Merge pull request #142602 from Artturin/strictdepsfixes

26 files changed, 157 insertions, 58 deletions

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index 156bf1fb3cd..61d5225621b 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, buildPackages
 , curl, openssl, zlib, expat, perlPackages, python3, gettext, cpio
 , gnugrep, gnused, gawk, coreutils # needed at runtime by git-filter-branch etc
-, openssh, pcre2
+, openssh, pcre2, bash
 , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45
 , libxslt, tcl, tk, makeWrapper, libiconv
 , svnSupport, subversionClient, perlLibs, smtpPerlLibs
@@ -73,7 +73,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]
     ++ lib.optionals withManual [ asciidoc texinfo xmlto docbook2x
          docbook_xsl docbook_xml_dtd_45 libxslt ];
-  buildInputs = [curl openssl zlib expat cpio libiconv]
+  buildInputs = [ curl openssl zlib expat cpio libiconv bash ]
     ++ lib.optionals perlSupport [ perlPackages.perl ]
     ++ lib.optionals guiSupport [tcl tk]
     ++ lib.optionals withpcre2 [ pcre2 ]
@@ -84,11 +84,12 @@ stdenv.mkDerivation {
   NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
               + lib.optionalString (stdenv.isFreeBSD) "-lthr";
 
-  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+  configureFlags = [
+    "ac_cv_prog_CURL_CONFIG=${lib.getDev curl}/bin/curl-config"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
     "ac_cv_snprintf_returns_bogus=no"
     "ac_cv_iconv_omits_bom=no"
-    "ac_cv_prog_CURL_CONFIG=${curl.dev}/bin/curl-config"
   ];
 
   preBuild = ''
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 0d07ce4e8d1..0617e857239 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    pkg-config makeWrapper meson ninja installShellFiles
+    pkg-config makeWrapper meson ninja installShellFiles perl
     asciidoc xmlto docbook_xml_dtd_45 docbook_xsl findXMLCatalogs
   ];
 
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/applications/window-managers/sway/default.nix
index fb0cb31fad5..8267c0573ea 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@@ -35,8 +35,14 @@ stdenv.mkDerivation rec {
     echo -e '\ninclude /etc/sway/config.d/*' >> config.in
   '';
 
+  strictDeps = true;
+
+  # Pkg-config binary for machine MachineChoice.BUILD not found. Giving up.
+  # has to be in both depsBuildBuild and nativeBuildInputs
+  depsBuildBuild = [ pkg-config scdoc ];
+
   nativeBuildInputs = [
-    meson ninja pkg-config wayland-scanner scdoc
+    meson ninja pkg-config wayland-scanner
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/dconf/default.nix b/pkgs/development/libraries/dconf/default.nix
index 550940f5a1e..a5879011697 100644
--- a/pkgs/development/libraries/dconf/default.nix
+++ b/pkgs/development/libraries/dconf/default.nix
@@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
     "-Dgtk_doc=${lib.boolToString (!isCross)}" # gtk-doc does do some gobject introspection, which doesn't yet cross-compile.
   ] ++ lib.optional isCross "-Dvapi=false";
 
+  checkInputs = [
+    dbus # for dbus-daemon
+  ];
+
   doCheck = !stdenv.isAarch32 && !stdenv.isAarch64 && !stdenv.isDarwin;
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 7f63d5f67e7..3182a4b3998 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -16,10 +16,11 @@
 , libjpeg
 , libpng
 , gnome
-, gobject-introspection
 , doCheck ? false
 , makeWrapper
 , lib
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 let
@@ -43,13 +44,19 @@ stdenv.mkDerivation rec {
     ./installed-tests-path.patch
   ];
 
+  # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     gettext
     python3
-    gobject-introspection
     makeWrapper
     glib
     gi-docgen
@@ -58,7 +65,11 @@ stdenv.mkDerivation rec {
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_43
-  ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
 
   propagatedBuildInputs = [
     glib
@@ -69,7 +80,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString withGtkDoc}"
-    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
     "-Dgio_sniffing=false"
   ];
 
diff --git a/pkgs/development/libraries/libgudev/default.nix b/pkgs/development/libraries/libgudev/default.nix
index 87061ae6559..6a63947c8a5 100644
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -5,9 +5,10 @@
 , ninja
 , udev
 , glib
-, gobject-introspection
 , gnome
 , vala
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -21,12 +22,18 @@ stdenv.mkDerivation rec {
     sha256 = "1al6nr492nzbm8ql02xhzwci2kwb1advnkaky3j9636jf08v41hd";
   };
 
