summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/go.xml12
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml5
-rw-r--r--nixos/modules/hardware/all-firmware.nix1
-rw-r--r--nixos/modules/programs/singularity.nix4
-rw-r--r--nixos/modules/services/continuous-integration/gitlab-runner.nix2
-rwxr-xr-xnixos/modules/services/misc/confd.nix2
-rw-r--r--nixos/modules/services/misc/etcd.nix2
-rw-r--r--nixos/modules/services/misc/gitea.nix16
-rw-r--r--nixos/modules/services/misc/gogs.nix6
-rw-r--r--nixos/modules/services/misc/leaps.nix2
-rw-r--r--nixos/modules/services/misc/ssm-agent.nix3
-rw-r--r--nixos/modules/services/monitoring/bosun.nix2
-rw-r--r--nixos/modules/services/monitoring/grafana-reporter.nix2
-rw-r--r--nixos/modules/services/monitoring/grafana.nix2
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/snmp.nix2
-rw-r--r--nixos/modules/services/monitoring/scollector.nix2
-rw-r--r--nixos/modules/services/networking/consul.nix8
-rw-r--r--nixos/modules/services/networking/flannel.nix6
-rw-r--r--nixos/modules/services/networking/skydns.nix2
-rw-r--r--nixos/modules/services/security/hologram-agent.nix4
-rw-r--r--nixos/modules/services/security/hologram-server.nix2
-rw-r--r--nixos/modules/services/security/oauth2_proxy.nix2
-rw-r--r--nixos/modules/services/web-apps/mattermost.nix2
-rw-r--r--nixos/modules/virtualisation/ecs-agent.nix3
-rw-r--r--nixos/modules/virtualisation/lxd.nix2
-rw-r--r--pkgs/applications/blockchains/dcrwallet.nix4
-rw-r--r--pkgs/applications/blockchains/quorum.nix4
-rw-r--r--pkgs/applications/misc/overmind/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/k3s/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/kompose/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/kops/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/minishift/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/openshift/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/stern/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix2
-rw-r--r--pkgs/applications/networking/sync/rclone/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/grv/default.nix2
-rw-r--r--pkgs/applications/version-management/gitea/default.nix4
-rw-r--r--pkgs/applications/version-management/gitlab/gitaly/default.nix2
-rw-r--r--pkgs/applications/version-management/gitlab/gitlab-shell/default.nix4
-rw-r--r--pkgs/applications/version-management/gogs/default.nix4
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix7
-rw-r--r--pkgs/applications/virtualization/docker-slim/default.nix2
-rw-r--r--pkgs/applications/virtualization/docker/proxy.nix2
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/runc/default.nix4
-rw-r--r--pkgs/applications/virtualization/singularity/default.nix12
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix7
-rw-r--r--pkgs/data/fonts/liberation-fonts/default.nix67
-rw-r--r--pkgs/data/fonts/redhat-liberation-fonts/default.nix70
-rw-r--r--pkgs/data/misc/iana-etc/default.nix4
-rw-r--r--pkgs/desktops/deepin/dde-api/default.nix4
-rw-r--r--pkgs/desktops/deepin/dde-daemon/default.nix2
-rw-r--r--pkgs/desktops/deepin/startdde/default.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/compiler-rt.nix5
-rw-r--r--pkgs/development/compilers/llvm/10/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/6/compiler-rt.nix5
-rw-r--r--pkgs/development/compilers/llvm/6/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/7/compiler-rt.nix5
-rw-r--r--pkgs/development/compilers/llvm/7/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/8/compiler-rt.nix5
-rw-r--r--pkgs/development/compilers/llvm/8/llvm.nix1
-rw-r--r--pkgs/development/compilers/llvm/9/compiler-rt.nix5
-rw-r--r--pkgs/development/compilers/llvm/9/llvm.nix1
-rw-r--r--pkgs/development/go-packages/generic/default.nix9
-rw-r--r--pkgs/development/libraries/c-blosc/default.nix4
-rw-r--r--pkgs/development/libraries/glew/default.nix4
-rw-r--r--pkgs/development/libraries/gobject-introspection/setup-hook.sh9
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix18
-rw-r--r--pkgs/development/libraries/gtk/patches/01-build-Fix-path-handling-in-pkgconfig.patch30
-rw-r--r--pkgs/development/libraries/ilmbase/default.nix23
-rw-r--r--pkgs/development/libraries/libcbor/default.nix2
-rw-r--r--pkgs/development/libraries/libfido2/default.nix8
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix20
-rw-r--r--pkgs/development/libraries/libssh/default.nix4
-rw-r--r--pkgs/development/libraries/libvorbis/default.nix6
-rw-r--r--pkgs/development/libraries/nettle/default.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix14
-rw-r--r--pkgs/development/libraries/opencv/cmake-don-t-use-OpenCVFindOpenEXR.patch55
-rw-r--r--pkgs/development/libraries/openexr/default.nix45
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix4
-rw-r--r--pkgs/development/python-modules/certifi/default.nix8
-rw-r--r--pkgs/development/python-modules/dask/default.nix17
-rw-r--r--pkgs/development/python-modules/ipython/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter_client/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter_core/default.nix4
-rw-r--r--pkgs/development/python-modules/line_profiler/default.nix4
-rw-r--r--pkgs/development/python-modules/nbformat/2.nix4
-rw-r--r--pkgs/development/python-modules/nbformat/default.nix4
-rw-r--r--pkgs/development/python-modules/notebook/2.nix4
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix4
-rw-r--r--pkgs/development/python-modules/reikna/default.nix4
-rw-r--r--pkgs/development/python-modules/sounddevice/default.nix4
-rw-r--r--pkgs/development/python-modules/statsmodels/default.nix4
-rw-r--r--pkgs/development/python-modules/tabulate/default.nix4
-rw-r--r--pkgs/development/python-modules/tqdm/default.nix4
-rw-r--r--pkgs/development/python-modules/xarray/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix44
-rw-r--r--pkgs/development/tools/build-managers/meson/more-env-vars.patch16
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh7
-rw-r--r--pkgs/development/tools/buildah/default.nix4
-rw-r--r--pkgs/development/tools/cloudfoundry-cli/default.nix2
-rw-r--r--pkgs/development/tools/container-linux-config-transpiler/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-agent/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix12
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix8
-rw-r--r--pkgs/development/tools/deis/default.nix4
-rw-r--r--pkgs/development/tools/dep2nix/default.nix2
-rw-r--r--pkgs/development/tools/doctl/default.nix2
-rw-r--r--pkgs/development/tools/fac/default.nix2
-rw-r--r--pkgs/development/tools/go2nix/default.nix4
-rw-r--r--pkgs/development/tools/gocode-gomod/default.nix2
-rw-r--r--pkgs/development/tools/kind/default.nix2
-rw-r--r--pkgs/development/tools/misc/hound/default.nix2
-rw-r--r--pkgs/development/tools/out-of-tree/default.nix2
-rw-r--r--pkgs/development/tools/pandoc/default.nix29
-rw-r--r--pkgs/development/tools/parsing/re2c/default.nix14
-rw-r--r--pkgs/development/tools/skaffold/default.nix2
-rw-r--r--pkgs/development/tools/skopeo/default.nix2
-rw-r--r--pkgs/development/tools/toxiproxy/default.nix4
-rw-r--r--pkgs/development/tools/vgo2nix/default.nix2
-rw-r--r--pkgs/development/tools/wally-cli/default.nix2
-rw-r--r--pkgs/development/tools/xcbuild/wrapper.nix4
-rw-r--r--pkgs/games/boohu/default.nix2
-rw-r--r--pkgs/games/harmonist/default.nix2
-rw-r--r--pkgs/misc/cups/default.nix4
-rw-r--r--pkgs/misc/logging/beats/6.x.nix2
-rw-r--r--pkgs/misc/logging/beats/7.x.nix2
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix15
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix7
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix28
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix21
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix6
-rw-r--r--pkgs/servers/dex/default.nix4
-rw-r--r--pkgs/servers/etcd/default.nix2
-rw-r--r--pkgs/servers/meguca/default.nix6
-rw-r--r--pkgs/servers/miniflux/default.nix2
-rw-r--r--pkgs/servers/monitoring/grafana-reporter/default.nix2
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix6
-rw-r--r--pkgs/servers/monitoring/loki/default.nix2
-rw-r--r--pkgs/servers/monitoring/prometheus/alertmanager.nix2
-rw-r--r--pkgs/servers/monitoring/prometheus/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/postfix-exporter.nix2
-rw-r--r--pkgs/servers/monitoring/prometheus/pushgateway.nix2
-rw-r--r--pkgs/servers/monitoring/uchiwa/default.nix4
-rw-r--r--pkgs/servers/nginx-sso/default.nix4
-rw-r--r--pkgs/servers/sql/cockroachdb/default.nix8
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix27
-rw-r--r--pkgs/tools/admin/docker-credential-helpers/default.nix6
-rw-r--r--pkgs/tools/admin/lxd/default.nix4
-rw-r--r--pkgs/tools/backup/diskrsync/default.nix2
-rw-r--r--pkgs/tools/backup/duplicacy/default.nix2
-rw-r--r--pkgs/tools/backup/restic/default.nix2
-rw-r--r--pkgs/tools/backup/restic/rest-server.nix2
-rw-r--r--pkgs/tools/filesystems/gcsfuse/default.nix4
-rw-r--r--pkgs/tools/misc/aptly/default.nix2
-rw-r--r--pkgs/tools/misc/direnv/default.nix6
-rw-r--r--pkgs/tools/misc/mongodb-tools/default.nix2
-rw-r--r--pkgs/tools/misc/phraseapp-client/default.nix2
-rw-r--r--pkgs/tools/misc/tewisay/default.nix6
-rw-r--r--pkgs/tools/networking/assh/default.nix2
-rw-r--r--pkgs/tools/networking/dd-agent/datadog-agent.nix16
-rw-r--r--pkgs/tools/networking/guardian-agent/default.nix8
-rw-r--r--pkgs/tools/package-management/morph/default.nix4
-rw-r--r--pkgs/tools/security/gopass/default.nix4
-rw-r--r--pkgs/tools/security/notary/default.nix2
-rw-r--r--pkgs/tools/security/vault/default.nix2
-rw-r--r--pkgs/tools/security/verifpal/default.nix4
-rw-r--r--pkgs/tools/system/localtime/default.nix2
-rw-r--r--pkgs/tools/text/gawk/default.nix4
-rw-r--r--pkgs/tools/virtualization/cri-tools/default.nix2
-rw-r--r--pkgs/tools/virtualization/distrobuilder/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix9
176 files changed, 644 insertions, 526 deletions
diff --git a/doc/languages-frameworks/go.xml b/doc/languages-frameworks/go.xml
index 84b146532b1..70c135555ea 100644
--- a/doc/languages-frameworks/go.xml
+++ b/doc/languages-frameworks/go.xml
@@ -192,18 +192,6 @@ deis = buildGoPackage rec {
   </para>
 
   <para>
-   <varname>buildGoPackage</varname> produces <xref linkend='chap-multiple-output' xrefstyle="select: title" /> where <varname>bin</varname> includes program binaries. You can test build a Go binary as follows:
-<screen>
-<prompt>$ </prompt>nix-build -A deis.bin
-</screen>
-   or build all outputs with:
-<screen>
-<prompt>$ </prompt>nix-build -A deis.all
-</screen>
-   <varname>bin</varname> output will be installed by default with <varname>nix-env -i</varname> or <varname>systemPackages</varname>.
-  </para>
-
-  <para>
    You may use Go packages installed into the active Nix profiles by adding the following to your ~/.bashrc:
 <screen>
 for p in $NIX_PROFILES; do
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index e380e65ea7c..07db926c97d 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -317,6 +317,11 @@ php.override {
      the <literal>notmuch.emacs</literal> output.
     </para>
    </listitem>
+   <listitem>
+   <para>
+     The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
+   </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/hardware/all-firmware.nix b/nixos/modules/hardware/all-firmware.nix
index 16be8bcfdd7..b07edb0f6ac 100644
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@@ -51,6 +51,7 @@ in {
         rtlwifi_new-firmware
         zd1211fw
         alsa-firmware
+        sof-firmware
         openelec-dvb-firmware
       ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
         ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
diff --git a/nixos/modules/programs/singularity.nix b/nixos/modules/programs/singularity.nix
index b27e122bd1d..6ac64a81fc2 100644
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -5,8 +5,8 @@ let
   cfg = config.programs.singularity;
   singularity = pkgs.singularity.overrideAttrs (attrs : {
     installPhase = attrs.installPhase + ''
-      mv $bin/libexec/singularity/bin/starter-suid $bin/libexec/singularity/bin/starter-suid.orig
-      ln -s /run/wrappers/bin/singularity-suid $bin/libexec/singularity/bin/starter-suid
+      mv $out/libexec/singularity/bin/starter-suid $out/libexec/singularity/bin/starter-suid.orig
+      ln -s /run/wrappers/bin/singularity-suid $out/libexec/singularity/bin/starter-suid
     '';
   });
 in {
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix
index bd4cf6a37ba..cce4797e13f 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix
@@ -127,7 +127,7 @@ in
       serviceConfig = {
         StateDirectory = "gitlab-runner";
         ExecReload= "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        ExecStart = ''${cfg.package.bin}/bin/gitlab-runner run \
+        ExecStart = ''${cfg.package}/bin/gitlab-runner run \
           --working-directory ${cfg.workDir} \
           --config /etc/gitlab-runner/config.toml \
           --service gitlab-runner \
diff --git a/nixos/modules/services/misc/confd.nix b/nixos/modules/services/misc/confd.nix
index 8e9bec15dd4..c1ebdb3dde9 100755
--- a/nixos/modules/services/misc/confd.nix
+++ b/nixos/modules/services/misc/confd.nix
@@ -75,7 +75,7 @@ in {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       serviceConfig = {
-        ExecStart = "${cfg.package.bin}/bin/confd";
+        ExecStart = "${cfg.package}/bin/confd";
       };
     };
 
diff --git a/nixos/modules/services/misc/etcd.nix b/nixos/modules/services/misc/etcd.nix
index 7322e1c080b..32360d43768 100644
--- a/nixos/modules/services/misc/etcd.nix
+++ b/nixos/modules/services/misc/etcd.nix
@@ -178,7 +178,7 @@ in {
 
       serviceConfig = {
         Type = "notify";
-        ExecStart = "${pkgs.etcd.bin}/bin/etcd";
+        ExecStart = "${pkgs.etcd}/bin/etcd";
         User = "etcd";
         LimitNOFILE = 40000;
       };
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 38910a5a005..7c8e2c75577 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -335,7 +335,7 @@ in
       description = "gitea";
       after = [ "network.target" ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
       wantedBy = [ "multi-user.target" ];
-      path = [ gitea.bin pkgs.gitAndTools.git ];
+      path = [ gitea pkgs.gitAndTools.git ];
 
       preStart = let
         runConfig = "${cfg.stateDir}/custom/conf/app.ini";
@@ -347,11 +347,11 @@ in
           cp -f ${configFile} ${runConfig}
 
           if [ ! -e ${secretKey} ]; then
-              ${gitea.bin}/bin/gitea generate secret SECRET_KEY > ${secretKey}
+              ${gitea}/bin/gitea generate secret SECRET_KEY > ${secretKey}
           fi
 
           if [ ! -e ${jwtSecret} ]; then
-              ${gitea.bin}/bin/gitea generate secret LFS_JWT_SECRET > ${jwtSecret}
+              ${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${jwtSecret}
           fi
 
           KEY="$(head -n1 ${secretKey})"
@@ -374,7 +374,7 @@ in
         HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 6 -type f -wholename "*git/hooks/*")
         if [ "$HOOKS" ]
         then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea.bin}/bin/gitea,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea}/bin/gitea,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
@@ -383,7 +383,7 @@ in
         # update command option in authorized_keys
         if [ -r ${cfg.stateDir}/.ssh/authorized_keys ]
         then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea.bin}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
         fi
       '';
 
@@ -392,7 +392,7 @@ in
         User = cfg.user;
         Group = "gitea";
         WorkingDirectory = cfg.stateDir;
-        ExecStart = "${gitea.bin}/bin/gitea web";
+        ExecStart = "${gitea}/bin/gitea web";
         Restart = "always";
 
