summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/old/cross.txt2
-rw-r--r--nixos/modules/system/boot/stage-1.nix2
-rw-r--r--nixos/modules/system/boot/systemd.nix1
-rw-r--r--pkgs/applications/audio/lingot/default.nix2
-rw-r--r--pkgs/applications/audio/mhwaveedit/default.nix2
-rw-r--r--pkgs/applications/audio/puredata/default.nix13
-rw-r--r--pkgs/applications/audio/schismtracker/default.nix2
-rw-r--r--pkgs/applications/audio/transcode/default.nix8
-rw-r--r--pkgs/applications/editors/elvis/default.nix2
-rw-r--r--pkgs/applications/editors/emacs-modes/bbdb/default.nix2
-rw-r--r--pkgs/applications/editors/emacs-modes/maude/default.nix2
-rw-r--r--pkgs/applications/editors/gobby/default.nix3
-rw-r--r--pkgs/applications/editors/nano/default.nix10
-rw-r--r--pkgs/applications/graphics/dia/default.nix2
-rw-r--r--pkgs/applications/graphics/xara/default.nix2
-rw-r--r--pkgs/applications/misc/cgminer/default.nix2
-rw-r--r--pkgs/applications/misc/fetchmail/default.nix2
-rw-r--r--pkgs/applications/misc/font-manager/default.nix2
-rw-r--r--pkgs/applications/misc/gksu/default.nix2
-rw-r--r--pkgs/applications/misc/jigdo/default.nix2
-rw-r--r--pkgs/applications/misc/lilyterm/default.nix8
-rw-r--r--pkgs/applications/misc/notify-osd/default.nix2
-rw-r--r--pkgs/applications/misc/taskjuggler/2.x/default.nix12
-rw-r--r--pkgs/applications/misc/wordnet/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/dillo/default.nix2
-rw-r--r--pkgs/applications/networking/ids/daq/default.nix6
-rw-r--r--pkgs/applications/networking/ids/snort/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/amsn/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/mcabber/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/silc-client/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/telepathy/salut/default.nix2
-rw-r--r--pkgs/applications/networking/newsreaders/slrn/default.nix5
-rw-r--r--pkgs/applications/networking/znc/default.nix11
-rw-r--r--pkgs/applications/office/gnucash/2.4.nix8
-rw-r--r--pkgs/applications/office/gnumeric/default.nix2
-rw-r--r--pkgs/applications/office/ledger/2.6.3.nix6
-rw-r--r--pkgs/applications/science/biology/ncbi-tools/default.nix7
-rw-r--r--pkgs/applications/science/chemistry/octopus/default.nix16
-rw-r--r--pkgs/applications/science/electronics/geda/default.nix4
-rw-r--r--pkgs/applications/science/electronics/xcircuit/default.nix6
-rw-r--r--pkgs/applications/science/logic/eprover/default.nix5
-rw-r--r--pkgs/applications/science/logic/hol/default.nix2
-rw-r--r--pkgs/applications/science/math/cbc/default.nix2
-rw-r--r--pkgs/applications/science/math/ginac/default.nix2
-rw-r--r--pkgs/applications/science/math/scilab/default.nix52
-rw-r--r--pkgs/applications/science/misc/boinc/default.nix2
-rw-r--r--pkgs/applications/version-management/fossil/default.nix2
-rw-r--r--pkgs/applications/version-management/subversion/default.nix24
-rw-r--r--pkgs/applications/video/kino/default.nix2
-rw-r--r--pkgs/applications/video/xawtv/default.nix5
-rw-r--r--pkgs/applications/video/xine-ui/default.nix2
-rw-r--r--pkgs/applications/virtualization/singularity/default.nix2
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix4
-rw-r--r--pkgs/data/icons/tango-icon-theme/default.nix2
-rw-r--r--pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix2
-rw-r--r--pkgs/desktops/gnome-2/desktop/vte/default.nix6
-rw-r--r--pkgs/desktops/gnome-3/core/folks/default.nix2
-rw-r--r--pkgs/desktops/gnome-3/core/rest/default.nix2
-rw-r--r--pkgs/desktops/mate/mate-control-center/default.nix2
-rw-r--r--pkgs/desktops/mate/mate-screensaver/default.nix2
-rw-r--r--pkgs/desktops/mate/mate-system-monitor/default.nix2
-rw-r--r--pkgs/development/compilers/opa/default.nix2
-rw-r--r--pkgs/development/compilers/opendylan/default.nix4
-rw-r--r--pkgs/development/compilers/swi-prolog/default.nix6
-rw-r--r--pkgs/development/compilers/urweb/default.nix2
-rw-r--r--pkgs/development/compilers/yap/default.nix2
-rw-r--r--pkgs/development/coq-modules/coquelicot/default.nix2
-rw-r--r--pkgs/development/interpreters/clisp/default.nix16
-rw-r--r--pkgs/development/interpreters/clisp/hg.nix16
-rw-r--r--pkgs/development/interpreters/scsh/default.nix2
-rw-r--r--pkgs/development/libraries/aalib/default.nix2
-rw-r--r--pkgs/development/libraries/agg/default.nix2
-rw-r--r--pkgs/development/libraries/arb/git.nix4
-rw-r--r--pkgs/development/libraries/beecrypt/default.nix4
-rw-r--r--pkgs/development/libraries/buddy/default.nix2
-rw-r--r--pkgs/development/libraries/classads/default.nix6
-rw-r--r--pkgs/development/libraries/clearsilver/default.nix9
-rw-r--r--pkgs/development/libraries/cloog-ppl/default.nix2
-rw-r--r--pkgs/development/libraries/cwiid/default.nix2
-rw-r--r--pkgs/development/libraries/dbus-cplusplus/default.nix2
-rw-r--r--pkgs/development/libraries/dbus/default.nix4
-rw-r--r--pkgs/development/libraries/fflas-ffpack/1.nix6
-rw-r--r--pkgs/development/libraries/fribidi/default.nix6
-rw-r--r--pkgs/development/libraries/gamin/default.nix6
-rw-r--r--pkgs/development/libraries/gdbm/default.nix6
-rw-r--r--pkgs/development/libraries/gegl/3.0.nix2
-rw-r--r--pkgs/development/libraries/gegl/default.nix2
-rw-r--r--pkgs/development/libraries/gmp/4.3.2.nix8
-rw-r--r--pkgs/development/libraries/gmp/5.1.x.nix13
-rw-r--r--pkgs/development/libraries/gmp/6.x.nix11
-rw-r--r--pkgs/development/libraries/gsasl/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gst-ffmpeg/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix10
-rw-r--r--pkgs/development/libraries/icu/base.nix6
-rw-r--r--pkgs/development/libraries/ilixi/default.nix9
-rw-r--r--pkgs/development/libraries/imlib/default.nix9
-rw-r--r--pkgs/development/libraries/jasper/default.nix2
-rw-r--r--pkgs/development/libraries/lensfun/default.nix2
-rw-r--r--pkgs/development/libraries/libagar/libagar_test.nix2
-rw-r--r--pkgs/development/libraries/libantlr3c/default.nix2
-rw-r--r--pkgs/development/libraries/libcanberra/default.nix2
-rw-r--r--pkgs/development/libraries/libcdr/default.nix3
-rw-r--r--pkgs/development/libraries/libcmis/default.nix2
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libextractor/default.nix10
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix2
-rw-r--r--pkgs/development/libraries/libinfinity/default.nix17
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libmp3splt/default.nix2
-rw-r--r--pkgs/development/libraries/liboping/default.nix2
-rw-r--r--pkgs/development/libraries/libpng/12.nix2
-rw-r--r--pkgs/development/libraries/libpqxx/default.nix2
-rw-r--r--pkgs/development/libraries/librsync/0.9.nix5
-rw-r--r--pkgs/development/libraries/libspatialite/default.nix2
-rw-r--r--pkgs/development/libraries/libtasn1/default.nix3
-rw-r--r--pkgs/development/libraries/libtiff/default.nix6
-rw-r--r--pkgs/development/libraries/libxml2/default.nix20
-rw-r--r--pkgs/development/libraries/libzmf/default.nix6
-rw-r--r--pkgs/development/libraries/loudmouth/default.nix2
-rw-r--r--pkgs/development/libraries/mesa/default.nix1
-rw-r--r--pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch52
-rw-r--r--pkgs/development/libraries/neon/0.29.nix13
-rw-r--r--pkgs/development/libraries/neon/default.nix13
-rw-r--r--pkgs/development/libraries/nlopt/default.nix17
-rw-r--r--pkgs/development/libraries/ntrack/default.nix2
-rw-r--r--pkgs/development/libraries/openldap/default.nix12
-rw-r--r--pkgs/development/libraries/openwsman/default.nix2
-rw-r--r--pkgs/development/libraries/polkit/default.nix72
-rw-r--r--pkgs/development/libraries/polkit/system_bus.conf58
-rw-r--r--pkgs/development/libraries/qt-3/default.nix51
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix59
-rw-r--r--pkgs/development/libraries/rarian/default.nix2
-rw-r--r--pkgs/development/libraries/readosm/default.nix2
-rw-r--r--pkgs/development/libraries/science/biology/htslib/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/liblbfgs/default.nix2
-rw-r--r--pkgs/development/libraries/snack/default.nix2
-rw-r--r--pkgs/development/libraries/spatialite-tools/default.nix2
-rw-r--r--pkgs/development/libraries/sword/default.nix2
-rw-r--r--pkgs/development/libraries/thrift/default.nix2
-rw-r--r--pkgs/development/libraries/tix/default.nix14
-rw-r--r--pkgs/development/libraries/vapoursynth-mvtools/default.nix2
-rw-r--r--pkgs/development/libraries/wayland/1.9.nix2
-rw-r--r--pkgs/development/misc/avr/binutils/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/bap/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/fileutils/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/lablgtk/2.14.0.nix2
-rw-r--r--pkgs/development/ocaml-modules/lablgtk/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ocsigen-server/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/qcheck/default.nix2
-rw-r--r--pkgs/development/perl-modules/generic/default.nix12
-rw-r--r--pkgs/development/python-modules/pygobject/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix19
-rw-r--r--pkgs/development/tools/documentation/gnome-doc-utils/default.nix2
-rw-r--r--pkgs/development/tools/misc/avrdude/default.nix2
-rw-r--r--pkgs/development/tools/misc/cscope/default.nix2
-rw-r--r--pkgs/development/tools/misc/ddd/default.nix2
-rw-r--r--pkgs/development/tools/misc/dialog/default.nix19
-rw-r--r--pkgs/development/tools/misc/elfutils/default.nix4
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix4
-rw-r--r--pkgs/development/tools/misc/gnum4/default.nix2
-rw-r--r--pkgs/development/tools/misc/srecord/default.nix5
-rw-r--r--pkgs/development/tools/misc/swig/2.x.nix2
-rw-r--r--pkgs/development/tools/misc/swig/3.x.nix2
-rw-r--r--pkgs/development/tools/misc/swig/default.nix2
-rw-r--r--pkgs/development/tools/parsing/flex/default.nix8
-rw-r--r--pkgs/games/exult/default.nix2
-rw-r--r--pkgs/games/gltron/default.nix2
-rw-r--r--pkgs/games/typespeed/default.nix4
-rw-r--r--pkgs/misc/drivers/xwiimote/default.nix2
-rw-r--r--pkgs/misc/emulators/atari800/default.nix10
-rw-r--r--pkgs/misc/emulators/vice/default.nix2
-rw-r--r--pkgs/misc/emulators/wine/base.nix2
-rw-r--r--pkgs/misc/jackaudio/jack1.nix6
-rw-r--r--pkgs/misc/screensavers/vlock/default.nix2
-rw-r--r--pkgs/os-specific/linux/alsa-firmware/default.nix6
-rw-r--r--pkgs/os-specific/linux/alsa-oss/default.nix2
-rw-r--r--pkgs/os-specific/linux/alsa-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix24
-rw-r--r--pkgs/os-specific/linux/drbd/default.nix7
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix2
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix6
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/default.nix26
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix8
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix2
-rw-r--r--pkgs/os-specific/linux/pm-utils/default.nix2
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix15
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix16
-rw-r--r--pkgs/os-specific/linux/udisks/1-default.nix2
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix11
-rw-r--r--pkgs/os-specific/windows/cygwin-setup/default.nix2
-rw-r--r--pkgs/servers/dict/libmaa.nix2
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix46
-rw-r--r--pkgs/servers/http/apache-modules/tomcat-connectors/default.nix5
-rw-r--r--pkgs/servers/http/couchdb/default.nix6
-rw-r--r--pkgs/servers/http/pshs/default.nix2
-rw-r--r--pkgs/servers/http/yaws/default.nix2
-rw-r--r--pkgs/servers/irc/ircd-hybrid/default.nix7
-rw-r--r--pkgs/servers/mail/mailman/default.nix8
-rw-r--r--pkgs/servers/mail/petidomo/default.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/2.0.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/2.2.nix2
-rw-r--r--pkgs/servers/monitoring/zabbix/default.nix9
-rw-r--r--pkgs/servers/news/leafnode/default.nix2
-rw-r--r--pkgs/servers/shairport-sync/default.nix10
-rw-r--r--pkgs/servers/sql/postgresql/psqlodbc/default.nix2
-rw-r--r--pkgs/servers/sql/virtuoso/6.x.nix10
-rw-r--r--pkgs/servers/sql/virtuoso/7.x.nix10
-rw-r--r--pkgs/servers/x11/xorg/default.nix68
-rwxr-xr-xpkgs/servers/x11/xorg/generate-expr-from-tarballs.pl2
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix12
-rw-r--r--pkgs/stdenv/adapters.nix13
-rw-r--r--pkgs/stdenv/generic/default.nix2
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix41
-rw-r--r--pkgs/tools/backup/partimage/default.nix2
-rw-r--r--pkgs/tools/compression/lzip/default.nix11
-rw-r--r--pkgs/tools/filesystems/davfs2/default.nix2
-rw-r--r--pkgs/tools/filesystems/nixpart/0.4/lvm2.nix9
-rw-r--r--pkgs/tools/graphics/editres/default.nix2
-rw-r--r--pkgs/tools/graphics/ggobi/default.nix2
-rw-r--r--pkgs/tools/graphics/plotutils/default.nix2
-rw-r--r--pkgs/tools/inputmethods/keyfuzz/default.nix2
-rw-r--r--pkgs/tools/misc/most/default.nix2
-rw-r--r--pkgs/tools/misc/urjtag/default.nix12
-rw-r--r--pkgs/tools/misc/xburst-tools/default.nix7
-rw-r--r--pkgs/tools/networking/argus-clients/default.nix2
-rw-r--r--pkgs/tools/networking/cadaver/default.nix2
-rw-r--r--pkgs/tools/networking/infiniband-diags/default.nix2
-rw-r--r--pkgs/tools/networking/mtr/default.nix2
-rw-r--r--pkgs/tools/networking/p2p/amule/default.nix23
-rw-r--r--pkgs/tools/networking/reaver-wps/default.nix2
-rw-r--r--pkgs/tools/networking/ssmtp/default.nix5
-rw-r--r--pkgs/tools/networking/trickle/default.nix2
-rw-r--r--pkgs/tools/networking/vtun/default.nix9
-rw-r--r--pkgs/tools/networking/webalizer/default.nix9
-rw-r--r--pkgs/tools/networking/wget/default.nix5
-rw-r--r--pkgs/tools/security/fwknop/default.nix29
-rw-r--r--pkgs/tools/security/gnupg/22.nix4
-rw-r--r--pkgs/tools/security/modsecurity/default.nix22
-rw-r--r--pkgs/tools/security/super/default.nix5
-rw-r--r--pkgs/tools/security/yara/default.nix10
-rw-r--r--pkgs/tools/system/monit/default.nix26
-rw-r--r--pkgs/tools/text/catdoc/default.nix2
-rw-r--r--pkgs/tools/text/gnupatch/default.nix11
-rw-r--r--pkgs/tools/typesetting/xmlroff/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix21
-rw-r--r--pkgs/top-level/perl-packages.nix50
-rw-r--r--pkgs/top-level/php-packages.nix4
251 files changed, 1047 insertions, 797 deletions
diff --git a/doc/old/cross.txt b/doc/old/cross.txt
index 73103ea0c6d..c0885c08176 100644
--- a/doc/old/cross.txt
+++ b/doc/old/cross.txt
@@ -64,7 +64,7 @@ stdenv.mkDerivation {
     sha256 = "1ian3kwh2vg6hr3ymrv48s04gijs539vzrq62xr76bxbhbwnz2np";
   };
   inherit noSysDirs;
-  configureFlags = "--target=arm-linux";
+  configureFlags = [ "--target=arm-linux" ];
 }
 ---
 
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 2caab69cbb9..f58b68cb335 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -179,7 +179,7 @@ let
         fi
       done
 
-      if [ -z "${toString pkgs.stdenv.isCross}" ]; then
+      if [ -z "${toString (pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform)}" ]; then
       # Make sure that the patchelf'ed binaries still work.
       echo "testing patched programs..."
       $out/bin/ash -c 'echo hello world' | grep "hello world"
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2d3d80a91bc..12e029ae57f 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -65,6 +65,7 @@ let
       "systemd-user-sessions.service"
       "dbus-org.freedesktop.machine1.service"
       "user@.service"
+      "user-runtime-dir@.service"
 
       # Journal.
       "systemd-journald.socket"
diff --git a/pkgs/applications/audio/lingot/default.nix b/pkgs/applications/audio/lingot/default.nix
index 65df1b89430..389db3d548d 100644
--- a/pkgs/applications/audio/lingot/default.nix
+++ b/pkgs/applications/audio/lingot/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ intltool gtk2 alsaLib libglade ];
 
-  configureFlags = "--disable-jack";
+  configureFlags = [ "--disable-jack" ];
 
   meta = {
     description = "Not a Guitar-Only tuner";
diff --git a/pkgs/applications/audio/mhwaveedit/default.nix b/pkgs/applications/audio/mhwaveedit/default.nix
index 3a77c7bbbf2..88b636679cb 100644
--- a/pkgs/applications/audio/mhwaveedit/default.nix
+++ b/pkgs/applications/audio/mhwaveedit/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation  rec {
      pkgconfig libpulseaudio makeWrapper
   ];
 
-  configureFlags = "--with-default-ladspa-path=${ladspaPlugins}/lib/ladspa";
+  configureFlags = [ "--with-default-ladspa-path=${ladspaPlugins}/lib/ladspa" ];
 
   postInstall = ''
     wrapProgram $out/bin/mhwaveedit \
diff --git a/pkgs/applications/audio/puredata/default.nix b/pkgs/applications/audio/puredata/default.nix
index 73f50e45d3d..6aca7e9ce22 100644
--- a/pkgs/applications/audio/puredata/default.nix
+++ b/pkgs/applications/audio/puredata/default.nix
@@ -15,13 +15,12 @@ stdenv.mkDerivation  rec {
 
   buildInputs = [ alsaLib libjack2 fftw ];
 
-  configureFlags = ''
-    --enable-alsa
-    --enable-jack
-    --enable-fftw
-    --disable-portaudio
-
-  '';
+  configureFlags = [
+    "--enable-alsa"
+    "--enable-jack"
+    "--enable-fftw"
+    "--disable-portaudio"
+  ];
 
   # https://github.com/pure-data/pure-data/issues/188
   # --disable-oss
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index 22786304faa..ab1a6e38738 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     export ac_cv_prog_ac_ct_WINDRES=
   '';
 
-  configureFlags = "--enable-dependency-tracking";
+  configureFlags = [ "--enable-dependency-tracking" ];
 
   buildInputs = [ alsaLib python SDL ];
 
diff --git a/pkgs/applications/audio/transcode/default.nix b/pkgs/applications/audio/transcode/default.nix
index f47c8fa2eec..d7d5b65375e 100644
--- a/pkgs/applications/audio/transcode/default.nix
+++ b/pkgs/applications/audio/transcode/default.nix
@@ -10,9 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flac lame zlib libjpeg libvorbis libtheora libxml2 lzo
                   libdvdread pkgconfig x264 libmpeg2 xvidcore ];
-  configureFlags = "--disable-ffmpeg --disable-libavcodec --disable-libavformat
-    --enable-lzo --enable-ogg --enable-vorbis --enable-theora --enable-libxml2
-    --enable-x264 --enable-libmpeg2 --enable-xvid";
+  configureFlags = [
+    "--disable-ffmpeg" "--disable-libavcodec" "--disable-libavformat"
+    "--enable-lzo" "--enable-ogg" "--enable-vorbis" "--enable-theora" "--enable-libxml2"
+    "--enable-x264" "--enable-libmpeg2" "--enable-xvid"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/editors/elvis/default.nix b/pkgs/applications/editors/elvis/default.nix
index b9bd529930f..078b8a03b5d 100644
--- a/pkgs/applications/editors/elvis/default.nix
+++ b/pkgs/applications/editors/elvis/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  configureFlags = "--ioctl=termios";
+  configureFlags = [ "--ioctl=termios" ];
 
   meta = {
     homepage = http://elvis.vi-editor.org/;
diff --git a/pkgs/applications/editors/emacs-modes/bbdb/default.nix b/pkgs/applications/editors/emacs-modes/bbdb/default.nix
index 0ab11b5bf20..689bcfc9adf 100644
--- a/pkgs/applications/editors/emacs-modes/bbdb/default.nix
+++ b/pkgs/applications/editors/emacs-modes/bbdb/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   patches = [ ./install-infodir.patch ];
 
   buildInputs = [emacs texinfo ctags];
-  configureFlags = "--with-package-dir=$$out/share/emacs/site-lisp";
+  configureFlags = [ "--with-package-dir=$$out/share/emacs/site-lisp" ];
   preInstall = "mkdir -p $out/info";
   installTargets = "install-pkg texinfo";
   postInstall = ''
diff --git a/pkgs/applications/editors/emacs-modes/maude/default.nix b/pkgs/applications/editors/emacs-modes/maude/default.nix
index 70693d039c5..9b737a938a1 100644
--- a/pkgs/applications/editors/emacs-modes/maude/default.nix
+++ b/pkgs/applications/editors/emacs-modes/maude/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [emacs];
-  configureFlags = "--with-lispdir=$$out/share/emacs/site-lisp";
+  configureFlags = [ "--with-lispdir=$$out/share/emacs/site-lisp" ];
 
   meta = {
     description = "Emacs mode for the programming language Maude";
diff --git a/pkgs/applications/editors/gobby/default.nix b/pkgs/applications/editors/gobby/default.nix
index de1e5e4c64b..faad4bfe72b 100644
--- a/pkgs/applications/editors/gobby/default.nix
+++ b/pkgs/applications/editors/gobby/default.nix
@@ -18,9 +18,6 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtkmm2 gsasl gtksourceview libxmlxx libinf intltool ]
     ++ stdenv.lib.optional gnomeSupport gnome_vfs;
-  
-  configureFlags = ''
-  '';
 
   meta = with stdenv.lib; {
     homepage = http://gobby.0x539.de/;
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 96a9cea09c7..86134687ba3 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -32,11 +32,11 @@ in stdenv.mkDerivation rec {
 
   outputs = [ "out" "info" ];
 
-  configureFlags = ''
-    --sysconfdir=/etc
-    ${optionalString (!enableNls) "--disable-nls"}
-    ${optionalString enableTiny "--enable-tiny"}
-  '';
+  configureFlags = [
+    "--sysconfdir=/etc"
+    (stdenv.lib.enableFeature enableNls "nls")
+    (stdenv.lib.enableFeature enableTiny "tiny")
+  ];
 
   postInstall = ''
     cp ${nixSyntaxHighlight}/nix.nanorc $out/share/nano/
diff --git a/pkgs/applications/graphics/dia/default.nix b/pkgs/applications/graphics/dia/default.nix
index 949dce7132b..4780c823697 100644
--- a/pkgs/applications/graphics/dia/default.nix
+++ b/pkgs/applications/graphics/dia/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     NOCONFIGURE=1 ./autogen.sh # autoreconfHook is not enough
   '';
-  configureFlags = stdenv.lib.optionalString withGNOME "--enable-gnome";
+  configureFlags = stdenv.lib.optional withGNOME "--enable-gnome";
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/graphics/xara/default.nix b/pkgs/applications/graphics/xara/default.nix
index 4542de2d42f..56388a8a255 100644
--- a/pkgs/applications/graphics/xara/default.nix
+++ b/pkgs/applications/graphics/xara/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ automake pkgconfig gettext perl zip ];
   buildInputs = [ wxGTK gtk2 libxml2 freetype pango ];
 
-  configureFlags = "--disable-svnversion";
+  configureFlags = [ "--disable-svnversion" ];
 
   patches = map fetchurl (import ./debian-patches.nix);
 
diff --git a/pkgs/applications/misc/cgminer/default.nix b/pkgs/applications/misc/cgminer/default.nix
index acd38d74dca..ee3e2a955d3 100644
--- a/pkgs/applications/misc/cgminer/default.nix
+++ b/pkgs/applications/misc/cgminer/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     xorg.libX11 xorg.libXext xorg.libXinerama jansson
   ];
   configureScript = "./autogen.sh";
-  configureFlags = "--enable-scrypt --enable-opencl";
+  configureFlags = [ "--enable-scrypt" "--enable-opencl" ];
   NIX_LDFLAGS = "-lgcc_s -lX11 -lXext -lXinerama";
 
   preConfigure = ''
diff --git a/pkgs/applications/misc/fetchmail/default.nix b/pkgs/applications/misc/fetchmail/default.nix
index 8304cb0f8d1..e9d19466609 100644
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ openssl ];
 
-  configureFlags = "--with-ssl=${openssl.dev}";
+  configureFlags = [ "--with-ssl=${openssl.dev}" ];
 
   meta = {
     homepage = http://www.fetchmail.info/;
diff --git a/pkgs/applications/misc/font-manager/default.nix b/pkgs/applications/misc/font-manager/default.nix
index be853e4213b..1fad5333a14 100644
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     substituteInPlace configure --replace "/usr/bin/file" "${file}/bin/file"
   '';
 
-  configureFlags = "--disable-pycompile";
+  configureFlags = [ "--disable-pycompile" ];
 
   meta = {
     homepage = https://fontmanager.github.io/;
diff --git a/pkgs/applications/misc/gksu/default.nix b/pkgs/applications/misc/gksu/default.nix
index 6adc805b728..712c2081f10 100644
--- a/pkgs/applications/misc/gksu/default.nix
+++ b/pkgs/applications/misc/gksu/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's|/usr/bin/x-terminal-emulator|-l gnome-terminal|g' gksu.desktop
   '';
 
-  configureFlags = "--disable-nautilus-extension";
+  configureFlags = [ "--disable-nautilus-extension" ];
 
   meta = {
     description = "A graphical frontend for libgksu";
diff --git a/pkgs/applications/misc/jigdo/default.nix b/pkgs/applications/misc/jigdo/default.nix
index d8b1253ac27..3561fcde839 100644
--- a/pkgs/applications/misc/jigdo/default.nix
+++ b/pkgs/applications/misc/jigdo/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ db gtk2 bzip2 ];
 
