger/default.nix4
-rw-r--r--pkgs/development/tools/scalafmt/default.nix7
-rw-r--r--pkgs/development/tools/wabt/default.nix4
-rw-r--r--pkgs/games/azimuth/default.nix64
-rw-r--r--pkgs/misc/emulators/wine/sources.nix6
-rw-r--r--pkgs/misc/screensavers/xautolock/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/cpptools/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/wakatime/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftool/default.nix26
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix6
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix4
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix113
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/5.x.nix5
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix4
-rw-r--r--pkgs/shells/tcsh/default.nix4
-rw-r--r--pkgs/tools/backup/duply/default.nix4
-rw-r--r--pkgs/tools/misc/aptly/default.nix4
-rw-r--r--pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch1153
-rw-r--r--pkgs/tools/misc/coreutils/default.nix14
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/qt5ct/default.nix4
-rw-r--r--pkgs/tools/misc/shell-hist/default.nix23
-rw-r--r--pkgs/tools/misc/tlp/default.nix4
-rw-r--r--pkgs/tools/misc/ttyplot/default.nix4
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix8
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/axel/default.nix6
-rw-r--r--pkgs/tools/networking/i2pd/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/security/signing-party/default.nix30
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/security/vault/default.nix4
-rw-r--r--pkgs/tools/security/yara/default.nix4
-rw-r--r--pkgs/tools/system/stress-ng/default.nix50
-rw-r--r--pkgs/top-level/all-packages.nix40
-rw-r--r--pkgs/top-level/php-packages.nix4
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release-cross.nix2
295 files changed, 3089 insertions, 1331 deletions
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index eab498b9624..490f8639d38 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -29,17 +29,17 @@
 # handle that.
 
 stdenv.mkDerivation rec {
-  name = "qmmp-1.3.1";
+  name = "qmmp-1.3.2";
 
   src = fetchurl {
     url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "1dmybzibpr6hpr2iv1wvrjgww842mng2x0rh1mr8gs8j191xvlhw";
+    sha256 = "1rh063kcyg7gs9yj2r4v5irpnq4pjaxaxsgrw30mdr21xhhc15cz";
   };
 
+  nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
     [ # basic requirements
-      cmake pkgconfig xlibsWrapper
-      qtbase qttools qtmultimedia qtx11extras
+      qtbase qttools qtmultimedia qtx11extras xlibsWrapper
       # transports
       curl libmms
       # input plugins
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index 27533084804..15935751c32 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -72,8 +72,9 @@ with stdenv.lib; stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Open-source virtual modular synthesizer";
     homepage = http://vcvrack.com/;
-    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or unfree
-    license = [ licenses.bsd3 licenses.cc-by-nc-40 licenses.unfree ];
+    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or under a
+    # no-derivatives clause
+    license = with licenses; [ bsd3 cc-by-nc-40 unfreeRedistributable ];
     maintainers = with maintainers; [ moredread ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index bce2e882698..5922206a8b9 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qt5, libsForQt5
 , bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
-, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext
+, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext, freetype, fontconfig
 }:
 
 stdenv.mkDerivation rec {
@@ -18,11 +18,13 @@ stdenv.mkDerivation rec {
     sha256 = "1y63yqyd0v255liik4ff5ak6mj86d8d76w436x76hs5dk6jgpmfb";
   };
 
+  nativeBuildInputs = [ bison flex pkgconfig ];
+
   buildInputs = [
-    bison flex eigen boost libGLU_combined glew opencsg cgal mpfr gmp glib
-    pkgconfig harfbuzz gettext
-  ]
-    ++ (with qt5; [qtbase qmake])
+    eigen boost glew opencsg cgal mpfr gmp glib
+    harfbuzz gettext freetype fontconfig
+  ] ++ stdenv.lib.optional stdenv.isLinux libGLU_combined
+    ++ (with qt5; [qtbase qmake] ++ stdenv.lib.optional stdenv.isDarwin qtmacextras)
     ++ (with libsForQt5; [qscintilla])
   ;
 
@@ -33,6 +35,17 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/*.app $out/Applications
+    rmdir $out/bin || true
+
+    mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
+      $out/share/openscad/{examples,color-schemes,locale,libraries,fonts}
+
+    rmdir $out/share/openscad
+  '';
+
   meta = {
     description = "3D parametric model compiler";
     longDescription = ''
@@ -48,7 +61,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://openscad.org/;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     maintainers = with stdenv.lib.maintainers;
       [ bjornfor raskin the-kenny ];
   };
diff --git a/pkgs/applications/kde/kgpg.nix b/pkgs/applications/kde/kgpg.nix
index 33813f376a5..944cff47e0d 100644
--- a/pkgs/applications/kde/kgpg.nix
+++ b/pkgs/applications/kde/kgpg.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools, ki18n, makeWrapper,
-  akonadi-contacts, gnupg1, karchive, kcodecs, kcontacts, kcoreaddons,
+  akonadi-contacts, gnupg, karchive, kcodecs, kcontacts, kcoreaddons,
   kcrash, kdbusaddons, kiconthemes, kjobwidgets, kio, knotifications, kservice,
   ktextwidgets, kxmlgui, kwidgetsaddons, kwindowsystem, qgpgme,
 }:
@@ -10,12 +10,12 @@ mkDerivation {
   name = "kgpg";
   nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];
   buildInputs = [
-    akonadi-contacts gnupg1 karchive kcodecs kcontacts kcoreaddons kcrash
+    akonadi-contacts gnupg karchive kcodecs kcontacts kcoreaddons kcrash
     kdbusaddons ki18n kiconthemes kjobwidgets kio knotifications kservice
     ktextwidgets kxmlgui kwidgetsaddons kwindowsystem qgpgme
   ];
   postFixup = ''
-    wrapProgram "$out/bin/kgpg" --prefix PATH : "${lib.makeBinPath [ gnupg1 ]}"
+    wrapProgram "$out/bin/kgpg" --prefix PATH : "${lib.makeBinPath [ gnupg ]}"
   '';
   meta = {
     license = [ lib.licenses.gpl2 ];
diff --git a/pkgs/applications/misc/bemenu/default.nix b/pkgs/applications/misc/bemenu/default.nix
new file mode 100644
index 00000000000..89c32668be9
--- /dev/null
+++ b/pkgs/applications/misc/bemenu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, cairo, cmake, libxkbcommon
+, pango, fribidi, harfbuzz, pcre, pkgconfig
+, ncursesSupport ? true, ncurses ? null
+, waylandSupport ? true, wayland ? null
+, x11Support ? true, xlibs ? null, xorg ? null
+}:
+
+assert ncursesSupport -> ncurses != null;
+assert waylandSupport -> wayland != null;
+assert x11Support -> xlibs != null && xorg != null;
+
+stdenv.mkDerivation rec {
+  pname = "bemenu";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cloudef";
+    repo = "bemenu";
+    rev = "33e540a2b04ce78f5c7ab4a60b899c67f586cc32";
+    sha256 = "11h55m9dx6ai12pqij52ydjm36dvrcc856pa834njihrp626pl4w";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig pcre ];
+
+  buildInputs = with stdenv.lib; [
+    cairo
+    fribidi
+    harfbuzz
+    libxkbcommon
+    pango
+  ] ++ optionals ncursesSupport [ ncurses ]
+    ++ optionals waylandSupport [ wayland ]
+    ++ optionals x11Support [
+      xlibs.libX11 xlibs.libXinerama xlibs.libXft
+      xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
+    ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Cloudef/bemenu";
+    description = "Dynamic menu library and client program inspired by dmenu";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 6185b7d228f..9cabd6dda7c 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -3,16 +3,6 @@
 let
   version = "3.3.5";
 
-  qdarkstyle = python3Packages.buildPythonPackage rec {
-    pname = "QDarkStyle";
-    version = "2.5.4";
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
-    };
-    doCheck = false; # no tests
-  };
-
   # Not provided in official source releases, which are what upstream signs.
   tests = fetchFromGitHub {
     owner = "spesmilo";
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index 0049e9aca75..bf29e05db1b 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -57,7 +57,28 @@ stdenv.mkDerivation rec {
       prePatch = ''
         cp ${src}/leptonica_mod/{allheaders.h,dewarp2.c,leptwin.c} src/
       '';
-      patches = [];
+      patches = [
+        # stripped down copy of upstream commit b88c821f8d347bce0aea86d606c710303919f3d2
+        ./leptonica-CVE-2018-3836.patch
+        (fetchpatch {
+          # CVE-2018-7186
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "ee301cb2029db8a6289c5295daa42bba7715e99a.patch";
+          sha256 = "0cgb7mvz2px1rg5i80wk1wxxjvzjga617d8q6j7qygkp7jm6495d";
+        })
+        (fetchpatch {
+          # CVE-2018-7247
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "c1079bb8e77cdd426759e466729917ca37a3ed9f.patch";
+          sha256 = "1z4iac5gwqggh7aa8cvyp6nl9fwd1v7wif26caxc9y5qr3jj34qf";
+        })
+        (fetchpatch {
+          # CVE-2018-7440
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "49ecb6c2dfd6ed5078c62f4a8eeff03e3beced3b.patch";
+          sha256 = "1hjmva98iaw9xj7prg7aimykyayikcwnk4hk0380007hqb35lqmy";
+        })
+      ];
     });
     tesseract_modded = tesseract4.override {
       tesseractBase = tesseract4.tesseractBase.overrideAttrs (_: {
diff --git a/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
new file mode 100644
index 00000000000..f1b4170fbaa
--- /dev/null
+++ b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
@@ -0,0 +1,95 @@
+--- a/src/allheaders.h
++++ b/src/allheaders.h
+@@ -2600,6 +2600,7 @@
+ LEPT_DLL extern char * stringReverse ( const char *src );
+ LEPT_DLL extern char * strtokSafe ( char *cstr, const char *seps, char **psaveptr );
+ LEPT_DLL extern l_int32 stringSplitOnToken ( char *cstr, const char *seps, char **phead, char **ptail );
++LEPT_DLL extern l_int32 stringCheckForChars ( const char *src, const char *chars, l_int32 *pfound );
+ LEPT_DLL extern char * stringRemoveChars ( const char *src, const char *remchars );
+ LEPT_DLL extern l_int32 stringFindSubstr ( const char *src, const char *sub, l_int32 *ploc );
+ LEPT_DLL extern char * stringReplaceSubstr ( const char *src, const char *sub1, const char *sub2, l_int32 *pfound, l_int32 *ploc );
+--- a/src/gplot.c
++++ b/src/gplot.c
+@@ -141,9 +141,10 @@
+             const char  *xlabel,
+             const char  *ylabel)
+ {
+-char   *newroot;
+-char    buf[L_BUF_SIZE];
+-GPLOT  *gplot;
++char    *newroot;
++char     buf[L_BUF_SIZE];
++l_int32  badchar;
++GPLOT   *gplot;
+ 
+     PROCNAME("gplotCreate");
+ 
+@@ -152,6 +153,9 @@
+     if (outformat != GPLOT_PNG && outformat != GPLOT_PS &&
+         outformat != GPLOT_EPS && outformat != GPLOT_LATEX)
+         return (GPLOT *)ERROR_PTR("outformat invalid", procName, NULL);
++    stringCheckForChars(rootname, "`;&|><\"?*", &badchar);
++    if (badchar)  /* danger of command injection */
++        return (GPLOT *)ERROR_PTR("invalid rootname", procName, NULL);
+ 
+     if ((gplot = (GPLOT *)LEPT_CALLOC(1, sizeof(GPLOT))) == NULL)
+         return (GPLOT *)ERROR_PTR("gplot not made", procName, NULL);
+--- a/src/utils2.c
++++ b/src/utils2.c
+@@ -42,6 +42,7 @@
+  *           l_int32    stringSplitOnToken()
+  *
+  *       Find and replace string and array procs
++ *           l_int32    stringCheckForChars()
+  *           char      *stringRemoveChars()
+  *           l_int32    stringFindSubstr()
+  *           char      *stringReplaceSubstr()
+@@ -701,6 +702,48 @@
+ /*--------------------------------------------------------------------*
+  *                       Find and replace procs                       *
+  *--------------------------------------------------------------------*/
++/*!
++ * \brief   stringCheckForChars()
++ *
++ * \param[in]    src      input string; can be of zero length
++ * \param[in]    chars    string of chars to be searched for in %src
++ * \param[out]   pfound   1 if any characters are found; 0 otherwise
++ * \return  0 if OK, 1 on error
++ *
++ * <pre>
++ * Notes:
++ *      (1) This can be used to sanitize an operation by checking for
++ *          special characters that don't belong in a string.
++ * </pre>
++ */
++l_int32
++stringCheckForChars(const char  *src,
++                    const char  *chars,
++                    l_int32     *pfound)
++{
++char     ch;
++l_int32  i, n;
++
++    PROCNAME("stringCheckForChars");
++
++    if (!pfound)
++        return ERROR_INT("&found not defined", procName, 1);
++    *pfound = FALSE;
++    if (!src || !chars)
++        return ERROR_INT("src and chars not both defined", procName, 1);
++
++    n = strlen(src);
++    for (i = 0; i < n; i++) {
++        ch = src[i];
++        if (strchr(chars, ch)) {
++            *pfound = TRUE;
++            break;
++        }
++    }
++    return 0;
++}
++
++
+ /*!
+  * \brief   stringRemoveChars()
+  *
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
index 3edb48cc489..be70efba5ad 100644
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@@ -2,7 +2,7 @@
   harfbuzz, fontconfig, pkgconfig, ncurses, imagemagick, xsel,
   libstartup_notification, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
-  which, dbus,
+  which, dbus, fetchpatch,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -67,6 +67,17 @@ buildPythonApplication rec {
       libstartup_notification = "${libstartup_notification}/lib/libstartup-notification-1.so";
     })
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      name = "macos-symlink-1";
+      url = https://github.com/kovidgoyal/kitty/commit/bdeec612667f6976109247fe1750b10dda9c24c0.patch;
+      sha256 = "1d18x260w059qag80kgb2cgi2h4rricvqhwpbrw79s8yxzs7jhxk";
+    })
+    (fetchpatch {
+      # fixup of previous patch
+      name = "macos-symlink-2";
+      url = https://github.com/kovidgoyal/kitty/commit/af2c9a49b1ad31e94242295d88598591623fbf11.patch;
+      sha256 = "0k3dmgbvmh66j8k3h8dw6la6ma6f20fng6jjypy982kxvracsnl5";
+    })
     ./macos-10.11.patch
     ./no-lto.patch
     ./no-werror.patch
@@ -84,7 +95,7 @@ buildPythonApplication rec {
     mkdir -p $out
     ${if stdenv.isDarwin then ''
     mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+    ln -s ../Applications/kitty.app/Contents/MacOS/kitty-deref-symlink "$out/bin/kitty"
     mkdir "$out/Applications"
     cp -r kitty.app "$out/Applications/kitty.app"
     '' else ''
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 76a0a574808..b8ed4c5ddbe 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -15,13 +15,26 @@ let
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
       (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
       (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
-      (mkOverride "jinja2"      "2.8.1"  "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m")
       (mkOverride "pylru"       "1.0.9"  "0b0pq0l7xv83dfsajsc49jcxzc99kb9jfx1a1dlx22hzcy962dvi")
       (mkOverride "sarge"       "0.1.4"  "08s8896973bz1gg0pkr592w6g4p6v47bkfvws5i91p9xf8b35yar")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
 
       # https://github.com/NixOS/nixpkgs/pull/58179#issuecomment-478605134
       (mkOverride "werkzeug"    "0.14.1" "c3fd7a7d41976d9f44db327260e263132466836cef6f91512889ed60ad26557c")
+
+      # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
+      # This old version does not have updated test config for pytest 4,
+      # and pypi tarball doesn't contain tests dir anyways.
+      (pself: psuper: {
+        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+          version = "2.8.1";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m";
+          };
+          doCheck = false;
+        });
+      })
     ]);
   };
 
@@ -69,7 +82,7 @@ in py.pkgs.buildPythonApplication rec {
     pylru pyyaml sarge feedparser netifaces click websocket_client
     scandir chainmap future dateutil futures wrapt monotonic emoji
     frozendict
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
   checkInputs = with py.pkgs; [ nose mock ddt ];
 
@@ -82,7 +95,7 @@ in py.pkgs.buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    HOME=$(mktemp -d) nosetests
+    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index da09c123dcd..e5c096fd2ae 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -4,7 +4,7 @@
 , cabextract
 , gettext
 , glxinfo
-, gnupg1compat
+, gnupg
 , icoutils
 , imagemagick
 , netcat-gnu
@@ -32,7 +32,7 @@ let
       python2Packages.python
       gettext
       glxinfo
-      gnupg1compat
+      gnupg
       icoutils
       imagemagick
       netcat-gnu
diff --git a/pkgs/applications/misc/tilix/default.nix b/pkgs/applications/misc/tilix/default.nix
index ed9ae5ade9f..342eca0a6fd 100644
--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tilix";
-  version = "1.9.0";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
     rev = version;
-    sha256 = "1k8hqpq6bzmn06b4s8c257n37ghgp3fl7l9g6fy0giwk1x0ix735";
+    sha256 = "0mg9y4xd2pnv0smibg7dyy733jarvx6qpdqap3sj7fpyni0jvpph";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/tzupdate/default.nix b/pkgs/applications/misc/tzupdate/default.nix
index a5d2f206f3a..c887876634f 100644
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
   pname = "tzupdate";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "085kp4v9ijhkfvr0r5rzn4z7nrkb2qig05j0bajb0gkgynwf8wnz";
+    sha256 = "1sc3z2bx2nhnxg82x0jy19pr8lw56chbr90c2lr11w495csqwhz7";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index f3258c0c711..6378cf1c068 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -32,15 +32,15 @@ stdenv.mkDerivation rec {
   ] ++ optional synctexSupport "-Dsynctex=enabled";
 
   nativeBuildInputs = [
-    meson ninja pkgconfig appstream-glib desktop-file-utils python3.pkgs.sphinx
+    meson ninja pkgconfig desktop-file-utils python3.pkgs.sphinx
     gettext makeWrapper libxml2
-  ];
+  ] ++ optional stdenv.isLinux appstream-glib;
 
   buildInputs = [
-    gtk girara libintl libseccomp
-    sqlite glib file librsvg
+    gtk girara libintl sqlite glib file librsvg
   ] ++ optional synctexSupport texlive.bin.core
-    ++ optional stdenv.isDarwin [ gtk-mac-integration ];
+    ++ optional stdenv.isLinux libseccomp
+    ++ optional stdenv.isDarwin gtk-mac-integration;
 
   meta = {
     homepage = https://pwmt.org/projects/zathura/;
diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix
index dfddfe7d91e..e3db15ca78d 100644
--- a/pkgs/applications/misc/zathura/default.nix
+++ b/pkgs/applications/misc/zathura/default.nix
@@ -1,5 +1,6 @@
 { config, pkgs
-, useMupdf ? config.zathura.useMupdf or true
+# zathura_pdf_mupdf fails to load _opj_create_decompress at runtime on Darwin (https://github.com/NixOS/nixpkgs/pull/61295#issue-277982980)
+, useMupdf ? config.zathura.useMupdf or (!pkgs.stdenv.isDarwin)
 , synctexSupport ? true }:
 
 let
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 709c1edb0b8..e2c08a00da2 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zathura_core girara mupdf cairo
-  ] ++ stdenv.lib.optional stdenv.isDarwin [
-    gtk-mac-integration
-  ];
+  ] ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
   PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";
 
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 81c493fedcf..9696c55bd86 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "4.1.5";
+  version = "4.1.6";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "09zcygaxfv9g6av0vsvlyzv4v65wvj766xyfx31yz5ig3xan6ak1";
+    sha256 = "1y9kv84sy5fg64wbl4xpm8qh0hjba7ibk045cazp0m736rjmxk8c";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index d58c4214d0e..7a5f389af24 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tixati-${version}";
-  version = "2.59";
+  version = "2.61";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "0vf5y9kj2g7psgdzv2r46jdh5krdps838ca4wwwxi0dd1mwa65my";
+    sha256 = "05f8lcsac2mr90bhk999qkj8wwd6igdl07389bqrd1ydjasacl2k";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 46869ecb24f..b9d973287d2 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -14,7 +14,8 @@ let
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
-  name = "wireshark-${variant}-${version}";
+  pname = "wireshark-${variant}";
+  inherit version;
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
@@ -24,7 +25,6 @@ in stdenv.mkDerivation {
 
   cmakeFlags = [
     "-DBUILD_wireshark=${if withQt then "ON" else "OFF"}"
-    "-DENABLE_QT5=${if withQt then "ON" else "OFF"}"
     "-DENABLE_APPLICATION_BUNDLE=${if withQt && stdenv.isDarwin then "ON" else "OFF"}"
   ];
 
@@ -95,6 +95,8 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  dontFixCmake = true;
+
   shellHook = ''
     # to be able to run the resulting binary
     export WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 7cdc7341953..ccb346868a1 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -3,14 +3,14 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoPackage rec {
-      version = "1.1.1";
+      version = "1.1.3";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1nkc4ivc8mg9c1njqlkhb9i5f4c1via1rdqfbhwgkj86s6cnxrg7";
+        sha256 = "00jshqa0nkwj06bfq16p359ss6nl6h49s31hag79wl9gwkca38va";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index a15425ec213..c9a9b55c31e 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -12,8 +12,8 @@ python27Packages.buildPythonApplication rec {
   };
 
   patches = (fetchpatch {
-    url = https://github.com/eggnogdb/eggnog-mapper/pull/125/commits/b7828e4c8c1c453e391aef050f06ff3f84ff9faf.patch;
-    sha256 = "0nz1a7ybm4j5c7vdm3annnxz9036iam2044hia341a0am9wydmzk";
+    url = "https://github.com/eggnogdb/eggnog-mapper/commit/6972f601ade85b65090efca747d2302acb58507f.patch";
+    sha256 = "0abnmn0bh11jihf5d3cggiild1ykawzv5f5fhb4cyyi8fvy4hcxf";
   });
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/logic/symbiyosys/default.nix b/pkgs/applications/science/logic/symbiyosys/default.nix
index f58c820d22b..8ba77159693 100644
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, yosys, python3 }:
+{ stdenv, fetchFromGitHub, yosys, bash, python3 }:
 
 stdenv.mkDerivation rec {
   name = "symbiyosys-${version}";
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/sby \
       --replace "##yosys-sys-path##" \
                 "sys.path += [p + \"/share/yosys/python3/\" for p in [\"$out\", \"${yosys}\"]]"
+    substituteInPlace $out/share/yosys/python3/sby_core.py \
+      --replace "/bin/bash" \
+                "${bash}/bin/bash"
   '';
   meta = {
     description = "Tooling for Yosys-based verification flows";
diff --git a/pkgs/applications/science/math/cbc/default.nix b/pkgs/applications/science/math/cbc/default.nix
index 93aefbca216..d0857e2a517 100644
--- a/pkgs/applications/science/math/cbc/default.nix
+++ b/pkgs/applications/science/math/cbc/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, zlib, bzip2 }:
 
-stdenv.mkDerivation {
-  name = "cbc-2.9.9";
+stdenv.mkDerivation rec {
+  pname = "cbc";
+  version = "2.10.2";
 
   src = fetchurl {
-    url = "https://www.coin-or.org/download/source/Cbc/Cbc-2.9.9.tgz";
-    sha256 = "1w8axdzm05xf5y13c31w7rc5z6ywxqxiwafnxcq3p195kgj0915a";
+    url = "https://www.coin-or.org/download/source/Cbc/Cbc-${version}.tgz";
+    sha256 = "0frbxkh6nbh46kaxsx5bmzridgip3v7aq75l8yak5npiiq4jlwv3";
   };
 
   configureFlags = [ "-C" ];
@@ -23,6 +24,7 @@ stdenv.mkDerivation {
     license = lib.licenses.epl10;
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    broken = stdenv.isAarch64; # Missing <immintrin.h> after 2.10.0
     description = "A mixed integer programming solver";
   };
 }
diff --git a/pkgs/applications/science/math/pynac/default.nix b/pkgs/applications/science/math/pynac/default.nix
index f05700b1bd8..75a46bb182a 100644
--- a/pkgs/applications/science/math/pynac/default.nix
+++ b/pkgs/applications/science/math/pynac/default.nix
@@ -9,14 +9,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.24";
+  version = "0.7.25";
   pname = "pynac";
 
   src = fetchFromGitHub {
     owner = "pynac";
     repo = "pynac";
     rev = "pynac-${version}";
-    sha256 = "0i3qxww28576jim0abgkqy9mi2k0lfllgyx8xpfqsqb75ai970ik";
+    sha256 = "0nnifvg6kzx0lq6gz7znind8g30v3d2pjfwgsdiks3vv9kv9nbj3";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index fd50febb469..c9fd33312d7 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -1,41 +1,42 @@
-{stdenv, fetchgit, mercurial, makeWrapper, subversion}:
+{stdenv, fetchgit, mercurial, makeWrapper}:
 
-with stdenv.lib;
-stdenv.mkDerivation {
-  name = "fast-export";
+stdenv.mkDerivation rec {
+  pname = "fast-export";
+  version = "190107";
 
   src = fetchgit {
     url = git://repo.or.cz/fast-export.git;
-    rev = "d202200fd9daa75cdb37d4cf067d4ca00e269535";
-    sha256 = "0m4llsg9rx4sza1kf39kxsdvhi6y87a18wm5k19c5r2h3vpylwcc";
+    rev = "v${version}";
+    sha256 = "14azfps9jd5anivcvfwflgsvqdyy6gm9jy284kzx2ng9f7871d14";
   };
 
-  buildInputs = [mercurial.python mercurial makeWrapper subversion];
+  buildInputs = [mercurial.python mercurial makeWrapper];
 
-  dontBuild = true; # skip svn for now
-
-  # TODO also support svn stuff
-  # moving .py files into lib directory so that you can't pick the wrong file from PATH.
-  # This requires redefining ROOT
   installPhase = ''
-    sed -i "s@/usr/bin/env.*@$(type -p python)@" *.py
-    l=$out/libexec/git-fast-export
-    mkdir -p $out/{bin,doc/git-fast-export} $l
-    sed -i "s@ROOT=.*@ROOT=$l@" *.sh
-    mv *.sh $out/bin
-    mv *.py $l
-    for p in $out/bin/*.sh; do
-      wrapProgram $p \
-        --prefix PYTHONPATH : "$(echo ${mercurial}/lib/python*/site-packages):$(echo ${mercurial.python}/lib/python*/site-packages)${stdenv.lib.concatMapStrings (x: ":$(echo ${x}/lib/python*/site-packages)") mercurial.pythonPackages or []}" \
-        --prefix PATH : "$(dirname $(type -p python))":$l
+    binPath=$out/bin
+    libexecPath=$out/libexec/${pname}
+    sitepackagesPath=$out/${mercurial.python.sitePackages}
+    mkdir -p $binPath $libexecPath $sitepackagesPath
+
+    # Patch shell scripts so they can execute the Python scripts
+    sed -i "s|ROOT=.*|ROOT=$libexecPath|" *.sh
+
+    mv hg-fast-export.sh hg-reset.sh $binPath
+    mv hg-fast-export.py hg-reset.py $libexecPath
+    mv hg2git.py pluginloader plugins $sitepackagesPath
+
+    for script in $out/bin/*.sh; do
+      wrapProgram $script \
+        --prefix PATH : "${mercurial.python}/bin":$libexec \
+        --prefix PYTHONPATH : "${mercurial}/${mercurial.python.sitePackages}":$sitepackagesPath
     done
   '';
 
-  meta = {
-    description = "Import svn, mercurial into git";
+  meta = with stdenv.lib; {
+    description = "Import mercurial into git";
     homepage = https://repo.or.cz/w/fast-export.git;
     license = licenses.gpl2;
     maintainers = [ maintainers.koral ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
index 2163855d00e..6a39f1fe3d1 100644
--- a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, git, gnupg1compat, makeWrapper, openssl, stdenv }:
+{ fetchFromGitHub, git, gnupg, makeWrapper, openssl, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "git-crypt-${version}";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     make install PREFIX=$out
-    wrapProgram $out/bin/* --prefix PATH : $out/bin:${git}/bin:${gnupg1compat}/bin
+    wrapProgram $out/bin/* --prefix PATH : $out/bin:${git}/bin:${gnupg}/bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
index 5a5b666b7cd..d1dce046979 100644
--- a/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, docutils, makeWrapper
-, gnupg1compat, curl, rsync, coreutils
+, gnupg, curl, rsync, coreutils
 , gawk, gnused, gnugrep
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     prefix="$out" ./install.sh
     wrapProgram "$out/bin/git-remote-gcrypt" \
-      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg1compat curl rsync coreutils
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg curl rsync coreutils
                                                     gawk gnused gnugrep ]}"
   '';
 
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 0ee188cc19d..34c367b20a4 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, qmake, qtbase, qttools, subversion, apr }:
 
 let
-  version = "1.0.13";
+  version = "1.0.16";
 in
 stdenv.mkDerivation {
   name = "svn-all-fast-export-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     owner = "svn-all-fast-export";
     repo = "svn2git";
     rev = version;
-    sha256 = "0f1qj0c4cdq46mz54wcy17g7rq1fy2q0bq3sswhr7r5a2s433x4f";
+    sha256 = "1xs3gngjkna458liaqjsc8ryld03mdmvycnkzwsgyzfxsgjx1i3l";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/version-management/src/default.nix b/pkgs/applications/version-management/src/default.nix
index 20d3922138b..e41d40beb59 100644
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@@ -2,20 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "0n9j2mywbm8c7mc5b3m7dvn6gff88wwwaygk4y1jivpg1f6s3k3l";
+    sha256 = "0qd10w8fwbrgaj8sx49q6cfhqq3ylhwn7nl9v6kxi1yjlw2p098p";
   };
 
-  buildInputs = [ python rcs git makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python rcs git ];
 
   preConfigure = ''
     patchShebangs .
   '';
 
-  makeFlags = [ "prefix=$(out)" ];
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   postInstall = ''
     wrapProgram $out/bin/src \
@@ -32,8 +33,9 @@ stdenv.mkDerivation rec {
       will seem familiar to Subversion/Git/hg users, and no binary blobs
       anywhere.
     '';
-    homepage = http://www.catb.org/esr/src/;
-    license = licenses.bsd3;
+    homepage = "http://www.catb.org/esr/src/";
+    changelog = "https://gitlab.com/esr/src/raw/${version}/NEWS";
+    license = licenses.bsd2;
     platforms = platforms.all;
     maintainers = with maintainers; [ calvertvl AndersonTorres ];
   };
diff --git a/pkgs/applications/video/mkclean/default.nix b/pkgs/applications/video/mkclean/default.nix
new file mode 100644
index 00000000000..4a3cbc81b35
--- /dev/null
+++ b/pkgs/applications/video/mkclean/default.nix
@@ -0,0 +1,37 @@
+{ dos2unix, fetchurl, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "mkclean";
+  version = "0.8.10";
+
+  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ dos2unix ];
+
+  src = fetchurl {
+    url = "mirror://sourceforge/matroska/${pname}-${version}.tar.bz2";
+    sha256 = "0zbpi4sm68zb20d53kbss93fv4aafhcmz7dsd0zdf01vj1r3wxwn";
+  };
+
+  configurePhase = ''
+    dos2unix ./mkclean/configure.compiled
+    ./mkclean/configure.compiled
+  '';
+
+  buildPhase = ''
+    make -C mkclean
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,lib}
+    mv release/gcc_linux_*/*.* $out/lib
+    mv release/gcc_linux_*/* $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "mkclean is a command line tool to clean and optimize Matroska (.mkv / .mka / .mks / .mk3d) and WebM (.webm / .weba) files that have already been muxed.";
+    homepage = "https://www.matroska.org";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ chrisaw ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/virtualization/rkt/default.nix b/pkgs/applications/virtualization/rkt/default.nix
index 42aad06d0c0..0f53ede188c 100644
--- a/pkgs/applications/virtualization/rkt/default.nix
+++ b/pkgs/applications/virtualization/rkt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, autoreconfHook, acl, go, file, git, wget, gnupg1, trousers, squashfsTools,
+{ stdenv, lib, autoreconfHook, acl, go, file, git, wget, gnupg, trousers, squashfsTools,
   cpio, fetchurl, fetchFromGitHub, iptables, systemd, makeWrapper, glibc }:
 
 let
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [
     glibc.out glibc.static
-    autoreconfHook go file git wget gnupg1 trousers squashfsTools cpio acl systemd
+    autoreconfHook go file git wget gnupg trousers squashfsTools cpio acl systemd
     makeWrapper
   ];
 
diff --git a/pkgs/applications/window-managers/i3/wk-switch.nix b/pkgs/applications/window-managers/i3/wk-switch.nix
index 39bd62cd5aa..5b1cdbe05f5 100644
--- a/pkgs/applications/window-managers/i3/wk-switch.nix
+++ b/pkgs/applications/window-managers/i3/wk-switch.nix
@@ -1,18 +1,17 @@
-{ stdenv, fetchFromGitHub, python2Packages }:
+{ stdenv, fetchFromGitHub, python3Packages }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "i3-wk-switch";
-  version = "2017-08-21";
+  version = "2019-05-10";
 
-  # https://github.com/tmfink/i3-wk-switch/commit/484f840bc4c28ddc60fa3be81e2098f7689e78fb
   src = fetchFromGitHub {
     owner = "tmfink";
     repo = pname;
-    rev = "484f840";
-    sha256 = "0nrc13ld5bx07wrgnpzgpbaixb4rpi93xiapvyb8srd49fj9pcmb";
+    rev = "05a2d5d35e9841d2a26630f1866fc0a0e8e708eb";
+    sha256 = "0ln192abdqrrs7rdazp9acbji2y6pf68z2d1by4nf2q529dh24dc";
   };
 
-  propagatedBuildInputs = with python2Packages; [ i3-py ];
+  propagatedBuildInputs = with python3Packages; [ i3ipc ];
 
   dontBuild = true;
   doCheck = false;
@@ -23,7 +22,7 @@ python2Packages.buildPythonApplication rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "XMonad-like workspace switching for i3";
+    description = "XMonad-like workspace switching for i3 and sway";
     maintainers = with maintainers; [ synthetica ];
     platforms = platforms.linux;
     license = licenses.mit;
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 11945e7b6f7..57e40069003 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -216,7 +216,7 @@ rec {
         find image/$extractionID/layer -name ".wh.*" -exec bash -c 'name="$(basename {}|sed "s/^.wh.//")"; mknod "$(dirname {})/$name" c 0 0; rm {}' \;
 
         # Get the next lower directory and continue the loop.
-        lowerdir=$lowerdir''${lowerdir:+:}image/$extractionID/layer
+        lowerdir=image/$extractionID/layer''${lowerdir:+:}$lowerdir
       done
 
       mkdir work
@@ -585,9 +585,9 @@ rec {
           layerID=$(sha256sum "$layer/json" | cut -d ' ' -f 1)
           ln -s "$layer" "./image/$layerID"
 
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerID/layer.tar\"] + .")
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${configJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerID/layer.tar\"]")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${configJson})\"}]")
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
         done
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
         echo "$imageJson" > "image/$imageJsonChecksum.json"
@@ -779,23 +779,24 @@ rec {
         # Use the temp folder we've been working on to create a new image.
         mv temp image/$layerID
 
-        # Add the new layer ID to the beginning of the layer list
+        # Add the new layer ID to the end of the layer list
         (
+          cat layer-list
           # originally this used `sed -i "1i$layerID" layer-list`, but
           # would fail if layer-list was completely empty.
           echo "$layerID/layer.tar"
-          cat layer-list
         ) | ${pkgs.moreutils}/bin/sponge layer-list
 
         # Create image json and image manifest
         imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")
         manifestJson=$(jq -n "[{\"RepoTags\":[\"$imageName:$imageTag\"]}]")
 
-        for layerTar in $(tac ./layer-list); do
+        for layerTar in $(cat ./layer-list); do
           layerChecksum=$(sha256sum image/$layerTar | cut -d ' ' -f1)
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${baseJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerTar\"] + .")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${baseJson})\"}]")
+          # diff_ids order is from the bottom-most to top-most layer
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerTar\"]")
         done
 
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 557a4dbf54b..ac21be907b8 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -187,4 +187,43 @@ rec {
     runAsRoot = "touch /example-file";
     fromImage = bash;
   };
+
+  # 13. example of 3 layers images This image is used to verify the
+  # order of layers is correct.
+  # It allows to validate
+  # - the layer of parent are below
+  # - the order of parent layer is preserved at image build time
+  #   (this is why there are 3 images)
+  layersOrder = let
+    l1 = pkgs.dockerTools.buildImage {
+      name = "l1";
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer1 > tmp/layer1
+        echo layer1 > tmp/layer2
+        echo layer1 > tmp/layer3
+      '';
+    };
+    l2 = pkgs.dockerTools.buildImage {
+      name = "l2";
+      fromImage = l1;
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer2 > tmp/layer2
+        echo layer2 > tmp/layer3
+      '';
+    };
+  in pkgs.dockerTools.buildImage {
+    name = "l3";
+    fromImage = l2;
+    tag = "latest";
+    contents = [ pkgs.coreutils ];
+    extraCommands = ''
+      mkdir -p tmp
+      echo layer3 > tmp/layer3
+    '';
+  };
+
 }
diff --git a/pkgs/data/fonts/agave/default.nix b/pkgs/data/fonts/agave/default.nix
index eb18f620a2a..b9417256867 100644
--- a/pkgs/data/fonts/agave/default.nix
+++ b/pkgs/data/fonts/agave/default.nix
@@ -1,24 +1,21 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
-stdenv.mkDerivation rec {
+let
   pname = "agave";
   version = "009";
+in fetchurl {
+  name = "${pname}-${version}";
+  url = "https://github.com/agarick/agave/releases/download/v${version}/agave-r.ttf";
 