         # Filesystem
@@ -450,7 +450,7 @@ in
        description = "gitea dump";
        after = [ "gitea.service" ];
        wantedBy = [ "default.target" ];
-       path = [ gitea.bin ];
+       path = [ gitea ];
 
        environment = {
          USER = cfg.user;
@@ -461,7 +461,7 @@ in
        serviceConfig = {
          Type = "oneshot";
          User = cfg.user;
-         ExecStart = "${gitea.bin}/bin/gitea dump";
+         ExecStart = "${gitea}/bin/gitea dump";
          WorkingDirectory = cfg.stateDir;
        };
     };
diff --git a/nixos/modules/services/misc/gogs.nix b/nixos/modules/services/misc/gogs.nix
index ee99967c261..c5070aaa356 100644
--- a/nixos/modules/services/misc/gogs.nix
+++ b/nixos/modules/services/misc/gogs.nix
@@ -200,7 +200,7 @@ in
       description = "Gogs (Go Git Service)";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.gogs.bin ];
+      path = [ pkgs.gogs ];
 
       preStart = let
         runConfig = "${cfg.stateDir}/custom/conf/app.ini";
@@ -230,7 +230,7 @@ in
         HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
         if [ "$HOOKS" ]
         then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs.bin}/bin/gogs,g' $HOOKS
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs}/bin/gogs,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
@@ -242,7 +242,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
-        ExecStart = "${pkgs.gogs.bin}/bin/gogs web";
+        ExecStart = "${pkgs.gogs}/bin/gogs web";
         Restart = "always";
       };
 
diff --git a/nixos/modules/services/misc/leaps.nix b/nixos/modules/services/misc/leaps.nix
index d4e88ecbebd..ef89d3e64d0 100644
--- a/nixos/modules/services/misc/leaps.nix
+++ b/nixos/modules/services/misc/leaps.nix
@@ -55,7 +55,7 @@ in
         Restart = "on-failure";
         WorkingDirectory = stateDir;
         PrivateTmp = true;
-        ExecStart = "${pkgs.leaps.bin}/bin/leaps -path ${toString cfg.path} -address ${cfg.address}:${toString cfg.port}";
+        ExecStart = "${pkgs.leaps}/bin/leaps -path ${toString cfg.path} -address ${cfg.address}:${toString cfg.port}";
       };
     };
   };
diff --git a/nixos/modules/services/misc/ssm-agent.nix b/nixos/modules/services/misc/ssm-agent.nix
index e951a4c7ffa..f7c05deeecb 100644
--- a/nixos/modules/services/misc/ssm-agent.nix
+++ b/nixos/modules/services/misc/ssm-agent.nix
@@ -35,7 +35,7 @@ in {
 
       path = [ fake-lsb-release ];
       serviceConfig = {
-        ExecStart = "${cfg.package.bin}/bin/agent";
+        ExecStart = "${cfg.package}/bin/agent";
         KillMode = "process";
         Restart = "on-failure";
         RestartSec = "15min";
@@ -43,4 +43,3 @@ in {
     };
   };
 }
-
diff --git a/nixos/modules/services/monitoring/bosun.nix b/nixos/modules/services/monitoring/bosun.nix
index b1c12cce1f8..04e9da1c81a 100644
--- a/nixos/modules/services/monitoring/bosun.nix
+++ b/nixos/modules/services/monitoring/bosun.nix
@@ -148,7 +148,7 @@ in {
         User = cfg.user;
         Group = cfg.group;
         ExecStart = ''
-          ${cfg.package.bin}/bin/bosun -c ${configFile}
+          ${cfg.package}/bin/bosun -c ${configFile}
         '';
       };
     };
diff --git a/nixos/modules/services/monitoring/grafana-reporter.nix b/nixos/modules/services/monitoring/grafana-reporter.nix
index b5a78e4583e..893c15d568b 100644
--- a/nixos/modules/services/monitoring/grafana-reporter.nix
+++ b/nixos/modules/services/monitoring/grafana-reporter.nix
@@ -59,7 +59,7 @@ in {
           "-templates ${cfg.templateDir}"
         ];
       in {
-        ExecStart = "${pkgs.grafana_reporter.bin}/bin/grafana-reporter ${args}";
+        ExecStart = "${pkgs.grafana_reporter}/bin/grafana-reporter ${args}";
       };
     };
   };
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 0f8bc2471e3..b0c81a46d4d 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -535,7 +535,7 @@ in {
         ${optionalString cfg.provision.enable ''
           export GF_PATHS_PROVISIONING=${provisionConfDir};
         ''}
-        exec ${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}
+        exec ${cfg.package}/bin/grafana-server -homepath ${cfg.dataDir}
       '';
       serviceConfig = {
         WorkingDirectory = cfg.dataDir;
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
index 045e48a3d0f..01276366e97 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@@ -58,7 +58,7 @@ in
     in {
     serviceConfig = {
       ExecStart = ''
-        ${pkgs.prometheus-snmp-exporter.bin}/bin/snmp_exporter \
+        ${pkgs.prometheus-snmp-exporter}/bin/snmp_exporter \
           --config.file=${escapeShellArg configFile} \
           --log.format=${escapeShellArg cfg.logFormat} \
           --log.level=${cfg.logLevel} \
diff --git a/nixos/modules/services/monitoring/scollector.nix b/nixos/modules/services/monitoring/scollector.nix
index 38cd2213de7..6f13ce889cb 100644
--- a/nixos/modules/services/monitoring/scollector.nix
+++ b/nixos/modules/services/monitoring/scollector.nix
@@ -118,7 +118,7 @@ in {
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
-        ExecStart = "${cfg.package.bin}/bin/scollector -conf=${conf} ${lib.concatStringsSep " " cfg.extraOpts}";
+        ExecStart = "${cfg.package}/bin/scollector -conf=${conf} ${lib.concatStringsSep " " cfg.extraOpts}";
       };
     };
 
diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix
index 689cbc8a986..f7d2afead06 100644
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@@ -179,15 +179,15 @@ in
             (filterAttrs (n: _: hasPrefix "consul.d/" n) config.environment.etc);
 
         serviceConfig = {
-          ExecStart = "@${cfg.package.bin}/bin/consul consul agent -config-dir /etc/consul.d"
+          ExecStart = "@${cfg.package}/bin/consul consul agent -config-dir /etc/consul.d"
             + concatMapStrings (n: " -config-file ${n}") configFiles;
-          ExecReload = "${cfg.package.bin}/bin/consul reload";
+          ExecReload = "${cfg.package}/bin/consul reload";
           PermissionsStartOnly = true;
           User = if cfg.dropPrivileges then "consul" else null;
           Restart = "on-failure";
           TimeoutStartSec = "infinity";
         } // (optionalAttrs (cfg.leaveOnStop) {
-          ExecStop = "${cfg.package.bin}/bin/consul leave";
+          ExecStop = "${cfg.package}/bin/consul leave";
         });
 
         path = with pkgs; [ iproute gnugrep gawk consul ];
@@ -238,7 +238,7 @@ in
 
         serviceConfig = {
           ExecStart = ''
-            ${cfg.alerts.package.bin}/bin/consul-alerts start \
+            ${cfg.alerts.package}/bin/consul-alerts start \
               --alert-addr=${cfg.alerts.listenAddr} \
               --consul-addr=${cfg.alerts.consulAddr} \
               ${optionalString cfg.alerts.watchChecks "--watch-checks"} \
diff --git a/nixos/modules/services/networking/flannel.nix b/nixos/modules/services/networking/flannel.nix
index dd2f6454e95..4c040112d28 100644
--- a/nixos/modules/services/networking/flannel.nix
+++ b/nixos/modules/services/networking/flannel.nix
@@ -19,8 +19,8 @@ in {
     package = mkOption {
       description = "Package to use for flannel";
       type = types.package;
-      default = pkgs.flannel.bin;
-      defaultText = "pkgs.flannel.bin";
+      default = pkgs.flannel;
+      defaultText = "pkgs.flannel";
     };
 
     publicIp = mkOption {
@@ -167,7 +167,7 @@ in {
         touch /run/flannel/docker
       '' + optionalString (cfg.storageBackend == "etcd") ''
         echo "setting network configuration"
-        until ${pkgs.etcdctl.bin}/bin/etcdctl set /coreos.com/network/config '${builtins.toJSON networkConfig}'
+        until ${pkgs.etcdctl}/bin/etcdctl set /coreos.com/network/config '${builtins.toJSON networkConfig}'
         do
           echo "setting network configuration, retry"
           sleep 1
diff --git a/nixos/modules/services/networking/skydns.nix b/nixos/modules/services/networking/skydns.nix
index 6ad18bb2240..e79d6de9264 100644
--- a/nixos/modules/services/networking/skydns.nix
+++ b/nixos/modules/services/networking/skydns.nix
@@ -83,7 +83,7 @@ in {
         SKYDNS_NAMESERVERS = concatStringsSep "," cfg.nameservers;
       };
       serviceConfig = {
-        ExecStart = "${cfg.package.bin}/bin/skydns";
+        ExecStart = "${cfg.package}/bin/skydns";
       };
     };
 
diff --git a/nixos/modules/services/security/hologram-agent.nix b/nixos/modules/services/security/hologram-agent.nix
index a5087b0a99b..e37334b3cf5 100644
--- a/nixos/modules/services/security/hologram-agent.nix
+++ b/nixos/modules/services/security/hologram-agent.nix
@@ -43,12 +43,12 @@ in {
       description = "Provide EC2 instance credentials to machines outside of EC2";
       after       = [ "network.target" ];
       wantedBy    = [ "multi-user.target" ];
-      requires    = [ "network-link-dummy0.service" "network-addresses-dummy0.service" ]; 
+      requires    = [ "network-link-dummy0.service" "network-addresses-dummy0.service" ];
       preStart = ''
         /run/current-system/sw/bin/rm -fv /run/hologram.sock
       '';
       serviceConfig = {
-        ExecStart = "${pkgs.hologram.bin}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
+        ExecStart = "${pkgs.hologram}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
       };
     };
 
diff --git a/nixos/modules/services/security/hologram-server.nix b/nixos/modules/services/security/hologram-server.nix
index bad02c7440b..4acf6ae0e21 100644
--- a/nixos/modules/services/security/hologram-server.nix
+++ b/nixos/modules/services/security/hologram-server.nix
@@ -123,7 +123,7 @@ in {
       wantedBy    = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.hologram.bin}/bin/hologram-server --debug --conf ${cfgFile}";
+        ExecStart = "${pkgs.hologram}/bin/hologram-server --debug --conf ${cfgFile}";
       };
     };
   };
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index 46caadee204..d5c5437329e 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -577,7 +577,7 @@ in
       serviceConfig = {
         User = "oauth2_proxy";
         Restart = "always";
-        ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${configString}";
+        ExecStart = "${cfg.package}/bin/oauth2_proxy ${configString}";
         EnvironmentFile = mkIf (cfg.keyFile != null) cfg.keyFile;
       };
     };
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 853347bf86e..f5c2c356afc 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -224,7 +224,7 @@ in
         serviceConfig = {
           User = "nobody";
           Group = "nogroup";
-          ExecStart = "${pkgs.matterircd.bin}/bin/matterircd ${concatStringsSep " " cfg.matterircd.parameters}";
+          ExecStart = "${pkgs.matterircd}/bin/matterircd ${concatStringsSep " " cfg.matterircd.parameters}";
           WorkingDirectory = "/tmp";
           PrivateTmp = true;
           Restart = "always";
diff --git a/nixos/modules/virtualisation/ecs-agent.nix b/nixos/modules/virtualisation/ecs-agent.nix
index fc51b159579..93fefe56d1a 100644
--- a/nixos/modules/virtualisation/ecs-agent.nix
+++ b/nixos/modules/virtualisation/ecs-agent.nix
@@ -38,9 +38,8 @@ in {
         if [ ! -z "$ECS_DATADIR" ]; then
           mkdir -p "$ECS_DATADIR"
         fi
-        ${cfg.package.bin}/bin/agent
+        ${cfg.package}/bin/agent
       '';
     };
   };
 }
-
diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix
index de48d3a780e..53b89a9f55b 100644
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@@ -108,7 +108,7 @@ in
       '';
 
       serviceConfig = {
-        ExecStart = "@${cfg.package.bin}/bin/lxd lxd --group lxd";
+        ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
         Type = "simple";
         KillMode = "process"; # when stopping, leave the containers alone
         LimitMEMLOCK = "infinity";
diff --git a/pkgs/applications/blockchains/dcrwallet.nix b/pkgs/applications/blockchains/dcrwallet.nix
index 163ed2615d3..258aad8e1bd 100644
--- a/pkgs/applications/blockchains/dcrwallet.nix
+++ b/pkgs/applications/blockchains/dcrwallet.nix
@@ -29,8 +29,8 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    mkdir -pv $bin/bin
-    cp -v dcrwallet $bin/bin
+    mkdir -pv $out/bin
+    cp -v dcrwallet $out/bin
   '';
 
 
diff --git a/pkgs/applications/blockchains/quorum.nix b/pkgs/applications/blockchains/quorum.nix
index 49bc0be108f..f745860f661 100644
--- a/pkgs/applications/blockchains/quorum.nix
+++ b/pkgs/applications/blockchains/quorum.nix
@@ -21,8 +21,8 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    mkdir -pv $bin/bin
-    cp -v build/bin/geth build/bin/bootnode build/bin/swarm $bin/bin
+    mkdir -pv $out/bin
+    cp -v build/bin/geth build/bin/bootnode build/bin/swarm $out/bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/overmind/default.nix b/pkgs/applications/misc/overmind/default.nix
index 7603a66cd36..29dc6f54e6c 100644
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@@ -8,7 +8,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
-    wrapProgram "$bin/bin/overmind" --prefix PATH : "${lib.makeBinPath [ tmux which ]}"
+    wrapProgram "$out/bin/overmind" --prefix PATH : "${lib.makeBinPath [ tmux which ]}"
   '';
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index b18e1f08dd4..134684f0639 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -126,8 +126,8 @@ let
     installPhase = ''
       pushd go/src/${goPackagePath}
 
-      mkdir -p "$bin/bin"
-      install -m 0755 -t "$bin/bin" ./bin/*
+      mkdir -p "$out/bin"
+      install -m 0755 -t "$out/bin" ./bin/*
 
       popd
     '';
@@ -181,8 +181,8 @@ let
     installPhase = ''
       pushd go/src/${goPackagePath}
 
-      mkdir -p "$bin/bin"
-      install -m 0755 -t "$bin/bin" ./dist/artifacts/k3s
+      mkdir -p "$out/bin"
+      install -m 0755 -t "$out/bin" ./dist/artifacts/k3s
 
       popd
     '';
diff --git a/pkgs/applications/networking/cluster/kompose/default.nix b/pkgs/applications/networking/cluster/kompose/default.nix
index 2467ed93b32..c01e1c8c004 100644
--- a/pkgs/applications/networking/cluster/kompose/default.nix
+++ b/pkgs/applications/networking/cluster/kompose/default.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     for shell in bash zsh; do
-      $bin/bin/kompose completion $shell > kompose.$shell
+      $out/bin/kompose completion $shell > kompose.$shell
       installShellCompletion kompose.$shell
     done
   '';
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index 3e1f63531bb..2a86fed0d08 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -34,7 +34,7 @@ let
 
         postInstall = ''
           for shell in bash zsh; do
-            $bin/bin/kops completion $shell > kops.$shell
+            $out/bin/kops completion $shell > kops.$shell
             installShellCompletion kops.$shell
           done
         '';
diff --git a/pkgs/applications/networking/cluster/minishift/default.nix b/pkgs/applications/networking/cluster/minishift/default.nix
index 3dcfbf6fd7e..0c932396e9e 100644
--- a/pkgs/applications/networking/cluster/minishift/default.nix
+++ b/pkgs/applications/networking/cluster/minishift/default.nix
@@ -48,7 +48,7 @@ in buildGoPackage rec {
   '';
 
   postInstall = ''
-    wrapProgram "$bin/bin/minishift" \
+    wrapProgram "$out/bin/minishift" \
       --prefix PATH ':' '${lib.makeBinPath [ docker-machine-kvm openshift ]}'
   '';
 
diff --git a/pkgs/applications/networking/cluster/openshift/default.nix b/pkgs/applications/networking/cluster/openshift/default.nix
index 19272c37ee8..b547434d8da 100644
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@@ -61,8 +61,8 @@ in buildGoPackage rec {
   '';
 
   installPhase = ''
-    mkdir -p $bin/bin
-    cp -a "_output/local/bin/$(go env GOOS)/$(go env GOARCH)/"* "$bin/bin/"
+    mkdir -p $out/bin
+    cp -a "_output/local/bin/$(go env GOOS)/$(go env GOARCH)/"* "$out/bin/"
     installShellCompletion --bash contrib/completions/bash/*
     installShellCompletion --zsh contrib/completions/zsh/*
   '';
diff --git a/pkgs/applications/networking/cluster/stern/default.nix b/pkgs/applications/networking/cluster/stern/default.nix
index 95ad965c346..8ad0e8711f2 100644
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@@ -20,7 +20,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall =
-    let stern = if isCrossBuild then buildPackages.stern else "$bin"; in
+    let stern = if isCrossBuild then buildPackages.stern else "$out"; in
     ''
       for shell in bash zsh; do
         ${stern}/bin/stern --completion $shell > stern.$shell
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 50a5129226a..516c4e51402 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -26,7 +26,7 @@ let
 
       postInstall = ''
         # remove all plugins, they are part of the main binary now
-        for i in $bin/bin/*; do
+        for i in $out/bin/*; do
           if [[ $(basename $i) != terraform ]]; then
             rm "$i"
           fi
@@ -88,7 +88,7 @@ let
 
             buildCommand = ''
               mkdir -p $out/bin/
-              makeWrapper "${terraform.bin}/bin/terraform" "$out/bin/terraform" \
+              makeWrapper "${terraform}/bin/terraform" "$out/bin/terraform" \
                 --set NIX_TERRAFORM_PLUGIN_DIR "${
                   buildEnv {
                     name = "tf-plugin-env";
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 26c969c671f..4e3066fc6ab 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -23,7 +23,7 @@ buildGoPackage rec {
   '';
 
   postInstall = ''
-    wrapProgram $bin/bin/terragrunt \
+    wrapProgram $out/bin/terragrunt \
       --set TERRAGRUNT_TFPATH ${lib.getBin terraform.full}/bin/terraform
   '';
 
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 57925a3292d..2fde398b2f5 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -15,7 +15,7 @@ buildGoPackage rec {
 
   subPackages = [ "." ];
 
-  outputs = [ "bin" "out" "man" ];
+  outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -23,7 +23,7 @@ buildGoPackage rec {
     let
       rcloneBin =
         if stdenv.buildPlatform == stdenv.hostPlatform
-        then "$bin"
+        then "$out"
         else stdenv.lib.getBin buildPackages.rclone;
     in
       ''
diff --git a/pkgs/applications/version-management/git-and-tools/grv/default.nix b/pkgs/applications/version-management/git-and-tools/grv/default.nix
index 8c915762b6e..64a4f8a823c 100644
--- a/pkgs/applications/version-management/git-and-tools/grv/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/grv/default.nix
@@ -36,7 +36,7 @@ buildGoPackage {
 
   installPhase = ''
     runHook preInstall
-    install -D grv $bin/bin/grv
+    install -D grv $out/bin/grv
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 570fb2ce56f..b18ac251016 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -44,7 +44,7 @@ buildGoPackage rec {
     )
   '';
 