-  configureFlags = "--without-libdb";
+  configureFlags = [ "--without-libdb" ];
 
   meta = {
     description = "Download utility that can fetch files from several sources simultaneously";
diff --git a/pkgs/applications/misc/lilyterm/default.nix b/pkgs/applications/misc/lilyterm/default.nix
index 662ca9761fb..72cb1e85802 100644
--- a/pkgs/applications/misc/lilyterm/default.nix
+++ b/pkgs/applications/misc/lilyterm/default.nix
@@ -40,10 +40,10 @@ stdenv.mkDerivation rec {
 
   preConfigure = "sh autogen.sh";
 
-  configureFlags = ''
-    --enable-nls
-    --enable-safe-mode
-  '';
+  configureFlags = [
+    "--enable-nls"
+    "--enable-safe-mode"
+  ];
 
   meta = with stdenv.lib; {
     description = "A fast, lightweight terminal emulator";
diff --git a/pkgs/applications/misc/notify-osd/default.nix b/pkgs/applications/misc/notify-osd/default.nix
index 8e8126192dd..f602ce9db66 100644
--- a/pkgs/applications/misc/notify-osd/default.nix
+++ b/pkgs/applications/misc/notify-osd/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     gnome3.gsettings-desktop-schemas
   ];
 
-  configureFlags = "--libexecdir=$(out)/bin";
+  configureFlags = [ "--libexecdir=$(out)/bin" ];
 
   preFixup = ''
     wrapProgram "$out/bin/notify-osd" \
diff --git a/pkgs/applications/misc/taskjuggler/2.x/default.nix b/pkgs/applications/misc/taskjuggler/2.x/default.nix
index 2b0573f2d2d..6b38c3d59c2 100644
--- a/pkgs/applications/misc/taskjuggler/2.x/default.nix
+++ b/pkgs/applications/misc/taskjuggler/2.x/default.nix
@@ -44,12 +44,12 @@ stdenv.mkDerivation rec {
     HOME=$TMPDIR
   '';
 
-  configureFlags = "
-    --without-arts --disable-docs
-    --x-includes=${libX11.dev}/include
-    --x-libraries=${libX11.out}/lib
-    --with-qt-dir=${qt3}
-  ";
+  configureFlags = [
+    "--without-arts" "--disable-docs"
+    "--x-includes=${libX11.dev}/include"
+    "--x-libraries=${libX11.out}/lib"
+    "--with-qt-dir=${qt3}"
+  ];
 
   preInstall = ''
     mkdir -p $out/share/emacs/site-lisp/
diff --git a/pkgs/applications/misc/wordnet/default.nix b/pkgs/applications/misc/wordnet/default.nix
index 71d95e13892..a2e3fa13fc6 100644
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@@ -17,8 +17,10 @@ stdenv.mkDerivation rec {
   '';
 
   # Needs the path to `tclConfig.sh' and `tkConfig.sh'.
-  configureFlags = "--with-tcl=" + tcl + "/lib " +
-                   "--with-tk="  + tk  + "/lib";
+  configureFlags = [
+    "--with-tcl=${tcl}/lib"
+    "--with-tk=${tk}/lib"
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/wishwn --set TK_LIBRARY "${tk}/lib/${tk.libPrefix}"
diff --git a/pkgs/applications/networking/browsers/dillo/default.nix b/pkgs/applications/networking/browsers/dillo/default.nix
index 9dc329dfc18..671ab03a2e2 100644
--- a/pkgs/applications/networking/browsers/dillo/default.nix
+++ b/pkgs/applications/networking/browsers/dillo/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   buildInputs = with stdenv.lib;
   [ perl fltk openssl libjpeg libpng libXcursor libXi libXinerama ];
 
-  configureFlags =  "--enable-ssl";
+  configureFlags = [ "--enable-ssl" ];
 
   meta = with stdenv.lib; {
     homepage = https://www.dillo.org/;
diff --git a/pkgs/applications/networking/ids/daq/default.nix b/pkgs/applications/networking/ids/daq/default.nix
index 3dc154351d2..9af105ad52e 100644
--- a/pkgs/applications/networking/ids/daq/default.nix
+++ b/pkgs/applications/networking/ids/daq/default.nix
@@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flex bison libpcap libdnet libnfnetlink libnetfilter_queue];
 
-  configureFlags = "--enable-nfq-module=yes --with-dnet-includes=${libdnet}/includes --with-dnet-libraries=${libdnet}/lib";
+  configureFlags = [
+    "--enable-nfq-module=yes"
+    "--with-dnet-includes=${libdnet}/includes"
+    "--with-dnet-libraries=${libdnet}/lib"
+  ];
 
   meta = {
     description = "Data AcQuisition library (DAQ), for packet I/O";
diff --git a/pkgs/applications/networking/ids/snort/default.nix b/pkgs/applications/networking/ids/snort/default.nix
index ff19a62ef30..0fdfbacb45c 100644
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@@ -14,7 +14,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = "--disable-static-daq --enable-control-socket --with-daq-includes=${daq}/includes --with-daq-libraries=${daq}/lib"; 
+  configureFlags = [
+    "--disable-static-daq"
+    "--enable-control-socket"
+    "--with-daq-includes=${daq}/includes"
+    "--with-daq-libraries=${daq}/lib"
+  ]; 
 
   postInstall = ''
     wrapProgram $out/bin/snort --add-flags "--daq-dir ${daq}/lib/daq --dynamic-preprocessor-lib-dir $out/lib/snort_dynamicpreprocessor/ --dynamic-engine-lib-dir $out/lib/snort_dynamicengine"
diff --git a/pkgs/applications/networking/instant-messengers/amsn/default.nix b/pkgs/applications/networking/instant-messengers/amsn/default.nix
index e6ffd72afa5..6ff51445718 100644
--- a/pkgs/applications/networking/instant-messengers/amsn/default.nix
+++ b/pkgs/applications/networking/instant-messengers/amsn/default.nix
@@ -7,7 +7,11 @@ stdenv.mkDerivation {
     sha256 = "0b8ir7spxnsz8f7kvr9f1k91nsy8cb65q6jv2l55b04fl20x4z7r";
   };
 
-  configureFlags = "--with-tcl=${tcl}/lib --with-tk=${tk}/lib --enable-static";
+  configureFlags = [
+    "--with-tcl=${tcl}/lib"
+    "--with-tk=${tk}/lib"
+    "--enable-static"
+  ];
 
   buildInputs = [which tcl tk xlibsWrapper libpng libjpeg makeWrapper];
 
diff --git a/pkgs/applications/networking/instant-messengers/mcabber/default.nix b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
index 6a697790d8f..d86d62021fb 100644
--- a/pkgs/applications/networking/instant-messengers/mcabber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
@@ -14,7 +14,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ncurses glib loudmouth libotr gpgme ];
 
-  configureFlags = "--with-openssl=${openssl.dev} --enable-modules --enable-otr";
+  configureFlags = [
+    "--with-openssl=${openssl.dev}"
+    "--enable-modules"
+    "--enable-otr"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/applications/networking/instant-messengers/silc-client/default.nix b/pkgs/applications/networking/instant-messengers/silc-client/default.nix
index dca7d1257f6..1219440bf83 100644
--- a/pkgs/applications/networking/instant-messengers/silc-client/default.nix
+++ b/pkgs/applications/networking/instant-messengers/silc-client/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = "--with-ncurses=${ncurses.dev}";
+  configureFlags = [ "--with-ncurses=${ncurses.dev}" ];
 
   preConfigure = stdenv.lib.optionalString enablePlugin ''
     configureFlags="$configureFlags --with-silc-plugin=$out/lib/irssi"
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
index 525a8a313f4..a0cc73da46d 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   checkInputs = [ dbus.daemon ];
 
-  configureFlags = "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt";
+  configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
 
   enableParallelBuilding = true;
   doCheck = true;
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
index 82ad57ae927..f6e3baadb4e 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     dbus telepathy-glib.python
   ];
 
-  configureFlags = "--enable-call";
+  configureFlags = [ "--enable-call" ];
 
   preFixup = ''
     wrapProgram "$out/libexec/telepathy-logger" \
diff --git a/pkgs/applications/networking/instant-messengers/telepathy/salut/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/salut/default.nix
index bae7231e783..68c81d38078 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/salut/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/salut/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ libxslt pkgconfigUpstream ];
 
-  configureFlags = "--disable-avahi-tests";
+  configureFlags = [ "--disable-avahi-tests" ];
 
   meta = with stdenv.lib; {
     description = "Link-local XMPP connection manager for Telepathy";
diff --git a/pkgs/applications/networking/newsreaders/slrn/default.nix b/pkgs/applications/networking/newsreaders/slrn/default.nix
index d761be2d7ac..9f775f0db65 100644
--- a/pkgs/applications/networking/newsreaders/slrn/default.nix
+++ b/pkgs/applications/networking/newsreaders/slrn/default.nix
@@ -18,7 +18,10 @@ stdenv.mkDerivation {
       -e "s|/bin/rm|rm|"
   '';
 
-  configureFlags = "--with-slang=${slang.dev} --with-ssl=${openssl.dev}";
+  configureFlags = [
+    "--with-slang=${slang.dev}"
+    "--with-ssl=${openssl.dev}"
+  ];
 
   buildInputs = [ slang ncurses openssl ];
 
diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
index 30fa41de12d..ca5624d5b73 100644
--- a/pkgs/applications/networking/znc/default.nix
+++ b/pkgs/applications/networking/znc/default.nix
@@ -24,10 +24,13 @@ stdenv.mkDerivation rec {
     ++ optional withTcl tcl
     ++ optional withCyrus cyrus_sasl;
 
-  configureFlags = optionalString withPerl "--enable-perl "
-    + optionalString withPython "--enable-python "
-    + optionalString withTcl "--enable-tcl --with-tcl=${tcl}/lib "
-    + optionalString withCyrus "--enable-cyrus ";
+  configureFlags = [
+    (stdenv.lib.enableFeature withPerl "perl")
+    (stdenv.lib.enableFeature withPython "python")
+    (stdenv.lib.enableFeature withTcl "tcl")
+    (stdenv.lib.withFeatureAs withTcl "tcl" "${tcl}/lib")
+    (stdenv.lib.enableFeature withCyrus "cyrus")
+  ];
 
   meta = with stdenv.lib; {
     description = "Advanced IRC bouncer";
diff --git a/pkgs/applications/office/gnucash/2.4.nix b/pkgs/applications/office/gnucash/2.4.nix
index b4e962ce3fc..9aa4cc64315 100644
--- a/pkgs/applications/office/gnucash/2.4.nix
+++ b/pkgs/applications/office/gnucash/2.4.nix
@@ -27,7 +27,13 @@ stdenv.mkDerivation rec {
   ];
   propagatedUserEnvPkgs = [ gconf ];
 
-  configureFlags = "CFLAGS=-O3 CXXFLAGS=-O3 --disable-dbi --enable-ofx --enable-aqbanking";
+  configureFlags = [
+    "CFLAGS=-O3"
+    "CXXFLAGS=-O3"
+    "--disable-dbi"
+    "--enable-ofx"
+    "--enable-aqbanking"
+  ];
 
   postInstall = ''
     # Auto-updaters don't make sense in Nix.
diff --git a/pkgs/applications/office/gnumeric/default.nix b/pkgs/applications/office/gnumeric/default.nix
index badc02a3646..e196b1bd0d7 100644
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@@ -16,7 +16,7 @@ in stdenv.mkDerivation rec {
     sha256 = "26cceb7fa97dc7eee7181a79a6251a85b1f1464dcaaaf7624829f7439c5f7d3f";
   };
 
-  configureFlags = "--disable-component";
+  configureFlags = [ "--disable-component" ];
 
   prePatch = ''
     substituteInPlace doc/C/gnumeric.xml \
diff --git a/pkgs/applications/office/ledger/2.6.3.nix b/pkgs/applications/office/ledger/2.6.3.nix
index 6fb8f6ca903..49b258c43fd 100644
--- a/pkgs/applications/office/ledger/2.6.3.nix
+++ b/pkgs/applications/office/ledger/2.6.3.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ emacs gmp pcre expat ];
 
-  configureFlags = "CPPFLAGS=-DNDEBUG CFLAGS=-O3 CXXFLAGS=-O3";
+  configureFlags = [
+    "CPPFLAGS=-DNDEBUG"
+    "CFLAGS=-O3"
+    "CXXFLAGS=-O3"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/applications/science/biology/ncbi-tools/default.nix b/pkgs/applications/science/biology/ncbi-tools/default.nix
index 821a80230e5..1c24ef09254 100644
--- a/pkgs/applications/science/biology/ncbi-tools/default.nix
+++ b/pkgs/applications/science/biology/ncbi-tools/default.nix
@@ -15,7 +15,12 @@ stdenv.mkDerivation rec {
     sha256 = "1b2v0dcdqn3bysgdkj57sxmd6s0hc9wpnxssviz399g6plhxggbr";
   };
 
-  configureFlags = "--without-debug --with-bin-release --with-dll --without-static";
+  configureFlags = [ 
+    "--without-debug"
+    "--with-bin-release"
+    "--with-dll"
+    "--without-static"
+  ];
   buildInputs = [ cpio ];
 
   meta = {
diff --git a/pkgs/applications/science/chemistry/octopus/default.nix b/pkgs/applications/science/chemistry/octopus/default.nix
index 0d8ab0d0e19..0ff8aa94c88 100644
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@@ -17,14 +17,14 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ perl procps fftw.dev ];
   buildInputs = [ libyaml gfortran libxc openblas gsl fftw.out netcdf arpack ];
 
-  configureFlags = ''
-    --with-yaml-prefix=${libyaml}
-    --with-blas=-lopenblas
-    --with-lapack=-lopenblas
-    --with-fftw-prefix=${fftwAll}
-    --with-gsl-prefix=${gsl}
-    --with-libxc-prefix=${libxc}
-  '';
+  configureFlags = [
+    "--with-yaml-prefix=${libyaml}"
+    "--with-blas=-lopenblas"
+    "--with-lapack=-lopenblas"
+    "--with-fftw-prefix=${fftwAll}"
+    "--with-gsl-prefix=${gsl}"
+    "--with-libxc-prefix=${libxc}"
+  ];
 
   doCheck = false;
   checkTarget = "check-short";
diff --git a/pkgs/applications/science/electronics/geda/default.nix b/pkgs/applications/science/electronics/geda/default.nix
index e080569e56f..93fe7b6ba77 100644
--- a/pkgs/applications/science/electronics/geda/default.nix
+++ b/pkgs/applications/science/electronics/geda/default.nix
@@ -9,7 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "08dpa506xk4gjbbi8vnxcb640wq4ihlgmhzlssl52nhvxwx7gx5v";
   };
 
-  configureFlags = "--disable-update-xdg-database";
+  configureFlags = [
+    "--disable-update-xdg-database" 
+  ];
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ guile gtk2 flex gawk perl ];
 
diff --git a/pkgs/applications/science/electronics/xcircuit/default.nix b/pkgs/applications/science/electronics/xcircuit/default.nix
index ba2a170e625..418144e6af7 100644
--- a/pkgs/applications/science/electronics/xcircuit/default.nix
+++ b/pkgs/applications/science/electronics/xcircuit/default.nix
@@ -17,7 +17,11 @@ in stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook automake pkgconfig ];
   hardeningDisable = [ "format" ];
 
-  configureFlags = "--with-tcl=${tcl}/lib --with-tk=${tk}/lib --with-ngspice=${getBin ngspice}/bin/ngspice";
+  configureFlags = [
+    "--with-tcl=${tcl}/lib"
+    "--with-tk=${tk}/lib"
+    "--with-ngspice=${getBin ngspice}/bin/ngspice"
+  ];
 
   buildInputs = with xorg; [ cairo ghostscript libSM libXt libICE libX11 libXpm tcl tk zlib ];
 
diff --git a/pkgs/applications/science/logic/eprover/default.nix b/pkgs/applications/science/logic/eprover/default.nix
index 95f5385fac3..0e978f2d5c9 100644
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@@ -14,7 +14,10 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     sed -e 's/ *CC *= *gcc$//' -i Makefile.vars
   '';
-  configureFlags = "--exec-prefix=$(out) --man-prefix=$(out)/share/man";
+  configureFlags = [
+    "--exec-prefix=$(out)"
+    "--man-prefix=$(out)/share/man"
+  ];
 
   meta = with stdenv.lib; {
     description = "Automated theorem prover for full first-order logic with equality";
diff --git a/pkgs/applications/science/logic/hol/default.nix b/pkgs/applications/science/logic/hol/default.nix
index 5eb33daefe8..d6a1eb6cbf7 100644
--- a/pkgs/applications/science/logic/hol/default.nix
+++ b/pkgs/applications/science/logic/hol/default.nix
@@ -15,7 +15,7 @@ in
 
 let
   polymlEnableShared = with pkgs; lib.overrideDerivation polyml (attrs: {
-    configureFlags = "--enable-shared";
+    configureFlags = [ "--enable-shared" ];
   });
 in
 
diff --git a/pkgs/applications/science/math/cbc/default.nix b/pkgs/applications/science/math/cbc/default.nix
index 689261abc66..93aefbca216 100644
--- a/pkgs/applications/science/math/cbc/default.nix
+++ b/pkgs/applications/science/math/cbc/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1w8axdzm05xf5y13c31w7rc5z6ywxqxiwafnxcq3p195kgj0915a";
   };
 
-  configureFlags = "-C";
+  configureFlags = [ "-C" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/science/math/ginac/default.nix b/pkgs/applications/science/math/ginac/default.nix
index 944460de9c7..18b13e11d35 100644
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs ginsh";
 
-  configureFlags = "--disable-rpath";
+  configureFlags = [ "--disable-rpath" ];
 
   meta = with stdenv.lib; {
     description = "GiNaC is Not a CAS";
diff --git a/pkgs/applications/science/math/scilab/default.nix b/pkgs/applications/science/math/scilab/default.nix
index 6063a45a3ef..96b7dec19c2 100644
--- a/pkgs/applications/science/math/scilab/default.nix
+++ b/pkgs/applications/science/math/scilab/default.nix
@@ -29,35 +29,29 @@ stdenv.mkDerivation rec {
 /*
   --with-atlas-library=DIR  Atlas library files are in DIR and we use Atlas
 */
-  configureFlags = ""
-  # use gcc C compiler and gnu Fortran compiler (g77 or gfortran)
-  + " --with-gcc --with-g77"
-  # use Xaw3d widgets given with Scilab
-  + (lib.optionalString (!withXaw3d) " --with-local-xaw")
-  # do not compile with PVM library
-  + " --without-pvm"
-  # compile with GTK
-  + (if withGtk then "
-       --with-gtk --with-gtk2
-    " else "
-       --without-gtk --without-gtk2
-    ")
-  # compile with TCL/TK
-  + (lib.optionalString withTk "
-       --with-tk
-       --with-tcl-library=${tcl}/lib
-       --with-tcl-include=${tcl}/include
-       --with-tk-library=${tk}/lib
-       --with-tk-include=${tk}/include
-    ")
-  # do not use Gtk widgets
-  + " --without-gtk --without-gtk2"
-  # compile with ocaml
-  + (if withOCaml then " --with-ocaml" else " --without-ocaml")
-  # do not compile Java interface
-  + " --without-java"
-  # use the X Window System
-  + lib.optionalString withX "--with-x"
+  configureFlags = [
+    # use gcc C compiler and gnu Fortran compiler (g77 or gfortran)
+    "--with-gcc" "--with-g77"
+    # do not compile with PVM library
+    "--without-pvm"
+    # compile with GTK
+    (stdenv.lib.enableFeature withGtk "gtk")
+    (stdenv.lib.enableFeature withGtk "gtk2")
+    # compile with ocaml
+    (stdenv.lib.withFeature withOCaml "ocaml")
+    # do not compile Java interface
+    "--without-java"
+    # use the X Window System
+    (stdenv.lib.withFeature withX "x")
+    # compile with TCL/TK
+  ] ++ lib.optionals withTk [
+    "--with-tk"
+    "--with-tcl-library=${tcl}/lib"
+    "--with-tcl-include=${tcl}/include"
+    "--with-tk-library=${tk}/lib"
+    "--with-tk-include=${tk}/include"
+  ]    # use Xaw3d widgets given with Scilab
+    ++ lib.optional (!withXaw3d) "--with-local-xaw"
   ;
 
   makeFlags = "all";
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index a1b8769617c..01bd1c6fd80 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = "--disable-server";
+  configureFlags = [ "--disable-server" ];
 
   meta = {
     description = "Free software for distributed and grid computing";
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index 1373e13c414..396ed10392c 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   preCheck = stdenv.lib.optional doCheck ''
     export TCLLIBPATH="${tcllib}/lib/tcllib${tcllib.version}"
   '';
-  configureFlags = if withJson then  "--json" else  "";
+  configureFlags = stdenv.lib.optional withJson "--json";
 
   preBuild=''
     export USER=nonexistent-but-specified-user
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 7bac75c960e..981f25f00f8 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -42,17 +42,19 @@ let
     # https://gcc.gnu.org/gcc-5/porting_to.html
     CPPFLAGS = "-P";
 
-    configureFlags = ''
-      ${if bdbSupport then "--with-berkeley-db" else "--without-berkeley-db"}
-      ${if httpServer then "--with-apxs=${apacheHttpd.dev}/bin/apxs" else "--without-apxs"}
-      ${if pythonBindings || perlBindings then "--with-swig=${swig}" else "--without-swig"}
-      ${if javahlBindings then "--enable-javahl --with-jdk=${jdk}" else ""}
-      --disable-keychain
-      ${if saslSupport then "--with-sasl=${sasl}" else "--without-sasl"}
-      ${if httpSupport then "--with-serf=${serf}" else "--without-serf"}
-      --with-zlib=${zlib.dev}
-      --with-sqlite=${sqlite.dev}
-    '';
+    configureFlags = [
+      (stdenv.lib.withFeature bdbSupport "berkeley-db")
+      (stdenv.lib.withFeatureAs httpServer "apxs" "${apacheHttpd.dev}/bin/apxs")
+      (stdenv.lib.withFeatureAs (pythonBindings || perlBindings) "swig" swig)
+      (stdenv.lib.withFeatureAs saslSupport "sasl" sasl)
+      (stdenv.lib.withFeatureAs httpSupport "serf" serf)
+      "--disable-keychain"
+      "--with-zlib=${zlib.dev}"
+      "--with-sqlite=${sqlite.dev}"
+    ] ++ stdenv.lib.optionals javahlBindings [
+      "--enable-javahl"
+      "--with-jdk=${jdk}"
+    ];
 
     preBuild = ''
       makeFlagsArray=(APACHE_LIBEXECDIR=$out/modules)
diff --git a/pkgs/applications/video/kino/default.nix b/pkgs/applications/video/kino/default.nix
index 3d2bf1f1a4f..6c473e2d8dc 100644
--- a/pkgs/applications/video/kino/default.nix
+++ b/pkgs/applications/video/kino/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation {
   buildInputs = [ gtk2 libglade libxml2 libraw1394 libsamplerate libdv
       pkgconfig perl perlXMLParser libavc1394 libiec61883 intltool libXv gettext libX11 glib cairo ffmpeg libv4l ]; # TODOoptional packages 
 
-  configureFlags = "--enable-local-ffmpeg=no";
+  configureFlags = [ "--enable-local-ffmpeg=no" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/video/xawtv/default.nix b/pkgs/applications/video/xawtv/default.nix
index 1b1bb8147d3..5bc9ad8852a 100644
--- a/pkgs/applications/video/xawtv/default.nix
+++ b/pkgs/applications/video/xawtv/default.nix
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${linux}/lib/modules/${linux.modDirVersion}/build"
   '';
 
-  configureFlags="--prefix=";
-  NIX_LDFLAGS="-lgcc_s";
+  configureFlags= [ "--prefix=" ];
+
+  NIX_LDFLAGS = "-lgcc_s";
 
   makeFlags = "SUID_ROOT= DESTDIR=\$(out) PREFIX=";
 
diff --git a/pkgs/applications/video/xine-ui/default.nix b/pkgs/applications/video/xine-ui/default.nix
index b75145a3e4a..69fc68a69de 100644
--- a/pkgs/applications/video/xine-ui/default.nix
+++ b/pkgs/applications/video/xine-ui/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''sed -e '/curl\/types\.h/d' -i src/xitk/download.c'';
 
-  configureFlags = "--with-readline=${readline.dev}";
+  configureFlags = [ "--with-readline=${readline.dev}" ];
   
   LIRC_CFLAGS="-I${lirc}/include";
   LIRC_LIBS="-L ${lirc}/lib -llirc_client";
diff --git a/pkgs/applications/virtualization/singularity/default.nix b/pkgs/applications/virtualization/singularity/default.nix
index ff05cb75706..fccb389071c 100644
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  configureFlags = "--localstatedir=/var";
+  configureFlags = [ "--localstatedir=/var" ];
   installFlags = "CONTAINER_MOUNTDIR=dummy CONTAINER_FINALDIR=dummy CONTAINER_OVERLAY=dummy SESSIONDIR=dummy";
 
   fixupPhase = ''
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 2048220361a..3635b0ef046 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -268,8 +268,8 @@ stdenv.mkDerivation {
       ##
 
       mkdir -p $man/nix-support $info/nix-support
-      printWords ${bintools.man or ""} >> $man/nix-support/propagated-build-inputs
-      printWords ${bintools.info or ""} >> $info/nix-support/propagated-build-inputs
+      echo ${bintools.man or ""} >> $man/nix-support/propagated-user-env-packages
+      echo ${bintools.info or ""} >> $info/nix-support/propagated-user-env-packages
     ''
 
     + ''
diff --git a/pkgs/data/icons/tango-icon-theme/default.nix b/pkgs/data/icons/tango-icon-theme/default.nix
index 928c5396b61..d38f6485f13 100644
--- a/pkgs/data/icons/tango-icon-theme/default.nix
+++ b/pkgs/data/icons/tango-icon-theme/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ intltool iconnamingutils imagemagick librsvg ];
 
-  configureFlags = "--enable-png-creation";
+  configureFlags = [ "--enable-png-creation" ];
 
   postInstall = '''${gtk.out}/bin/gtk-update-icon-cache' "$out/share/icons/Tango" '';
 
diff --git a/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix b/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix
index 62a224eb504..4b769f5d0ae 100644
--- a/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix
@@ -15,5 +15,5 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ perl perlXMLParser libxml2 libxslt gettext];
-  configureFlags = "--with-xml-catalog=${docbook_xml_dtd_42}/xml/dtd/docbook/catalog.xml";
+  configureFlags = [ "--with-xml-catalog=${docbook_xml_dtd_42}/xml/dtd/docbook/catalog.xml" ];
 }
diff --git a/pkgs/desktops/gnome-2/desktop/vte/default.nix b/pkgs/desktops/gnome-2/desktop/vte/default.nix
index c7ed90905ac..0c8efc57c71 100644
--- a/pkgs/desktops/gnome-2/desktop/vte/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/vte/default.nix
@@ -32,9 +32,9 @@ in stdenv.mkDerivation rec {
   buildInputs = [ intltool glib gtk ncurses ] ++
                 stdenv.lib.optionals pythonSupport [python pygtk];
 