-  src = fetchurl {
-    url = "https://github.com/agarick/agave/releases/download/v${version}/agave-r.ttf";
-    sha256 = "05766gp2glm1p2vknk1nncxigq28hg8s58kjwsbn8zpwy8ivywpk";
-  };
-
-  sourceRoot = ".";
-
-  unpackPhase = ":";
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp $src $out/share/fonts/truetype/
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    install -D $downloadedFile $out/share/fonts/truetype/agave-r.ttf
   '';
 
-  meta = with stdenv.lib; {
+  sha256 = "16qvz3zpwiq2nw0gxygva5pssswcia5xp0q6ir5jfkackvqf3fql";
+
+  meta = with lib; {
     description = "truetype monospaced typeface designed for X environments";
     homepage = https://b.agaric.net/page/agave;
     license = licenses.mit;
diff --git a/pkgs/data/fonts/aileron/default.nix b/pkgs/data/fonts/aileron/default.nix
index 52a96f16db0..ee85ee59882 100644
--- a/pkgs/data/fonts/aileron/default.nix
+++ b/pkgs/data/fonts/aileron/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A helvetica font in nine weights";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/andagii/default.nix b/pkgs/data/fonts/andagii/default.nix
index ba0bab61eec..0f20b9c46cf 100644
--- a/pkgs/data/fonts/andagii/default.nix
+++ b/pkgs/data/fonts/andagii/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0.2";
@@ -17,7 +17,7 @@ in fetchzip {
   # There are multiple claims that the font is GPL, so I include the
   # package; but I cannot find the original source, so use it on your
   # own risk Debian claims it is GPL - good enough for me.
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.i18nguy.com/unicode/unicode-font.html;
     description = "Unicode Plane 1 Osmanya script font";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/andika/default.nix b/pkgs/data/fonts/andika/default.nix
index 4b6965563a3..e03a800b3ad 100644
--- a/pkgs/data/fonts/andika/default.nix
+++ b/pkgs/data/fonts/andika/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "1jy9vpcprpd1k48p20wh6jhyn909ibia8lr5i747p41l0s8a7lqy";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/andika;
       description = "A family designed especially for literacy use taking into account the needs of beginning readers";
       longDescription = ''
diff --git a/pkgs/data/fonts/ankacoder/condensed.nix b/pkgs/data/fonts/ankacoder/condensed.nix
index 08a46628e65..53f4d94b38f 100644
--- a/pkgs/data/fonts/ankacoder/condensed.nix
+++ b/pkgs/data/fonts/ankacoder/condensed.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "1.100"; in
 fetchzip rec {
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "0i80zpr2y9368rg2i6x8jv0g7d03kdyr5h7w9yz7pjd7i9xd8439";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Anka/Coder Condensed font";
     homepage = https://code.google.com/archive/p/anka-coder-fonts;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ankacoder/default.nix b/pkgs/data/fonts/ankacoder/default.nix
index 170c8cde514..52e2d4a4233 100644
--- a/pkgs/data/fonts/ankacoder/default.nix
+++ b/pkgs/data/fonts/ankacoder/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "1.100"; in
 fetchzip rec {
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "1jqx9micfmiarqh9xp330gl96v3vxbwzz9cmg2vi845n9md4im85";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Anka/Coder fonts";
     homepage = https://code.google.com/archive/p/anka-coder-fonts;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/anonymous-pro/default.nix b/pkgs/data/fonts/anonymous-pro/default.nix
index 3ac2c943299..4aeda64377e 100644
--- a/pkgs/data/fonts/anonymous-pro/default.nix
+++ b/pkgs/data/fonts/anonymous-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.002";
@@ -13,7 +13,7 @@ in fetchzip rec {
   '';
   sha256 = "05rgzag38qc77b31sm5i2vwwrxbrvwzfsqh3slv11skx36pz337f";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.marksimonson.com/fonts/view/anonymous-pro;
     description = "TrueType font set intended for source code";
     longDescription = ''
diff --git a/pkgs/data/fonts/arkpandora/default.nix b/pkgs/data/fonts/arkpandora/default.nix
index 909985d945b..26c4530ac0e 100644
--- a/pkgs/data/fonts/arkpandora/default.nix
+++ b/pkgs/data/fonts/arkpandora/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
 let
   version = "2.04";
@@ -21,6 +21,5 @@ in fetchurl {
 
   meta = {
     description = "Font, metrically identical to Arial and Times New Roman";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/arphic/default.nix b/pkgs/data/fonts/arphic/default.nix
index 37d9a199567..1e52ea301af 100644
--- a/pkgs/data/fonts/arphic/default.nix
+++ b/pkgs/data/fonts/arphic/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, mkfontscale, mkfontdir }:
+{ lib, fetchzip, mkfontscale, mkfontdir }:
 
 let
   version = "0.2.20080216.2";
@@ -18,7 +18,7 @@ in {
 
     sha256 = "0xi5ycm7ydzpn7cqxv1kcj9vd70nr9wn8v27hmibyjc25y2qdmzl";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "CJK Unicode font Kai style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;
 
@@ -43,7 +43,7 @@ in {
 
     sha256 = "16jybvj1cxamm682caj6nsm6l5c60x9mgchp1l2izrw2rvc8x38d";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "CJK Unicode font Ming style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;
 
diff --git a/pkgs/data/fonts/aurulent-sans/default.nix b/pkgs/data/fonts/aurulent-sans/default.nix
index 1a83ce17646..a87be94acd0 100644
--- a/pkgs/data/fonts/aurulent-sans/default.nix
+++ b/pkgs/data/fonts/aurulent-sans/default.nix
@@ -1,12 +1,13 @@
-{stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "aurulent-sans-0.1";
-
-  url = "https://github.com/deepfire/hartke-aurulent-sans/archive/${name}.zip";
+  owner = "deepfire";
+  repo = "hartke-aurulent-sans";
+  rev = name;
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    tar xf $downloadedFile -C $out/share/fonts --strip=1
   '';
   sha256 = "1l60psfv9x0x9qx9vp1qnhmck7a7kks385m5ycrd3d91irz1j5li";
 
@@ -14,8 +15,8 @@ fetchzip rec {
     description = "Aurulent Sans";
     longDescription = "Aurulent Sans is a humanist sans serif intended to be used as an interface font.";
     homepage = http://delubrum.org/;
-    maintainers = with stdenv.lib.maintainers; [ deepfire ];
-    license = stdenv.lib.licenses.ofl;
-    platforms = stdenv.lib.platforms.all;
+    maintainers = with lib.maintainers; [ deepfire ];
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/b612/default.nix b/pkgs/data/fonts/b612/default.nix
index 2f583e2fc4b..1c2d7f53bad 100644
--- a/pkgs/data/fonts/b612/default.nix
+++ b/pkgs/data/fonts/b612/default.nix
@@ -1,20 +1,21 @@
-{ stdenv, fetchzip, lib }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "1.008";
   pname = "b612";
-in
-
-fetchzip rec {
+in fetchFromGitHub {
   name = "${pname}-font-${version}";
-  url = "https://github.com/polarsys/b612/archive/${version}.zip";
-  sha256 = "0r3lana1q9w3siv8czb3p9rrb5d9svp628yfbvvmnj7qvjrmfsiq";
+  owner = "polarsys";
+  repo = "b612";
+  rev = version;
   postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype/${pname}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/${pname}
+    cp fonts/ttf/*.ttf $out/share/fonts/truetype/${pname}
   '';
+  sha256 = "0r3lana1q9w3siv8czb3p9rrb5d9svp628yfbvvmnj7qvjrmfsiq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://b612-font.com/;
     description = "Highly legible font family for use on aircraft cockpit screens";
     longDescription = ''
diff --git a/pkgs/data/fonts/babelstone-han/default.nix b/pkgs/data/fonts/babelstone-han/default.nix
index 67080e73c46..5408e7b1b1d 100644
--- a/pkgs/data/fonts/babelstone-han/default.nix
+++ b/pkgs/data/fonts/babelstone-han/default.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
-  version = "11.0.3";
+  version = "12.1.4";
 in fetchzip {
   name = "babelstone-han-${version}";
 
@@ -10,9 +10,9 @@ in fetchzip {
     mkdir -p $out/share/fonts/truetype
     unzip $downloadedFile '*.ttf' -d $out/share/fonts/truetype
   '';
-  sha256 = "0c8s21kllyilwivrb8gywq818y67w3zpann34hz36vy0wyiswn1c";
+  sha256 = "1fypwk2i87jfrckvxg9wz4x84z7c6ifgzrjb8fylhac50lzi6kni";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Unicode CJK font with over 36000 Han characters";
     homepage = http://www.babelstone.co.uk/Fonts/Han.html;
 
diff --git a/pkgs/data/fonts/baekmuk-ttf/default.nix b/pkgs/data/fonts/baekmuk-ttf/default.nix
index 555bba63354..b11a0a4f0f0 100644
--- a/pkgs/data/fonts/baekmuk-ttf/default.nix
+++ b/pkgs/data/fonts/baekmuk-ttf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "baekmuk-ttf-2.2";
@@ -6,9 +6,8 @@ fetchzip rec {
   url = "http://kldp.net/baekmuk/release/865-${name}.tar.gz";
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
-    mkdir -p $out/share/fonts $out/share/doc/${name}
-    cp ttf/*.ttf  $out/share/fonts
-    cp COPYRIGHT* $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts        ttf/*.ttf
+    install -m444 -Dt $out/share/doc/${name}  COPYRIGHT*
   '';
   sha256 = "1jgsvack1l14q8lbcv4qhgbswi30mf045k37rl772hzcmx0r206g";
 
@@ -16,7 +15,6 @@ fetchzip rec {
     description = "Korean font";
     homepage = http://kldp.net/projects/baekmuk/;
     license = "BSD-like";
-    platforms = stdenv.lib.platforms.linux;
   };
 }
 
diff --git a/pkgs/data/fonts/bakoma-ttf/default.nix b/pkgs/data/fonts/bakoma-ttf/default.nix
index 8d87154c1df..53ebba41fd5 100644
--- a/pkgs/data/fonts/bakoma-ttf/default.nix
+++ b/pkgs/data/fonts/bakoma-ttf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "bakoma-ttf";
@@ -16,6 +16,5 @@ fetchzip {
   meta = {
     description = "TrueType versions of the Computer Modern and AMS TeX Fonts";
     homepage = http://www.ctan.org/tex-archive/fonts/cm/ps-type1/bakoma/ttf/;
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/behdad-fonts/default.nix b/pkgs/data/fonts/behdad-fonts/default.nix
index 54ddc95bf6c..8b4228ec423 100644
--- a/pkgs/data/fonts/behdad-fonts/default.nix
+++ b/pkgs/data/fonts/behdad-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "behdad-fonts";
   version = "0.0.3";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "font-store";
+  repo = "BehdadFont";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "font-store";
-    repo = "BehdadFont";
-    rev = "v${version}";
-    sha256 = "0rlmyv82qmyy90zvkjnlva44ia7dyhiyk7axbq526v7zip3g79w0";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/behdad-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/behdad-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/behrad-fonts {} \;
   '';
+  sha256 = "0c57232462cv1jrfn0m2bl7jzcfkacirrdd2qimrc8iqhkz0ajfz";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/font-store/BehdadFont;
     description = "A Persian/Arabic Open Source Font";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/cabin/default.nix b/pkgs/data/fonts/cabin/default.nix
index 5bf4d454b06..0a8168cdf9e 100644
--- a/pkgs/data/fonts/cabin/default.nix
+++ b/pkgs/data/fonts/cabin/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "cabin-1.005";
 
-  url = https://github.com/impallari/Cabin/archive/982839c790e9dc57c343972aa34c51ed3b3677fd.zip;
+  owner = "impallari";
+  repo = "Cabin";
+  rev = "982839c790e9dc57c343972aa34c51ed3b3677fd";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype fonts/OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "1ax5c2iab48qsk9zn3gjvqaib2lnlm25f1wr0aysf5ngw0y0jkrd";
+  sha256 = "1bl7h217m695jn4rbniialfk573aa44fslp2rjxnhkicakpcm44h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A humanist sans with 4 weights and true italics";
     longDescription = ''
       The Cabin font family is a humanist sans with 4 weights and true italics,
diff --git a/pkgs/data/fonts/caladea/default.nix b/pkgs/data/fonts/caladea/default.nix
index 56d8273f78a..29bd001f808 100644
--- a/pkgs/data/fonts/caladea/default.nix
+++ b/pkgs/data/fonts/caladea/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "20130214";
@@ -15,7 +15,7 @@ in fetchzip rec {
   '';
   sha256 = "0kwm42ggr8kvcn3554cpmv90xzam1sdncx7x3zs3bzp88mxrnv1z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
     homepage = http://openfontlibrary.org/en/font/caladea;
diff --git a/pkgs/data/fonts/camingo-code/default.nix b/pkgs/data/fonts/camingo-code/default.nix
index dfdf367337c..98175373ebd 100644
--- a/pkgs/data/fonts/camingo-code/default.nix
+++ b/pkgs/data/fonts/camingo-code/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -8,14 +8,12 @@ in fetchzip rec {
   url = https://github.com/chrissimpkins/codeface/releases/download/font-collection/codeface-fonts.zip;
   postFetch = ''
     unzip $downloadedFile
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/doc/${name}
-    cp -v fonts/camingo-code/*.ttf $out/share/fonts/truetype/
-    cp -v fonts/camingo-code/*.txt $out/share/doc/${name}/
+    install -m444 -Dt $out/share/fonts/truetype fonts/camingo-code/*.ttf
+    install -m444 -Dt $out/share/doc/${name}    fonts/camingo-code/*.txt
   '';
-  sha256 = "035z2k6lwwy2bysw27pirn3vjxnj2h23nyx8jr213rb2bl0m21x1";
+  sha256 = "16iqjwwa7pnswvcc4w8nglkd0m0fz50qsz96i1kcpqip3nwwvw7y";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.myfonts.com/fonts/jan-fromm/camingo-code/;
     description = "A monospaced typeface designed for source-code editors";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 2243435bc5d..3c0e314579d 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "20130920";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "0d72zy6kdmxgpi63r3yvi3jh1hb7lvlgv8hgd4ag0x10dz18mbzv";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
     homepage = http://openfontlibrary.org/en/font/carlito;
diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 995e03372fb..e28a718fad1 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "1a220s8n0flvcdkazqf5g10v6r55s2an308slvvarynpj6l7x27n";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/charis;
       description = "A family of highly readable fonts for broad multilingual use";
       longDescription = ''
diff --git a/pkgs/data/fonts/clearlyU/default.nix b/pkgs/data/fonts/clearlyU/default.nix
index 5dc8e53282a..0df3ba4f659 100644
--- a/pkgs/data/fonts/clearlyU/default.nix
+++ b/pkgs/data/fonts/clearlyU/default.nix
@@ -7,18 +7,17 @@ stdenv.mkDerivation {
     url = https://www.math.nmsu.edu/~mleisher/Software/cu/cu12-1.9.tgz;
     sha256 = "1xn14jbv3m1khy7ydvad9ydkn7yygdbhjy9wm1v000jzjwr3lv21";
   };
-  
+
   nativeBuildInputs = [ mkfontdir mkfontscale ];
 
-  installPhase =
-    ''
-      mkdir -p $out/share/fonts
-      cp *.bdf $out/share/fonts
-      cd $out/share/fonts
-      mkfontdir 
-      mkfontscale
-    '';
-  
+  installPhase = ''
+    mkdir -p $out/share/fonts
+    cp *.bdf $out/share/fonts
+    cd $out/share/fonts
+    mkfontdir
+    mkfontscale
+  '';
+
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = "127zrg65s90ksj99kr9hxny40rbxvpai62mf5nqk853hcd1bzpr6";
@@ -26,6 +25,5 @@ stdenv.mkDerivation {
   meta = {
     description = "A Unicode font";
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/cm-unicode/default.nix b/pkgs/data/fonts/cm-unicode/default.nix
index d17021feb81..c058f07ed51 100644
--- a/pkgs/data/fonts/cm-unicode/default.nix
+++ b/pkgs/data/fonts/cm-unicode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.7.0";
@@ -9,15 +9,13 @@ in fetchzip rec {
 
   postFetch = ''
     tar -xJvf $downloadedFile --strip-components=1
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v *.otf $out/share/fonts/opentype/
-    cp -v README FontLog.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    README FontLog.txt
   '';
 
   sha256 = "1rzz7yhqq3lljyqxbg46jfzfd09qgpgx865lijr4sgc94riy1ypn";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://canopus.iacp.dvo.ru/~panov/cm-unicode/;
     description = "Computer Modern Unicode fonts";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/comfortaa/default.nix b/pkgs/data/fonts/comfortaa/default.nix
index f7ec6e8b8c8..6e4c0bb08e7 100644
--- a/pkgs/data/fonts/comfortaa/default.nix
+++ b/pkgs/data/fonts/comfortaa/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "3.001";
@@ -8,13 +8,12 @@ in fetchzip rec {
   url = "https://orig00.deviantart.net/40a3/f/2017/093/d/4/comfortaa___font_by_aajohan-d1qr019.zip";
   postFetch = ''
     mkdir -p $out/share/fonts $out/share/doc
-    unzip -l $downloadedFile
     unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
     unzip -j $downloadedFile \*/FONTLOG.txt \*/donate.html -d $out/share/doc/${name}
   '';
   sha256 = "0z7xr0cnn6ghwivrm5b5awq9bzhnay3y99qq6dkdgfkfdsaz0n9h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://aajohan.deviantart.com/art/Comfortaa-font-105395949;
     description = "A clean and modern font suitable for headings and logos";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/comic-neue/default.nix b/pkgs/data/fonts/comic-neue/default.nix
index 07fc172ca51..2615d0260f0 100644
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.2";
@@ -19,7 +19,7 @@ in fetchzip rec {
 
   sha256 = "1yypq5aqqzv3q1c6vx5130mi2iwihzzvrawhwqpwsfjl0p25sq9q";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://comicneue.com/;
     description = "A casual type face: Make your lemonade stand look like a fortune 500 company";
     longDescription = ''
diff --git a/pkgs/data/fonts/comic-relief/default.nix b/pkgs/data/fonts/comic-relief/default.nix
index 2a1273214bd..d51c915b844 100644
--- a/pkgs/data/fonts/comic-relief/default.nix
+++ b/pkgs/data/fonts/comic-relief/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
@@ -18,7 +18,7 @@ in fetchzip rec {
 
   sha256 = "0dz0y7w6mq4hcmmxv6fn4mp6jkln9mzr4s96vsg68wrl5b7k9yff";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://loudifier.com/comic-relief/;
     description = "A font metric-compatible with Microsoft Comic Sans";
     longDescription = ''
diff --git a/pkgs/data/fonts/cooper-hewitt/default.nix b/pkgs/data/fonts/cooper-hewitt/default.nix
index 1fa5cff7604..e1635c560d6 100644
--- a/pkgs/data/fonts/cooper-hewitt/default.nix
+++ b/pkgs/data/fonts/cooper-hewitt/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-fetchzip rec {
+fetchzip {
   name = "cooper-hewitt-2014-06-09";
 
   url = https://www.cooperhewitt.org/wp-content/uploads/fonts/CooperHewitt-OTF-public.zip;
@@ -12,7 +12,7 @@ fetchzip rec {
 
   sha256 = "01iwqmjvqkc6fmc2r0486vk06s6f51n9wxzl1pf9z48n0igj4gqd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.cooperhewitt.org/open-source-at-cooper-hewitt/cooper-hewitt-the-typeface-by-chester-jenkins/;
     description = "A contemporary sans serif, with characters composed of modified-geometric curves and arches";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/corefonts/default.nix b/pkgs/data/fonts/corefonts/default.nix
index 8c45c813953..5e06a34b6f0 100644
--- a/pkgs/data/fonts/corefonts/default.nix
+++ b/pkgs/data/fonts/corefonts/default.nix
@@ -41,12 +41,10 @@ stdenv.mkDerivation {
 
     cabextract --lowercase viewer1.cab
 
-    fontDir=$out/share/fonts/truetype
-    mkdir -p $fontDir
-    cp *.ttf $fontDir
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
 
     # Also put the EULA there to be on the safe side.
-    cp ${eula} $fontDir/eula.html
+    cp ${eula} $out/share/fonts/truetype/eula.html
 
     # Set up no-op font configs to override any aliases set up by
     # other packages.
diff --git a/pkgs/data/fonts/crimson/default.nix b/pkgs/data/fonts/crimson/default.nix
index e96c13b7822..a3f24985fd9 100644
--- a/pkgs/data/fonts/crimson/default.nix
+++ b/pkgs/data/fonts/crimson/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2014.10";
@@ -9,16 +9,13 @@ in fetchzip rec {
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
-
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v "Desktop Fonts/OTF/"*.otf $out/share/fonts/opentype
-    cp -v README.md $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/opentype "Desktop Fonts/OTF/"*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md
   '';
 
   sha256 = "0mg65f0ydyfmb43jqr1f34njpd10w8npw15cbb7z0nxmy4nkl842";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://aldusleaf.org/crimson.html;
     description = "A font family inspired by beautiful oldstyle typefaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/culmus/default.nix b/pkgs/data/fonts/culmus/default.nix
index 4ef5a444558..5aad7ff236f 100644
--- a/pkgs/data/fonts/culmus/default.nix
+++ b/pkgs/data/fonts/culmus/default.nix
@@ -1,16 +1,12 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.133";
-in stdenv.mkDerivation {
+in fetchzip {
   name = "culmus-${version}";
-
-  src = fetchzip {
-    url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
-    sha256 = "0q80j3vixn364sc23hcy6098rkgy0kb4p91lky6224am1dwn2qmr";
-  };
-
-  installPhase = ''
+  url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{truetype,type1}
     cp -v *.pfa $out/share/fonts/type1/
     cp -v *.afm $out/share/fonts/type1/
@@ -19,12 +15,13 @@ in stdenv.mkDerivation {
     cp -v *.otf $out/share/fonts/truetype/
     cp -v fonts.scale-ttf $out/share/fonts/truetype/fonts.scale
   '';
+  sha256 = "0zqqjcrqmbd4389hqz2dwymkkcxjrq9ylyriiv3gbmzl6l1ffk3g";
 
   meta = {
     description = "Culmus Hebrew fonts";
     longDescription = "The Culmus project aims at providing the Hebrew-speaking GNU/Linux and Unix community with a basic collection of Hebrew fonts for X Windows.";
-    platforms = stdenv.lib.platforms.all;
-    license = stdenv.lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    license = lib.licenses.gpl2;
     homepage = http://culmus.sourceforge.net/;
     downloadPage = http://culmus.sourceforge.net/download.html;
   };
diff --git a/pkgs/data/fonts/d2coding/default.nix b/pkgs/data/fonts/d2coding/default.nix
index abc0dba8165..00823fe05b2 100644
--- a/pkgs/data/fonts/d2coding/default.nix
+++ b/pkgs/data/fonts/d2coding/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchzip, unzip }:
+{ lib, fetchzip, unzip }:
 
 let
   version = "1.3.2";
   pname = "d2codingfont";
 
-in fetchzip rec {
+in fetchzip {
   name = "${pname}-${version}";
   url = "https://github.com/naver/${pname}/releases/download/VER${version}/D2Coding-Ver${version}-20180524.zip";
 
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1812r82530wzfki7k9cm35fy6k2lvis7j6w0w8svc784949m1wwj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Monospace font with support for Korean and latin characters";
     longDescription = ''
       D2Coding is a monospace font developed by a Korean IT Company called Naver.
diff --git a/pkgs/data/fonts/dina-pcf/default.nix b/pkgs/data/fonts/dina-pcf/default.nix
index 975bbc1749a..27306a0ef05 100644
--- a/pkgs/data/fonts/dina-pcf/default.nix
+++ b/pkgs/data/fonts/dina-pcf/default.nix
@@ -60,6 +60,5 @@ stdenv.mkDerivation rec {
     downloadPage = https://www.donationcoder.com/Software/Jibz/Dina/;
     license = licenses.free;
     maintainers = [ maintainers.prikhi ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/dina/default.nix b/pkgs/data/fonts/dina/default.nix
index 66feaf0ff54..8638ec74f77 100644
--- a/pkgs/data/fonts/dina/default.nix
+++ b/pkgs/data/fonts/dina/default.nix
@@ -5,11 +5,13 @@ let
 in fetchzip rec {
   name = "dina-font-${version}";
 
-  url = "http://www.donationcoder.com/Software/Jibz/Dina/downloads/Dina.zip";
+  # `meta.homepage` has no direct download link
+  url = "https://github.com/ProgrammingFonts/ProgrammingFonts/archive/b15ef365146be7eef4a46979cfe157c5aeefb7c0.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.bdf -d $out/share/fonts
+    unzip -j $downloadedFile '*/Dina/*.bdf' -d $out/share/fonts
+    chmod u-x $out/share/fonts/*
   '';
 
   sha256 = "02a6hqbq18sw69npylfskriqhvj1nsk65hjjyd05nl913ycc6jl7";
@@ -25,6 +27,5 @@ in fetchzip rec {
     downloadPage = https://www.donationcoder.com/Software/Jibz/Dina/;
     license = licenses.free;
     maintainers = [ maintainers.prikhi ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/dosemu-fonts/default.nix b/pkgs/data/fonts/dosemu-fonts/default.nix
index f564507c777..4837425d19a 100644
--- a/pkgs/data/fonts/dosemu-fonts/default.nix
+++ b/pkgs/data/fonts/dosemu-fonts/default.nix
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Various fonts from the DOSEmu project";
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/dosis/default.nix b/pkgs/data/fonts/dosis/default.nix
index 01157e8b7e4..48b170e2e1b 100644
--- a/pkgs/data/fonts/dosis/default.nix
+++ b/pkgs/data/fonts/dosis/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "dosis-1.007";
 
-  url = https://github.com/impallari/Dosis/archive/12df1e13e58768f20e0d48ff15651b703f9dd9dc.zip;
+  owner = "impallari";
+  repo = "Dosis";
+  rev = "12df1e13e58768f20e0d48ff15651b703f9dd9dc";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    find . -name '*.otf' -exec install -m444 -Dt $out/share/fonts/opentype {} \;
+    install -m444 -Dt $out/share/doc/${name} README.md FONTLOG.txt
   '';
 
-  sha256 = "11a8jmgaly14l7rm3jxkwwv3ngr8fdlkp70nicjk2rg0nny2cvfq";
+  sha256 = "0vz25w45i8flfvppymr5h83pa2n1r37da20v7691p44018fdsdny";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A very simple, rounded, sans serif family";
     longDescription = ''
       Dosis is a very simple, rounded, sans serif family.
diff --git a/pkgs/data/fonts/doulos-sil/default.nix b/pkgs/data/fonts/doulos-sil/default.nix
index 324f6f63e55..59371593f79 100644
--- a/pkgs/data/fonts/doulos-sil/default.nix
+++ b/pkgs/data/fonts/doulos-sil/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "04a9cr7jbw7d8llcj8xsqp9rp8w6gcgbd9sdwvi02kz7jhqa0vad";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/doulos;
       description = "A font that provides complete support for the International Phonetic Alphabet";
       longDescription = ''
diff --git a/pkgs/data/fonts/eb-garamond/default.nix b/pkgs/data/fonts/eb-garamond/default.nix
index 53a5d9f73cc..14233268991 100644
--- a/pkgs/data/fonts/eb-garamond/default.nix
+++ b/pkgs/data/fonts/eb-garamond/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.016";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "04jq4mpln85zzbla8ybsjw7vn9qr3r0snmk5zykrm24imq7ripv3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.georgduffner.at/ebgaramond/;
     description = "Digitization of the Garamond shown on the Egenolff-Berner specimen";
     maintainers = with maintainers; [ relrod rycee ];
diff --git a/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix b/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
index d2b376f5bba..e7981f63baf 100644
--- a/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
+++ b/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.2.0";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "0ps8q9nkx67ivgn8na4s012360v36jwr0951rsg7j6dyyw9g41jq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Icon fonts for emacs all-the-icons";
     longDescription = ''
       The emacs package all-the-icons provides icons to improve
diff --git a/pkgs/data/fonts/emojione/default.nix b/pkgs/data/fonts/emojione/default.nix
index f466a5b230d..3e71352f802 100644
--- a/pkgs/data/fonts/emojione/default.nix
+++ b/pkgs/data/fonts/emojione/default.nix
@@ -29,7 +29,6 @@ stdenv.mkDerivation rec {
     description = "Open source emoji set";
     homepage = http://emojione.com/;
     license = licenses.cc-by-40;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/data/fonts/encode-sans/default.nix b/pkgs/data/fonts/encode-sans/default.nix
index 96d64e13893..787a83f9561 100644
--- a/pkgs/data/fonts/encode-sans/default.nix
+++ b/pkgs/data/fonts/encode-sans/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "encode-sans-1.002";
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "16mx894zqlwrhnp4rflgayxhxppmsj6k7haxdngajhb30rlwf08p";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A versatile sans serif font family";
     longDescription = ''
       The Encode Sans family is a versatile workhorse. Featuring a huge range of
diff --git a/pkgs/data/fonts/eunomia/default.nix b/pkgs/data/fonts/eunomia/default.nix
index 56fa718f867..55250156fcd 100644
--- a/pkgs/data/fonts/eunomia/default.nix
+++ b/pkgs/data/fonts/eunomia/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://dotcolon.net/font/eunomia/;
     description = "A futuristic decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/f5_6/default.nix b/pkgs/data/fonts/f5_6/default.nix
index 25cab717cee..28969f02364 100644
--- a/pkgs/data/fonts/f5_6/default.nix
+++ b/pkgs/data/fonts/f5_6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A weighted decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/fantasque-sans-mono/default.nix b/pkgs/data/fonts/fantasque-sans-mono/default.nix
index 7d05482ef5f..5b982dcaa3e 100644
--- a/pkgs/data/fonts/fantasque-sans-mono/default.nix
+++ b/pkgs/data/fonts/fantasque-sans-mono/default.nix
@@ -1,9 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
-
   version = "1.7.2";
-
 in
 
 fetchzip rec {
@@ -19,7 +17,7 @@ fetchzip rec {
 
   sha256 = "1fwvbqfrgb539xybwdawvwa8cg4f215kw905rgl9a6p0iwa1nxqk";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/belluzj/fantasque-sans;
     description = "A font family with a great monospaced variant for programmers";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ferrum/default.nix b/pkgs/data/fonts/ferrum/default.nix
index bbe185bd848..ec3f3218ea5 100644
--- a/pkgs/data/fonts/ferrum/default.nix
+++ b/pkgs/data/fonts/ferrum/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/data/fonts/fira/default.nix
index ce6e011d8a6..fe27ac2cd5d 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/data/fonts/fira/default.nix
@@ -1,18 +1,23 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
-  name = "fira-4.106";
+let
+  version = "4.106";
+in fetchFromGitHub {
+  name = "fira-${version}";
 
-  url = https://github.com/mozilla/Fira/archive/4.106.zip;
+  owner = "mozilla";
+  repo = "Fira";
+  rev = version;
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile Fira-4.106/otf/FiraSans\*.otf -d $out/share/fonts/opentype
+    tar xf $downloadedFile --strip=1
+    mkdir -p $out/share/fonts/opentype
+    cp otf/*.otf $out/share/fonts/opentype
   '';
 
   sha256 = "0c97nmihcq0ki7ywj8zn048a2bgrszc61lb9p0djfi65ar52jab4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://mozilla.github.io/Fira/;
     description = "Sans-serif font for Firefox OS";
     longDescription = ''
diff --git a/pkgs/data/fonts/fixedsys-excelsior/default.nix b/pkgs/data/fonts/fixedsys-excelsior/default.nix
index b0c481dfcb5..14232edee0c 100644
--- a/pkgs/data/fonts/fixedsys-excelsior/default.nix
+++ b/pkgs/data/fonts/fixedsys-excelsior/default.nix
@@ -1,33 +1,25 @@
 { stdenv, fetchurl } :
 
-let 
+let
   major = "3";
   minor = "00";
   version = "${major}.${minor}";
-
-in
-
-stdenv.mkDerivation rec {
+in fetchurl rec {
   name = "fixedsys-excelsior-${version}";
 
-  src = fetchurl {
-    url = http://www.fixedsysexcelsior.com/fonts/FSEX300.ttf;
-    sha256 = "6ee0f3573bc5e33e93b616ef6282f49bc0e227a31aa753ac76ed2e3f3d02056d";
-  };
-
-  phases = [ "installPhase" ];
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype/
-    cp $src $out/share/fonts/truetype/${name}.ttf
+  urls = [
+    http://www.fixedsysexcelsior.com/fonts/FSEX300.ttf
+    https://raw.githubusercontent.com/chrissimpkins/codeface/master/fonts/fixed-sys-excelsior/FSEX300.ttf
+    http://tarballs.nixos.org/sha256/6ee0f3573bc5e33e93b616ef6282f49bc0e227a31aa753ac76ed2e3f3d02056d
+  ];
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    install -m444 -D $downloadedFile $out/share/fonts/truetype/${name}.ttf
   '';
 
-  outputHashMode = "recursive";
-
-  outputHashAlgo = "sha256";
+  sha256 = "32d6f07f1ff08c764357f8478892b2ba5ade23427af99759f34a0ba24bcd2e37";
 
-  outputHash = "32d6f07f1ff08c764357f8478892b2ba5ade23427af99759f34a0ba24bcd2e37";
-  
   meta = {
     description = "Pan-unicode version of Fixedsys, a classic DOS font.";
     homepage = http://www.fixedsysexcelsior.com/;
diff --git a/pkgs/data/fonts/font-awesome-5/default.nix b/pkgs/data/fonts/font-awesome-5/default.nix
index 312cef61ec7..8ed30632c0a 100644
--- a/pkgs/data/fonts/font-awesome-5/default.nix
+++ b/pkgs/data/fonts/font-awesome-5/default.nix
@@ -1,20 +1,22 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "5.8.2";
-in fetchzip rec {
+in fetchFromGitHub rec {
   name = "font-awesome-${version}";
 