-  outputs = [ "bin" "out" "data" ];
+  outputs = [ "out" "data" ];
 
   postInstall = ''
     mkdir $data
@@ -52,7 +52,7 @@ buildGoPackage rec {
     mkdir -p $out
     cp -R ./go/src/${goPackagePath}/options/locale $out/locale
 
-    wrapProgram $bin/bin/gitea \
+    wrapProgram $out/bin/gitea \
       --prefix PATH : ${makeBinPath [ bash git gzip openssh ]}
   '';
 
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 968b26632c7..37a2fc23af0 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -65,7 +65,7 @@ in buildGoPackage rec {
        "'/run/gitlab/shell-config.yml'"
   '';
 
-  outputs = [ "bin" "out" "ruby" ];
+  outputs = [ "out" "ruby" ];
 
   meta = with stdenv.lib; {
     homepage = "https://gitlab.com/gitlab-org/gitaly";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 40860b13e4d..2b4fddaa9c8 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -18,8 +18,8 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postInstall = ''
-    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/bin/* $bin/bin
-    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/{support,VERSION} $bin/
+    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/bin/* $out/bin
+    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/{support,VERSION} $out/
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index a35778ac023..48667ad8be3 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -34,13 +34,13 @@ buildGoPackage rec {
     (  optional sqliteSupport "sqlite"
     ++ optional pamSupport "pam");
 
-  outputs = [ "bin" "out" "data" ];
+  outputs = [ "out" "data" ];
 
   postInstall = ''
     mkdir $data
     cp -R $src/{public,templates} $data
 
-    wrapProgram $bin/bin/gogs \
+    wrapProgram $out/bin/gogs \
       --prefix PATH : ${makeBinPath [ bash git gzip openssh ]}
   '';
 
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 7ce4390ba30..fbeb2e3382f 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
   };
 
   goPackagePath = "github.com/containerd/containerd";
-  outputs = [ "bin" "out" "man" ];
+  outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ go-md2man utillinux ];
 
@@ -33,7 +33,7 @@ buildGoPackage rec {
 
   installPhase = ''
     for b in bin/*; do
-      install -Dm555 $b $bin/$b
+      install -Dm555 $b $out/$b
     done
 
     make man
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 7d866cd71bb..2fd3a0b39dd 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -30,7 +30,6 @@ buildGoPackage rec {
     sha256 = "142flmv54pj48rjqkd26fbxrcbx2cv6pdmrc33jgyvn6r99zliah";
   };
 
-  outputs = [ "bin" "out" ];
   nativeBuildInputs = [ git pkgconfig which ];
   buildInputs = [ btrfs-progs gpgme libapparmor libassuan libgpgerror
                  libseccomp libselinux lvm2 ]
@@ -43,9 +42,9 @@ buildGoPackage rec {
     make binaries BUILDTAGS="$BUILDTAGS"
   '';
   installPhase = ''
-    install -Dm755 bin/crio $bin/bin/crio${flavor}
-    install -Dm755 bin/crio-status $bin/bin/crio-status${flavor}
-    install -Dm755 bin/pinns $bin/bin/pinns${flavor}
+    install -Dm755 bin/crio $out/bin/crio${flavor}
+    install -Dm755 bin/crio-status $out/bin/crio-status${flavor}
+    install -Dm755 bin/pinns $out/bin/pinns${flavor}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index a4c2be05061..996d52bacab 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -33,7 +33,7 @@ buildGoPackage rec {
   # docker-slim tries to create its state dir next to the binary (inside the nix
   # store), so we set it to use the working directory at the time of invocation
   postInstall = ''
-    wrapProgram "$bin/bin/docker-slim" --add-flags '--state-path "$(pwd)"'
+    wrapProgram "$out/bin/docker-slim" --add-flags '--state-path "$(pwd)"'
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/docker/proxy.nix b/pkgs/applications/virtualization/docker/proxy.nix
index dde0b481497..cb3518d7d3d 100644
--- a/pkgs/applications/virtualization/docker/proxy.nix
+++ b/pkgs/applications/virtualization/docker/proxy.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
   goDeps = null;
 
   installPhase = ''
-    install -m755 -D ./go/bin/proxy $bin/bin/docker-proxy
+    install -m755 -D ./go/bin/proxy $out/bin/docker-proxy
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 8ca193194bc..feed5cadce3 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -25,7 +25,7 @@ buildGoPackage rec {
 
   goPackagePath = "github.com/containers/libpod";
 
-  outputs = [ "bin" "out" "man" ];
+  outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ pkg-config go-md2man installShellFiles ];
 
@@ -40,7 +40,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dm555 bin/podman $bin/bin/podman
+    install -Dm555 bin/podman $out/bin/podman
     installShellCompletion --bash completions/bash/podman
     installShellCompletion --zsh completions/zsh/_podman
     MANDIR=$man/share/man make install.man
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index 87385024967..b29b1f97d21 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -22,7 +22,7 @@ buildGoPackage rec {
   };
 
   goPackagePath = "github.com/opencontainers/runc";
-  outputs = [ "bin" "out" "man" ];
+  outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ go-md2man installShellFiles pkg-config which ];
   buildInputs = [ libseccomp libapparmor apparmor-parser ];
@@ -38,7 +38,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dm755 runc $bin/bin/runc
+    install -Dm755 runc $out/bin/runc
     installManPage man/*/*
   '';
 
diff --git a/pkgs/applications/virtualization/singularity/default.nix b/pkgs/applications/virtualization/singularity/default.nix
index 4477e7c7b1d..f6a1a3bc6a9 100644
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@@ -42,7 +42,7 @@ buildGoPackage rec {
     patchShebangs .
     sed -i 's|defaultPath := "[^"]*"|defaultPath := "${stdenv.lib.makeBinPath propagatedBuildInputs}"|' cmd/internal/cli/actions.go
 
-    ./mconfig -V ${version} -p $bin --localstatedir=/var
+    ./mconfig -V ${version} -p $out --localstatedir=/var
 
     # Don't install SUID binaries
     sed -i 's/-m 4755/-m 755/g' builddir/Makefile
@@ -54,16 +54,16 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    make -C builddir install LOCALSTATEDIR=$bin/var
-    chmod 755 $bin/libexec/singularity/bin/starter-suid
-    wrapProgram $bin/bin/singularity --prefix PATH : ${stdenv.lib.makeBinPath propagatedBuildInputs}
+    make -C builddir install LOCALSTATEDIR=$out/var
+    chmod 755 $out/libexec/singularity/bin/starter-suid
+    wrapProgram $out/bin/singularity --prefix PATH : ${stdenv.lib.makeBinPath propagatedBuildInputs}
   '';
 
   postFixup = ''
-    find $bin/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true
+    find $out/libexec/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true
 
     # These etc scripts shouldn't have their paths patched
-    cp etc/actions/* $bin/etc/singularity/actions/
+    cp etc/actions/* $out/etc/singularity/actions/
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 84020505a63..5cc99c6412a 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation {
 
   inherit targetPrefix infixSalt;
 
-  outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
+  outputs = [ "out" ] ++ optionals propagateDoc ([ "man" ] ++ optional (bintools ? info) "info");
 
   passthru = {
     inherit bintools libc nativeTools nativeLibc nativePrefix;
@@ -259,14 +259,15 @@ stdenv.mkDerivation {
       printWords ${bintools_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
     ''
 
-    + optionalString propagateDoc ''
+    + optionalString propagateDoc (''
       ##
       ## Man page and info support
       ##
 
       ln -s ${bintools.man} $man
+    '' + optionalString (bintools ? info) ''
       ln -s ${bintools.info} $info
-    ''
+    '')
 
     + ''
       ##
diff --git a/pkgs/data/fonts/liberation-fonts/default.nix b/pkgs/data/fonts/liberation-fonts/default.nix
new file mode 100644
index 00000000000..838a8d4c769
--- /dev/null
+++ b/pkgs/data/fonts/liberation-fonts/default.nix
@@ -0,0 +1,67 @@
+{ stdenv, fetchFromGitHub, fontforge, python3 }:
+let
+  inherit (python3.pkgs) fonttools;
+
+  common =
+    { version, repo, sha256, nativeBuildInputs, postPatch ? null }:
+      stdenv.mkDerivation rec {
+        pname = "liberation-fonts";
+        inherit version;
+
+        src = fetchFromGitHub {
+          owner = "liberationfonts";
+          rev = version;
+          inherit repo sha256;
+        };
+
+        inherit nativeBuildInputs postPatch;
+
+        installPhase = ''
+          find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
+
+          install -m444 -Dt $out/share/doc/${pname}-${version} AUTHORS     || true
+          install -m444 -Dt $out/share/doc/${pname}-${version} ChangeLog   || true
+          install -m444 -Dt $out/share/doc/${pname}-${version} COPYING     || true
+          install -m444 -Dt $out/share/doc/${pname}-${version} License.txt || true
+          install -m444 -Dt $out/share/doc/${pname}-${version} README      || true
+        '';
+
+        meta = with stdenv.lib; {
+          description = "Liberation Fonts, replacements for Times New Roman, Arial, and Courier New";
+          longDescription = ''
+            The Liberation Fonts are intended to be replacements for the three most
+            commonly used fonts on Microsoft systems: Times New Roman, Arial, and
+            Courier New. Since 2012 they are based on croscore fonts.
+
+            There are three sets: Sans (a substitute for Arial, Albany, Helvetica,
+            Nimbus Sans L, and Bitstream Vera Sans), Serif (a substitute for Times
+            New Roman, Thorndale, Nimbus Roman, and Bitstream Vera Serif) and Mono
+            (a substitute for Courier New, Cumberland, Courier, Nimbus Mono L, and
+            Bitstream Vera Sans Mono).
+          '';
+
+          license = licenses.ofl;
+          homepage = "https://github.com/liberationfonts";
+          maintainers = with maintainers; [ raskin ];
+        };
+      };
+in
+{
+  liberation_ttf_v1 = common {
+    repo = "liberation-1.7-fonts";
+    version = "1.07.5";
+    nativeBuildInputs = [ fontforge ];
+    sha256 = "1ffl10mf78hx598sy9qr5m6q2b8n3mpnsj73bwixnd4985gsz56v";
+  };
+  liberation_ttf_v2 = common {
+    repo = "liberation-fonts";
+    version = "2.1.0";
+    nativeBuildInputs = [ fontforge fonttools ];
+    postPatch = ''
+      substituteInPlace scripts/setisFixedPitch-fonttools.py --replace \
+        'font = ttLib.TTFont(fontfile)' \
+        'font = ttLib.TTFont(fontfile, recalcTimestamp=False)'
+    '';
+    sha256 = "03xpzaas264x5n6qisxkhc68pkpn32m7y78qdm3rdkxdwi8mv8mz";
+  };
+}
diff --git a/pkgs/data/fonts/redhat-liberation-fonts/default.nix b/pkgs/data/fonts/redhat-liberation-fonts/default.nix
deleted file mode 100644
index 1cb0eb349e4..00000000000
--- a/pkgs/data/fonts/redhat-liberation-fonts/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ stdenv, fetchFromGitHub, fontforge, python3 }:
-
-let
-  inherit (python3.pkgs) fonttools;
-
-  common =
-    { version, repo, sha256, nativeBuildInputs, postPatch ? null }:
-    stdenv.mkDerivation rec {
-      pname = "liberation-fonts";
-      inherit version;
-
-      src = fetchFromGitHub {
-        owner = "liberationfonts";
-        rev = version;
-        inherit repo sha256;
-      };
-
-      inherit nativeBuildInputs postPatch;
-
-      installPhase = ''
-        find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
-
-        install -m444 -Dt $out/share/doc/${pname}-${version} AUTHORS     || true
-        install -m444 -Dt $out/share/doc/${pname}-${version} ChangeLog   || true
-        install -m444 -Dt $out/share/doc/${pname}-${version} COPYING     || true
-        install -m444 -Dt $out/share/doc/${pname}-${version} License.txt || true
-        install -m444 -Dt $out/share/doc/${pname}-${version} README      || true
-      '';
-
-      meta = with stdenv.lib; {
-        description = "Liberation Fonts, replacements for Times New Roman, Arial, and Courier New";
-        longDescription = ''
-          The Liberation Fonts are intended to be replacements for the three most
-          commonly used fonts on Microsoft systems: Times New Roman, Arial, and
-          Courier New. Since 2012 they are based on croscore fonts.
-
-          There are three sets: Sans (a substitute for Arial, Albany, Helvetica,
-          Nimbus Sans L, and Bitstream Vera Sans), Serif (a substitute for Times
-          New Roman, Thorndale, Nimbus Roman, and Bitstream Vera Serif) and Mono
-          (a substitute for Courier New, Cumberland, Courier, Nimbus Mono L, and
-          Bitstream Vera Sans Mono).
-        '';
-
-        license = licenses.ofl;
-        homepage = "https://github.com/liberationfonts";
-        maintainers = [
-          maintainers.raskin
-        ];
-      };
-    };
-
-in {
-  liberation_ttf_v1 = common {
-    repo = "liberation-1.7-fonts";
-    version = "1.07.5";
-    nativeBuildInputs = [ fontforge ];
-    sha256 = "1ffl10mf78hx598sy9qr5m6q2b8n3mpnsj73bwixnd4985gsz56v";
-  };
-  liberation_ttf_v2 = common {
-    repo = "liberation-fonts";
-    version = "2.00.4";
-    nativeBuildInputs = [ fontforge fonttools ];
-    postPatch = ''
-      substituteInPlace scripts/setisFixedPitch-fonttools.py --replace \
-        'font = ttLib.TTFont(fontfile)' \
-        'font = ttLib.TTFont(fontfile, recalcTimestamp=False)'
-    '';
-    sha256 = "14bn1zlhyr4qaz5z2sx4h115pnbd41ix1vky8fxm2lx76xrjjiaa";
-  };
-}
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index d7d6c062e0c..2b2d2d19065 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchzip }:
 
 let
-  version = "20190731";
+  version = "20200407";
 in fetchzip {
   name = "iana-etc-${version}";
   url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-  sha256 = "0vqr4zm53zn7z75ynmf59xfrlhpyk8f41xd6i4v8j0f7k6hfdvpi";
+  sha256 = "1zmqim0l4lz5xbq7w2wi48fzsvg2msyw6c80dzw4vxll31frpy18";
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
diff --git a/pkgs/desktops/deepin/dde-api/default.nix b/pkgs/desktops/deepin/dde-api/default.nix
index 9fb18d04df8..accc7e2b701 100644
--- a/pkgs/desktops/deepin/dde-api/default.nix
+++ b/pkgs/desktops/deepin/dde-api/default.nix
@@ -37,8 +37,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  outputs = [ "out" ];
-
   nativeBuildInputs = [
     pkgconfig
     deepin-gettext-tools # build
@@ -109,7 +107,7 @@ buildGoPackage rec {
   installPhase = ''
     make install PREFIX="$out" SYSTEMD_LIB_DIR="$out/lib" -C go/src/${goPackagePath}
     mv $out/share/gocode $out/share/go
-    remove-references-to -t ${go} $out/bin/* $out/lib/deepin-api/*
+    remove-references-to -t ${go} $out/lib/deepin-api/*
   '';
 
   postFixup = ''
diff --git a/pkgs/desktops/deepin/dde-daemon/default.nix b/pkgs/desktops/deepin/dde-daemon/default.nix
index fdbb7856b06..ad818b2606c 100644
--- a/pkgs/desktops/deepin/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/dde-daemon/default.nix
@@ -29,8 +29,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  outputs = [ "out" ];
-
   nativeBuildInputs = [
     pkgconfig
     dbus-factory
diff --git a/pkgs/desktops/deepin/startdde/default.nix b/pkgs/desktops/deepin/startdde/default.nix
index 3050e7b9e13..137417f3754 100644
--- a/pkgs/desktops/deepin/startdde/default.nix
+++ b/pkgs/desktops/deepin/startdde/default.nix
@@ -22,8 +22,6 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  outputs = [ "out" ];
-
   nativeBuildInputs = [
     pkgconfig
     dbus-factory
@@ -114,7 +112,7 @@ buildGoPackage rec {
   installPhase = ''
     make install PREFIX="$out" -C go/src/${goPackagePath}
     rm -rf $out/share/lightdm  # this is uselesss for NixOS
-    remove-references-to -t ${go} $out/bin/* $out/sbin/*
+    remove-references-to -t ${go} $out/sbin/*
   '';
 
   postFixup = ''
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt.nix b/pkgs/development/compilers/llvm/10/compiler-rt.nix
index 4d31229d64c..c0ea436ae27 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt.nix
@@ -55,7 +55,10 @@ stdenv.mkDerivation rec {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/10/llvm.nix b/pkgs/development/compilers/llvm/10/llvm.nix
index 648c9fdefc3..82e4605a2f5 100644
--- a/pkgs/development/compilers/llvm/10/llvm.nix
+++ b/pkgs/development/compilers/llvm/10/llvm.nix
@@ -159,6 +159,7 @@ in stdenv.mkDerivation (rec {
 
   enableParallelBuilding = true;
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage    = "https://llvm.org/";
diff --git a/pkgs/development/compilers/llvm/6/compiler-rt.nix b/pkgs/development/compilers/llvm/6/compiler-rt.nix
index 1bdba107d7d..abb6796e3c7 100644
--- a/pkgs/development/compilers/llvm/6/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/6/compiler-rt.nix
@@ -54,7 +54,10 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/6/llvm.nix b/pkgs/development/compilers/llvm/6/llvm.nix
index 9f3b5e5ba0d..22dbb75d2d5 100644
--- a/pkgs/development/compilers/llvm/6/llvm.nix
+++ b/pkgs/development/compilers/llvm/6/llvm.nix
@@ -147,6 +147,7 @@ stdenv.mkDerivation ({
 