-  configureFlags = ''
-    ${if pythonSupport then "--enable-python" else "--disable-python"}
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature pythonSupport "python")
+  ];
 
   postInstall = stdenv.lib.optionalString pythonSupport ''
     cd $(toPythonPath $out)/gtk-2.0
diff --git a/pkgs/desktops/gnome-3/core/folks/default.nix b/pkgs/desktops/gnome-3/core/folks/default.nix
index bea40431a24..981b8504487 100644
--- a/pkgs/desktops/gnome-3/core/folks/default.nix
+++ b/pkgs/desktops/gnome-3/core/folks/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
                   vala libsecret libxml2 libsoup nspr nss intltool db ];
   nativeBuildInputs = [ pkgconfig ];
 
-  configureFlags = "--disable-fatal-warnings";
+  configureFlags = [ "--disable-fatal-warnings" ];
 
   NIX_CFLAGS_COMPILE = ["-I${nss.dev}/include/nss"
                         "-I${dbus-glib.dev}/include/dbus-1.0" "-I${dbus.dev}/include/dbus-1.0"];
diff --git a/pkgs/desktops/gnome-3/core/rest/default.nix b/pkgs/desktops/gnome-3/core/rest/default.nix
index 9cd36cd7750..aeef5114435 100644
--- a/pkgs/desktops/gnome-3/core/rest/default.nix
+++ b/pkgs/desktops/gnome-3/core/rest/default.nix
@@ -14,7 +14,7 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib libsoup gobjectIntrospection];
 
-  configureFlags = "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt";
+  configureFlags = [ "--with-ca-certificates=/etc/ssl/certs/ca-certificates.crt" ];
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/desktops/mate/mate-control-center/default.nix b/pkgs/desktops/mate/mate-control-center/default.nix
index 36bfa596e19..bc5a78c5a4b 100644
--- a/pkgs/desktops/mate/mate-control-center/default.nix
+++ b/pkgs/desktops/mate/mate-control-center/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     mate.mate-settings-daemon
   ];
 
-  configureFlags = "--disable-update-mimedb";
+  configureFlags = [ "--disable-update-mimedb" ];
 
   meta = with stdenv.lib; {
     description = "Utilities to configure the MATE desktop";
diff --git a/pkgs/desktops/mate/mate-screensaver/default.nix b/pkgs/desktops/mate/mate-screensaver/default.nix
index 25d90c753dc..b4c215339b5 100644
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     mate.mate-menus
   ];
 
-  configureFlags = "--without-console-kit";
+  configureFlags = [ "--without-console-kit" ];
 
   makeFlags = "DBUS_SESSION_SERVICE_DIR=$(out)/etc";
 
diff --git a/pkgs/desktops/mate/mate-system-monitor/default.nix b/pkgs/desktops/mate/mate-system-monitor/default.nix
index 0f281cfc004..c3f29dff631 100644
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
-  configureFlags = "--enable-systemd";
+  configureFlags = [ "--enable-systemd" ];
 
   meta = with stdenv.lib; {
     description = "System monitor for the MATE desktop";
diff --git a/pkgs/development/compilers/opa/default.nix b/pkgs/development/compilers/opa/default.nix
index 7b9e00b105d..06ed7c51e9a 100644
--- a/pkgs/development/compilers/opa/default.nix
+++ b/pkgs/development/compilers/opa/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   prefixKey = "-prefix ";
 
-  configureFlags = "-ocamlfind ${ocamlPackages.findlib}/bin/ocamlfind ";
+  configureFlags = [ "-ocamlfind ${ocamlPackages.findlib}/bin/ocamlfind" ];
 
   buildInputs = [ which perl jdk openssl coreutils zlib ncurses
     makeWrapper gcc binutils gnumake nodejs
diff --git a/pkgs/development/compilers/opendylan/default.nix b/pkgs/development/compilers/opendylan/default.nix
index d00080282d7..17d474359da 100644
--- a/pkgs/development/compilers/opendylan/default.nix
+++ b/pkgs/development/compilers/opendylan/default.nix
@@ -24,7 +24,9 @@ stdenv.mkDerivation {
     ./autogen.sh
   '';
 
-  configureFlags = if stdenv.system == "i686-linux" then "--with-mps=$(TMPDIR)/mps" else "--with-gc=${boehmgc.out}";
+  configureFlags = [
+    (if stdenv.system == "i686-linux" then "--with-mps=$(TMPDIR)/mps" else "--with-gc=${boehmgc.out}")
+  ];
   buildPhase = "make 3-stage-bootstrap";
 
   postInstall = "wrapProgram $out/bin/dylan-compiler --suffix PATH : ${gcc}/bin";
diff --git a/pkgs/development/compilers/swi-prolog/default.nix b/pkgs/development/compilers/swi-prolog/default.nix
index 5f8bebbde3e..3ddffd58505 100644
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@@ -21,7 +21,11 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = "--with-world --enable-gmp --enable-shared";
+  configureFlags = [
+    "--with-world"
+    "--enable-gmp"
+    "--enable-shared"
+  ];
 
   buildFlags = "world";
 
diff --git a/pkgs/development/compilers/urweb/default.nix b/pkgs/development/compilers/urweb/default.nix
index 8426635ce96..68fa3d3613f 100644
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sed -e 's@/usr/bin/file@${file}/bin/file@g' -i configure
   '';
 
-  configureFlags = "--with-openssl=${openssl.dev}";
+  configureFlags = [ "--with-openssl=${openssl.dev}" ];
 
   preConfigure = ''
     export PGHEADER="${postgresql}/include/libpq-fe.h";
diff --git a/pkgs/development/compilers/yap/default.nix b/pkgs/development/compilers/yap/default.nix
index 7c6b545285c..3ad0bc25787 100644
--- a/pkgs/development/compilers/yap/default.nix
+++ b/pkgs/development/compilers/yap/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline gmp zlib ];
 
-  configureFlags = "--enable-tabling=yes";
+  configureFlags = [ "--enable-tabling=yes" ];
 
   NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
 
diff --git a/pkgs/development/coq-modules/coquelicot/default.nix b/pkgs/development/coq-modules/coquelicot/default.nix
index c4dc8b5fc5b..baad637cbb7 100644
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   buildInputs = [ coq ];
   propagatedBuildInputs = [ ssreflect ];
 
-  configureFlags = "--libdir=$out/lib/coq/${coq.coq-version}/user-contrib/Coquelicot";
+  configureFlags = [ "--libdir=$out/lib/coq/${coq.coq-version}/user-contrib/Coquelicot" ];
   buildPhase = "./remake";
   installPhase = "./remake install";
 
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index 9ab43e7392d..0a54a916ba7 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -67,15 +67,15 @@ stdenv.mkDerivation rec {
     substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
   '';
 
-  configureFlags = "builddir"
-  + stdenv.lib.optionalString (!dllSupport) " --without-dynamic-modules"
-  + stdenv.lib.optionalString (readline != null) " --with-readline"
+  configureFlags = [ "builddir" ]
+  ++ stdenv.lib.optional (!dllSupport) "--without-dynamic-modules"
+  ++ stdenv.lib.optional (readline != null) "--with-readline"
   # --with-dynamic-ffi can only exist with --with-ffcall - foreign.d does not compile otherwise
-  + stdenv.lib.optionalString (ffcallAvailable && (libffi != null)) " --with-dynamic-ffi"
-  + stdenv.lib.optionalString ffcallAvailable " --with-ffcall"
-  + stdenv.lib.optionalString (!ffcallAvailable) " --without-ffcall"
-  + stdenv.lib.concatMapStrings (x: " --with-module=" + x) withModules
-  + stdenv.lib.optionalString threadSupport " --with-threads=POSIX_THREADS";
+  ++ stdenv.lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
+  ++ stdenv.lib.optional ffcallAvailable "--with-ffcall"
+  ++ stdenv.lib.optional (!ffcallAvailable) "--without-ffcall"
+  ++ builtins.map (x: "--with-module=" + x) withModules
+  ++ stdenv.lib.optional threadSupport "--with-threads=POSIX_THREADS";
 
   preBuild = ''
     sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
diff --git a/pkgs/development/interpreters/clisp/hg.nix b/pkgs/development/interpreters/clisp/hg.nix
index 9839220796c..47dbf8a225c 100644
--- a/pkgs/development/interpreters/clisp/hg.nix
+++ b/pkgs/development/interpreters/clisp/hg.nix
@@ -62,15 +62,15 @@ stdenv.mkDerivation rec {
     substituteInPlace modules/bindings/glibc/linux.lisp --replace "(def-c-type __swblk_t)" ""
   '';
 
-  configureFlags = "builddir"
-  + stdenv.lib.optionalString (!dllSupport) " --without-dynamic-modules"
-  + stdenv.lib.optionalString (readline != null) " --with-readline"
+  configureFlags = [ "builddir" ]
+  ++ stdenv.lib.optional (!dllSupport) "--without-dynamic-modules"
+  ++ stdenv.lib.optional (readline != null) "--with-readline"
   # --with-dynamic-ffi can only exist with --with-ffcall - foreign.d does not compile otherwise
-  + stdenv.lib.optionalString (ffcallAvailable && (libffi != null)) " --with-dynamic-ffi"
-  + stdenv.lib.optionalString ffcallAvailable " --with-ffcall"
-  + stdenv.lib.optionalString (!ffcallAvailable) " --without-ffcall"
-  + stdenv.lib.concatMapStrings (x: " --with-module=" + x) withModules
-  + stdenv.lib.optionalString threadSupport " --with-threads=POSIX_THREADS";
+  ++ stdenv.lib.optional (ffcallAvailable && (libffi != null)) "--with-dynamic-ffi"
+  ++ stdenv.lib.optional ffcallAvailable "--with-ffcall"
+  ++ stdenv.lib.optional (!ffcallAvailable) "--without-ffcall"
+  ++ builtins.map (x: " --with-module=" + x) withModules
+  ++ stdenv.lib.optional threadSupport "--with-threads=POSIX_THREADS";
 
   preBuild = ''
     sed -e '/avcall.h/a\#include "config.h"' -i src/foreign.d
diff --git a/pkgs/development/interpreters/scsh/default.nix b/pkgs/development/interpreters/scsh/default.nix
index 8da41ea1a9c..85c9434f081 100644
--- a/pkgs/development/interpreters/scsh/default.nix
+++ b/pkgs/development/interpreters/scsh/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ scheme48 ];
-  configureFlags = ''--with-scheme48=${scheme48}'';
+  configureFlags = [ "--with-scheme48=${scheme48}" ];
 
   meta = with stdenv.lib; {
     description = "A Scheme shell";
diff --git a/pkgs/development/libraries/aalib/default.nix b/pkgs/development/libraries/aalib/default.nix
index 0209c41abee..8b1878b0cc3 100644
--- a/pkgs/development/libraries/aalib/default.nix
+++ b/pkgs/development/libraries/aalib/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ncurses ];
 
-  configureFlags = "--without-x --with-ncurses=${ncurses.dev}";
+  configureFlags = [ "--without-x" "--with-ncurses=${ncurses.dev}" ];
 
   postInstall = ''
     mkdir -p $dev/bin
diff --git a/pkgs/development/libraries/agg/default.nix b/pkgs/development/libraries/agg/default.nix
index ab309858095..c0539aeed47 100644
--- a/pkgs/development/libraries/agg/default.nix
+++ b/pkgs/development/libraries/agg/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sh autogen.sh
   '';
 
-  configureFlags = "--x-includes=${libX11.dev}/include --x-libraries=${libX11.out}/lib --enable-examples=no";
+  configureFlags = [ "--x-includes=${libX11.dev}/include" "--x-libraries=${libX11.out}/lib" "--enable-examples=no" ];
 
   # libtool --tag=CXX --mode=link g++ -g -O2 libexamples.la ../src/platform/X11/libaggplatformX11.la ../src/libagg.la -o alpha_mask2 alpha_mask2.o
   # libtool: error: cannot find the library 'libexamples.la'
diff --git a/pkgs/development/libraries/arb/git.nix b/pkgs/development/libraries/arb/git.nix
index 87b884fece1..a281e2a085f 100644
--- a/pkgs/development/libraries/arb/git.nix
+++ b/pkgs/development/libraries/arb/git.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
     rev = "10bc615ce5999caf4723444b2b1219b74781d8a4";
     sha256 = "1xb40x3hv9nh76aizhskj5gdhalgn7r95a7zji2nn4ih3lmh40hl";
   };
-  buildInputs = [mpir gmp mpfr flint];
-  configureFlags = "--with-gmp=${gmp} --with-mpir=${mpir} --with-mpfr=${mpfr} --with-flint=${flint}";
+  buildInputs = [ mpir gmp mpfr flint ];
+  configureFlags = [ "--with-gmp=${gmp}" "--with-mpir=${mpir}" "--with-mpfr=${mpfr}" "--with-flint=${flint}" ];
   meta = {
     inherit version;
     description = ''A library for arbitrary-precision interval arithmetic'';
diff --git a/pkgs/development/libraries/beecrypt/default.nix b/pkgs/development/libraries/beecrypt/default.nix
index 09758440524..d7d6ef54516 100644
--- a/pkgs/development/libraries/beecrypt/default.nix
+++ b/pkgs/development/libraries/beecrypt/default.nix
@@ -6,8 +6,8 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/beecrypt/beecrypt-4.2.1.tar.gz;
     sha256 = "0pf5k1c4nsj77jfq5ip0ra1gzx2q47xaa0s008fnn6hd11b1yvr8";
   };
-  buildInputs = [m4];
-  configureFlags = "--disable-optimized --enable-static";
+  buildInputs = [ m4 ];
+  configureFlags = [ "--disable-optimized" "--enable-static" ];
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/buddy/default.nix b/pkgs/development/libraries/buddy/default.nix
index 00e236eba8c..a8555a349d0 100644
--- a/pkgs/development/libraries/buddy/default.nix
+++ b/pkgs/development/libraries/buddy/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ bison ];
   patches = [ ./gcc-4.3.3-fixes.patch ];
-  configureFlags = "CFLAGS=-O3 CXXFLAGS=-O3";
+  configureFlags = [ "CFLAGS=-O3" "CXXFLAGS=-O3" ];
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/libraries/classads/default.nix b/pkgs/development/libraries/classads/default.nix
index 32a4a574ed6..d329b1945fc 100644
--- a/pkgs/development/libraries/classads/default.nix
+++ b/pkgs/development/libraries/classads/default.nix
@@ -12,9 +12,9 @@ stdenv.mkDerivation {
 
   buildInputs = [ pcre ];
 
-  configureFlags = ''                                                  
-    --enable-namespace --enable-flexible-member
-  '';
+  configureFlags = [
+    "--enable-namespace" "--enable-flexible-member"
+  ];
   
   meta = {
     homepage = http://www.cs.wisc.edu/condor/classad/;
diff --git a/pkgs/development/libraries/clearsilver/default.nix b/pkgs/development/libraries/clearsilver/default.nix
index cd1789a13bb..fd4d8d5ca31 100644
--- a/pkgs/development/libraries/clearsilver/default.nix
+++ b/pkgs/development/libraries/clearsilver/default.nix
@@ -10,7 +10,14 @@ stdenv.mkDerivation rec {
 
   PYTHON_SITE = "$(out)/site-packages";
 
-  configureFlags = "--with-python=${python}/bin/python --disable-apache --disable-perl --disable-ruby --disable-java --disable-csharp";
+  configureFlags = [
+    "--with-python=${python}/bin/python"
+    "--disable-apache"
+    "--disable-perl"
+    "--disable-ruby"
+    "--disable-java"
+    "--disable-csharp"
+  ];
 
   preInstall = ''
     mkdir -p $out
diff --git a/pkgs/development/libraries/cloog-ppl/default.nix b/pkgs/development/libraries/cloog-ppl/default.nix
index 0ce0af97ec9..47037339d41 100644
--- a/pkgs/development/libraries/cloog-ppl/default.nix
+++ b/pkgs/development/libraries/cloog-ppl/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-ppl-version.patch ];
 
-  configureFlags = "--with-ppl=${ppl}";
+  configureFlags = [ "--with-ppl=${ppl}" ];
 
   preAutoreconf = ''
     touch NEWS ChangeLog AUTHORS
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index 606058da854..ee646b24c81 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = "--without-python";
+  configureFlags = [ "--without-python" ];
 
   prePatch = ''
     sed -i -e '/$(LDCONFIG)/d' common/include/lib.mak.in
diff --git a/pkgs/development/libraries/dbus-cplusplus/default.nix b/pkgs/development/libraries/dbus-cplusplus/default.nix
index 05140581143..6190f6ddc52 100644
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ dbus glib expat ];
 
-  configureFlags = "--disable-ecore";
+  configureFlags = [ "--disable-ecore" ];
 
   meta = with stdenv.lib; {
     homepage = http://dbus-cplusplus.sourceforge.net;
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index ade6c98df94..3ca2bdd9abe 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.12.8";
-  sha256 = "1cvfi7jiby12h0f5gbysphhk99m6mch87ab3cqxkj0w36gkrkp72";
+  version = "1.12.10";
+  sha256 = "1xywijmgfad4m3cxp0b4l6kvypwc53ckmhwwzbrc6n32jwj3ssab";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";
diff --git a/pkgs/development/libraries/fflas-ffpack/1.nix b/pkgs/development/libraries/fflas-ffpack/1.nix
index 5efa378ff5f..eae0326c832 100644
--- a/pkgs/development/libraries/fflas-ffpack/1.nix
+++ b/pkgs/development/libraries/fflas-ffpack/1.nix
@@ -9,7 +9,11 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ givaro_3_7 openblas gmpxx];
-  configureFlags = "--with-blas=-lopenblas --with-gmp=${gmpxx.dev} --with-givaro=${givaro_3_7}";
+  configureFlags = [
+    "--with-blas=-lopenblas"
+    "--with-gmp=${gmpxx.dev}"
+    "--with-givaro=${givaro_3_7}"
+  ];
   meta = {
     inherit version;
     description = ''Finite Field Linear Algebra Subroutines'';
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 208d88ed18e..08b0a87e3e2 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -11,14 +11,14 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "fribidi";
-  version = "1.0.4";
+  version = "1.0.5";
 
   outputs = [ "out" "devdoc" ];
 
-  # NOTE: 2018-06-06 v1.0.4: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
+  # NOTE: 2018-06-06 v1.0.5: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${name}.tar.bz2";
-    sha256 = "1gipy8fjyn6i4qrhima02x8xs493d21f22dijp88nk807razxgcl";
+    sha256 = "1kp4b1hpx2ky20ixgy2xhj5iygfl7ps5k9kglh1z5i7mhykg4r3a";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gamin/default.nix b/pkgs/development/libraries/gamin/default.nix
index 2af7bbce18b..a4e0bcfb52b 100644
--- a/pkgs/development/libraries/gamin/default.nix
+++ b/pkgs/development/libraries/gamin/default.nix
@@ -14,7 +14,11 @@ stdenv.mkDerivation (rec {
 
   # `_GNU_SOURCE' is needed, e.g., to get `struct ucred' from
   # <sys/socket.h> with Glibc 2.9.
-  configureFlags = "--disable-debug --with-python=${python} CPPFLAGS=-D_GNU_SOURCE";
+  configureFlags = [
+    "--disable-debug"
+    "--with-python=${python}"
+    "CPPFLAGS=-D_GNU_SOURCE"
+  ];
 
   patches = [ ./deadlock.patch ]
     ++ map fetchurl (import ./debian-patches.nix)
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index a1980d62490..bbebcca6e2f 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,11 +1,13 @@
 { stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.15";
+  name = "gdbm-1.17";
+  # FIXME: remove on update to > 1.17
+  NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-Wno-error=return-type" else null;
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "03nwsbixdp3nx3fzn3gjy0n7rcppmkkxb2nxbmd8mvb7gwhf7zgr";
+    sha256 = "0zcp2iv5dbab18859a5fvacg8lkp8k4pr9af13kfvami6lpcrn3w";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/gegl/3.0.nix b/pkgs/development/libraries/gegl/3.0.nix
index 287c3324386..54ee7662d06 100644
--- a/pkgs/development/libraries/gegl/3.0.nix
+++ b/pkgs/development/libraries/gegl/3.0.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   # needs fonts otherwise  don't know how to pass them
-  configureFlags = "--disable-docs";
+  configureFlags = [ "--disable-docs" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index ccfa7e53611..e90cc257e7e 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   })];
 
   # needs fonts otherwise  don't know how to pass them
-  configureFlags = "--disable-docs";
+  configureFlags = [ "--disable-docs" ];
 
   buildInputs = [ babl libpng cairo libjpeg librsvg pango gtk2 bzip2 intltool libintl ]
     ++ stdenv.lib.optional stdenv.isDarwin OpenGL;
diff --git a/pkgs/development/libraries/gmp/4.3.2.nix b/pkgs/development/libraries/gmp/4.3.2.nix
index 36067cc0786..939f769b457 100644
--- a/pkgs/development/libraries/gmp/4.3.2.nix
+++ b/pkgs/development/libraries/gmp/4.3.2.nix
@@ -27,8 +27,12 @@ let self = stdenv.mkDerivation rec {
     then "ln -sf configfsf.guess config.guess"
     else ''echo "Darwin host is `./config.guess`."'';
 
-  configureFlags = (if cxx then "--enable-cxx" else "--disable-cxx") +
-    stdenv.lib.optionalString stdenv.isDarwin " ac_cv_build=x86_64-apple-darwin13.4.0 ac_cv_host=x86_64-apple-darwin13.4.0";
+  configureFlags = [
+    (stdenv.lib.enableFeature cxx "cxx")
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    "ac_cv_build=x86_64-apple-darwin13.4.0"
+    "ac_cv_host=x86_64-apple-darwin13.4.0"
+  ];
 
   # The test t-lucnum_ui fails (on Linux/x86_64) when built with GCC 4.8.
   # Newer versions of GMP don't have that issue anymore.
diff --git a/pkgs/development/libraries/gmp/5.1.x.nix b/pkgs/development/libraries/gmp/5.1.x.nix
index 57204776dec..3b9fbc35a76 100644
--- a/pkgs/development/libraries/gmp/5.1.x.nix
+++ b/pkgs/development/libraries/gmp/5.1.x.nix
@@ -20,18 +20,17 @@ let self = stdenv.mkDerivation rec {
 
   patches = if stdenv.isDarwin then [ ./need-size-t.patch ] else null;
 
-  configureFlags =
+  configureFlags = [
+    "--with-pic"
+    (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
     # See <http://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
-    optional (!stdenv.isSunOS) "--enable-fat"
-    ++ (if cxx then [ "--enable-cxx"  ]
-               else [ "--disable-cxx" ])
-    ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
-    ++ optional stdenv.isDarwin "ABI=64"
-    ++ optional stdenv.is64bit "--with-pic"
+    (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
+  ] ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
+    ++ optional (stdenv.isDarwin && stdenv.is64bit) "ABI=64"
     ;
 
   # The config.guess in GMP tries to runtime-detect various
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index f62883529fc..04c57d94666 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -21,18 +21,17 @@ let self = stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ m4 ];
 
-  configureFlags =
+  configureFlags = [
+    "--with-pic"
+    (stdenv.lib.enableFeature cxx "cxx")
     # Build a "fat binary", with routines for several sub-architectures
     # (x86), except on Solaris where some tests crash with "Memory fault".
     # See <http://hydra.nixos.org/build/2760931>, for instance.
     #
     # no darwin because gmp uses ASM that clang doesn't like
-    optional (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "--enable-fat"
-    ++ (if cxx then [ "--enable-cxx"  ]
-               else [ "--disable-cxx" ])
-    ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
+    (stdenv.lib.enableFeature (!stdenv.isSunOS && stdenv.hostPlatform.isx86) "fat")
+  ] ++ optional (cxx && stdenv.isDarwin) "CPPFLAGS=-fexceptions"
     ++ optional (stdenv.isDarwin && stdenv.is64bit) "ABI=64"
-    ++ optional stdenv.is64bit "--with-pic"
     ++ optional (with stdenv.hostPlatform; useAndroidPrebuilt || useiOSPrebuilt) "--disable-assembly"
     ;
 
diff --git a/pkgs/development/libraries/gsasl/default.nix b/pkgs/development/libraries/gsasl/default.nix
index 9c19bdbdc29..71da2c716f8 100644
--- a/pkgs/development/libraries/gsasl/default.nix
+++ b/pkgs/development/libraries/gsasl/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libidn kerberos ];
 
-  configureFlags = "--with-gssapi-impl=mit";
+  configureFlags = [ "--with-gssapi-impl=mit" ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-ffmpeg/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-ffmpeg/default.nix
index 95b394a6d4b..9c9243a1c68 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-ffmpeg/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-ffmpeg/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   # Upstream strongly recommends against using --with-system-ffmpeg,
   # but we do it anyway because we're so hardcore (and we don't want
   # multiple copies of ffmpeg).
-  configureFlags = stdenv.lib.optionalString (!useInternalFfmpeg) "--with-system-ffmpeg";
+  configureFlags = stdenv.lib.optional (!useInternalFfmpeg) "--with-system-ffmpeg";
 
   buildInputs =
     [ pkgconfig bzip2 gst-plugins-base orc ]
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
index e46ecfb7612..9f1048f2de5 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
@@ -26,9 +26,13 @@ stdenv.mkDerivation rec {
     patch -p1 < ${./darwin.patch}
   '';
 
-  configureFlags = ''
-    --disable-examples --enable-failing-tests --localstatedir=/var --disable-gtk-doc --disable-docbook
-  '';
+  configureFlags = [
+    "--disable-examples"
+    "--enable-failing-tests"
+    "--localstatedir=/var"
+    "--disable-gtk-doc"
+    "--disable-docbook"
+  ];
 
   postInstall = ''
     # Hm, apparently --disable-gtk-doc is ignored...
diff --git a/pkgs/development/libraries/icu/base.nix b/pkgs/development/libraries/icu/base.nix
index 705fb816b2e..b8ad48326b2 100644
--- a/pkgs/development/libraries/icu/base.nix
+++ b/pkgs/development/libraries/icu/base.nix
@@ -36,9 +36,9 @@ let
       sed -e 's/LDFLAGSICUDT=-nodefaultlibs -nostdlib/LDFLAGSICUDT=/' -i config/mh-linux
     '';
 
-    configureFlags = "--disable-debug" +
-      stdenv.lib.optionalString (stdenv.isFreeBSD || stdenv.isDarwin) " --enable-rpath" +
-      stdenv.lib.optionalString (buildPlatform != hostPlatform) " --with-cross-build=${nativeBuildRoot}";
+    configureFlags = [ "--disable-debug" ]
+      ++ stdenv.lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) "--enable-rpath"
+      ++ stdenv.lib.optional (buildPlatform != hostPlatform) "--with-cross-build=${nativeBuildRoot}";
 
     enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/ilixi/default.nix b/pkgs/development/libraries/ilixi/default.nix
index 0213148d693..99f6df9c5f0 100644
--- a/pkgs/development/libraries/ilixi/default.nix
+++ b/pkgs/development/libraries/ilixi/default.nix
@@ -14,9 +14,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ directfb libsigcxx libxml2 fontconfig ];
 
-  configureFlags = ''
-    --enable-log-debug --enable-debug --enable-trace --with-examples
-  '';
+  configureFlags = [
+    "--enable-log-debug"
+    "--enable-debug"
+    "--enable-trace"
+    "--with-examples"
+  ];
 
   meta = with stdenv.lib; {
     description = "Lightweight C++ GUI toolkit for embedded Linux systems";
diff --git a/pkgs/development/libraries/imlib/default.nix b/pkgs/development/libraries/imlib/default.nix
index 624e401b62f..2b95742c44c 100644
--- a/pkgs/development/libraries/imlib/default.nix
+++ b/pkgs/development/libraries/imlib/default.nix
@@ -7,10 +7,11 @@ stdenv.mkDerivation {
     sha256 = "0ggjxyvgp4pxc0b88v40xj9daz90518ydnycw7qax011gxpr12d3";
   };
 
-  configureFlags = "
-    --disable-shm
-    --x-includes=${libX11.dev}/include
-    --x-libraries=${libX11.out}/lib";
+  configureFlags = [
+    "--disable-shm"
+    "--x-includes=${libX11.dev}/include"
+    "--x-libraries=${libX11.out}/lib"
+  ];
 
   buildInputs = [libjpeg libXext libX11 xextproto libtiff libungif libpng];
 
diff --git a/pkgs/development/libraries/jasper/default.nix b/pkgs/development/libraries/jasper/default.nix
index bc18a13884b..de4848c7dda 100644
--- a/pkgs/development/libraries/jasper/default.nix
+++ b/pkgs/development/libraries/jasper/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   propagatedBuildInputs = [ libjpeg ];
 
-  configureFlags = "--enable-shared";
+  configureFlags = [ "--enable-shared" ];
 
   outputs = [ "bin" "dev" "out" "man" ];
 
diff --git a/pkgs/development/libraries/lensfun/default.nix b/pkgs/development/libraries/lensfun/default.nix
index e9ba4ae5ac2..c815262ac0e 100644
--- a/pkgs/development/libraries/lensfun/default.nix
+++ b/pkgs/development/libraries/lensfun/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib zlib libpng cmake gnumake3 ];
 
-  configureFlags = "-v";
+  configureFlags = [ "-v" ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/libagar/libagar_test.nix b/pkgs/development/libraries/libagar/libagar_test.nix
index dea102774d0..c1e9ba7d1c7 100644
--- a/pkgs/development/libraries/libagar/libagar_test.nix
+++ b/pkgs/development/libraries/libagar/libagar_test.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     cat configure.in | ${bsdbuild}/bin/mkconfigure > configure
   '';
 
-  configureFlags = "--with-agar=${libagar}";
+  configureFlags = [ "--with-agar=${libagar}" ];
 
   buildInputs = [ perl bsdbuild libagar libjpeg libpng openssl ];
 
diff --git a/pkgs/development/libraries/libantlr3c/default.nix b/pkgs/development/libraries/libantlr3c/default.nix
index ef583818859..6f12bf891b0 100644
--- a/pkgs/development/libraries/libantlr3c/default.nix
+++ b/pkgs/development/libraries/libantlr3c/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
     sha256 ="0lpbnb4dq4azmsvlhp6khq1gy42kyqyjv8gww74g5lm2y6blm4fa";
   };
 
-  configureFlags = if stdenv.is64bit then "--enable-64bit" else "";
+  configureFlags = stdenv.lib.optional stdenv.is64bit "--enable-64bit";
 
   meta = with stdenv.lib; {
     description = "C runtime libraries of ANTLR v3";
diff --git a/pkgs/development/libraries/libcanberra/default.nix b/pkgs/development/libraries/libcanberra/default.nix
index 0d1772d0c54..8addb6128f0 100644
--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.isLinux libcap
     ++ lib.optional withAlsa alsaLib;
 
-  configureFlags = "--disable-oss";
+  configureFlags = [ "--disable-oss" ];
 
   patchFlags = "-p0";
   patches = stdenv.lib.optional stdenv.isDarwin
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/development/libraries/libcdr/default.nix
index fa309dc8844..5e46f4dc699 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/development/libraries/libcdr/default.nix
@@ -18,8 +18,7 @@ stdenv.mkDerivation rec {
     sed -i 's,^CPPFLAGS.*,\0 -DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED,' src/lib/Makefile.in
   '';
 
-  configureFlags = if stdenv.cc.isClang
-    then [ "--disable-werror" ] else null;
+  configureFlags = stdenv.lib.optional stdenv.cc.isClang "--disable-werror";
 
   CXXFLAGS="--std=gnu++0x"; # For c++11 constants in lcms2.h
 
diff --git a/pkgs/development/libraries/libcmis/default.nix b/pkgs/development/libraries/libcmis/default.nix
index 9ab42c7fd1d..d62d1a80264 100644
--- a/pkgs/development/libraries/libcmis/default.nix
+++ b/pkgs/development/libraries/libcmis/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ boost libxml2 curl ];
-  configureFlags = "--without-man --with-boost=${boost.dev} --disable-werror --disable-tests";
+  configureFlags = [ "--without-man" "--with-boost=${boost.dev}" "--disable-werror" "--disable-tests" ];
 
   # Cppcheck cannot find all the include files (use --check-config for details)
   doCheck = false;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 93ef1957d2c..bedbce938bc 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, valgrind-light }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.92";
+  name = "libdrm-2.4.93";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "1yirzx8hmlvv6r0l7lb3zxmgy5la2mri9al0k16xqfg19pdqzr79";
+    sha256 = "0g6d9wsnb7lx8r1m4kq8js0wsc5jl20cz1csnlh6z9s8jpfd313f";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index 88b15b58c43..e3f3604f94e 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -27,10 +27,12 @@ stdenv.mkDerivation rec {
    ] ++ stdenv.lib.optionals gtkSupport [ glib gtk3 ]
      ++ stdenv.lib.optionals videoSupport [ ffmpeg libmpeg2 ];
 
-  configureFlags = "--disable-ltdl-install "
-    + "--with-ltdl-include=${libtool}/include "
-    + "--with-ltdl-lib=${libtool.lib}/lib "
-    + "--enable-xpdf";
+  configureFlags = [
+    "--disable-ltdl-install"
+    "--with-ltdl-include=${libtool}/include"
+    "--with-ltdl-lib=${libtool.lib}/lib"
+    "--enable-xpdf"
+  ];
 
   # Checks need to be run after "make install", otherwise plug-ins are not in
   # the search path, etc.
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 638dec302b7..d8708114c8e 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isDarwin gettext
     ++ stdenv.lib.optional enableCapabilities libcap;
 
-  preConfigure = stdenv.lib.optionalString stdenv.isCross ''
+  preConfigure = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     # This is intentional: gpg-error-config is a shell script that will work during the build
     mkdir -p "$NIX_BUILD_TOP"/bin
     ln -s ${libgpgerror.dev}/bin/gpg-error-config "$NIX_BUILD_TOP/bin"
diff --git a/pkgs/development/libraries/libinfinity/default.nix b/pkgs/development/libraries/libinfinity/default.nix
index 208e0111062..dffb9053605 100644
--- a/pkgs/development/libraries/libinfinity/default.nix
+++ b/pkgs/development/libraries/libinfinity/default.nix
@@ -7,7 +7,6 @@
 , libintl }:
 
 let
-  edf = flag: feature: (if flag then "--with-" else "--without-") + feature;
   optional = cond: elem: assert cond -> elem != null; if cond then [elem] else [];
 
 in stdenv.mkDerivation rec {
@@ -28,14 +27,14 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ gnutls ];
 
-  configureFlags = ''
-    ${if documentation then "--enable-gtk-doc" else "--disable-gtk-doc"}
-    ${edf gtkWidgets "inftextgtk"}
-    ${edf gtkWidgets "infgtk"}
-    ${edf daemon "infinoted"}
-    ${edf daemon "libdaemon"}
-    ${edf avahiSupport "avahi"}
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature documentation "gtk-doc")
+    (stdenv.lib.withFeature gtkWidgets "inftextgtk")
+    (stdenv.lib.withFeature gtkWidgets "infgtk")
+    (stdenv.lib.withFeature daemon "infinoted")
+    (stdenv.lib.withFeature daemon "libdaemon")
+    (stdenv.lib.withFeature avahiSupport "avahi")
+  ];
 
   passthru = {
     inherit version;
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index bf08db6d3b7..5498a32e709 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.11.0";
+  version = "1.11.3";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "04mwl1v51b785h7q3v23hahr0qzr48qq1jzj7d3msjvgh97nr8v4";
+    sha256 = "01nb1shnl871d939wgfd7nc9svclcnfjfhlq64b4yns2dvcr24gk";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libmp3splt/default.nix b/pkgs/development/libraries/libmp3splt/default.nix
index 7e5ac2a2297..af8297e9854 100644
--- a/pkgs/development/libraries/libmp3splt/default.nix
+++ b/pkgs/development/libraries/libmp3splt/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ libtool ];
   buildInputs = [ libmad libid3tag ];
 
-  configureFlags = "--disable-pcre";
+  configureFlags = [ "--disable-pcre" ];
 
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mp3splt/;
diff --git a/pkgs/development/libraries/liboping/default.nix b/pkgs/development/libraries/liboping/default.nix
index c177f7ba58e..ca026811d69 100644
--- a/pkgs/development/libraries/liboping/default.nix
+++ b/pkgs/development/libraries/liboping/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses perl ];
 
-  configureFlags = stdenv.lib.optionalString (perl == null) "--with-perl-bindings=no";
+  configureFlags = stdenv.lib.optional (perl == null) "--with-perl-bindings=no";
 
   meta = with stdenv.lib; {
     description = "C library to generate ICMP echo requests (a.k.a. ping packets)";
diff --git a/pkgs/development/libraries/libpng/12.nix b/pkgs/development/libraries/libpng/12.nix
index 01a828f95da..0153ff8327b 100644
--- a/pkgs/development/libraries/libpng/12.nix
+++ b/pkgs/development/libraries/libpng/12.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   passthru = { inherit zlib; };
 
-  configureFlags = "--enable-static";
+  configureFlags = [ "--enable-static" ];
 
   postInstall = ''mv "$out/bin" "$dev/bin"'';
 
diff --git a/pkgs/development/libraries/libpqxx/default.nix b/pkgs/development/libraries/libpqxx/default.nix
index 5c4699d2626..5afed2b2a2f 100644
--- a/pkgs/development/libraries/libpqxx/default.nix
+++ b/pkgs/development/libraries/libpqxx/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  configureFlags = "--enable-shared";
+  configureFlags = [ "--enable-shared" ];
 
   meta = {
     description = "A C++ library to access PostgreSQL databases";
diff --git a/pkgs/development/libraries/librsync/0.9.nix b/pkgs/development/libraries/librsync/0.9.nix
index 115f4cd90a0..3ca84ed2ce5 100644
--- a/pkgs/development/libraries/librsync/0.9.nix
+++ b/pkgs/development/libraries/librsync/0.9.nix
@@ -10,7 +10,10 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = if stdenv.isCygwin then "--enable-static" else "--enable-shared";
+  configureFlags = [
+    (stdenv.lib.enableFeature stdenv.isCygwin    "static")
+    (stdenv.lib.enableFeature (!stdenv.isCygwin) "shared")
+  ];
 
   dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
 
diff --git a/pkgs/development/libraries/libspatialite/default.nix b/pkgs/development/libraries/libspatialite/default.nix
index b75baf149e1..8e7b539527e 100644
--- a/pkgs/development/libraries/libspatialite/default.nix
+++ b/pkgs/development/libraries/libspatialite/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxml2 sqlite zlib proj geos libiconv ];
 
-  configureFlags = "--disable-freexl";
+  configureFlags = [ "--disable-freexl" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index cc5b19f7a59..5762291568c 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
-  nativeBuildInputs = [ texinfo ];
-  buildInputs = [ perl ];
+  nativeBuildInputs = [ texinfo perl ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index c5a12432280..bf0393fd89a 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -13,8 +13,10 @@ stdenv.mkDerivation rec {
 
   prePatch = let
       debian = fetchurl {
-        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.9-5.debian.tar.xz;
-        sha256 = "15lwcsd46gini27akms2ngyxnwi1hs2yskrv5x2wazs5fw5ii62w";
+        # When the URL disappears, it typically means that Debian has new patches
+        # (probably security) and updating to new tarball will apply them as well.
+        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.9-6.debian.tar.xz;
+        sha256 = "10yk5npchxscgsnd7ihd3bbbw2fxkl7ni0plm43c9q4nwp6ms52f";
       };
     in ''
       tar xf ${debian}
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index aa78d0d33c0..ede65d5e8c5 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -19,6 +19,13 @@ in stdenv.mkDerivation rec {
     sha256 = "0ci7is75bwqqw2p32vxvrk6ds51ik7qgx73m920rakv5jlayax0b";
   };
 
+  patches = [
+    (fetchurl { # CVE-2018-9251
+      url = https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74.diff;
+      sha256 = "01c5dnipz2rmv2dgma1ycvhyiyfvy9makyn6ywahm10jwk5chn3i";
+    })
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional enableStatic "static";
@@ -32,12 +39,13 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ zlib findXMLCatalogs ] ++ lib.optional icuSupport icu;
 
-  configureFlags =
-       lib.optional pythonSupport "--with-python=${python}"
-    ++ lib.optional icuSupport    "--with-icu"
-    ++ [ "--exec_prefix=$dev" ]
-    ++ lib.optional enableStatic "--enable-static"
-    ++ lib.optional (!enableShared) "--disable-shared";
+  configureFlags = [
+    "--exec_prefix=$dev"
+    (lib.enableFeature enableStatic "static")
+    (lib.enableFeature enableShared "shared")
+    (lib.withFeature icuSupport "icu")
+    (lib.withFeatureAs pythonSupport "python" python)
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libzmf/default.nix b/pkgs/development/libraries/libzmf/default.nix
index 6050a7080df..695effe2ea9 100644
--- a/pkgs/development/libraries/libzmf/default.nix
+++ b/pkgs/development/libraries/libzmf/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "08mg5kmkjrmqrd8j5rkzw9vdqlvibhb1ynp6bmfxnzq5rcq1l197";
   };
 
-  buildInputs = [boost icu libpng librevenge zlib cppunit];
-  nativeBuildInputs = [doxygen pkgconfig];
-  configureFlags = " --disable-werror ";
+  buildInputs = [ boost icu libpng librevenge zlib cppunit ];
+  nativeBuildInputs = [ doxygen pkgconfig ];
+  configureFlags = [ "--disable-werror" ];
 
   meta = {
     inherit version;
diff --git a/pkgs/development/libraries/loudmouth/default.nix b/pkgs/development/libraries/loudmouth/default.nix
index e014e38c3f9..aecd75656da 100644
--- a/pkgs/development/libraries/loudmouth/default.nix
+++ b/pkgs/development/libraries/loudmouth/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   patches = [
   ];
 
-  configureFlags = "--with-ssl=openssl";
+  configureFlags = [ "--with-ssl=openssl" ];
 
   propagatedBuildInputs = [ openssl libidn glib zlib ];
 
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index dbcfcf19bd1..e1a9477dcd6 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -88,6 +88,7 @@ let self = stdenv.mkDerivation {
   patches = [
     ./symlink-drivers.patch
     ./missing-includes.patch # dev_t needs sys/stat.h, time_t needs time.h, etc.-- fixes build w/musl
+    ./disk_cache-include-dri-driver-path-in-cache-key.patch
   ];
 
   outputs = [ "out" "dev" "drivers" "osmesa" ];
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
new file mode 100644
index 00000000000..47391567fb9
--- /dev/null
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -0,0 +1,52 @@
+From 9c9df280b318c26aece9873cf77b32e4f95634c1 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Mon, 6 Aug 2018 15:52:11 -0300
+Subject: [PATCH] disk_cache: include dri driver path in cache key
+
+This fixes invalid cache hits on NixOS where all shared library
+timestamps in /nix/store are zero.
+---
+ src/util/Makefile.am  | 3 +++
+ src/util/disk_cache.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/src/util/Makefile.am b/src/util/Makefile.am
+index 07bf052175..aea09f60b3 100644
+--- a/src/util/Makefile.am
++++ b/src/util/Makefile.am
+@@ -30,6 +30,9 @@ noinst_LTLIBRARIES = \
+ 	libmesautil.la \
+ 	libxmlconfig.la
+ 
++AM_CFLAGS = \
++	-DDISK_CACHE_KEY=\"$(drivers)\"
++
+ AM_CPPFLAGS = \
+ 	$(PTHREAD_CFLAGS) \
+ 	-I$(top_srcdir)/include
+diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
+index 4a762eff20..8086c0be75 100644
+--- a/src/util/disk_cache.c
++++ b/src/util/disk_cache.c
+@@ -388,8 +388,10 @@ disk_cache_create(const char *gpu_name, const char *timestamp,
+ 
+    /* Create driver id keys */
+    size_t ts_size = strlen(timestamp) + 1;
++   size_t key_size = strlen(DISK_CACHE_KEY) + 1;
+    size_t gpu_name_size = strlen(gpu_name) + 1;
+    cache->driver_keys_blob_size += ts_size;
++   cache->driver_keys_blob_size += key_size;
+    cache->driver_keys_blob_size += gpu_name_size;
+ 
+    /* We sometimes store entire structs that contains a pointers in the cache,
+@@ -410,6 +412,7 @@ disk_cache_create(const char *gpu_name, const char *timestamp,
+    uint8_t *drv_key_blob = cache->driver_keys_blob;
+    DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
+    DRV_KEY_CPY(drv_key_blob, timestamp, ts_size)
++   DRV_KEY_CPY(drv_key_blob, DISK_CACHE_KEY, key_size)
+    DRV_KEY_CPY(drv_key_blob, gpu_name, gpu_name_size)
+    DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
+    DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
+-- 
+2.18.0
+
diff --git a/pkgs/development/libraries/neon/0.29.nix b/pkgs/development/libraries/neon/0.29.nix
index dbde83c2d94..d0f992efb2b 100644
--- a/pkgs/development/libraries/neon/0.29.nix
+++ b/pkgs/development/libraries/neon/0.29.nix
@@ -28,13 +28,12 @@ stdenv.mkDerivation rec {
   buildInputs = [libxml2 openssl]
     ++ stdenv.lib.optional compressionSupport zlib;
 
-  configureFlags = ''
-    ${if shared then "--enable-shared" else "--disable-shared"}
-    ${if static then "--enable-static" else "--disable-static"}
-    ${if compressionSupport then "--with-zlib" else "--without-zlib"}
-    ${if sslSupport then "--with-ssl" else "--without-ssl"}
-    --enable-shared
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature shared "shared")
+    (stdenv.lib.enableFeature static "static")
+    (stdenv.lib.withFeature compressionSupport "zlib")
+    (stdenv.lib.withFeature sslSupport "ssl")
+  ];
 
   passthru = {inherit compressionSupport sslSupport;};
 
diff --git a/pkgs/development/libraries/neon/default.nix b/pkgs/development/libraries/neon/default.nix
index 9c2a3265491..7aad5be36f7 100644
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -28,13 +28,12 @@ stdenv.mkDerivation rec {
   buildInputs = [libxml2 openssl]
     ++ stdenv.lib.optional compressionSupport zlib;
 
-  configureFlags = ''
-    ${if shared then "--enable-shared" else "--disable-shared"}
-    ${if static then "--enable-static" else "--disable-static"}
-    ${if compressionSupport then "--with-zlib" else "--without-zlib"}
-    ${if sslSupport then "--with-ssl" else "--without-ssl"}
-    --enable-shared
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature shared "shared")
+    (stdenv.lib.enableFeature static "static")
+    (stdenv.lib.withFeature compressionSupport "zlib")
+    (stdenv.lib.withFeature sslSupport "ssl")
+  ];
 
   passthru = {inherit compressionSupport sslSupport;};
 
diff --git a/pkgs/development/libraries/nlopt/default.nix b/pkgs/development/libraries/nlopt/default.nix
index 3696578b8e0..904cdc6a3da 100644
--- a/pkgs/development/libraries/nlopt/default.nix
+++ b/pkgs/development/libraries/nlopt/default.nix
@@ -10,11 +10,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ octave ];
 
-  configureFlags = "--with-cxx --enable-shared --with-pic --without-guile --without-python
-  --without-matlab " +
-    stdenv.lib.optionalString (octave != null) ("--with-octave " +
-        "M_INSTALL_DIR=$(out)/${octave.sitePath}/m " +
-        "OCT_INSTALL_DIR=$(out)/${octave.sitePath}/oct ");
+  configureFlags = [
+    "--with-cxx"
+    "--enable-shared"
+    "--with-pic"
+    "--without-guile"
+    "--without-python"
+    "--without-matlab"
+  ] ++ stdenv.lib.optionals (octave != null) [
+    "--with-octave"
+    "M_INSTALL_DIR=$(out)/${octave.sitePath}/m"
+    "OCT_INSTALL_DIR=$(out)/${octave.sitePath}/oct"
+  ];
 
   meta = {
     homepage = http://ab-initio.mit.edu/nlopt/;
diff --git a/pkgs/development/libraries/ntrack/default.nix b/pkgs/development/libraries/ntrack/default.nix
index fb36839fe23..44c8f51e856 100644
--- a/pkgs/development/libraries/ntrack/default.nix
+++ b/pkgs/development/libraries/ntrack/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig python ];
 
-  configureFlags = "--without-gobject CFLAGS=--std=gnu99";
+  configureFlags = [ "--without-gobject" "CFLAGS=--std=gnu99" ];
 
   # Remove this patch after version 016
   patches = [ ./libnl-fix.patch ];
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 907f071d5c5..9ed555053e2 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,21 +1,13 @@
 { stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
 
 stdenv.mkDerivation rec {
-  name = "openldap-2.4.45";
+  name = "openldap-2.4.46";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${name}.tgz";
-    sha256 = "091qvwk5dkcpp17ziabcnh3rg3m7qwzw2pihfcd1d5fdxgywzmnd";
+    sha256 = "0bab1km8f2nan1x0zgwliknbxg0zlf2pafxrr867kblrdfwdr44s";
   };
 
-  patches = [
-    (fetchurl {
-      url = "https://bz-attachments.freebsd.org/attachment.cgi?id=183223";
-      sha256 = "1fiy457hrxmydybjlvn8ypzlavz22cz31q2rga07n32dh4x759r3";
-    })
-  ];
-  patchFlags = [ "-p0" ];
-
   # TODO: separate "out" and "bin"
   outputs = [ "out" "dev" "man" "devdoc" ];
 
diff --git a/pkgs/development/libraries/openwsman/default.nix b/pkgs/development/libraries/openwsman/default.nix
index 1aa0f268457..2122a7b23f1 100644
--- a/pkgs/development/libraries/openwsman/default.nix
+++ b/pkgs/development/libraries/openwsman/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     cmakeFlags="$cmakeFlags -DPACKAGE_ARCHITECTURE=$(uname -m)";
   '';
 
-  configureFlags = "--disable-more-warnings";
+  configureFlags = [ "--disable-more-warnings" ];
 
   meta = with stdenv.lib; {
     description  = "Openwsman server implementation and client API with bindings";
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 2b5f7cacd4b..82927664b4c 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -1,49 +1,25 @@
-{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, glib, expat, pam
-, intltool, spidermonkey_17 , gobjectIntrospection, libxslt, docbook_xsl
-, docbook_xml_dtd_412, gtk-doc
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, glib, expat, pam, perl
+, intltool, spidermonkey_52 , gobjectIntrospection, libxslt, docbook_xsl, dbus
+, docbook_xml_dtd_412, gtk-doc, coreutils
 , useSystemd ? stdenv.isLinux, systemd
-, doCheck ? false
+, doCheck ? stdenv.isLinux
 }:
 
 let
 
-  system = "/var/run/current-system/sw";
+  system = "/run/current-system/sw";
   setuid = "/run/wrappers/bin"; #TODO: from <nixos> config.security.wrapperDir;
 
-  foolVars = {
-    SYSCONF = "/etc";
-    DATA = "${system}/share"; # to find share/polkit-1/actions of other apps at runtime
-  };
-
 in
 
 stdenv.mkDerivation rec {
-  name = "polkit-0.113";
+  name = "polkit-0.115";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/polkit/releases/${name}.tar.gz";
-    sha256 = "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71";
+    sha256 = "0c91y61y4gy6p91cwbzg32dhavw4b7fflg370rimqhdxpzdfr1rg";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "http://src.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-agent-leaks.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
-      sha256 = "1cxnhj0y30g7ldqq1y6zwsbdwcx7h97d3mpd3h5jy7dhg3h9ym91";
-    })
-    (fetchpatch {
-      url = "http://src.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-polkitpermission-leak.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
-      sha256 = "1h1rkd4avqyyr8q6836zzr3w10jf521gcqnvhrhzwdpgp1ay4si7";
-    })
-    (fetchpatch {
-      url = "http://src.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-itstool.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
-      sha256 = "0bxmjwp8ahy1y5g1l0kxmld0l3mlvb2l0i5n1qabia3d5iyjkyfh";
-    })
-    (fetchpatch {
-      name = "netgroup-optional.patch";
-      url = "https://bugs.freedesktop.org/attachment.cgi?id=118753";
-      sha256 = "1zq51dhmqi9zi86bj9dq4i4pxlxm41k3k4a091j07bd78cjba038";
-    })
-  ];
 
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i -e "s/-Wl,--as-needed//" configure.ac
@@ -52,35 +28,34 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
   nativeBuildInputs =
-    [ gtk-doc pkgconfig autoreconfHook intltool gobjectIntrospection ]
+    [ gtk-doc pkgconfig autoreconfHook intltool gobjectIntrospection perl ]
     ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
   buildInputs =
-    [ glib expat pam spidermonkey_17 gobjectIntrospection ]
+    [ glib expat pam spidermonkey_52 gobjectIntrospection ]
     ++ stdenv.lib.optional useSystemd systemd;
 
-  # Ugly hack to overwrite hardcoded directories
-  # TODO: investigate a proper patch which will be accepted upstream
-  # After update it's good to check the sources via:
-  #   grep '\<PACKAGE_' '--include=*.[ch]' -R
-  CFLAGS = stdenv.lib.concatStringsSep " "
-    ( map (var: ''-DPACKAGE_${var}_DIR=\""${builtins.getAttr var foolVars}"\"'')
-        (builtins.attrNames foolVars) );
+  NIX_CFLAGS_COMPILE = " -Wno-deprecated-declarations "; # for polkit 0.114 and glib 2.56
 
   preConfigure = ''
+    chmod +x test/mocklibc/bin/mocklibc{,-test}.in
     patchShebangs .
-  '' + stdenv.lib.optionalString useSystemd /* bogus chroot detection */ ''
-    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
-  ''
+
     # ‘libpolkit-agent-1.so’ should call the setuid wrapper on
     # NixOS.  Hard-coding the path is kinda ugly.  Maybe we can just
     # call through $PATH, but that might have security implications.
-  + ''
     substituteInPlace src/polkitagent/polkitagentsession.c \
       --replace   'PACKAGE_PREFIX "/lib/polkit-1/'   '"${setuid}/'
+    substituteInPlace test/data/etc/polkit-1/rules.d/10-testing.rules \
+      --replace   /bin/true ${coreutils}/bin/true \
+      --replace   /bin/false ${coreutils}/bin/false
+
+  '' + stdenv.lib.optionalString useSystemd /* bogus chroot detection */ ''
+    sed '/libsystemd autoconfigured/s/.*/:/' -i configure
   '';
 
   configureFlags = [
-    #"--libexecdir=$(out)/libexec/polkit-1" # this and localstatedir are ignored by configure
+    "--datadir=${system}/share"
+    "--sysconfdir=/etc"
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
     "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
@@ -96,7 +71,14 @@ stdenv.mkDerivation rec {
     paxmark mr test/polkitbackend/.libs/polkitbackendjsauthoritytest
   '';
 
+  installFlags=["datadir=$(out)/share" "sysconfdir=$(out)/etc"];
+
   inherit doCheck;
+  checkInputs = [dbus];
+  checkPhase = ''
+    # tests need access to the system bus
+    dbus-run-session --config-file=${./system_bus.conf} -- sh -c 'DBUS_SYSTEM_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS make check'
+  '';
 
   meta = with stdenv.lib; {
     homepage = http://www.freedesktop.org/wiki/Software/polkit;
diff --git a/pkgs/development/libraries/polkit/system_bus.conf b/pkgs/development/libraries/polkit/system_bus.conf
new file mode 100644
index 00000000000..435b4740a2f
--- /dev/null
+++ b/pkgs/development/libraries/polkit/system_bus.conf
@@ -0,0 +1,58 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <!-- Our well-known bus type, do not change this -->
+  <type>system</type>
+
+  <!-- Fork into daemon mode -->
+  <fork/>
+
+  <!-- Enable logging to syslog -->
+  <syslog/>
+
+  <!-- Only allow socket-credentials-based authentication -->
+  <auth>EXTERNAL</auth>
+
+  <!-- Only listen on a local socket. (abstract=/path/to/socket 
+       means use abstract namespace, don't really create filesystem 
+       file; only Linux supports this. Use path=/whatever on other 
+       systems.) -->
+  <listen>unix:path=/tmp/system_bus_socket</listen>
+
+  <policy context="default">
+    <!-- All users can connect to system bus -->
+    <allow user="*"/>
+
+    <!-- Holes must be punched in service configuration files for
+         name ownership and sending method calls -->
+    <deny own="*"/>
+    <deny send_type="method_call"/>
+
+    <!-- Signals and reply messages (method returns, errors) are allowed
+         by default -->
+    <allow send_type="signal"/>
+    <allow send_requested_reply="true" send_type="method_return"/>
+    <allow send_requested_reply="true" send_type="error"/>
+
+    <!-- All messages may be received by default -->
+    <allow receive_type="method_call"/>
+    <allow receive_type="method_return"/>
+    <allow receive_type="error"/>
+    <allow receive_type="signal"/>
+
+    <!-- Allow anyone to talk to the message bus -->
+    <allow send_destination="org.freedesktop.DBus"
+           send_interface="org.freedesktop.DBus" />
+    <allow send_destination="org.freedesktop.DBus"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+    <!-- But disallow some specific bus services -->
+    <deny send_destination="org.freedesktop.DBus"
+          send_interface="org.freedesktop.DBus"
+          send_member="UpdateActivationEnvironment"/>
+    <deny send_destination="org.freedesktop.DBus"
+          send_interface="org.freedesktop.DBus.Debug.Stats"/>
+    <deny send_destination="org.freedesktop.DBus"
+          send_interface="org.freedesktop.systemd1.Activator"/>
+  </policy>
+
+</busconfig>
diff --git a/pkgs/development/libraries/qt-3/default.nix b/pkgs/development/libraries/qt-3/default.nix
index 32841c9b933..a3c91f9f307 100644
--- a/pkgs/development/libraries/qt-3/default.nix
+++ b/pkgs/development/libraries/qt-3/default.nix
@@ -30,31 +30,38 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ which ];
-  propagatedBuildInputs = [libpng xlibsWrapper libXft libXrender zlib libjpeg];
+  buildInputs = [
+    xextproto
+  ] ++ stdenv.lib.optionals openglSupport [
+    libGLU_combined libXmu
+  ] ++ stdenv.lib.optionals xftSupport [
+    libXft libXft.freetype libXft.fontconfig
+  ] ++ stdenv.lib.optional xrenderSupport libXrender
+    ++ stdenv.lib.optional xineramaSupport libXinerama
+    ++ stdenv.lib.optional xrandrSupport libXrandr
+    ++ stdenv.lib.optional xineramaSupport libXinerama;
+
+  propagatedBuildInputs = [ libpng xlibsWrapper libXft libXrender zlib libjpeg ];
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = "
-    -v
-    -system-zlib -system-libpng -system-libjpeg
-    -qt-gif
-    -I${xextproto}/include
-    ${if openglSupport then "-dlopen-opengl
-      -L${libGLU_combined}/lib -I${libGLU_combined}/include
-      -L${libXmu.out}/lib -I${libXmu.dev}/include" else ""}
-    ${if threadSupport then "-thread" else "-no-thread"}
-    ${if xrenderSupport then "-xrender -L${libXrender.out}/lib -I${libXrender.dev}/include" else "-no-xrender"}
-    ${if xrandrSupport then "-xrandr
-      -L${libXrandr.out}/lib -I${libXrandr.dev}/include
-      -I${randrproto}/include" else "-no-xrandr"}
-    ${if xineramaSupport then "-xinerama -L${libXinerama.out}/lib -I${libXinerama.dev}/include" else "-no-xinerama"}
-    ${if cursorSupport then "-L${libXcursor.out}/lib -I${libXcursor.dev}/include" else ""}
-    ${if mysqlSupport then "-qt-sql-mysql -L${mysql.connector-c}/lib/mysql -I${mysql.connector-c}/include/mysql" else ""}
-    ${if xftSupport then "-xft
-      -L${libXft.out}/lib -I${libXft.dev}/include
-      -L${libXft.freetype.out}/lib -I${libXft.freetype.dev}/include
-      -L${libXft.fontconfig.lib}/lib -I${libXft.fontconfig.dev}/include" else "-no-xft"}
-  ";
+  configurePlatforms = [];
+  configureFlags = let
+    mk = cond: name: "-${stdenv.lib.optionalString cond "no-"}${name}";
+  in [
+    "-v"
+    "-system-zlib" "-system-libpng" "-system-libjpeg"
+    "-qt-gif"
+    (mk xftSupport "xft")
+    (mk xrenderSupport "xrender")
+    (mk xrandrSupport "xrandr")
+    (mk xineramaSupport "xinerama")
+    (mk threadSupport "thread")
+  ] ++ stdenv.lib.optionals mysqlSupport [
+    "-qt-sql-mysql"
+    "-L${mysql.connector-c}/lib/mysql"
+    "-I${mysql.connector-c}/include/mysql"
+  ] ++ stdenv.lib.optional openglSupport "-dlopen-opengl";
 
   patches = [
     # Don't strip everything so we can get useful backtraces.
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 471f11ad107..463cb2938ed 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -6,7 +6,7 @@
 , buildMultimedia ? stdenv.isLinux, alsaLib, gstreamer, gst-plugins-base
 , buildWebkit ? (stdenv.isLinux || stdenv.isDarwin)
 , flashplayerFix ? false, gdk_pixbuf
-, gtkStyle ? true, gtk2
+, gtkStyle ? stdenv.hostPlatform == stdenv.buildPlatform, gtk2
 , gnomeStyle ? false, libgnomeui, GConf, gnome_vfs
 , developerBuild ? false
 , docs ? false
@@ -139,37 +139,40 @@ stdenv.mkDerivation rec {
 
   prefixKey = "-prefix ";
 
-  ${if stdenv.hostPlatform == stdenv.buildPlatform then null else "configurePlatforms"} = [];
+  configurePlatforms = [];
   configureFlags = let
+    mk = cond: name: "-${lib.optionalString cond "no-"}${name}";
     platformFlag =
       if stdenv.hostPlatform != stdenv.buildPlatform
       then "-xplatform"
       else "-platform";
-    in (if stdenv.hostPlatform == stdenv.buildPlatform then ''
-      -v -no-separate-debug-info -release -fast -confirm-license -opensource
-
-      -${if stdenv.isFreeBSD then "no-" else ""}opengl -xrender -xrandr -xinerama -xcursor -xinput -xfixes -fontconfig
-      -qdbus -${if cups == null then "no-" else ""}cups -glib -dbus-linked -openssl-linked
-
-      ${if mysql != null then "-plugin" else "-no"}-sql-mysql -system-sqlite
-
-      -exceptions -xmlpatterns
-
-      -make libs -make tools -make translations
-      -${if demos then "" else "no"}make demos
-      -${if examples then "" else "no"}make examples
-      -${if docs then "" else "no"}make docs
-
-      -no-phonon ${if buildWebkit then "" else "-no"}-webkit ${if buildMultimedia then "" else "-no"}-multimedia -audio-backend
-      ${if developerBuild then "-developer-build" else ""}
-    '' else ''
-      -static -release -confirm-license -opensource
-      -no-opengl -no-phonon
-      -no-svg
-      -make qmake -make libs -nomake tools
-      -nomake demos -nomake examples -nomake docs
-    '') + lib.optionalString stdenv.hostPlatform.isDarwin "${platformFlag} unsupported/macx-clang-libc++"
-        + lib.optionalString stdenv.hostPlatform.isMinGW  "${platformFlag} win32-g++-4.6";
+  in (if stdenv.hostPlatform != stdenv.buildPlatform then [
+    # I've not tried any case other than i686-pc-mingw32.
+    # -nomake tools: it fails linking some asian language symbols
+    # -no-svg: it fails to build on mingw64
+    "-static" "-release" "-confirm-license" "-opensource"
+    "-no-opengl" "-no-phonon"
+    "-no-svg"
+    "-make" "qmake" "-make" "libs" "-nomake" "tools"
+  ] else [
+    "-v" "-no-separate-debug-info" "-release" "-fast" "-confirm-license" "-opensource"
+
+    (mk (!stdenv.isFreeBSD) "opengl") "-xrender" "-xrandr" "-xinerama" "-xcursor" "-xinput" "-xfixes" "-fontconfig"
+    "-qdbus" (mk (cups != null) "cups") "-glib" "-dbus-linked" "-openssl-linked"
+
+    "-${if mysql != null then "plugin" else "no"}-sql-mysql" "-system-sqlite"
+
+    "-exceptions" "-xmlpatterns"
+
+    "-make" "libs" "-make" "tools" "-make" "translations"
+    "-no-phonon" (mk buildWebkit "webkit") (mk buildMultimedia "multimedia") "-audio-backend"
+  ]) ++ [
+    (mk demos "make") "demos"
+    (mk examples "make") "examples"
+    (mk docs "make") "docs"
+  ] ++ lib.optional developerBuild "-developer-build"
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ platformFlag "unsupported/macx-clang-libc++" ]
+    ++ lib.optionals stdenv.hostPlatform.isWindows [ platformFlag "win32-g++-4.6" ];
 
   propagatedBuildInputs =
     [ libXrender libXrandr libXinerama libXcursor libXext libXfixes libXv libXi
@@ -219,7 +222,7 @@ stdenv.mkDerivation rec {
     cp bin/qmake* $out/bin
   '';
 
-  dontStrip = if stdenv.hostPlatform == stdenv.buildPlatform then null else true;
+  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
 
   meta = {
     homepage    = http://qt-project.org/;
diff --git a/pkgs/development/libraries/rarian/default.nix b/pkgs/development/libraries/rarian/default.nix
index 484e5856872..4446226fede 100644
--- a/pkgs/development/libraries/rarian/default.nix
+++ b/pkgs/development/libraries/rarian/default.nix
@@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ perl perlXMLParser libxml2 libxslt];
-  configureFlags = "--with-xml-catalog=${docbook_xml_dtd_42}/xml/dtd/docbook/docbook.cat";
+  configureFlags = [ "--with-xml-catalog=${docbook_xml_dtd_42}/xml/dtd/docbook/docbook.cat" ];
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/development/libraries/readosm/default.nix b/pkgs/development/libraries/readosm/default.nix
index 5a4306a63a7..1c777e849a4 100644
--- a/pkgs/development/libraries/readosm/default.nix
+++ b/pkgs/development/libraries/readosm/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ expat zlib geos libspatialite ];
 
-  configureFlags = "--disable-freexl";
+  configureFlags = [ "--disable-freexl" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/science/biology/htslib/default.nix b/pkgs/development/libraries/science/biology/htslib/default.nix
index 2144a7f7893..48548bd7265 100644
--- a/pkgs/development/libraries/science/biology/htslib/default.nix
+++ b/pkgs/development/libraries/science/biology/htslib/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ zlib bzip2 lzma curl ];
 
-  configureFlags = "--enable-libcurl"; # optional but strongly recommended
+  configureFlags = [ "--enable-libcurl" ]; # optional but strongly recommended
 
   installFlags = "prefix=$(out)";
 
diff --git a/pkgs/development/libraries/science/math/liblbfgs/default.nix b/pkgs/development/libraries/science/math/liblbfgs/default.nix
index fe90fa2e171..33e8baada83 100644
--- a/pkgs/development/libraries/science/math/liblbfgs/default.nix
+++ b/pkgs/development/libraries/science/math/liblbfgs/default.nix
@@ -2,7 +2,7 @@
 stdenv.mkDerivation {
   name = "liblbfgs-1.10";
 
-  configureFlags = "--enable-sse2";
+  configureFlags = [ "--enable-sse2" ];
   src = fetchurl {
     url = https://github.com/downloads/chokkan/liblbfgs/liblbfgs-1.10.tar.gz;
     sha256 = "1kv8d289rbz38wrpswx5dkhr2yh4fg4h6sszkp3fawxm09sann21";
diff --git a/pkgs/development/libraries/snack/default.nix b/pkgs/development/libraries/snack/default.nix
index 1b5564dc159..acf10cc497c 100644
--- a/pkgs/development/libraries/snack/default.nix
+++ b/pkgs/development/libraries/snack/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "07p89jv9qnjqkszws9sssq93ayvwpdnkcxrvyicbm4mb8x2pdzjb";
   };
 
-  configureFlags = "--with-tcl=${tcl}/lib --with-tk=${tk}/lib";
+  configureFlags = [ "--with-tcl=${tcl}/lib" "--with-tk=${tk}/lib" ];
 
   postUnpack = ''sourceRoot="$sourceRoot/unix"'';
 
diff --git a/pkgs/development/libraries/spatialite-tools/default.nix b/pkgs/development/libraries/spatialite-tools/default.nix
index 9070423d8c7..4ea7de0b1a3 100644
--- a/pkgs/development/libraries/spatialite-tools/default.nix
+++ b/pkgs/development/libraries/spatialite-tools/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ sqlite expat zlib proj geos libspatialite readosm ];
 
-  configureFlags = "--disable-freexl";
+  configureFlags = [ "--disable-freexl" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/sword/default.nix b/pkgs/development/libraries/sword/default.nix
index 0c3bb3b1306..afb168d5aa2 100644
--- a/pkgs/development/libraries/sword/default.nix
+++ b/pkgs/development/libraries/sword/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = "--without-conf --enable-tests=no CXXFLAGS=-Wno-unused-but-set-variable";
+  configureFlags = [ "--without-conf" "--enable-tests=no CXXFLAGS=-Wno-unused-but-set-variable" ];
 
   meta = with stdenv.lib; {
     description = "A software framework that allows research manipulation of Biblical texts";
diff --git a/pkgs/development/libraries/thrift/default.nix b/pkgs/development/libraries/thrift/default.nix
index cb200b82e20..dee441a0c2f 100644
--- a/pkgs/development/libraries/thrift/default.nix
+++ b/pkgs/development/libraries/thrift/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   # TODO: package boost-test, so we can run the test suite. (Currently it fails
   # to find libboost_unit_test_framework.a.)
-  configureFlags = "--enable-tests=no";
+  configureFlags = [ "--enable-tests=no" ];
   doCheck = false;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/libraries/tix/default.nix
index 7e18e740227..232c95e6257 100644
--- a/pkgs/development/libraries/tix/default.nix
+++ b/pkgs/development/libraries/tix/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation rec {
       ln -s $i private_headers/generic;
     done;
     '';
-  configureFlags = ''
-      --with-tclinclude=${tcl}/include
-      --with-tclconfig=.
-      --with-tkinclude=${tk.dev}/include
-      --with-tkconfig=.
-      --libdir=''${prefix}/lib
-    '';
+  configureFlags = [
+    "--with-tclinclude=${tcl}/include"
+    "--with-tclconfig=."
+    "--with-tkinclude=${tk.dev}/include"
+    "--with-tkconfig=."
+    "--libdir=\${prefix}/lib"
+  ];
 
   meta = with stdenv.lib; {
     description = "A widget library for Tcl/Tk";
diff --git a/pkgs/development/libraries/vapoursynth-mvtools/default.nix b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
index 2fa6710c4fa..c2ab61c6bd1 100644
--- a/pkgs/development/libraries/vapoursynth-mvtools/default.nix
+++ b/pkgs/development/libraries/vapoursynth-mvtools/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     yasm vapoursynth fftwFloat
   ];
 
-  configureFlags = "--libdir=$(out)/lib/vapoursynth";
+  configureFlags = [ "--libdir=$(out)/lib/vapoursynth" ];
 
   meta = with stdenv.lib; {
     description = "A set of filters for motion estimation and compensation";
diff --git a/pkgs/development/libraries/wayland/1.9.nix b/pkgs/development/libraries/wayland/1.9.nix
index 3555a923228..750a786c3fc 100644
--- a/pkgs/development/libraries/wayland/1.9.nix
+++ b/pkgs/development/libraries/wayland/1.9.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "1yhy62vkbq8j8c9zaa6yzvn75cd99kfa8n2zfdwl80x019r711ww";
   };
 
-  configureFlags = "--with-scanner --disable-documentation";
+  configureFlags = [ "--with-scanner" "--disable-documentation" ];
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/development/misc/avr/binutils/default.nix b/pkgs/development/misc/avr/binutils/default.nix
index de87ad88492..83ba93e63b7 100644
--- a/pkgs/development/misc/avr/binutils/default.nix
+++ b/pkgs/development/misc/avr/binutils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     url = "mirror://gnu/binutils/binutils-${version}.tar.bz2";
     sha256 = "1l34hn1zkmhr1wcrgf0d4z7r3najxnw3cx2y2fk7v55zjlk3ik7z";
   };
-  configureFlags = "--target=avr --enable-languages=c,c++";
+  configureFlags = [ "--target=avr" "--enable-languages=c,c++" ];
 
   meta = with stdenv.lib; {
     description = "the GNU Binutils for AVR microcontrollers";
diff --git a/pkgs/development/ocaml-modules/bap/default.nix b/pkgs/development/ocaml-modules/bap/default.nix
index 72c426ce037..445ff3ecb18 100644
--- a/pkgs/development/ocaml-modules/bap/default.nix
+++ b/pkgs/development/ocaml-modules/bap/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
 
   disableIda = "--disable-ida --disable-fsi-benchmark";
 
-  configureFlags = "--enable-everything ${disableIda} --with-llvm-config=${llvm_38}/bin/llvm-config";
+  configureFlags = [ "--enable-everything ${disableIda}" "--with-llvm-config=${llvm_38}/bin/llvm-config" ];
 
   BAPBUILDFLAGS = "-j $(NIX_BUILD_CORES)";
 
diff --git a/pkgs/development/ocaml-modules/fileutils/default.nix b/pkgs/development/ocaml-modules/fileutils/default.nix
index a7dc5ef0191..8c9aa46d9a0 100644
--- a/pkgs/development/ocaml-modules/fileutils/default.nix
+++ b/pkgs/development/ocaml-modules/fileutils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ocaml findlib ocamlbuild ounit ];
 
-  configureFlags = "--enable-tests";
+  configureFlags = [ "--enable-tests" ];
   doCheck = true;
   checkTarget = "test";
 
diff --git a/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix b/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
index 5dc303b59f4..55a4a02f7ff 100644
--- a/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/2.14.0.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ocaml findlib gtk2 libgnomecanvas libglade gtksourceview camlp4 ];
 
-  configureFlags = "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib";
+  configureFlags = [ "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib" ];
   buildFlags = "world";
 
   preInstall = ''
diff --git a/pkgs/development/ocaml-modules/lablgtk/default.nix b/pkgs/development/ocaml-modules/lablgtk/default.nix
index ff42af0c0e4..6b01929db76 100644
--- a/pkgs/development/ocaml-modules/lablgtk/default.nix
+++ b/pkgs/development/ocaml-modules/lablgtk/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ocaml findlib gtk2 libgnomecanvas libglade gtksourceview ];
 
-  configureFlags = "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib";
+  configureFlags = [ "--with-libdir=$(out)/lib/ocaml/${ocaml.version}/site-lib" ];
   buildFlags = "world";
 
   preInstall = ''
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index efbb1230497..474f69ba918 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
   ocaml_sqlite3 tree uutf makeWrapper camlp4 pgocaml camlzip ]
   ++ (param.buildInputs or []);
 
-  configureFlags = "--root $(out) --prefix /";
+  configureFlags = [ "--root $(out) --prefix /" ];
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/ocaml-modules/qcheck/default.nix b/pkgs/development/ocaml-modules/qcheck/default.nix
index 20100a9b2eb..dfe7ec84d63 100644
--- a/pkgs/development/ocaml-modules/qcheck/default.nix
+++ b/pkgs/development/ocaml-modules/qcheck/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ocaml findlib ocamlbuild ounit ];
 
-  configureFlags = "--enable-tests";
+  configureFlags = [ "--enable-tests" ];
 
   doCheck = true;
   checkPhase = "ocaml setup.ml -test";
diff --git a/pkgs/development/perl-modules/generic/default.nix b/pkgs/development/perl-modules/generic/default.nix
index 561bbcdb73e..1d7e6d17ffb 100644
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@@ -1,10 +1,10 @@
-perl:
+{ lib, stdenv, perl }:
 
 { nativeBuildInputs ? [], name, ... } @ attrs:
 
-perl.stdenv.mkDerivation (
+stdenv.mkDerivation (
   (
-  perl.stdenv.lib.recursiveUpdate
+  lib.recursiveUpdate
   {
     outputs = [ "out" "devdoc" ];
 
@@ -23,13 +23,17 @@ perl.stdenv.mkDerivation (
     # the results are not being monitored by a human being."
     AUTOMATED_TESTING = true;
 
+    # current directory (".") is removed from @INC in Perl 5.26 but many old libs rely on it
+    # https://metacpan.org/pod/release/XSAWYERX/perl-5.26.0/pod/perldelta.pod#Removal-of-the-current-directory-%28%22.%22%29-from-@INC
+    PERL_USE_UNSAFE_INC = lib.optionalString (lib.versionAtLeast (lib.getVersion perl) "5.26") "1";
+
     meta.homepage = "https://metacpan.org/release/${(builtins.parseDrvName name).name}";
   }
   attrs
   )
   //
   {
-    name = "perl-" + name;
+    name = "perl${lib.getVersion perl}-${name}";
     builder = ./builder.sh;
     nativeBuildInputs = nativeBuildInputs ++ [ (perl.dev or perl) ];
     inherit perl;
diff --git a/pkgs/development/python-modules/pygobject/default.nix b/pkgs/development/python-modules/pygobject/default.nix
index 796fc992a7d..56e8f1fa5eb 100644
--- a/pkgs/development/python-modules/pygobject/default.nix
+++ b/pkgs/development/python-modules/pygobject/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     ./pygobject-2.28.6-gio-types-2.32.patch
   ];
 
-  configureFlags = "--disable-introspection";
+  configureFlags = [ "--disable-introspection" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ glib ];
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 5fda0994010..0e3f89fa152 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -27,10 +27,10 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  # Remove .pytest-cache when using py.test in a Nix build
+  # Remove .pytest_cache when using py.test in a Nix build
   setupHook = writeText "pytest-hook" ''
     postFixupHooks+=(
-        'find $out -name .pytest-cache -type d -exec rm -rf {} +'
+        'find $out -name .pytest_cache -type d -exec rm -rf {} +'
     )
   '';
 
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 3cb906d50ed..ca53c4d8c53 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,7 +1,6 @@
-{ lib, python3Packages, stdenv, targetPlatform, writeTextDir, substituteAll }: let
-  targetPrefix = lib.optionalString stdenv.isCross
-                   (targetPlatform.config + "-");
-in python3Packages.buildPythonApplication rec {
+{ lib, python3Packages, stdenv, targetPlatform, writeTextDir, substituteAll }:
+
+python3Packages.buildPythonApplication rec {
   version = "0.46.1";
   pname = "meson";
 
@@ -48,10 +47,10 @@ in python3Packages.buildPythonApplication rec {
 
   crossFile = writeTextDir "cross-file.conf" ''
     [binaries]
-    c = '${targetPrefix}cc'
-    cpp = '${targetPrefix}c++'
-    ar = '${targetPrefix}ar'
-    strip = '${targetPrefix}strip'
+    c = '${stdenv.cc.targetPrefix}cc'
+    cpp = '${stdenv.cc.targetPrefix}c++'
+    ar = '${stdenv.cc.bintools.targetPrefix}ar'
+    strip = '${stdenv.cc.bintools.targetPrefix}strip'
     pkgconfig = 'pkg-config'
 
     [properties]
@@ -69,7 +68,9 @@ in python3Packages.buildPythonApplication rec {
   # checkInputs = [ ninja pkgconfig ];
   # checkPhase = "python ./run_project_tests.py";
 
-  inherit (stdenv) cc isCross;
+  inherit (stdenv) cc;
+
+  isCross = stdenv.buildPlatform != stdenv.hostPlatform;
 
   meta = with lib; {
     homepage = http://mesonbuild.com;
diff --git a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
index 7e8a4159072..9b16d55d413 100644
--- a/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
+++ b/pkgs/development/tools/documentation/gnome-doc-utils/default.nix
@@ -13,7 +13,7 @@ python2Packages.buildPythonApplication {
   nativeBuildInputs = [ intltool pkgconfig ];
   buildInputs = [ libxslt ];
 