-  url = "https://github.com/FortAwesome/Font-Awesome/archive/${version}.zip";
+  owner = "FortAwesome";
+  repo = "Font-Awesome";
+  rev = version;
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile "Font-Awesome-${version}/otfs/*.otf" -d $out/share/fonts/opentype
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype otfs/*.otf
   '';
 
   sha256 = "1h0qhvkfyfs4579jvrk3gwc7dp4i9s46bkj406b493dvmxxhv986";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Font Awesome - OTF font";
     longDescription = ''
       Font Awesome gives you scalable vector icons that can instantly be customized.
diff --git a/pkgs/data/fonts/fontconfig-penultimate/default.nix b/pkgs/data/fonts/fontconfig-penultimate/default.nix
index e1be0da428a..601146d99a9 100644
--- a/pkgs/data/fonts/fontconfig-penultimate/default.nix
+++ b/pkgs/data/fonts/fontconfig-penultimate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip
+{ lib, fetchzip
 , version ? "0.3.5"
 , sha256 ? "1gfgl7qimp76q4z0nv55vv57yfs4kscdr329np701k0xnhncwvrk"
 }:
@@ -14,7 +14,7 @@ fetchzip {
     unzip -j $downloadedFile \*.conf -d $out/etc/fonts/conf.d
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/ttuegel/fontconfig-penultimate;
     description = "Sensible defaults for Fontconfig";
     license = licenses.asl20;
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 39118716f6f..c5e19edea26 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "freefont-ttf-20120503";
@@ -20,8 +20,8 @@ fetchzip rec {
       10646/Unicode UCS (Universal Character Set).
     '';
     homepage = https://www.gnu.org/software/freefont/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
     maintainers = [];
   };
 }
diff --git a/pkgs/data/fonts/gandom-fonts/default.nix b/pkgs/data/fonts/gandom-fonts/default.nix
index 938ff272cbd..4d925b269cd 100644
--- a/pkgs/data/fonts/gandom-fonts/default.nix
+++ b/pkgs/data/fonts/gandom-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "gandom-fonts";
   version = "0.6";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "rastikerdar";
+  repo = "gandom-font";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "gandom-font";
-    rev = "v${version}";
-    sha256 = "1pdbqhvcsz6aq3qgarhfd05ip0wmh7bxqkmxrwa0kgxsly6zxz9x";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/gandom-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/gandom-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/gandom-fonts {} \;
   '';
+  sha256 = "0zsq6s9ziyb5jz0v8aj00dlxd1aly0ibxgszd05dfvykmgz051lc";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/gandom-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی گندم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/gdouros/default.nix b/pkgs/data/fonts/gdouros/default.nix
index 359074099ba..71c92a72e59 100644
--- a/pkgs/data/fonts/gdouros/default.nix
+++ b/pkgs/data/fonts/gdouros/default.nix
@@ -1,29 +1,16 @@
-{stdenv, fetchzip, lib}:
+{ fetchzip, lib }:
 
 let
   fonts = {
-    symbola = { version = "9.17"; file = "Symbola.zip"; sha256 = "13z18lxx0py54nns61ihgxacpf1lg9s7g2sbpbnxpllqw7j73iq2";
-                description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
-    aegyptus = { version = "6.17"; file = "Aegyptus.zip"; sha256 = "19rkf89msqb076qjdfa75pqrx35c3slj64vxw08zqdvyavq7jc79";
-                 description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
-    akkadian = { version = "7.17"; file = "AkkadianAssyrian.zip"; sha256 = "1xw2flrwb5r89sk7jd195v3svsb21brf1li2i3pdjcfqxfp5m0g7";
-                 description = "Sumero-Akkadian Cuneiform"; };
-    anatolian = { version = "5.17"; file = "Anatolian.zip"; sha256 = "0dqcyjakc4fy076pjplm6psl8drpwxiwyq97xrf6a3qa098gc0qc";
-                  description = "Anatolian Hieroglyphs"; };
-    maya = { version = "4.17"; file = "Maya.zip"; sha256 = "17s5c23wpqrcq5h6pgssbmzxiv4jvhdh2ssr99j9q6j32a51h9gh";
-             description = "Maya Hieroglyphs"; };
-    unidings = { version = "9.17"; file = "Unidings.zip"; sha256 = "0nzw8mrhk0hbjnl2cgi31b00vmi785win86kiz9d2yzdfz1is6sk";
-                 description = "Glyphs and Icons for blocks of The Unicode Standard"; };
-    musica = { version = "3.17"; file = "Musica.zip"; sha256 = "0mnv61dxzs2npvxgs5l9q81q19xzzi1sn53x5qwpiirkmi6bg5y6";
-               description = "Musical Notation"; };
-    analecta = { version = "5.17"; file = "Analecta.zip"; sha256 = "13npnfscd9mz6vf89qxxbj383njf53a1smqjh0c1w2lvijgak3aj";
-                 description = "Coptic, Gothic, Deseret"; };
-    textfonts = { version = "7.17"; file = "TextfontsFonts.zip"; sha256 = "1ggflqnslp81v8pzmzx6iwi2sa38l9bpivjjci7nvx3y5xynm6wl";
-                 description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
-    aegan = { version = "9.17"; file = "AegeanFonts.zip"; sha256 = "0dm2ck3p11bc9izrh7xz3blqfqg1mgsvy4jsgmz9rcs4m74xrhsf";
-              description = "Aegean"; };
-    abydos = { version = "1.23"; file = "AbydosFont.zip"; sha256 = "04r7ysnjjq0nrr3m8lbz8ssyx6xaikqybjqxzl3ziywl9h6nxdj8";
-               description = "AbydosFont"; };
+    aegan     = { version = "10.00"; file = "Aegean.zip";       sha256 = "0k47nhzw4vx771ch3xx8mf6xx5vx0hg0cif5jdlmdaz4h2c3rawz"; description = "Aegean"; };
+    aegyptus  = { version =  "8.00"; file = "Aegyptus.zip";     sha256 = "13h2pi641k9vxgqi9l11mjya10ym9ln54wrkwxx6gxq63zy7y5mj"; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
+    akkadian  = { version =  "7.18"; file = "Akkadian.zip";     sha256 = "1bplcvszbdrk85kqipn9lzhr62647wjibz1p8crzjvsw6f9ymxy3"; description = "Sumero-Akkadian Cuneiform"; };
+    assyrian  = { version =  "2.00"; file = "AssyrianFont.zip"; sha256 = "0vdvb24vsnmwzd6bw14akqg0hbvsk8avgnbwk9fkybn1f801475k"; description = "Neo-Assyrian in Unicode with OpenType"; };
+    eemusic   = { version =  "2.00"; file = "EEMusic.zip";      sha256 = "1y9jf105a2b689m7hdjmhhr7z5j0qd2w6dmb3iic9bwaczlrjy7j"; description = "Byzantine Musical Notation in Unicode with OpenType"; };
+    maya      = { version =  "4.18"; file = "Maya.zip";         sha256 = "08z2ch0z2c43fjfg5m4yp3l1dp0cbk7lv5i7wzsr3cr9kr59wpi9"; description = "Maya Hieroglyphs"; };
+    symbola   = { version = "12.00"; file = "Symbola.zip";      sha256 = "1i3xra33xkj32vxs55xs2afrqyc822nk25669x78px5g5qd8gypm"; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
+    textfonts = { version =  "9.00"; file = "Textfonts.zip";    sha256 = "0wzxz4j4fgk81b88d58715n1wvq2mqmpjpk4g5hi3vk77y2zxc4d"; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
+    unidings  = { version =  "9.19"; file = "Unidings.zip";     sha256 = "1bybzgdqhmq75hb12n3pjrsdcpw1a6sgryx464s68jlq4zi44g78"; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
   };
 
   mkpkg = name_: {version, file, sha256, description}: fetchzip rec {
@@ -42,9 +29,8 @@ let
       # In lieu of a license:
       # Fonts in this site are offered free for any use;
       # they may be installed, embedded, opened, edited, modified, regenerated, posted, packaged and redistributed.
-      license = stdenv.lib.licenses.free;
+      license = lib.licenses.free;
       homepage = http://users.teilar.gr/~g1951d/;
-      platforms = stdenv.lib.platforms.unix;
     };
   };
 in
diff --git a/pkgs/data/fonts/gentium-book-basic/default.nix b/pkgs/data/fonts/gentium-book-basic/default.nix
index 9b626291c2c..505b273c2d2 100644
--- a/pkgs/data/fonts/gentium-book-basic/default.nix
+++ b/pkgs/data/fonts/gentium-book-basic/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   major = "1";
@@ -11,14 +11,13 @@ in fetchzip rec {
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
-    unzip -l $downloadedFile
     unzip -j $downloadedFile \*.ttf                            -d $out/share/fonts/truetype
     unzip -j $downloadedFile \*/FONTLOG.txt \*/GENTIUM-FAQ.txt -d $out/share/doc/${name}
   '';
 
   sha256 = "0598zr5f7d6ll48pbfbmmkrybhhdks9b2g3m2g67wm40070ffzmd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/gentium/;
     description = "A high-quality typeface family for Latin, Cyrillic, and Greek";
     maintainers = with maintainers; [ ];
diff --git a/pkgs/data/fonts/gentium/default.nix b/pkgs/data/fonts/gentium/default.nix
index 829eca8c06f..a60a39f4f01 100644
--- a/pkgs/data/fonts/gentium/default.nix
+++ b/pkgs/data/fonts/gentium/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "1qr2wjdmm93167b0w9cidlf3wwsyjx4838ja9jmm4jkyian5whhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/gentium/;
     description = "A high-quality typeface family for Latin, Cyrillic, and Greek";
     longDescription = ''
diff --git a/pkgs/data/fonts/go-font/default.nix b/pkgs/data/fonts/go-font/default.nix
index a0af38cfd24..bb28d3be67f 100644
--- a/pkgs/data/fonts/go-font/default.nix
+++ b/pkgs/data/fonts/go-font/default.nix
@@ -1,26 +1,22 @@
 { stdenv, fetchgit }:
 
-stdenv.mkDerivation rec {
-  name = "go-font-${version}";
+let
   version = "2017-03-30";
+in (fetchgit {
+  name = "go-font-${version}";
+  url = "https://go.googlesource.com/image";
+  rev = "f03a046406d4d7fbfd4ed29f554da8f6114049fc";
 
-  src = fetchgit {
-    url = "https://go.googlesource.com/image";
-    rev = "f03a046406d4d7fbfd4ed29f554da8f6114049fc";
-    sha256 = "1aq6mnjayks55gd9ahavk6jfydlq5lm4xm0xk4pd5sqa74p5p74d";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    mv $out/* .
     mkdir -p $out/share/fonts/truetype
     mkdir -p $out/share/doc/go-font
     cp font/gofont/ttfs/* $out/share/fonts/truetype
     mv $out/share/fonts/truetype/README $out/share/doc/go-font/LICENSE
   '';
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "10hfm2cpxlx1ng7r2mbvykjhmy131qlgzpdzj7ibg9kr293bcjc0";
-
+  sha256 = "1488426ya2nzmwjas947fx9h5wzxrp9wasn8nkjqf0y0mpd4f1xz";
+}) // {
   meta = with stdenv.lib; {
     homepage = https://blog.golang.org/go-fonts;
     description = "The Go font family";
diff --git a/pkgs/data/fonts/gohufont/default.nix b/pkgs/data/fonts/gohufont/default.nix
index b394cb47157..59ac4ec850b 100644
--- a/pkgs/data/fonts/gohufont/default.nix
+++ b/pkgs/data/fonts/gohufont/default.nix
@@ -67,6 +67,5 @@ stdenv.mkDerivation rec {
     homepage    = http://font.gohu.org/;
     license     = licenses.wtfpl;
     maintainers = with maintainers; [ epitrochoid rnhmjoj ];
-    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/gyre/default.nix b/pkgs/data/fonts/gyre/default.nix
index 492d89a674c..91a8aaf3c30 100644
--- a/pkgs/data/fonts/gyre/default.nix
+++ b/pkgs/data/fonts/gyre/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   baseName = "gyre-fonts";
@@ -25,8 +25,8 @@ in fetchzip {
       covering all modern European languages and then some
     '';
     homepage = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/index_html#Readings";
-    license = stdenv.lib.licenses.lppl13c;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ bergey ];
+    license = lib.licenses.lppl13c;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ bergey ];
   };
 }
diff --git a/pkgs/data/fonts/hack/default.nix b/pkgs/data/fonts/hack/default.nix
index e77fcc3c3a3..ef0df1ba67f 100644
--- a/pkgs/data/fonts/hack/default.nix
+++ b/pkgs/data/fonts/hack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.003";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "1l6ih6v7dqali5c7zh6z2xnbf9h2wz0ag6fdgszmqd5lnhw39v6s";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A typeface designed for source code";
     longDescription = ''
       Hack is hand groomed and optically balanced to be a workhorse face for
diff --git a/pkgs/data/fonts/hanazono/default.nix b/pkgs/data/fonts/hanazono/default.nix
index 27459b2d1f3..4def0b44b14 100644
--- a/pkgs/data/fonts/hanazono/default.nix
+++ b/pkgs/data/fonts/hanazono/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "20141012";
@@ -15,7 +15,7 @@ in fetchzip {
 
   sha256 = "0z0fgrjzp0hqqnhfisivciqpxd2br2w2q9mvxkglj44np2q889w2";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Free kanji font containing 96,327 characters";
     homepage = http://fonts.jp/hanazono/;
 
diff --git a/pkgs/data/fonts/hasklig/default.nix b/pkgs/data/fonts/hasklig/default.nix
index de7dd5834e4..6286cf8a1df 100644
--- a/pkgs/data/fonts/hasklig/default.nix
+++ b/pkgs/data/fonts/hasklig/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
@@ -9,13 +9,12 @@ in fetchzip {
 
   postFetch = ''
     unzip $downloadedFile
-    mkdir -p $out/share/fonts/opentype
-    cp *.otf $out/share/fonts/opentype
+    install -m444 -Dt $out/share/fonts/opentype *.otf
   '';
 
   sha256 = "0xxyx0nkapviqaqmf3b610nq17k20afirvc72l32pfspsbxz8ybq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/i-tu/Hasklig;
     description = "A font with ligatures for Haskell code based off Source Code Pro";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
index a614017b809..759d2c2db1d 100644
--- a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
+++ b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2013.06.07"; # date of most recent file in distribution
@@ -28,8 +28,8 @@ in fetchzip rec {
       font. The numbers are well spaced and defined with high accuracy. The
       punctuation marks are heavily detailed as well.
     '';
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.romildo ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/hermit/default.nix b/pkgs/data/fonts/hermit/default.nix
index c247ad15543..f641b36a1b0 100644
--- a/pkgs/data/fonts/hermit/default.nix
+++ b/pkgs/data/fonts/hermit/default.nix
@@ -1,23 +1,20 @@
-{ stdenv, fetchurl }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
   pname = "hermit";
   version = "2.0";
+in fetchzip rec {
+  name = "${pname}-${version}";
 
-  src = fetchurl {
-    url = "https://pcaro.es/d/otf-${pname}-${version}.tar.gz";
-    sha256 = "09rmy3sbf1j1hr8zidighjgqc8kp0wsra115y27vrnlf10ml6jy0";
-  };
-
-  sourceRoot = ".";
+  url = "https://pcaro.es/d/otf-${name}.tar.gz";
 
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    cp *.otf $out/share/fonts/opentype/
+  postFetch = ''
+    tar xf $downloadedFile
+    install -m444 -Dt $out/share/fonts/opentype *.otf
   '';
+  sha256 = "127hnpxicqya7v1wmzxxqafq3aj1n33i4j5ncflbw6gj5g3bizwl";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "monospace font designed to be clear, pragmatic and very readable";
     homepage = https://pcaro.es/p/hermit;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/hyperscrypt/default.nix b/pkgs/data/fonts/hyperscrypt/default.nix
index 80516eb0293..362781c05bb 100644
--- a/pkgs/data/fonts/hyperscrypt/default.nix
+++ b/pkgs/data/fonts/hyperscrypt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, lib }:
+{ fetchzip, lib }:
 
 let
   version = "1.1";
@@ -15,7 +15,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*${pname}.otf -d $out/share/fonts/opentype/${pname}.otf
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://velvetyne.fr/fonts/hyper-scrypt/;
     description = "A modern stencil typeface inspired by stained glass technique";
     longDescription = ''
diff --git a/pkgs/data/fonts/inriafonts/default.nix b/pkgs/data/fonts/inriafonts/default.nix
index a2192385abc..52c28db639e 100644
--- a/pkgs/data/fonts/inriafonts/default.nix
+++ b/pkgs/data/fonts/inriafonts/default.nix
@@ -1,26 +1,22 @@
-{ stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
+{ lib, fetchFromGitHub }:
 
+let
   pname = "inriafonts";
   version = "1.200";
+in fetchFromGitHub rec {
   name = "${pname}-${version}";
-
-src = fetchFromGitHub {
   owner = "BlackFoundry";
   repo = "InriaFonts";
   rev = "v${version}";
-  sha256 = "06775y99lyh6hj5hzvrx56iybdck8a8xfqkipqd5c4cldg0a9hh8";
-};
 
-installPhase = ''
-  mkdir -p $out/share/fonts/truetype
-  cp fonts/*/TTF/*.ttf $out/share/fonts/truetype
-  mkdir -p $out/share/fonts/opentype
-  cp fonts/*/OTF/*.otf $out/share/fonts/opentype
-'';
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/truetype fonts/*/TTF/*.ttf
+    install -m444 -Dt $out/share/fonts/opentype fonts/*/OTF/*.otf
+  '';
+  sha256 = "0wrwcyycyzvgvgnlmwi1ncdvwb8f6bbclynd1105rsyxgrz5dd70";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://black-foundry.com/work/inria;
     description = "Inria Sans and Inria Serif";
     longDescription = ''
@@ -32,7 +28,7 @@ installPhase = ''
       typeface with a unapologetically contemporary design as the
       Sans-serif part and a more rational axis and drawing for the
       serif. Both members comes in 3 weights with matching italics.
-      '';
+    '';
     license = licenses.ofl;
     maintainers = with maintainers; [ leenaars ];
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/inter-ui/default.nix b/pkgs/data/fonts/inter-ui/default.nix
index 15032ebb3e3..d9ef6684faa 100644
--- a/pkgs/data/fonts/inter-ui/default.nix
+++ b/pkgs/data/fonts/inter-ui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 # XXX: IMPORTANT:
 # For compat, keep this at the last version that used the name "Inter UI"
@@ -18,7 +18,7 @@ in fetchzip {
 
   sha256 = "01d2ql803jrhss6g60djvs08x9xl7z6b3snkn03vqnrajdgifcl4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://rsms.me/inter/;
     description = "A typeface specially designed for user interfaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/inter/default.nix b/pkgs/data/fonts/inter/default.nix
index 8973eae1464..f11f13283d5 100644
--- a/pkgs/data/fonts/inter/default.nix
+++ b/pkgs/data/fonts/inter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.5";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "0zqixzzbb3n1j4jvpjm0hlxc32j53hgq4j078gihjkhgvjhsklf2";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://rsms.me/inter/;
     description = "A typeface specially designed for user interfaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ipaexfont/default.nix b/pkgs/data/fonts/ipaexfont/default.nix
index dfeab5124c8..4d7e2fa380e 100644
--- a/pkgs/data/fonts/ipaexfont/default.nix
+++ b/pkgs/data/fonts/ipaexfont/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-fetchzip rec {
+fetchzip {
   name = "ipaexfont-003.01";
 
-  url = "http://dl.ipafont.ipa.go.jp/IPAexfont/IPAexfont00301.zip";
+  url = "http://web.archive.org/web/20160616003021/http://dl.ipafont.ipa.go.jp/IPAexfont/IPAexfont00301.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -12,7 +12,7 @@ fetchzip rec {
 
   sha256 = "02a6sj990cnig5lq0m54nmbmfkr3s57jpxl9fiyzrjmigvd1qmhj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Japanese font package with Mincho and Gothic fonts";
     longDescription = ''
       IPAex font is a Japanese font developed by the Information-technology
@@ -24,6 +24,5 @@ fetchzip rec {
     homepage = http://ipafont.ipa.go.jp/;
     license = licenses.ipa;
     maintainers = with maintainers; [ gebner ];
-    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/data/fonts/ipafont/default.nix b/pkgs/data/fonts/ipafont/default.nix
index c056f14f46f..d1cb0070883 100644
--- a/pkgs/data/fonts/ipafont/default.nix
+++ b/pkgs/data/fonts/ipafont/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "ipafont-003.03";
@@ -20,8 +20,7 @@ fetchzip {
       suitable for both display and printing.
     '';
     homepage = http://ipafont.ipa.go.jp/ipafont/;
-    license = stdenv.lib.licenses.ipa;
-    maintainers = [ stdenv.lib.maintainers.auntie ];
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.ipa;
+    maintainers = [ lib.maintainers.auntie ];
   };
 }
diff --git a/pkgs/data/fonts/ir-standard-fonts/default.nix b/pkgs/data/fonts/ir-standard-fonts/default.nix
index af1392e9d5e..1501e0fb7fa 100644
--- a/pkgs/data/fonts/ir-standard-fonts/default.nix
+++ b/pkgs/data/fonts/ir-standard-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "ir-standard-fonts";
-  version= "unstable-2017-01-21";
+  version = "unstable-2017-01-21";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "morealaz";
+  repo = pname;
+  rev = "d36727d6c38c23c01b3074565667a2fe231fe18f";
 
-  src = fetchFromGitHub {
-    owner = "morealaz";
-    repo = pname;
-    rev = "d36727d6c38c23c01b3074565667a2fe231fe18f";
-    sha256 = "1ks9q1r1gk2517yfr1fbgrdbgw0w97i4am6jqn5ywpgm2xd03yg1";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/ir-standard-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/ir-standard-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/ir-standard-fonts {} \;
   '';
+  sha256 = "0i2vzhwk77pm6fx5z5gxl026z9f35rhh3cvl003mry2lcg1x5rhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/morealaz/ir-standard-fonts;
     description = "Iran Supreme Council of Information and Communication Technology (SCICT) standard Persian fonts series";
     # License information is unavailable.
diff --git a/pkgs/data/fonts/iwona/default.nix b/pkgs/data/fonts/iwona/default.nix
index 3649aad99f4..afa59b737a5 100644
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@@ -1,23 +1,18 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "iwona-${version}";
+let
   version = "0_995";
+in fetchzip {
+  name = "iwona-${version}";
+  url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
 
-  src = fetchzip {
-    url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
-    sha256 = "1wj5bxbxpz5a8p3rhw708cyjc0lgqji8g0iv6brmmbrrkpb3jq2s";
-  };
-
-  installPhase = ''
-    install -m 444 -D -t $out/share/fonts/opentype/ *.otf
+  postFetch = ''
+    mkdir -p $out/share/fonts/opentype
+    unzip -j $downloadedFile *.otf -d $out/share/fonts/opentype
   '';
+  sha256 = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A two-element sans-serif typeface, created by Małgorzata Budyta";
     homepage = http://jmn.pl/en/kurier-i-iwona/;
     # "[...] GUST Font License (GFL), which is a free license, legally
diff --git a/pkgs/data/fonts/junicode/default.nix b/pkgs/data/fonts/junicode/default.nix
index 824d9044d76..1cfe1d5d4b0 100644
--- a/pkgs/data/fonts/junicode/default.nix
+++ b/pkgs/data/fonts/junicode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "junicode-0.7.8";
@@ -15,7 +15,6 @@ fetchzip {
   meta = {
     homepage = http://junicode.sourceforge.net/;
     description = "A Unicode font for medievalists";
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/data/fonts/kawkab-mono/default.nix b/pkgs/data/fonts/kawkab-mono/default.nix
index 852fdec82f8..c1de2806ef1 100644
--- a/pkgs/data/fonts/kawkab-mono/default.nix
+++ b/pkgs/data/fonts/kawkab-mono/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "kawkab-mono-20151015";
@@ -15,8 +15,7 @@ fetchzip rec {
   meta = {
     description = "An arab fixed-width font";
     homepage = https://makkuk.com/kawkab-mono/;
-    license = stdenv.lib.licenses.ofl;
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.ofl;
   };
 }
 
diff --git a/pkgs/data/fonts/kochi-substitute-naga10/default.nix b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
index c24e6898129..cc2ec0d641f 100644
--- a/pkgs/data/fonts/kochi-substitute-naga10/default.nix
+++ b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "20030809";
 in
@@ -26,7 +26,7 @@ fetchzip {
       Debian version.
     '';
     homepage = http://sourceforge.jp/projects/efont/;
-    license = stdenv.lib.licenses.unfreeRedistributable;
-    maintainers = [ stdenv.lib.maintainers.auntie ];
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ lib.maintainers.auntie ];
   };
 }
diff --git a/pkgs/data/fonts/kochi-substitute/default.nix b/pkgs/data/fonts/kochi-substitute/default.nix
index 5815b84f21a..11cd73e5237 100644
--- a/pkgs/data/fonts/kochi-substitute/default.nix
+++ b/pkgs/data/fonts/kochi-substitute/default.nix
@@ -43,6 +43,5 @@ stdenv.mkDerivation {
     homepage = http://sourceforge.jp/projects/efont/;
     license = stdenv.lib.licenses.wadalab;
     maintainers = [ stdenv.lib.maintainers.auntie ];
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/lalezar-fonts/default.nix b/pkgs/data/fonts/lalezar-fonts/default.nix
index c9915d7a3e6..2cd33e9fe1b 100644
--- a/pkgs/data/fonts/lalezar-fonts/default.nix
+++ b/pkgs/data/fonts/lalezar-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "lalezar-fonts";
   version = "unstable-2017-02-28";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "BornaIz";
+  repo = "Lalezar";
+  rev = "238701c4241f207e92515f845a199be9131c1109";
 
-  src = fetchFromGitHub {
-    owner = "BornaIz";
-    repo = "Lalezar";
-    rev = "238701c4241f207e92515f845a199be9131c1109";
-    sha256 = "1j3zg9qw4ahw52i0i2c69gv5gjc1f4zsdla58kd9visk03qgk77p";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/lalezar-fonts
     cp -v $( find . -name '*.ttf') $out/share/fonts/lalezar-fonts
   '';
+  sha256 = "0jmwhr2dqgj3vn0v26jh6c0id6n3wd6as3bq39xa870zlk7v307b";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/BornaIz/Lalezar;
     description = "A multi-script display typeface for popular culture";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/lato/default.nix b/pkgs/data/fonts/lato/default.nix
index 91d85ce9a0d..ea9d1837ef5 100644
--- a/pkgs/data/fonts/lato/default.nix
+++ b/pkgs/data/fonts/lato/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lato-2.0";
@@ -12,7 +12,7 @@ fetchzip {
 
   sha256 = "1amwn6vcaggxrd2s4zw21s2pr47zmzdf2xfy4x9lxa2cd9bkhvg5";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.latofonts.com/;
 
     description = ''
diff --git a/pkgs/data/fonts/liberastika/default.nix b/pkgs/data/fonts/liberastika/default.nix
index 2e1f89ed1e7..1bc3b9b2092 100644
--- a/pkgs/data/fonts/liberastika/default.nix
+++ b/pkgs/data/fonts/liberastika/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1.5";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1a9dvl1pzch2vh8sqyyn1d1wz4n624ffazl6hzlc3s5k5lzrb6jp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Liberation Sans fork with improved cyrillic support";
     homepage = https://sourceforge.net/projects/lib-ka/;
 
diff --git a/pkgs/data/fonts/liberation-sans-narrow/default.nix b/pkgs/data/fonts/liberation-sans-narrow/default.nix
index 97a1ff70f49..4a14e095cf0 100644
--- a/pkgs/data/fonts/liberation-sans-narrow/default.nix
+++ b/pkgs/data/fonts/liberation-sans-narrow/default.nix
@@ -14,11 +14,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ fontforge pythonPackages.fonttools python ];
 
   installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp -v $(find . -name '*Narrow*.ttf') $out/share/fonts/truetype
-
-    mkdir -p "$out/doc/${pname}-${version}"
-    cp -v AUTHORS ChangeLog COPYING License.txt README "$out/doc/${pname}-${version}" || true
+    find . -name '*Narrow*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
+    install -m444 -Dt $out/doc/${pname}-${version} AUTHORS ChangeLog COPYING License.txt README.rst
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/data/fonts/libertinus/default.nix b/pkgs/data/fonts/libertinus/default.nix
index 2ee1e83691c..246d4a91a96 100644
--- a/pkgs/data/fonts/libertinus/default.nix
+++ b/pkgs/data/fonts/libertinus/default.nix
@@ -1,28 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "libertinus-${version}";
+let
   version = "6.6";
+in fetchFromGitHub rec {
+  name = "libertinus-${version}";
 
-  src = fetchFromGitHub {
-    rev    = "v${version}";
-    owner  = "khaledhosny";
-    repo   = "libertinus";
-    sha256 = "0syagjmwy6q1ysncchl9bgyfrm7f6fghj1aipbr6md7l6gafz7ji";
-  };
+  owner  = "khaledhosny";
+  repo   = "libertinus";
+  rev    = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype/
-    mkdir -p $out/share/doc/${name}/
-    cp *.otf $out/share/fonts/opentype/
-    cp *.txt $out/share/doc/${name}/
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    *.txt
   '';
+  sha256 = "11pxb2zwvjlk06zbqrfv2pgwsl4awf68fak1ks4881i8xbl1910m";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "11pxb2zwvjlk06zbqrfv2pgwsl4awf68fak1ks4881i8xbl1910m";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A fork of the Linux Libertine and Linux Biolinum fonts";
     longDescription = ''
       Libertinus fonts is a fork of the Linux Libertine and Linux Biolinum fonts
diff --git a/pkgs/data/fonts/libre-baskerville/default.nix b/pkgs/data/fonts/libre-baskerville/default.nix
index 18f236068a2..f5e6083f944 100644
--- a/pkgs/data/fonts/libre-baskerville/default.nix
+++ b/pkgs/data/fonts/libre-baskerville/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-baskerville-1.000";
 
-  url = https://github.com/impallari/Libre-Baskerville/archive/2fba7c8e0a8f53f86efd3d81bc4c63674b0c613f.zip;
+  owner = "impallari";
+  repo = "Libre-Baskerville";
+  rev = "2fba7c8e0a8f53f86efd3d81bc4c63674b0c613f";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip    -j $downloadedFile \*.ttf                    -d $out/share/fonts/truetype
-    unzip -n -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "0arlq89b3vmpw3n4wbllsdvqblhz6p09dm19z1cndicmcgk26w2a";
+  sha256 = "1kpji85d1mgwq8b4fh1isznrhsrv32la3wf058rwjmhx5a3l7yaj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A webfont family optimized for body text";
     longDescription = ''
       Libre Baskerville is a webfont family optimized for body text. It's Based
diff --git a/pkgs/data/fonts/libre-bodoni/default.nix b/pkgs/data/fonts/libre-bodoni/default.nix
index 96f366973f0..e55d5030741 100644
--- a/pkgs/data/fonts/libre-bodoni/default.nix
+++ b/pkgs/data/fonts/libre-bodoni/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-bodoni-2.000";
 
-  url = https://github.com/impallari/Libre-Bodoni/archive/995a40e8d6b95411d660cbc5bb3f726ffd080c7d.zip;
+  owner = "impallari";
+  repo = "Libre-Bodoni";
+  rev = "995a40e8d6b95411d660cbc5bb3f726ffd080c7d";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*/v2000\ -\ initial\ glyphs\ migration/OTF/\*.otf  -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt                           -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype */v2000\ -\ initial\ glyphs\ migration/OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "0pnb1xydpvcl9mkz095f566kz7yj061wbf40rwrbwmk706f6bsiw";
+  sha256 = "0my0i5a7f0d27m6dcdirjmlcnswqqfp8gl3ccxa5f2wkn3qlzkvz";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Bodoni fonts adapted for today's web requirements";
     longDescription = ''
       The Libre Bodoni fonts are based on the 19th century Morris Fuller
diff --git a/pkgs/data/fonts/libre-franklin/default.nix b/pkgs/data/fonts/libre-franklin/default.nix
index 9ca37e35640..97832ab5651 100644
--- a/pkgs/data/fonts/libre-franklin/default.nix
+++ b/pkgs/data/fonts/libre-franklin/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-franklin-1.014";
 
-  url = https://github.com/impallari/Libre-Franklin/archive/006293f34c47bd752fdcf91807510bc3f91a0bd3.zip;
+  owner = "impallari";
+  repo = "Libre-Franklin";
+  rev = "006293f34c47bd752fdcf91807510bc3f91a0bd3";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype */OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "1rkjp8x62cn4alw3lp7m45q34bih81j2hg15kg5c1nciyqq1qz0z";
+  sha256 = "0aq280m01pbirkzga432340aknf2m5ggalw0yddf40sqz7falykf";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A reinterpretation and expansion based on the 1912 Morris Fuller Benton’s classic.";
     homepage = https://github.com/impallari/Libre-Franklin;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/lm-math/default.nix b/pkgs/data/fonts/lm-math/default.nix
index 348373b8927..8df851cb9df 100644
--- a/pkgs/data/fonts/lm-math/default.nix
+++ b/pkgs/data/fonts/lm-math/default.nix
@@ -1,26 +1,20 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "latinmodern-math-${version}";
+let
   version = "1.959";
+in fetchzip rec {
+  name = "latinmodern-math-${version}";
 
-  src = fetchzip {
-    url = "www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
-    sha256 = "15l3lxjciyjmbh0q6jjvzz16ibk4ij79in9fs47qhrfr2wrddpvs";
-  };
-
-  installPhase = ''
+  url = "http://www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
+  postFetch = ''
     mkdir -p $out/share/fonts/opentype/
     mkdir -p $out/share/doc/${name}/
-    cp otf/*.otf $out/share/fonts/opentype/
-    cp doc/*.txt $out/share/doc/${name}/
+    unzip -f $downloadedFile otf/*.otf -d $out/share/fonts/opentype/
+    unzip -f $downloadedFile doc/*.txt -d $out/share/doc/${name}/
   '';
+  sha256 = "05k145bxgxjh7i9gx1ahigxfpc2v2vwzsy2mc41jvvg51kjr8fnn";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "05k145bxgxjh7i9gx1ahigxfpc2v2vwzsy2mc41jvvg51kjr8fnn";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The Latin Modern Math (LM Math) font completes the modernization of the Computer Modern family of typefaces designed and programmed by Donald E. Knuth.";
     homepage = http://www.gust.org.pl/projects/e-foundry/lm-math;
     # "The Latin Modern Math font is licensed under the GUST Font License (GFL),
diff --git a/pkgs/data/fonts/lmodern/default.nix b/pkgs/data/fonts/lmodern/default.nix
index c408aae9c0e..644efd8b858 100644
--- a/pkgs/data/fonts/lmodern/default.nix
+++ b/pkgs/data/fonts/lmodern/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lmodern-2.004.5";
@@ -21,7 +21,6 @@ fetchzip {
 
   meta = {
     description = "Latin Modern font";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/lmodern/lmmath.nix b/pkgs/data/fonts/lmodern/lmmath.nix
index c6e0788eed3..98bde90ff94 100644
--- a/pkgs/data/fonts/lmodern/lmmath.nix
+++ b/pkgs/data/fonts/lmodern/lmmath.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lmmath-0.903";
@@ -21,7 +21,6 @@ fetchzip {
 
   meta = {
     description = "Latin Modern font";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/lobster-two/default.nix b/pkgs/data/fonts/lobster-two/default.nix
index 850fd1a1f94..d9e7ec66ee6 100644
--- a/pkgs/data/fonts/lobster-two/default.nix
+++ b/pkgs/data/fonts/lobster-two/default.nix
@@ -70,10 +70,11 @@ in
     outputHash = "0if9l8pzwgfnbdjg5yblcy08dwn9yj3wzz29l0fycia46xlzd4ym";
 
     meta = with stdenv.lib; {
-      homepage = http://www.impallari.com/lobstertwo;
+      homepage = https://github.com/librefonts/lobstertwo;
       description = "Script font with many ligatures";
       license = licenses.ofl;
       platforms = platforms.all;
       maintainers = [maintainers.rycee];
+      broken = true; # googlecode.com RIP; can be built from sources
     };
   }
diff --git a/pkgs/data/fonts/lohit-fonts/default.nix b/pkgs/data/fonts/lohit-fonts/default.nix
index c847b4cdd27..0e8b1f8fe4d 100644
--- a/pkgs/data/fonts/lohit-fonts/default.nix
+++ b/pkgs/data/fonts/lohit-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, lib }:
+{ fetchzip, lib }:
 let
   fonts = {
     assamese        = { label = "Assamese";          version = "2.91.5"; sha256 = "06cw416kgw0m6883n5ixmpniinsd747rdmacf06z83w1hqwj2js6"; };
@@ -51,7 +51,6 @@ let
       # Set a non-zero priority to allow easy overriding of the
       # fontconfig configuration files.
       priority = 5;
-      platforms = stdenv.lib.platforms.unix;
     };
   };
 
diff --git a/pkgs/data/fonts/manrope/default.nix b/pkgs/data/fonts/manrope/default.nix
index 1fdf88b79ab..9dce73a28aa 100644
--- a/pkgs/data/fonts/manrope/default.nix
+++ b/pkgs/data/fonts/manrope/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "manrope";
   version = "3";
-  src = fetchFromGitHub {
-    owner = "sharanda";
-    repo = pname;
-    rev = "3bd68c0c325861e32704470a90dfc1868a5c37e9";
-    sha256 = "1k6nmczbl97b9j2a8vx6a1r3q4gd1c2qydv0y9gn8xyl7x8fcvhs";
-  };
-  dontBuild = true;
-  installPhase = ''
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "sharanda";
+  repo = pname;
+  rev = "3bd68c0c325861e32704470a90dfc1868a5c37e9";
+  sha256 = "1h4chkfbp75hrrqqarf28ld4yb7hfrr7q4w5yz96ivg94lbwlnld";
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     install -Dm644 -t $out/share/fonts/opentype "desktop font"/*
   '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Open-source modern sans-serif font family";
     homepage = https://github.com/sharanda/manrope;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/marathi-cursive/default.nix b/pkgs/data/fonts/marathi-cursive/default.nix
index 48b2f4c516b..60c77dddc8d 100644
--- a/pkgs/data/fonts/marathi-cursive/default.nix
+++ b/pkgs/data/fonts/marathi-cursive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   version = "1.2";
@@ -11,15 +11,13 @@ in fetchzip rec {
     ${p7zip}/bin/7z x $downloadedFile
     cd MarathiCursive
 
-    mkdir -p $out/share/fonts/marathi-cursive
-    cp -v *.otf *.ttf $out/share/fonts/marathi-cursive
-    mkdir -p $out/share/doc/${name}
-    cp -v README *.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/marathi-cursive *.otf *.ttf
+    install -m444 -Dt $out/share/doc/${name}           README *.txt
   '';
 
-  sha256 = "0fhz2ixrkm523qlx5pnwyzxgb1cfiiwrhls98xg8a5l3sypn1g8v";
+  sha256 = "0wq4w79x8r5w6ikm9amcmapf0jcdgifs9zf1pbnw3fk4ncz5s551";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/MihailJP/MarathiCursive;
     description = "Modi script font with Graphite and OpenType support";
     maintainers = with maintainers; [ mathnerd314 ];
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 432bbaa78db..1c36d0f57fe 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,17 +1,15 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "material-design-icons-${version}";
+let
   version = "3.3.92";
+in fetchFromGitHub {
+  name = "material-design-icons-${version}";
+  owner  = "Templarian";
+  repo   = "MaterialDesign-Webfont";
+  rev    = "v${version}";
 
-  src = fetchFromGitHub {
-    owner  = "Templarian";
-    repo   = "MaterialDesign-Webfont";
-    rev    = "v${version}";
-    sha256 = "0k8pv2nsp3al4i4awx5mv7cscpm8akjn567jl9dwzangcsai0l53";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{eot,svg,truetype,woff,woff2}
     cp fonts/*.eot $out/share/fonts/eot/
     cp fonts/*.svg $out/share/fonts/svg/
@@ -19,8 +17,9 @@ stdenv.mkDerivation rec {
     cp fonts/*.woff $out/share/fonts/woff/
     cp fonts/*.woff2 $out/share/fonts/woff2/
   '';
+  sha256 = "0dbm4qfd0b91yrw3cv4i377pnm98fgj936nk1m5wlx8mx8jahz48";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "3200+ Material Design Icons from the Community";
     longDescription = ''
       Material Design Icons' growing icon collection allows designers and
diff --git a/pkgs/data/fonts/material-icons/default.nix b/pkgs/data/fonts/material-icons/default.nix
index ea44c9c79b1..0126fbac225 100644
--- a/pkgs/data/fonts/material-icons/default.nix
+++ b/pkgs/data/fonts/material-icons/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "material-icons-${version}";
+let
   version = "3.0.1";
+in fetchFromGitHub {
+  name = "material-icons-${version}";
 