   enableParallelBuilding = true;
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage    = "https://llvm.org/";
diff --git a/pkgs/development/compilers/llvm/7/compiler-rt.nix b/pkgs/development/compilers/llvm/7/compiler-rt.nix
index 055fb01215f..e83a4a3c26f 100644
--- a/pkgs/development/compilers/llvm/7/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/7/compiler-rt.nix
@@ -55,7 +55,10 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/7/llvm.nix b/pkgs/development/compilers/llvm/7/llvm.nix
index 55485418e4f..0a85d862f20 100644
--- a/pkgs/development/compilers/llvm/7/llvm.nix
+++ b/pkgs/development/compilers/llvm/7/llvm.nix
@@ -168,6 +168,7 @@ in stdenv.mkDerivation ({
 
   enableParallelBuilding = true;
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage    = "https://llvm.org/";
diff --git a/pkgs/development/compilers/llvm/8/compiler-rt.nix b/pkgs/development/compilers/llvm/8/compiler-rt.nix
index 573c198d6da..b11659a78cc 100644
--- a/pkgs/development/compilers/llvm/8/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/8/compiler-rt.nix
@@ -55,7 +55,10 @@ stdenv.mkDerivation {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/8/llvm.nix b/pkgs/development/compilers/llvm/8/llvm.nix
index 43615fc675d..61ed24ba842 100644
--- a/pkgs/development/compilers/llvm/8/llvm.nix
+++ b/pkgs/development/compilers/llvm/8/llvm.nix
@@ -143,6 +143,7 @@ in stdenv.mkDerivation ({
 
   enableParallelBuilding = true;
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage    = "https://llvm.org/";
diff --git a/pkgs/development/compilers/llvm/9/compiler-rt.nix b/pkgs/development/compilers/llvm/9/compiler-rt.nix
index c7723a98291..7d712017eae 100644
--- a/pkgs/development/compilers/llvm/9/compiler-rt.nix
+++ b/pkgs/development/compilers/llvm/9/compiler-rt.nix
@@ -54,7 +54,10 @@ stdenv.mkDerivation rec {
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
   # get no binary cache for the entire platform. If you really find yourself wanting the TSAN, make this controllable by
   # a flag and turn the flag off during the stdenv build.
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  postPatch = ''
+    substituteInPlace cmake/builtin-config-ix.cmake \
+      --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + stdenv.lib.optionalString (useLLVM) ''
diff --git a/pkgs/development/compilers/llvm/9/llvm.nix b/pkgs/development/compilers/llvm/9/llvm.nix
index f69f45b858b..0344caa5e8a 100644
--- a/pkgs/development/compilers/llvm/9/llvm.nix
+++ b/pkgs/development/compilers/llvm/9/llvm.nix
@@ -160,6 +160,7 @@ in stdenv.mkDerivation (rec {
 
   enableParallelBuilding = true;
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = {
     description = "Collection of modular and reusable compiler and toolchain technologies";
     homepage    = "https://llvm.org/";
diff --git a/pkgs/development/go-packages/generic/default.nix b/pkgs/development/go-packages/generic/default.nix
index b4ec8bd1706..54d1c743bee 100644
--- a/pkgs/development/go-packages/generic/default.nix
+++ b/pkgs/development/go-packages/generic/default.nix
@@ -203,15 +203,15 @@ let
     installPhase = args.installPhase or ''
       runHook preInstall
 
-      mkdir -p $bin
+      mkdir -p $out
       dir="$NIX_BUILD_TOP/go/bin"
-      [ -e "$dir" ] && cp -r $dir $bin
+      [ -e "$dir" ] && cp -r $dir $out
 
       runHook postInstall
     '';
 
     preFixup = preFixup + ''
-      find $bin/bin -type f -exec ${removeExpr removeReferences} '{}' + || true
+      find $out/bin -type f -exec ${removeExpr removeReferences} '{}' + || true
     '';
 
     strictDeps = true;
@@ -235,9 +235,6 @@ let
 
     enableParallelBuilding = enableParallelBuilding;
 
-    # I prefer to call this dev but propagatedBuildInputs expects $out to exist
-    outputs = args.outputs or [ "bin" "out" ];
-
     meta = {
       # Add default meta information
       homepage = "https://${goPackagePath}";
diff --git a/pkgs/development/libraries/c-blosc/default.nix b/pkgs/development/libraries/c-blosc/default.nix
index d3bb3479911..85905778e80 100644
--- a/pkgs/development/libraries/c-blosc/default.nix
+++ b/pkgs/development/libraries/c-blosc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "c-blosc";
-  version = "1.17.1";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "Blosc";
     repo = "c-blosc";
     rev = "v${version}";
-    sha256 = "1asp3xmbvdnz1mj1pl1ykzz61cybvkxz3cdn43zh1z0x1qlgwm80";
+    sha256 = "1ywq8j70149859vvs19wgjq89d6xsvvmvm2n1dmkzpchxgrvnw70";
   };
 
   buildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index 8f237199a65..80a7759c574 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -4,11 +4,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "glew-2.1.0";
+  name = "glew-2.2.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/glew/${name}.tgz";
-    sha256 = "159wk5dc0ykjbxvag5i1m2mhp23zkk6ra04l26y3jc3nwvkr3ph4";
+    sha256 = "1qak8f7g1iswgswrgkzc7idk7jmqgwrs58fhg2ai007v7j4q5z6l";
   };
 
   outputs = [ "bin" "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/gobject-introspection/setup-hook.sh b/pkgs/development/libraries/gobject-introspection/setup-hook.sh
index a68d544cfbe..6bee47aeb09 100644
--- a/pkgs/development/libraries/gobject-introspection/setup-hook.sh
+++ b/pkgs/development/libraries/gobject-introspection/setup-hook.sh
@@ -18,7 +18,14 @@ giDiscoverSelf() {
     fi
 }
 
-preFixupHooks+=(giDiscoverSelf)
+# gappsWrapperArgsHook expects GI_TYPELIB_PATH variable to be set by this.
+# Until we have dependency mechanism in generic builder, we need to use this ugly hack.
+if [[ " ${preFixupPhases:-} " =~ " gappsWrapperArgsHook " ]]; then
+    preFixupPhases+=" "
+    preFixupPhases="${preFixupPhases/ gappsWrapperArgsHook / giDiscoverSelf gappsWrapperArgsHook }"
+else
+    preFixupPhases+=" giDiscoverSelf"
+fi
 
 _multioutMoveGlibGir() {
   moveToOutput share/gir-1.0 "${!outputDev}"
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index a3fe432017c..1e618730cd8 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -48,7 +48,7 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "gtk+3";
-  version = "3.24.18";
+  version = "3.24.20";
 
   outputs = [ "out" "dev" ] ++ optional withGtkDoc "devdoc";
   outputBin = "dev";
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "1lia2ybd1661j6mvrc00iyd50gm7sy157bdzlyf4mr028rzzzspm";
+    sha256 = "Laxp9xbo0EunqVCRWJ4rquyV3KzpMssVg5Fj20ebHfM=";
   };
 
   patches = [
@@ -71,12 +71,17 @@ stdenv.mkDerivation rec {
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
 
-    # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
-    ./patches/01-build-Fix-path-handling-in-pkgconfig.patch
+    # Fix path handling in pkg-config
+    # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1793
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/commit/6d9db8610eff8c12d594d53b7813d9eea1247801.patch";
+      sha256 = "QHseZWgPlZBDEM2dIVixUJkGZMCaYjahkLmSCqCcoWU=";
+    })
   ] ++ optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
     # e.g. https://gitlab.gnome.org/GNOME/gtk/blob/3.24.4/gtk/gtk-launch.c#L31-33
+    # https://gitlab.gnome.org/GNOME/gtk/merge_requests/536
     ./patches/3.0-darwin-x11.patch
   ];
 
@@ -92,6 +97,11 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS";
 
   postPatch = ''
+    # TODO: Remove in 3.24.21
+    # https://gitlab.gnome.org/GNOME/gtk/issues/2669
+    echo "${stdenv.shell}" > check-version.py
+    chmod +x check-version.py
+
     files=(
       build-aux/meson/post-install.py
       demos/gtk-demo/geninclude.py
diff --git a/pkgs/development/libraries/gtk/patches/01-build-Fix-path-handling-in-pkgconfig.patch b/pkgs/development/libraries/gtk/patches/01-build-Fix-path-handling-in-pkgconfig.patch
deleted file mode 100644
index ec69a12514f..00000000000
--- a/pkgs/development/libraries/gtk/patches/01-build-Fix-path-handling-in-pkgconfig.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 7b692e618c4183a51af3d3b0037f106c4fec2355 Mon Sep 17 00:00:00 2001
-From: worldofpeace <worldofpeace@protonmail.ch>
-Date: Fri, 19 Jul 2019 13:32:57 -0400
-Subject: [PATCH] build: Fix path handling in pkgconfig
-
----
- meson.build | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 36913b3f04..161b378ba5 100644
---- a/meson.build
-+++ b/meson.build
-@@ -834,10 +834,10 @@ configure_file(input: 'config.h.meson',
- # pkg-config files - bit of a mess all of this
- pkgconf = configuration_data()
- 
--pkgconf.set('prefix', get_option('prefix'))
-+pkgconf.set('prefix', gtk_prefix)
- pkgconf.set('exec_prefix', '${prefix}')
--pkgconf.set('libdir', '${prefix}/@0@'.format(get_option('libdir')))
--pkgconf.set('includedir', '${prefix}/@0@'.format(get_option('includedir')))
-+pkgconf.set('libdir', gtk_libdir)
-+pkgconf.set('includedir', join_paths('${prefix}', gtk_includedir))
- pkgconf.set('GTK_API_VERSION', gtk_api_version)
- pkgconf.set('VERSION', meson.project_version())
- pkgconf.set('GTK_BINARY_VERSION', gtk_binary_version)
--- 
-2.22.0
-
diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 4ea16a59e8b..9d2479c2e0b 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -1,9 +1,13 @@
-{ stdenv, lib, buildPackages, automake, autoconf, libtool, which,
-  fetchpatch, openexr }:
+{ stdenv
+, buildPackages
+, cmake
+, libtool
+, openexr
+}:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
-  version = lib.getVersion openexr;
+  version = stdenv.lib.getVersion openexr;
 
   # the project no longer provides separate tarballs. We may even want to merge
   # the ilmbase package into openexr in the future.
@@ -13,19 +17,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  preConfigure = ''
-    patchShebangs ./bootstrap
-    ./bootstrap
-  '';
-
+  nativeBuildInputs = [ cmake libtool ];
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ automake autoconf libtool which ];
-
-  NIX_CFLAGS_LINK = "-pthread";
 
-  patches = [
-    ./cross.patch
-  ];
+  patches = [ ./cross.patch ];
 
   # fails 1 out of 1 tests with
   # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
diff --git a/pkgs/development/libraries/libcbor/default.nix b/pkgs/development/libraries/libcbor/default.nix
index 7067caa42c0..9b6a54d92f9 100644
--- a/pkgs/development/libraries/libcbor/default.nix
+++ b/pkgs/development/libraries/libcbor/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # needs "-DWITH_TESTS=ON", but fails w/compilation error
 
+  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ];
+
   NIX_CFLAGS_COMPILE = "-fno-lto";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index 30ecdda3da2..b062b10732e 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -22,6 +22,14 @@ stdenv.mkDerivation rec {
   buildInputs = [ hidapi libcbor openssl ]
     ++ stdenv.lib.optionals stdenv.isLinux [ udev ];
 
+  patches = [
+    # make build reproducible
+    (fetchpatch {
+      url = "https://github.com/Yubico/libfido2/commit/e79f7d7996e70d6b2ae9826fce81d61659cab4f6.patch";
+      sha256 = "0jwg69f95qqf0ym24q1ka50d3d3338cyw4fdfzpw4sab0shiaq9v";
+    })
+  ];
+
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
     "-DUSE_HIDAPI=1"
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index 5772e0d24f6..92cde8aef4c 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -2,34 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "1hyywwjsmvsd7di603f7iznjlccqlc7yvz0j59gax7bljm9wb6ni";
+    sha256 = "0mkzdzdxjxjl794rblq4mq33wmb8ikqmfswbqdbr8gw2kw4wlhdl";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig python3 addOpenGLRunpath ];
   buildInputs = [ libX11 libXext xorgproto ];
 
-  # The following 3 patches should be removed once libglvnd >1.2.0 is released
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NVIDIA/libglvnd/commit/6f52473dac08c44b081b792874b4ce73122096da.patch";
-      sha256 = "0rd9ihl8n33cm0rya5a7ki0hn31fh52r0gaj5d4w80jrsah2ayij";
-    })
-    (fetchpatch {
-      url = "https://github.com/NVIDIA/libglvnd/commit/51233cc52cbcbe25f8461830913c06f5b5bc9508.patch";
-      sha256 = "1qx3nw8vq5xcrixmi7xw1vpy4gbf7kmx38rx8wg8x046g4mv8ijj";
-    })
-    (fetchpatch {
-      url = "https://github.com/NVIDIA/libglvnd/commit/5dfdc5a6dc60a3bdc63cd4510dabacba388da13a.patch";
-      sha256 = "0gmb3619yz3z7n22afjh8p2y13bmsky4r0z0csm14is3wvdi64ya";
-    })
-  ];
-
   postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace src/GLX/Makefile.am \
       --replace "-Wl,-Bsymbolic " ""
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index bf6e0a491f2..c6accad9c3c 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/0.8/${pname}-${version}.tar.xz";
-    sha256 = "1qk5bm9r6199jbfk54f8w24vkl52051g8s3kmq4z2kdc6vbpy4jb";
+    sha256 = "09b8w9m5qiap8wbvz4613nglsynpk8hn0q9b929ny2y4l2fy2nc5";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libvorbis/default.nix b/pkgs/development/libraries/libvorbis/default.nix
index c867b73c317..28c5536d626 100644
--- a/pkgs/development/libraries/libvorbis/default.nix
+++ b/pkgs/development/libraries/libvorbis/default.nix
@@ -12,12 +12,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://gitlab.xiph.org/xiph/vorbis/uploads/a68cf70fa10c8081a633f77b5c6576b7/0001-CVE-2017-14160-make-sure-we-don-t-overflow.patch";
-      sha256 = "0v21p59cb3z77ch1v6q5dcrd733h91f3m8ifnd7kkkr8gzn17d5x";
+      url = "https://gitlab.xiph.org/xiph/vorbis/commit/018ca26dece618457dd13585cad52941193c4a25.patch";
+      sha256 = "18k4vp0nmrxxpis641ylnw6dgwxrymh5bf74njr6v8dizmmz1bkj";
       name = "CVE-2017-14160+CVE-2018-10393.patch";
     })
     (fetchpatch {
-      url = "https://gitlab.xiph.org/xiph/vorbis/commit/112d3bd0aaa.diff";
+      url = "https://gitlab.xiph.org/xiph/vorbis/commit/112d3bd0aaacad51305e1464d4b381dabad0e88b.diff";
       sha256 = "1k77y3q36npy8mkkz40f6cb46l2ldrwyrd191m29s8rnbhnafdf7";
       name = "CVE-2018-10392.patch";
     })
diff --git a/pkgs/development/libraries/nettle/default.nix b/pkgs/development/libraries/nettle/default.nix
index 36c9f0e6ac7..7c0c6476bd0 100644
--- a/pkgs/development/libraries/nettle/default.nix
+++ b/pkgs/development/libraries/nettle/default.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.5.1";
+  version = "3.6";
 
   src = fetchurl {
     url = "mirror://gnu/nettle/nettle-${version}.tar.gz";
-    sha256 = "06clvkdfxhlbagn4afssylmn5vrak59dlmnvy8b2xc31hycs3k3m";
+    sha256 = "1wg3sprl0bzy49cmbwwm91vw67hk1x5i3ksdygsciyxz587hsk6j";
   };
 })
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index abec6e1ace5..9dcb9956838 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -38,20 +38,20 @@
 assert blas.implementation == "openblas" && lapack.implementation == "openblas";
 
 let
-  version = "4.1.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv";
     rev    = version;
-    sha256 = "0c98ziwvfrzdzwn52a36d37n5rac8zmxq2jn479bzfaii1bib8xx";
+    sha256 = "1r9bq9p1x99g2y8jvj9428sgqvljz75dm5vrfsma7hh5wjhz9775";
   };
 
   contribSrc = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv_contrib";
     rev    = version;
-    sha256 = "10ryyxhggin5dk5glf4ycyrfryqf50f4bs10biv6nxlrrinm2di4";
+    sha256 = "068b4f95rlryab3mffxs2w6dnbmbhrnpsdgl007rxk4bwnz29y49";
   };
 