+  strictDeps = true;
+
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
     pkg-config
-    gobject-introspection
     meson
     ninja
     vala
+    glib # for glib-mkenums needed during the build
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -37,8 +44,8 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     # There's a dependency cycle with umockdev and the tests fail to LD_PRELOAD anyway
     "-Dtests=disabled"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
     "-Dvapi=disabled"
   ];
 
diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix
index b108a5c5eea..40089e3d7e9 100644
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@@ -7,8 +7,9 @@
 , docbook-xsl-ns
 , glib
 , gdk-pixbuf
-, gobject-introspection
 , gnome
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
@@ -27,15 +28,24 @@ stdenv.mkDerivation rec {
     "-Dtests=false"
     "-Ddocbook_docs=disabled"
     "-Dgtk_doc=false"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
-    gobject-introspection
     meson
     ninja
     pkg-config
     libxslt
     docbook-xsl-ns
+    glib # for glib-mkenums needed during the build
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ];
+
+  buildInputs = lib.optionals withIntrospection [
+    gobject-introspection
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index c59a80c0e0f..25f8209dd3d 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -105,6 +105,9 @@ stdenv.mkDerivation rec {
     # Fix thumbnailer path
     sed -e "s#@bindir@\(/gdk-pixbuf-thumbnailer\)#${gdk-pixbuf}/bin\1#g" \
         -i gdk-pixbuf-loader/librsvg.thumbnailer.in
+
+    # 'error: linker `cc` not found' when cross-compiling
+    export RUSTFLAGS="-Clinker=$CC"
   '';
 
   # Not generated when cross compiling.
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 513bfe2d17e..c298ca8c17d 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -6,7 +6,6 @@
 , harfbuzz
 , libintl
 , libthai
-, gobject-introspection
 , darwin
 , fribidi
 , gnome
@@ -16,12 +15,13 @@
 , meson
 , ninja
 , glib
+, python3
 , x11Support? !stdenv.isDarwin, libXft
+, withIntrospection ? (stdenv.buildPlatform == stdenv.hostPlatform)
+, gobject-introspection
+, withDocs ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:
 
-let
-  withDocs = stdenv.buildPlatform == stdenv.hostPlatform;
-in
 stdenv.mkDerivation rec {
   pname = "pango";
   version = "1.48.10";
@@ -34,12 +34,21 @@ stdenv.mkDerivation rec {
     sha256 = "IeH1eYvN/adeq8QoBRSwiWq1b2VtTn5mAwuaJTXs3Jg=";
   };
 
+  strictDeps = !withIntrospection;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson ninja
     glib # for glib-mkenum
     pkg-config
+  ] ++ lib.optionals withIntrospection [
     gobject-introspection
+  ] ++ lib.optionals withDocs [
     gi-docgen
+    python3
   ];
 
   buildInputs = [
@@ -63,10 +72,9 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dgtk_doc=${lib.boolToString withDocs}"
+    "-Dintrospection=${if withIntrospection then "enabled" else "disabled"}"
   ] ++ lib.optionals (!x11Support) [
     "-Dxft=disabled" # only works with x11
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dintrospection=disabled"
   ];
 
   # Fontconfig error: Cannot load default config file
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index 08741c29dd6..1d6bf0f7aa4 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
     xmlto
     python3
     docbook_xml_dtd_45
+    docbook_xsl
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/xpybutil/default.nix b/pkgs/development/python-modules/xpybutil/default.nix
index af8fda8a7d2..cc574c58241 100644
--- a/pkgs/development/python-modules/xpybutil/default.nix
+++ b/pkgs/development/python-modules/xpybutil/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, xcffib, pillow, nose }:
+{ lib, buildPythonPackage, fetchFromGitHub, xcffib, pillow }:
 
 buildPythonPackage rec {
   pname = "xpybutil";
@@ -17,7 +17,12 @@ buildPythonPackage rec {
 
   propagatedNativeBuildInputs = [ xcffib ];
 