-  src = fetchFromGitHub {
-    owner  = "google";
-    repo   = "material-design-icons";
-    rev    = "${version}";
-    sha256 = "17q5brcqyyc8gbjdgpv38p89s60cwxjlwy2ljnrvas5cj0s62np0";
-  };
+  owner  = "google";
+  repo   = "material-design-icons";
+  rev    = version;
 
-  buildCommand = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype
-    cp $src/iconfont/*.ttf $out/share/fonts/truetype
+    cp iconfont/*.ttf $out/share/fonts/truetype
   '';
+  sha256 = "1syy6v941lb8nqxhdf7mfx28v05lwrfnq53r3c1ym13x05l9kchp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "System status icons by Google, featuring material design";
     homepage = https://material.io/icons;
     license = licenses.asl20;
diff --git a/pkgs/data/fonts/medio/default.nix b/pkgs/data/fonts/medio/default.nix
index aa805b6f082..024e6049a38 100644
--- a/pkgs/data/fonts/medio/default.nix
+++ b/pkgs/data/fonts/medio/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Serif font designed by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/migmix/default.nix b/pkgs/data/fonts/migmix/default.nix
index 14b08e140ea..986751645e3 100644
--- a/pkgs/data/fonts/migmix/default.nix
+++ b/pkgs/data/fonts/migmix/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
   unpackPhase = ":";
 
   installPhase = ''
-    mkdir -p $out/share/fonts/truetype/migmix
-    find $srcs -name '*.ttf' | xargs install -m644 --target $out/share/fonts/truetype/migmix
+    find $srcs -name '*.ttf' -exec install -m644 -Dt $out/share/fonts/truetype/migmix {} \;
   '';
 
   outputHashAlgo = "sha256";
@@ -38,7 +37,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on M+ fonts and IPA fonts";
     homepage = http://mix-mplus-ipa.osdn.jp/migmix;
     license = licenses.ipa;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/migu/default.nix b/pkgs/data/fonts/migu/default.nix
index aefaefb337f..3b03460125f 100644
--- a/pkgs/data/fonts/migu/default.nix
+++ b/pkgs/data/fonts/migu/default.nix
@@ -37,7 +37,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on modified M+ fonts and IPA fonts";
     homepage = http://mix-mplus-ipa.osdn.jp/migu/;
     license = licenses.ipa;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/mononoki/default.nix b/pkgs/data/fonts/mononoki/default.nix
index cc481a136ba..658c3bdf20a 100644
--- a/pkgs/data/fonts/mononoki/default.nix
+++ b/pkgs/data/fonts/mononoki/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.2";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "19y4xg7ilm21h9yynyrwcafdqn05zknpmmjrb37qim6p0cy2glff";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/madmalik/mononoki;
     description = "A font for programming and code review";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/montserrat/default.nix b/pkgs/data/fonts/montserrat/default.nix
index 37afa063c3e..de8ea80b017 100644
--- a/pkgs/data/fonts/montserrat/default.nix
+++ b/pkgs/data/fonts/montserrat/default.nix
@@ -2,7 +2,7 @@
 #
 # https://aur.archlinux.org/packages/ttf-montserrat/
 
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -19,7 +19,7 @@ in fetchzip {
 
   sha256 = "11sdgvhaqg59mq71aqwqp2mb428984hjxy7hd1vasia9kgk8259w";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A geometric sans serif font with extended latin support (Regular, Alternates, Subrayada)";
     homepage    = "https://www.fontspace.com/julieta-ulanovsky/montserrat";
     license     = licenses.ofl;
diff --git a/pkgs/data/fonts/mph-2b-damase/default.nix b/pkgs/data/fonts/mph-2b-damase/default.nix
index 692ad63574f..4102386af90 100644
--- a/pkgs/data/fonts/mph-2b-damase/default.nix
+++ b/pkgs/data/fonts/mph-2b-damase/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "MPH-2B-Damase-2";
@@ -13,6 +13,5 @@ fetchzip {
   sha256 = "0yzf12z6fpbgycqwiz88f39iawdhjabadfa14wxar3nhl9n434ql";
 
   meta = {
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/mplus-outline-fonts/default.nix b/pkgs/data/fonts/mplus-outline-fonts/default.nix
index 0fd724149d8..812f96352f0 100644
--- a/pkgs/data/fonts/mplus-outline-fonts/default.nix
+++ b/pkgs/data/fonts/mplus-outline-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "063";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0d485l2ihxfk039rrrnfviamlbj13cwky0c752m4ikwvgiqiq94y";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "M+ Outline Fonts";
     homepage = http://mplus-fonts.sourceforge.jp/mplus-outline-fonts/index-en.html;
     license = licenses.mit;
diff --git a/pkgs/data/fonts/mro-unicode/default.nix b/pkgs/data/fonts/mro-unicode/default.nix
index 8986a9adb7a..bb5a1ed8a9f 100644
--- a/pkgs/data/fonts/mro-unicode/default.nix
+++ b/pkgs/data/fonts/mro-unicode/default.nix
@@ -3,7 +3,7 @@
 fetchzip {
   name = "mro-unicode-2013-05-25";
 
-  url = "https://github.com/phjamr/MroUnicode/raw/master/MroUnicode-Regular.ttf";
+  url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/MroUnicode-Regular.ttf";
 
diff --git a/pkgs/data/fonts/nahid-fonts/default.nix b/pkgs/data/fonts/nahid-fonts/default.nix
index 31c0f5590bd..b9d9025b2c0 100644
--- a/pkgs/data/fonts/nahid-fonts/default.nix
+++ b/pkgs/data/fonts/nahid-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "nahid-fonts";
   version = "0.3.0";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "rastikerdar";
+  repo = "nahid-font";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "nahid-font";
-    rev = "v${version}";
-    sha256 = "0n42sywi41zin9dilr8vabmcqvmx2f1a8b4yyybs6ms9zb9xdkxg";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/nahid-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/nahid-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/nahid-fonts {} \;
   '';
+  sha256 = "0df169sibq14j2mj727sq86c00jm1nz8565v85hkvh4zgz2plb7c";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/nahid-font;
     description = "A Persian (Farsi) Font - قلم (فونت) فارسی ناهید";
     license = licenses.free;
diff --git a/pkgs/data/fonts/nanum-gothic-coding/default.nix b/pkgs/data/fonts/nanum-gothic-coding/default.nix
index c0b4670a659..f6b8210290e 100644
--- a/pkgs/data/fonts/nanum-gothic-coding/default.nix
+++ b/pkgs/data/fonts/nanum-gothic-coding/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, unzip}:
+{ lib, fetchzip }:
 
 let
   version = "VER2.5";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0b3pkhd6xn6393zi0dhj3ah08w1y1ji9fl6584bi0c8lanamf2pc";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A contemporary monospaced sans-serif typeface with a warm touch";
     homepage = https://github.com/naver/nanumfont;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/nerdfonts/default.nix b/pkgs/data/fonts/nerdfonts/default.nix
index 528055a5e80..985f264f40e 100644
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@@ -30,7 +30,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/ryanoasis/nerd-fonts;
     license = licenses.mit;
     maintainers = with maintainers; [ garbas ];
-    platforms = with platforms; unix;
     hydraPlatforms = []; # 'Output limit exceeded' on Hydra
   };
 }
diff --git a/pkgs/data/fonts/nika-fonts/default.nix b/pkgs/data/fonts/nika-fonts/default.nix
index f40ee8da750..c6bdbd40248 100644
--- a/pkgs/data/fonts/nika-fonts/default.nix
+++ b/pkgs/data/fonts/nika-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "nika-fonts";
   version = "1.0.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "font-store";
+  repo = "NikaFont";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "font-store";
-    repo = "NikaFont";
-    rev = "v${version}";
-    sha256 = "16dhk87vmjnywl5wqsl9dzp12ddpfk57w08f7811m3ijqadscdwc";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/nika-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/nika-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/nika-fonts {} \;
   '';
+  sha256 = "1x34b2dqn1dymi1vmj5vrjcy2z8s0f3rr6cniyrz85plvid6x40i";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/font-store/NikaFont/;
     description = "Persian/Arabic Open Source Font";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/norwester/default.nix b/pkgs/data/fonts/norwester/default.nix
index 35d69aa7f07..0de5aa8fdf3 100644
--- a/pkgs/data/fonts/norwester/default.nix
+++ b/pkgs/data/fonts/norwester/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.2";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1npsaiiz9g5z6315lnmynwcnrfl37fyxc7w1mhkw1xbzcnv74z4r";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://jamiewilson.io/norwester;
     description = "A condensed geometric sans serif by Jamie Wilson";
     maintainers = with maintainers; [ leenaars ];
diff --git a/pkgs/data/fonts/noto-fonts/tools.nix b/pkgs/data/fonts/noto-fonts/tools.nix
index b5fc13daefa..a9d45128c5b 100644
--- a/pkgs/data/fonts/noto-fonts/tools.nix
+++ b/pkgs/data/fonts/noto-fonts/tools.nix
@@ -27,6 +27,5 @@ pythonPackages.buildPythonPackage rec {
     description = "Noto fonts support tools and scripts plus web site generation";
     license = lib.licenses.asl20;
     homepage = https://github.com/googlei18n/nototools;
-    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/office-code-pro/default.nix b/pkgs/data/fonts/office-code-pro/default.nix
index 564b950784b..4354725c90c 100644
--- a/pkgs/data/fonts/office-code-pro/default.nix
+++ b/pkgs/data/fonts/office-code-pro/default.nix
@@ -1,26 +1,23 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "office-code-pro";
   version = "1.004";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "nathco";
-    repo = "Office-Code-Pro";
-    rev = version;
-    sha256 = "0znmjjyn5q83chiafy252bhsmw49r2nx2ls2cmhjp4ihidfr6cmb";
-  };
+  owner = "nathco";
+  repo = "Office-Code-Pro";
+  rev = version;
 
-  installPhase = ''
-    fontDir=$out/share/fonts/opentype
-    docDir=$out/share/doc/${pname}-${version}
-    mkdir -p $fontDir $docDir
-    install -Dm644 README.md $docDir
-    install -t $fontDir -m644 'Fonts/Office Code Pro/OTF/'*.otf
-    install -t $fontDir -m644 'Fonts/Office Code Pro D/OTF/'*.otf
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m644 -Dt $out/share/doc/${name} README.md
+    install -m444 -Dt $out/share/fonts/opentype 'Fonts/Office Code Pro/OTF/'*.otf 'Fonts/Office Code Pro D/OTF/'*.otf
   '';
+  sha256 = "1bagwcaicn6q8qkqazz6wb3x30y4apmkga0mkv8fh6890hfhywr9";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A customized version of Source Code Pro";
     longDescription = ''
       Office Code Pro is a customized version of Source Code Pro, the monospaced
@@ -31,6 +28,5 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/nathco/Office-Code-Pro;
     license = licenses.ofl;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/oldsindhi/default.nix b/pkgs/data/fonts/oldsindhi/default.nix
index 4e55b5098c8..c2ea6a7180b 100644
--- a/pkgs/data/fonts/oldsindhi/default.nix
+++ b/pkgs/data/fonts/oldsindhi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   version = "0.1";
@@ -10,15 +10,13 @@ in fetchzip rec {
   postFetch = ''
     ${p7zip}/bin/7z x $downloadedFile
 
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/doc/${name}
-    cp -v OldSindhi/*.ttf $out/share/fonts/truetype/
-    cp -v OldSindhi/README OldSindhi/*.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/truetype OldSindhi/*.ttf
+    install -m444 -Dt $out/share/doc/${name}    OldSindhi/README OldSindhi/*.txt
   '';
 
-  sha256 = "1na3lxyz008fji5ln3fqzyr562k6kch1y824byhfs4y0rwwz3f3q";
+  sha256 = "0d4l9cg2vmh2pvnqsla8mgcwvc7wjxzcabhlli6633h3ifj2yp7b";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/MihailJP/oldsindhi;
     description = "Free Sindhi Khudabadi font";
     maintainers = with maintainers; [ mathnerd314 ];
diff --git a/pkgs/data/fonts/oldstandard/default.nix b/pkgs/data/fonts/oldstandard/default.nix
index 95f8f3be7d6..cd0d0063efb 100644
--- a/pkgs/data/fonts/oldstandard/default.nix
+++ b/pkgs/data/fonts/oldstandard/default.nix
@@ -1,29 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "oldstandard-${version}";
+let
   version = "2.2";
+in fetchzip rec {
+  name = "oldstandard-${version}";
 
-  src = fetchzip {
-    stripRoot = false;
-    url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${name}.otf.zip";
-    sha256 = "1hl78jw5szdjq9dhbcv2ln75wpp2lzcxrnfc36z35v5wk4l7jc3h";
-  };
-
-  phases = [ "unpackPhase" "installPhase" ];
+  url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${name}.otf.zip";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v *.otf $out/share/fonts/opentype/
-    cp -v FONTLOG.txt $out/share/doc/${name}
+  postFetch = ''
+    unzip $downloadedFile
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    FONTLOG.txt
   '';
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1qwfsyp51grr56jcnkkmnrnl3r20pmhp9zh9g88kp64m026cah6n";
+  sha256 = "1qwfsyp51grr56jcnkkmnrnl3r20pmhp9zh9g88kp64m026cah6n";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/akryukov/oldstand;
     description = "An attempt to revive a specific type of Modern style of serif typefaces";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/open-dyslexic/default.nix b/pkgs/data/fonts/open-dyslexic/default.nix
index 7fa57463ece..8519c346891 100644
--- a/pkgs/data/fonts/open-dyslexic/default.nix
+++ b/pkgs/data/fonts/open-dyslexic/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2016-06-23";
@@ -15,7 +15,7 @@ in fetchzip {
 
   sha256 = "1vl8z5rknh2hpr2f0v4b2qgs5kclx5pzyk8al7243k5db82a2cyi";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://opendyslexic.org/;
     description = "Font created to increase readability for readers with dyslexia";
     license = "Bitstream Vera License (https://www.gnome.org/fonts/#Final_Bitstream_Vera_Fonts)";
diff --git a/pkgs/data/fonts/open-sans/default.nix b/pkgs/data/fonts/open-sans/default.nix
index d8918a6567b..dfe1426d697 100644
--- a/pkgs/data/fonts/open-sans/default.nix
+++ b/pkgs/data/fonts/open-sans/default.nix
@@ -1,25 +1,23 @@
-{ stdenv, fetchFromGitLab }:
+{ lib, fetchFromGitLab }:
 
-stdenv.mkDerivation rec {
+let
   pname = "open-sans";
   version = "1.11";
+in fetchFromGitLab rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitLab {
-    domain = "salsa.debian.org";
-    owner = "fonts-team";
-    repo = "fonts-open-sans";
-    rev = "debian%2F1.11-1"; # URL-encoded form of "debian/1.11-1" tag
-    sha256 = "077hkvpmk3ghbqyb901w43b2m2a27lh8ddasyx1x7pdwyr2bjjl2";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
+  domain = "salsa.debian.org";
+  owner = "fonts-team";
+  repo = "fonts-open-sans";
+  rev = "debian%2F1.11-1"; # URL-encoded form of "debian/1.11-1" tag
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
   '';
+  sha256 = "146ginwx18z624z582lrnhil8jvi9bjg6843265bgxxrfmf75vhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Open Sans fonts";
     longDescription = ''
       Open Sans is a humanist sans serif typeface designed by Steve Matteson,
diff --git a/pkgs/data/fonts/orbitron/default.nix b/pkgs/data/fonts/orbitron/default.nix
index e0ef1ecda81..699345f753e 100644
--- a/pkgs/data/fonts/orbitron/default.nix
+++ b/pkgs/data/fonts/orbitron/default.nix
@@ -1,23 +1,23 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "20110526";
-in fetchzip {
+in fetchFromGitHub {
   name = "orbitron-${version}";
 
-  url = https://github.com/theleagueof/orbitron/archive/13e6a52.zip;
+  owner = "theleagueof";
+  repo = "orbitron";
+  rev = "13e6a52";
 
   postFetch = ''
-    otfdir=$out/share/fonts/opentype/orbitron
-    ttfdir=$out/share/fonts/ttf/orbitron
-    mkdir -p $otfdir $ttfdir
-    unzip -j $downloadedFile \*/Orbitron\*.otf -d $otfdir
-    unzip -j $downloadedFile \*/Orbitron\*.ttf -d $ttfdir
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype/orbitron *.otf
+    install -m444 -Dt $out/share/fonts/ttf/orbitron      *.ttf
   '';
 
   sha256 = "1y9yzvpqs2v3ssnqk2iiglrh8amgsscnk8vmfgnqgqi9f4dhdvnv";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.theleagueofmoveabletype.com/orbitron;
     downloadPage = "https://www.theleagueofmoveabletype.com/orbitron/download";
     description = ''
diff --git a/pkgs/data/fonts/overpass/default.nix b/pkgs/data/fonts/overpass/default.nix
index c39bb945f48..4730a67e290 100644
--- a/pkgs/data/fonts/overpass/default.nix
+++ b/pkgs/data/fonts/overpass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.0.3";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "1m6p7rrlyqikjvypp4698sn0lp3a4z0z5al4swblfhg8qaxzv5pg";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://overpassfont.org/;
     description = "Font heavily inspired by Highway Gothic";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/oxygenfonts/default.nix b/pkgs/data/fonts/oxygenfonts/default.nix
index 109b3c3a0b3..e34e49d9814 100644
--- a/pkgs/data/fonts/oxygenfonts/default.nix
+++ b/pkgs/data/fonts/oxygenfonts/default.nix
@@ -1,18 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub {
   name = "oxygenfonts-20160824";
 
-  url = https://github.com/vernnobile/oxygenFont/archive/62db0ebe3488c936406685485071a54e3d18473b.zip;
+  owner = "vernnobile";
+  repo = "oxygenFont";
+  rev = "62db0ebe3488c936406685485071a54e3d18473b";
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile '*/Oxygen-Sans.ttf' '*/Oxygen-Sans-Bold.ttf' '*/OxygenMono-Regular.ttf' -d $out/share/fonts/truetype
+    tar xf $downloadedFile --strip=1
+    mkdir -p $out/share/fonts/truetype
+    cp */Oxygen-Sans.ttf */Oxygen-Sans-Bold.ttf */OxygenMono-Regular.ttf $out/share/fonts/truetype
   '';
 
   sha256 = "17m86p1s7a7d90zqjsr46h5bpmas4vxsgj7kd0j5c8cb7lw92jyf";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Desktop/gui font for integrated use with the KDE desktop";
     longDescription = ''
       Oxygen Font is a font family originally aimed as a desktop/gui
diff --git a/pkgs/data/fonts/parastoo-fonts/default.nix b/pkgs/data/fonts/parastoo-fonts/default.nix
index 00f03b53078..d02925e3a37 100644
--- a/pkgs/data/fonts/parastoo-fonts/default.nix
+++ b/pkgs/data/fonts/parastoo-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "parastoo-fonts";
   version = "1.0.0-alpha5";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "parastoo-font";
-    rev = "v${version}";
-    sha256 = "1nya9cbbs6sgv2w3zyah3lb1kqylf922q3fazh4l7bi6zgm8q680";
-  };
+  owner = "rastikerdar";
+  repo = "parastoo-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/parastoo-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/parastoo-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/parastoo-fonts {} \;
   '';
+  sha256 = "10jbii6rskcy4akjl5yfcqv4mfwk3nqnx36l6sbxks43va9l04f4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/parastoo-font;
     description = "A Persian (Farsi) Font - فونت ( قلم ) فارسی پرستو";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/paratype-pt/mono.nix b/pkgs/data/fonts/paratype-pt/mono.nix
index 6124d0c79b6..e6f0776daea 100644
--- a/pkgs/data/fonts/paratype-pt/mono.nix
+++ b/pkgs/data/fonts/paratype-pt/mono.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-mono";
 
-  url = "http://www.paratype.ru/uni/public/PTMono.zip";
+  url = [
+    https://company.paratype.com/system/attachments/631/original/ptmono.zip
+    http://rus.paratype.ru/system/attachments/631/original/ptmono.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "07kl82ngby55khvzsvn831ddpc0q8djgz2y6gsjixkyjfdk2xjjm";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/paratype-pt/sans.nix b/pkgs/data/fonts/paratype-pt/sans.nix
index 499871a4228..1e6610e8e44 100644
--- a/pkgs/data/fonts/paratype-pt/sans.nix
+++ b/pkgs/data/fonts/paratype-pt/sans.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-sans";
 
-  url = "http://www.paratype.ru/uni/public/PTSans.zip";
+  url = [
+    https://company.paratype.com/system/attachments/629/original/ptsans.zip
+    http://rus.paratype.ru/system/attachments/629/original/ptsans.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "01fkd417gv98jf3a6zyfi9w2dkqsbddy1vacga2672yf0kh1z1r0";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/paratype-pt/serif.nix b/pkgs/data/fonts/paratype-pt/serif.nix
index 409aaf526f8..f4da6508f08 100644
--- a/pkgs/data/fonts/paratype-pt/serif.nix
+++ b/pkgs/data/fonts/paratype-pt/serif.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-serif";
 
-  url = "http://www.paratype.ru/uni/public/PTSerif.zip";
+  url = [
+    https://company.paratype.com/system/attachments/634/original/ptserif.zip
+    http://rus.paratype.ru/system/attachments/634/original/ptserif.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "1iw5qi4ag3yp1lwmi91lb18gr768bqwl46xskaqnkhr9i9qp0v6d";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/pecita/default.nix b/pkgs/data/fonts/pecita/default.nix
index a90ff42a8e2..144ec3bab85 100644
--- a/pkgs/data/fonts/pecita/default.nix
+++ b/pkgs/data/fonts/pecita/default.nix
@@ -1,9 +1,7 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
 let
-
   version = "5.4";
-
 in
 
 fetchurl rec {
@@ -21,7 +19,7 @@ fetchurl rec {
   recursiveHash = true;
   sha256 = "0pwm20f38lcbfkdqkpa2ydpc9kvmdg0ifc4h2dmipsnwbcb5rfwm";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://pecita.eu/police-en.php;
     description = "Handwritten font with connected glyphs";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/penna/default.nix b/pkgs/data/fonts/penna/default.nix
index b1244c47bf1..57395c507fe 100644
--- a/pkgs/data/fonts/penna/default.nix
+++ b/pkgs/data/fonts/penna/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Geometric sans serif designed by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/poly/default.nix b/pkgs/data/fonts/poly/default.nix
index 81fc7b79925..d291d50e836 100644
--- a/pkgs/data/fonts/poly/default.nix
+++ b/pkgs/data/fonts/poly/default.nix
@@ -46,6 +46,5 @@ stdenv.mkDerivation rec {
     homepage = http://www.fontsquirrel.com/fonts/poly;
     license = stdenv.lib.licenses.ofl;
     maintainers = with stdenv.lib.maintainers; [ relrod ];
-    platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/data/fonts/powerline-fonts/default.nix b/pkgs/data/fonts/powerline-fonts/default.nix
index c932c7f06c0..c8044905a08 100644
--- a/pkgs/data/fonts/powerline-fonts/default.nix
+++ b/pkgs/data/fonts/powerline-fonts/default.nix
@@ -1,30 +1,24 @@
-{ stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip {
+fetchFromGitHub {
   name = "powerline-fonts-2018-11-11";
 
-  url = https://github.com/powerline/fonts/archive/e80e3eba9091dac0655a0a77472e10f53e754bb0.zip;
+  owner = "powerline";
+  repo = "fonts";
+  rev = "e80e3eba9091dac0655a0a77472e10f53e754bb0";
 
   postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile '*.otf' -d $out/share/fonts/opentype
-
-    mkdir -p $out/share/fonts/truetype
-    unzip -j $downloadedFile '*.ttf' -d $out/share/fonts/truetype
-
-    mkdir -p $out/share/fonts/bdf
-    unzip -j $downloadedFile '*/BDF/*.bdf' -d $out/share/fonts/bdf
-
-    mkdir -p $out/share/fonts/pcf
-    unzip -j $downloadedFile '*/PCF/*.pcf.gz' -d $out/share/fonts/pcf
-
-    mkdir -p $out/share/fonts/psf
-    unzip -j $downloadedFile '*/PSF/*.psf.gz' -d $out/share/fonts/psf
+    tar xf $downloadedFile --strip=1
+    find . -name '*.otf'    -exec install -Dt $out/share/fonts/opentype {} \;
+    find . -name '*.ttf'    -exec install -Dt $out/share/fonts/truetype {} \;
+    find . -name '*.bdf'    -exec install -Dt $out/share/fonts/bdf      {} \;
+    find . -name '*.pcf.gz' -exec install -Dt $out/share/fonts/pcf      {} \;
+    find . -name '*.psf.gz' -exec install -Dt $out/share/fonts/psf      {} \;
   '';
 
   sha256 = "0irifak86gn7hawzgxcy53s22y215mxc2kjncv37h7q44jsqdqww";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/powerline/fonts;
     description = "Patched fonts for Powerline users";
     longDescription = ''
diff --git a/pkgs/data/fonts/profont/default.nix b/pkgs/data/fonts/profont/default.nix
index 0c6eede969f..c28c9283a9b 100644
--- a/pkgs/data/fonts/profont/default.nix
+++ b/pkgs/data/fonts/profont/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "profont";
 
-  url = "http://tobiasjung.name/downloadfile.php?file=profont-x11.zip";
+  url = "http://web.archive.org/web/20160707013914/http://tobiasjung.name/downloadfile.php?file=profont-x11.zip";
 
   postFetch = ''
     unzip -j $downloadedFile
@@ -19,10 +19,10 @@ fetchzip rec {
 
   sha256 = "1calqmvrfv068w61f614la8mg8szas6m5i9s0lsmwjhb4qwjyxbw";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://tobiasjung.name;
     description = "A monospaced font created to be a most readable font for programming";
-    maintainers = with stdenv.lib.maintainers; [ myrl ];
+    maintainers = with lib.maintainers; [ myrl ];
     license = licenses.mit;
     platforms = platforms.all;
   };
diff --git a/pkgs/data/fonts/public-sans/default.nix b/pkgs/data/fonts/public-sans/default.nix
index 12adfcb9136..cfcf2563340 100644
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.003";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "02ranwr1bw4n9n1ljw234nzhj2a0hgradniib37nh10maark5wg3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";
     homepage = https://public-sans.digital.gov/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/quattrocento-sans/default.nix b/pkgs/data/fonts/quattrocento-sans/default.nix
index 34c8a74a762..429cd80c2fc 100644
--- a/pkgs/data/fonts/quattrocento-sans/default.nix
+++ b/pkgs/data/fonts/quattrocento-sans/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2.0";
 in fetchzip rec {
   name = "quattrocento-sans-${version}";
 
-  url = "http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+  url = "http://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/{fonts,doc}
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0g8hnn92ks4y0jbizwj7yfa097lk887wqkqpqjdmc09sd2n44343";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.impallari.com/quattrocentosans/;
     description = "A classic, elegant and sober sans-serif typeface";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/quattrocento/default.nix b/pkgs/data/fonts/quattrocento/default.nix
index a78001bb4ae..7e268182eef 100644
--- a/pkgs/data/fonts/quattrocento/default.nix
+++ b/pkgs/data/fonts/quattrocento/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
 in fetchzip rec {
   name = "quattrocento-${version}";
 
-  url = "http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+  url = "http://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/{fonts,doc}
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0f8l19y61y20sszn8ni8h9kgl0zy1gyzychg22z5k93ip4h7kfd0";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.impallari.com/quattrocento/;
     description = "A classic, elegant, sober and strong serif typeface";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/raleway/default.nix b/pkgs/data/fonts/raleway/default.nix
index 009295c5869..7fd6b80b714 100644
--- a/pkgs/data/fonts/raleway/default.nix
+++ b/pkgs/data/fonts/raleway/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "2016-08-30";
-in fetchzip {
+in fetchFromGitHub {
   name = "raleway-${version}";
 
-  url = https://github.com/impallari/Raleway/archive/fa27f47b087fc093c6ae11cfdeb3999ac602929a.zip;
+  owner = "impallari";
+  repo = "Raleway";
+  rev = "fa27f47b087fc093c6ae11cfdeb3999ac602929a";
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*-Original.otf  -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.txt \*.md     -d $out
+    tar xf $downloadedFile --strip=1
+    find . -name "*-Original.otf" -exec install -Dt $out/share/fonts/opentype {} \;
+    cp *.txt *.md -d $out
   '';
 
   sha256 = "16jr7drqg2wib2q48ajlsa7rh1jxjibl1wd4rjndi49vfl463j60";
@@ -33,8 +35,8 @@ in fetchzip {
     '';
 
     homepage = https://github.com/impallari/Raleway;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
 
-    maintainers = with stdenv.lib.maintainers; [ Profpatsch ];
+    maintainers = with lib.maintainers; [ Profpatsch ];
   };
 }
diff --git a/pkgs/data/fonts/ricty/default.nix b/pkgs/data/fonts/ricty/default.nix
index d26adfc0f9f..2667562b1b0 100644
--- a/pkgs/data/fonts/ricty/default.nix
+++ b/pkgs/data/fonts/ricty/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on Inconsolata and Migu 1M";
     homepage = https://www.rs.tus.ac.jp/yyusa/ricty.html;
     license = licenses.unfree;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/roboto/default.nix b/pkgs/data/fonts/roboto/default.nix
index 26697c52327..707d31ac531 100644
--- a/pkgs/data/fonts/roboto/default.nix
+++ b/pkgs/data/fonts/roboto/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.138";
@@ -22,8 +22,8 @@ in fetchzip rec {
       Chrome OS, and the recommended font for Google’s visual language,
       Material Design.
     '';
-    license = stdenv.lib.licenses.asl20;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.romildo ];
   };
 }
diff --git a/pkgs/data/fonts/rounded-mgenplus/default.nix b/pkgs/data/fonts/rounded-mgenplus/default.nix
index c6cb61b7bd1..43198702492 100644
--- a/pkgs/data/fonts/rounded-mgenplus/default.nix
+++ b/pkgs/data/fonts/rounded-mgenplus/default.nix
@@ -1,33 +1,19 @@
-{ stdenv, fetchurl, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   pname = "rounded-mgenplus";
   version = "20150602";
-
-in
-
-stdenv.mkDerivation rec {
+in fetchzip rec {
   name = "${pname}-${version}";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
-    sha256 = "1k15xvzd3s5ppp151wv31wrfq2ri8v96xh7i71i974rxjxj6gspc";
-  };
-
-  nativeBuildInputs = [ p7zip ];
-
-  phases = [ "unpackPhase" "installPhase" ];
-
-  unpackPhase = ''
-    7z x $src
-  '';
 
-  installPhase = ''
+  url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
+  postFetch = ''
+    ${p7zip}/bin/7z x $downloadedFile
     install -m 444 -D -t $out/share/fonts/${pname} ${pname}-*.ttf
   '';
+  sha256 = "0vwdknagdrl5dqwpb1x5lxkbfgvbx8dpg7cb6yamgz71831l05v1";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A Japanese font based on Rounded M+ and Noto Sans Japanese";
     homepage = http://jikasei.me/font/rounded-mgenplus/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/route159/default.nix b/pkgs/data/fonts/route159/default.nix
index 892078a1151..1b8d4e60653 100644
--- a/pkgs/data/fonts/route159/default.nix
+++ b/pkgs/data/fonts/route159/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "1";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A weighted sans serif font";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/sahel-fonts/default.nix b/pkgs/data/fonts/sahel-fonts/default.nix
index 20545be3dca..0b90a43ca3e 100644
--- a/pkgs/data/fonts/sahel-fonts/default.nix
+++ b/pkgs/data/fonts/sahel-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "sahel-fonts";
   version = "1.0.0-alpha22";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "sahel-font";
-    rev = "v${version}";
-    sha256 = "1kx7byzb5zxspq0i4cvgf4q7sm6xnhdnfyw9zrb1wfmdv3jzaz7p";
-  };
+  owner = "rastikerdar";
+  repo = "sahel-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/sahel-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/sahel-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/sahel-fonts {} \;
   '';
+  sha256 = "0vj8ydv50rjanb0favd7rh4r9rv5fl39vqwvzkpgfdcdawn0xjm7";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/sahel-font;
     description = "A Persian (farsi) Font - فونت (قلم) فارسی ساحل";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/samim-fonts/default.nix b/pkgs/data/fonts/samim-fonts/default.nix
index 620e2fdcfb9..dd4a01c782e 100644
--- a/pkgs/data/fonts/samim-fonts/default.nix
+++ b/pkgs/data/fonts/samim-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "samim-fonts";
   version = "3.1.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "samim-font";
-    rev = "v${version}";
-    sha256 = "1mp0pgbn9r098ilajwzag7c21shwb13mq61ly9av0mfbpnhkkjqk";
-  };
+  owner = "rastikerdar";
+  repo = "samim-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/samim-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/samim-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/samim-fonts {} \;
   '';
+  sha256 = "0mmhncqg48dp0d7l725dv909zswbkk22dlqzcdfh6k6cgk2gn08q";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/samim-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی صمیم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index 17ee7cc2a9e..f46fda0dd31 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -1,25 +1,21 @@
-{ stdenv, fetchurl, p7zip }:
+{ lib, fetchurl, p7zip }:
 
 let
   version = "0.8.0";
-  sha256 = "0zafvzrh4180hmz351f1rvs29n8mfxf0qv6mdl7psf1f066dizs6";
 in fetchurl rec {
-  inherit sha256;
-
   name = "sarasa-gothic-${version}";
 
   url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
+  sha256 = "0zafvzrh4180hmz351f1rvs29n8mfxf0qv6mdl7psf1f066dizs6";
 
   recursiveHash = true;
   downloadToTemp = true;
 
   postFetch = ''
-    ${p7zip}/bin/7z x $downloadedFile
-    mkdir -p $out/share/fonts
-    install -m644 *.ttc $out/share/fonts/
+    ${p7zip}/bin/7z x $downloadedFile -o$out/share/fonts
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "SARASA GOTHIC is a Chinese & Japanese programming font based on Iosevka and Source Han Sans";
     homepage = https://github.com/be5invis/Sarasa-Gothic;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/scheherazade/default.nix b/pkgs/data/fonts/scheherazade/default.nix
index b35f537c06b..062b29c9039 100644
--- a/pkgs/data/fonts/scheherazade/default.nix
+++ b/pkgs/data/fonts/scheherazade/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.100";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/scheherazade/;
     description = "A font designed in a similar style to traditional Naskh typefaces";
     longDescription = ''
diff --git a/pkgs/data/fonts/seshat/default.nix b/pkgs/data/fonts/seshat/default.nix
index 6b22716f1eb..af3c5dd25ee 100644
--- a/pkgs/data/fonts/seshat/default.nix
+++ b/pkgs/data/fonts/seshat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib,  fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Roman body font designed for main text by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/shabnam-fonts/default.nix b/pkgs/data/fonts/shabnam-fonts/default.nix
index cf4bd372229..89bca56a53e 100644
--- a/pkgs/data/fonts/shabnam-fonts/default.nix
+++ b/pkgs/data/fonts/shabnam-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "shabnam-fonts";
+let
+  pname = "shabnam-fonts";
   version = "4.0.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "shabnam-font";
-    rev = "v${version}";
-    sha256 = "1y4w16if2y12028b9vyc5l5c5bvcglhxacv380ixb8fcc4hfakmb";
-  };
+  owner = "rastikerdar";
+  repo = "shabnam-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/shabnam-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/shabnam-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/shabnam-fonts {} \;
   '';
+  sha256 = "0wfyaaj2pq2knz12l7rsc4wc703cbz0r8gkcya5x69p0aixch8ba";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/shabnam-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی شبنم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/shrikhand/default.nix b/pkgs/data/fonts/shrikhand/default.nix
index 034c36a63ce..a00036510f5 100644
--- a/pkgs/data/fonts/shrikhand/default.nix
+++ b/pkgs/data/fonts/shrikhand/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2016-03-03";
@@ -11,7 +11,7 @@ in fetchzip {
 
   sha256 = "0s54k9cs1g2yz6lwg5gakqb12vg5qkfdz3pc8mh7mib2s6q926hs";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://jonpinhorn.github.io/shrikhand/;
     description = "A vibrant and playful typeface for both Latin and Gujarati writing systems";
     maintainers = with maintainers; [ sternenseemann ];
diff --git a/pkgs/data/fonts/siji/default.nix b/pkgs/data/fonts/siji/default.nix
index a5a4be73c27..a0acf78d855 100644
--- a/pkgs/data/fonts/siji/default.nix
+++ b/pkgs/data/fonts/siji/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   date = "2016-05-13";
@@ -19,8 +19,8 @@ in fetchzip {
   meta = {
     homepage = https://github.com/stark/siji;
     description = "An iconic bitmap font based on Stlarch with additional glyphs";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.asymmetric ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.asymmetric ];
   };
 }
diff --git a/pkgs/data/fonts/source-code-pro/default.nix b/pkgs/data/fonts/source-code-pro/default.nix
index 6c3b9035306..be4d045815c 100644
--- a/pkgs/data/fonts/source-code-pro/default.nix
+++ b/pkgs/data/fonts/source-code-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.030";
@@ -16,9 +16,9 @@ in fetchzip {
 
   meta = {
     description = "A set of monospaced OpenType fonts designed for coding environments";
-    maintainers = with stdenv.lib.maintainers; [ relrod ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ relrod ];
+    platforms = with lib.platforms; all;
     homepage = https://adobe-fonts.github.io/source-code-pro/;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/source-han-code-jp/default.nix b/pkgs/data/fonts/source-han-code-jp/default.nix
index fc016a457c2..85f5cddd2ea 100644
--- a/pkgs/data/fonts/source-han-code-jp/default.nix
+++ b/pkgs/data/fonts/source-han-code-jp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   pname = "source-han-code-jp";
@@ -17,9 +17,9 @@ in fetchzip {
 
   meta = {
     description = "A monospaced Latin font suitable for coding";
-    maintainers = with stdenv.lib.maintainers; [ mt-caret ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ mt-caret ];
+    platforms = with lib.platforms; all;
     homepage = https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/source-han-sans/default.nix b/pkgs/data/fonts/source-han-sans/default.nix
index dc0d3175851..87e24c0e23c 100644
--- a/pkgs/data/fonts/source-han-sans/default.nix
+++ b/pkgs/data/fonts/source-han-sans/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   makePackage = {variant, language, region, sha256}: let
@@ -19,9 +19,8 @@ let
     meta = {
       description = "${language} subset of an open source Pan-CJK sans-serif typeface";
       homepage = https://github.com/adobe-fonts/source-han-sans;
-      license = stdenv.lib.licenses.ofl;
-      platforms = stdenv.lib.platforms.unix;
-      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      license = lib.licenses.ofl;
+      maintainers = with lib.maintainers; [ taku0 ];
     };
   };
 in
diff --git a/pkgs/data/fonts/source-han-serif/default.nix b/pkgs/data/fonts/source-han-serif/default.nix
index ac85d31d331..bb5a67c8306 100644
--- a/pkgs/data/fonts/source-han-serif/default.nix
+++ b/pkgs/data/fonts/source-han-serif/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   makePackage = {variant, language, region, sha256}: let
@@ -19,9 +19,8 @@ let
     meta = {
       description = "${language} subset of an open source Pan-CJK serif typeface";
       homepage = https://github.com/adobe-fonts/source-han-sans;
-      license = stdenv.lib.licenses.ofl;
-      platforms = stdenv.lib.platforms.unix;
-      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      license = lib.licenses.ofl;
+      maintainers = with lib.maintainers; [ taku0 ];
     };
   };
 in
diff --git a/pkgs/data/fonts/source-sans-pro/default.nix b/pkgs/data/fonts/source-sans-pro/default.nix
index 84360dec5d4..bea5fea0f9d 100644
--- a/pkgs/data/fonts/source-sans-pro/default.nix
+++ b/pkgs/data/fonts/source-sans-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "source-sans-pro-2.045";
@@ -14,7 +14,7 @@ fetchzip {
 
   sha256 = "0xjdp226ybdcfylbpfsdgnz2bf4pj4qv1wfs6fv22hjxlzqfixf3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://adobe-fonts.github.io/source-sans-pro/;
     description = "A set of OpenType fonts designed by Adobe for UIs";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/source-serif-pro/default.nix b/pkgs/data/fonts/source-serif-pro/default.nix
index cdfe1e3f187..87484a99b11 100644
--- a/pkgs/data/fonts/source-serif-pro/default.nix
+++ b/pkgs/data/fonts/source-serif-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.010";
@@ -16,7 +16,7 @@ in fetchzip {
 
   sha256 = "1a3lmqk7hyxpfkb30s9z73lhs823dmq6xr5llp9w23g6bh332x2h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://adobe-fonts.github.io/source-serif-pro/;
     description = "A set of OpenType fonts to complement Source Sans Pro";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/spleen/default.nix b/pkgs/data/fonts/spleen/default.nix
index a474c3db779..ed1e1e52e98 100644
--- a/pkgs/data/fonts/spleen/default.nix
+++ b/pkgs/data/fonts/spleen/default.nix
@@ -1,23 +1,25 @@
-{ stdenv, fetchurl, mkfontdir, mkfontscale }:
+{ lib, fetchurl }:
 