   # Contrib must be built in order to enable Tesseract support:
@@ -62,8 +62,8 @@ let
     src = fetchFromGitHub {
       owner  = "opencv";
       repo   = "opencv_3rdparty";
-      rev    = "32e315a5b106a7b89dbed51c28f8120a48b368b4";
-      sha256 = "19w9f0r16072s59diqxsr5q6nmwyz9gnxjs49nglzhd66p3ddbkp";
+      rev    = "a56b6ac6f030c312b2dce17430eef13aed9af274";
+      sha256 = "1msbkc3zixx61rcg6a04i1bcfhw1phgsrh93glq1n80hgsk3nbjq";
     } + "/ippicv";
     files = let name = platform : "ippicv_2019_${platform}_general_20180723.tgz"; in
       if stdenv.hostPlatform.system == "x86_64-linux" then
@@ -168,7 +168,9 @@ stdenv.mkDerivation {
   # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with
   # what appears to be some stray headers in dnn/misc/tensorflow
   # in contrib when generating the Python bindings:
-  patches = lib.optional enableCuda ./cuda_opt_flow.patch;
+  patches = [
+    ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+  ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;
   postPatch = ''
     sed -i '/Add these standard paths to the search paths for FIND_LIBRARY/,/^\s*$/{d}' CMakeLists.txt
     sed -i -e 's|if len(decls) == 0:|if len(decls) == 0 or "opencv2/" not in hdr:|' ./modules/python/src2/gen2.py
diff --git a/pkgs/development/libraries/opencv/cmake-don-t-use-OpenCVFindOpenEXR.patch b/pkgs/development/libraries/opencv/cmake-don-t-use-OpenCVFindOpenEXR.patch
new file mode 100644
index 00000000000..dc80b09b646
--- /dev/null
+++ b/pkgs/development/libraries/opencv/cmake-don-t-use-OpenCVFindOpenEXR.patch
@@ -0,0 +1,55 @@
+From 6d988c08e852379a163ecd20df8639196d84d014 Mon Sep 17 00:00:00 2001
+From: Bernardo Meurer <meurerbernardo@gmail.com>
+Date: Sun, 26 Apr 2020 14:50:25 -0700
+Subject: [PATCH] cmake: don't use OpenCVFindOpenEXR
+
+Use find_package for this.
+---
+ CMakeLists.txt                  |  2 ++
+ cmake/OpenCVFindLibsGrfmt.cmake | 15 +++------------
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4c0b3880fc..0360469350 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -14,6 +14,8 @@ FATAL: In-source builds are not allowed.
+ ")
+ endif()
+ 
++# the future!
++include(FindPkgConfig)
+ 
+ include(cmake/OpenCVMinDepVersions.cmake)
+ 
+diff --git a/cmake/OpenCVFindLibsGrfmt.cmake b/cmake/OpenCVFindLibsGrfmt.cmake
+index 0beaf19317..4c5e46e615 100644
+--- a/cmake/OpenCVFindLibsGrfmt.cmake
++++ b/cmake/OpenCVFindLibsGrfmt.cmake
+@@ -227,20 +227,11 @@ endif()
+ # --- OpenEXR (optional) ---
+ if(WITH_OPENEXR)
+   ocv_clear_vars(HAVE_OPENEXR)
+-  if(NOT BUILD_OPENEXR)
+-    include("${OpenCV_SOURCE_DIR}/cmake/OpenCVFindOpenEXR.cmake")
+-  endif()
+-
++  pkg_check_modules(OPENEXR OpenEXR)
+   if(OPENEXR_FOUND)
+     set(HAVE_OPENEXR YES)
+-  else()
+-    ocv_clear_vars(OPENEXR_INCLUDE_PATHS OPENEXR_LIBRARIES OPENEXR_ILMIMF_LIBRARY OPENEXR_VERSION)
+-
+-    set(OPENEXR_LIBRARIES IlmImf)
+-    add_subdirectory("${OpenCV_SOURCE_DIR}/3rdparty/openexr")
+-    if(OPENEXR_VERSION)  # check via TARGET doesn't work
+-      set(HAVE_OPENEXR YES)
+-    endif()
++    set(OPENEXR_INCLUDE_PATHS ${OPENEXR_INCLUDE_DIRS})
++    set(OPENEXR_LIBRARIES ${OPENEXR_LIBRARIES})
+   endif()
+ endif()
+ 
+-- 
+2.26.1
+
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index da8fb429465..425afc70f37 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -1,11 +1,13 @@
-{ lib, stdenv, buildPackages, fetchFromGitHub, autoconf, automake, libtool, pkgconfig,
-  zlib, ilmbase, fetchpatch }:
-
-let
-  # Doesn't really do anything when not crosscompiling
-  emulator = stdenv.hostPlatform.emulator buildPackages;
-in
-
+{ lib
+, stdenv
+, buildPackages
+, fetchFromGitHub
+, zlib
+, ilmbase
+, fetchpatch 
+, cmake
+, libtool
+}:
 stdenv.mkDerivation rec {
   pname = "openexr";
   version = "2.4.1";
@@ -17,36 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "020gyl8zv83ag6gbcchmqiyx9rh2jca7j8n52zx1gk4rck7kwc01";
   };
 
-  sourceRoot = "source/OpenEXR";
-
   outputs = [ "bin" "dev" "out" "doc" ];
-
-  # Needed because there are some generated sources. Solution: just run them under QEMU.
-  postPatch = ''
-    for file in b44ExpLogTable dwaLookups
-    do
-      # Ecape for both sh and Automake
-      emu=${lib.escapeShellArg (lib.replaceStrings ["$"] ["$$"] emulator)}
-      before="./$file > $file.h"
-      after="$emu $before"
-      substituteInPlace IlmImf/Makefile.am \
-        --replace "$before" "$after"
-    done
-
-    # Make sure the patch succeeded
-    [[ $(grep "$emu" IlmImf/Makefile.am | wc -l) = 2 ]]
-  '';
-
-  preConfigure = ''
-    patchShebangs ./bootstrap
-    ./bootstrap
-  '';
-
-  nativeBuildInputs = [ pkgconfig autoconf automake libtool ];
+  nativeBuildInputs = [ cmake libtool ];
   propagatedBuildInputs = [ ilmbase zlib ];
 
   enableParallelBuilding = true;
-  doCheck = false; # fails 1 of 1 tests
 
   meta = with stdenv.lib; {
     description = "A high dynamic-range (HDR) image file format";
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index f6a40204587..53c98046993 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -96,12 +96,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.8";
+  version = "0.3.9";
   src = fetchFromGitHub {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "0s017qqi4n6jzrxl9cyx625wj26smnyn5g8s699s7h8v1srlrw6p";
+    sha256 = "0nq51j45shb32n6086xff3x374kx5qhr2cwjzvppx4s2z0ahflal";
   };
 
   inherit blas64;
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 04ae5a78bdb..94619956cff 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -5,13 +5,17 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2019.11.28";
+  version = "2020.4.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f";
+    sha256 = "06b5gfs7wmmipln8f3z928d2mmx2j4b3x7pnqmj6cvmyfh8v7z2i";
   };
 
+  pythonImportsCheck = [ "certifi" ];
+
+  dontUseSetuptoolsCheck = true;
+
   meta = {
     homepage = "https://certifi.io/";
     description = "Python package for providing Mozilla's CA Bundle";
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index b8dfd8deb4a..1b3a08aa997 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fsspec
-, pytest
+, pytestCheckHook
 , pythonOlder
 , cloudpickle
 , numpy
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2.10.1";
+  version = "2.14.0";
 
   disabled = pythonOlder "3.5";
 
@@ -23,13 +23,15 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    sha256 = "035mr7385yf5ng5wf60qxr80529h8dsla5hymkyg68dxhkd0jvbr";
+    sha256 = "0kj46pwzvdw8ii1h45y48wxvjid89yp4cfak2h4b8z8xic73fqgj";
   };
 
   checkInputs = [
-    pytest
+    pytestCheckHook
   ];
 
+  dontUseSetuptoolsCheck = true;
+
   propagatedBuildInputs = [
     bokeh
     cloudpickle
@@ -50,9 +52,10 @@ buildPythonPackage rec {
       --replace "cmdclass=versioneer.get_cmdclass()," ""
   '';
 
-  checkPhase = ''
-    pytest
-  '';
+  disabledTests = [
+    "test_argwhere_str"
+    "test_count_nonzero_str"
+  ];
 
   meta = {
     description = "Minimal task scheduling abstraction";
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index fe89691431c..9d6624a7df4 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "7.12.0";
+  version = "7.13.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9459e7237e2e5858738ff9c3e26504b79899b58a6d49e574d352493d80684c6";
+    sha256 = "ca478e52ae1f88da0102360e57e528b92f3ae4316aabac80a2cd7f7ab2efb48a";
   };
 
   prePatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/jupyter_client/default.nix b/pkgs/development/python-modules/jupyter_client/default.nix
index 4855663ebc7..008a74dfb3e 100644
--- a/pkgs/development/python-modules/jupyter_client/default.nix
+++ b/pkgs/development/python-modules/jupyter_client/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_client";
-  version = "5.3.4";
+  version = "6.1.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60e6faec1031d63df57f1cc671ed673dced0ed420f4377ea33db37b1c188b910";
+    sha256 = "3a32fa4d0b16d1c626b30c3002a62dfd86d6863ed39eaba3f537fade197bb756";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jupyter_core/default.nix b/pkgs/development/python-modules/jupyter_core/default.nix
index c10f3026876..fe40a3f09c4 100644
--- a/pkgs/development/python-modules/jupyter_core/default.nix
+++ b/pkgs/development/python-modules/jupyter_core/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "jupyter_core";
-  version = "4.6.1";
+  version = "4.6.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a183e0ec2e8f6adddf62b0a3fc6a2237e3e0056d381e536d3e7c7ecc3067e244";
+    sha256 = "394fd5dd787e7c8861741880bdf8a00ce39f95de5d18e579c74b882522219e7e";
   };
 
   checkInputs = [ pytest mock glibcLocales nose ];
diff --git a/pkgs/development/python-modules/line_profiler/default.nix b/pkgs/development/python-modules/line_profiler/default.nix
index a60b023acd7..027e6b0d134 100644
--- a/pkgs/development/python-modules/line_profiler/default.nix
+++ b/pkgs/development/python-modules/line_profiler/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "line_profiler";
-  version = "2.1.2";
+  version = "3.0.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "efa66e9e3045aa7cb1dd4bf0106e07dec9f80bc781a993fbaf8162a36c20af5c";
+    sha256 = "7218ad6bd81f8649b211974bf108933910f016d66b49651effe7bbf63667d141";
   };
 
   patches = [ ./python37.patch ];
diff --git a/pkgs/development/python-modules/nbformat/2.nix b/pkgs/development/python-modules/nbformat/2.nix
index faf2cee2b00..35ee52b11ec 100644
--- a/pkgs/development/python-modules/nbformat/2.nix
+++ b/pkgs/development/python-modules/nbformat/2.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "nbformat";
-  version = "4.4.0";
+  version = "5.0.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f7494ef0df60766b7cabe0a3651556345a963b74dbc16bc7c18479041170d402";
+    sha256 = "562de41fc7f4f481b79ab5d683279bf3a168858268d4387b489b7b02be0b324a";
   };
 
   LC_ALL="en_US.utf8";
diff --git a/pkgs/development/python-modules/nbformat/default.nix b/pkgs/development/python-modules/nbformat/default.nix
index 35ee52b11ec..2f8c57e0033 100644
--- a/pkgs/development/python-modules/nbformat/default.nix
+++ b/pkgs/development/python-modules/nbformat/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "nbformat";
-  version = "5.0.4";
+  version = "5.0.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "562de41fc7f4f481b79ab5d683279bf3a168858268d4387b489b7b02be0b324a";
+    sha256 = "049af048ed76b95c3c44043620c17e56bc001329e07f83fec4f177f0e3d7b757";
   };
 
   LC_ALL="en_US.utf8";
diff --git a/pkgs/development/python-modules/notebook/2.nix b/pkgs/development/python-modules/notebook/2.nix
index 8b8cce2f824..6b891353679 100644
--- a/pkgs/development/python-modules/notebook/2.nix
+++ b/pkgs/development/python-modules/notebook/2.nix
@@ -25,11 +25,11 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "5.7.8";
+  version = "6.0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "573e0ae650c5d76b18b6e564ba6d21bf321d00847de1d215b418acb64f056eb8";
+    sha256 = "47a9092975c9e7965ada00b9a20f0cf637d001db60d241d479f53c0be117ad48";
   };
 
   LC_ALL = "en_US.utf8";
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 4a062ca7b97..0838509a849 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -27,13 +27,13 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.18.1";
+  version = "1.18.3";
   format = "pyproject.toml";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "b6ff59cee96b454516e47e7721098e6ceebef435e3e21ac2d6c3b8b02628eb77";
+    sha256 = "e46e2384209c91996d5ec16744234d1c906ab79a701ce1a26155c9ec890b8dc8";
   };
 
   nativeBuildInputs = [ gfortran pytest cython setuptoolsBuildHook ];
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index abf5509056d..6d3899e32e7 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "4.6.0";
+  version = "4.7.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "654f423662e7dfe6a9b26fac8ec76aedcf742c339909ac49f1f0c1a1b744bcd1";
+    sha256 = "8f5ae5571f0e921db9f2d12613ed667c350ee22c7db598d9bbbe143e8533f932";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/pkgs/development/python-modules/reikna/default.nix b/pkgs/development/python-modules/reikna/default.nix
index 611bdd66901..ebe3dc772d7 100644
--- a/pkgs/development/python-modules/reikna/default.nix
+++ b/pkgs/development/python-modules/reikna/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "reikna";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "52bbce24fa1fd7bb950d38ce9b60f497dd00ac6b26688d80ab9bce709f063e71";
+    sha256 = "d01f4264c8379ef2962a93aacb002d491b92ef9b5b22b45f77e7821dfa87bef7";
   };
 
   checkInputs = [ sphinx pytestcov pytest ];
diff --git a/pkgs/development/python-modules/sounddevice/default.nix b/pkgs/development/python-modules/sounddevice/default.nix
index 614f0881ff8..9a6baf80f04 100644
--- a/pkgs/development/python-modules/sounddevice/default.nix
+++ b/pkgs/development/python-modules/sounddevice/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "sounddevice";
-  version = "0.3.14";
+  version = "0.3.15";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7b0f7ad86550668da55404eabcb63d4212ec622fcce86510092306b77d2e80a";
+    sha256 = "028f6e5df83027f4bfba5d6d61e6d46eb8689f9e647825e09f539920dee17d2c";
   };
 
   propagatedBuildInputs = [ cffi numpy portaudio ];
diff --git a/pkgs/development/python-modules/statsmodels/default.nix b/pkgs/development/python-modules/statsmodels/default.nix
index e2c7142c979..c65fb0990f0 100644
--- a/pkgs/development/python-modules/statsmodels/default.nix
+++ b/pkgs/development/python-modules/statsmodels/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "statsmodels";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wcc7xbwlf8r2diw9fnzf4bg9h5cg406w7phd3dz37hx17yfi3ha";
+    sha256 = "5bde3fa0a35a91b45dba7cbc28270b5b649ff1d721c89290883f6e831672d5f0";
   };
 
   checkInputs = with self; [ nose ];
diff --git a/pkgs/development/python-modules/tabulate/default.nix b/pkgs/development/python-modules/tabulate/default.nix
index c482c517989..4686d02486f 100644
--- a/pkgs/development/python-modules/tabulate/default.nix
+++ b/pkgs/development/python-modules/tabulate/default.nix
@@ -5,12 +5,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.8.6";
+  version = "0.8.7";
   pname = "tabulate";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5470cc6687a091c7042cee89b2946d9235fe9f6d49c193a4ae2ac7bf386737c8";
+    sha256 = "db2723a20d04bcda8522165c73eea7c300eda74e0ce852d9022e0159d7895007";
   };
 
   checkInputs = [ nose ];
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index a6549ee07c9..c00eac75ee0 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.42.1";
+  version = "4.45.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "251ee8440dbda126b8dfa8a7c028eb3f13704898caaef7caa699b35e119301e2";
+    sha256 = "00339634a22c10a7a22476ee946bbde2dbe48d042ded784e4d88e0236eca5d81";
   };
 
   checkInputs = [ nose coverage glibcLocales flake8 ];
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index a950076a261..abce8ac12fe 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c72d160c970725201f769e80fb91cbad68d6ebf21d68fcc371385a6c950459c3";
+    sha256 = "64e3138d87b641e22fe7a003c94abc685896b247b63e434505c1e6b38c91a8fb";
   };
 
   checkInputs = [ pytest ];
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 0dbe9ec7842..6c882b27896 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -3,20 +3,9 @@
 , stdenv
 , writeTextDir
 , substituteAll
-, targetPackages
+, pkgsHostHost
 }:
 
-let
-  # See https://mesonbuild.com/Reference-tables.html#cpu-families
-  cpuFamilies = {
-    aarch64  = "aarch64";
-    armv5tel = "arm";
-    armv6l   = "arm";
-    armv7l   = "arm";
-    i686     = "x86";
-    x86_64   = "x86_64";
-  };
-in
 python3Packages.buildPythonApplication rec {
   pname = "meson";
   version = "0.54.0";
@@ -45,6 +34,11 @@ python3Packages.buildPythonApplication rec {
     # We remove the check so multiple outputs can work sanely.
     ./allow-dirs-outside-of-prefix.patch
 
+    # Meson is currently inspecting fewer variables than autoconf does, which
+    # makes it harder for us to use setup hooks, etc.  Taken from
+    # https://github.com/mesonbuild/meson/pull/6827
+    ./more-env-vars.patch
+
     # Unlike libtool, vanilla Meson does not pass any information
     # about the path library will be installed to to g-ir-scanner,
     # breaking the GIR when path other than ${!outputLib}/lib is used.
@@ -65,35 +59,15 @@ python3Packages.buildPythonApplication rec {
 
   setupHook = ./setup-hook.sh;
 
-  crossFile = writeTextDir "cross-file.conf" ''
-    [binaries]
-    c = '${targetPackages.stdenv.cc.targetPrefix}cc'
-    cpp = '${targetPackages.stdenv.cc.targetPrefix}c++'
-    ar = '${targetPackages.stdenv.cc.bintools.targetPrefix}ar'
-    strip = '${targetPackages.stdenv.cc.bintools.targetPrefix}strip'
-    pkgconfig = 'pkg-config'
-    ld = '${targetPackages.stdenv.cc.targetPrefix}ld'
-    objcopy = '${targetPackages.stdenv.cc.targetPrefix}objcopy'
-
-    [properties]
-    needs_exe_wrapper = true
-
-    [host_machine]
-    system = '${targetPackages.stdenv.targetPlatform.parsed.kernel.name}'
-    cpu_family = '${cpuFamilies.${targetPackages.stdenv.targetPlatform.parsed.cpu.name}}'
-    cpu = '${targetPackages.stdenv.targetPlatform.parsed.cpu.name}'
-    endian = ${if targetPackages.stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
-  '';
+  # Ensure there will always be a native C compiler when meson is used, as a
+  # workaround until https://github.com/mesonbuild/meson/pull/6512 lands.
+  depsHostHostPropagated = [ pkgsHostHost.stdenv.cc ];
 
   # 0.45 update enabled tests but they are failing
   doCheck = false;
   # checkInputs = [ ninja pkgconfig ];
   # checkPhase = "python ./run_project_tests.py";
 