-  configureFlags = "--disable-scrollkeeper";
+  configureFlags = [ "--disable-scrollkeeper" ];
 
   preBuild = ''
     substituteInPlace xml2po/xml2po/Makefile --replace '-e "s+^#!.*python.*+#!$(PYTHON)+"' '-e "s\"^#!.*python.*\"#!$(PYTHON)\""'
diff --git a/pkgs/development/tools/misc/avrdude/default.nix b/pkgs/development/tools/misc/avrdude/default.nix
index 66b0467657a..4475e58207e 100644
--- a/pkgs/development/tools/misc/avrdude/default.nix
+++ b/pkgs/development/tools/misc/avrdude/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "15m1w1qad3dj7r8n5ng1qqcaiyx1gyd6hnc3p2apgjllccdp77qg";
   };
 
-  configureFlags = stdenv.lib.optionalString docSupport "--enable-doc";
+  configureFlags = stdenv.lib.optionals docSupport "--enable-doc";
 
   buildInputs = [ yacc flex libusb libelf libftdi1 readline ]
     ++ stdenv.lib.optionals docSupport [ texLive texinfo texi2html ];
diff --git a/pkgs/development/tools/misc/cscope/default.nix b/pkgs/development/tools/misc/cscope/default.nix
index b6d1b6d272e..67cd321cfd5 100644
--- a/pkgs/development/tools/misc/cscope/default.nix
+++ b/pkgs/development/tools/misc/cscope/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ngiv4aj3rr35k3q3wjx0y19gh7i1ydqa0cqip6sjwd8fph5ll65";
   };
 
-  configureFlags = "--with-ncurses=${ncurses.dev}";
+  configureFlags = [ "--with-ncurses=${ncurses.dev}" ];
 
   buildInputs = [ ncurses ];
   nativeBuildInputs = stdenv.lib.optional emacsSupport emacs;
diff --git a/pkgs/development/tools/misc/ddd/default.nix b/pkgs/development/tools/misc/ddd/default.nix
index 9375dfb20cd..7238bcdeb6b 100644
--- a/pkgs/development/tools/misc/ddd/default.nix
+++ b/pkgs/development/tools/misc/ddd/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
     sha256 = "0p5nx387857w3v2jbgvps2p6mlm0chajcdw5sfrddcglsxkwvmis";
   };
   buildInputs = [motif ncurses libX11 libXt];
-  configureFlags = "--with-x";
+  configureFlags = [ "--with-x" ];
 
   patches = [ ./gcc44.patch ];
 
diff --git a/pkgs/development/tools/misc/dialog/default.nix b/pkgs/development/tools/misc/dialog/default.nix
index 591254c73f5..a433c4a338c 100644
--- a/pkgs/development/tools/misc/dialog/default.nix
+++ b/pkgs/development/tools/misc/dialog/default.nix
@@ -1,12 +1,9 @@
 { stdenv, fetchurl, ncurses
 , withLibrary ? false, libtool
 , unicodeSupport ? true
+, enableShared ? !stdenv.isDarwin
 }:
 
-let optStr = stdenv.lib.optionalString;
-    buildShared = !stdenv.isDarwin;
-in
-
 assert withLibrary -> libtool != null;
 assert unicodeSupport -> ncurses.unicode && ncurses != null;
 
@@ -24,14 +21,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  configureFlags = ''
-    --disable-rpath-hacks
-    ${optStr withLibrary "--with-libtool"}
-    --with-libtool-opts=${optStr buildShared "-shared"}
-    --with-ncurses${optStr unicodeSupport "w"}
-  '';
+  configureFlags = [
+    "--disable-rpath-hacks"
+    (stdenv.lib.withFeature withLibrary "libtool")
+    "--with-ncurses${stdenv.lib.optionalString unicodeSupport "w"}"
+    "--with-libtool-opts=${stdenv.lib.optionalString enableShared "-shared"}"
+  ];
 
-  installTargets = "install${optStr withLibrary "-full"}";
+  installTargets = "install${stdenv.lib.optionalString withLibrary "-full"}";
 
   meta = {
     homepage = http://invisible-island.net/dialog/dialog.html;
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index af140bfb1d6..e067c0a669b 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   #
   # I wrote this testing for the nanonote.
 
-  buildPhase = if stdenv.hostPlatform == stdenv.buildPlatform then null else ''
+  buildPhase = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     pushd libebl
     make
     popd
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     popd
   '';
 
-  installPhase = if stdenv.hostPlatform == stdenv.buildPlatform then null else ''
+  installPhase = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     pushd libelf
     make install
     popd
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index b5840d07466..ae59f85a211 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -18,7 +18,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "8.1";
+  version = "8.1.1";
 in
 
 assert targetPlatform.isHurd -> mig != null && hurd != null;
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "0d2bpqk58fqlx21rbnk8mbcjlggzc9kb5sjirrfrrrjq70ka0qdg";
+    sha256 = "0g6hv9xk12aa58w77fydaldqr9a6b0a6bnwsq87jfc6lkcbc7p4p";
   };
 
   patches = [ ./debug-info-from-env.patch ]
diff --git a/pkgs/development/tools/misc/gnum4/default.nix b/pkgs/development/tools/misc/gnum4/default.nix
index 9cd6e2c5e1a..7e92df1a997 100644
--- a/pkgs/development/tools/misc/gnum4/default.nix
+++ b/pkgs/development/tools/misc/gnum4/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
-  configureFlags = "--with-syscmd-shell=${stdenv.shell}";
+  configureFlags = [ "--with-syscmd-shell=${stdenv.shell}" ];
 
   # Upstream is aware of it; it may be in the next release.
   patches = [ ./s_isdir.patch ] ++ stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;
diff --git a/pkgs/development/tools/misc/srecord/default.nix b/pkgs/development/tools/misc/srecord/default.nix
index 94a452ce083..a76a180741e 100644
--- a/pkgs/development/tools/misc/srecord/default.nix
+++ b/pkgs/development/tools/misc/srecord/default.nix
@@ -10,8 +10,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ boost libtool groff ghostscript libgcrypt ];
 
-  configureFlags = stdenv.lib.optionalString
-    (libgcrypt == null) "--without-gcrypt";
+  configureFlags = [
+    (stdenv.lib.optional (libgcrypt == null) "--without-gcrypt")
+  ];
 
   meta = with stdenv.lib; {
     description = "Collection of powerful tools for manipulating EPROM load files";
diff --git a/pkgs/development/tools/misc/swig/2.x.nix b/pkgs/development/tools/misc/swig/2.x.nix
index 6dbaca26c81..acf1988c947 100644
--- a/pkgs/development/tools/misc/swig/2.x.nix
+++ b/pkgs/development/tools/misc/swig/2.x.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake libtool bison ];
   buildInputs = [ pcre ];
 
-  configureFlags = "--without-tcl";
+  configureFlags = [ "--without-tcl" ];
 
   postPatch = ''
     # Disable ccache documentation as it need yodl
diff --git a/pkgs/development/tools/misc/swig/3.x.nix b/pkgs/development/tools/misc/swig/3.x.nix
index 48a2e7bd2cb..077d037aa97 100644
--- a/pkgs/development/tools/misc/swig/3.x.nix
+++ b/pkgs/development/tools/misc/swig/3.x.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoconf automake libtool bison ];
   buildInputs = [ pcre ];
 
-  configureFlags = "--without-tcl";
+  configureFlags = [ "--without-tcl" ];
 
   postPatch = ''
     # Disable ccache documentation as it need yodl
diff --git a/pkgs/development/tools/misc/swig/default.nix b/pkgs/development/tools/misc/swig/default.nix
index e10fd25d046..cfd1c7728cb 100644
--- a/pkgs/development/tools/misc/swig/default.nix
+++ b/pkgs/development/tools/misc/swig/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   # 'make check' uses boost and tcl
   buildInputs = stdenv.lib.optionals doCheck [ boost tcl ];
 
-  configureFlags = "--disable-ccache";
+  configureFlags = [ "--disable-ccache" ];
 
   meta = {
     description = "Interface compiler that connects C/C++ code to higher-level languages";
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 17323a06cc1..1bff2076b9a 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -30,10 +30,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison ];
   propagatedBuildInputs = [ m4 ];
 
-  preConfigure = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    export ac_cv_func_malloc_0_nonnull=yes
-    export ac_cv_func_realloc_0_nonnull=yes
-  '';
+  preConfigure = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
 
   postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
     sed -i Makefile -e 's/-no-undefined//;'
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index 36ea8a7a3d5..a90e50fac62 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "0a03a2l3ji6h48n106d4w55l8v6lni1axniafnvvv5c5n3nz5bgd";
   };
 
-  configureFlags = "--disable-tools";
+  configureFlags = [ "--disable-tools" ];
 
   patches =
     [ # Arch Linux patch set.
diff --git a/pkgs/games/gltron/default.nix b/pkgs/games/gltron/default.nix
index 6ede118526d..610fba5057d 100644
--- a/pkgs/games/gltron/default.nix
+++ b/pkgs/games/gltron/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   '';
 
   # The build fails, unless we disable the default -Wall -Werror
-  configureFlags = "--disable-warn";
+  configureFlags = [ "--disable-warn" ];
 
   buildInputs = [ SDL libGLU_combined zlib libpng libvorbis libmikmod SDL_sound ];
 
diff --git a/pkgs/games/typespeed/default.nix b/pkgs/games/typespeed/default.nix
index 45067d96397..6f0afc359ab 100644
--- a/pkgs/games/typespeed/default.nix
+++ b/pkgs/games/typespeed/default.nix
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
 
   patches = [ ./typespeed-config-in-home.patch ];
 
-  configureFlags = "--datadir=\${out}/share/";
-  makeFlags = ["CC=cc"];
+  configureFlags = [ "--datadir=\${out}/share/" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
   meta = with stdenv.lib; {
     description = "A curses based typing game";
diff --git a/pkgs/misc/drivers/xwiimote/default.nix b/pkgs/misc/drivers/xwiimote/default.nix
index 5d54d647f2b..a21584afa4c 100644
--- a/pkgs/misc/drivers/xwiimote/default.nix
+++ b/pkgs/misc/drivers/xwiimote/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ udev ncurses bluez ];
 
-  configureFlags = "--with-doxygen=no";
+  configureFlags = [ "--with-doxygen=no" ];
 
   meta = {
     homepage = http://dvdhrm.github.io/xwiimote;
diff --git a/pkgs/misc/emulators/atari800/default.nix b/pkgs/misc/emulators/atari800/default.nix
index 9467345db1c..9e662c42304 100644
--- a/pkgs/misc/emulators/atari800/default.nix
+++ b/pkgs/misc/emulators/atari800/default.nix
@@ -13,7 +13,15 @@ stdenv.mkDerivation rec{
 
   buildInputs = [ unzip zlib SDL readline libGLU_combined libX11 ];
 
-  configureFlags = "--target=default --with-video=sdl --with-sound=sdl --with-readline --with-opengl --with-x --enable-riodevice";
+  configureFlags = [
+    "--target=default"
+    "--with-video=sdl"
+    "--with-sound=sdl"
+    "--with-readline"
+    "--with-opengl"
+    "--with-x"
+    "--enable-riodevice"
+  ];
 
   preConfigure = "cd src";
 
diff --git a/pkgs/misc/emulators/vice/default.nix b/pkgs/misc/emulators/vice/default.nix
index ae8fbe9e1f5..7cf4faf55cd 100644
--- a/pkgs/misc/emulators/vice/default.nix
+++ b/pkgs/misc/emulators/vice/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison flex perl libpng giflib libjpeg alsaLib readline libGLU_combined
     pkgconfig gtk2 SDL autoreconfHook libXaw ];
   dontDisableStatic = true;
-  configureFlags = "--enable-fullscreen --enable-gnomeui";
+  configureFlags = [ "--enable-fullscreen --enable-gnomeui" ];
 
   desktopItem = makeDesktopItem {
     name = "vice";
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index 0ff6f3f041e..d56a485c152 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -3,7 +3,7 @@
   # flex 2.6.3 causes: undefined reference to `yywrap'
   pkgconfig, fontforge, makeWrapper, flex_2_6_1, bison,
   supportFlags,
-  buildScript ? null, configureFlags ? ""
+  buildScript ? null, configureFlags ? []
 }:
 
 with import ./util.nix { inherit lib; };
diff --git a/pkgs/misc/jackaudio/jack1.nix b/pkgs/misc/jackaudio/jack1.nix
index 848215ae17a..c11be4ad0c0 100644
--- a/pkgs/misc/jackaudio/jack1.nix
+++ b/pkgs/misc/jackaudio/jack1.nix
@@ -22,9 +22,9 @@ stdenv.mkDerivation rec {
     sha256 = "0i6l25dmfk2ji2lrakqq9icnwjxklgcjzzk65dmsff91z2zva5rm";
   };
   
-  configureFlags = ''
-    ${if (optLibffado != null) then "--enable-firewire" else ""}
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature (optLibffado != null) "firewire")
+  ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ optAlsaLib optDb optLibffado optCelt ];
diff --git a/pkgs/misc/screensavers/vlock/default.nix b/pkgs/misc/screensavers/vlock/default.nix
index 0e5e87245f3..ae89bbd53cc 100644
--- a/pkgs/misc/screensavers/vlock/default.nix
+++ b/pkgs/misc/screensavers/vlock/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   patches = [ ./eintr.patch ];
 
-  configureFlags = "VLOCK_GROUP=root ROOT_GROUP=root";
+  configureFlags = [ "VLOCK_GROUP=root" "ROOT_GROUP=root" ];
 
   buildInputs = [ pam ];
 
diff --git a/pkgs/os-specific/linux/alsa-firmware/default.nix b/pkgs/os-specific/linux/alsa-firmware/default.nix
index fb312b6bcb0..53fcf7d6843 100644
--- a/pkgs/os-specific/linux/alsa-firmware/default.nix
+++ b/pkgs/os-specific/linux/alsa-firmware/default.nix
@@ -8,9 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "0gfcyj5anckjn030wcxx5v2xk2s219nyf99s9m833275b5wz2piw";
   };
 
-  configureFlags = ''
-    --with-hotplug-dir=$(out)/lib/firmware
-  '';
+  configureFlags = [
+    "--with-hotplug-dir=$(out)/lib/firmware"
+  ];
 
   dontStrip = true;
 
diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix
index a13e178e418..431353e234e 100644
--- a/pkgs/os-specific/linux/alsa-oss/default.nix
+++ b/pkgs/os-specific/linux/alsa-oss/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ alsaLib ncurses libsamplerate ];
   nativeBuildInputs = [ gettext ];
 
-  configureFlags = "--disable-xmlto";
+  configureFlags = [ "--disable-xmlto" ];
 
   installFlags = "ASOUND_STATE_DIR=$(TMPDIR)/dummy";
 
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index 376c42a8f9b..86d9aeebf1b 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gettext ];
   buildInputs = [ alsaLib ncurses libsamplerate fftw ];
 
-  configureFlags = "--disable-xmlto --with-udev-rules-dir=$(out)/lib/udev/rules.d";
+  configureFlags = [ "--disable-xmlto" "--with-udev-rules-dir=$(out)/lib/udev/rules.d" ];
 
   installFlags = "ASOUND_STATE_DIR=$(TMPDIR)/dummy";
 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index cbbe4d5ca46..08428f95b06 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -2,9 +2,9 @@
 , pkgconfig, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, python
 , gawk
-, perl
+, withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && perl.meta.available or false, perl
+, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && python.meta.available or false, python
 , swig
 , ncurses
 , pam
@@ -76,10 +76,9 @@ let
       perl
     ];
 
-    buildInputs = stdenv.lib.optionals (!stdenv.isCross) [
-      perl
-      python
-    ];
+    buildInputs = []
+      ++ stdenv.lib.optional withPerl perl
+      ++ stdenv.lib.optional withPython python;
 
     # required to build apparmor-parser
     dontDisableStatic = true;
@@ -92,11 +91,14 @@ let
 
     postPatch = "cd ./libraries/libapparmor";
     # https://gitlab.com/apparmor/apparmor/issues/1
-    configureFlags = stdenv.lib.optionalString (!stdenv.isCross) "--with-python --with-perl";
+    configureFlags = [
+      (stdenv.lib.withFeature withPerl "perl")
+      (stdenv.lib.withFeature withPython "python")
+    ];
 
-    outputs = if stdenv.isCross then [ "out" ] else [ "out" "python" ];
+    outputs = [ "out" ] ++ stdenv.lib.optional withPython "python";
 
-    postInstall = stdenv.lib.optionalString (!stdenv.isCross) ''
+    postInstall = stdenv.lib.optionalString withPython ''
       mkdir -p $python/lib
       mv $out/lib/python* $python/lib/
     '';
@@ -137,7 +139,9 @@ let
 
     inherit doCheck;
 
-    meta = apparmor-meta "user-land utilities";
+    meta = apparmor-meta "user-land utilities" // {
+      broken = !(withPython && withPerl);
+    };
   };
 
   apparmor-bin-utils = stdenv.mkDerivation {
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index 8d18d598020..c6792ea17fb 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -12,7 +12,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flex perl ];
 
-  configureFlags = "--without-distro --without-pacemaker --localstatedir=/var --sysconfdir=/etc";
+  configureFlags = [
+    "--without-distro"
+    "--without-pacemaker"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+  ];
 
   preConfigure =
     ''
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index fae928dca4c..5943ced2f8f 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = "patchShebangs ./configure";
 
-  configureFlags = "--datadir=$(prefix)/data";
+  configureFlags = [ "--datadir=$(prefix)/data" ];
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 4204105bb60..d8197edc46c 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,4 +1,6 @@
-{ fetchurl, stdenv, config, flex, bash, bison, db, iptables, pkgconfig }:
+{ fetchurl, stdenv, config, flex, bash, bison, db, iptables, pkgconfig
+, libelf
+}:
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
@@ -35,7 +37,7 @@ stdenv.mkDerivation rec {
     "CONFDIR=$(out)/etc/iproute2"
   ];
 
-  buildInputs = [ db iptables ];
+  buildInputs = [ db iptables libelf ];
   nativeBuildInputs = [ bison flex pkgconfig ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
index e27f380ac3e..dd7d25716dc 100644
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ b/pkgs/os-specific/linux/ipsec-tools/default.nix
@@ -28,19 +28,19 @@ stdenv.mkDerivation rec {
   # fix build with newer gcc versions
   preConfigure = ''substituteInPlace configure --replace "-Werror" "" '';
 
-  configureFlags = ''
-    --sysconfdir=/etc --localstatedir=/var
-    --with-kernel-headers=${linuxHeaders}/include
-    --disable-security-context
-    --enable-adminport
-    --enable-dpd
-    --enable-frag
-    --enable-gssapi
-    --enable-hybrid
-    --enable-natt
-    --enable-shared
-    --enable-stats
-  '';
+  configureFlags = [
+    "--sysconfdir=/etc --localstatedir=/var"
+    "--with-kernel-headers=${linuxHeaders}/include"
+    "--disable-security-context"
+    "--enable-adminport"
+    "--enable-dpd"
+    "--enable-frag"
+    "--enable-gssapi"
+    "--enable-hybrid"
+    "--enable-natt"
+    "--enable-shared"
+    "--enable-stats"
+  ];
 
   meta = {
     homepage = http://ipsec-tools.sourceforge.net/;
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 0c088ac2a4b..9fa7a2cf0aa 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
     export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
   '';
 
-  configureFlags = ''
-    --enable-devel
-    --enable-shared
-  '';
+  configureFlags = [
+    "--enable-devel"
+    "--enable-shared"
+  ];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 4caa0acb4b6..3430797666e 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optional (!stdenv.hostPlatform.isMusl) libidn;
 
   # ninfod probably could build on cross, but the Makefile doesn't pass --host etc to the sub configure...
-  buildFlags = "man all" + stdenv.lib.optionalString (!stdenv.isCross) " ninfod";
+  buildFlags = "man all" + stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) " ninfod";
 
   installPhase =
     ''
diff --git a/pkgs/os-specific/linux/pm-utils/default.nix b/pkgs/os-specific/linux/pm-utils/default.nix
index a5577b97b87..b314e8db837 100644
--- a/pkgs/os-specific/linux/pm-utils/default.nix
+++ b/pkgs/os-specific/linux/pm-utils/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "02qc6zaf7ams6qcc470fwb6jvr4abv3lrlx16clqpn36501rkn4f";
   };
 
-  configureFlags = "--sysconfdir=/etc";
+  configureFlags = [ "--sysconfdir=/etc" ];
 
   preConfigure =
     ''
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 1a7a31d978a..ea34075210d 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -18,13 +18,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ intltool utillinux ];
 
-  configureFlags = ""
-  + " --with-media-dir=${mediaDir}"
-  + " --with-lock-dir=${lockDir}"
-  + " --with-whitelist=${whiteList}"
-  + " --with-mount-prog=${utillinux}/bin/mount"
-  + " --with-umount-prog=${utillinux}/bin/umount"
-  + " --with-mount-ntfs3g=${ntfs3g}/sbin/mount.ntfs-3g";
+  configureFlags = [
+    "--with-media-dir=${mediaDir}"
+    "--with-lock-dir=${lockDir}"
+    "--with-whitelist=${whiteList}"
+    "--with-mount-prog=${utillinux}/bin/mount"
+    "--with-umount-prog=${utillinux}/bin/umount"
+    "--with-mount-ntfs3g=${ntfs3g}/sbin/mount.ntfs-3g"
+  ];
 
   postConfigure = ''
     # etc/Mafile.am is hardcoded and it does not respect the --prefix option.
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 3a76450a830..25ba60b58ee 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -20,13 +20,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "shadow-${version}";
-  version = "4.5";
+  version = "4.6";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = "shadow";
     rev = "${version}";
-    sha256 = "1aj7s2arnsfqf34ak40is2zmwm666l28pay6rv1ffx46j0wj4hws";
+    sha256 = "1llcv77lvpc4h3rgww9ms736kbdisiylcr2z02863f41afxbwl82";
   };
 
   buildInputs = stdenv.lib.optional (pam != null && stdenv.isLinux) pam;
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index abb6efa29bf..015aabbacfe 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -19,7 +19,7 @@ let
   pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
 
 in stdenv.mkDerivation rec {
-  version = "238";
+  version = "239";
   name = "systemd-${version}";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
@@ -27,8 +27,8 @@ in stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "02042d012c4d6c0a2854d8436dd6636d4327774f";
-    sha256 = "0iv6fygzac0z6dagbmw1nf8dx7rrr6d9cxp0fr304rn3ir58g5f0";
+    rev = "67c553805a9ebee2dce7c3a350b4abd4d7a489c2";
+    sha256 = "114vq71gcddi4qm2hyrj5jsas9599s0h5mg65jfpvxhfyaw54cpv";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -145,16 +145,6 @@ in stdenv.mkDerivation rec {
       --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  patches = [
-    # https://github.com/systemd/systemd/pull/8580
-    (fetchpatch {
-      url = https://github.com/systemd/systemd/pull/8580.patch;
-      sha256 = "1yp07hlpgqq0h2y0qc3kasswzkycz6p8d56d695ck1qa2f5bdfgn";
-    })
-  ];
-
-  hardeningDisable = [ "stackprotector" ];
-
   NIX_CFLAGS_COMPILE =
     [ # Can't say ${polkit.bin}/bin/pkttyagent here because that would
       # lead to a cyclic dependency.
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
index 199523db428..bdc6a63f069 100644
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ b/pkgs/os-specific/linux/udisks/1-default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  configureFlags = "--localstatedir=/var --enable-lvm2";
+  configureFlags = [ "--localstatedir=/var" "--enable-lvm2" ];
 
   meta = {
     homepage = http://www.freedesktop.org/wiki/Software/udisks;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index d2f75f5875e..55673ccf013 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -28,10 +28,6 @@ in stdenv.mkDerivation rec {
       --replace "/bin/umount" "$out/bin/umount"
   '';
 
-  preConfigure = lib.optionalString (systemd != null) ''
-    configureFlags+=" --with-systemd --with-systemdsystemunitdir=$bin/lib/systemd/system/"
-  '';
-
   # !!! It would be better to obtain the path to the mount helpers
   # (/sbin/mount.*) through an environment variable, but that's
   # somewhat risky because we have to consider that mount can setuid
@@ -43,8 +39,11 @@ in stdenv.mkDerivation rec {
     "--disable-use-tty-group"
     "--enable-fs-paths-default=/run/wrappers/bin:/var/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
-  ] ++ lib.optional (ncurses == null) "--without-ncurses"
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    (lib.withFeature (ncurses != null) "ncursesw")
+    (lib.withFeature (systemd != null) "systemd")
+    (lib.withFeatureAs (systemd != null)
+       "systemdsystemunitdir" "$bin/lib/systemd/system/")
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
        "scanf_cv_type_modifier=ms"
   ;
 
diff --git a/pkgs/os-specific/windows/cygwin-setup/default.nix b/pkgs/os-specific/windows/cygwin-setup/default.nix
index 71b47c5a50f..3738760bb29 100644
--- a/pkgs/os-specific/windows/cygwin-setup/default.nix
+++ b/pkgs/os-specific/windows/cygwin-setup/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     });
   in map mkStatic [ zlib bzip2 lzma libgcrypt ];
 
-  configureFlags = "--disable-shared";
+  configureFlags = [ "--disable-shared" ];
 
   dontDisableStatic = true;
 
diff --git a/pkgs/servers/dict/libmaa.nix b/pkgs/servers/dict/libmaa.nix
index d35a9a68303..3c04a678def 100644
--- a/pkgs/servers/dict/libmaa.nix
+++ b/pkgs/servers/dict/libmaa.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ libtool ];
-  # configureFlags = "--datadir=/var/run/current-system/share/dictd";
+  # configureFlags = [ "--datadir=/var/run/current-system/share/dictd" ];
 
   meta = with stdenv.lib; {
     description = "Dict protocol server and client";
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 4822b5109e8..d7f7660bf61 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -47,26 +47,32 @@ stdenv.mkDerivation rec {
     configureFlags="$configureFlags --includedir=$dev/include"
   '';
 