-stdenv.mkDerivation rec {
+let
   pname = "spleen";
   version = "1.0.4";
+in fetchurl rec {
+  name = "${pname}-${version}";
+  url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
 
-  src = fetchurl {
-    url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
-    sha256 = "1x62a5ygn3rpgzbaacz64rp8mn7saymdnxci4l3xasvsjjp60s3g";
-  };
-
-  buildPhase = "gzip -n9 *.pcf";
-  installPhase = ''
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     d="$out/share/fonts/X11/misc/spleen"
+    gzip -n9 *.pcf
     install -Dm644 *.pcf.gz  -t $d
     install -Dm644 *.bdf -t $d
     install -m644 fonts.alias-spleen $d/fonts.alias
   '';
+  sha256 = "0jab55h08gy7gpyxqfrfj30iinmknpllh3dp5g7ck5q3qfgdzh7m";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Monospaced bitmap fonts";
     homepage = https://www.cambus.net/spleen-monospaced-bitmap-fonts;
     license = licenses.bsd2;
diff --git a/pkgs/data/fonts/stix-otf/default.nix b/pkgs/data/fonts/stix-otf/default.nix
index 1ae85da3f7f..f5d15439079 100644
--- a/pkgs/data/fonts/stix-otf/default.nix
+++ b/pkgs/data/fonts/stix-otf/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1.1";
 in fetchzip rec {
   name = "stix-otf-${version}";
 
-  url = "mirror://sourceforge/stixfonts/STIXv${version}-word.zip";
+  url = "http://ftp.fi.muni.cz/pub/linux/gentoo/distfiles/STIXv${version}-word.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "04d4qxq3i9fyapsmxk6d9v1xirjam8c74fyxs6n24d3gf2945zmw";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.stixfonts.org/;
     description = "Fonts for Scientific and Technical Information eXchange";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/stix-two/default.nix b/pkgs/data/fonts/stix-two/default.nix
index f535c0d7e7b..1d5ed37767c 100644
--- a/pkgs/data/fonts/stix-two/default.nix
+++ b/pkgs/data/fonts/stix-two/default.nix
@@ -5,11 +5,11 @@ let
 in fetchzip {
   name = "stix-two-${version}";
 
-  url = "mirror://sourceforge/stixfonts/Current%20Release/STIXv${version}.zip";
+  url = "https://github.com/stipub/stixfonts/archive/${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile '*/OTF/*.otf' -d $out/share/fonts/opentype
   '';
 
   sha256 = "19i30d2xjk52bjj7xva1hnlyh58yd5phas1njcc8ldcz87a1lhql";
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index 7652f593db4..bfc66a77207 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.37";
@@ -11,7 +11,7 @@ in fetchzip rec {
     mkdir -p $out/share/fonts/truetype/
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/
   '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Font for programmers and command line users";
     homepage = https://www.kutilek.de/sudo-font/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/tamsyn/default.nix b/pkgs/data/fonts/tamsyn/default.nix
index 91198408d8d..380024e7e1a 100644
--- a/pkgs/data/fonts/tamsyn/default.nix
+++ b/pkgs/data/fonts/tamsyn/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, mkfontdir, mkfontscale }:
 
 let
-  version = "1.11"; 
+  version = "1.11";
 in stdenv.mkDerivation {
   pname = "tamsyn-font";
   inherit version;
@@ -22,7 +22,7 @@ in stdenv.mkDerivation {
     fontDir="$out/share/fonts/tamsyn"
     mkdir -p "$fontDir"
     mv *.pcf "$fontDir"
-    mv *.psf.gz "$fontDir" 
+    mv *.psf.gz "$fontDir"
 
     cd "$fontDir"
     mkfontdir
@@ -38,13 +38,12 @@ in stdenv.mkDerivation {
     longDescription = ''Tamsyn is a monospace bitmap font, primarily aimed at
     programmers. It was derived from Gilles Boccon-Gibod's MonteCarlo. Tamsyn
     font was further inspired by Gohufont, Terminus, Dina, Proggy, Fixedsys, and
-    Consolas. 
+    Consolas.
     '';
     homepage = http://www.fial.com/~scott/tamsyn-font/;
     downloadPage = http://www.fial.com/~scott/tamsyn-font/download;
     license = licenses.free;
     maintainers = [ maintainers.rps ];
-    platforms = platforms.linux;
   };
 }
 
diff --git a/pkgs/data/fonts/tempora-lgc/default.nix b/pkgs/data/fonts/tempora-lgc/default.nix
index 1cab3da200e..f06a5bfee27 100644
--- a/pkgs/data/fonts/tempora-lgc/default.nix
+++ b/pkgs/data/fonts/tempora-lgc/default.nix
@@ -38,6 +38,5 @@ stdenv.mkDerivation {
     description = ''Tempora font'';
     license = stdenv.lib.licenses.gpl2 ;
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/tenderness/default.nix b/pkgs/data/fonts/tenderness/default.nix
index 29682cc1299..958af414ff0 100644
--- a/pkgs/data/fonts/tenderness/default.nix
+++ b/pkgs/data/fonts/tenderness/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Serif font designed by Sora Sagano with old-style figures";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/terminus-font-ttf/default.nix b/pkgs/data/fonts/terminus-font-ttf/default.nix
index 27abb72e124..211cc73cc9d 100644
--- a/pkgs/data/fonts/terminus-font-ttf/default.nix
+++ b/pkgs/data/fonts/terminus-font-ttf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "4.47.0";
@@ -20,7 +20,7 @@ in fetchzip rec {
 
   sha256 = "1mnx3vlnl0r15yzsa4zb9qqab4hpi603gdwhlbw960wg03i3xn8z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A clean fixed width TTF font";
     longDescription = ''
       Monospaced bitmap font designed for long work with computers
@@ -29,6 +29,5 @@ in fetchzip rec {
     homepage = http://files.ax86.net/terminus-ttf;
     license = licenses.ofl;
     maintainers = with maintainers; [ okasu ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/terminus-font/default.nix b/pkgs/data/fonts/terminus-font/default.nix
index 2221f6bc6f5..4198fe2cbe6 100644
--- a/pkgs/data/fonts/terminus-font/default.nix
+++ b/pkgs/data/fonts/terminus-font/default.nix
@@ -37,6 +37,5 @@ stdenv.mkDerivation rec {
     homepage = http://terminus-font.sourceforge.net/;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ astsmtl ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/tewi/default.nix b/pkgs/data/fonts/tewi/default.nix
index 32d859bf53b..fbc29cdf5fb 100644
--- a/pkgs/data/fonts/tewi/default.nix
+++ b/pkgs/data/fonts/tewi/default.nix
@@ -46,6 +46,5 @@ stdenv.mkDerivation rec {
       url = "https://www.gnu.org/licenses/gpl-faq.html#FontException";
     };
     maintainers = [ maintainers.fro_ozen ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/tex-gyre-math/default.nix b/pkgs/data/fonts/tex-gyre-math/default.nix
index 3f9726ee094..8e1d2743174 100644
--- a/pkgs/data/fonts/tex-gyre-math/default.nix
+++ b/pkgs/data/fonts/tex-gyre-math/default.nix
@@ -28,32 +28,30 @@ let
     };
   };
 
-  mkVariant = variant: current:
-    let dotless_version = builtins.replaceStrings ["."] [""] current.version; in
+  mkVariant = variant: {displayName, version, sha256, outputHash}:
+    let dotless_version = builtins.replaceStrings ["."] [""] version; in
     stdenv.mkDerivation rec {
-      name = "tex-gyre-${variant}-math-${current.version}";
-      version = "${current.version}";
+      name = "tex-gyre-${variant}-math-${version}";
+      inherit version;
 
       src = fetchzip {
-        url = "www.gust.org.pl/projects/e-foundry/tg-math/download/texgyre${variant}-math-${dotless_version}.zip";
-        sha256 = current.sha256;
+        url = "http://www.gust.org.pl/projects/e-foundry/tg-math/download/texgyre${variant}-math-${dotless_version}.zip";
+        inherit sha256;
       };
 
       installPhase = ''
-        mkdir -p $out/share/fonts/opentype/
-        mkdir -p $out/share/doc/${name}/
-        cp -v opentype/*.otf $out/share/fonts/opentype/
-        cp -v doc/*.txt $out/share/doc/${name}/
+        install -m444 -Dt $out/share/fonts/opentype opentype/*.otf
+        install -m444 -Dt $out/share/doc/${name}    doc/*.txt
       '';
 
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
-      outputHash = current.outputHash;
+      inherit outputHash;
 
       meta = with stdenv.lib; {
         longDescription = ''
-          TeX Gyre ${current.displayName} Math is a math companion for the TeX Gyre
-          ${current.displayName} family of fonts (see
+          TeX Gyre ${displayName} Math is a math companion for the TeX Gyre
+          ${displayName} family of fonts (see
           http://www.gust.org.pl/projects/e-foundry/tex-gyre/) in the OpenType format.
         '';
         homepage = http://www.gust.org.pl/projects/e-foundry/tg-math;
diff --git a/pkgs/data/fonts/tex-gyre/default.nix b/pkgs/data/fonts/tex-gyre/default.nix
index 3229e58506d..7e55a70c71a 100644
--- a/pkgs/data/fonts/tex-gyre/default.nix
+++ b/pkgs/data/fonts/tex-gyre/default.nix
@@ -20,7 +20,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = outputHash;
+    inherit outputHash;
 
     meta = with stdenv.lib; {
       homepage = http://www.gust.org.pl/projects/e-foundry/tex-gyre;
diff --git a/pkgs/data/fonts/theano/default.nix b/pkgs/data/fonts/theano/default.nix
index 2dbe7e720d2..82563205454 100644
--- a/pkgs/data/fonts/theano/default.nix
+++ b/pkgs/data/fonts/theano/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.0";
@@ -16,7 +16,7 @@ in fetchzip rec {
 
   sha256 = "1my1symb7k80ys33iphsxvmf6432wx6vjdnxhzhkgrang1rhx1h8";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/akryukov/theano;
     description = "An old-style font designed from historic samples";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/tipa/default.nix b/pkgs/data/fonts/tipa/default.nix
index 1a4954e6ce4..6cebe2120fe 100644
--- a/pkgs/data/fonts/tipa/default.nix
+++ b/pkgs/data/fonts/tipa/default.nix
@@ -22,7 +22,6 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Phonetic font for TeX";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/tlwg/default.nix b/pkgs/data/fonts/tlwg/default.nix
index 90f1b1da908..494f48fd36e 100644
--- a/pkgs/data/fonts/tlwg/default.nix
+++ b/pkgs/data/fonts/tlwg/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
     description = "A collection of Thai scalable fonts available under free licenses";
     homepage = https://linux.thai.net/projects/fonts-tlwg;
     license = with licenses; [ gpl2 publicDomain lppl13c free ];
-    platforms = platforms.unix;
     maintainers = [ maintainers.yrashk ];
   };
 }
diff --git a/pkgs/data/fonts/ttf-bitstream-vera/default.nix b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
index a4d479ea33c..a732b576ffd 100644
--- a/pkgs/data/fonts/ttf-bitstream-vera/default.nix
+++ b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "ttf-bitstream-vera-1.10";
@@ -7,14 +7,11 @@ fetchzip {
 
   postFetch = ''
     tar -xjf $downloadedFile --strip-components=1
-    fontDir=$out/share/fonts/truetype
-    mkdir -p $fontDir
-    cp *.ttf $fontDir
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
   '';
 
   sha256 = "179hal4yi3367jg8rsvqx6h2w4s0kn9zzrv8c47sslyg28g39s4m";
 
   meta = {
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/ttf-envy-code-r/default.nix b/pkgs/data/fonts/ttf-envy-code-r/default.nix
index 2c58f197f18..024e1acd434 100644
--- a/pkgs/data/fonts/ttf-envy-code-r/default.nix
+++ b/pkgs/data/fonts/ttf-envy-code-r/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   pname = "ttf-envy-code-r";
@@ -16,11 +16,10 @@ in fetchzip {
 
   sha256 = "0x0r07nax68cmz7490x2crzzgdg4j8fg63wppcmjqm0230bggq2z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://damieng.com/blog/tag/envy-code-r;
     description = "Free scalable coding font by DamienG";
     license = licenses.unfree;
-    platforms = platforms.unix;
     maintainers = [ maintainers.lyt ];
   };
 }
diff --git a/pkgs/data/fonts/twemoji-color-font/default.nix b/pkgs/data/fonts/twemoji-color-font/default.nix
index 52d11bfd622..a9bf3720c07 100644
--- a/pkgs/data/fonts/twemoji-color-font/default.nix
+++ b/pkgs/data/fonts/twemoji-color-font/default.nix
@@ -38,6 +38,5 @@ stdenv.mkDerivation rec {
     downloadPage = "https://github.com/eosrei/twemoji-color-font/releases";
     license = with licenses; [ cc-by-40 mit ];
     maintainers = [ maintainers.fgaz ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/ubuntu-font-family/default.nix b/pkgs/data/fonts/ubuntu-font-family/default.nix
index e78f86fede4..5f072f90f05 100644
--- a/pkgs/data/fonts/ubuntu-font-family/default.nix
+++ b/pkgs/data/fonts/ubuntu-font-family/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "ubuntu-font-family-0.83";
 
-  url = "http://font.ubuntu.com/download/${name}.zip";
+  url = "https://assets.ubuntu.com/v1/fad7939b-ubuntu-font-family-0.83.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -19,8 +19,8 @@ fetchzip rec {
     contemporary style and contains characteristics unique to
     the Ubuntu brand that convey a precise, reliable and free attitude.";
     homepage = http://font.ubuntu.com/;
-    license = stdenv.lib.licenses.free;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.antono ];
+    license = lib.licenses.free;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.antono ];
   };
 }
diff --git a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
index f8df39c9565..35551e929e6 100644
--- a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
+++ b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -13,10 +13,9 @@ fetchzip rec {
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The Ultimate Oldschool PC Font Pack (TTF Fonts)";
     homepage = "http://int10h.org/oldschool-pc-fonts/";
-    platforms = platforms.unix;
     license = licenses.cc-by-sa-40;
     maintainers = [ maintainers.endgame ];
   };
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index e61e582d742..c98936b8096 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "undefined-medium-1.0";
@@ -10,9 +10,9 @@ fetchzip rec {
     unzip -j $downloadedFile ${name}/fonts/otf/\*.otf -d $out/share/fonts/opentype
   '';
 
-  sha256 = "0v3p1g9f1c0d6b9lhrvm1grzivm7ddk7dvn96zl5hdzr2y60y1rw";
+  sha256 = "1wa04jzbffshwcxm705yb5wja8wakn8j7fvim1mlih2z1sqw0njk";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://undefined-medium.com/;
     description = "A pixel grid-based monospace typeface";
     longDescription = ''
diff --git a/pkgs/data/fonts/uni-vga/default.nix b/pkgs/data/fonts/uni-vga/default.nix
index 2a13824b36f..cd719a62d99 100644
--- a/pkgs/data/fonts/uni-vga/default.nix
+++ b/pkgs/data/fonts/uni-vga/default.nix
@@ -20,13 +20,12 @@ stdenv.mkDerivation {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  sha256 = "0rfly7r6blr2ykxlv0f6my2w41vvxcw85chspljd2p1fxlr28jd7";
+  outputHash = "0rfly7r6blr2ykxlv0f6my2w41vvxcw85chspljd2p1fxlr28jd7";
 
   meta = {
     description = "Unicode VGA font";
     maintainers = [stdenv.lib.maintainers.ftrvxmtrx];
     homepage = http://www.inp.nsk.su/~bolkhov/files/fonts/univga/;
     license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index b167a7802d1..d495efc79ec 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "unifont-${version}";
-  version = "12.0.01";
+  version = "12.1.01";
 
   ttf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.ttf";
-    sha256 = "191vgddv5fksg7g01q692nfcb02ks2y28fi9fv8aghvs36q4iana";
+    sha256 = "05knv3vlnk8ahaybwz6r95d3a1h7h7q9ll6ij2jl7zgjhcx4zy5d";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.pcf.gz";
-    sha256 = "14xbrsdrnllly8h2afan3b4v486vd4y8iff8zqmcfliw0cipm8v4";
+    sha256 = "0q7dlnfzk49m4pgf2s7jv05jysa6sfxx3w0y17yis9j7g18lyw1b";
   };
 
   nativeBuildInputs = [ mkfontscale mkfontdir ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "1jccbz7wyyk7rpyapgsppcgakgpm1l9fqqxs7fg9naav7i0nzzpg";
+  outputHash = "0sgdr9dma4hkda3siydfvjrnzrpri8r7iqs2zqf77z9n4zn90qp5";
 
   meta = with stdenv.lib; {
     description = "Unicode font for Base Multilingual Plane";
diff --git a/pkgs/data/fonts/unifont_upper/default.nix b/pkgs/data/fonts/unifont_upper/default.nix
index d94a2cc0242..5cccc1eddc6 100644
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
-  version = "12.0.01";
+  version = "12.1.01";
 in fetchzip rec {
   name = "unifont_upper-${version}";
 
@@ -9,9 +9,9 @@ in fetchzip rec {
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";
 
-  sha256 = "1mmbndyi91fcdj7ykk5y7rypmm5jf2zf5pp5ab8hq3aa9y7invw3";
+  sha256 = "11b14ka2w16vssxdhgq7k9bx7xx0sr36hfi2vzyimmaibasi1r74";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
     homepage = http://unifoundry.com/unifont.html;
 
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index 408bd9a9264..d004e75571b 100755
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
@@ -1,23 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "vazir-fonts";
+let
+  pname = "vazir-fonts";
   version = "19.2.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "vazir-font";
-    rev = "v${version}";
-    sha256 = "0p96y4q20nhpv7hxca6rncfcb14iqy2vacv0xl55wkwqkm4wvzgr";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/vazir-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/vazir-fonts
+  owner = "rastikerdar";
+  repo = "vazir-font";
+  rev = "v${version}";
 
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/vazir-fonts {} \;
   '';
+  sha256 = "008h095rjrcjhz9h02v6cf3gv64khj21lii4zffgpdlmvfs29f8l";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/vazir-font;
     description = "A Persian (Farsi) Font - قلم (فونت) فارسی وزیر";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/vdrsymbols/default.nix b/pkgs/data/fonts/vdrsymbols/default.nix
index d3373a64c49..01a4072099a 100644
--- a/pkgs/data/fonts/vdrsymbols/default.nix
+++ b/pkgs/data/fonts/vdrsymbols/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "vdrsymbols-20100612";
@@ -12,7 +12,7 @@ fetchzip rec {
     install -Dm444 -t "$out/share/fonts/truetype" */*.ttf
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "DejaVu fonts with additional symbols used by VDR";
     homepage = http://andreas.vdr-developer.org/fonts/;
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/vegur/default.nix b/pkgs/data/fonts/vegur/default.nix
index 4bf28782a8a..a269f17bf0e 100644
--- a/pkgs/data/fonts/vegur/default.nix
+++ b/pkgs/data/fonts/vegur/default.nix
@@ -1,29 +1,22 @@
-{ stdenv, rpmextract, fetchurl, unzip }:
+{ lib, buildPackages, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
   version = "0.701";
+in fetchzip {
   name = "vegur-font-${version}";
 
   # Upstream doesn't version their URLs.
   # http://dotcolon.net/font/vegur/ → http://dotcolon.net/DL/font/vegur.zip
-  src = fetchurl {
-    url = "http://download.opensuse.org/repositories/M17N:/fonts/SLE_12_SP3/src/dotcolon-vegur-fonts-0.701-1.4.src.rpm";
-    sha256 = "0ra3fds3b352rpzn0015km539c3l2ik2lqd5x6fr65ss9fg2xn34";
-  };
-
-  nativeBuildInputs = [ rpmextract unzip ];
+  url = "http://download.opensuse.org/repositories/M17N:/fonts/SLE_12_SP3/src/dotcolon-vegur-fonts-0.701-1.4.src.rpm";
 
-  unpackPhase = ''
-    rpmextract $src
+  postFetch = ''
+    ${buildPackages.rpmextract}/bin/rpmextract $downloadedFile
     unzip vegur.zip
+    install -m444 -Dt $out/share/fonts/Vegur *.otf
   '';
+  sha256 = "0iisi2scq72lyj7pc1f36fhfjnm676n5byl4zaavhbxpdrbc6d1v";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/Vegur
-    cp *.otf $out/share/fonts/Vegur
-  '';
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://dotcolon.net/font/vegur/;
     description = "A humanist sans serif font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/vista-fonts-chs/default.nix b/pkgs/data/fonts/vista-fonts-chs/default.nix
index e9a3282e715..6a7cc71133a 100644
--- a/pkgs/data/fonts/vista-fonts-chs/default.nix
+++ b/pkgs/data/fonts/vista-fonts-chs/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip, cabextract}:
+{ lib, fetchzip, buildPackages }:
 
 # Modified from vista-fonts
 
@@ -8,7 +8,7 @@ fetchzip {
   url = http://download.microsoft.com/download/d/6/e/d6e2ff26-5821-4f35-a18b-78c963b1535d/VistaFont_CHS.EXE;
 
   postFetch = ''
-    ${cabextract}/bin/cabextract --lowercase --filter '*.TTF' $downloadedFile
+    ${buildPackages.cabextract}/bin/cabextract --lowercase --filter '*.TTF' $downloadedFile
 
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
@@ -25,12 +25,12 @@ fetchzip {
   meta = {
     description = "TrueType fonts from Microsoft Windows Vista For Simplified Chinese (Microsoft YaHei)";
     homepage = https://www.microsoft.com/typography/fonts/family.aspx?FID=350;
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.ChengCat ];
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.ChengCat ];
 
     # Set a non-zero priority to allow easy overriding of the
     # fontconfig configuration files.
     priority = 5;
-    platforms = stdenv.lib.platforms.all;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/vista-fonts/default.nix b/pkgs/data/fonts/vista-fonts/default.nix
index 65fa3fb81ab..e8784d90e7f 100644
--- a/pkgs/data/fonts/vista-fonts/default.nix
+++ b/pkgs/data/fonts/vista-fonts/default.nix
@@ -31,6 +31,6 @@ fetchzip {
     # Set a non-zero priority to allow easy overriding of the
     # fontconfig configuration files.
     priority = 5;
-    platforms = stdenv.lib.platforms.unix;
+    broken = true; # source url is 404
   };
 }
diff --git a/pkgs/data/fonts/weather-icons/default.nix b/pkgs/data/fonts/weather-icons/default.nix
index 8d818d21923..17227367120 100644
--- a/pkgs/data/fonts/weather-icons/default.nix
+++ b/pkgs/data/fonts/weather-icons/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.0.10";
-in fetchzip rec {
+in fetchzip {
   name = "weather-icons-${version}";
 
   url = "https://github.com/erikflowers/weather-icons/archive/${version}.zip";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "10zny9987wybq55sm803hrjkp33dq1lgmnxc15kssr8yb81g6qrl";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Weather Icons";
     longDescription = ''
       Weather Icons is the only icon font and CSS with 222 weather themed icons,
diff --git a/pkgs/data/fonts/wqy-microhei/default.nix b/pkgs/data/fonts/wqy-microhei/default.nix
index 038f0316940..dc87e6b634f 100644
--- a/pkgs/data/fonts/wqy-microhei/default.nix
+++ b/pkgs/data/fonts/wqy-microhei/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "wqy-microhei-0.2.0-beta";
@@ -15,9 +15,9 @@ fetchzip rec {
   meta = {
     description = "A (mainly) Chinese Unicode font";
     homepage = http://wenq.org;
-    license = stdenv.lib.licenses.asl20;
-    maintainers = [ stdenv.lib.maintainers.pkmx ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.pkmx ];
+    platforms = lib.platforms.all;
   };
 }
 
diff --git a/pkgs/data/fonts/wqy-zenhei/default.nix b/pkgs/data/fonts/wqy-zenhei/default.nix
index 9718763d004..7df1e5aeb2a 100644
--- a/pkgs/data/fonts/wqy-zenhei/default.nix
+++ b/pkgs/data/fonts/wqy-zenhei/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.9.45";
@@ -18,8 +18,8 @@ in fetchzip rec {
   meta = {
     description = "A (mainly) Chinese Unicode font";
     homepage = http://wenq.org;
-    license = stdenv.lib.licenses.gpl2; # with font embedding exceptions
-    maintainers = [ stdenv.lib.maintainers.pkmx ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.gpl2; # with font embedding exceptions
+    maintainers = [ lib.maintainers.pkmx ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/xkcd-font/default.nix b/pkgs/data/fonts/xkcd-font/default.nix
index 9aa664fd289..0e996da2fc7 100644
--- a/pkgs/data/fonts/xkcd-font/default.nix
+++ b/pkgs/data/fonts/xkcd-font/default.nix
@@ -1,24 +1,23 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "xkcd-font";
   version = "unstable-2017-08-24";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "ipython";
-    repo = pname;
-    rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
-    sha256 = "01wpfc1yp93b37r472mx2b459il5gywnv5sl7pp9afpycb3i4f6l";
-  };
-
-  phases = [ "unpackPhase" "installPhase" ];
+  owner = "ipython";
+  repo = pname;
+  rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
 
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     install -Dm444 -t $out/share/fonts/opentype/ xkcd/build/xkcd.otf
     install -Dm444 -t $out/share/fonts/truetype/ xkcd-script/font/xkcd-script.ttf
   '';
+  sha256 = "0xhwa53aiz20763jb9nvbr2zq9k6jl69p07dc4b0apwrrwz0jfr1";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The xkcd font";
     homepage = https://github.com/ipython/xkcd-font;
     license = licenses.cc-by-nc-30;
diff --git a/pkgs/data/fonts/yanone-kaffeesatz/default.nix b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
index 026bb2d2244..e713f4d64a3 100644
--- a/pkgs/data/fonts/yanone-kaffeesatz/default.nix
+++ b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "yanone-kaffeesatz-2004";
@@ -14,9 +14,9 @@ fetchzip {
 
   meta = {
     description = "The free font classic";
-    maintainers = with stdenv.lib.maintainers; [ mt-caret ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ mt-caret ];
+    platforms = with lib.platforms; all;
     homepage = https://yanone.de/fonts/kaffeesatz/;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/zilla-slab/default.nix b/pkgs/data/fonts/zilla-slab/default.nix
index d77d6d8b301..369fb53e6ab 100644
--- a/pkgs/data/fonts/zilla-slab/default.nix
+++ b/pkgs/data/fonts/zilla-slab/default.nix
@@ -1,8 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.002";
-  hash = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
 in fetchzip {
   name = "zilla-slab-${version}";
 
@@ -12,9 +11,9 @@ in fetchzip {
     mkdir -p $out/share/fonts/truetype
     cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
   '';
-  sha256 = hash;
+  sha256 = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/mozilla/zilla-slab;
     description = "Zilla Slab fonts";
     longDescription = ''
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index da99fb68b85..8920c401882 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.32.1";
+  version = "3.32.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0jb8d2a4kzz7an7d3db8mfpvhb6r1wrp8dk11vpa3jby60cxbbyd";
+    sha256 = "1jdk3az797kznkg40nbxb3ddyx8s6favzxlc4vr840zxcl84k9vy";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/ghc/8.6.4.nix b/pkgs/development/compilers/ghc/8.6.4.nix
index 640709aba1b..54c53691574 100644
--- a/pkgs/development/compilers/ghc/8.6.4.nix
+++ b/pkgs/development/compilers/ghc/8.6.4.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.6.5.nix b/pkgs/development/compilers/ghc/8.6.5.nix
index e891ff42ff6..bc45540036d 100644
--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.8.1.nix b/pkgs/development/compilers/ghc/8.8.1.nix
index 9772d045b76..ad2d64866f8 100644
--- a/pkgs/development/compilers/ghc/8.8.1.nix
+++ b/pkgs/development/compilers/ghc/8.8.1.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 88b273500dc..46d8dfafd0f 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -6,7 +6,7 @@
 
 , libiconv ? null, ncurses
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -29,7 +29,8 @@
 , version ? "8.7.20190115"
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index a697aac5b8f..f58871f1d7c 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
     sed -i 's,"$.LLVM_LIBRARY_DIR.",${llvm}/lib ${clang-unwrapped}/lib,' \
       cmake/modules/LLDBStandalone.cmake
+    sed -i -e 's,message(SEND_ERROR "Cannot find debugserver on system."),,' \
+           -e 's,string(STRIP ''${XCODE_DEV_DIR} XCODE_DEV_DIR),,' \
+           tools/debugserver/source/CMakeLists.txt
   '';
 
   nativeBuildInputs = [ cmake python which swig ];
@@ -36,8 +39,11 @@ stdenv.mkDerivation {
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
+
   cmakeFlags = [
     "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+    "-DSKIP_DEBUGSERVER=ON"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch b/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
deleted file mode 100644
index 779391fc62a..00000000000
--- a/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From f3db284516105fd30b5513a5528104574a7b8545 Mon Sep 17 00:00:00 2001
-From: Samuel Dionne-Riel <samuel@dionne-riel.com>
-Date: Thu, 9 Aug 2018 19:07:45 -0400
-Subject: [PATCH] Disables `IO#isatty` test for sandboxed builds.
-
----
- mrbgems/mruby-io/test/io.rb | 13 -------------
- 1 file changed, 13 deletions(-)
-
-diff --git a/mrbgems/mruby-io/test/io.rb b/mrbgems/mruby-io/test/io.rb
-index e06b1499..e8a54736 100644
---- a/mrbgems/mruby-io/test/io.rb
-+++ b/mrbgems/mruby-io/test/io.rb
-@@ -342,19 +342,6 @@ assert('IO#_read_buf') do
-   io.closed?
- end
- 
--assert('IO#isatty') do
--  skip "isatty is not supported on this platform" if MRubyIOTestUtil.win?
--  f1 = File.open("/dev/tty")
--  f2 = File.open($mrbtest_io_rfname)
--
--  assert_true  f1.isatty
--  assert_false f2.isatty
--
--  f1.close
--  f2.close
--  true
--end
--
- assert('IO#pos=, IO#seek') do
-   fd = IO.sysopen $mrbtest_io_rfname
-   io = IO.new fd
--- 
-2.16.4
-
diff --git a/pkgs/development/compilers/mruby/default.nix b/pkgs/development/compilers/mruby/default.nix
index cfc1f00a803..03f3d56fd93 100644
--- a/pkgs/development/compilers/mruby/default.nix
+++ b/pkgs/development/compilers/mruby/default.nix
@@ -1,20 +1,16 @@
 { stdenv, ruby, bison, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "mruby-${version}";
-  version = "2.0.0";
+  pname = "mruby";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner   = "mruby";
     repo    = "mruby";
     rev     = version;
-    sha256  = "1r6w1asjshff43ymdwa6xmrkggza99mi2kw88k7ic6ag2j81hcj5";
+    sha256  = "1zm2d5kj9fnfx8ifj8ysrrr838ipwmvz35byzjhprakrg64911p9";
   };
 
-  patches = [
-    ./0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
-  ];
-
   nativeBuildInputs = [ ruby bison ];
 
   # Necessary so it uses `gcc` instead of `ld` for linking.
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
index abf2760075b..dc3071e5fab 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -41,8 +41,30 @@ self: super: {
   unix = null;
   xhtml = null;
 
-  # Use our native version of the Cabal library.
-  cabal-install = (doJailbreak super.cabal-install).overrideScope (self: super: { Cabal = null; });
+  # Use the current git version of cabal-install.
+  cabal-install = overrideCabal (super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal-git; })) (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/cabal-install";
+    jailbreak = true;
+  });
+  Cabal-git = overrideCabal super.Cabal_2_4_1_0 (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/Cabal";
+  });
 
   # Ignore overly restrictive upper version bounds.
   async = doJailbreak super.async;
@@ -56,10 +78,12 @@ self: super: {
   lucid = doJailbreak super.lucid;
   parallel = doJailbreak super.parallel;
   quickcheck-instances = doJailbreak super.quickcheck-instances;
+  setlocale = doJailbreak super.setlocale;
   split = doJailbreak super.split;
   tasty-expected-failure = doJailbreak super.tasty-expected-failure;
   test-framework = doJailbreak super.test-framework;
   th-lift = self.th-lift_0_8_0_1;
+  hledger-lib = doJailbreak super.hledger-lib;  # base >=4.8 && <4.13, easytest >=0.2.1 && <0.3
 
   # These packages don't work and need patching and/or an update.
   primitive = overrideSrc (doJailbreak super.primitive) {
@@ -160,9 +184,21 @@ self: super: {
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/attoparsec-0.13.2.2.patch";
     sha256 = "13i1p5g0xzxnv966nlyb77mfmxvg9jzbym1d36h1ajn045yf4igl";
   });
-  aeson = appendPatch super.aeson (pkgs.fetchpatch {
+  aeson = appendPatch (dontCheck super.aeson) (pkgs.fetchpatch {   # the test suite breaks the compiler
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/aeson-1.4.3.0.patch";
     sha256 = "1z6wmsmc682qs3y768r0zx493dxardwbsp0wdc4dsx83c0m5x66f";
   });
+  cassava = appendPatch super.cassava (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/cassava-0.5.1.0.patch";
+    sha256 = "11scwwjp94si90vb8v5yr291g9qwv5l223z8y0g0lc63932bp63g";
+  });
+  shakespeare = appendPatch super.shakespeare (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/shakespeare-2.0.20.patch";
+    sha256 = "1dgx41ylahj4wk8r422aik0d7qdpawdga4gqz905nvlnhqjla58y";
+  });
+  lens = appendPatch (doJailbreak super.lens) (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/lens-4.17.1.patch";
+    sha256 = "0w89ipi6dfkx5vlw4a64hh6fd0bm9hg33mwpghliyyxik5jmilv1";
+  });
 