-  inherit (stdenv) cc;
-
-  isCross = stdenv.targetPlatform != stdenv.hostPlatform;
-
   meta = with lib; {
     homepage = "https://mesonbuild.com";
     description = "SCons-like build system that use python as a front-end language and Ninja as a building backend";
diff --git a/pkgs/development/tools/build-managers/meson/more-env-vars.patch b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
new file mode 100644
index 00000000000..a8f860f03cc
--- /dev/null
+++ b/pkgs/development/tools/build-managers/meson/more-env-vars.patch
@@ -0,0 +1,16 @@
+diff --git a/mesonbuild/envconfig.py b/mesonbuild/envconfig.py
+index ac13a710..e0d07c51 100644
+--- a/mesonbuild/envconfig.py
++++ b/mesonbuild/envconfig.py
+@@ -119,9 +119,9 @@ def get_env_var_pair(for_machine: MachineChoice,
+         # compiling we fall back on the unprefixed host version. This
+         # allows native builds to never need to worry about the 'BUILD_*'
+         # ones.
+-        ([var_name + '_FOR_BUILD'] if is_cross else [var_name]),
++        [var_name + '_FOR_BUILD'] + ([] if is_cross else [var_name]),
+         # Always just the unprefixed host verions
+-        ([] if is_cross else [var_name]),
++        [var_name],
+     )[for_machine]
+     for var in candidates:
+         value = os.environ.get(var)
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 8d76ecdaf32..3d946fcffd5 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -5,11 +5,6 @@ mesonConfigurePhase() {
         mesonFlags="--prefix=$prefix $mesonFlags"
     fi
 
-    # Build release by default.
-    if [ -n "@isCross@" ]; then
-      crossMesonFlags="--cross-file=@crossFile@/cross-file.conf"
-    fi
-
     # See multiple-outputs.sh and meson’s coredata.py
     mesonFlags="\
         --libdir=${!outputLib}/lib --libexecdir=${!outputLib}/libexec \
@@ -25,7 +20,7 @@ mesonConfigurePhase() {
 
     echo "meson flags: $mesonFlags ${mesonFlagsArray[@]}"
 
-    CC=@cc@/bin/cc CXX=@cc@/bin/c++ meson build $mesonFlags "${mesonFlagsArray[@]}"
+    meson build $mesonFlags "${mesonFlagsArray[@]}"
     cd build
 
     if ! [[ -v enableParallelBuilding ]]; then
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index 84b28631308..09d1e16a8b0 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -22,7 +22,7 @@ buildGoPackage rec {
     sha256 = "187cvb3i5cwm7cwxmzpl2ca7900yb6v6b6cybyz5mnd5ccy5ff1q";
   };
 
-  outputs = [ "bin" "man" "out" ];
+  outputs = [ "out" "man" ];
 
   goPackagePath = "github.com/containers/buildah";
   excludedPackages = [ "tests" ];
@@ -35,7 +35,7 @@ buildGoPackage rec {
   buildPhase = ''
     pushd go/src/${goPackagePath}
     make GIT_COMMIT="unknown"
-    install -Dm755 buildah $bin/bin/buildah
+    install -Dm755 buildah $out/bin/buildah
     installShellCompletion --bash contrib/completions/bash/buildah
   '';
 
diff --git a/pkgs/development/tools/cloudfoundry-cli/default.nix b/pkgs/development/tools/cloudfoundry-cli/default.nix
index 55d9854d792..1fa45a32c05 100644
--- a/pkgs/development/tools/cloudfoundry-cli/default.nix
+++ b/pkgs/development/tools/cloudfoundry-cli/default.nix
@@ -34,7 +34,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dm555 out/cf "$bin/bin/cf"
+    install -Dm555 out/cf "$out/bin/cf"
     installShellCompletion --bash "$src/ci/installers/completion/cf"
   '';
 
diff --git a/pkgs/development/tools/container-linux-config-transpiler/default.nix b/pkgs/development/tools/container-linux-config-transpiler/default.nix
index 0e6c58aa7ba..005c5d55b79 100644
--- a/pkgs/development/tools/container-linux-config-transpiler/default.nix
+++ b/pkgs/development/tools/container-linux-config-transpiler/default.nix
@@ -20,8 +20,8 @@ buildGoPackage rec {
   '';
 
   postInstall = ''
-    mv $bin/bin/{internal,ct}
-    rm $bin/bin/tools
+    mv $out/bin/{internal,ct}
+    rm $out/bin/tools
   '';
 
   meta = {
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
index 9182c889598..ceaa704b565 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/default.nix
@@ -24,10 +24,10 @@ buildGoPackage rec {
 
   postInstall = ''
     # Fix binary name
-    mv $bin/bin/{agent,buildkite-agent}
+    mv $out/bin/{agent,buildkite-agent}
 
     # These are runtime dependencies
-    wrapProgram $bin/bin/buildkite-agent \
+    wrapProgram $out/bin/buildkite-agent \
       --prefix PATH : '${stdenv.lib.makeBinPath [ openssh git coreutils gnused gnugrep ]}'
   '';
 
diff --git a/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix b/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
index 1d50e4ff6d5..39178201456 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-agent/generic.nix
@@ -15,17 +15,17 @@ buildGoPackage {
   postInstall = ''
     ${stdenv.lib.optionalString hasBootstrapScript ''
     # Install bootstrap.sh
-    mkdir -p $bin/libexec/buildkite-agent
-    cp $NIX_BUILD_TOP/go/src/${goPackagePath}/templates/bootstrap.sh $bin/libexec/buildkite-agent
-    sed -e "s|#!/bin/bash|#!${bash}/bin/bash|g" -i $bin/libexec/buildkite-agent/bootstrap.sh
+    mkdir -p $out/libexec/buildkite-agent
+    cp $NIX_BUILD_TOP/go/src/${goPackagePath}/templates/bootstrap.sh $out/libexec/buildkite-agent
+    sed -e "s|#!/bin/bash|#!${bash}/bin/bash|g" -i $out/libexec/buildkite-agent/bootstrap.sh
     ''}
 
     # Fix binary name
-    mv $bin/bin/{agent,buildkite-agent}
+    mv $out/bin/{agent,buildkite-agent}
 
     # These are runtime dependencies
-    wrapProgram $bin/bin/buildkite-agent \
-      ${stdenv.lib.optionalString hasBootstrapScript "--set BUILDKITE_BOOTSTRAP_SCRIPT_PATH $bin/libexec/buildkite-agent/bootstrap.sh"} \
+    wrapProgram $out/bin/buildkite-agent \
+      ${stdenv.lib.optionalString hasBootstrapScript "--set BUILDKITE_BOOTSTRAP_SCRIPT_PATH $out/libexec/buildkite-agent/bootstrap.sh"} \
       --prefix PATH : '${stdenv.lib.makeBinPath [ openssh git coreutils gnused gnugrep ]}'
   '';
 
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 7c7862dbe3b..e152b0ba638 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -35,10 +35,10 @@ buildGoPackage rec {
   patches = [ ./fix-shell-path.patch ];
 
   postInstall = ''
-    touch $bin/bin/hello
-    install -d $bin/bin/helper-images
-    ln -sf ${docker_x86_64} $bin/bin/helper-images/prebuilt-x86_64.tar.xz
-    ln -sf ${docker_arm} $bin/bin/helper-images/prebuilt-arm.tar.xz
+    touch $out/bin/hello
+    install -d $out/bin/helper-images
+    ln -sf ${docker_x86_64} $out/bin/helper-images/prebuilt-x86_64.tar.xz
+    ln -sf ${docker_arm} $out/bin/helper-images/prebuilt-arm.tar.xz
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/deis/default.nix b/pkgs/development/tools/deis/default.nix
index 4625c79767f..9e45d5988cc 100644
--- a/pkgs/development/tools/deis/default.nix
+++ b/pkgs/development/tools/deis/default.nix
@@ -9,8 +9,8 @@ buildGoPackage rec {
   subPackages = [ "client" ];
 
   postInstall = ''
-    if [ -f "$bin/bin/client" ]; then
-      mv "$bin/bin/client" "$bin/bin/deis"
+    if [ -f "$out/bin/client" ]; then
+      mv "$out/bin/client" "$out/bin/deis"
     fi
   '';
 
diff --git a/pkgs/development/tools/dep2nix/default.nix b/pkgs/development/tools/dep2nix/default.nix
index 86a1ac6d6b1..9d14f7c1c1e 100644
--- a/pkgs/development/tools/dep2nix/default.nix
+++ b/pkgs/development/tools/dep2nix/default.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   ];
 
   postFixup = ''
-    wrapProgram $bin/bin/dep2nix \
+    wrapProgram $out/bin/dep2nix \
       --prefix PATH : ${nix-prefetch-scripts}/bin
   '';
 
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index f84167afca8..f9c55555536 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -21,7 +21,7 @@ buildGoPackage rec {
   postInstall = ''
     export HOME=$(mktemp -d) # attempts to write to /homeless-shelter
     for shell in bash fish zsh; do
-      $bin/bin/doctl completion $shell > doctl.$shell
+      $out/bin/doctl completion $shell > doctl.$shell
       installShellCompletion doctl.$shell
     done
   '';
diff --git a/pkgs/development/tools/fac/default.nix b/pkgs/development/tools/fac/default.nix
index 331c86ad88c..6a23f84f236 100644
--- a/pkgs/development/tools/fac/default.nix
+++ b/pkgs/development/tools/fac/default.nix
@@ -18,7 +18,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
-    wrapProgram $bin/bin/fac \
+    wrapProgram $out/bin/fac \
       --prefix PATH : ${git}/bin
 
     # Install man page, not installed by default
diff --git a/pkgs/development/tools/go2nix/default.nix b/pkgs/development/tools/go2nix/default.nix
index 96f82cc827f..300f82ee548 100644
--- a/pkgs/development/tools/go2nix/default.nix
+++ b/pkgs/development/tools/go2nix/default.nix
@@ -17,14 +17,14 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  outputs = [ "bin" "out" "man" ];
+  outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ go-bindata gotools makeWrapper ];
 
   preBuild = ''go generate ./...'';
 
   postInstall = ''
-    wrapProgram $bin/bin/go2nix \
+    wrapProgram $out/bin/go2nix \
       --prefix PATH : ${nix-prefetch-git}/bin \
       --prefix PATH : ${git}/bin
 
diff --git a/pkgs/development/tools/gocode-gomod/default.nix b/pkgs/development/tools/gocode-gomod/default.nix
index 3ed719cbfce..603568236e6 100644
--- a/pkgs/development/tools/gocode-gomod/default.nix
+++ b/pkgs/development/tools/gocode-gomod/default.nix
@@ -25,7 +25,7 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postInstall = ''
-    mv $bin/bin/gocode $bin/bin/gocode-gomod
+    mv $out/bin/gocode $out/bin/gocode-gomod
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index 6436c83ee21..c9bea694549 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -20,7 +20,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     for shell in bash zsh; do
-      $bin/bin/kind completion $shell > kind.$shell
+      $out/bin/kind completion $shell > kind.$shell
       installShellCompletion kind.$shell
     done
   '';
diff --git a/pkgs/development/tools/misc/hound/default.nix b/pkgs/development/tools/misc/hound/default.nix
index d3afbbc1bc7..2d7431f9e8b 100644
--- a/pkgs/development/tools/misc/hound/default.nix
+++ b/pkgs/development/tools/misc/hound/default.nix
@@ -27,7 +27,7 @@ buildGoPackage rec {
   postInstall = with stdenv; let
     binPath = lib.makeBinPath [ mercurial git ];
   in ''
-    wrapProgram $bin/bin/houndd --prefix PATH : ${binPath}
+    wrapProgram $out/bin/houndd --prefix PATH : ${binPath}
   '';
 
   meta = {
diff --git a/pkgs/development/tools/out-of-tree/default.nix b/pkgs/development/tools/out-of-tree/default.nix
index 5faeec2387d..434f0186d89 100644
--- a/pkgs/development/tools/out-of-tree/default.nix
+++ b/pkgs/development/tools/out-of-tree/default.nix
@@ -17,7 +17,7 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postFixup = ''
-    wrapProgram $bin/bin/out-of-tree \
+    wrapProgram $out/bin/out-of-tree \
       --prefix PATH : "${stdenv.lib.makeBinPath [ qemu docker which ]}"
   '';
 
diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
new file mode 100644
index 00000000000..ce7132b0007
--- /dev/null
+++ b/pkgs/development/tools/pandoc/default.nix
@@ -0,0 +1,29 @@
+{ haskellPackages, haskell, removeReferencesTo }:
+
+let
+  static = haskell.lib.justStaticExecutables haskellPackages.pandoc;
+
+in
+  (haskell.lib.overrideCabal static (drv: {
+    configureFlags = drv.configureFlags or [] ++ ["-fembed_data_files"];
+    buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
+    buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
+  })).overrideAttrs (drv: {
+
+    # These libraries are still referenced, because pandoc references
+    # their `Paths_*` module for figuring out their version.
+    # The `Paths_*` module is generated by Cabal, and contains the
+    # version, but also paths to e.g. the data directories, which
+    # lead to a transitive runtime dependency on the whole GHC distribution.
+    # This should ideally be fixed in haskellPackages (or even Cabal),
+    # but a minimal pandoc is important enough to patch it manually.
+    disallowedReferences = [ haskellPackages.pandoc-types haskellPackages.HTTP ];
+    postInstall = ''
+      remove-references-to \
+        -t ${haskellPackages.pandoc-types} \
+        $out/bin/pandoc
+      remove-references-to \
+        -t ${haskellPackages.HTTP} \
+        $out/bin/pandoc
+    '';
+  })
diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
index dddd407d0da..482beeff122 100644
--- a/pkgs/development/tools/parsing/re2c/default.nix
+++ b/pkgs/development/tools/parsing/re2c/default.nix
@@ -1,16 +1,24 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "1.2.1";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "1qj0ck9msb9h8g9qb1lr57jmlj8x68ini3y3ccdifjjahhhr0hd4";
+    sha256 = "0aqlf2h6i2m3dq11dkq89p4w4c9kp4x66s5rhp84gmpz5xqv1x5h";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-11958.patch";
+      url = "https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a.patch";
+      sha256 = "1d95ahxk92g7k87sda9gxgmr3blyfzwd2y7h9jxj8zkd74knd9zh";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   doCheck = true;
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index 5534492cf37..dce42380c50 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -26,7 +26,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
     for shell in bash zsh; do
-      $bin/bin/skaffold completion $shell > skaffold.$shell
+      $out/bin/skaffold completion $shell > skaffold.$shell
       installShellCompletion skaffold.$shell
     done
   '';
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 7d4e4e0c69e..f7e1478bbec 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -34,7 +34,7 @@ buildGoPackage {
   inherit version;
   inherit src goPackagePath;
 
-  outputs = [ "bin" "man" "out" ];
+  outputs = [ "out" "man" ];
 
   excludedPackages = [ "integration" ];
 
diff --git a/pkgs/development/tools/toxiproxy/default.nix b/pkgs/development/tools/toxiproxy/default.nix
index a5c13e2266e..cdf3ed5b71a 100644
--- a/pkgs/development/tools/toxiproxy/default.nix
+++ b/pkgs/development/tools/toxiproxy/default.nix
@@ -15,8 +15,8 @@ buildGoPackage rec {
   buildFlagsArray = "-ldflags=-X github.com/Shopify/toxiproxy.Version=v${version}";
 
   postInstall = ''
-    mv $bin/bin/cli $bin/bin/toxiproxy-cli
-    mv $bin/bin/cmd $bin/bin/toxiproxy-cmd
+    mv $out/bin/cli $out/bin/toxiproxy-cli
+    mv $out/bin/cmd $out/bin/toxiproxy-cmd
   '';
 
   meta = {
diff --git a/pkgs/development/tools/vgo2nix/default.nix b/pkgs/development/tools/vgo2nix/default.nix
index 5f2a45f7427..65cc4b145fb 100644
--- a/pkgs/development/tools/vgo2nix/default.nix
+++ b/pkgs/development/tools/vgo2nix/default.nix
@@ -28,7 +28,7 @@ buildGoPackage {
   postInstall = with stdenv; let
     binPath = lib.makeBinPath [ nix-prefetch-git go ];
   in ''
-    wrapProgram $bin/bin/vgo2nix --prefix PATH : ${binPath}
+    wrapProgram $out/bin/vgo2nix --prefix PATH : ${binPath}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/wally-cli/default.nix b/pkgs/development/tools/wally-cli/default.nix
index 5d2550b89cb..ca8b40c4d53 100644
--- a/pkgs/development/tools/wally-cli/default.nix
+++ b/pkgs/development/tools/wally-cli/default.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   };
 
   postInstall = ''
-    mv $bin/bin/cli $bin/bin/wally
+    mv $out/bin/cli $out/bin/wally
   '';
 
   goDeps = ./deps.nix;
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index cd7b8616366..861ef0fc847 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -110,11 +110,15 @@ runCommand "xcodebuild-${xcbuild.version}" {
   mkdir -p $out/Applications/Xcode.app/Contents
   ln -s $out $out/Applications/Xcode.app/Contents/Developer
 