-  checkInputs = [ nose ];
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "xpybutil"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/BurntSushi/xpybutil";
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index ac715147dc3..05b7aac82c1 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -29,6 +29,10 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
+  depsBuildBuild = [
+    python3
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 8f2121c2599..9ce5b525e52 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -55,6 +55,8 @@ stdenv.mkDerivation rec {
 
   configureFlags =
     [
+      "--with-libxml2=${libxml2.dev}"
+      "--with-libxml2-cflags=-I${libxml2.dev}/include/libxml2"
       # Make sure to use a static value for the timeout. If we do not set a value
       # here autogen will select one based on the execution time of the configure
       # phase which is not really reproducible.
@@ -64,8 +66,6 @@ stdenv.mkDerivation rec {
       "--enable-timeout=78"
     ]
     ++ (lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--with-libxml2=${libxml2.dev}"
-      "--with-libxml2-cflags=-I${libxml2.dev}/include/libxml2"
       # the configure check for regcomp wants to run a host program
       "libopts_cv_with_libregex=yes"
       #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 24edb2c5955..4521eee95a2 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -14,8 +14,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ZznkyqQuau0zmb5Dh8p5OZZAlnM06RcohjuOqpIlgr4=";
   };
 
-  nativeBuildInputs = [ gettext perlPackages.LocaleGettext ];
-  buildInputs = [ perlPackages.perl perlPackages.LocaleGettext ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ gettext perlPackages.perl perlPackages.LocaleGettext ];
+  buildInputs = [ perlPackages.LocaleGettext ];
 
   doCheck = false;                                # target `check' is missing
 
diff --git a/pkgs/development/tools/misc/itstool/default.nix b/pkgs/development/tools/misc/itstool/default.nix
index 01a0fab369e..2c189cbf5a6 100644
--- a/pkgs/development/tools/misc/itstool/default.nix
+++ b/pkgs/development/tools/misc/itstool/default.nix
@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1acjgf8zlyk7qckdk19iqaca4jcmywd7vxjbcs1mm6kaf8icqcv2";
   };
 
-  pythonPath = [ python3.pkgs.libxml2 ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ python3 python3.pkgs.wrapPython ];
   buildInputs = [ python3 python3.pkgs.libxml2 ];
-  nativeBuildInputs = [ python3.pkgs.wrapPython ];
+  pythonPath = [ python3.pkgs.libxml2 ];
 
   postFixup = ''
     wrapPythonPrograms
diff --git a/pkgs/misc/ghostscript/default.nix b/pkgs/misc/ghostscript/default.nix
index 676c24b3f7d..92223d30f95 100644
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@@ -1,6 +1,6 @@
 { config, stdenv, lib, fetchurl, pkg-config, zlib, expat, openssl, autoconf
 , libjpeg, libpng, libtiff, freetype, fontconfig, libpaper, jbig2dec
-, libiconv, ijs, lcms2, fetchpatch, callPackage
+, libiconv, ijs, lcms2, fetchpatch, callPackage, bash, buildPackages
 , cupsSupport ? config.ghostscript.cups or (!stdenv.isDarwin), cups ? null
 , x11Support ? cupsSupport, xlibsWrapper ? null # with CUPS, X11 only adds very little
 }:
@@ -58,17 +58,27 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkg-config autoconf ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  nativeBuildInputs = [ pkg-config autoconf zlib ]
+    ++ lib.optional cupsSupport cups;
+
   buildInputs =
     [ zlib expat openssl
       libjpeg libpng libtiff freetype fontconfig libpaper jbig2dec
-      libiconv ijs lcms2
+      libiconv ijs lcms2 bash
     ]
     ++ lib.optional x11Support xlibsWrapper
     ++ lib.optional cupsSupport cups
     ;
 
   preConfigure = ''
+    # https://ghostscript.com/doc/current/Make.htm
+    export CCAUX=$CC_FOR_BUILD
+    ${lib.optionalString cupsSupport ''export CUPSCONFIG="${cups.dev}/bin/cups-config"''}
+
     # requires in-tree (heavily patched) openjpeg
     rm -rf jpeg libpng zlib jasper expat tiff lcms2mt jbig2dec freetype cups/libs ijs
 