-  configureFlags = ''
-    --with-apr=${apr.dev}
-    --with-apr-util=${aprutil.dev}
-    --with-z=${zlib.dev}
-    --with-pcre=${pcre.dev}
-    --disable-maintainer-mode
-    --disable-debugger-mode
-    --enable-mods-shared=all
-    --enable-mpms-shared=all
-    --enable-cern-meta
-    --enable-imagemap
-    --enable-cgi
-    ${optionalString brotliSupport "--enable-brotli --with-brotli=${brotli}"}
-    ${optionalString proxySupport "--enable-proxy"}
-    ${optionalString sslSupport "--enable-ssl"}
-    ${optionalString http2Support "--enable-http2 --with-nghttp2"}
-    ${optionalString luaSupport "--enable-lua --with-lua=${lua5}"}
-    ${optionalString libxml2Support "--with-libxml2=${libxml2.dev}/include/libxml2"}
-    --docdir=$(doc)/share/doc
-  '';
+  configureFlags = [
+    "--with-apr=${apr.dev}"
+    "--with-apr-util=${aprutil.dev}"
+    "--with-z=${zlib.dev}"
+    "--with-pcre=${pcre.dev}"
+    "--disable-maintainer-mode"
+    "--disable-debugger-mode"
+    "--enable-mods-shared=all"
+    "--enable-mpms-shared=all"
+    "--enable-cern-meta"
+    "--enable-imagemap"
+    "--enable-cgi"
+    (stdenv.lib.enableFeature proxySupport "proxy")
+    (stdenv.lib.enableFeature sslSupport "ssl")
+    (stdenv.lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
+    "--docdir=$(doc)/share/doc"
+
+    (stdenv.lib.enableFeature brotliSupport "brotli")
+    (stdenv.lib.withFeatureAs brotliSupport "brotli" brotli)
+
+    (stdenv.lib.enableFeature http2Support "http2")
+    (stdenv.lib.withFeature http2Support "nghttp2")
+
+    (stdenv.lib.enableFeature luaSupport "lua")
+    (stdenv.lib.withFeatureAs luaSupport "lua" lua5)
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
index 58ae8f85b81..e569ae8f870 100644
--- a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
+++ b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
@@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "11khipjpy3y84j1pp7yyx76y64jccvyhh3klwzqxylff49vjc2fc";
   };
 
-  configureFlags = "--with-apxs=${apacheHttpd.dev}/bin/apxs --with-java-home=${jdk}";
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+    "--with-java-home=${jdk}"
+  ];
 
   setSourceRoot = ''
     sourceRoot=$(echo */native)
diff --git a/pkgs/servers/http/couchdb/default.nix b/pkgs/servers/http/couchdb/default.nix
index 5a873c7e84b..5239c027b8f 100644
--- a/pkgs/servers/http/couchdb/default.nix
+++ b/pkgs/servers/http/couchdb/default.nix
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
 
   If you wish to ignore this error pass --enable-js-trunk to ./configure.
   */
-  configureFlags = ''
-    --enable-js-trunk
-  '';
+  configureFlags = [
+    "--enable-js-trunk"
+  ];
 
   meta = with stdenv.lib; {
     description = "A database that uses JSON for documents, JavaScript for MapReduce queries, and regular HTTP for an API";
diff --git a/pkgs/servers/http/pshs/default.nix b/pkgs/servers/http/pshs/default.nix
index 2205c91789f..c38ca046a35 100644
--- a/pkgs/servers/http/pshs/default.nix
+++ b/pkgs/servers/http/pshs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libevent file qrencode miniupnpc ];
 
   # SSL requires libevent at 2.1 with ssl support
-  configureFlags = "--disable-ssl";
+  configureFlags = [ "--disable-ssl" ];
 
   meta = {
     description = "Pretty small HTTP server - a command-line tool to share files";
diff --git a/pkgs/servers/http/yaws/default.nix b/pkgs/servers/http/yaws/default.nix
index 5f92fbf2c03..827f6122b57 100644
--- a/pkgs/servers/http/yaws/default.nix
+++ b/pkgs/servers/http/yaws/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cd $name
   '';
 
-  configureFlags = "--with-extrainclude=${pam}/include/security";
+  configureFlags = [ "--with-extrainclude=${pam}/include/security" ];
 
   buildInputs = [ erlang pam perl ];
 
diff --git a/pkgs/servers/irc/ircd-hybrid/default.nix b/pkgs/servers/irc/ircd-hybrid/default.nix
index c73c69e6ee5..cf5b572c9eb 100644
--- a/pkgs/servers/irc/ircd-hybrid/default.nix
+++ b/pkgs/servers/irc/ircd-hybrid/default.nix
@@ -10,8 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl zlib ];
 
-  configureFlags =
-    "--with-nicklen=100 --with-topiclen=360 --enable-openssl=${openssl.dev}";
+  configureFlags = [
+    "--with-nicklen=100"
+    "--with-topiclen=360"
+    "--enable-openssl=${openssl.dev}"
+  ];
 
   postInstall = "echo postinstall; mkdir -p \${out}/ ; rm -rf \${out}/logs ; ln -s /home/ircd \${out}/logs;";
 
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 93990360c1a..a38c0b277da 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -13,9 +13,13 @@ stdenv.mkDerivation rec {
 
   patches = [ ./fix-var-prefix.patch ];
 
-  configureFlags = "--without-permcheck --with-cgi-ext=.cgi --with-var-prefix=/var/lib/mailman";
+  configureFlags = [
+    "--without-permcheck"
+    "--with-cgi-ext=.cgi"
+    "--with-var-prefix=/var/lib/mailman"
+  ];
 
-  installTargets = "doinstall";         # Leave out the 'update' target that's implied by 'install'.
+  installTargets = "doinstall"; # Leave out the 'update' target that's implied by 'install'.
 
   makeFlags = [ "DIRSETGID=:" ];
 
diff --git a/pkgs/servers/mail/petidomo/default.nix b/pkgs/servers/mail/petidomo/default.nix
index 8ccd783b6ad..c97d8e4ccf3 100644
--- a/pkgs/servers/mail/petidomo/default.nix
+++ b/pkgs/servers/mail/petidomo/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ flex bison ];
 
-  configureFlags = "--with-mta=${sendmailPath}";
+  configureFlags = [ "--with-mta=${sendmailPath}" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/monitoring/zabbix/2.0.nix b/pkgs/servers/monitoring/zabbix/2.0.nix
index 9f1a2baeb9a..ce660fa6e88 100644
--- a/pkgs/servers/monitoring/zabbix/2.0.nix
+++ b/pkgs/servers/monitoring/zabbix/2.0.nix
@@ -77,7 +77,7 @@ in
 
     inherit src preConfigure;
 
-    configureFlags = "--enable-agent";
+    configureFlags = [ "--enable-agent" ];
 
     meta = with stdenv.lib; {
       inherit branch;
diff --git a/pkgs/servers/monitoring/zabbix/2.2.nix b/pkgs/servers/monitoring/zabbix/2.2.nix
index bf3849e6524..ac0e6bb81f8 100644
--- a/pkgs/servers/monitoring/zabbix/2.2.nix
+++ b/pkgs/servers/monitoring/zabbix/2.2.nix
@@ -89,7 +89,7 @@ in
 
     inherit src preConfigure;
 
-    configureFlags = "--enable-agent";
+    configureFlags = [ "--enable-agent" ];
 
     meta = with stdenv.lib; {
       inherit branch;
diff --git a/pkgs/servers/monitoring/zabbix/default.nix b/pkgs/servers/monitoring/zabbix/default.nix
index be52698ed83..4b6bd5e0b25 100644
--- a/pkgs/servers/monitoring/zabbix/default.nix
+++ b/pkgs/servers/monitoring/zabbix/default.nix
@@ -27,7 +27,12 @@ in
 
     inherit src preConfigure;
 
-    configureFlags = "--enable-agent --enable-server --with-pgsql --with-libcurl";
+    configureFlags = [
+      "--enable-agent"
+      "--enable-server"
+      "--with-pgsql"
+      "--with-libcurl"
+    ];
 
   nativeBuildInputs = [ pkgconfig ];
     buildInputs = [ postgresql curl openssl zlib ];
@@ -56,7 +61,7 @@ in
 
     inherit src preConfigure;
 
-    configureFlags = "--enable-agent";
+    configureFlags = [ "--enable-agent" ];
 
     meta = with stdenv.lib; {
       description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
diff --git a/pkgs/servers/news/leafnode/default.nix b/pkgs/servers/news/leafnode/default.nix
index 6d2bb9b9e94..955547289bc 100644
--- a/pkgs/servers/news/leafnode/default.nix
+++ b/pkgs/servers/news/leafnode/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "096w4gxj08m3vwmyv4sxpmbl8dn6mzqfmrhc32jgyca6qzlrdin8";
   };
 
-  configureFlags = "--enable-runas-user=nobody";
+  configureFlags = [ "--enable-runas-user=nobody" ];
 
   prePatch = ''
     substituteInPlace Makefile.in --replace 02770 0770
diff --git a/pkgs/servers/shairport-sync/default.nix b/pkgs/servers/shairport-sync/default.nix
index e880e490a6a..d6ea05c9e6d 100644
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@@ -27,11 +27,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = ''
-    --with-alsa --with-pipe --with-pulseaudio --with-stdout
-    --with-avahi --with-ssl=openssl --with-soxr
-    --without-configfiles --without-initscript
-  '';
+  configureFlags = [
+    "--with-alsa" "--with-pipe" "--with-pulseaudio" "--with-stdout"
+    "--with-avahi" "--with-ssl=openssl" "--with-soxr"
+    "--without-configfiles" "--without-initscript"
+  ];
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/servers/sql/postgresql/psqlodbc/default.nix b/pkgs/servers/sql/postgresql/psqlodbc/default.nix
index 684817d309b..2364e0913bc 100644
--- a/pkgs/servers/sql/postgresql/psqlodbc/default.nix
+++ b/pkgs/servers/sql/postgresql/psqlodbc/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libiodbc postgresql openssl ];
 
-  configureFlags = "--with-iodbc=${libiodbc}";
+  configureFlags = [ "--with-iodbc=${libiodbc}" ];
 
   meta = with stdenv.lib; {
     homepage = http://psqlodbc.projects.postgresql.org/;
diff --git a/pkgs/servers/sql/virtuoso/6.x.nix b/pkgs/servers/sql/virtuoso/6.x.nix
index b0b8f926d9e..eda1f060df2 100644
--- a/pkgs/servers/sql/virtuoso/6.x.nix
+++ b/pkgs/servers/sql/virtuoso/6.x.nix
@@ -14,11 +14,11 @@ stdenv.mkDerivation rec {
 
   CPP = "${stdenv.cc}/bin/gcc -E";
 
-  configureFlags = "
-    --enable-shared --disable-all-vads --with-readline=${readline.dev}
-    --disable-hslookup --disable-wbxml2 --without-iodbc
-    --enable-openssl=${openssl.dev}
-    ";
+  configureFlags = [
+    "--enable-shared" "--disable-all-vads" "--with-readline=${readline.dev}"
+    "--disable-hslookup" "--disable-wbxml2" "--without-iodbc"
+    "--enable-openssl=${openssl.dev}"
+  ];
 
   postInstall = ''
     echo Moving documentation
diff --git a/pkgs/servers/sql/virtuoso/7.x.nix b/pkgs/servers/sql/virtuoso/7.x.nix
index bf2a51f6596..536e96354d9 100644
--- a/pkgs/servers/sql/virtuoso/7.x.nix
+++ b/pkgs/servers/sql/virtuoso/7.x.nix
@@ -12,11 +12,11 @@ stdenv.mkDerivation rec {
 
   CPP = "${stdenv.cc}/bin/gcc -E";
 
-  configureFlags = "
-    --enable-shared --disable-all-vads --with-readline=${readline.dev}
-    --disable-hslookup --disable-wbxml2 --without-iodbc
-    --enable-openssl=${openssl.dev}
-    ";
+  configureFlags = [
+    "--enable-shared" "--disable-all-vads" "--with-readline=${readline.dev}"
+    "--disable-hslookup" "--disable-wbxml2" "--without-iodbc"
+    "--enable-openssl=${openssl.dev}"
+  ];
 
   postInstall=''
     echo Moving documentation
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index cc28dc73ca8..6f94929ffd6 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -171,7 +171,7 @@ let
       sha256 = "0m60f5bd0caambrk8ksknb5dks7wzsg7g7xaf0j21jxmx8rq9h5j";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -183,7 +183,7 @@ let
       sha256 = "02advcv9lyxpvrjv8bjh1b797lzg6jvhipclz49z8r8y98g4l0n6";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -195,7 +195,7 @@ let
       sha256 = "19dd9znam1ah72jmdh7i6ny2ss2r6m21z9v0l43xvikw48zmwvyi";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -207,7 +207,7 @@ let
       sha256 = "152wigpph5wvl4k9m3l4mchxxisgsnzlx033mn5iqrpkc6f72cl7";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -219,7 +219,7 @@ let
       sha256 = "0xw0pdnzj5jljsbbhakc6q9ha2qnca1jr81zk7w70yl9bw83b54p";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -243,7 +243,7 @@ let
       sha256 = "1x246dfnxnmflzf0qzy62k8jdpkb6jkgspcjgbk8jcq9lw99npah";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -255,7 +255,7 @@ let
       sha256 = "10cl4gm38dw68jzln99ijix730y7cbx8np096gmpjjwff1i73h13";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -267,7 +267,7 @@ let
       sha256 = "073jmhf0sr2j1l8da97pzsqj805f7mf9r2gy92j4diljmi8sm1il";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -279,7 +279,7 @@ let
       sha256 = "1fqzckxdzjv4802iad2fdrkpaxl4w0hhs9lxlkyraq2kq9ik7a32";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -291,7 +291,7 @@ let
       sha256 = "0cfbxdp5m12cm7jsh3my0lym9328cgm7fa9faz2hqj05wbxnmhaa";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -303,7 +303,7 @@ let
       sha256 = "0pyjmc0ha288d4i4j0si4dh3ncf3jiwwjljvddrb0k8v4xiyljqv";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -315,7 +315,7 @@ let
       sha256 = "1hb3iav089albp4sdgnlh50k47cdjif9p4axm0kkjvs8jyi5a53n";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -327,7 +327,7 @@ let
       sha256 = "1kmn9jbck3vghz6rj3bhc3h0w6gh0qiaqm90cjkqsz1x9r2dgq7b";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -339,7 +339,7 @@ let
       sha256 = "13plbifkvfvdfym6gjbgy9wx2xbdxi9hfrl1k22xayy02135wgxs";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -351,7 +351,7 @@ let
       sha256 = "1256z0jhcf5gbh1d03593qdwnag708rxqa032izmfb5dmmlhbsn6";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -363,7 +363,7 @@ let
       sha256 = "0ai1v4n61k8j9x2a1knvfbl2xjxk3xxmqaq3p9vpqrspc69k31kf";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -375,7 +375,7 @@ let
       sha256 = "0dd6vfiagjc4zmvlskrbjz85jfqhf060cpys8j0y1qpcbsrkwdhp";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -387,7 +387,7 @@ let
       sha256 = "1s2bbhizzgbbbn5wqs3vw53n619cclxksljvm759h9p1prqdwrdw";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -399,7 +399,7 @@ let
       sha256 = "0yzza0l4zwyy7accr1s8ab7fjqkpwggqydbm2vc19scdby5xz7g1";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -411,7 +411,7 @@ let
       sha256 = "1pyjll4adch3z5cg663s6vhi02k8m6488f0mrasg81ssvg9jinzx";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -423,7 +423,7 @@ let
       sha256 = "0rx8q02rkx673a7skkpnvfkg28i8gmqzgf25s9yi0lar915sn92q";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -435,7 +435,7 @@ let
       sha256 = "0rdc3xdz12pnv951538q6wilx8mrdndpkphpbblszsv7nc8cw61b";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -447,7 +447,7 @@ let
       sha256 = "1dldxlh54zq1yzfnrh83j5vm0k4ijprrs5yl18gm3n9j1z0q2cws";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -459,7 +459,7 @@ let
       sha256 = "0q2ybxs8wvylvw95j6x9i800rismsmx4b587alwbfqiw6biy63z4";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -471,7 +471,7 @@ let
       sha256 = "19cq7iq0pfad0nc2v28n681fdq3fcw1l1hzaq0wpkgpx7bc1zjsk";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -483,7 +483,7 @@ let
       sha256 = "148793fqwzrc3bmh2vlw5fdiwjc2n7vs25cic35gfp452czk489p";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
@@ -495,7 +495,7 @@ let
       sha256 = "150pq6n8n984fah34n3k133kggn9v0c5k07igv29sxp1wi07krxq";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -507,7 +507,7 @@ let
       sha256 = "13qghgr1zzpv64m0p42195k1kc77pksiv059fdvijz1n6kdplpxx";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -519,7 +519,7 @@ let
       sha256 = "0nkym3n48b4v36y4s927bbkjnsmicajarnf6vlp7wxp0as304i74";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf fontutil mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf fontutil mkfontdir mkfontscale ;};
 
@@ -531,7 +531,7 @@ let
       sha256 = "0yayf1qlv7irf58nngddz2f1q04qkpr5jwp4aja2j5gyvzl32hl2";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -543,7 +543,7 @@ let
       sha256 = "1xfgcx4gsgik5mkgkca31fj3w72jw9iw76qyrajrsz1lp8ka6hr0";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -567,7 +567,7 @@ let
       sha256 = "1q6jcqrffg9q5f5raivzwx9ffvf7r11g6g0b125na1bhpz5ly7s8";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -591,7 +591,7 @@ let
       sha256 = "181n1bgq8vxfxqicmy1jpm1hnr6gwn1kdhl6hr4frjigs1ikpldb";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ bdftopcf mkfontdir ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit bdftopcf mkfontdir ;};
 
@@ -603,7 +603,7 @@ let
       sha256 = "0jp3zc0qfdaqfkgzrb44vi9vi0a8ygb35wp082yz7rvvxhmg9sya";
     };
     nativeBuildInputs = [ pkgconfig ];
-    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = "--with-fontrootdir=$(out)/lib/X11/fonts";
+    buildInputs = [ mkfontdir mkfontscale ]; configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
     meta.platforms = stdenv.lib.platforms.unix;
   }) // {inherit mkfontdir mkfontscale ;};
 
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index dfde730fbea..37daa0dc9bc 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -178,7 +178,7 @@ while (<>) {
     }
 
     if ($isFont) {
-        $extraAttrs{$pkg} = " configureFlags = \"--with-fontrootdir=\$(out)/lib/X11/fonts\"; ";
+        $extraAttrs{$pkg} = " configureFlags = [ \"--with-fontrootdir=\$(out)/lib/X11/fonts\" ]; ";
     }
 
     sub process {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index d989d17b032..b1a749c7ec4 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -77,7 +77,7 @@ in
 
   libxcb = attrs : attrs // {
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ args.python ];
-    configureFlags = "--enable-xkb --enable-xinput";
+    configureFlags = [ "--enable-xkb" "--enable-xinput" ];
     outputs = [ "out" "dev" "man" "doc" ];
   };
 
@@ -147,7 +147,7 @@ in
   # See https://bugs.freedesktop.org/show_bug.cgi?id=47792
   # Once the bug is fixed upstream, this can be removed.
   luit = attrs: attrs // {
-    configureFlags = "--disable-selective-werror";
+    configureFlags = [ "--disable-selective-werror" ];
   };
 
   compositeproto = attrs: attrs // {
@@ -408,7 +408,7 @@ in
   };
 
   xkbcomp = attrs: attrs // {
-    configureFlags = "--with-xkb-config-root=${xorg.xkeyboardconfig}/share/X11/xkb";
+    configureFlags = [ "--with-xkb-config-root=${xorg.xkeyboardconfig}/share/X11/xkb" ];
   };
 
   xkeyboardconfig = attrs: attrs // {
@@ -601,7 +601,7 @@ in
 
   xcursorthemes = attrs: attrs // {
     buildInputs = attrs.buildInputs ++ [xorg.xcursorgen];
-    configureFlags = "--with-cursordir=$(out)/share/icons";
+    configureFlags = [ "--with-cursordir=$(out)/share/icons" ];
   };
 
   xinit = attrs: attrs // {
@@ -631,7 +631,7 @@ in
     };
     buildInputs = attrs.buildInputs ++ [xorg.libXfixes xorg.libXScrnSaver xorg.pixman];
     nativeBuildInputs = attrs.nativeBuildInputs ++ [args.autoreconfHook xorg.utilmacros];
-    configureFlags = "--with-default-dri=3 --enable-tools";
+    configureFlags = [ "--with-default-dri=3" "--enable-tools" ];
 
     meta = attrs.meta // {
       platforms = ["i686-linux" "x86_64-linux"];
@@ -676,7 +676,7 @@ in
   };
 
   xrdb = attrs: attrs // {
-    configureFlags = "--with-cpp=${args.mcpp}/bin/mcpp";
+    configureFlags = [ "--with-cpp=${args.mcpp}/bin/mcpp" ];
   };
 
   sessreg = attrs: attrs // {
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 66570cba946..7d527729273 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -34,9 +34,9 @@ rec {
   makeStaticBinaries = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
         NIX_CFLAGS_LINK = "-static";
-        configureFlags =
-          toString args.configureFlags or ""
-          + " --disable-shared"; # brrr...
+        configureFlags = (args.configureFlags or []) ++ [
+            "--disable-shared" # brrr...
+          ];
       });
       isStatic = true;
     };
@@ -47,9 +47,10 @@ rec {
   makeStaticLibraries = stdenv: stdenv //
     { mkDerivation = args: stdenv.mkDerivation (args // {
         dontDisableStatic = true;
-        configureFlags =
-          toString args.configureFlags or ""
-          + " --enable-static --disable-shared";
+        configureFlags = (args.configureFlags or []) ++ [
+          "--enable-static"
+          "--disable-shared"
+        ];
       });
     };
 
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 2eac9e58daa..b3934c88ed2 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -141,8 +141,6 @@ let
       inherit overrides;
 
       inherit cc;
-
-      isCross = targetPlatform != buildPlatform;
     }
 
     # Propagate any extra attributes.  For instance, we use this to
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 48ee68f4c00..560aa72eb39 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -78,6 +78,15 @@ rec {
     , ... } @ attrs:
 
     let
+      # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when
+      # no package has `doCheck = true`.
+      doCheck' = doCheck && stdenv.hostPlatform == stdenv.buildPlatform;
+      doInstallCheck' = doInstallCheck && stdenv.hostPlatform == stdenv.buildPlatform;
+
+      outputs' =
+        outputs ++
+        (if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
+
       fixedOutputDrv = attrs ? outputHash;
       noNonNativeDeps = builtins.length (depsBuildTarget ++ depsBuildTargetPropagated
                                       ++ depsHostHost ++ depsHostHostPropagated
@@ -97,6 +106,11 @@ rec {
       inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
     })
     else let
+      doCheck = doCheck';
+      doInstallCheck = doInstallCheck';
+
+      outputs = outputs';
+
       references = nativeBuildInputs ++ buildInputs
                 ++ propagatedNativeBuildInputs ++ propagatedBuildInputs;
 
@@ -111,7 +125,7 @@ rec {
         [
           (map (drv: drv.__spliced.hostHost or drv) depsHostHost)
           (map (drv: drv.crossDrv or drv) (buildInputs
-             ++ lib.optionals doCheck' checkInputs
+             ++ lib.optionals doCheck checkInputs
              ++ lib.optionals doInstallCheck' installCheckInputs))
         ]
         [
@@ -133,15 +147,6 @@ rec {
         ]
       ];
 
-      # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when
-      # no package has `doCheck = true`.
-      doCheck' = doCheck && stdenv.hostPlatform == stdenv.buildPlatform;
-      doInstallCheck' = doInstallCheck && stdenv.hostPlatform == stdenv.buildPlatform;
-
-      outputs' =
-        outputs ++
-        (if separateDebugInfo then assert stdenv.hostPlatform.isLinux; [ "debug" ] else []);
-
       computedSandboxProfile =
         lib.concatMap (input: input.__propagatedSandboxProfile or [])
           (stdenv.extraNativeBuildInputs
@@ -165,7 +170,6 @@ rec {
       derivationArg =
         (removeAttrs attrs
           ["meta" "passthru" "pos"
-           "doCheck" "doInstallCheck"
            "checkInputs" "installCheckInputs"
            "__impureHostDeps" "__propagatedImpureHostDeps"
            "sandboxProfile" "propagatedSandboxProfile"])
@@ -212,15 +216,11 @@ rec {
             ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
             ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
 
+          inherit doCheck doInstallCheck;
+
+          inherit outputs;
         } // lib.optionalAttrs (hardeningDisable != [] || hardeningEnable != []) {
           NIX_HARDENING_ENABLE = enabledHardeningOptions;
-        } // lib.optionalAttrs (outputs' != [ "out" ]) {
-          outputs = outputs';
-        } // lib.optionalAttrs doCheck' {
-          doCheck = true;
-        } // lib.optionalAttrs doInstallCheck' {
-          doInstallCheck = true;
-
         } // lib.optionalAttrs (stdenv.buildPlatform.isDarwin) {
           # TODO: remove lib.unique once nix has a list canonicalization primitive
           __sandboxProfile =
@@ -261,9 +261,8 @@ rec {
           #   unless they are comfortable with this default.
           outputsToInstall =
             let
-              outs = outputs'; # the value passed to derivation primitive
-              hasOutput = out: builtins.elem out outs;
-            in [( lib.findFirst hasOutput null (["bin" "out"] ++ outs) )];
+              hasOutput = out: builtins.elem out outputs;
+            in [( lib.findFirst hasOutput null (["bin" "out"] ++ outputs) )];
         }
         // attrs.meta or {}
         # Fill `meta.position` to identify the source location of the package.
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index 8781c2d2cad..a2e962d7f85 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/partimage/partimage-0.6.9.tar.bz2;
     sha256 = "0db6xiphk6xnlpbxraiy31c5xzj0ql6k4rfkmqzh665yyj0nqfkm";
   };
-  configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
+  configureFlags = [ "--with-ssl-headers=${openssl.dev}/include/openssl" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [bzip2 zlib newt newt openssl slang
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index 25d09e6e947..49677e98813 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -4,14 +4,19 @@ stdenv.mkDerivation rec {
   name = "lzip-${version}";
   version = "1.20";
 
-  buildInputs = [ texinfo ];
+  nativeBuildInputs = [ texinfo ];
 
   src = fetchurl {
     url = "mirror://savannah/lzip/${name}.tar.gz";
     sha256 = "0319q59kb8g324wnj7xzbr7vvlx5bcs13lr34j0zb3kqlyjq2fy9";
   };
 
-  configureFlags = "CPPFLAGS=-DNDEBUG CFLAGS=-O3 CXXFLAGS=-O3" + stdenv.lib.optionalString stdenv.isCross " CXX=${stdenv.cc.targetPrefix}c++";
+  configureFlags = [
+    "CPPFLAGS=-DNDEBUG"
+    "CFLAGS=-O3"
+    "CXXFLAGS=-O3"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+    "CXX=${stdenv.cc.targetPrefix}c++";
 
   setupHook = ./lzip-setup-hook.sh;
 
@@ -22,6 +27,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.nongnu.org/lzip/lzip.html;
     description = "A lossless data compressor based on the LZMA algorithm";
     license = stdenv.lib.licenses.gpl3Plus;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/filesystems/davfs2/default.nix b/pkgs/tools/filesystems/davfs2/default.nix
index 64934ccb469..38933c524cc 100644
--- a/pkgs/tools/filesystems/davfs2/default.nix
+++ b/pkgs/tools/filesystems/davfs2/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./isdir.patch ./fix-sysconfdir.patch ];
 
-  configureFlags = "--sysconfdir=/etc";
+  configureFlags = [ "--sysconfdir=/etc" ];
 
   makeFlags = ["sbindir=$(out)/sbin" "ssbindir=$(out)/sbin"];
 
diff --git a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
index 1ddcbb2376c..7c92dc95268 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/lvm2.nix
@@ -12,8 +12,13 @@ stdenv.mkDerivation {
     sha256 = "0nr833bl0q4zq52drjxmmpf7bs6kqxwa5kahwwxm9411khkxz0vc";
   };
 
-  configureFlags =
-    "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
+  configureFlags = [
+    "--disable-readline"
+    "--enable-udev_rules"
+    "--enable-udev_sync"
+    "--enable-pkgconfig"
+    "--enable-applib"
+  ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ systemd ];
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 8bc33fb1b0a..b8f32c33a53 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libXt libXaw libXres utilmacros ];
 
-  configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
+  configureFlags = [ "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index 071c8f36079..0ed1855a338 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libxml2 gtk2 ];
 
-  configureFlags = "--with-all-plugins";
+  configureFlags = [ "--with-all-plugins" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/graphics/plotutils/default.nix b/pkgs/tools/graphics/plotutils/default.nix
index 780e09ee91c..0d1890bb670 100644
--- a/pkgs/tools/graphics/plotutils/default.nix
+++ b/pkgs/tools/graphics/plotutils/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     make -C libplot xmi.h
   '';
 
-  configureFlags = "--enable-libplotter"; # required for pstoedit
+  configureFlags = [ "--enable-libplotter" ]; # required for pstoedit
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/inputmethods/keyfuzz/default.nix b/pkgs/tools/inputmethods/keyfuzz/default.nix
index b930da02acc..bb179e18e07 100644
--- a/pkgs/tools/inputmethods/keyfuzz/default.nix
+++ b/pkgs/tools/inputmethods/keyfuzz/default.nix
@@ -17,5 +17,5 @@ stdenv.mkDerivation rec {
     sha256 = "0xv9ymivp8fnyc5xcyh1vamxnx90bzw66wlld813fvm6q2gsiknk";
   };
 
-  configureFlags = "--without-initdir --disable-lynx";
+  configureFlags = [ "--without-initdir" "--disable-lynx" ];
 }
diff --git a/pkgs/tools/misc/most/default.nix b/pkgs/tools/misc/most/default.nix
index 61ddec3caaa..3471016db5b 100644
--- a/pkgs/tools/misc/most/default.nix
+++ b/pkgs/tools/misc/most/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
       -e "s|/bin/rm|rm|"
   '';
 
-  configureFlags = "--with-slang=${slang.dev}";
+  configureFlags = [ "--with-slang=${slang.dev}" ];
 
   buildInputs = [ slang ncurses ];
 
diff --git a/pkgs/tools/misc/urjtag/default.nix b/pkgs/tools/misc/urjtag/default.nix
index 48edb601a43..60a1ab325b1 100644
--- a/pkgs/tools/misc/urjtag/default.nix
+++ b/pkgs/tools/misc/urjtag/default.nix
@@ -21,12 +21,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ gettext autoconf automake libtool bison flex which
     subversion makeWrapper readline libftdi libusb python3 ];
 
-  configureFlags = ''
-    ${if svfSupport then "--enable-svf" else "--disable-svf"}
-    ${if bsdlSupport then "--enable-bsdl" else "--disable-bsdl"}
-    ${if staplSupport then "--enable-stapl" else "--disable-stapl"}
-    ${if jedecSupport then "--enable-jedec-exp" else "--disable-jedec-exp"}
-  '';
+  configureFlags = [
+    (stdenv.lib.enableFeature svfSupport   "svf")
+    (stdenv.lib.enableFeature bsdlSupport  "bsdl")
+    (stdenv.lib.enableFeature staplSupport "stapl")
+    (stdenv.lib.enableFeature jedecSupport "jedec-exp")
+  ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/tools/misc/xburst-tools/default.nix b/pkgs/tools/misc/xburst-tools/default.nix
index b25be641897..ca642035a0b 100644
--- a/pkgs/tools/misc/xburst-tools/default.nix
+++ b/pkgs/tools/misc/xburst-tools/default.nix
@@ -18,9 +18,10 @@ stdenv.mkDerivation {
     sh autogen.sh
   '';
 
-  configureFlags = if gccCross != null then
-    "--enable-firmware CROSS_COMPILE=${gccCross.targetPrefix}"
-    else "";
+  configureFlags = stdenv.lib.optionals (gccCross != null) [
+    "--enable-firmware"
+    "CROSS_COMPILE=${gccCross.targetPrefix}"
+  ];
 
   hardeningDisable = [ "pic" "stackprotector" ];
 
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index 766ae411606..dccab1796fb 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     done
     '';
 
-  configureFlags = "--with-perl=${perl}/bin/perl";
+  configureFlags = [ "--with-perl=${perl}/bin/perl" ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libpcap bison cyrus_sasl tcp_wrappers flex ];
diff --git a/pkgs/tools/networking/cadaver/default.nix b/pkgs/tools/networking/cadaver/default.nix
index 6bc96a5b8c7..75a05108b8b 100644
--- a/pkgs/tools/networking/cadaver/default.nix
+++ b/pkgs/tools/networking/cadaver/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = "--with-ssl";
+  configureFlags = [ "--with-ssl" ];
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/tools/networking/infiniband-diags/default.nix b/pkgs/tools/networking/infiniband-diags/default.nix
index f769a3fcffa..2ed5346b551 100644
--- a/pkgs/tools/networking/infiniband-diags/default.nix
+++ b/pkgs/tools/networking/infiniband-diags/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  configureFlags = "--with-perl-installdir=\${out}/lib/perl5/site_perl --sbindir=\${out}/bin";
+  configureFlags = [ "--with-perl-installdir=\${out}/lib/perl5/site_perl" "--sbindir=\${out}/bin" ];
 
   postInstall = ''
     rmdir $out/var/run $out/var
diff --git a/pkgs/tools/networking/mtr/default.nix b/pkgs/tools/networking/mtr/default.nix
index 8932360c717..3c2ced1712f 100644
--- a/pkgs/tools/networking/mtr/default.nix
+++ b/pkgs/tools/networking/mtr/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile.in --replace ' install-exec-hook' ""
   '';
 
-  configureFlags = stdenv.lib.optionalString (!withGtk) "--without-gtk";
+  configureFlags = stdenv.lib.optional (!withGtk) "--without-gtk";
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
 
diff --git a/pkgs/tools/networking/p2p/amule/default.nix b/pkgs/tools/networking/p2p/amule/default.nix
index ac440fc6d33..a74242ba5e1 100644
--- a/pkgs/tools/networking/p2p/amule/default.nix
+++ b/pkgs/tools/networking/p2p/amule/default.nix
@@ -8,10 +8,7 @@
 assert httpServer -> libpng != null;
 assert client -> libX11 != null;
 with stdenv;
-let
-  # Enable/Disable Feature
-  edf = enabled: flag: if enabled then "--enable-" + flag else "--disable-" + flag;
-in
+
 mkDerivation rec {
   name = "aMule-2.3.2";
 
@@ -27,15 +24,15 @@ mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  configureFlags = ''
-    --with-crypto-prefix=${cryptopp}
-    --disable-debug
-    --enable-optimize
-    ${edf monolithic "monolithic"}
-    ${edf daemon "amule-daemon"}
-    ${edf client "amule-gui"}
-    ${edf httpServer "webserver"}
-  '';
+  configureFlags = [
+    "--with-crypto-prefix=${cryptopp}"
+    "--disable-debug"
+    "--enable-optimize"
+    (stdenv.lib.enableFeature monolithic "monolithic")
+    (stdenv.lib.enableFeature daemon "amule-daemon")
+    (stdenv.lib.enableFeature client "amule-gui")
+    (stdenv.lib.enableFeature httpServer "webserver")
+  ];
 
   postConfigure = ''
     sed -i "src/libs/ec/file_generator.pl"     \
diff --git a/pkgs/tools/networking/reaver-wps/default.nix b/pkgs/tools/networking/reaver-wps/default.nix
index 6cbee7d2a85..ed48feabb85 100644
--- a/pkgs/tools/networking/reaver-wps/default.nix
+++ b/pkgs/tools/networking/reaver-wps/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     sourceRoot=$(echo */src)
   '';
 
-  configureFlags = "--sysconfdir=${confdir}";
+  configureFlags = [ "--sysconfdir=${confdir}" ];
 
   installPhase = ''
     mkdir -p $out/{bin,etc}
diff --git a/pkgs/tools/networking/ssmtp/default.nix b/pkgs/tools/networking/ssmtp/default.nix
index 5f6e955f8e4..24e96491f9d 100644
--- a/pkgs/tools/networking/ssmtp/default.nix
+++ b/pkgs/tools/networking/ssmtp/default.nix
@@ -14,7 +14,10 @@ stdenv.mkDerivation {
   # See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858781
   patches = [ ./ssmtp_support_AuthPassFile_parameter.patch ];
 
-  configureFlags = "--sysconfdir=/etc ${if tlsSupport then "--enable-ssl" else ""}";
+  configureFlags = [
+    "--sysconfdir=/etc"
+    (stdenv.lib.enableFeature tlsSupport "ssl")
+  ];
 
   postConfigure =
     ''
diff --git a/pkgs/tools/networking/trickle/default.nix b/pkgs/tools/networking/trickle/default.nix
index f6c88bb66b7..7a4adc14c2d 100644
--- a/pkgs/tools/networking/trickle/default.nix
+++ b/pkgs/tools/networking/trickle/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   LDFLAGS = "-levent";
 
-  configureFlags = "--with-libevent";
+  configureFlags = [ "--with-libevent" ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/networking/vtun/default.nix b/pkgs/tools/networking/vtun/default.nix
index fb0ee64cc2c..d2cbb5d8a4e 100644
--- a/pkgs/tools/networking/vtun/default.nix
+++ b/pkgs/tools/networking/vtun/default.nix
@@ -20,10 +20,11 @@ stdenv.mkDerivation rec {
   '';
   buildInputs = [ lzo openssl zlib yacc flex ];
 
-  configureFlags = ''
-    --with-lzo-headers=${lzo}/include/lzo
-    --with-ssl-headers=${openssl.dev}/include/openssl
-    --with-blowfish-headers=${openssl.dev}/include/openssl'';
+  configureFlags = [
+    "--with-lzo-headers=${lzo}/include/lzo"
+    "--with-ssl-headers=${openssl.dev}/include/openssl"
+    "--with-blowfish-headers=${openssl.dev}/include/openssl"
+  ];
 
   meta = with stdenv.lib; {
       description = "Virtual Tunnels over TCP/IP with traffic shaping, compression and encryption";
diff --git a/pkgs/tools/networking/webalizer/default.nix b/pkgs/tools/networking/webalizer/default.nix
index 5d31d35bd63..67a95f32b61 100644
--- a/pkgs/tools/networking/webalizer/default.nix
+++ b/pkgs/tools/networking/webalizer/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, zlib, libpng, gd, geoip, db}:
+{ stdenv, fetchurl, zlib, libpng, gd, geoip, db }:
 
 stdenv.mkDerivation {
   name = "webalizer-2.23-05";
@@ -16,7 +16,12 @@ stdenv.mkDerivation {
 
   buildInputs = [zlib libpng gd geoip db]; 
 
-  configureFlags = "--enable-dns --enable-geoip --disable-static --enable-shared";
+  configureFlags = [
+    "--enable-dns"
+    "--enable-geoip"
+    "--disable-static"
+    "--enable-shared"
+  ];
 
   meta = {
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 5c1636ddb86..0bd99c63596 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -34,8 +34,9 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (libpsl != null) libpsl
     ++ stdenv.lib.optional stdenv.isDarwin perl;
 
-  configureFlags =
-    if openssl != null then "--with-ssl=openssl" else "--without-ssl";
+  configureFlags = [
+    (stdenv.lib.withFeatureAs (openssl != null) "ssl" "openssl")
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/fwknop/default.nix b/pkgs/tools/security/fwknop/default.nix
index 3a4bdcd529e..812c032230c 100644
--- a/pkgs/tools/security/fwknop/default.nix
+++ b/pkgs/tools/security/fwknop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, lib
+{ stdenv, fetchFromGitHub, autoreconfHook
 , libpcap, texinfo
 , iptables
 , gnupgSupport ? true, gnupg, gpgme # Increases dependencies!
@@ -23,21 +23,18 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional gnupgSupport [ gnupg gpgme.dev ]
     ++ stdenv.lib.optional wgetSupport [ wget ];
 
-  configureFlags = ''
-    --sysconfdir=/etc
-    --localstatedir=/run
-    --with-iptables=${iptables}/sbin/iptables
-    ${lib.optionalString (!buildServer) "--disable-server"}
-    ${lib.optionalString (!buildClient) "--disable-client"}
-    ${lib.optionalString gnupgSupport ''
-      --with-gpgme
-      --with-gpgme-prefix=${gpgme.dev}
-      --with-gpg=${gnupg}
-    ''}
-    ${lib.optionalString wgetSupport ''
-      --with-wget=${wget}/bin/wget
-    ''}
-  '';
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/run"
+    "--with-iptables=${iptables}/sbin/iptables"
+    (stdenv.lib.enableFeature buildServer "server")
+    (stdenv.lib.enableFeature buildClient "client")
+    (stdenv.lib.withFeatureAs wgetSupport "wget" "${wget}/bin/wget")
+  ] ++ stdenv.lib.optionalString gnupgSupport [
+    "--with-gpgme"
+    "--with-gpgme-prefix=${gpgme.dev}"
+    "--with-gpg=${gnupg}"
+  ];
 
   # Temporary hack to copy the example configuration files into the nix-store,
   # this'll probably be helpful until there's a NixOS module for that (feel free
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index fd773da4ade..ded07cb5dad 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.8";
+  version = "2.2.9";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1k8dnnfs9888yp713l7kg2jg110lw47s4krx0njna6fjrsw4qyvp";
+    sha256 = "0r11mx8nkh7ysrnshs560amha5csx8zcaggb5kxcksx1zymyly32";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/modsecurity/default.nix b/pkgs/tools/security/modsecurity/default.nix
index 2c02a5dd473..09f8c63973c 100644
--- a/pkgs/tools/security/modsecurity/default.nix
+++ b/pkgs/tools/security/modsecurity/default.nix
@@ -22,17 +22,17 @@ stdenv.mkDerivation rec {
   buildInputs = [  curl apacheHttpd pcre apr aprutil libxml2 ] ++
     optional luaSupport lua5;
 
-  configureFlags = ''
-    --enable-standalone-module
-    --enable-static
-    --with-curl=${curl.dev}
-    --with-apxs=${apacheHttpd.dev}/bin/apxs
-    --with-pcre=${pcre.dev}
-    --with-apr=${apr.dev}
-    --with-apu=${aprutil.dev}/bin/apu-1-config
-    --with-libxml=${libxml2.dev}
-    --with-lua=${luaValue}
-  '';
+  configureFlags = [
+    "--enable-standalone-module"
+    "--enable-static"
+    "--with-curl=${curl.dev}"
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+    "--with-pcre=${pcre.dev}"
+    "--with-apr=${apr.dev}"
+    "--with-apu=${aprutil.dev}/bin/apu-1-config"
+    "--with-libxml=${libxml2.dev}"
+    "--with-lua=${luaValue}"
+  ];
 
   outputs = ["out" "nginx"];
   # by default modsecurity's install script copies compiled output to httpd's modules folder
diff --git a/pkgs/tools/security/super/default.nix b/pkgs/tools/security/super/default.nix
index 688521e1401..2b4173a51af 100644
--- a/pkgs/tools/security/super/default.nix
+++ b/pkgs/tools/security/super/default.nix
@@ -24,7 +24,10 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
 
-  configureFlags = "--sysconfdir=/etc --localstatedir=/var";
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+  ];
 
   installFlags = "sysconfdir=$(out)/etc localstatedir=$(TMPDIR)";
 
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 166f20dd7d6..e273b2c1909 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -41,11 +41,11 @@ stdenv.mkDerivation rec {
 
   preConfigure = "./bootstrap.sh";
 
-  configureFlags = ""
-    + stdenv.lib.optionalString withCrypto "--with-crypto "
-    + stdenv.lib.optionalString enableMagic "--enable-magic "
-    + stdenv.lib.optionalString enableCuckoo "--enable-cuckoo "
-  ;
+  configureFlags = [
+    (stdenv.lib.withFeature withCrypto "crypto")
+    (stdenv.lib.enableFeature enableMagic "magic")
+    (stdenv.lib.enableFeature enableCuckoo "cuckoo")
+  ];
 
   meta = with stdenv.lib; {
     description = "The pattern matching swiss knife for malware researchers";
diff --git a/pkgs/tools/system/monit/default.nix b/pkgs/tools/system/monit/default.nix
index 17e472b8d2b..362545285ed 100644
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@@ -1,7 +1,10 @@
-{stdenv, fetchurl, openssl, bison, flex, pam, zlib, usePAM ? stdenv.isLinux
- , buildPlatform, hostPlatform }:
-let useSSL = (openssl != null);
-    isCross = ( buildPlatform != hostPlatform ) ; in
+{ stdenv
+, fetchurl, bison, flex
+, zlib
+, usePAM ? stdenv.hostPlatform.isLinux, pam
+, useSSL ? true, openssl
+}:
+
 stdenv.mkDerivation rec {
   name = "monit-5.25.2";
 
@@ -15,15 +18,18 @@ stdenv.mkDerivation rec {
     stdenv.lib.optionals useSSL [ openssl ] ++
     stdenv.lib.optionals usePAM [ pam ];
 
-  configureFlags =
-    if useSSL then [
+  configureFlags = [
+    (stdenv.lib.withFeature usePAM "pam")
+  ] ++ (if useSSL then [
       "--with-ssl-incl-dir=${openssl.dev}/include"
       "--with-ssl-lib-dir=${openssl.out}/lib"
-    ] else [ "--without-ssl" ] ++
-    stdenv.lib.optionals (! usePAM) [ "--without-pam" ] ++
+    ] else [
+      "--without-ssl"
+  ]) ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # will need to check both these are true for musl
-    stdenv.lib.optionals isCross [ "libmonit_cv_setjmp_available=yes"
-                                   "libmonit_cv_vsnprintf_c99_conformant=yes"];
+    "libmonit_cv_setjmp_available=yes"
+    "libmonit_cv_vsnprintf_c99_conformant=yes"
+  ];
 
   meta = {
     homepage = http://mmonit.com/monit/;
diff --git a/pkgs/tools/text/catdoc/default.nix b/pkgs/tools/text/catdoc/default.nix
index 2a06b25b11d..8a8eb3117f0 100644
--- a/pkgs/tools/text/catdoc/default.nix
+++ b/pkgs/tools/text/catdoc/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = "--disable-wordview";
+  configureFlags = [ "--disable-wordview" ];
 
   meta = with stdenv.lib; {
     description = "MS-Word/Excel/PowerPoint to text converter";
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index c83eab2e2ef..0ad2a18236f 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, ed
+, ed, autoreconfHook
 , buildPlatform, hostPlatform
 }:
 
@@ -14,9 +14,18 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.savannah.gnu.org/cgit/patch.git/patch/?id=f290f48a621867084884bfff87f8093c15195e6a
     ./CVE-2018-6951.patch
+    (fetchurl {
+      url = https://sources.debian.org/data/main/p/patch/2.7.6-2/debian/patches/Allow_input_files_to_be_missing_for_ed-style_patches.patch;
+      sha256 = "0iw0lk0yhnhvfjzal48ij6zdr92mgb84jq7fwryy1hdhi47hhq64";
+    })
+    (fetchurl { # CVE-2018-1000156
+      url = https://sources.debian.org/data/main/p/patch/2.7.6-2/debian/patches/Fix_arbitrary_command_execution_in_ed-style_patches.patch;
+      sha256 = "1bpy16n3hm5nv9xkrn6c4wglzsdzj3ss1biq16w9kfv48p4hx2vg";
+    })
   ];
 
   buildInputs = stdenv.lib.optional doCheck ed;
+  nativeBuildInputs = [ autoreconfHook ];
 
   configureFlags = stdenv.lib.optionals (hostPlatform != buildPlatform) [
     "ac_cv_func_strnlen_working=yes"
diff --git a/pkgs/tools/typesetting/xmlroff/default.nix b/pkgs/tools/typesetting/xmlroff/default.nix
index f8b0ddbfac5..523a34c0b56 100644
--- a/pkgs/tools/typesetting/xmlroff/default.nix
+++ b/pkgs/tools/typesetting/xmlroff/default.nix
@@ -26,7 +26,10 @@ stdenv.mkDerivation rec {
 
   configureScript = "./autogen.sh";
 
-  configureFlags = "--disable-pangoxsl --disable-gp";
+  configureFlags = [
+    "--disable-pangoxsl"
+    "--disable-gp"
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 26fef8cb1d7..49170793b00 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7450,7 +7450,6 @@ with pkgs;
 
   ocropus = callPackage ../applications/misc/ocropus { };
 
-  perl = perl524;
   inherit (callPackages ../development/interpreters/perl {}) perl522 perl524 perl526 perl528;
 
   pachyderm = callPackage ../applications/networking/cluster/pachyderm { };
@@ -12600,11 +12599,25 @@ with pkgs;
 
   ### DEVELOPMENT / PERL MODULES
 
-  buildPerlPackage = callPackage ../development/perl-modules/generic perl;
-
-  perlPackages = recurseIntoAttrs (callPackage ./perl-packages.nix {
+  perl522Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
+    perl = perl522;
     overrides = (config.perlPackageOverrides or (p: {})) pkgs;
   });
+  perl524Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
+    perl = perl524;
+    overrides = (config.perlPackageOverrides or (p: {})) pkgs;
+  });
+  perl526Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
+    perl = perl526;
+    overrides = (config.perlPackageOverrides or (p: {})) pkgs;
+  });
+  perl528Packages = recurseIntoAttrs (callPackage ./perl-packages.nix {
+    perl = perl528;
+    overrides = (config.perlPackageOverrides or (p: {})) pkgs;
+  });
+
+  perlPackages = perl528Packages;
+  inherit (perlPackages) perl buildPerlPackage;
 
   perlXMLParser = perlPackages.XMLParser;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a644438c5a0..522b0e0574a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7,13 +7,16 @@
 
 {config, pkgs, fetchurl, fetchFromGitHub, stdenv, gnused, perl, overrides}:
 
-let self = _self // overrides; _self = with self; {
+let
+  inherit (stdenv.lib) maintainers;
+  self = _self // overrides;
+  _self = with self; {
 
   inherit perl;
 
-  inherit (pkgs) buildPerlPackage;
+  callPackage = pkgs.newScope self;
 
-  inherit (stdenv.lib) maintainers;
+  buildPerlPackage = callPackage ../development/perl-modules/generic { };
 
   # Helper functions for packages that use Module::Build to build.
   buildPerlModule = { buildInputs ? [], ... } @ args:
@@ -751,10 +754,7 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  BerkeleyDB = import ../development/perl-modules/BerkeleyDB {
-    inherit buildPerlPackage fetchurl;
-    inherit (pkgs) db;
-  };
+  BerkeleyDB = callPackage ../development/perl-modules/BerkeleyDB { };
 
   BHooksEndOfScope = buildPerlPackage rec {
     name = "B-Hooks-EndOfScope-0.24";
@@ -2424,10 +2424,7 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  CompressRawZlib = import ../development/perl-modules/Compress-Raw-Zlib {
-    inherit fetchurl buildPerlPackage stdenv;
-    inherit (pkgs) zlib;
-  };
+  CompressRawZlib = callPackage ../development/perl-modules/Compress-Raw-Zlib { };
 
   CompressUnLZMA = buildPerlPackage rec {
     name = "Compress-unLZMA-0.05";
@@ -4064,30 +4061,15 @@ let self = _self // overrides; _self = with self; {
     buildInputs = [ TestException ];
   };
 
-  DBDSQLite = import ../development/perl-modules/DBD-SQLite {
-    inherit stdenv fetchurl buildPerlPackage DBI;
-    inherit (pkgs) sqlite;
-  };
+  DBDSQLite = callPackage ../development/perl-modules/DBD-SQLite { };
 
-  DBDmysql = import ../development/perl-modules/DBD-mysql {
-    inherit fetchurl buildPerlPackage DBI;
-    inherit (pkgs) mysql;
-  };
+  DBDmysql = callPackage ../development/perl-modules/DBD-mysql { };
 
-  DBDPg = import ../development/perl-modules/DBD-Pg {
-    inherit stdenv fetchurl buildPerlPackage DBI;
-    inherit (pkgs) postgresql;
-  };
+  DBDPg = callPackage ../development/perl-modules/DBD-Pg { };
 
-  DBDsybase = import ../development/perl-modules/DBD-sybase {
-    inherit fetchurl buildPerlPackage DBI;
-    inherit (pkgs) freetds;
-  };
+  DBDsybase = callPackage ../development/perl-modules/DBD-sybase { };
 
-  DBFile = import ../development/perl-modules/DB_File {
-    inherit fetchurl buildPerlPackage;
-    inherit (pkgs) db;
-  };
+  DBFile = callPackage ../development/perl-modules/DB_File { };
 
   DBI = buildPerlPackage rec {
     name = "DBI-${version}";
@@ -9066,9 +9048,7 @@ let self = _self // overrides; _self = with self; {
     propagatedBuildInputs = [ LWP NetDNS ];
   };
 
-  maatkit = import ../development/perl-modules/maatkit {
-    inherit fetchurl buildPerlPackage stdenv DBDmysql;
-  };
+  maatkit = callPackage ../development/perl-modules/maatkit { };
 
   MacPasteboard = buildPerlPackage rec {
     name = "Mac-Pasteboard-0.009";
@@ -9561,7 +9541,7 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  MNI-Perllib = pkgs.callPackage ../development/perl-modules/MNI {};
+  MNI-Perllib = callPackage ../development/perl-modules/MNI {};
 
   Mo = buildPerlPackage rec {
      name = "Mo-0.40";
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 8592e3136ae..ef6da6ed804 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -109,7 +109,7 @@ let
   imagick = buildPecl {
     name = "imagick-3.4.3";
     sha256 = "0z2nc92xfc5axa9f2dy95rmsd2c81q8cs1pm4anh0a50x9g5ng0z";
-    configureFlags = "--with-imagick=${pkgs.imagemagick.dev}";
+    configureFlags = [ "--with-imagick=${pkgs.imagemagick.dev}" ];
     nativeBuildInputs = [ pkgs.pkgconfig ];
     buildInputs = [ pkgs.pcre ];
   };
@@ -120,7 +120,7 @@ let
 
     sha256 = "04c35rj0cvq5ygn2jgmyvqcb0k8d03v4k642b6i37zgv7x15pbic";
 
-    configureFlags = "--with-zlib-dir=${pkgs.zlib.dev}";
+    configureFlags = [ "--with-zlib-dir=${pkgs.zlib.dev}" ];
 
     makeFlags = [ "CFLAGS=-fgnu89-inline" ];
   };