 }
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 99967aa6724..fe76c581eda 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -3750,6 +3750,7 @@ broken-packages:
   - cparsing
   - CPBrainfuck
   - cpio-conduit
+  - cpkg
   - cplusplus-th
   - cprng-aes-effect
   - cpuperf
@@ -3956,6 +3957,7 @@ broken-packages:
   - dead-simple-json
   - Deadpan-DDP
   - debian
+  - debug
   - debug-me
   - debug-trace-var
   - decepticons
@@ -5083,6 +5085,7 @@ broken-packages:
   - hakismet
   - hakka
   - hako
+  - hakyll
   - hakyll-agda
   - hakyll-blaze-templates
   - hakyll-contrib
@@ -5091,9 +5094,16 @@ broken-packages:
   - hakyll-contrib-hyphenation
   - hakyll-contrib-links
   - hakyll-convert
+  - hakyll-dhall
+  - hakyll-dir-list
+  - hakyll-favicon
   - hakyll-filestore
+  - hakyll-images
   - hakyll-ogmarkup
   - hakyll-R
+  - hakyll-sass
+  - hakyll-series
+  - hakyll-shakespeare
   - hakyll-shortcode
   - hakyll-shortcut-links
   - halberd
@@ -5627,6 +5637,7 @@ broken-packages:
   - hocker
   - hodatime
   - HODE
+  - Hoed
   - hog
   - hogg
   - hoggl
@@ -6335,6 +6346,7 @@ broken-packages:
   - katip-syslog
   - katt
   - kawaii
+  - kazura-queue
   - kd-tree
   - kdesrc-build-extra
   - kdt
@@ -6442,6 +6454,7 @@ broken-packages:
   - language-c-comments
   - language-c-inline
   - language-conf
+  - language-csharp
   - language-css
   - language-dart
   - language-dockerfile
@@ -7470,6 +7483,7 @@ broken-packages:
   - parsec-pratt
   - parseerror-eq
   - parsely
+  - parser-combinators-tests
   - parser-helper
   - parser241
   - parsergen
@@ -8203,6 +8217,7 @@ broken-packages:
   - RNAlien
   - RNAwolf
   - rncryptor
+  - rob
   - robin
   - robots-txt
   - roc-cluster
@@ -8453,6 +8468,7 @@ broken-packages:
   - servant-streaming-docs
   - servant-streaming-server
   - servant-waargonaut
+  - servant-xml
   - servant-zeppelin
   - servant-zeppelin-client
   - servant-zeppelin-server
@@ -9741,6 +9757,7 @@ broken-packages:
   - wiring
   - withdependencies
   - wkt
+  - wkt-geom
   - wl-pprint-ansiterm
   - wl-pprint-terminfo
   - WL500gPControl
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 1be90f902e6..f4dd805568e 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -128,6 +128,26 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system =
+    if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then
+      # darwin.security_tool is broken in Mojave (#45042)
+
+      # We will use the system provided security for now.
+      # Beware this WILL break in sandboxes!
+
+      # TODO(matthewbauer): If someone really needs this to work in sandboxes,
+      # I think we can add a propagatedImpureHost dep here, but I’m hoping to
+      # get a proper fix available soonish.
+      overrideCabal super.x509-system (drv: {
+        postPatch = (drv.postPatch or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+        '';
+      })
+    else super.x509-system;
+
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 41d94bd5309..ddcfa0ff447 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -10169,6 +10169,8 @@ self: {
        testHaskellDepends = [ base process QuickCheck ];
        description = "Lightweight algorithmic debugging";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "HoleyMonoid" = callPackage
@@ -44208,8 +44210,8 @@ self: {
      }:
      mkDerivation {
        pname = "cabal-cache";
-       version = "1.0.0.7";
-       sha256 = "1r1qz3nrh2k4gx6j6iiw3gvcflkl9l5yk81nj0c2snrz8wgsq28b";
+       version = "1.0.0.9";
+       sha256 = "1h7wp30gmggsrjgspsahn6b045njy6c23mhgkmhz6nn5s4wa1hak";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -58088,6 +58090,8 @@ self: {
        testHaskellDepends = [ base hspec hspec-megaparsec megaparsec ];
        description = "Build tool for C";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "cplex-hs" = callPackage
@@ -64785,6 +64789,8 @@ self: {
        ];
        description = "Simple trace-based debugger";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "debug-diff" = callPackage
@@ -66627,6 +66633,8 @@ self: {
        pname = "dhall-bash";
        version = "1.0.20";
        sha256 = "1nqiyvyj0dw1a6shy9bb1qxzjrnh8544hsa2c6rwg2j36f0lk73d";
+       revision = "1";
+       editedCabalFile = "0rld0k17lprd8ibwbk0aan94lbd5ffsx5a5apjgk4d4cs3jchycp";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66696,6 +66704,8 @@ self: {
        pname = "dhall-json";
        version = "1.2.8";
        sha256 = "0s5iygh9rfmhx3v62dnfr55xz60rjvnicrq9ydspy129mhf0zzgd";
+       revision = "1";
+       editedCabalFile = "04gbbjns1vgafvc10zx4vrk130kww0a6c4lcqcmapa8yi7vz9670";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66763,6 +66773,8 @@ self: {
        pname = "dhall-text";
        version = "1.0.17";
        sha256 = "0bs246857r801qnqvh8cb5wm1rplr7grynl4h989i61qz7vcqf53";
+       revision = "1";
+       editedCabalFile = "1avvybk495zngswlnjiqj8nk7iycwzzhxx3cml4w2yhqlic3xx2g";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -92221,12 +92233,13 @@ self: {
          bup curl git gnupg lsof openssh perl rsync wget which
        ];
        preConfigure = "export HOME=$TEMPDIR; patchShebangs .";
-       postBuild = ''
+       installPhase = "make PREFIX=$out BUILDER=: install";
+       checkPhase = ''
          ln -sf dist/build/git-annex/git-annex git-annex
          ln -sf git-annex git-annex-shell
+         export PATH+=":$PWD"
+         git-annex test
        '';
-       installPhase = "make PREFIX=$out BUILDER=: install install-completions";
-       checkPhase = ''PATH+=":$PWD" git-annex test'';
        enableSharedExecutables = false;
        description = "manage files with git, without checking their contents into git";
        license = stdenv.lib.licenses.agpl3;
@@ -99881,6 +99894,19 @@ self: {
        license = stdenv.lib.licenses.gpl3;
      }) {};
 
+  "gw" = callPackage
+    ({ mkDerivation, base, unix }:
+     mkDerivation {
+       pname = "gw";
+       version = "0.1";
+       sha256 = "055pkk3gg74r4yzh3fxq1zvp1fv3i8cd53jscy1b2n3mmzhbzahv";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [ base unix ];
+       description = "ghcWithPackages cmdline util";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
+
   "gyah-bin" = callPackage
     ({ mkDerivation, base, extra, GiveYouAHead }:
      mkDerivation {
@@ -102234,6 +102260,8 @@ self: {
        testToolDepends = [ utillinux ];
        description = "A static website compiler library";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {inherit (pkgs) utillinux;};
 
   "hakyll-R" = callPackage
@@ -102413,6 +102441,8 @@ self: {
        executableHaskellDepends = [ base dhall hakyll ];
        description = "Dhall compiler for Hakyll";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-dir-list" = callPackage
@@ -102427,6 +102457,8 @@ self: {
        ];
        description = "Allow Hakyll to create hierarchical menues from directories";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-elm" = callPackage
@@ -102455,6 +102487,8 @@ self: {
        executableHaskellDepends = [ base hakyll ];
        testHaskellDepends = [ base ];
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-filestore" = callPackage
@@ -102494,6 +102528,8 @@ self: {
        ];
        description = "Hakyll utilities to work with images";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-ogmarkup" = callPackage
@@ -102522,6 +102558,8 @@ self: {
        ];
        description = "Hakyll SASS compiler over hsass";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-series" = callPackage
@@ -102533,6 +102571,8 @@ self: {
        libraryHaskellDepends = [ base containers hakyll ];
        description = "Adds series functionality to hakyll";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shakespeare" = callPackage
@@ -102550,6 +102590,8 @@ self: {
        ];
        description = "Hakyll Hamlet compiler";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shortcode" = callPackage
@@ -119173,6 +119215,29 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {inherit (pkgs) ruby;};
 
+  "hruby_0_3_7" = callPackage
+    ({ mkDerivation, aeson, attoparsec, base, bytestring, Cabal
+     , process, QuickCheck, ruby, scientific, stm, text
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "hruby";
+       version = "0.3.7";
+       sha256 = "1i77gmkggm6l17zr1jrn65rjgh3m47f7wz5j9c715mi2ilr01qfx";
+       setupHaskellDepends = [ base Cabal process ];
+       libraryHaskellDepends = [
+         aeson attoparsec base bytestring scientific stm text
+         unordered-containers vector
+       ];
+       librarySystemDepends = [ ruby ];
+       testHaskellDepends = [
+         aeson attoparsec base QuickCheck text vector
+       ];
+       description = "Embed a Ruby intepreter in your Haskell program !";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {inherit (pkgs) ruby;};
+
   "hs-GeoIP" = callPackage
     ({ mkDerivation, base, bytestring, deepseq, GeoIP }:
      mkDerivation {
@@ -137709,6 +137774,8 @@ self: {
        ];
        description = "Fast concurrent queues much inspired by unagi-chan";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "kbq-gu" = callPackage
@@ -140522,6 +140589,8 @@ self: {
        libraryToolDepends = [ alex ];
        description = "C# source code manipulation";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "language-css" = callPackage
@@ -172143,6 +172212,8 @@ self: {
        testToolDepends = [ hspec-discover ];
        description = "Test suite of parser-combinators";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "parser-helper" = callPackage
@@ -192469,12 +192540,16 @@ self: {
      }) {};
 
   "relation" = callPackage
-    ({ mkDerivation, array, base, containers, groom }:
+    ({ mkDerivation, base, containers, hedgehog, hspec, hspec-discover
+     , hw-hspec-hedgehog
+     }:
      mkDerivation {
        pname = "relation";
-       version = "0.2.1";
-       sha256 = "03h6l8v3ppxbwg9ddgg121yx3i2v4vbcpwrv1vg3mgbw5pwq7x4c";
-       libraryHaskellDepends = [ array base containers groom ];
+       version = "0.4";
+       sha256 = "1jy5m0jih6ik05zagngrskk1ibiiblxsydxgdq6kjx1aa2pqnmqi";
+       libraryHaskellDepends = [ base containers ];
+       testHaskellDepends = [ base hedgehog hspec hw-hspec-hedgehog ];
+       testToolDepends = [ hspec-discover ];
        description = "A data structure representing Relations on Sets";
        license = stdenv.lib.licenses.bsd3;
        hydraPlatforms = stdenv.lib.platforms.none;
@@ -195640,6 +195715,8 @@ self: {
        testHaskellDepends = [ base directory ];
        description = "Simple projects generator";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "robin" = callPackage
@@ -204334,6 +204411,8 @@ self: {
        ];
        description = "Servant support for the XML Content-Type";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "servant-yaml" = callPackage
@@ -223107,6 +223186,22 @@ self: {
        broken = true;
      }) {};
 
+  "tasty-lua" = callPackage
+    ({ mkDerivation, base, bytestring, directory, file-embed, hslua
+     , tasty, tasty-hunit, text
+     }:
+     mkDerivation {
+       pname = "tasty-lua";
+       version = "0.1.0";
+       sha256 = "199zhrd48ixyi32spnm85v0dj6i09sl3rwi42kaxdlxkkmc54i1z";
+       libraryHaskellDepends = [
+         base bytestring file-embed hslua tasty text
+       ];
+       testHaskellDepends = [ base directory hslua tasty tasty-hunit ];
+       description = "Write tests in Lua, integrate into tasty";
+       license = stdenv.lib.licenses.mit;
+     }) {};
+
   "tasty-program" = callPackage
     ({ mkDerivation, base, deepseq, directory, filepath, process, tasty
      }:
@@ -245543,6 +245638,8 @@ self: {
        ];
        description = "A parser of WKT, WKB and eWKB";
        license = stdenv.lib.licenses.asl20;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "wl-pprint" = callPackage
diff --git a/pkgs/development/libraries/alkimia/default.nix b/pkgs/development/libraries/alkimia/default.nix
index 6f4fd09015e..f98c8fa480e 100644
--- a/pkgs/development/libraries/alkimia/default.nix
+++ b/pkgs/development/libraries/alkimia/default.nix
@@ -1,19 +1,20 @@
 { mkDerivation, fetchurl, lib
-, extra-cmake-modules, doxygen, graphviz, qtbase, mpir
+, extra-cmake-modules, doxygen, graphviz, qtbase, qtwebkit, mpir
+, kdelibs4support, plasma-framework, knewstuff, kpackage
 }:
 
 mkDerivation rec {
   name = "alkimia-${version}";
-  version = "7.0.1";
+  version = "8.0.1";
 
   src = fetchurl {
-    url = "mirror://kde/stable/alkimia/${version}/src/${name}.tar.xz";
-    sha256 = "1fri76465058fgsyrmdrc3hj1javz4g10mfzqp5rsj7qncjr1i22";
+    url = "mirror://kde/stable/alkimia/${version}/${name}.tar.xz";
+    sha256 = "059i6vn36sdq5zn2vqzh4asvvgdgs7n478nk9phvb5gdys01fq7m";
   };
 
   nativeBuildInputs = [ extra-cmake-modules doxygen graphviz ];
 
-  buildInputs = [ qtbase ];
+  buildInputs = [ qtbase qtwebkit kdelibs4support plasma-framework knewstuff kpackage ];
   propagatedBuildInputs = [ mpir ];
 
   meta = {
diff --git a/pkgs/development/libraries/ctl/default.nix b/pkgs/development/libraries/ctl/default.nix
index ac6c9657dde..71e30104476 100644
--- a/pkgs/development/libraries/ctl/default.nix
+++ b/pkgs/development/libraries/ctl/default.nix
@@ -1,22 +1,31 @@
-{ stdenv, callPackage, cmake, pkgconfig, ilmbase, libtiff, openexr }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, pkgconfig, ilmbase, libtiff, openexr }:
 
-let
-  source = callPackage ./source.nix { };
-in
-stdenv.mkDerivation {
-  name = "ctl-${source.version}";
+stdenv.mkDerivation rec {
+  pname = "ctl";
+  version = "1.5.2";
 
-  src = source.src;
+  src = fetchFromGitHub {
+    owner = "ampas";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "ctl-1.5.2-ilm_230.patch";
+      url = "https://src.fedoraproject.org/rpms/CTL/raw/9d7c15a91bccdc0a9485d463bf2789be72e6b17d/f/ctl-1.5.2-ilm_230.patch";
+      sha256 = "0mdx7llwrm0q8ai53zhyxi40i9h5s339dbkqpqv30yzi2xpnfj3d";
+    })
+  ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libtiff ilmbase openexr ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libtiff ilmbase openexr ];
 
   meta = with stdenv.lib; {
     description = "Color Transformation Language";
-    homepage = http://ampasctl.sourceforge.net;
-    license = "A.M.P.A.S";
+    homepage = "https://github.com/ampas/CTL";
+    license = "A.M.P.A.S"; # BSD-derivative, free but GPL incompatible
     platforms = platforms.all;
   };
-
-  passthru.source = source;
 }
diff --git a/pkgs/development/libraries/ctl/source.nix b/pkgs/development/libraries/ctl/source.nix
deleted file mode 100644
index d0cb83c0369..00000000000
--- a/pkgs/development/libraries/ctl/source.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ fetchFromGitHub }:
-rec {
-  version = "1.5.2";
-
-  src = fetchFromGitHub {
-    owner = "ampas";
-    repo = "CTL";
-    rev = "ctl-${version}";
-    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
-  };
-}
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 0f72afe4cc1..9d1751afaf9 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtksourceview-${version}";
-  version = "3.24.10";
+  version = "3.24.11";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtksourceview/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "16ym7jwiki4s1pilwr4incx0yg7ll94f1cajrnpndkxxs36hcm5b";
+    sha256 = "1zbpj283b5ycz767hqz5kdq02wzsga65pp4fykvhg8xj6x50f6v9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index 7f932d52dc4..be3ddfff4c8 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "lombok-1.18.4";
+  name = "lombok-1.18.8";
 
   src = fetchurl {
     url = "https://projectlombok.org/downloads/${name}.jar";
-    sha256 = "0hlpycnmzd71ihn59hzf445dvwky2lkv57jimx91i6v7xcnr5wrr";
+    sha256 = "1z14rc3fh03qvn2xkjrb7ha0hddv3f3vsp781xm336sp4cl9b5h3";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/libraries/libdazzle/default.nix b/pkgs/development/libraries/libdazzle/default.nix
index 59f07202fde..28d9152dcee 100644
--- a/pkgs/development/libraries/libdazzle/default.nix
+++ b/pkgs/development/libraries/libdazzle/default.nix
@@ -2,7 +2,7 @@
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43, glibcLocales, dbus, xvfb_run, glib, gtk3, gnome3 }:
 
 let
-  version = "3.32.1";
+  version = "3.32.2";
   pname = "libdazzle";
 in
 stdenv.mkDerivation {
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdazzle/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0wprqgn480r31pcgmpyk9l6cfvlczfcx10fpqaq9pbn3vjgs3393";
+    sha256 = "0hgi7gnkna9n42nh7p81crrw0jjj22yr8acych60wxh6hzxqsgs1";
   };
 
   nativeBuildInputs = [ ninja meson pkgconfig vala gobject-introspection libxml2 gtk-doc docbook_xsl docbook_xml_dtd_43 glibcLocales dbus xvfb_run ];
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 95860ac9420..bb6402dc428 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -9,11 +9,11 @@ assert postgresSupport -> postgresql != null;
 
 (if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
   pname = "libgda";
-  version = "5.2.8";
+  version = "5.2.9";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0id4my5wh2m6rd7ijqp2azsjdb4l4yjrv3imq71kly00gjc6v1z2";
+    sha256 = "16vxv2qvysh22s8h9h6irx96sacagxkz0i4qgi1wc6ibly6fvjjr";
   };
   configureFlags = with stdenv.lib; [ "--enable-gi-system-install=no" ]
     ++ (optional (mysqlSupport) "--with-mysql=yes")
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
index 8389ba7e3e0..cde422906da 100644
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "linbox";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "0rmk474hvgkggmhxwa5i52wdnbvipx9n8mpsc41j1c96q4v8fl22";
+    sha256 = "11mgj7pkppvzmhx5g6wfnzisk36z00gqzzq9p14hzh5dbdhk3693";
   };
 
   nativeBuildInputs = [
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.lgpl21Plus;
     maintainers = [stdenv.lib.maintainers.timokau];
     platforms = stdenv.lib.platforms.unix;
+    broken = stdenv.isDarwin || stdenv.isAarch64; # https://trac.sagemath.org/ticket/26932#comment:21
     homepage = http://linalg.org/;
   };
 }
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 4c994d596ba..b54f34fbb2c 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "onig-${version}";
-  version = "6.9.1";
+  version = "6.9.2";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "0dbdd9r15fsqn0rimkjwlv8v68v4i1830h0m7dw56b335wwl6bbg";
+    sha256 = "15asc9v6ylal8fwzlnrh673mp62wngxvv9jx7h86vhljjdap6yfc";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 6a882ecd900..89248597f5d 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-mac-universal --enable-cxx" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
+
   propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
   patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/range-v3/default.nix b/pkgs/development/libraries/range-v3/default.nix
index 7fe4b504a99..256b756ed45 100644
--- a/pkgs/development/libraries/range-v3/default.nix
+++ b/pkgs/development/libraries/range-v3/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "range-v3-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ericniebler";
     repo = "range-v3";
     rev = version;
-    sha256 = "1s5gj799aa94nfg3r24whq7ck69g0zypf70w14wx64pgwg0424vf";
+    sha256 = "0fzbpaa4vwlivi417zxm1d6v4lkp5c9f5bd706nn2fmw3zxjj815";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 615ac4fa690..f95ae385ab6 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -2,13 +2,13 @@
 
 with stdenv.lib; stdenv.mkDerivation rec {
   name = "tbb-${version}";
-  version = "2019_U5";
+  version = "2019_U6";
 
   src = fetchFromGitHub {
     owner = "01org";
     repo = "tbb";
     rev = version;
-    sha256 = "0390da1iya2mvn3ribjb1f8yvzsqsf5b16wn6dqbjxcz0crmwlzk";
+    sha256 = "1zbf06l659vq6s5wp3ln96ycwcd42caffan5vilqvqyxqvjljyic";
   };
 
   makeFlags = concatStringsSep " " (
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 5326300a146..56850dcf86e 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a2b83e63b830de3ff01c2992342cfe09f96e410953c85904ee7e301b21fa513";
+    sha256 = "087jk00kv0qsqqspyn015nicvbl627wck3fgx2qhqawvrgqk3xb0";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 84c9b21f933..c32719140ea 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
 , numpy
 , ffmpeg_4
 , libav
@@ -10,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "av";
-  version = "6.1.2";
+  version = "6.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eebbb56eeae650b1fc551f94d51aee39b487bf4df73c39daea186c5d2950650f";
+    sha256 = "1wm33qajxcpl9rn7zfb2pwwqn87idb7ic7h5zwy2hgbpjnh3vc2g";
   };
 
-  checkInputs = [ nose numpy ];
+  checkInputs = [ numpy ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ffmpeg_4 ];
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index 1de465cfec0..405b66ce724 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.11.3";
+  version = "1.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cb03053bfcb96ccef181405b6d3482a5b868f0c7fbaa68b52d25e0071dafd1bc";
+    sha256 = "0i4lfnajz685hlp9m0bjn7s279bv6mm5118b1qmldzqdnvw4s032";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/latexcodec/default.nix b/pkgs/development/python-modules/latexcodec/default.nix
index 785d9f1aa3a..2873c8f9622 100644
--- a/pkgs/development/python-modules/latexcodec/default.nix
+++ b/pkgs/development/python-modules/latexcodec/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "latexcodec";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0s4wdbg0w2l8pj3i0y4510i0s04p8nhxcsa2z41bjsv0k66npb81";
+    sha256 = "0wnp3yqcgx0rpy8dz51vh75lbp2qif67da19zi7m3ca98n887hgb";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index e22c52bb248..222f5137475 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.10.10";
+  version = "8.10.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dabc8cfcff96446b0787ea337739ea286ec3949ec27a4790a9b4587817da5c5f";
+    sha256 = "1rd46dryxkwlha9lfqqwywazlh908ngh6076zz3myhzf8h3dmxnz";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/py-radix/default.nix b/pkgs/development/python-modules/py-radix/default.nix
new file mode 100644
index 00000000000..b06de3a27a7
--- /dev/null
+++ b/pkgs/development/python-modules/py-radix/default.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, coverage
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "py-radix";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "mjschultz";
+    repo = "py-radix";
+    rev = "v${version}";
+    sha256 = "01xyn9lg6laavnzczf5bck1l1c2718ihxx0hvdkclnnxjqhbrqis";
+  };
+
+  doCheck = true;
+  checkInputs = [ coverage nose ];
+
+  meta = with stdenv.lib; {
+    description = "Python radix tree for IPv4 and IPv6 prefix matching";
+    homepage = https://github.com/mjschultz/py-radix;
+    license = with licenses; [ isc bsdOriginal ];
+    maintainers = with maintainers; [ mkg ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 7bc54cb0ffb..713861deae3 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -32,12 +32,25 @@ let
     "test_set_notBefore"
   ];
 
+  # these tests are extremely tightly wed to the exact output of the openssl cli tool,
+  # including exact punctuation.
+  failingOpenSSL_1_1Tests = [
+    "test_dump_certificate"
+    "test_dump_privatekey_text"
+    "test_dump_certificate_request"
+    "test_export_text"
+  ];
+
   disabledTests = [
     # https://github.com/pyca/pyopenssl/issues/692
     # These tests, we disable always.
     "test_set_default_verify_paths"
     "test_fallback_default_verify_paths"
-  ] ++ (optionals (hasPrefix "libressl" openssl.meta.name) failingLibresslTests);
+  ] ++ (
+    optionals (hasPrefix "libressl" openssl.meta.name) failingLibresslTests
+  ) ++ (
+    optionals (versionAtLeast (getVersion openssl.name) "1.1") failingOpenSSL_1_1Tests
+  );
 
   # Compose the final string expression, including the "-k" and the single quotes.
   testExpression = optionalString (disabledTests != [])
diff --git a/pkgs/development/python-modules/python-gnupg/default.nix b/pkgs/development/python-modules/python-gnupg/default.nix
index 1ecf5fe1061..728a353cec7 100644
--- a/pkgs/development/python-modules/python-gnupg/default.nix
+++ b/pkgs/development/python-modules/python-gnupg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, gnupg1 }:
+{ stdenv, buildPythonPackage, fetchPypi, gnupg }:
 
 buildPythonPackage rec {
   pname   = "python-gnupg";
@@ -12,9 +12,9 @@ buildPythonPackage rec {
   # Let's make the library default to our gpg binary
   patchPhase = ''
     substituteInPlace gnupg.py \
-    --replace "gpgbinary='gpg'" "gpgbinary='${gnupg1}/bin/gpg'"
+    --replace "gpgbinary='gpg'" "gpgbinary='${gnupg}/bin/gpg'"
     substituteInPlace test_gnupg.py \
-    --replace "gpgbinary=GPGBINARY" "gpgbinary='${gnupg1}/bin/gpg'" \
+    --replace "gpgbinary=GPGBINARY" "gpgbinary='${gnupg}/bin/gpg'" \
     --replace "test_search_keys" "disabled__test_search_keys"
   '';
 
diff --git a/pkgs/development/python-modules/qdarkstyle/default.nix b/pkgs/development/python-modules/qdarkstyle/default.nix
index 5f8c59584dc..425bb21a687 100644
--- a/pkgs/development/python-modules/qdarkstyle/default.nix
+++ b/pkgs/development/python-modules/qdarkstyle/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "qdarkstyle";
-  version = "2.6.6";
+  version = "2.6.8";
 
   src = fetchPypi {
     inherit version;
     pname = "QDarkStyle";
-    sha256 = "1jbvvg36fnbvpzvg4ns7zx5jj8h1xsqdr05v5m98a0a9r8awdx3m";
+    sha256 = "18l2ynq2x8jd380nr47xy947c3qdmhv8nnxnan03y5d51azm8yh3";
   };
 
   # No tests available
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 941c24033e5..2912ef213c2 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b03n1ixzscm0jw97l4dq5iy4fslnqxq5bb8287xb7n2a1gs26xw";
+    sha256 = "1qqyk5wlaps1m2hb5n2q1gynw2ayqn31dvxwwni4450ygf65arx6";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/pkgs/development/python-modules/qtpy/default.nix b/pkgs/development/python-modules/qtpy/default.nix
index d0bea83ad26..24e607f2849 100644
--- a/pkgs/development/python-modules/qtpy/default.nix
+++ b/pkgs/development/python-modules/qtpy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "QtPy";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjg7farw6mkmrwqcg6ms7j74g8py2msvawddji4wy8yfvql1ifl";
+    sha256 = "17pdn4d77gjjrsq7m1i6dz9px0dfi6wgaqz2v3sa3crl15spawp9";
   };
 
   # no concrete propagatedBuildInputs as multiple backends are supposed
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index 586edd766cd..cefe7dac221 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fd68yaqhpay7jxhyc6xkdrak88wdblxs0phgdkngbakx2yaw2y3";
+    sha256 = "06z9h5vxrvqns3yr4jfrxifw0iqdn6ijlnznpmyi8nc18h8yma2a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/smart_open/default.nix b/pkgs/development/python-modules/smart_open/default.nix
index f3f7acabfd6..9d2c7162719 100644
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3c16477ad7e8f94ab033630ea31993670ad21153172367db1acb143077d501c";
+    sha256 = "029b0ns6q9vl4pyk1w7jp4dvif1mfgr53a58z1p8zipwnhkfwnih";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index 507f7ec49bd..f540cf72877 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,10 +1,10 @@
 { buildPythonPackage, fetchPypi, lib, pythonOlder }:
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.3.4";
+  version = "1.3.5";
   src = fetchPypi{
     inherit pname version;
-    sha256 = "68c362848d9fb71d3c3e5f43c09974a0ae319144634e7a47db62f0f2a54a7fa7";
+    sha256 = "1m7pr6qpana3cvqwiw7mlvrgvmw27ch5mx1592572xhlki8g85ak";
   };
   # Only works with Python 3.3 and newer;
   disabled = pythonOlder "3.3";
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index c80a14063a5..5a3ee3d8cbd 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -110,12 +110,12 @@ in {
   #<generated>
   # DO NOT EDIT! Automatically generated by ./update.py
   radare2 = generic {
-    version_commit = "21276";
-    gittap = "3.4.1";
-    gittip = "da30e593718d5149f2a3d520c7f79fe1c7ca46ef";
-    rev = "3.4.1";
-    version = "3.4.1";
-    sha256 = "02qfj11j8f37hl46m8h4x9pv161glgdr7q3rfhwmq46px9y7f17p";
+    version_commit = "21707";
+    gittap = "3.5.0";
+    gittip = "75cfab37c6cfd0caffb9a90a949f5e60282bbd6c";
+    rev = "3.5.0";
+    version = "3.5.0";
+    sha256 = "03zm74a4vpip4pzj1s3gm2bdihw0iz47w8sxbhjf74074x1ylpzv";
     cs_ver = "4.0.1";
     cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
   };
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 1e29e4b34f0..e106c6962dc 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -153,7 +153,7 @@ stdenv.mkDerivation rec {
       sed -i -e 's/<.*\*>//g' tools/osx/xcode_locator.m
 
       # don't use system installed Xcode to run clang, use Nix clang instead
-      sed -i -e "s;/usr/bin/xcrun clang;${clang}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
+      sed -i -e "s;/usr/bin/xcrun clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
         scripts/bootstrap/compile.sh \
         src/tools/xcode/realpath/BUILD \
         src/tools/xcode/stdredirect/BUILD \
@@ -256,7 +256,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     which
     customBash
-  ] ++ lib.optionals (stdenv.isDarwin) [ cctools clang libcxx CoreFoundation CoreServices Foundation ];
+  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
diff --git a/pkgs/development/tools/build-managers/buck/default.nix b/pkgs/development/tools/build-managers/buck/default.nix
index 832e8e35164..2cbf3a33a09 100644
--- a/pkgs/development/tools/build-managers/buck/default.nix
+++ b/pkgs/development/tools/build-managers/buck/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "buck";
-  version = "2019.01.10.01";
+  version = "2019.05.06.01";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0987s399v4ba2a3crca12vsg9001xcb5drhqi564ninpa5vxamr2";
+    sha256 = "0bcj1g8hmcpdgz3c2sxglxxq1jn1x0p9dk6hml8ajkn4h82kw12y";
   };
 
   patches = [ ./pex-mtime.patch ];
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 5e03474bf10..99692d1ef50 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, makeWrapper
-, coreutils, jdk, rlwrap, gnupg1compat }:
+, coreutils, jdk, rlwrap, gnupg }:
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --replace 'LEIN_JAR=/usr/share/java/leiningen-$LEIN_VERSION-standalone.jar' "LEIN_JAR=$out/share/$JARNAME"
     wrapProgram $out/bin/lein \
       --prefix PATH ":" "${stdenv.lib.makeBinPath [ rlwrap coreutils ]}" \
-      --set LEIN_GPG ${gnupg1compat}/bin/gpg \
+      --set LEIN_GPG ${gnupg}/bin/gpg \
       --set JAVA_CMD ${jdk}/bin/java
   '';
 
diff --git a/pkgs/development/tools/chit/default.nix b/pkgs/development/tools/chit/default.nix
new file mode 100644
index 00000000000..a23a3d45cce
--- /dev/null
+++ b/pkgs/development/tools/chit/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl
+, darwin
+}:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  pname = "chit";
+  version = "0.1.12";
+
+  src = fetchFromGitHub {
+    owner = "peterheesterman";
+    repo = pname;
+    rev = version;
+    sha256 = "17g2p07zhf4n4pjmws0ssfy2mrn0v933ih0vnlr1z2cv9mx8srsl";
+  };
+
+  cargoSha256 = "1jqnnf4jgjpm1i310hda15423nxfw9frgpmc2kbrs66qcsj7avaw";
+
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkgconfig ];
+  buildInputs = []
+  ++ stdenv.lib.optionals stdenv.isLinux [ openssl ]
+  ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ CoreFoundation CoreServices Security ])
+  ;
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Crate help in terminal: A tool for looking up details about rust crates without going to crates.io";
+    longDescription = ''
+      Chit helps answer these questions:
+
+      * Who wrote this crate? What else did they write?
+      * What alternatives are there?
+      * How old is this crate?
+      * What versions are there? When did they come out?
+      * What are the downloads over time?
+      * Should i use this crate?
+      * How mature is it?
+    '';
+    homepage = https://github.com/peterheesterman/chit;
+    license = licenses.mit;
+    maintainers = [ maintainers.lilyball ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/react-native-debugger/default.nix b/pkgs/development/tools/react-native-debugger/default.nix
index 9a421129955..3b6c7940384 100644
--- a/pkgs/development/tools/react-native-debugger/default.nix
+++ b/pkgs/development/tools/react-native-debugger/default.nix
@@ -38,11 +38,11 @@ let
   ];
 in stdenv.mkDerivation rec {
   name = "react-native-debugger-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchurl {
     url = "https://github.com/jhen0409/react-native-debugger/releases/download/v${version}/rn-debugger-linux-x64.zip";
-    sha256 = "0f1wvk1550z4imcs60sv229zllcxpykx4b60bw658idr1xc3c0ix";
+    sha256 = "07mcliy5f3kcqr76izqirqzwb2rwbnl3k1al9dln1izim0lhx06r";
   };
 
   buildInputs = [ unzip ];
diff --git a/pkgs/development/tools/scalafmt/default.nix b/pkgs/development/tools/scalafmt/default.nix
index db3a2af8f5b..a9f8a4cd4b3 100644
--- a/pkgs/development/tools/scalafmt/default.nix
+++ b/pkgs/development/tools/scalafmt/default.nix
@@ -2,7 +2,7 @@
 
 let
   baseName = "scalafmt";
-  version = "2.0.0-RC5";
+  version = "2.0.0-RC7";
   deps = stdenv.mkDerivation {
     name = "${baseName}-deps-${version}";
     buildCommand = ''
@@ -13,13 +13,14 @@ let
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash     = "0y2nja4dj3l7f7m9dxr8xwda8vv27dwj090gfsa78a20vq1d3xxw";
+    outputHash     = "0scz3pp63z6xfj69kvsfr8l3ll9rq95j4xlhlyrzg1vfl1gf41ig";
   };
 in
 stdenv.mkDerivation rec {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index e607fe2ff14..e9ced0e753a 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "wabt-${version}";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner  = "WebAssembly";
     repo   = "wabt";
     rev    = version;
-    sha256 = "0vki02317mbk5f2w9fxyslcrn5rl2sk845rrs318i37wsz6ismp3";
+    sha256 = "0hn88vlqyclpk79v3wg3lrssd9vwhjdgvb41g03jqakygxxgnmp5";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/games/azimuth/default.nix b/pkgs/games/azimuth/default.nix
new file mode 100644
index 00000000000..3370f339fa2
--- /dev/null
+++ b/pkgs/games/azimuth/default.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchFromGitHub, SDL }:
+
+stdenv.mkDerivation rec {
+  pname = "azimuth";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner  = "mdsteele";
+    repo   = "azimuth";
+    rev    = "v${version}";
+    sha256 = "0yh52i3vfmj5zd7fs1r2xpjy2mknycr5xz6kyixj2qncb25xsm7z";
+  };
+
+  preConfigure = ''
+    substituteInPlace data/azimuth.desktop \
+      --replace Exec=azimuth "Exec=$out/bin/azimuth" \
+      --replace "Version=%AZ_VERSION_NUMBER" "Version=${version}"
+  '';
+
+  makeFlags = [
+    "BUILDTYPE=release"
+  ];
+
+  buildInputs = [ SDL ];
+
+  enableParallelBuilding = true;
+
+  # the game doesn't have an installation procedure
+  installPhase = ''
+    mkdir -p $out/bin
+    cp out/release/host/bin/azimuth $out/bin/azimuth
+    cp out/release/host/bin/editor $out/bin/azimuth-editor
+    cp out/release/host/bin/muse $out/bin/azimuth-muse
+    cp out/release/host/bin/zfxr $out/bin/azimuth-zfxr
+    mkdir -p $out/share/doc/azimuth
+    cp doc/* README.md LICENSE $out/share/doc/azimuth
+    mkdir -p $out/share/icons/hicolor/128x128/apps $out/share/icons/hicolor/64x64/apps $out/share/icons/hicolor/48x48/apps $out/share/icons/hicolor/32x32/apps
+    cp data/icons/icon_128x128.png $out/share/icons/hicolor/128x128/apps/azimuth.png
+    cp data/icons/icon_64x64.png $out/share/icons/hicolor/64x64/apps/azimuth.png
+    cp data/icons/icon_48x48.png $out/share/icons/hicolor/48x48/apps/azimuth.png
+    cp data/icons/icon_32x32.png $out/share/icons/hicolor/32x32/apps/azimuth.png
+    mkdir -p $out/share/applications
+    cp data/azimuth.desktop $out/share/applications
+  '';
+
+  meta = {
+    description = "A metroidvania game using only vectorial graphic";
+    longDescription = ''
+      Azimuth is a metroidvania game, and something of an homage to the previous
+      greats of the genre (Super Metroid in particular). You will need to pilot
+      your ship, explore the inside of the planet, fight enemies, overcome
+      obstacles, and uncover the storyline piece by piece. Azimuth features a
+      huge game world to explore, lots of little puzzles to solve, dozens of
+      weapons and upgrades to find and use, and a wide variety of enemies and
+      bosses to tangle with.
+    '';
+
+    license = stdenv.lib.licenses.gpl3Plus;
+    homepage = https://mdsteele.games/azimuth/index.html;
+    maintainers = with stdenv.lib.maintainers; [ marius851000 ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index ef22bd9a3ac..f441ac36add 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -39,16 +39,16 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "4.7";
+    version = "4.8";
     url = "https://dl.winehq.org/wine/source/4.x/wine-${version}.tar.xz";
-    sha256 = "1c5swx6jj0hz9w2jgyl30pdjcq9n62qp1rmqyq1d4q2a6n291jiv";
+    sha256 = "0dd1vw3bq47ypdpflgmmbi68pjw5z3wz26kfwvnkxqbp28fapfa8";
     inherit (stable) mono gecko32 gecko64;
   };
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "1sgyq57dyzchwnvkgx96bcx5rv821s0vidzdyz7x5711j7xmiv70";
+    sha256 = "0npm44zdys78qbqqyvjczqqjdgacpsfds3jxyy1y4yj2xjqzagsq";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/misc/screensavers/xautolock/default.nix b/pkgs/misc/screensavers/xautolock/default.nix
index 8edb618b389..0da198aab78 100644
--- a/pkgs/misc/screensavers/xautolock/default.nix
+++ b/pkgs/misc/screensavers/xautolock/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   name = "xautolock-${version}";
-  version = "2.2-6-ge68d0ed";
+  version = "2.2-7-ga23dd5c";
 