+  # The native xcodebuild command supports an invocation like "xcodebuild -version -sdk" without specifying the specific SDK, so we simulate this by
+  # detecting this case and simulating the output; printing the header and appending the normal output via appending the sdk version to the positional
+  # arguments we pass through to the wrapped xcodebuild.
   makeWrapper ${xcbuild}/bin/xcodebuild $out/bin/xcodebuild \
     --add-flags "-xcconfig ${xcconfig}" \
     --add-flags "DERIVED_DATA_DIR=." \
     --set DEVELOPER_DIR "$out" \
     --set SDKROOT ${sdkName} \
+    --run '[ "$#" -eq 2 ] && [ "$1" = "-version" ] && [ "$2" = "-sdk" ] && echo ${sdkName}.sdk - macOS ${sdkVer} \(macosx${sdkVer}\) && set -- "$@" "${sdkName}"' \
     --run '[ "$1" = "-version" ] && [ "$#" -eq 1 ] && (echo Xcode ${xcodeVer}; echo Build version ${sdkBuildVersion}) && exit 0' \
     --run '[ "$1" = "-license" ] && exit 0'
 
diff --git a/pkgs/games/boohu/default.nix b/pkgs/games/boohu/default.nix
index 3dcfe201d2c..3ca8ee4693a 100644
--- a/pkgs/games/boohu/default.nix
+++ b/pkgs/games/boohu/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postInstall = "mv $bin/bin/boohu.git $bin/bin/boohu";
+  postInstall = "mv $out/bin/boohu.git $out/bin/boohu";
 
   meta = with stdenv.lib; {
     description = "A new coffee-break roguelike game";
diff --git a/pkgs/games/harmonist/default.nix b/pkgs/games/harmonist/default.nix
index 19074a309dd..fb9e1cf6617 100644
--- a/pkgs/games/harmonist/default.nix
+++ b/pkgs/games/harmonist/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
-  postInstall = "mv $bin/bin/harmonist.git $bin/bin/harmonist";
+  postInstall = "mv $out/bin/harmonist.git $out/bin/harmonist";
 
   meta = with stdenv.lib; {
     description = "A stealth coffee-break roguelike game";
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index b16c0645cda..8736edd0e61 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   pname = "cups";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.3.1";
+  version = if stdenv.isDarwin then "2.2.6" else "2.3.3";
 
   passthru = { inherit version; };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = if version == "2.2.6"
              then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "1kkpmj17205j8w9hdff2bfpk6lwdmr3gx0j4r35nhgvya24rvjhv";
+             else "1vpk0b2vq830f8fvf9z8qjsm5k141i7pi8djbinpnr78pi4dj7r6";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/misc/logging/beats/6.x.nix b/pkgs/misc/logging/beats/6.x.nix
index d3f284a2ddb..c3bca18a9a4 100644
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@@ -47,7 +47,7 @@ in {
     '';
     buildInputs = [ systemd.dev ];
     postFixup = let libPath = stdenv.lib.makeLibraryPath [ systemd.lib ]; in ''
-      patchelf --set-rpath ${libPath} "$bin/bin/journalbeat"
+      patchelf --set-rpath ${libPath} "$out/bin/journalbeat"
     '';
   };
 }
diff --git a/pkgs/misc/logging/beats/7.x.nix b/pkgs/misc/logging/beats/7.x.nix
index cdc8417a9c1..61c89339fe7 100644
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@@ -46,7 +46,7 @@ in {
     '';
     buildInputs = [ systemd.dev ];
     postFixup = let libPath = stdenv.lib.makeLibraryPath [ systemd.lib ]; in ''
-      patchelf --set-rpath ${libPath} "$bin/bin/journalbeat"
+      patchelf --set-rpath ${libPath} "$out/bin/journalbeat"
     '';
   };
 }
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index e31f9b91f97..fad33b21d04 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -16,7 +16,7 @@ in
 stdenv.mkDerivation {
   pname = "${targetPrefix}cctools-binutils-darwin";
   inherit (cctools) version;
-  outputs = [ "out" "info" "man" ];
+  outputs = [ "out" "man" ];
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
@@ -42,12 +42,13 @@ stdenv.mkDerivation {
 
     ln -s ${cctools}/libexec $out/libexec
 
-    mkdir -p "$info/nix-support" "$man/nix-support"
-    printWords ${binutils-unwrapped.info} \
-      >> $info/nix-support/propagated-build-inputs
-    # FIXME: cctools missing man pages
-    printWords ${binutils-unwrapped.man} \
-      >> $man/nix-support/propagated-build-inputs
+    mkdir -p "$man"/share/man/man{1,5}
+    for i in ${builtins.concatStringsSep " " cmds}; do
+      for path in "${cctools.man}"/share/man/man?/$i.*; do
+        dest_path="$man''${path#${cctools.man}}"
+        ln -sv "$path" "$dest_path"
+      done
+    done
   '';
 
   passthru = {
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 368f2938064..0c25f225291 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -1,4 +1,5 @@
 { stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook
+, installShellFiles
 , libcxxabi, libuuid
 , libobjc ? null, maloader ? null
 , enableTapiSupport ? true, libtapi
@@ -28,9 +29,9 @@ let
       sha256 = "0h8b1my0wf1jyjq63wbiqkl2clgxsf87f6i4fjhqs431fzlq8sac";
     };
 
-    outputs = [ "out" "dev" ];
+    outputs = [ "out" "dev" "man" ];
 
-    nativeBuildInputs = [ autoconf automake libtool autoreconfHook ];
+    nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
     buildInputs = [ libuuid ]
       ++ stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
       ++ stdenv.lib.optional enableTapiSupport libtapi;
@@ -88,6 +89,8 @@ let
       pushd include
       make DSTROOT=$out/include RC_OS=common install
       popd
+
+      installManPage ar/ar.{1,5}
     '';
 
     passthru = {
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
new file mode 100644
index 00000000000..73ab46b3c8a
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  pname = "sof-firmware";
+  version = "1.4.2";
+
+  src = fetchurl {
+    url = "https://www.alsa-project.org/files/pub/misc/sof/${pname}-${version}.tar.bz2";
+    sha256 = "1nkh020gjm45vxd6fvmz63hj16ilff2nl5avvsklajjs6xci1sf5";
+  };
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    rm lib/firmware/intel/{sof/LICENCE,sof-tplg/LICENCE}
+    mkdir $out
+    cp -r lib $out/lib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Sound Open Firmware";
+    homepage = "https://www.sofproject.org/";
+    license = with licenses; [ bsd3 isc ];
+    maintainers = with maintainers; [ lblasc ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 0a58ed87e6c..088ec4ebf44 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -254,6 +254,27 @@ let
       SND_USB_CAIAQ_INPUT = yes;
       # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
       PSS_MIXER           = whenOlder "4.12" yes;
+    # Enable Sound Open Firmware support
+    } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" &&
+                        versionAtLeast version "5.5") {
+      SND_SOC_SOF_TOPLEVEL              = yes;
+      SND_SOC_SOF_ACPI                  = module;
+      SND_SOC_SOF_PCI                   = module;
+      SND_SOC_SOF_APOLLOLAKE_SUPPORT    = yes;
+      SND_SOC_SOF_CANNONLAKE_SUPPORT    = yes;
+      SND_SOC_SOF_COFFEELAKE_SUPPORT    = yes;
+      SND_SOC_SOF_COMETLAKE_H_SUPPORT   = yes;
+      SND_SOC_SOF_COMETLAKE_LP_SUPPORT  = yes;
+      SND_SOC_SOF_ELKHARTLAKE_SUPPORT   = yes;
+      SND_SOC_SOF_GEMINILAKE_SUPPORT    = yes;
+      SND_SOC_SOF_HDA_AUDIO_CODEC       = yes;
+      SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = yes;
+      SND_SOC_SOF_HDA_LINK              = yes;
+      SND_SOC_SOF_ICELAKE_SUPPORT       = yes;
+      SND_SOC_SOF_INTEL_TOPLEVEL        = yes;
+      SND_SOC_SOF_JASPERLAKE_SUPPORT    = yes;
+      SND_SOC_SOF_MERRIFIELD_SUPPORT    = yes;
+      SND_SOC_SOF_TIGERLAKE_SUPPORT     = yes;
     };
 
     usb-serial = {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 71505840b86..d73e0a8ac90 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,6 @@
 { buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
 , libelf, cpio
-, utillinux
+, utillinuxMinimal
 , writeTextFile
 }:
 
@@ -281,7 +281,7 @@ let
 in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;
-assert stdenv.lib.versionAtLeast version "4.15" -> utillinux != null;
+assert stdenv.lib.versionAtLeast version "4.15" -> utillinuxMinimal != null;
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.platform kernelPatches configfile) // {
   pname = "linux";
   inherit version;
@@ -292,7 +292,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.platform kernelPatches
   nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr ]
       ++ optional  (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional  (stdenv.lib.versionAtLeast version "4.14") libelf
-      ++ optional  (stdenv.lib.versionAtLeast version "4.15") utillinux
+      ++ optional  (stdenv.lib.versionAtLeast version "4.15") utillinuxMinimal
       ++ optionals (stdenv.lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optional  (stdenv.lib.versionAtLeast version "5.2")  cpio
       ;
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 799b73294e8..09a3cd877ab 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -22,8 +22,8 @@ buildGoPackage rec {
   ];
 
   postInstall = ''
-    mkdir -p $bin/share
-    cp -r $src/web $bin/share/web
+    mkdir -p $out/share
+    cp -r $src/web $out/share/web
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/etcd/default.nix b/pkgs/servers/etcd/default.nix
index 9a2bf7ce590..bdb4b4883da 100644
--- a/pkgs/servers/etcd/default.nix
+++ b/pkgs/servers/etcd/default.nix
@@ -22,7 +22,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dm755 bin/* bin/functional/cmd/* -t $bin/bin
+    install -Dm755 bin/* bin/functional/cmd/* -t $out/bin
   '';
 
   passthru.tests = with nixosTests; {
diff --git a/pkgs/servers/meguca/default.nix b/pkgs/servers/meguca/default.nix
index 3088ee190e7..4c5521e97bb 100644
--- a/pkgs/servers/meguca/default.nix
+++ b/pkgs/servers/meguca/default.nix
@@ -35,9 +35,9 @@ buildGoPackage {
   '';
 
   installPhase = ''
-    mkdir -p $bin/bin $bin/share/meguca
-    cp meguca $bin/bin
-    cp -r www $bin/share/meguca
+    mkdir -p $out/bin $out/share/meguca
+    cp meguca $out/bin
+    cp -r www $out/share/meguca
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index bb841da74d2..43c41250970 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -20,7 +20,7 @@ buildGoPackage rec {
   '';
 
   postInstall = ''
-    mv $bin/bin/miniflux.app $bin/bin/miniflux
+    mv $out/bin/miniflux.app $out/bin/miniflux
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/monitoring/grafana-reporter/default.nix b/pkgs/servers/monitoring/grafana-reporter/default.nix
index 24756cc8bd2..d6f3c28d82b 100644
--- a/pkgs/servers/monitoring/grafana-reporter/default.nix
+++ b/pkgs/servers/monitoring/grafana-reporter/default.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   };
 
   postInstall = ''
-    wrapProgram $bin/bin/grafana-reporter \
+    wrapProgram $out/bin/grafana-reporter \
       --prefix PATH : ${makeBinPath [ tetex ]}
   '';
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 66e534a0f9a..7fdd9c70d9a 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -29,10 +29,10 @@ buildGoPackage rec {
 
   postInstall = ''
     tar -xvf $srcStatic
-    mkdir -p $bin/share/grafana
-    mv grafana-*/{public,conf,tools} $bin/share/grafana/
+    mkdir -p $out/share/grafana
+    mv grafana-*/{public,conf,tools} $out/share/grafana/
   '' + lib.optionalString phantomJsSupport ''
-    ln -sf ${phantomjs2}/bin/phantomjs $bin/share/grafana/tools/phantomjs/phantomjs
+    ln -sf ${phantomjs2}/bin/phantomjs $out/share/grafana/tools/phantomjs/phantomjs
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
index a4117d923e3..e8804702f0d 100644
--- a/pkgs/servers/monitoring/loki/default.nix
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -24,7 +24,7 @@ buildGoPackage rec {
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ systemd.dev ];
 
   preFixup = stdenv.lib.optionalString stdenv.isLinux ''
-    wrapProgram $bin/bin/promtail \
+    wrapProgram $out/bin/promtail \
       --prefix LD_LIBRARY_PATH : "${systemd.lib}/lib"
   '';
 
diff --git a/pkgs/servers/monitoring/prometheus/alertmanager.nix b/pkgs/servers/monitoring/prometheus/alertmanager.nix
index 9074c19e109..9402fa44eed 100644
--- a/pkgs/servers/monitoring/prometheus/alertmanager.nix
+++ b/pkgs/servers/monitoring/prometheus/alertmanager.nix
@@ -27,7 +27,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
-    $bin/bin/amtool --completion-script-bash > amtool.bash
+    $out/bin/amtool --completion-script-bash > amtool.bash
     installShellCompletion amtool.bash
   '';
 
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
index e43e625e449..28b76234dd8 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@@ -54,9 +54,9 @@ in buildGoPackage rec {
   '';
 
   preInstall = ''
-    mkdir -p "$bin/share/doc/prometheus" "$bin/etc/prometheus"
-    cp -a $src/documentation/* $bin/share/doc/prometheus
-    cp -a $src/console_libraries $src/consoles $bin/etc/prometheus
+    mkdir -p "$out/share/doc/prometheus" "$out/etc/prometheus"
+    cp -a $src/documentation/* $out/share/doc/prometheus
+    cp -a $src/console_libraries $src/consoles $out/etc/prometheus
   '';
 
   doCheck = true;
diff --git a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
index 8202a8c8c29..b5a93343252 100644
--- a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
@@ -43,7 +43,7 @@ buildGoPackage rec {
   ];
 
   postInstall = optionalString withSystemdSupport ''
-    wrapProgram $bin/bin/postfix_exporter \
+    wrapProgram $out/bin/postfix_exporter \
       --prefix LD_LIBRARY_PATH : "${systemd.lib}/lib"
   '';
 
diff --git a/pkgs/servers/monitoring/prometheus/pushgateway.nix b/pkgs/servers/monitoring/prometheus/pushgateway.nix
index 0cb41f099c6..1425fccdca4 100644
--- a/pkgs/servers/monitoring/prometheus/pushgateway.nix
+++ b/pkgs/servers/monitoring/prometheus/pushgateway.nix
@@ -29,7 +29,7 @@ buildGoPackage rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    export PATH=$PATH:$bin/bin
+    export PATH=$PATH:$out/bin
 
     pushgateway --help
 
diff --git a/pkgs/servers/monitoring/uchiwa/default.nix b/pkgs/servers/monitoring/uchiwa/default.nix
index 065af0079b0..9f0be68e168 100644
--- a/pkgs/servers/monitoring/uchiwa/default.nix
+++ b/pkgs/servers/monitoring/uchiwa/default.nix
@@ -16,7 +16,7 @@ let
     goPackagePath = "github.com/${owner}/${repo}";
     inherit src;
     postInstall = ''
-      mkdir $out
+      mkdir -p $out
       cp go/src/github.com/sensu/uchiwa/public/index.html $out/
     '';
   };
@@ -37,7 +37,7 @@ in stdenv.mkDerivation {
 
   buildCommand = ''
     mkdir -p $out/bin $out/public
-    makeWrapper ${backend.bin}/bin/uchiwa $out/bin/uchiwa \
+    makeWrapper ${backend}/bin/uchiwa $out/bin/uchiwa \
       --add-flags "-p $out/public"
     ln -s ${backend.out}/index.html $out/public/index.html
     ln -s ${frontend.out}/bower_components $out/public/bower_components
diff --git a/pkgs/servers/nginx-sso/default.nix b/pkgs/servers/nginx-sso/default.nix
index e9bd705ffa9..769a8605f03 100644
--- a/pkgs/servers/nginx-sso/default.nix
+++ b/pkgs/servers/nginx-sso/default.nix
@@ -15,8 +15,8 @@ buildGoPackage rec {
   };
 
   postInstall = ''
-    mkdir -p $bin/share
-    cp -R $src/frontend $bin/share
+    mkdir -p $out/share
+    cp -R $src/frontend $out/share
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/sql/cockroachdb/default.nix b/pkgs/servers/sql/cockroachdb/default.nix
index fb62ee58474..2ce8e901e86 100644
--- a/pkgs/servers/sql/cockroachdb/default.nix
+++ b/pkgs/servers/sql/cockroachdb/default.nix
@@ -42,7 +42,7 @@ buildGoPackage rec {
   installPhase = ''
     runHook preInstall
 
-    install -D cockroachoss $bin/bin/cockroach
+    install -D cockroachoss $out/bin/cockroach
     installShellCompletion cockroach.bash
 
     mkdir -p $man/share/man
@@ -51,11 +51,7 @@ buildGoPackage rec {
     runHook postInstall
   '';
 
-  # Unfortunately we have to keep an empty reference to $out, because it seems
-  # buildGoPackages only nukes references to the go compiler under $bin, effectively
-  # making all binary output under $bin mandatory. Ideally, we would just use
-  # $out and $man and remove $bin since there's no point in an empty path. :(
-  outputs = [ "bin" "man" "out" ];
+  outputs = [ "out" "man" ];
 
   meta = with stdenv.lib; {
     homepage    = "https://www.cockroachlabs.com";
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index a11b280b047..09879451d8e 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -49,6 +49,7 @@ in rec {
     # Configure Phase
     , configureFlags ? []
     , cmakeFlags ? []
+    , mesonFlags ? []
     , # Target is not included by default because most programs don't care.
       # Including it then would cause needless mass rebuilds.
       #
@@ -252,6 +253,32 @@ in rec {
           ++ lib.optional (stdenv.buildPlatform.uname.system != null) "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
           ++ lib.optional (stdenv.buildPlatform.uname.processor != null) "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
           ++ lib.optional (stdenv.buildPlatform.uname.release != null) "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}";
+
+          mesonFlags = if mesonFlags == null then null else let
+            # See https://mesonbuild.com/Reference-tables.html#cpu-families
+            cpuFamily = platform: with platform;
+              /**/ if isAarch32 then "arm"
+              else if isAarch64 then "aarch64"
+              else if isx86_32  then "x86"
+              else if isx86_64  then "x86_64"
+              else platform.parsed.cpu.family + builtins.toString platform.parsed.cpu.bits;
+            crossFile = builtins.toFile "cross-file.conf" (''
+              [properties]
+              needs_exe_wrapper = true
+
+              [host_machine]
+              system = '${stdenv.targetPlatform.parsed.kernel.name}'
+              cpu_family = '${cpuFamily stdenv.targetPlatform}'
+              cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
+              endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
+            ''
+            # TODO should have target prefix too, issue #86077
+            + ''
+
+              [binaries]
+              pkgconfig = 'pkg-config'
+            '');
+          in [ "--cross-file=${crossFile}" ] ++ mesonFlags;
         } // lib.optionalAttrs (attrs.enableParallelBuilding or false) {
           enableParallelChecking = attrs.enableParallelChecking or true;
         } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
diff --git a/pkgs/tools/admin/docker-credential-helpers/default.nix b/pkgs/tools/admin/docker-credential-helpers/default.nix
index 1f4315afc40..38762b6fd29 100644
--- a/pkgs/tools/admin/docker-credential-helpers/default.nix
+++ b/pkgs/tools/admin/docker-credential-helpers/default.nix
@@ -32,11 +32,11 @@ buildGoPackage rec {
   installPhase =
     if stdenv.isDarwin
     then ''
-      install -Dm755 -t $bin/bin bin/docker-credential-osxkeychain
+      install -Dm755 -t $out/bin bin/docker-credential-osxkeychain
     ''
     else ''
-      install -Dm755 -t $bin/bin bin/docker-credential-pass
-      install -Dm755 -t $bin/bin bin/docker-credential-secretservice
+      install -Dm755 -t $out/bin bin/docker-credential-pass
+      install -Dm755 -t $out/bin bin/docker-credential-secretservice
     '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 6051c16e91e..e4ac149a8ed 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -31,9 +31,9 @@ buildGoPackage rec {
 
   postInstall = ''
     # test binaries, code generation
-    rm $bin/bin/{deps,macaroon-identity,generate}
+    rm $out/bin/{deps,macaroon-identity,generate}
 
-    wrapProgram $bin/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath [
+    wrapProgram $out/bin/lxd --prefix PATH : ${stdenv.lib.makeBinPath [
       acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ebtables bash criu
       (writeShellScriptBin "apparmor_parser" ''
         exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
diff --git a/pkgs/tools/backup/diskrsync/default.nix b/pkgs/tools/backup/diskrsync/default.nix
index 81209444455..b96d6d75725 100644
--- a/pkgs/tools/backup/diskrsync/default.nix
+++ b/pkgs/tools/backup/diskrsync/default.nix
@@ -17,7 +17,7 @@ buildGoPackage rec {
   buildInputs = [ makeWrapper ];
 
   preFixup = ''
-    wrapProgram "$bin/bin/diskrsync" --argv0 diskrsync --prefix PATH : ${openssh}/bin
+    wrapProgram "$out/bin/diskrsync" --argv0 diskrsync --prefix PATH : ${openssh}/bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/backup/duplicacy/default.nix b/pkgs/tools/backup/duplicacy/default.nix
index 1d754e4324d..b261289f0bf 100644
--- a/pkgs/tools/backup/duplicacy/default.nix
+++ b/pkgs/tools/backup/duplicacy/default.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -D duplicacy_main $bin/bin/duplicacy
+    install -D duplicacy_main $out/bin/duplicacy
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index df9d613ee44..f366533f9bf 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -20,7 +20,7 @@ buildGoPackage rec {
   passthru.tests.restic = nixosTests.restic;
 
   postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-    $bin/bin/restic generate \
+    $out/bin/restic generate \
       --bash-completion restic.bash \
       --zsh-completion restic.zsh \
       --man .
diff --git a/pkgs/tools/backup/restic/rest-server.nix b/pkgs/tools/backup/restic/rest-server.nix
index c7f12cb751b..45a4df74b15 100644
--- a/pkgs/tools/backup/restic/rest-server.nix
+++ b/pkgs/tools/backup/restic/rest-server.nix
@@ -19,7 +19,7 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    install -Dt $bin/bin rest-server
+    install -Dt $out/bin rest-server
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/gcsfuse/default.nix b/pkgs/tools/filesystems/gcsfuse/default.nix
index f8d955dbfc1..3f0e261b18d 100644
--- a/pkgs/tools/filesystems/gcsfuse/default.nix
+++ b/pkgs/tools/filesystems/gcsfuse/default.nix
@@ -16,8 +16,8 @@ buildGoPackage rec {
   subPackages = [ "." "tools/mount_gcsfuse" ];
 
   postInstall = ''
-    ln -s $bin/bin/mount_gcsfuse $bin/bin/mount.gcsfuse
-    ln -s $bin/bin/mount_gcsfuse $bin/bin/mount.fuse.gcsfuse
+    ln -s $out/bin/mount_gcsfuse $out/bin/mount.gcsfuse
+    ln -s $out/bin/mount_gcsfuse $out/bin/mount.fuse.gcsfuse
   '';
 
   meta = with lib;{
diff --git a/pkgs/tools/misc/aptly/default.nix b/pkgs/tools/misc/aptly/default.nix
index 792b12688aa..3c97c168429 100644
--- a/pkgs/tools/misc/aptly/default.nix
+++ b/pkgs/tools/misc/aptly/default.nix
@@ -33,7 +33,7 @@ buildGoPackage {
 
   postInstall = ''
     installShellCompletion --bash ${aptlyCompletionSrc}/aptly
-    wrapProgram "$bin/bin/aptly" \
+    wrapProgram "$out/bin/aptly" \
       --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg bzip2 xz graphviz ]}"
   '';
 
diff --git a/pkgs/tools/misc/direnv/default.nix b/pkgs/tools/misc/direnv/default.nix
index 3c7e72f6d73..7a57c7ad08b 100644
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@@ -23,9 +23,9 @@ buildGoPackage rec {
 
   installPhase = ''
     mkdir -p $out
-    make install DESTDIR=$bin
-    mkdir -p $bin/share/fish/vendor_conf.d
-    echo "eval ($bin/bin/direnv hook fish)" > $bin/share/fish/vendor_conf.d/direnv.fish
+    make install DESTDIR=$out
+    mkdir -p $out/share/fish/vendor_conf.d
+    echo "eval ($out/bin/direnv hook fish)" > $out/share/fish/vendor_conf.d/direnv.fish
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/mongodb-tools/default.nix b/pkgs/tools/misc/mongodb-tools/default.nix
index f216e358d8a..c3e9a0dc2ff 100644
--- a/pkgs/tools/misc/mongodb-tools/default.nix
+++ b/pkgs/tools/misc/mongodb-tools/default.nix
@@ -45,7 +45,7 @@ in buildGoPackage {
     runHook preBuild
 
     ${stdenv.lib.concatMapStrings (t: ''
-      go build -o "$bin/bin/${t}" -tags ssl -ldflags "-s -w" $goPackagePath/${t}/main
+      go build -o "$out/bin/${t}" -tags ssl -ldflags "-s -w" $goPackagePath/${t}/main
     '') tools}
 
     runHook postBuild
diff --git a/pkgs/tools/misc/phraseapp-client/default.nix b/pkgs/tools/misc/phraseapp-client/default.nix
index a66a6688ad4..35bd84005b5 100644
--- a/pkgs/tools/misc/phraseapp-client/default.nix
+++ b/pkgs/tools/misc/phraseapp-client/default.nix
@@ -15,7 +15,7 @@ buildGoPackage rec {
   };
 
   postInstall = ''
-    ln -s $bin/bin/phraseapp-client $bin/bin/phraseapp
+    ln -s $out/bin/phraseapp-client $out/bin/phraseapp
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/tewisay/default.nix b/pkgs/tools/misc/tewisay/default.nix
index d2a8a1d0e87..b4f834bdd1a 100644
--- a/pkgs/tools/misc/tewisay/default.nix
+++ b/pkgs/tools/misc/tewisay/default.nix
@@ -18,12 +18,12 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postInstall = ''
-    install -D -t $bin/share/tewisay/cows go/src/${goPackagePath}/cows/*.cow
+    install -D -t $out/share/tewisay/cows go/src/${goPackagePath}/cows/*.cow
   '';
 
   preFixup = ''
-    wrapProgram $bin/bin/tewisay \
-      --prefix COWPATH : $bin/share/tewisay/cows
+    wrapProgram $out/bin/tewisay \
+      --prefix COWPATH : $out/share/tewisay/cows
   '';
 
   meta = {
diff --git a/pkgs/tools/networking/assh/default.nix b/pkgs/tools/networking/assh/default.nix
index 9d4230524be..7b796a52e3a 100644
--- a/pkgs/tools/networking/assh/default.nix
+++ b/pkgs/tools/networking/assh/default.nix
@@ -10,7 +10,7 @@ buildGoPackage rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
-    wrapProgram "$bin/bin/assh" \
+    wrapProgram "$out/bin/assh" \
       --prefix PATH : ${openssh}/bin
   '';
 
diff --git a/pkgs/tools/networking/dd-agent/datadog-agent.nix b/pkgs/tools/networking/dd-agent/datadog-agent.nix
index 57d7244148d..dc29a95d92b 100644
--- a/pkgs/tools/networking/dd-agent/datadog-agent.nix
+++ b/pkgs/tools/networking/dd-agent/datadog-agent.nix
@@ -47,8 +47,8 @@ in buildGoPackage rec {
 
   # DataDog use paths relative to the agent binary, so fix these.
   postPatch = ''
-    sed -e "s|PyChecksPath =.*|PyChecksPath = \"$bin/${python.sitePackages}\"|" \
-        -e "s|distPath =.*|distPath = \"$bin/share/datadog-agent\"|" \
+    sed -e "s|PyChecksPath =.*|PyChecksPath = \"$out/${python.sitePackages}\"|" \
+        -e "s|distPath =.*|distPath = \"$out/share/datadog-agent\"|" \
         -i cmd/agent/common/common_nix.go
     sed -e "s|/bin/hostname|${lib.getBin hostname}/bin/hostname|" \
         -i pkg/util/hostname_nix.go
@@ -57,14 +57,14 @@ in buildGoPackage rec {
   # Install the config files and python modules from the "dist" dir
   # into standard paths.
   postInstall = ''
-    mkdir -p $bin/${python.sitePackages} $bin/share/datadog-agent
-    cp -R $src/cmd/agent/dist/conf.d $bin/share/datadog-agent
-    cp -R $src/cmd/agent/dist/{checks,utils,config.py} $bin/${python.sitePackages}
+    mkdir -p $out/${python.sitePackages} $out/share/datadog-agent
+    cp -R $src/cmd/agent/dist/conf.d $out/share/datadog-agent
+    cp -R $src/cmd/agent/dist/{checks,utils,config.py} $out/${python.sitePackages}
 
-    cp -R $src/pkg/status/dist/templates $bin/share/datadog-agent
+    cp -R $src/pkg/status/dist/templates $out/share/datadog-agent
 
-    wrapProgram "$bin/bin/agent" \
-      --set PYTHONPATH "$bin/${python.sitePackages}" \
+    wrapProgram "$out/bin/agent" \
+      --set PYTHONPATH "$out/${python.sitePackages}" \
       --prefix LD_LIBRARY_PATH : ${systemd.lib}/lib
   '';
 
diff --git a/pkgs/tools/networking/guardian-agent/default.nix b/pkgs/tools/networking/guardian-agent/default.nix
index a5e8dc10d34..262234ca67b 100644
--- a/pkgs/tools/networking/guardian-agent/default.nix
+++ b/pkgs/tools/networking/guardian-agent/default.nix
@@ -23,14 +23,14 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postInstall = ''
-    mkdir -p $bin/bin $out/share/doc/${pname}
-    cp -v ./go/src/github.com/StanfordSNR/${pname}/scripts/* $bin/bin/
+    mkdir -p $out/bin $out/share/doc/${pname}
+    cp -v ./go/src/github.com/StanfordSNR/${pname}/scripts/* $out/bin/
     cp -vr ./go/src/github.com/StanfordSNR/${pname}/{AUTHORS,doc,LICENSE,README.md} $out/share/doc/guardian-agent
   '';
 
   postFixup = ''
-		wrapProgram $bin/bin/sga-guard \
-			--prefix PATH : "$bin/bin" \
+		wrapProgram $out/bin/sga-guard \
+			--prefix PATH : "$out/bin" \
 			--prefix PATH : "${autossh}/bin"
   '';
 
diff --git a/pkgs/tools/package-management/morph/default.nix b/pkgs/tools/package-management/morph/default.nix
index a1d2f15ad13..130bf2bb2e5 100644
--- a/pkgs/tools/package-management/morph/default.nix
+++ b/pkgs/tools/package-management/morph/default.nix
@@ -29,10 +29,10 @@ buildGoPackage rec {
   postInstall = ''
     mkdir -p $lib
     cp -v $src/data/*.nix $lib
-    wrapProgram $bin/bin/morph --prefix PATH : ${lib.makeBinPath [ openssh ]};
+    wrapProgram $out/bin/morph --prefix PATH : ${lib.makeBinPath [ openssh ]};
   '';
 
-  outputs = [ "out" "bin" "lib" ];
+  outputs = [ "out" "lib" ];
 
   meta = with lib; {
     description = "Morph is a NixOS host manager written in Golang.";
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index cb640fb1639..4aee3737664 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -23,13 +23,13 @@ buildGoPackage rec {
 
   postInstall = ''
     for shell in bash fish zsh; do
-      $bin/bin/gopass completion $shell > gopass.$shell
+      $out/bin/gopass completion $shell > gopass.$shell
       installShellCompletion gopass.$shell
     done
   '';
 
   postFixup = ''
-    wrapProgram $bin/bin/gopass \
+    wrapProgram $out/bin/gopass \
       --prefix PATH : "${wrapperPath}"
   '';
 
diff --git a/pkgs/tools/security/notary/default.nix b/pkgs/tools/security/notary/default.nix
index 4f0b5f2c954..15797fc8665 100644
--- a/pkgs/tools/security/notary/default.nix
+++ b/pkgs/tools/security/notary/default.nix
@@ -26,7 +26,7 @@ buildGoPackage rec {
 
   installPhase = ''
     runHook preInstall
-    install -D bin/notary $bin/bin/notary
+    install -D bin/notary $out/bin/notary
     runHook postInstall
   '';
 
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index ae46bbae40a..5c1409dae1a 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -23,7 +23,7 @@ buildGoPackage rec {
   ];
 
   postInstall = ''
-    echo "complete -C $bin/bin/vault vault" > vault.bash
+    echo "complete -C $out/bin/vault vault" > vault.bash
     installShellCompletion vault.bash
   '';
 
diff --git a/pkgs/tools/security/verifpal/default.nix b/pkgs/tools/security/verifpal/default.nix
index 95afb580d4e..e1e5e100bd1 100644
--- a/pkgs/tools/security/verifpal/default.nix
+++ b/pkgs/tools/security/verifpal/default.nix
@@ -28,8 +28,8 @@ buildGoPackage rec {
   '';
 
   installPhase = ''
-    mkdir -p $bin/bin
-    cp go/src/$goPackagePath/build/bin/linux/verifpal $bin/bin/
+    mkdir -p $out/bin
+    cp go/src/$goPackagePath/build/bin/linux/verifpal $out/bin/
   '';
 
   meta = {
diff --git a/pkgs/tools/system/localtime/default.nix b/pkgs/tools/system/localtime/default.nix
index 4dcb6afb00f..805a70c74e9 100644
--- a/pkgs/tools/system/localtime/default.nix
+++ b/pkgs/tools/system/localtime/default.nix
@@ -16,7 +16,7 @@ buildGoPackage rec {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
-    "BINDIR=${placeholder "bin"}/bin"
+    "BINDIR=${placeholder "out"}/bin"
   ];
 
   buildPhase = ''
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 58dea610c39..73e2b8a6de4 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -19,11 +19,11 @@ let
   inherit (stdenv.lib) optional;
 in
 stdenv.mkDerivation rec {
-  name = "gawk-5.0.1";
+  name = "gawk-5.1.0";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/${name}.tar.xz";
-    sha256 = "15570p7g2x54asvr2fsc56sxzmm08fbk4mzpcs5n92fp9vq8cklf";
+    sha256 = "1gc2cccqy1x1bf6rhwlmd8q7dz7gnam6nwgl38bxapv6qm5flpyg";
   };
 
   # When we do build separate interactive version, it makes sense to always include man.
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index dced8672ee6..65a7f7d1980 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -14,7 +14,7 @@ buildGoPackage rec {
 
   buildPhase = ''
     pushd go/src/${goPackagePath}
-    make all install BINDIR=$bin/bin
+    make all install BINDIR=$out/bin
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/virtualization/distrobuilder/default.nix b/pkgs/tools/virtualization/distrobuilder/default.nix
index a781f3a4424..6ad8c355ee2 100644
--- a/pkgs/tools/virtualization/distrobuilder/default.nix
+++ b/pkgs/tools/virtualization/distrobuilder/default.nix
@@ -23,7 +23,7 @@ buildGoPackage rec {
   goDeps = ./deps.nix;
 
   postInstall = ''
-    wrapProgram $bin/bin/distrobuilder --prefix PATH ":" ${binPath}
+    wrapProgram $out/bin/distrobuilder --prefix PATH ":" ${binPath}
   '';
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 59c668f8ff4..2a8583ea0a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5739,10 +5739,7 @@ in
 
   pal = callPackage ../tools/misc/pal { };
 
-  pandoc = haskell.lib.overrideCabal (haskell.lib.justStaticExecutables haskellPackages.pandoc) (drv: {
-    configureFlags = drv.configureFlags or [] ++ ["-fembed_data_files"];
-    buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
-  });
+  pandoc = callPackage ../development/tools/pandoc { };
 
   pamtester = callPackage ../tools/security/pamtester { };
 
@@ -6649,6 +6646,8 @@ in
     python = python3;
   };
 
+  sof-firmware = callPackage ../os-specific/linux/firmware/sof-firmware { };
+
   softhsm = callPackage ../tools/security/softhsm {
     inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -17880,7 +17879,7 @@ in
 
   ledger-udev-rules = callPackage ../os-specific/linux/ledger-udev-rules {};
 
-  inherit (callPackages ../data/fonts/redhat-liberation-fonts { })
+  inherit (callPackages ../data/fonts/liberation-fonts { })
     liberation_ttf_v1
     liberation_ttf_v2
     ;