@@ -85,9 +95,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional x11Support "--with-x"
   ++ lib.optionals cupsSupport [
     "--enable-cups"
-    "--with-cups-serverbin=$(out)/lib/cups"
-    "--with-cups-serverroot=$(out)/etc/cups"
-    "--with-cups-datadir=$(out)/share/cups"
   ];
 
   # make check does nothing useful
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 344913888d5..d5d533c3fc5 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -4,13 +4,14 @@
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gawk
 , withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl, perl
-, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python, python
+, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3, python3
 , swig
 , ncurses
 , pam
 , libnotify
 , buildPackages
 , coreutils
+, bash
 , gnugrep
 , gnused
 , kmod
@@ -68,6 +69,11 @@ let
     name = "libapparmor-${apparmor-version}";
     src = apparmor-sources;
 
+   # checking whether python bindings are enabled... yes
+   # checking for python3... no
+   # configure: error: python is required when enabling python bindings
+    strictDeps = false;
+
     nativeBuildInputs = [
       autoreconfHook
       bison
@@ -77,11 +83,11 @@ let
       ncurses
       which
       perl
-    ];
+    ] ++ lib.optional withPython python3;
 
     buildInputs = []
       ++ lib.optional withPerl perl
-      ++ lib.optional withPython python;
+      ++ lib.optional withPython python3;
 
     # required to build apparmor-parser
     dontDisableStatic = true;
@@ -117,11 +123,14 @@ let
     name = "apparmor-utils-${apparmor-version}";
     src = apparmor-sources;
 
-    nativeBuildInputs = [ makeWrapper which ];
+    strictDeps = true;
+
+    nativeBuildInputs = [ makeWrapper which python3 ];
 
     buildInputs = [
+      bash
       perl
-      python
+      python3
       libapparmor
       libapparmor.python
     ];
@@ -143,7 +152,7 @@ let
     postInstall = ''
       sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
       for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python3.libPrefix}/site-packages:$PYTHONPATH"
       done
 
       substituteInPlace $out/bin/aa-notify \
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index db576302997..4fcbb371c76 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchurl, bash }:
 
 stdenv.mkDerivation rec {
   pname = "pax-utils";
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-7sp/vZi8Zr6tSncADCAl2fF+qCAbhCRYgkBs4AubaxQ=";
   };
 
+  strictDeps = true;
+
+  buildInputs = [ bash ];
+
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 232b228394b..a2836be7ef8 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -40,7 +40,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook makeWrapper perlPackages.perl perlPackages.XMLParser ];
+  nativeBuildInputs = [ pkg-config autoreconfHook makeWrapper perlPackages.perl perlPackages.XMLParser ]
+    ++ lib.optionals stdenv.isLinux [ glib ];
 
   propagatedBuildInputs =
     lib.optionals stdenv.isLinux [ libcap ];
diff --git a/pkgs/servers/x11/xorg/xcb-util-xrm.nix b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
index ee870f07125..0235ad29cc6 100644
--- a/pkgs/servers/x11/xorg/xcb-util-xrm.nix
+++ b/pkgs/servers/x11/xorg/xcb-util-xrm.nix
@@ -9,10 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "118cj1ybw86pgw0l5whn9vbg5n5b0ijcpx295mwahzi004vz671h";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [ pkg-config m4 ];
   doCheck = true;
-  buildInputs = [ libxcb xcbutil ];
-  checkInputs = [ libX11 ];
+  buildInputs = [ libxcb xcbutil libX11 ];
 
   meta = with lib; {
     description = "XCB utility functions for the X resource manager";
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix
index f225f2196cc..b98c5538499 100644
--- a/pkgs/tools/graphics/graphviz/base.nix
+++ b/pkgs/tools/graphics/graphviz/base.nix
@@ -1,7 +1,7 @@
 { rev, sha256, version }:
 
 { lib, stdenv, fetchFromGitLab, autoreconfHook, pkg-config, cairo, expat, flex
-, fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
+, fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango, bash
 , bison, fetchpatch, xorg, ApplicationServices, python3 }:
 
 let
@@ -41,11 +41,16 @@ stdenv.mkDerivation {
     inherit sha256 rev;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config python3 ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+    bison
+    flex
+  ];
 
   buildInputs = [
-    libpng libjpeg expat bison libtool fontconfig gd gts libdevil flex pango
-    gettext
+    libpng libjpeg expat fontconfig gd gts libdevil pango bash
   ] ++ optionals (xorg != null) (with xorg; [ libXrender libXaw libXpm ])
     ++ optionals (stdenv.isDarwin) [ ApplicationServices ];
 