   # This repository contains xautolock-2.2 plus various useful patches that
   # were collected from Debian, etc.
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "peti";
     repo = "xautolock";
     rev = "v${version}";
-    sha256 = "1131ki6zwk94s8j6zqywf8r5kanx3nrjm692rxh8pcz4hv9qp1mz";
+    sha256 = "10j61rl0sx9sh84rjyfyddl73xb5i2cpb17fyrli8kwj39nw0v2g";
   };
 
   nativeBuildInputs = [ imake gccmakedep ];
diff --git a/pkgs/misc/vscode-extensions/cpptools/default.nix b/pkgs/misc/vscode-extensions/cpptools/default.nix
index ca44ccb8cd2..89ed98cd0a7 100644
--- a/pkgs/misc/vscode-extensions/cpptools/default.nix
+++ b/pkgs/misc/vscode-extensions/cpptools/default.nix
@@ -68,8 +68,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cpptools";
     publisher = "ms-vscode";
-    version = "0.22.1";
-    sha256 = "1f79vbp19k1zm2y5djr4vim0h5y5rnm96rg8fx2h9zb8i559230k";
+    version = "0.23.0";
+    sha256 = "1c7qia60fgak5pisl1qzp2kvm1cs30b29rxpydk7j3lqcpqr5ixj";
   };
 
   buildInputs = [
diff --git a/pkgs/misc/vscode-extensions/wakatime/default.nix b/pkgs/misc/vscode-extensions/wakatime/default.nix
index f4c8ca8647d..034866d5b2f 100644
--- a/pkgs/misc/vscode-extensions/wakatime/default.nix
+++ b/pkgs/misc/vscode-extensions/wakatime/default.nix
@@ -8,8 +8,8 @@ in
     mktplcRef = {
       name = "vscode-wakatime";
       publisher = "WakaTime";
-      version = "2.0.9";
-      sha256 = "0fbliim80ydq90c606jhl79fdcmmpb9fs402mvy3g9zmjixspnpb";
+      version = "2.1.0";
+      sha256 = "0a23l8vaj0yghfh9lbi453vjghaxgjmphfjy2s4lgrvq38j4bv9n";
     };
 
     postPatch = ''
diff --git a/pkgs/os-specific/linux/bpftool/default.nix b/pkgs/os-specific/linux/bpftool/default.nix
new file mode 100644
index 00000000000..cc4786ab384
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftool/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchurl
+, libopcodes, libbfd, libelf
+, linuxPackages_latest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpftool";
+  inherit (linuxPackages_latest.kernel) version src;
+
+  buildInputs = [ libopcodes libbfd libelf ];
+
+  preConfigure = ''
+    cd tools/bpf/bpftool
+    substituteInPlace ./Makefile \
+      --replace '/usr/local' "$out" \
+      --replace '/usr'       "$out" \
+      --replace '/sbin'      '/bin'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Debugging/program analysis tool for the eBPF subsystem";
+    license     = [ licenses.gpl2 licenses.bsd2 ];
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2f091b95cfc..a735d165299 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -427,6 +427,12 @@ let
 
       VFIO_PCI_VGA = mkIf stdenv.is64bit yes;
 
+      # VirtualBox guest drivers in the kernel conflict with the ones in the
+      # official additions package and prevent the vboxsf module from loading,
+      # so disable them for now.
+      VBOXGUEST = option no;
+      DRM_VBOXVIDEO = option no;
+
     } // optionalAttrs (stdenv.isx86_64 || stdenv.isi686) ({
       XEN = option yes;
 
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 85ef8a1a6cc..2627286ccff 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, substituteAll, autoreconfHook, pkgconfig, libusb1, hwdata , python3 }:
 
 stdenv.mkDerivation rec {
-  name = "usbutils-010";
+  name = "usbutils-012";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/usb/usbutils/${name}.tar.xz";
-    sha256 = "06aag4jfgsfjxk563xsp9ik9nadihmasrr37a1gb0vwqni5kdiv1";
+    sha256 = "0iiy0q7fzikavmdsjsb0sl9kp3gfh701qwyjjccvqh0qz4jlcqw8";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 81143032c91..c6140bd12be 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,9 +182,9 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "0.8.0-rc4";
+    version = "0.8.0-rc5";
 
-    sha256 = "02cdxf62758smbqy723yqv8lkch1043alvcwhdnvya21ygcgycnw";
+    sha256 = "1944w36rk33mn44zfvc1qbn2sv9h90r25zxnanwvyhss0vgqw73v";
     isUnstable = true;
 
     extraPatches = [
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 6a0114a6ba5..347ac290378 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -6,8 +6,8 @@ let
     src = fetchFromGitHub {
       owner = "chobits";
       repo = "ngx_http_proxy_connect_module";
-      rev = "8201639082cba702211585b03d4cc7bc51c65167";
-      sha256 = "0z71x3xnlczrr2kq43w3drxj9g14fkk4jz66x921v0yb8r9mnn5a";
+      rev = "18e2520b361ffebde6c08c8119ecfba113a3b53c";
+      sha256 = "1nyil5n2a97nqsqarvnp4bazw4vnxifqizzw5aank4vi9xlq90b2";
     };
 
     patches = [
@@ -32,12 +32,21 @@ in
     inputs = [ pkgs.brotli ];
   };
 
+  coolkit = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_coolkit";
+      rev    = "0.2";
+      sha256 = "1idj0cqmfsdqawjcqpr1fsq670fdki51ksqk2lslfpcs3yrfjpqh";
+    };
+  };
+
   dav = {
     src = fetchFromGitHub {
       owner = "arut";
       repo = "nginx-dav-ext-module";
-      rev = "v0.1.0";
-      sha256 = "1ifahd69vz715g3zim618jbmxb7kcmzykc696grskxm0svpy294k";
+      rev = "v3.0.0";
+      sha256 = "000dm5zk0m1hm1iq60aff5r6y8xmqd7djrwhgnz9ig01xyhnjv9w";
     };
     inputs = [ pkgs.expat ];
   };
@@ -87,6 +96,14 @@ in
     };
   };
 
+  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "15";
+  };
+
+  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "14";
+  };
+
   ipscrub = {
     src = fetchFromGitHub {
       owner = "masonicboom";
@@ -97,12 +114,30 @@ in
     inputs = [ pkgs.libbsd ];
   };
 
+  limit-speed = {
+    src = fetchFromGitHub {
+      owner = "yaoweibin";
+      repo = "nginx_limit_speed_module";
+      rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
+      sha256 = "0kkrd08zpcwx938i2is07vq6pgjkvn97xzjab0g4zaz8bivgmjp8";
+    };
+  };
+
+  live ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-live-module";
+      rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
+      sha256 = "1kpnhl4b50zim84z22ahqxyxfq4jv8ab85kzsy2n5ciqbyg491lz";
+    };
+  };
+
   lua = {
     src = fetchFromGitHub {
       owner = "openresty";
       repo = "lua-nginx-module";
-      rev = "v0.10.13";
-      sha256 = "19mpc76lfhyyvkfs2n08b4rc9cf2v7rm8fskkf60hsdcf6qna822";
+      rev = "v0.10.14";
+      sha256 = "1vg6pp9n8z42p6f3jqk15gvdyy7mfvs5ssfbiy83bydjx42fq7g0";
     };
     inputs = [ pkgs.luajit ];
     preConfigure = ''
@@ -148,6 +183,24 @@ in
     };
   };
 
+  mpeg-ts ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-ts-module";
+      rev = "v0.1.1";
+      sha256 = "12dxcyy6wna1fccl3a9lnsbymd6p4apnwz6c24w74v97qvpfdxqd";
+    };
+  };
+
+  naxsi ={
+    src = fetchFromGitHub {
+      owner = "nbs-system";
+      repo = "naxsi";
+      rev = "0.56";
+      sha256 = "12kn6wbl8xqc19fi05ffprqps4pplg4a6i1cf01xc0d6brx1fg8v";
+    } + "/naxsi_src";
+  };
+
   ngx_aws_auth = {
     src = fetchFromGitHub {
       owner = "anomalizer";
@@ -254,6 +307,24 @@ in
     };
   };
 
+  slowfs-cache = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_slowfs_cache";
+      rev    = "1.10";
+      sha256 = "1gyza02pcws3zqm1phv3ag50db5gnapxyjwy8skjmvawz7p5bmxr";
+    };
+  };
+
+  sorted-querystring = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-sorted-querystring-module";
+      rev = "0.3";
+      sha256 = "0p6b0hcws39n27fx4xp9k4hb3pcv7b6kah4qqaj0pzjy3nbp4gj7";
+    };
+  };
+
   statsd = {
     src = fetchFromGitHub {
       owner = "apcera";
@@ -285,8 +356,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "ngx_http_substitutions_filter_module";
-      rev = "v0.6.4";
-      sha256 = "0q86cv0mfffh43id5xanywyhpd7b0jijrmk8y311c13l9ajrd2rx";
+      rev = "bc58cb11844bc42735bbaef7085ea86ace46d05b";
+      sha256 = "1q5hr3sqys4f365gzjci549rn9ylhgj4xb29ril04zr5vkhzlnar";
     };
   };
 
@@ -303,8 +374,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "nginx_upstream_check_module";
-      rev = "9aecf15ec379fe98f62355c57b60c0bc83296f04";
-      sha256 = "1cjisxw1wykll683nw09k0i1nvzslp4dr59x58cvarpk43paim2y";
+      rev = "007f76f7adbcbd6abd9352502af1a4ae463def85";
+      sha256 = "1qcg7c9rcl70wr1qf188shnn9s2f7cxnlw05s6scbvlgnf6ik6in";
     };
   };
 
@@ -312,8 +383,8 @@ in
     src = fetchFromGitHub {
       owner = "tarantool";
       repo = "nginx_upstream_module";
-      rev = "v2.7";
-      sha256 = "05dwj0caj910p7kan2qjvm6x2x601igryhny2xzr47hhsk5q1cnx";
+      rev = "v2.7.1";
+      sha256 = "0ya4330in7zjzqw57djv4icpk0n1j98nvf0f8v296yi9rjy054br";
     };
     inputs = [ pkgs.msgpuck.dev pkgs.yajl ];
   };
@@ -327,6 +398,16 @@ in
     };
   };
 
+  video-thumbextractor = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-video-thumbextractor-module";
+      rev = "0.9.0";
+      sha256 = "1b0v471mzbcys73pzr7gpvzzhff0cva0l5ff32cv7z1v9c0ypji7";
+    };
+    inputs = [ pkgs.ffmpeg ];
+  };
+
   vts = {
     src = fetchFromGitHub {
       owner = "vozlt";
@@ -335,12 +416,4 @@ in
       sha256 = "1jq2s9k7hah3b317hfn9y3g1q4g4x58k209psrfsqs718a9sw8c7";
     };
   };
-
-  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "15";
-  };
-
-  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "14";
-  };
 }
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index 094b782abf9..e95fcaa03ef 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg1 }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg }:
 
 perlPackages.buildPerlPackage rec {
   name = "SpamAssassin-3.4.2";
@@ -27,7 +27,7 @@ perlPackages.buildPerlPackage rec {
     mv "rules/"* $out/share/spamassassin/
 
     for n in "$out/bin/"*; do
-      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : "${gnupg1}/bin"
+      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : "${gnupg}/bin"
     done
   '';
 
diff --git a/pkgs/servers/search/elasticsearch/5.x.nix b/pkgs/servers/search/elasticsearch/5.x.nix
index 0d67988e820..6142d751dab 100644
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless, utillinux }:
+{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless
+, utillinux, gnugrep, coreutils }:
 
 with stdenv.lib;
 
@@ -23,7 +24,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/bin/elasticsearch \
       --prefix ES_CLASSPATH : "$out/lib/*" \
-      --prefix PATH : "${utillinux}/bin" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}" \
       --set ES_JVM_OPTIONS "$out/config/jvm.options"
 
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 73bee6c47f3..fffc84b2d28 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -45,7 +45,7 @@ stdenv.mkDerivation (rec {
     chmod -x $out/bin/*.*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index a55a43baa0b..ddb1d2299cb 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -56,7 +56,7 @@ stdenv.mkDerivation (rec {
     chmod +x $out/bin/*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux coreutils gnugrep ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index 0f393c11988..43dd8a40480 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   name = "tcsh-${version}";
-  version = "6.20.00";
+  version = "6.21.00";
 
   src = fetchurl {
     urls = [
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
       "ftp://ftp.astron.com/pub/tcsh/${name}.tar.gz"
       "ftp://ftp.funet.fi/pub/unix/shells/tcsh/${name}.tar.gz"
     ];
-    sha256 = "17ggxkkn5skl0v1x0j6hbv5l0sgnidfzwv16992sqkdm983fg7dq";
+    sha256 = "0wp9cqkzdj5ahfyg9bn5z1wnyblqyv9vz4sc5aqmj7rp91a34f64";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index 0ccc964c3e6..d476b797f38 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, coreutils, python2, duplicity, gawk, gnupg1, bash
+{ stdenv, fetchurl, coreutils, python2, duplicity, gawk, gnupg, bash
 , gnugrep, txt2man, makeWrapper, which
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share/man/man1"
     install -vD duply "$out/bin"
     wrapProgram "$out/bin/duply" --set PATH \
-        ${stdenv.lib.makeBinPath [ coreutils python2 duplicity gawk gnupg1 bash gnugrep txt2man which ]}
+        ${stdenv.lib.makeBinPath [ coreutils python2 duplicity gawk gnupg bash gnugrep txt2man which ]}
     "$out/bin/duply" txt2man > "$out/share/man/man1/duply.1"
   '';
 
diff --git a/pkgs/tools/misc/aptly/default.nix b/pkgs/tools/misc/aptly/default.nix
index 4571ee24fba..2dac9bd60c9 100644
--- a/pkgs/tools/misc/aptly/default.nix
+++ b/pkgs/tools/misc/aptly/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, gnupg1compat, bzip2, xz, graphviz }:
+{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, gnupg, bzip2, xz, graphviz }:
 
 let
 
@@ -34,7 +34,7 @@ buildGoPackage {
     mkdir -p $bin/share/bash-completion/completions
     ln -s ${aptlyCompletionSrc}/aptly $bin/share/bash-completion/completions
     wrapProgram "$bin/bin/aptly" \
-      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg1compat bzip2 xz graphviz ]}"
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg bzip2 xz graphviz ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
new file mode 100644
index 00000000000..02b0b85db31
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
@@ -0,0 +1,1153 @@
+From 453ff940449bbbde9ec00f0bbf82a359c5598fc7 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sat, 23 Mar 2019 23:00:52 +0100
+Subject: [PATCH 1/1] Support cross-compilation to musl libc.
+
+Reported by Necktwi Ozfguah <necktwi@ferryfair.com>.
+
+* m4/calloc.m4 (_AC_FUNC_CALLOC_IF): Add cross-compilation guesses for
+musl libc.
+* m4/canonicalize.m4 (gl_FUNC_REALPATH_WORKS): Likewise.
+* m4/chown.m4 (gl_FUNC_CHOWN): Likewise.
+* m4/d-ino.m4 (gl_CHECK_TYPE_STRUCT_DIRENT_D_INO): Likewise.
+* m4/fdopendir.m4 (gl_FUNC_FDOPENDIR): Likewise.
+* m4/fnmatch.m4 (gl_FUNC_FNMATCH_POSIX): Likewise.
+* m4/fpurge.m4 (gl_FUNC_FPURGE): Likewise.
+* m4/getcwd.m4 (gl_FUNC_GETCWD_NULL): Likewise.
+* m4/getcwd-abort-bug.m4 (gl_FUNC_GETCWD_ABORT_BUG): Likewise.
+* m4/getdelim.m4 (gl_FUNC_GETDELIM): Likewise.
+* m4/getgroups.m4 (AC_FUNC_GETGROUPS, gl_FUNC_GETGROUPS): Likewise.
+* m4/getline.m4 (gl_FUNC_GETLINE): Likewise.
+* m4/gettimeofday.m4 (gl_FUNC_GETTIMEOFDAY_CLOBBER): Likewise.
+* m4/hypot.m4 (gl_FUNC_HYPOT): Likewise.  // removed
+* m4/hypotf.m4 (gl_FUNC_HYPOTF): Likewise.  // removed
+* m4/hypotl.m4 (gl_FUNC_HYPOTL): Likewise.  // removed
+* m4/iconv_open-utf.m4 (gl_FUNC_ICONV_OPEN_UTF_SUPPORT): Likewise.  // removed
+* m4/link-follow.m4 (gl_FUNC_LINK_FOLLOWS_SYMLINK): Likewise.
+* m4/log.m4 (gl_FUNC_LOG): Likewise.  // removed
+* m4/logf.m4 (gl_FUNC_LOGF): Likewise.  // removed
+* m4/logl.m4 (gl_FUNC_LOGL_WORKS): Likewise.  // removed
+* m4/log10.m4 (gl_FUNC_LOG10): Likewise.  // removed
+* m4/log10f.m4 (gl_FUNC_LOG10F): Likewise.  // removed
+* m4/log10l.m4 (gl_FUNC_LOG10L): Likewise.  // removed
+* m4/log1p.m4 (gl_FUNC_LOG1P): Likewise.  // removed
+* m4/log1pf.m4 (gl_FUNC_LOG1PF): Likewise.  // removed
+* m4/log1pl.m4 (gl_FUNC_LOG1PL): Likewise.  // removed
+* m4/log2.m4 (gl_FUNC_LOG2): Likewise.  // removed
+* m4/log2f.m4 (gl_FUNC_LOG2F): Likewise.  // removed
+* m4/malloc.m4 (_AC_FUNC_MALLOC_IF): Likewise.
+* m4/mkdir.m4 (gl_FUNC_MKDIR): Likewise.
+* m4/mkstemp.m4 (gl_FUNC_MKSTEMP): Likewise.
+* m4/modf.m4 (gl_FUNC_MODF): Likewise.  // removed
+* m4/modff.m4 (gl_FUNC_MODFF): Likewise.  // removed
+* m4/modfl.m4 (gl_FUNC_MODFL): Likewise.  // removed
+* m4/perror.m4 (gl_FUNC_PERROR): Likewise.
+* m4/printf.m4 (gl_PRINTF_SIZES_C99, gl_PRINTF_INFINITE,
+gl_PRINTF_INFINITE_LONG_DOUBLE, gl_PRINTF_DIRECTIVE_A,
+gl_PRINTF_DIRECTIVE_F, gl_PRINTF_FLAG_ZERO, gl_SNPRINTF_TRUNCATION_C99,
+gl_SNPRINTF_RETVAL_C99, gl_SNPRINTF_DIRECTIVE_N,
+gl_VSNPRINTF_ZEROSIZE_C99): Likewise.
+* m4/ptsname.m4 (gl_FUNC_PTSNAME): Likewise.  // removed
+* m4/putenv.m4 (gl_FUNC_PUTENV): Likewise.
+* m4/realloc.m4 (_AC_FUNC_REALLOC_IF): Likewise.
+* m4/remainder.m4 (gl_FUNC_REMAINDER): Likewise.  // removed
+* m4/remainderf.m4 (gl_FUNC_REMAINDERF): Likewise.  // removed
+* m4/remainderl.m4 (gl_FUNC_REMAINDERL): Likewise.  // removed
+* m4/rintl.m4 (gl_FUNC_RINTL): Likewise.  // removed
+* m4/round.m4 (gl_FUNC_ROUND): Likewise.  // removed
+* m4/roundf.m4 (gl_FUNC_ROUNDF): Likewise.  // removed
+* m4/roundl.m4 (gl_FUNC_ROUNDL): Likewise.  // removed
+* m4/setenv.m4 (gl_FUNC_SETENV): Likewise.
+* m4/signbit.m4 (gl_SIGNBIT): Likewise.
+* m4/sleep.m4 (gl_FUNC_SLEEP): Likewise.
+* m4/stpncpy.m4 (gl_FUNC_STPNCPY): Likewise.
+* m4/strerror.m4 (gl_FUNC_STRERROR, gl_FUNC_STRERROR_0): Likewise.
+* m4/strtod.m4 (gl_FUNC_STRTOD): Likewise.
+* m4/strtold.m4 (gl_FUNC_STRTOLD): Likewise.
+* m4/trunc.m4 (gl_FUNC_TRUNC): Likewise.    // removed
+* m4/truncf.m4 (gl_FUNC_TRUNCF): Likewise.  // removed
+* m4/truncl.m4 (gl_FUNC_TRUNCL): Likewise.  // removed
+* m4/tzset.m4 (gl_FUNC_TZSET_CLOBBER): Likewise.
+* m4/ungetc.m4 (gl_FUNC_UNGETC_WORKS): Likewise.
+* m4/usleep.m4 (gl_FUNC_USLEEP): Likewise.
+* m4/utimes.m4 (gl_FUNC_UTIMES): Likewise.
+* m4/wcwidth.m4 (gl_FUNC_WCWIDTH): Likewise.
+---
+ m4/calloc.m4           |  4 ++-
+ m4/canonicalize.m4     |  4 ++-
+ m4/chown.m4            | 22 +++++++------
+ m4/d-ino.m4            | 16 +++++-----
+ m4/fdopendir.m4        | 12 ++++---
+ m4/fnmatch.m4          | 18 ++++++++---
+ m4/fpurge.m4           | 24 +++++++++-----
+ m4/getcwd-abort-bug.m4 | 11 +++++--
+ m4/getcwd.m4           |  4 ++-
+ m4/getdelim.m4         | 40 ++++++++++++++----------
+ m4/getgroups.m4        |  6 +++-
+ m4/getline.m4          | 38 +++++++++++++---------
+ m4/gettimeofday.m4     |  4 ++-
+ m4/link-follow.m4      |  4 ++-
+ m4/malloc.m4           |  4 +--
+ m4/mkdir.m4            |  4 ++-
+ m4/mkstemp.m4          |  4 ++-
+ m4/perror.m4           | 12 ++++---
+ m4/printf.m4           | 22 ++++++++++++-
+ m4/putenv.m4           |  4 ++-
+ m4/realloc.m4          |  4 +--
+ m4/setenv.m4           |  4 ++-
+ m4/signbit.m4          |  6 +++-
+ m4/sleep.m4            |  4 ++-
+ m4/stpncpy.m4          | 14 +++++++--
+ m4/strerror.m4         |  6 +++-
+ m4/strtod.m4           | 10 +++---
+ m4/strtold.m4          |  9 ++++--
+ m4/tzset.m4            |  4 ++-
+ m4/ungetc.m4           | 18 ++++++-----
+ m4/usleep.m4           |  4 ++-
+ m4/utimes.m4           | 10 +++---
+ m4/wcwidth.m4          | 12 ++++---
+ 76 files changed, 461 insertions(+), 157 deletions(-)
+
+diff --git a/m4/calloc.m4 b/m4/calloc.m4
+index 012a5bf..d76535d 100644
+--- a/m4/calloc.m4
++++ b/m4/calloc.m4
+@@ -1,4 +1,4 @@
+-# calloc.m4 serial 18
++# calloc.m4 serial 19
+
+ # Copyright (C) 2004-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -40,6 +40,8 @@ AC_DEFUN([_AC_FUNC_CALLOC_IF],
+        [case "$host_os" in
+                          # Guess yes on glibc systems.
+           *-gnu* | gnu*) ac_cv_func_calloc_0_nonnull="guessing yes" ;;
++                         # Guess yes on musl systems.
++          *-musl*)       ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # Guess yes on native Windows.
+           mingw*)        ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/canonicalize.m4 b/m4/canonicalize.m4
+index 5b6e25d..b61747b 100644
+--- a/m4/canonicalize.m4
++++ b/m4/canonicalize.m4
+@@ -1,4 +1,4 @@
+-# canonicalize.m4 serial 29
++# canonicalize.m4 serial 30
+
+ dnl Copyright (C) 2003-2007, 2009-2019 Free Software Foundation, Inc.
+
+@@ -113,6 +113,8 @@ AC_DEFUN([gl_FUNC_REALPATH_WORKS],
+      [case "$host_os" in
+                        # Guess yes on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_realpath_works="guessing yes" ;;
++                       # Guess yes on musl systems.
++        *-musl*)       gl_cv_func_realpath_works="guessing yes" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_realpath_works="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/chown.m4 b/m4/chown.m4
+index ecfc0c0..b798325 100644
+--- a/m4/chown.m4
++++ b/m4/chown.m4
+@@ -1,4 +1,4 @@
+-# serial 30
++# serial 32
+ # Determine whether we need the chown wrapper.
+
+ dnl Copyright (C) 1997-2001, 2003-2005, 2007, 2009-2019 Free Software
+@@ -109,10 +109,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_slash_works=yes],
+         [gl_cv_func_chown_slash_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_slash_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_slash_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_slash_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.link conftest.file])
+@@ -145,10 +147,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_ctime_works=yes],
+         [gl_cv_func_chown_ctime_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_ctime_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_ctime_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_ctime_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.file])
+diff --git a/m4/d-ino.m4 b/m4/d-ino.m4
+index f1420cc..87dcacc 100644
+--- a/m4/d-ino.m4
++++ b/m4/d-ino.m4
+@@ -1,4 +1,4 @@
+-# serial 18
++# serial 19
+
+ dnl From Jim Meyering.
+ dnl
+@@ -40,12 +40,14 @@ AC_DEFUN([gl_CHECK_TYPE_STRUCT_DIRENT_D_INO],
+            [gl_cv_struct_dirent_d_ino=yes],
+            [gl_cv_struct_dirent_d_ino=no],
+            [case "$host_os" in
+-                           # Guess yes on glibc systems with Linux kernel.
+-              linux*-gnu*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
+-                           # Guess no on native Windows.
+-              mingw*)      gl_cv_struct_dirent_d_ino="guessing no" ;;
+-                           # If we don't know, assume the worst.
+-              *)           gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # Guess yes on glibc systems with Linux kernel.
++              linux*-gnu*)  gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess yes on musl systems with Linux kernel.
++              linux*-musl*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess no on native Windows.
++              mingw*)       gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # If we don't know, assume the worst.
++              *)            gl_cv_struct_dirent_d_ino="guessing no" ;;
+             esac
+            ])])
+    case "$gl_cv_struct_dirent_d_ino" in
+diff --git a/m4/fdopendir.m4 b/m4/fdopendir.m4
+index 0490551..b2b3b03 100644
+--- a/m4/fdopendir.m4
++++ b/m4/fdopendir.m4
+@@ -1,4 +1,4 @@
+-# serial 10
++# serial 11
+ # See if we need to provide fdopendir.
+
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+@@ -45,10 +45,12 @@ DIR *fdopendir (int);
+          [gl_cv_func_fdopendir_works=yes],
+          [gl_cv_func_fdopendir_works=no],
+          [case "$host_os" in
+-                    # Guess yes on glibc systems.
+-            *-gnu*) gl_cv_func_fdopendir_works="guessing yes" ;;
+-                    # If we don't know, assume the worst.
+-            *)      gl_cv_func_fdopendir_works="guessing no" ;;
++                     # Guess yes on glibc systems.
++            *-gnu*)  gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # If we don't know, assume the worst.
++            *)       gl_cv_func_fdopendir_works="guessing no" ;;
+           esac
+          ])])
+     case "$gl_cv_func_fdopendir_works" in
+diff --git a/m4/fnmatch.m4 b/m4/fnmatch.m4
+index c264ca7..75ba55b 100644
+--- a/m4/fnmatch.m4
++++ b/m4/fnmatch.m4
+@@ -1,4 +1,4 @@
+-# Check for fnmatch - serial 13.  -*- coding: utf-8 -*-
++# Check for fnmatch - serial 14.  -*- coding: utf-8 -*-
+
+ # Copyright (C) 2000-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -14,6 +14,7 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+   m4_divert_text([DEFAULTS], [gl_fnmatch_required=POSIX])
+
+   AC_REQUIRE([gl_FNMATCH_H])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   gl_fnmatch_required_lowercase=`
+     echo $gl_fnmatch_required | LC_ALL=C tr '[[A-Z]]' '[[a-z]]'
+   `
+@@ -117,12 +118,19 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+             ]])],
+          [eval "$gl_fnmatch_cache_var=yes"],
+          [eval "$gl_fnmatch_cache_var=no"],
+-         [eval "$gl_fnmatch_cache_var=\"guessing no\""])
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) eval "$gl_fnmatch_cache_var=\"guessing yes\"" ;;
++                     # Guess no otherwise, even on glibc systems.
++            *)       eval "$gl_fnmatch_cache_var=\"guessing no\"" ;;
++          esac
++         ])
+       ])
+     eval "gl_fnmatch_result=\"\$$gl_fnmatch_cache_var\""
+-    if test "$gl_fnmatch_result" != yes; then
+-      REPLACE_FNMATCH=1
+-    fi
++    case "$gl_fnmatch_result" in
++      *yes) ;;
++      *) REPLACE_FNMATCH=1 ;;
++    esac
+   fi
+   if test $HAVE_FNMATCH = 0 || test $REPLACE_FNMATCH = 1; then
+     gl_REPLACE_FNMATCH_H
+diff --git a/m4/fpurge.m4 b/m4/fpurge.m4
+index cb21f56..6c5b3e9 100644
+--- a/m4/fpurge.m4
++++ b/m4/fpurge.m4
+@@ -1,4 +1,4 @@
+-# fpurge.m4 serial 8
++# fpurge.m4 serial 9
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -7,12 +7,13 @@ dnl with or without modifications, as long as this notice is preserved.
+ AC_DEFUN([gl_FUNC_FPURGE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_FUNCS_ONCE([fpurge])
+   AC_CHECK_FUNCS_ONCE([__fpurge])
+   AC_CHECK_DECLS([fpurge], , , [[#include <stdio.h>]])
+   if test "x$ac_cv_func_fpurge" = xyes; then
+     HAVE_FPURGE=1
+-    # Detect BSD bug.  Only cygwin 1.7 is known to be immune.
++    # Detect BSD bug.  Only cygwin 1.7 and musl are known to be immune.
+     AC_CACHE_CHECK([whether fpurge works], [gl_cv_func_fpurge_works],
+       [AC_RUN_IFELSE(
+          [AC_LANG_PROGRAM(
+@@ -48,11 +49,20 @@ AC_DEFUN([gl_FUNC_FPURGE],
+                return 13;
+              return 0;
+             ])],
+-      [gl_cv_func_fpurge_works=yes], [gl_cv_func_fpurge_works=no],
+-      [gl_cv_func_fpurge_works='guessing no'])])
+-    if test "x$gl_cv_func_fpurge_works" != xyes; then
+-      REPLACE_FPURGE=1
+-    fi
++         [gl_cv_func_fpurge_works=yes],
++         [gl_cv_func_fpurge_works=no],
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fpurge_works="guessing yes" ;;
++                     # Guess no otherwise.
++            *)       gl_cv_func_fpurge_works="guessing no" ;;
++          esac
++         ])
++      ])
++    case "$gl_cv_func_fpurge_works" in
++      *yes) ;;
++      *) REPLACE_FPURGE=1 ;;
++    esac
+   else
+     HAVE_FPURGE=0
+   fi
+diff --git a/m4/getcwd-abort-bug.m4 b/m4/getcwd-abort-bug.m4
+index f0f24a5..7227f08 100644
+--- a/m4/getcwd-abort-bug.m4
++++ b/m4/getcwd-abort-bug.m4
+@@ -1,4 +1,4 @@
+-# serial 9
++# serial 11
+ # Determine whether getcwd aborts when the length of the working directory
+ # name is unusually large.  Any length between 4k and 16k trigger the bug
+ # when using glibc-2.4.90-9 or older.
+@@ -13,6 +13,7 @@
+ # gl_FUNC_GETCWD_ABORT_BUG([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
+ AC_DEFUN([gl_FUNC_GETCWD_ABORT_BUG],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_DECLS_ONCE([getcwd])
+   AC_CHECK_HEADERS_ONCE([unistd.h])
+   AC_REQUIRE([gl_PATHMAX_SNIPPET_PREREQ])
+@@ -142,7 +143,13 @@ main ()
+         else
+           gl_cv_func_getcwd_abort_bug=no
+         fi],
+-       [gl_cv_func_getcwd_abort_bug=yes])
++       [case "$host_os" in
++                   # Guess no on musl systems.
++          *-musl*) gl_cv_func_getcwd_abort_bug="guessing no" ;;
++                   # Guess yes otherwise, even on glibc systems.
++          *)       gl_cv_func_getcwd_abort_bug="guessing yes"
++        esac
++       ])
+     ])
+   AS_IF([test $gl_cv_func_getcwd_abort_bug = yes], [$1], [$2])
+ ])
+diff --git a/m4/getcwd.m4 b/m4/getcwd.m4
+index 4929b51..625171a 100644
+--- a/m4/getcwd.m4
++++ b/m4/getcwd.m4
+@@ -6,7 +6,7 @@
+ # with or without modifications, as long as this notice is preserved.
+
+ # Written by Paul Eggert.
+-# serial 16
++# serial 17
+
+ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+   [
+@@ -50,6 +50,8 @@ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+         [[case "$host_os" in
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) gl_cv_func_getcwd_null="guessing yes";;
++                           # Guess yes on musl systems.
++            *-musl*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # Guess yes on Cygwin.
+             cygwin*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # If we don't know, assume the worst.
+diff --git a/m4/getdelim.m4 b/m4/getdelim.m4
+index bf17c57..e77c379 100644
+--- a/m4/getdelim.m4
++++ b/m4/getdelim.m4
+@@ -1,4 +1,4 @@
+-# getdelim.m4 serial 12
++# getdelim.m4 serial 13
+
+ dnl Copyright (C) 2005-2007, 2009-2019 Free Software Foundation, Inc.
+ dnl
+@@ -11,6 +11,7 @@ AC_PREREQ([2.59])
+ AC_DEFUN([gl_FUNC_GETDELIM],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getdelim().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -21,9 +22,10 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+   if test $ac_cv_func_getdelim = yes; then
+     HAVE_GETDELIM=1
+     dnl Found it in some library.  Verify that it works.
+-    AC_CACHE_CHECK([for working getdelim function], [gl_cv_func_working_getdelim],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getdelim function],
++      [gl_cv_func_working_getdelim],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -53,25 +55,31 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [gl_cv_func_working_getdelim=yes] dnl The library version works.
+-    , [gl_cv_func_working_getdelim=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [gl_cv_func_working_getdelim=yes],
++         [gl_cv_func_working_getdelim=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [gl_cv_func_working_getdelim="guessing yes"],
+-         [gl_cv_func_working_getdelim="guessing no"])]
+-    )])
++            ],
++            [gl_cv_func_working_getdelim="guessing yes"],
++            [case "$host_os" in
++               *-musl*) gl_cv_func_working_getdelim="guessing yes" ;;
++               *)       gl_cv_func_working_getdelim="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+     case "$gl_cv_func_working_getdelim" in
+-      *no)
+-        REPLACE_GETDELIM=1
+-        ;;
++      *yes) ;;
++      *) REPLACE_GETDELIM=1 ;;
+     esac
+   else
+     HAVE_GETDELIM=0
+diff --git a/m4/getgroups.m4 b/m4/getgroups.m4
+index 2ce986e..c93447b 100644
+--- a/m4/getgroups.m4
++++ b/m4/getgroups.m4
+@@ -1,4 +1,4 @@
+-# serial 21
++# serial 22
+
+ dnl From Jim Meyering.
+ dnl A wrapper around AC_FUNC_GETGROUPS.
+@@ -42,6 +42,8 @@ AC_DEFUN([AC_FUNC_GETGROUPS],
+          [case "$host_os" in # ((
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) ac_cv_func_getgroups_works="guessing yes" ;;
++                           # Guess yes on musl systems.
++            *-musl*)       ac_cv_func_getgroups_works="guessing yes" ;;
+                            # If we don't know, assume the worst.
+             *)             ac_cv_func_getgroups_works="guessing no" ;;
+           esac
+@@ -95,6 +97,8 @@ AC_DEFUN([gl_FUNC_GETGROUPS],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_getgroups_works="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_getgroups_works="guessing yes" ;;
+                             # If we don't know, assume the worst.
+              *)             gl_cv_func_getgroups_works="guessing no" ;;
+            esac
+diff --git a/m4/getline.m4 b/m4/getline.m4
+index 5b2ead2..32f771c 100644
+--- a/m4/getline.m4
++++ b/m4/getline.m4
+@@ -1,4 +1,4 @@
+-# getline.m4 serial 28
++# getline.m4 serial 29
+
+ dnl Copyright (C) 1998-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+@@ -16,6 +16,7 @@ dnl to do with the function we need.
+ AC_DEFUN([gl_FUNC_GETLINE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getline().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -28,9 +29,10 @@ AC_DEFUN([gl_FUNC_GETLINE],
+                  gl_getline_needs_run_time_check=yes],
+                 [am_cv_func_working_getline=no])
+   if test $gl_getline_needs_run_time_check = yes; then
+-    AC_CACHE_CHECK([for working getline function], [am_cv_func_working_getline],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getline function],
++      [am_cv_func_working_getline],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -61,21 +63,28 @@ AC_DEFUN([gl_FUNC_GETLINE],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [am_cv_func_working_getline=yes] dnl The library version works.
+-    , [am_cv_func_working_getline=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [am_cv_func_working_getline=yes],
++         [am_cv_func_working_getline=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [am_cv_func_working_getline="guessing yes"],
+-         [am_cv_func_working_getline="guessing no"])]
+-    )])
++            ],
++            [am_cv_func_working_getline="guessing yes"],
++            [case "$host_os" in
++               *-musl*) am_cv_func_working_getline="guessing yes" ;;
++               *)       am_cv_func_working_getline="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+   fi
+
+   if test $ac_cv_have_decl_getline = no; then
+@@ -83,7 +92,8 @@ AC_DEFUN([gl_FUNC_GETLINE],
+   fi
+
+   case "$am_cv_func_working_getline" in
+-    *no)
++    *yes) ;;
++    *)
+       dnl Set REPLACE_GETLINE always: Even if we have not found the broken
+       dnl getline function among $LIBS, it may exist in libinet and the
+       dnl executable may be linked with -linet.
+diff --git a/m4/gettimeofday.m4 b/m4/gettimeofday.m4
+index d29b4bf..5e2ef6f 100644
+--- a/m4/gettimeofday.m4
++++ b/m4/gettimeofday.m4
+@@ -1,4 +1,4 @@
+-# serial 25
++# serial 26
+
+ # Copyright (C) 2001-2003, 2005, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -105,6 +105,8 @@ AC_DEFUN([gl_FUNC_GETTIMEOFDAY_CLOBBER],
+       case "$host_os" in
+                        # Guess all is fine on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_gettimeofday_clobber="guessing no" ;;
++                       # Guess all is fine on musl systems.
++        *-musl*)       gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/link-follow.m4 b/m4/link-follow.m4
+index cbd2dca..8ac7301 100644
+--- a/m4/link-follow.m4
++++ b/m4/link-follow.m4
+@@ -1,4 +1,4 @@
+-# serial 20
++# serial 21
+ dnl Run a program to determine whether link(2) follows symlinks.
+ dnl Set LINK_FOLLOWS_SYMLINKS accordingly.
+
+@@ -88,6 +88,8 @@ AC_DEFUN([gl_FUNC_LINK_FOLLOWS_SYMLINK],
+             case "$host_os" in
+                                   # On glibc/Linux we know the result.
+               linux*-gnu* | gnu*) gl_cv_func_link_follows_symlink="guessing no" ;;
++                                  # On musl/Linux we know the result.
++              linux*-musl*)       gl_cv_func_link_follows_symlink="guessing no" ;;
+                                   # Otherwise, we don't know.
+               *)                  gl_cv_func_link_follows_symlink=unknown ;;
+             esac
+diff --git a/m4/malloc.m4 b/m4/malloc.m4
+index b9b8d4b..c469c45 100644
+--- a/m4/malloc.m4
++++ b/m4/malloc.m4
+@@ -1,4 +1,4 @@
+-# malloc.m4 serial 17
++# malloc.m4 serial 19
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_MALLOC_IF],
+        [ac_cv_func_malloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_malloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/mkdir.m4 b/m4/mkdir.m4
+index 4cd9590..366a3cd 100644
+--- a/m4/mkdir.m4
++++ b/m4/mkdir.m4
+@@ -1,4 +1,4 @@
+-# serial 14
++# serial 15
+
+ # Copyright (C) 2001, 2003-2004, 2006, 2008-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -62,6 +62,8 @@ AC_DEFUN([gl_FUNC_MKDIR],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_mkdir_trailing_dot_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/mkstemp.m4 b/m4/mkstemp.m4
+index ae24c3b..1b15c2e 100644
+--- a/m4/mkstemp.m4
++++ b/m4/mkstemp.m4
+@@ -1,4 +1,4 @@
+-#serial 25
++#serial 26
+
+ # Copyright (C) 2001, 2003-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -59,6 +59,8 @@ AC_DEFUN([gl_FUNC_MKSTEMP],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_working_mkstemp="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_working_mkstemp="guessing yes" ;;
+                             # Guess no on native Windows.
+              mingw*)        gl_cv_func_working_mkstemp="guessing no" ;;
+                             # If we don't know, assume the worst.
+diff --git a/m4/perror.m4 b/m4/perror.m4
+index 335be72..08e2db1 100644
+--- a/m4/perror.m4
++++ b/m4/perror.m4
+@@ -1,4 +1,4 @@
+-# perror.m4 serial 7
++# perror.m4 serial 8
+ dnl Copyright (C) 2008-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,10 +48,12 @@ AC_DEFUN([gl_FUNC_PERROR],
+             rm -rf conftest.txt1 conftest.txt2],
+            [gl_cv_func_perror_works=no],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_perror_works="guessing yes" ;;
+-                      # Otherwise guess no.
+-              *)      gl_cv_func_perror_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_perror_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_perror_works="guessing yes" ;;
++                       # Otherwise guess no.
++              *)       gl_cv_func_perror_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/printf.m4 b/m4/printf.m4
+index cbf6ae4..6d2280e 100644
+--- a/m4/printf.m4
++++ b/m4/printf.m4
+@@ -1,4 +1,4 @@
+-# printf.m4 serial 60
++# printf.m4 serial 61
+ dnl Copyright (C) 2003, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -62,6 +62,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_sizes_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_sizes_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_printf_sizes_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_sizes_c99="guessing yes";;
+@@ -240,6 +242,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_infinite="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_infinite="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_infinite="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_infinite="guessing yes";;
+@@ -457,6 +461,8 @@ int main ()
+ changequote(,)dnl
+                                          # Guess yes on glibc systems.
+                    *-gnu* | gnu*)        gl_cv_func_printf_infinite_long_double="guessing yes";;
++                                         # Guess yes on musl systems.
++                   *-musl*)              gl_cv_func_printf_infinite_long_double="guessing yes";;
+                                          # Guess yes on FreeBSD >= 6.
+                    freebsd[1-5].*)       gl_cv_func_printf_infinite_long_double="guessing no";;
+                    freebsd* | kfreebsd*) gl_cv_func_printf_infinite_long_double="guessing yes";;
+@@ -575,6 +581,8 @@ int main ()
+                [gl_cv_func_printf_directive_a="guessing yes"],
+                [gl_cv_func_printf_directive_a="guessing no"])
+              ;;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_a="guessing yes";;
+                                  # Guess no on Android.
+            linux*-android*)      gl_cv_func_printf_directive_a="guessing no";;
+                                  # Guess no on native Windows.
+@@ -625,6 +633,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_directive_f="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_f="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_directive_f="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_directive_f="guessing yes";;
+@@ -960,6 +970,8 @@ changequote(,)dnl
+          case "$host_os" in
+                             # Guess yes on glibc systems.
+            *-gnu* | gnu*)   gl_cv_func_printf_flag_zero="guessing yes";;
++                            # Guess yes on musl systems.
++           *-musl*)         gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess yes on BeOS.
+            beos*)           gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess no on Android.
+@@ -1206,6 +1218,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_truncation_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_truncation_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_truncation_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_truncation_c99="guessing yes";;
+@@ -1308,6 +1322,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_retval_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_retval_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_retval_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_retval_c99="guessing yes";;
+@@ -1400,6 +1416,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_directive_n="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_directive_n="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_directive_n="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_directive_n="guessing yes";;
+@@ -1554,6 +1572,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_vsnprintf_zerosize_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+diff --git a/m4/putenv.m4 b/m4/putenv.m4
+index f8960f6..342ba26 100644
+--- a/m4/putenv.m4
++++ b/m4/putenv.m4
+@@ -1,4 +1,4 @@
+-# putenv.m4 serial 22
++# putenv.m4 serial 23
+ dnl Copyright (C) 2002-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -36,6 +36,8 @@ AC_DEFUN([gl_FUNC_PUTENV],
+              [case "$host_os" in
+                                # Guess yes on glibc systems.
+                 *-gnu* | gnu*) gl_cv_func_svid_putenv="guessing yes" ;;
++                               # Guess yes on musl systems.
++                *-musl*)       gl_cv_func_svid_putenv="guessing yes" ;;
+                                # Guess no on native Windows.
+                 mingw*)        gl_cv_func_svid_putenv="guessing no" ;;
+                                # If we don't know, assume the worst.
+diff --git a/m4/realloc.m4 b/m4/realloc.m4
+index f9f15ad..93066e8 100644
+--- a/m4/realloc.m4
++++ b/m4/realloc.m4
+@@ -1,4 +1,4 @@
+-# realloc.m4 serial 15
++# realloc.m4 serial 17
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_REALLOC_IF],
+        [ac_cv_func_realloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_realloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/setenv.m4 b/m4/setenv.m4
+index 6101274..a8f83d6 100644
+--- a/m4/setenv.m4
++++ b/m4/setenv.m4
+@@ -1,4 +1,4 @@
+-# setenv.m4 serial 27
++# setenv.m4 serial 28
+ dnl Copyright (C) 2001-2004, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -37,6 +37,8 @@ AC_DEFUN([gl_FUNC_SETENV],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_setenv_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_setenv_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+          *)             gl_cv_func_setenv_works="guessing no" ;;
+        esac
+diff --git a/m4/signbit.m4 b/m4/signbit.m4
+index bf5bce5..f7f2f3d 100644
+--- a/m4/signbit.m4
++++ b/m4/signbit.m4
+@@ -1,4 +1,4 @@
+-# signbit.m4 serial 16
++# signbit.m4 serial 17
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit="guessing yes" ;;
+                           # Guess yes on native Windows.
+            mingw*)        gl_cv_func_signbit="guessing yes" ;;
+                           # If we don't know, assume the worst.
+@@ -62,6 +64,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit_gcc="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit_gcc="guessing yes" ;;
+                           # Guess yes on mingw, no on MSVC.
+            mingw*)        if test -n "$GCC"; then
+                             gl_cv_func_signbit_gcc="guessing yes"
+diff --git a/m4/sleep.m4 b/m4/sleep.m4
+index 5f71cc7..7bab467 100644
+--- a/m4/sleep.m4
++++ b/m4/sleep.m4
+@@ -1,4 +1,4 @@
+-# sleep.m4 serial 9
++# sleep.m4 serial 10
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,6 +48,8 @@ handle_alarm (int sig)
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_sleep_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_sleep_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_sleep_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/stpncpy.m4 b/m4/stpncpy.m4
+index 83425dd..f8e1a7c 100644
+--- a/m4/stpncpy.m4
++++ b/m4/stpncpy.m4
+@@ -1,4 +1,4 @@
+-# stpncpy.m4 serial 16
++# stpncpy.m4 serial 17
+ dnl Copyright (C) 2002-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -7,6 +7,8 @@ dnl with or without modifications, as long as this notice is preserved.
+
+ AC_DEFUN([gl_FUNC_STPNCPY],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
++
+   dnl Persuade glibc <string.h> to declare stpncpy().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+
+@@ -69,12 +71,18 @@ int main ()
+ ]])],
+         [gl_cv_func_stpncpy=yes],
+         [gl_cv_func_stpncpy=no],
+-        [AC_EGREP_CPP([Thanks for using GNU], [
++        [dnl Guess yes on glibc systems and musl systems.
++         AC_EGREP_CPP([Thanks for using GNU], [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+   Thanks for using GNU
+ #endif
+-], [gl_cv_func_stpncpy="guessing yes"], [gl_cv_func_stpncpy="guessing no"])
++],         [gl_cv_func_stpncpy="guessing yes"],
++           [case "$host_os" in
++              *-musl*) gl_cv_func_stpncpy="guessing yes" ;;
++              *)       gl_cv_func_stpncpy="guessing no" ;;
++            esac
++           ])
+         ])
+     ])
+     case "$gl_cv_func_stpncpy" in
+diff --git a/m4/strerror.m4 b/m4/strerror.m4
+index b452f7f..2c90f31 100644
+--- a/m4/strerror.m4
++++ b/m4/strerror.m4
+@@ -1,4 +1,4 @@
+-# strerror.m4 serial 19
++# strerror.m4 serial 20
+ dnl Copyright (C) 2002, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -26,6 +26,8 @@ AC_DEFUN([gl_FUNC_STRERROR],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_working_strerror="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_working_strerror="guessing yes" ;;
+                           # If we don't know, assume the worst.
+            *)             gl_cv_func_working_strerror="guessing no" ;;
+          esac
+@@ -80,6 +82,8 @@ AC_DEFUN([gl_FUNC_STRERROR_0],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_strerror_0_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # Guess yes on native Windows.
+          mingw*)        gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/strtod.m4 b/m4/strtod.m4
+index 9912217..d68ab75 100644
+--- a/m4/strtod.m4
++++ b/m4/strtod.m4
+@@ -1,4 +1,4 @@
+-# strtod.m4 serial 24
++# strtod.m4 serial 25
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -115,9 +115,11 @@ numeric_equal (double x, double y)
+            ],
+            [gl_cv_func_strtod_works="guessing yes"],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_strtod_works="guessing yes" ;;
+-              *)      gl_cv_func_strtod_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtod_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_strtod_works="guessing yes" ;;
++              *)       gl_cv_func_strtod_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/strtold.m4 b/m4/strtold.m4
+index 16b4eda..17125fe 100644
+--- a/m4/strtold.m4
++++ b/m4/strtold.m4
+@@ -1,4 +1,4 @@
+-# strtold.m4 serial 2
++# strtold.m4 serial 4
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,7 +98,12 @@ numeric_equal (long double x, long double y)
+ #endif
+            ],
+            [gl_cv_func_strtold_works="guessing yes"],
+-           [gl_cv_func_strtod_works="guessing no"])
++           [case "$host_os" in
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtold_works="guessing yes" ;;
++              *)       gl_cv_func_strtold_works="guessing no" ;;
++            esac
++           ])
+         ])
+       ])
+     case "$gl_cv_func_strtold_works" in
+diff --git a/m4/tzset.m4 b/m4/tzset.m4
+index 1278801..afdfa8e 100644
+--- a/m4/tzset.m4
++++ b/m4/tzset.m4
+@@ -1,4 +1,4 @@
+-# serial 11
++# serial 12
+
+ # Copyright (C) 2003, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -70,6 +70,8 @@ main ()
+        [case "$host_os" in
+                          # Guess all is fine on glibc systems.
+           *-gnu* | gnu*) gl_cv_func_tzset_clobber="guessing no" ;;
++                         # Guess all is fine on musl systems.
++          *-musl*)       gl_cv_func_tzset_clobber="guessing no" ;;
+                          # Guess no on native Windows.
+           mingw*)        gl_cv_func_tzset_clobber="guessing no" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/ungetc.m4 b/m4/ungetc.m4
+index ab8757b..08baf33 100644
+--- a/m4/ungetc.m4
++++ b/m4/ungetc.m4
+@@ -1,4 +1,4 @@
+-# ungetc.m4 serial 6
++# ungetc.m4 serial 7
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -41,12 +41,16 @@ AC_DEFUN_ONCE([gl_FUNC_UNGETC_WORKS],
+            remove ("conftest.tmp");])],
+         [gl_cv_func_ungetc_works=yes], [gl_cv_func_ungetc_works=no],
+         [case "$host_os" in
+-                                       # Guess yes on glibc and bionic systems.
+-           *-gnu* | gnu* | *-android*) gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # Guess yes on native Windows.
+-           mingw*)                     gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # If we don't know, assume the worst.
+-           *)                          gl_cv_func_ungetc_works="guessing no" ;;
++                          # Guess yes on glibc systems.
++           *-gnu* | gnu*) gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on bionic systems.
++           *-android*)    gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on native Windows.
++           mingw*)        gl_cv_func_ungetc_works="guessing yes" ;;
++                          # If we don't know, assume the worst.
++           *)             gl_cv_func_ungetc_works="guessing no" ;;
+          esac
+         ])
+     ])
+diff --git a/m4/usleep.m4 b/m4/usleep.m4
+index 59605a8..4a6bff0 100644
+--- a/m4/usleep.m4
++++ b/m4/usleep.m4
+@@ -1,4 +1,4 @@
+-# usleep.m4 serial 5
++# usleep.m4 serial 6
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_FUNC_USLEEP],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_usleep_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_usleep_works="guessing yes" ;;
+                           # Guess no on native Windows.
+            mingw*)        gl_cv_func_usleep_works="guessing no" ;;
+                           # If we don't know, assume the worst.
+diff --git a/m4/utimes.m4 b/m4/utimes.m4
+index 7209b6d..5806d8f 100644
+--- a/m4/utimes.m4
++++ b/m4/utimes.m4
+@@ -1,5 +1,5 @@
+ # Detect some bugs in glibc's implementation of utimes.
+-# serial 5
++# serial 6
+
+ dnl Copyright (C) 2003-2005, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -143,9 +143,11 @@ main ()
+        [gl_cv_func_working_utimes=yes],
+        [gl_cv_func_working_utimes=no],
+        [case "$host_os" in
+-                  # Guess no on native Windows.
+-          mingw*) gl_cv_func_working_utimes="guessing no" ;;
+-          *)      gl_cv_func_working_utimes="guessing no" ;;
++                   # Guess yes on musl systems.
++          *-musl*) gl_cv_func_working_utimes="guessing yes" ;;
++                   # Guess no on native Windows.
++          mingw*)  gl_cv_func_working_utimes="guessing no" ;;
++          *)       gl_cv_func_working_utimes="guessing no" ;;
+         esac
+        ])
+     ])
+diff --git a/m4/wcwidth.m4 b/m4/wcwidth.m4
+index baa2002..3952fd2 100644
+--- a/m4/wcwidth.m4
++++ b/m4/wcwidth.m4
+@@ -1,4 +1,4 @@
+-# wcwidth.m4 serial 27
++# wcwidth.m4 serial 28
+ dnl Copyright (C) 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,9 +98,13 @@ int main ()
+           [
+ changequote(,)dnl
+            case "$host_os" in
+-                                        # Guess yes on glibc and AIX 7 systems.
+-             *-gnu* | gnu* | aix[7-9]*) gl_cv_func_wcwidth_works="guessing yes";;
+-             *)                         gl_cv_func_wcwidth_works="guessing no";;
++                            # Guess yes on glibc systems.
++             *-gnu* | gnu*) gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on AIX 7 systems.
++             aix[7-9]*)     gl_cv_func_wcwidth_works="guessing yes";;
++             *)             gl_cv_func_wcwidth_works="guessing no";;
+            esac
+ changequote([,])dnl
+           ])
+--
+1.9.1
+
+
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 9cc48f44646..f83a2b94071 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, buildPackages
-, autoreconfHook, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
+, autoreconfHook, bison, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
 , aclSupport ? stdenv.isLinux, acl ? null
 , attrSupport ? stdenv.isLinux, attr ? null
 , selinuxSupport? false, libselinux ? null, libsepol ? null
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
     sha256 = "1zg9m79x1i2nifj4kb0waf9x3i5h6ydkypkjnbsb9rnwis8rqypz";
   };
 
-  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
+  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
+         # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
+         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch;
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
@@ -55,7 +57,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "info" ];
 
-  nativeBuildInputs = [ perl xz.bin ];
+  nativeBuildInputs = [ perl xz.bin ]
+    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
+    ++ optionals stdenv.hostPlatform.isMusl [ autoreconfHook bison ];   # due to patch
   configureFlags = [ "--with-packager=https://NixOS.org" ]
     ++ optional (singleBinary != false)
       ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
@@ -73,7 +77,6 @@ stdenv.mkDerivation rec {
     ++ optional aclSupport acl
     ++ optional attrSupport attr
     ++ optional withOpenssl openssl
-    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
     ++ optionals selinuxSupport [ libselinux libsepol ]
        # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc != "glibc") libiconv;
@@ -132,4 +135,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 
+} // optionalAttrs stdenv.hostPlatform.isMusl {
+  # Work around a bogus warning in conjunction with musl.
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 }
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index b4272dac531..22da00da9fc 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit, python3Packages, docutils, help2man
 , acl, apktool, binutils-unwrapped, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
-, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg1, gnutar
+, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, pdftk, pgpdump, poppler_utils, sng, sqlite
 , squashfsTools, tcpdump, unoconv, unzip, xxd, xz
 , enableBloat ? false
@@ -41,7 +41,7 @@ python3Packages.buildPythonApplication rec {
       dtc e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
       libarchive libcaca lz4 pgpdump progressbar33 sng sqlite squashfsTools unzip xxd xz
     ] ++ lib.optionals enableBloat [
-      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg1 gnumeric imagemagick
+      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg gnumeric imagemagick
       llvm jdk mono openssh pdftk poppler_utils tcpdump unoconv
       python3Packages.guestfs
     ];
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index 77331a7f025..ddd4ae5ce05 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -4,11 +4,11 @@ let inherit (stdenv.lib) getDev; in
 
 stdenv.mkDerivation rec {
   pname = "qt5ct";
-  version = "0.38";
+  version = "0.39";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0p0317z79h906qwaf0p8ga6lmr1dlabkx12gn31bv9lnp9f55jwg";
+    sha256 = "069y6c17gfics8rz3rdsn2x2hb39m4qka08ygwpxa8gqppffqs9p";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/tools/misc/shell-hist/default.nix b/pkgs/tools/misc/shell-hist/default.nix
new file mode 100644
index 00000000000..b44cbf100e8
--- /dev/null
+++ b/pkgs/tools/misc/shell-hist/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage {
+  pname = "shell-hist";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jamesmunns";
+    repo = "shell-hist";
+    rev = "158de8c3908b49530ecd76bf6e65c210f351ef82";
+    sha256 = "0kc128xnnp1d56if70vfv0w3qnwhljhbnvzwwb7hfm3x2m0vqrqf";
+  };
+
+  cargoSha256 = "1nqnkzwqk879qy1261g1gds668xz6islhzq7chzhilaqpmvf6039";
+
+  meta = with lib; {
+    description = "Inspect your shell history";
+    homepage = "https://github.com/jamesmunns/shell-hist";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = [ maintainers.spacekookie ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 2cdb8aff472..6e431fdc98e 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -15,13 +15,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tlp-${version}";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "linrunner";
     repo = "TLP";
     rev = version;
-    sha256 = "1msldl6y8fpvxa9p87lv3hvgxwk2vpiahqmapq485ihdjkshc558";
+    sha256 = "0vm31ca6kdak9xzwskz7a8hvdp67drfh2zcdwlz3260r8r2ypgg1";
   };
 
   outRef = placeholder "out";
diff --git a/pkgs/tools/misc/ttyplot/default.nix b/pkgs/tools/misc/ttyplot/default.nix
index 53a0e0a2992..78aeab00a50 100644
--- a/pkgs/tools/misc/ttyplot/default.nix
+++ b/pkgs/tools/misc/ttyplot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttyplot-${version}";
-  version = "1.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "tenox7";
     repo = "ttyplot";
     rev = version;
-    sha256 = "1xaqzm71w2n0q532wpa3w818mvjvch3h34m2aq7pldkyk09frjxh";
+    sha256 = "19qm0hx9ljdw9qg78lydn3c627xy7xnx3knq5f7caw9lf0cdp7kf";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 70f304134d9..a32ce090ecd 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, rustPlatform, cargo, cmake, sphinx, lib, prefix ? "uutils-" }:
 
 rustPlatform.buildRustPackage {
-  name = "uutils-coreutils-2018-09-30";
+  name = "uutils-coreutils-2019-05-03";
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
-    rev = "a161b7e803aef08455ae0547dccd9210e38a4574";
-    sha256 = "19j40cma7rz6yf5j6nyid8qslbcmrnxdk6by53hflal2qx3g555z";
+    rev = "036dd812958ace22d973acf7b370f58072049dac";
+    sha256 = "0d9w3iiphhsk7l5l34682wayp90rgq5a3d94l3qdvhcqkfmpg727";
   };
 
   # too many impure/platform-dependent tests
   doCheck = false;
 
-  cargoSha256 = "1a9k7i4829plkxgsflmpji3mrw2i1vln6jsnhxmkl14h554yi5j4";
+  cargoSha256 = "0qnpx2xhckb45q8cgn0xh31dg5k73hqp5mz5zg3micmg7as4b621";
 
   makeFlags =
     [ "CARGO=${cargo}/bin/cargo" "PREFIX=$(out)" "PROFILE=release" "INSTALLDIR_MAN=$(out)/share/man/man1" ]
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 724979439d4..98dc79fbe11 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.04.30";
+  version = "2019.05.11";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1s43adnky8ayhjwmgmiqy6rmmygd4c23v36jhy2lzr2jpn8l53z1";
+    sha256 = "1y272jgdqwhf2njzqfln80zb2pmw83rvp6lxza6wghb7cld249j1";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 8a0efbb1943..68dfb089865 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "axel-${version}";
-  version = "2.16.1";
+  version = "2.17.1";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/a/axel/axel_${version}.orig.tar.gz";
-    sha256 = "0v3hgqrpqqqkj8ghaky88a0wpnpwqd72vd04ywlbhgfzfkfrllk4";
+  url = "https://github.com/axel-download-accelerator/axel/releases/download/v${version}/${name}.tar.xz";
+    sha256 = "1mwyps6yvrjxp7mpzc0a2hwr2pw050c63fc9aqjzdzjjw123dfrn";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 8c71018ba86..dfe8f6d1d60 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -11,13 +11,13 @@ stdenv.mkDerivation rec {
 
   name = pname + "-" + version;
   pname = "i2pd";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "1gn8i3jxy6zwrqxmkzc1n55sw29jxdjr4ihv33q2kcp7b90b4wsq";
+    sha256 = "1jqfgpwg83prikjg67farl854mhyjiy4lz6i8kahp765m6kp8gaq";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 9f3075b374e..4491d183aad 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -2,7 +2,7 @@
 , docbook_xsl }:
 
 let
-  version = "1.0.76";
+  version = "1.0.77";
 in stdenv.mkDerivation rec {
   name = "tgt-${version}";
 
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
     owner = "fujita";
     repo = "tgt";
     rev = "v${version}";
-    sha256 = "1q01ay0zn5gmy6df1iw1ic11p8zygxlp0r3nd887vvvjvlp3xrvc";
+    sha256 = "1qhck8v5057wn9nb1nsq6dzhvqzz51x8i3n0p1x36zbsmdjy2ajw";
   };
 
   buildInputs = [ libxslt systemd libaio docbook_xsl ];
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 29af5a5cc0a..8148692327e 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitLab, autoconf, automake, makeWrapper
 , python3, perl, perlPackages
-, libmd, gnupg1, which, getopt, libpaper, nettools, qprint
+, libmd, gnupg, which, getopt, libpaper, nettools, qprint
 , sendmailPath ? "/run/wrappers/bin/sendmail" }:
 
 let
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   # Perl is required for it's pod2man.
   # Python and Perl are required for patching the script interpreter paths.
   nativeBuildInputs = [ autoconf automake makeWrapper ];
-  buildInputs = [ python3 perl perlPackages.GnuPGInterface libmd gnupg1 ];
+  buildInputs = [ python3 perl perlPackages.GnuPGInterface libmd gnupg ];
 
   postInstall = ''
     # Install all tools which aren't handled by 'make install'.
@@ -126,59 +126,59 @@ in stdenv.mkDerivation rec {
         TextTemplate MIMETools MailTools TimeDate NetIDNEncode ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ nettools gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ nettools gnupg ]}"
 
     wrapProgram $out/bin/gpg-key2latex --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 libpaper ]}"
+      "${stdenv.lib.makeBinPath [ gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-key2ps --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ which gnupg1 libpaper ]}"
+      "${stdenv.lib.makeBinPath [ which gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-mailkeys --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 qprint ]}"
+      "${stdenv.lib.makeBinPath [ gnupg qprint ]}"
 
     wrapProgram $out/bin/gpgdir --set PERL5LIB \
       ${with perlPackages; makePerlPath ([
         TermReadKey ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpglist --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgparticipants --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ getopt gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ getopt gnupg ]}"
 
 #    wrapProgram $out/bin/gpgparticipants-prefill
 
     wrapProgram $out/bin/gpgsigs --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgwrap --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/keyanalyze --set PERL5LIB \
 
     wrapProgram $out/bin/keyart --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/keylookup --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-clean --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-fixkey --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/pgpring
 
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index a07a374c5d8..f159dd27c42 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tboot-${version}";
-  version = "1.9.6";
+  version = "1.9.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/tboot/${name}.tar.gz";
-    sha256 = "0f9afz260xhycpd0x5zz6jn8ha14i8j98rck0fhb55l1rbbfwm8v";
+    sha256 = "06f0ggl6vrb5ghklblvh2ixgmmjv31rkp1vfj9qm497iqwq9ac00";
   };
 
   patches = [ ./tboot-add-well-known-secret-option-to-lcp_writepol.patch ];
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 86cc6221a5c..1aa42dc75f3 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "11hyqqpfz839ipqv534vvljyarnr9wn98rzvyfwnx2lq76h2adqn";
+    sha256 = "1916zqmh4cam9nw3k95wiqizlpkbbm5qhfz4lblqba8pzc2y9v32";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 08457efe740..7fcb9fc10bd 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.9.0";
+  version = "3.10.0";
   name = "yara-${version}";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "1a707nx1py1q1z9fc18c93gjd4k5k6k53a93qw09jlcc67xk2sz7";
+    sha256 = "1qxqk324cyvi4n09s79786ciig1gdyhs9dnsm07hf95a3kh6w5z2";
   };
 
   buildInputs = [ autoconf automake libtool pcre]
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index a31ce8f65e4..eec36e8f090 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "stress-ng-${version}";
-  version = "0.09.57";
+  pname = "stress-ng";
+  version = "0.09.58";
 
   src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/${name}.tar.xz";
-    sha256 = "0xp55m1kif8hcjdcdhgaarghqf1gz5fa24qwl6zpmxkzl6bn002x";
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "1rlll6wl0i0m21idfr3xr99pfgnb9wf9i35hsb0frmrpcvls06za";
   };
 
   # All platforms inputs then Linux-only ones
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       attr keyutils libaio libapparmor libcap lksctp-tools
     ];
 
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace Makefile --replace "/usr" ""
   '';
 
@@ -27,25 +27,39 @@ stdenv.mkDerivation rec {
   # mystery, though. :-(
   enableParallelBuilding = (!stdenv.isi686);
 
-  installFlags = [ "DESTDIR=$(out)" ];
+  installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
     description = "Stress test a computer system";
     longDescription = ''
-      Stress test a system in various selectable ways, exercising both various
-      physical subsystems and various operating system kernel interfaces:
-      - over 130 different stress tests
-      - over 70 CPU specific stress tests that exercise floating point,
-        integer, bit manipulation and control flow
-      - over 20 virtual memory stress tests
-      stress-ng was originally intended to make a machine work hard and trip
-      hardware issues such as thermal overruns as well as operating system
-      bugs that only occur when a system is being thrashed hard.
+      stress-ng will stress test a computer system in various selectable ways. It
+      was designed to exercise various physical subsystems of a computer as well as
+      the various operating system kernel interfaces. Stress-ng features:
+
+        * over 210 stress tests
+        * over 50 CPU specific stress tests that exercise floating point, integer,
+          bit manipulation and control flow
+        * over 20 virtual memory stress tests
+        * portable: builds on Linux, Solaris, *BSD, Minix, Android, MacOS X,
+          Debian Hurd, Haiku, Windows Subsystem for Linux and SunOs/Dilos with
+          gcc, clang, tcc and pcc.
+
+      stress-ng was originally intended to make a machine work hard and trip hardware
+      issues such as thermal overruns as well as operating system bugs that only
+      occur when a system is being thrashed hard. Use stress-ng with caution as some
+      of the tests can make a system run hot on poorly designed hardware and also can
+      cause excessive system thrashing which may be difficult to stop.
+
+      stress-ng can also measure test throughput rates; this can be useful to observe
+      performance changes across different operating system releases or types of
+      hardware. However, it has never been intended to be used as a precise benchmark
+      test suite, so do NOT use it in this manner.
     '';
-    homepage = https://kernel.ubuntu.com/~cking/stress-ng/;
-    downloadPage = https://kernel.ubuntu.com/~cking/tarballs/stress-ng/;
+    homepage = "https://kernel.ubuntu.com/~cking/stress-ng/";
+    downloadPage = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/";
+    changelog = "https://kernel.ubuntu.com/git/cking/stress-ng.git/plain/debian/changelog?h=V${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ c0bw3b ];
-    platforms = platforms.linux; # TODO: fix https://github.com/NixOS/nixpkgs/pull/50506#issuecomment-439635963
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index adca2983fe5..a395066ee58 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1762,6 +1762,8 @@ in
 
   shab = callPackage ../tools/text/shab { };
 
+  shell-hist = callPackage ../tools/misc/shell-hist { };
+
   simg2img = callPackage ../tools/filesystems/simg2img { };
 
   snipes = callPackage ../games/snipes { };
@@ -2032,6 +2034,8 @@ in
 
   checkinstall = callPackage ../tools/package-management/checkinstall { };
 
+  chit = callPackage ../development/tools/chit { };
+
   chkrootkit = callPackage ../tools/security/chkrootkit { };
 
   chrony = callPackage ../tools/networking/chrony { };
@@ -2658,14 +2662,22 @@ in
   elk6Version = "6.7.2";
   elk7Version = "7.0.1";
 
-  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix { };
-  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix { };
+  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix {
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix {
+    utillinux = utillinuxMinimal;
+  };
   elasticsearch6-oss = callPackage ../servers/search/elasticsearch/6.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix {
+    utillinux = utillinuxMinimal;
   };
-  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix { };
   elasticsearch7-oss = callPackage ../servers/search/elasticsearch/7.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
   };
   elasticsearch = elasticsearch6;
   elasticsearch-oss = elasticsearch6-oss;
@@ -4517,6 +4529,8 @@ in
     withMinimal = false;
   };
 
+  mkclean = callPackage ../applications/video/mkclean {};
+
   mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
   mkp224o = callPackage ../tools/security/mkp224o { };
@@ -8748,13 +8762,16 @@ in
 
   bam = callPackage ../development/tools/build-managers/bam {};
 
-  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix { };
+  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
+  };
   bazel = callPackage ../development/tools/build-managers/bazel {
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk8;
     buildJdkName = "jdk8";
     runJdk = jdk11;
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
   };
 
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
@@ -8816,6 +8833,8 @@ in
   buildkite-agent2 = callPackage ../development/tools/continuous-integration/buildkite-agent/2.x.nix { };
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent/3.x.nix { };
 
+  bpftool = callPackage ../os-specific/linux/bpftool { };
+
   byacc = callPackage ../development/tools/parsing/byacc { };
 
   cadre = callPackage ../development/tools/cadre { };
@@ -16422,7 +16441,7 @@ in
   stix-two = callPackage ../data/fonts/stix-two { };
 
   inherit (callPackages ../data/fonts/gdouros { })
-    symbola aegyptus akkadian anatolian maya unidings musica analecta textfonts aegan abydos;
+    aegan aegyptus akkadian assyrian eemusic maya symbola textfonts unidings;
 
   iana-etc = callPackage ../data/misc/iana-etc { };
 
@@ -21110,6 +21129,8 @@ in
 
   atanks = callPackage ../games/atanks {};
 
+  azimuth = callPackage ../games/azimuth {};
+
   ballAndPaddle = callPackage ../games/ball-and-paddle {
     guile = guile_1_8;
   };
@@ -21457,7 +21478,10 @@ in
 
   nethack = callPackage ../games/nethack { };
 
-  nethack-qt = callPackage ../games/nethack { qtMode = true; };
+  nethack-qt = callPackage ../games/nethack {
+    qtMode = true;
+    stdenv = gccStdenv;
+  };
 
   nethack-x11 = callPackage ../games/nethack { x11Mode = true; };
 
@@ -24006,8 +24030,10 @@ in
     stdenv = crossLibcStdenv;
     };
 
-	omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
+  omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
 
   wasmtime = callPackage ../development/interpreters/wasmtime {};
 
+  bemenu = callPackage ../applications/misc/bemenu { };
+
 }
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 2cbdd0aee5c..63886bac857 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -347,12 +347,12 @@ let
   };
 
   phpstan = mkDerivation rec {
-    version = "0.11.5";
+    version = "0.11.6";
     pname = "phpstan";
 
     src = pkgs.fetchurl {
       url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-      sha256 = "13akllfr5dav0y61i4ym5ww8z32ynwj5lpvsfiwx6z52avmcrc29";
+      sha256 = "016zm9ynh0zi40kclvzql7zxs3pl69cacln2c7n3gsicpswr0qa4";
     };
 
     phases = [ "installPhase" ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c8026ced43..d9ebd75b5c1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -665,6 +665,8 @@ in {
 
   py-lru-cache = callPackage ../development/python-modules/py-lru-cache { };
 
+  py-radix = callPackage ../development/python-modules/py-radix { };
+
   pydbus = callPackage ../development/python-modules/pydbus { };
 
   pydocstyle = callPackage ../development/python-modules/pydocstyle { };
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index acccd155e08..339973f0574 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -31,7 +31,7 @@ let
     buildPackages.gcc = nativePlatforms;
     coreutils = nativePlatforms;
     haskell.packages.ghcHEAD.hello = nativePlatforms;
-    haskell.packages.ghc844.hello = nativePlatforms;
+    haskellPackages.hello = nativePlatforms;
   };
 
   linuxCommon = lib.recursiveUpdate gnuCommon {