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index 5b158f2cbb0..cb57fb2bb07 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -55,10 +55,10 @@ stdenv.mkDerivation rec {
   # have to pass "--with-appresdir", too.
   configureFlags = [
     "--without-x"
+    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
   ] ++ lib.optionals (ghostscript != null) [
     "--with-gs=${ghostscript}/bin/gs"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "ac_cv_path_PERL=${buildPackages.perl}/bin/perl"
     "gl_cv_func_signbit=yes"
   ];
 
@@ -106,7 +106,6 @@ stdenv.mkDerivation rec {
     substituteInPlace $perl/bin/grog \
       --replace $out/lib/groff/grog $perl/lib/groff/grog
 
-  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     find $perl/ -type f -print0 | xargs --null sed -i 's|${buildPackages.perl}|${perl}|'
   '';
 
diff --git a/pkgs/tools/text/sgml/opensp/default.nix b/pkgs/tools/text/sgml/opensp/default.nix
index 6924c8953ee..a2ad5e4993b 100644
--- a/pkgs/tools/text/sgml/opensp/default.nix
+++ b/pkgs/tools/text/sgml/opensp/default.nix
@@ -32,10 +32,13 @@ stdenv.mkDerivation rec {
 
   preConfigure = if stdenv.isCygwin then "autoreconf -fi" else null;
 
-  # need autoconf, automake, gettext, and libtool for reconfigure
-  nativeBuildInputs = lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
+  strictDeps = true;
 
-  buildInputs = [ xmlto docbook_xml_dtd_412 libxslt docbook_xsl gettext libiconv ];
+  nativeBuildInputs = [
+    xmlto
+    docbook_xml_dtd_412
+    docbook_xsl
+  ] ++ lib.optionals stdenv.isCygwin [ autoconf automake libtool ];
 
   doCheck = false; # fails
 
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index aac992552d3..42ac92698b0 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, lib, stdenv, texinfo, perlPackages
 , groff, libxml2, libxslt, gnused, libiconv, opensp
-, docbook_xml_dtd_43
+, docbook_xml_dtd_43, bash
 , makeWrapper }:
 
 stdenv.mkDerivation rec {
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ texinfo groff libxml2 libxslt opensp libiconv ]
+  nativeBuildInputs = [ makeWrapper perlPackages.perl texinfo libxslt ];
+  buildInputs = [ groff libxml2 opensp libiconv bash ]
     ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3b3362b861d..0d4a976501d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21591,7 +21591,7 @@ with pkgs;
 
   iucode-tool = callPackage ../os-specific/linux/microcode/iucode-tool.nix { };
 
-  inherit (callPackages ../os-specific/linux/apparmor { python = python3; })
+  inherit (callPackages ../os-specific/linux/apparmor { })
     libapparmor apparmor-utils apparmor-bin-utils apparmor-parser apparmor-pam
     apparmor-profiles apparmor-kernel-patches apparmorRulesFromClosure;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6129719d049..8393c1fd4ba 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8046,6 +8046,11 @@ let
     };
     nativeBuildInputs = [ buildPackages.pkg-config ];
     propagatedBuildInputs = [ pkgs.pkg-config ];
+    postPatch = ''
+      # no pkg-config binary when cross-compiling so the check fails
+      substituteInPlace Makefile.PL \
+        --replace "pkg-config" "$PKG_CONFIG"
+    '';
     doCheck = false; # expects test_glib-2.0.pc in PKG_CONFIG_PATH
     meta = {
       homepage = "http://gtk2-perl.sourceforge.net";
@@ -24561,6 +24566,7 @@ let
       })
     ];
     AUTOMATED_TESTING = false;
+    nativeBuildInputs = [ pkgs.pkg-config ];
     buildInputs = [ pkgs.xorg.libxcb pkgs.xorg.xcbproto pkgs.xorg.xcbutil pkgs.xorg.xcbutilwm ExtUtilsDepends ExtUtilsPkgConfig TestDeep TestException XSObjectMagic ];
     propagatedBuildInputs = [ DataDump MouseXNativeTraits XMLDescent XMLSimple ];
     NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm";