summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix5
-rw-r--r--nixos/modules/config/malloc.nix5
-rw-r--r--nixos/modules/rename.nix3
-rw-r--r--nixos/modules/security/misc.nix18
-rw-r--r--nixos/modules/services/backup/znapzend.nix27
-rw-r--r--nixos/modules/services/security/fprintd.nix20
-rw-r--r--nixos/modules/system/boot/binfmt.nix314
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix3
-rw-r--r--nixos/modules/system/boot/luksroot.nix175
-rw-r--r--nixos/modules/system/boot/resolved.nix5
-rw-r--r--nixos/modules/virtualisation/docker-containers.nix13
-rw-r--r--nixos/tests/docker-tools.nix7
-rw-r--r--pkgs/applications/audio/qmmp/default.nix8
-rw-r--r--pkgs/applications/audio/vcv-rack/default.nix5
-rw-r--r--pkgs/applications/graphics/openscad/default.nix25
-rw-r--r--pkgs/applications/kde/kgpg.nix6
-rw-r--r--pkgs/applications/misc/bemenu/default.nix45
-rw-r--r--pkgs/applications/misc/electrum/default.nix10
-rw-r--r--pkgs/applications/misc/k2pdfopt/default.nix23
-rw-r--r--pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch95
-rw-r--r--pkgs/applications/misc/kitty/default.nix15
-rw-r--r--pkgs/applications/misc/octoprint/default.nix19
-rw-r--r--pkgs/applications/misc/playonlinux/default.nix4
-rw-r--r--pkgs/applications/misc/tilix/default.nix4
-rw-r--r--pkgs/applications/misc/tzupdate/default.nix4
-rw-r--r--pkgs/applications/misc/zathura/core/default.nix10
-rw-r--r--pkgs/applications/misc/zathura/default.nix3
-rw-r--r--pkgs/applications/misc/zathura/pdf-mupdf/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/qbittorrent/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix6
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/science/biology/eggnog-mapper/default.nix4
-rw-r--r--pkgs/applications/science/logic/symbiyosys/default.nix5
-rw-r--r--pkgs/applications/science/math/cbc/default.nix10
-rw-r--r--pkgs/applications/science/math/pynac/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/fast-export/default.nix51
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-crypt/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix4
-rw-r--r--pkgs/applications/version-management/src/default.nix14
-rw-r--r--pkgs/applications/video/mkclean/default.nix37
-rw-r--r--pkgs/applications/virtualization/rkt/default.nix4
-rw-r--r--pkgs/applications/window-managers/i3/wk-switch.nix15
-rw-r--r--pkgs/build-support/docker/default.nix21
-rw-r--r--pkgs/build-support/docker/examples.nix39
-rw-r--r--pkgs/data/fonts/agave/default.nix27
-rw-r--r--pkgs/data/fonts/aileron/default.nix4
-rw-r--r--pkgs/data/fonts/andagii/default.nix4
-rw-r--r--pkgs/data/fonts/andika/default.nix4
-rw-r--r--pkgs/data/fonts/ankacoder/condensed.nix4
-rw-r--r--pkgs/data/fonts/ankacoder/default.nix4
-rw-r--r--pkgs/data/fonts/anonymous-pro/default.nix4
-rw-r--r--pkgs/data/fonts/arkpandora/default.nix3
-rw-r--r--pkgs/data/fonts/arphic/default.nix6
-rw-r--r--pkgs/data/fonts/aurulent-sans/default.nix17
-rw-r--r--pkgs/data/fonts/b612/default.nix17
-rw-r--r--pkgs/data/fonts/babelstone-han/default.nix8
-rw-r--r--pkgs/data/fonts/baekmuk-ttf/default.nix8
-rw-r--r--pkgs/data/fonts/bakoma-ttf/default.nix3
-rw-r--r--pkgs/data/fonts/behdad-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/cabin/default.nix18
-rw-r--r--pkgs/data/fonts/caladea/default.nix4
-rw-r--r--pkgs/data/fonts/camingo-code/default.nix12
-rw-r--r--pkgs/data/fonts/carlito/default.nix4
-rw-r--r--pkgs/data/fonts/charis-sil/default.nix4
-rw-r--r--pkgs/data/fonts/clearlyU/default.nix20
-rw-r--r--pkgs/data/fonts/cm-unicode/default.nix10
-rw-r--r--pkgs/data/fonts/comfortaa/default.nix5
-rw-r--r--pkgs/data/fonts/comic-neue/default.nix4
-rw-r--r--pkgs/data/fonts/comic-relief/default.nix4
-rw-r--r--pkgs/data/fonts/cooper-hewitt/default.nix6
-rw-r--r--pkgs/data/fonts/corefonts/default.nix6
-rw-r--r--pkgs/data/fonts/crimson/default.nix11
-rw-r--r--pkgs/data/fonts/culmus/default.nix19
-rw-r--r--pkgs/data/fonts/d2coding/default.nix6
-rw-r--r--pkgs/data/fonts/dina-pcf/default.nix1
-rw-r--r--pkgs/data/fonts/dina/default.nix7
-rw-r--r--pkgs/data/fonts/dosemu-fonts/default.nix1
-rw-r--r--pkgs/data/fonts/dosis/default.nix18
-rw-r--r--pkgs/data/fonts/doulos-sil/default.nix4
-rw-r--r--pkgs/data/fonts/eb-garamond/default.nix4
-rw-r--r--pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix4
-rw-r--r--pkgs/data/fonts/emojione/default.nix1
-rw-r--r--pkgs/data/fonts/encode-sans/default.nix4
-rw-r--r--pkgs/data/fonts/eunomia/default.nix4
-rw-r--r--pkgs/data/fonts/f5_6/default.nix4
-rw-r--r--pkgs/data/fonts/fantasque-sans-mono/default.nix6
-rw-r--r--pkgs/data/fonts/ferrum/default.nix4
-rw-r--r--pkgs/data/fonts/fira/default.nix19
-rw-r--r--pkgs/data/fonts/fixedsys-excelsior/default.nix32
-rw-r--r--pkgs/data/fonts/font-awesome-5/default.nix14
-rw-r--r--pkgs/data/fonts/fontconfig-penultimate/default.nix4
-rw-r--r--pkgs/data/fonts/freefont-ttf/default.nix6
-rw-r--r--pkgs/data/fonts/gandom-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/gdouros/default.nix36
-rw-r--r--pkgs/data/fonts/gentium-book-basic/default.nix5
-rw-r--r--pkgs/data/fonts/gentium/default.nix4
-rw-r--r--pkgs/data/fonts/go-font/default.nix22
-rw-r--r--pkgs/data/fonts/gohufont/default.nix1
-rw-r--r--pkgs/data/fonts/gyre/default.nix8
-rw-r--r--pkgs/data/fonts/hack/default.nix4
-rw-r--r--pkgs/data/fonts/hanazono/default.nix4
-rw-r--r--pkgs/data/fonts/hasklig/default.nix7
-rw-r--r--pkgs/data/fonts/helvetica-neue-lt-std/default.nix8
-rw-r--r--pkgs/data/fonts/hermit/default.nix23
-rw-r--r--pkgs/data/fonts/hyperscrypt/default.nix4
-rw-r--r--pkgs/data/fonts/inriafonts/default.nix26
-rw-r--r--pkgs/data/fonts/inter-ui/default.nix4
-rw-r--r--pkgs/data/fonts/inter/default.nix4
-rw-r--r--pkgs/data/fonts/ipaexfont/default.nix9
-rw-r--r--pkgs/data/fonts/ipafont/default.nix7
-rw-r--r--pkgs/data/fonts/ir-standard-fonts/default.nix27
-rw-r--r--pkgs/data/fonts/iwona/default.nix25
-rw-r--r--pkgs/data/fonts/junicode/default.nix5
-rw-r--r--pkgs/data/fonts/kawkab-mono/default.nix5
-rw-r--r--pkgs/data/fonts/kochi-substitute-naga10/default.nix6
-rw-r--r--pkgs/data/fonts/kochi-substitute/default.nix1
-rw-r--r--pkgs/data/fonts/lalezar-fonts/default.nix22
-rw-r--r--pkgs/data/fonts/lato/default.nix4
-rw-r--r--pkgs/data/fonts/liberastika/default.nix4
-rw-r--r--pkgs/data/fonts/liberation-sans-narrow/default.nix7
-rw-r--r--pkgs/data/fonts/libertinus/default.nix32
-rw-r--r--pkgs/data/fonts/libre-baskerville/default.nix18
-rw-r--r--pkgs/data/fonts/libre-bodoni/default.nix18
-rw-r--r--pkgs/data/fonts/libre-franklin/default.nix18
-rw-r--r--pkgs/data/fonts/lm-math/default.nix26
-rw-r--r--pkgs/data/fonts/lmodern/default.nix3
-rw-r--r--pkgs/data/fonts/lmodern/lmmath.nix3
-rw-r--r--pkgs/data/fonts/lobster-two/default.nix3
-rw-r--r--pkgs/data/fonts/lohit-fonts/default.nix3
-rw-r--r--pkgs/data/fonts/manrope/default.nix22
-rw-r--r--pkgs/data/fonts/marathi-cursive/default.nix12
-rw-r--r--pkgs/data/fonts/material-design-icons/default.nix23
-rw-r--r--pkgs/data/fonts/material-icons/default.nix24
-rw-r--r--pkgs/data/fonts/medio/default.nix4
-rw-r--r--pkgs/data/fonts/migmix/default.nix4
-rw-r--r--pkgs/data/fonts/migu/default.nix1
-rw-r--r--pkgs/data/fonts/mononoki/default.nix4
-rw-r--r--pkgs/data/fonts/montserrat/default.nix4
-rw-r--r--pkgs/data/fonts/mph-2b-damase/default.nix3
-rw-r--r--pkgs/data/fonts/mplus-outline-fonts/default.nix4
-rw-r--r--pkgs/data/fonts/mro-unicode/default.nix2
-rw-r--r--pkgs/data/fonts/nahid-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/nanum-gothic-coding/default.nix4
-rw-r--r--pkgs/data/fonts/nerdfonts/default.nix1
-rw-r--r--pkgs/data/fonts/nika-fonts/default.nix25
-rw-r--r--pkgs/data/fonts/norwester/default.nix4
-rw-r--r--pkgs/data/fonts/noto-fonts/tools.nix1
-rw-r--r--pkgs/data/fonts/office-code-pro/default.nix30
-rw-r--r--pkgs/data/fonts/oldsindhi/default.nix12
-rw-r--r--pkgs/data/fonts/oldstandard/default.nix30
-rw-r--r--pkgs/data/fonts/open-dyslexic/default.nix4
-rw-r--r--pkgs/data/fonts/open-sans/default.nix26
-rw-r--r--pkgs/data/fonts/orbitron/default.nix18
-rw-r--r--pkgs/data/fonts/overpass/default.nix4
-rw-r--r--pkgs/data/fonts/oxygenfonts/default.nix15
-rw-r--r--pkgs/data/fonts/parastoo-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/paratype-pt/mono.nix7
-rw-r--r--pkgs/data/fonts/paratype-pt/sans.nix7
-rw-r--r--pkgs/data/fonts/paratype-pt/serif.nix7
-rw-r--r--pkgs/data/fonts/pecita/default.nix6
-rw-r--r--pkgs/data/fonts/penna/default.nix4
-rw-r--r--pkgs/data/fonts/poly/default.nix1
-rw-r--r--pkgs/data/fonts/powerline-fonts/default.nix30
-rw-r--r--pkgs/data/fonts/profont/default.nix8
-rw-r--r--pkgs/data/fonts/public-sans/default.nix4
-rw-r--r--pkgs/data/fonts/quattrocento-sans/default.nix6
-rw-r--r--pkgs/data/fonts/quattrocento/default.nix6
-rw-r--r--pkgs/data/fonts/raleway/default.nix18
-rw-r--r--pkgs/data/fonts/ricty/default.nix1
-rw-r--r--pkgs/data/fonts/roboto/default.nix8
-rw-r--r--pkgs/data/fonts/rounded-mgenplus/default.nix28
-rw-r--r--pkgs/data/fonts/route159/default.nix4
-rw-r--r--pkgs/data/fonts/sahel-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/samim-fonts/default.nix24
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix12
-rw-r--r--pkgs/data/fonts/scheherazade/default.nix4
-rw-r--r--pkgs/data/fonts/seshat/default.nix4
-rw-r--r--pkgs/data/fonts/shabnam-fonts/default.nix26
-rw-r--r--pkgs/data/fonts/shrikhand/default.nix4
-rw-r--r--pkgs/data/fonts/siji/default.nix8
-rw-r--r--pkgs/data/fonts/source-code-pro/default.nix8
-rw-r--r--pkgs/data/fonts/source-han-code-jp/default.nix8
-rw-r--r--pkgs/data/fonts/source-han-sans/default.nix7
-rw-r--r--pkgs/data/fonts/source-han-serif/default.nix7
-rw-r--r--pkgs/data/fonts/source-sans-pro/default.nix4
-rw-r--r--pkgs/data/fonts/source-serif-pro/default.nix4
-rw-r--r--pkgs/data/fonts/spleen/default.nix22
-rw-r--r--pkgs/data/fonts/stix-otf/default.nix6
-rw-r--r--pkgs/data/fonts/stix-two/default.nix4
-rw-r--r--pkgs/data/fonts/sudo/default.nix4
-rw-r--r--pkgs/data/fonts/tamsyn/default.nix7
-rw-r--r--pkgs/data/fonts/tempora-lgc/default.nix1
-rw-r--r--pkgs/data/fonts/tenderness/default.nix4
-rw-r--r--pkgs/data/fonts/terminus-font-ttf/default.nix5
-rw-r--r--pkgs/data/fonts/terminus-font/default.nix1
-rw-r--r--pkgs/data/fonts/tewi/default.nix1
-rw-r--r--pkgs/data/fonts/tex-gyre-math/default.nix24
-rw-r--r--pkgs/data/fonts/tex-gyre/default.nix2
-rw-r--r--pkgs/data/fonts/theano/default.nix4
-rw-r--r--pkgs/data/fonts/tipa/default.nix1
-rw-r--r--pkgs/data/fonts/tlwg/default.nix1
-rw-r--r--pkgs/data/fonts/ttf-bitstream-vera/default.nix7
-rw-r--r--pkgs/data/fonts/ttf-envy-code-r/default.nix5
-rw-r--r--pkgs/data/fonts/twemoji-color-font/default.nix1
-rw-r--r--pkgs/data/fonts/ubuntu-font-family/default.nix10
-rw-r--r--pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix5
-rw-r--r--pkgs/data/fonts/undefined-medium/default.nix6
-rw-r--r--pkgs/data/fonts/uni-vga/default.nix3
-rw-r--r--pkgs/data/fonts/unifont/default.nix8
-rw-r--r--pkgs/data/fonts/unifont_upper/default.nix8
-rwxr-xr-xpkgs/data/fonts/vazir-fonts/default.nix27
-rw-r--r--pkgs/data/fonts/vdrsymbols/default.nix4
-rw-r--r--pkgs/data/fonts/vegur/default.nix25
-rw-r--r--pkgs/data/fonts/vista-fonts-chs/default.nix10
-rw-r--r--pkgs/data/fonts/vista-fonts/default.nix2
-rw-r--r--pkgs/data/fonts/weather-icons/default.nix6
-rw-r--r--pkgs/data/fonts/wqy-microhei/default.nix8
-rw-r--r--pkgs/data/fonts/wqy-zenhei/default.nix8
-rw-r--r--pkgs/data/fonts/xkcd-font/default.nix23
-rw-r--r--pkgs/data/fonts/yanone-kaffeesatz/default.nix8
-rw-r--r--pkgs/data/fonts/zilla-slab/default.nix7
-rw-r--r--pkgs/desktops/gnome-3/core/evolution-data-server/default.nix4
-rw-r--r--pkgs/development/compilers/ghc/8.6.4.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.6.5.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.8.1.nix5
-rw-r--r--pkgs/development/compilers/ghc/head.nix5
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix6
-rw-r--r--pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch36
-rw-r--r--pkgs/development/compilers/mruby/default.nix10
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix42
-rw-r--r--pkgs/development/haskell-modules/configuration-hackage2nix.yaml17
-rw-r--r--pkgs/development/haskell-modules/configuration-nix.nix20
-rw-r--r--pkgs/development/haskell-modules/hackage-packages.nix115
-rw-r--r--pkgs/development/libraries/alkimia/default.nix11
-rw-r--r--pkgs/development/libraries/ctl/default.nix35
-rw-r--r--pkgs/development/libraries/ctl/source.nix11
-rw-r--r--pkgs/development/libraries/gtksourceview/3.x.nix4
-rw-r--r--pkgs/development/libraries/java/lombok/default.nix4
-rw-r--r--pkgs/development/libraries/libdazzle/default.nix4
-rw-r--r--pkgs/development/libraries/libgda/default.nix4
-rw-r--r--pkgs/development/libraries/linbox/default.nix5
-rw-r--r--pkgs/development/libraries/oniguruma/default.nix4
-rw-r--r--pkgs/development/libraries/portaudio/default.nix2
-rw-r--r--pkgs/development/libraries/range-v3/default.nix4
-rw-r--r--pkgs/development/libraries/tbb/default.nix4
-rw-r--r--pkgs/development/python-modules/ansible-runner/default.nix4
-rw-r--r--pkgs/development/python-modules/av/default.nix7
-rw-r--r--pkgs/development/python-modules/holoviews/default.nix4
-rw-r--r--pkgs/development/python-modules/latexcodec/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/py-radix/default.nix28
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix15
-rw-r--r--pkgs/development/python-modules/python-gnupg/default.nix6
-rw-r--r--pkgs/development/python-modules/qdarkstyle/default.nix4
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix4
-rw-r--r--pkgs/development/python-modules/qtpy/default.nix4
-rw-r--r--pkgs/development/python-modules/shodan/default.nix4
-rw-r--r--pkgs/development/python-modules/smart_open/default.nix4
-rw-r--r--pkgs/development/python-modules/typed-ast/default.nix4
-rw-r--r--pkgs/development/tools/analysis/radare2/default.nix12
-rw-r--r--pkgs/development/tools/build-managers/bazel/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/buck/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/leiningen/default.nix4
-rw-r--r--pkgs/development/tools/chit/default.nix47
-rw-r--r--pkgs/development/tools/react-native-debugger/default.nix4
-rw-r--r--pkgs/development/tools/scalafmt/default.nix7
-rw-r--r--pkgs/development/tools/wabt/default.nix4
-rw-r--r--pkgs/games/azimuth/default.nix64
-rw-r--r--pkgs/misc/emulators/wine/sources.nix6
-rw-r--r--pkgs/misc/screensavers/xautolock/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/cpptools/default.nix4
-rw-r--r--pkgs/misc/vscode-extensions/wakatime/default.nix4
-rw-r--r--pkgs/os-specific/linux/bpftool/default.nix26
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix6
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix4
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix4
-rw-r--r--pkgs/servers/http/nginx/modules.nix113
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/5.x.nix5
-rw-r--r--pkgs/servers/search/elasticsearch/6.x.nix4
-rw-r--r--pkgs/servers/search/elasticsearch/7.x.nix4
-rw-r--r--pkgs/shells/tcsh/default.nix4
-rw-r--r--pkgs/tools/backup/duply/default.nix4
-rw-r--r--pkgs/tools/misc/aptly/default.nix4
-rw-r--r--pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch1153
-rw-r--r--pkgs/tools/misc/coreutils/default.nix14
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/qt5ct/default.nix4
-rw-r--r--pkgs/tools/misc/shell-hist/default.nix23
-rw-r--r--pkgs/tools/misc/tlp/default.nix4
-rw-r--r--pkgs/tools/misc/ttyplot/default.nix4
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix8
-rw-r--r--pkgs/tools/misc/youtube-dl/default.nix4
-rw-r--r--pkgs/tools/networking/axel/default.nix6
-rw-r--r--pkgs/tools/networking/i2pd/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/security/signing-party/default.nix30
-rw-r--r--pkgs/tools/security/tboot/default.nix4
-rw-r--r--pkgs/tools/security/vault/default.nix4
-rw-r--r--pkgs/tools/security/yara/default.nix4
-rw-r--r--pkgs/tools/system/stress-ng/default.nix50
-rw-r--r--pkgs/top-level/all-packages.nix40
-rw-r--r--pkgs/top-level/php-packages.nix4
-rw-r--r--pkgs/top-level/python-packages.nix2
-rw-r--r--pkgs/top-level/release-cross.nix2
307 files changed, 3521 insertions, 1494 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9679b4b3646..73858c179b7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4967,6 +4967,11 @@
     github = "ctheune";
     name = "Christian Theune";
   };
+  thiagokokada = {
+    email = "thiagokokada@gmail.com";
+    github = "thiagokokada";
+    name = "Thiago K. Okada";
+  };
   ThomasMader = {
     email = "thomas.mader@gmail.com";
     github = "ThomasMader";
diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
index 7a42b0803be..5fca39aa2e2 100644
--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@@ -54,9 +54,7 @@ in
       default = "libc";
       description = ''
         The system-wide memory allocator.
-        </para>
 
-        <para>
         Briefly, the system-wide memory allocator providers are:
         <itemizedlist>
         <listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem>
@@ -64,7 +62,6 @@ in
             (name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>")
             providers)}
         </itemizedlist>
-        </para>
 
         <warning>
         <para>
@@ -79,8 +76,6 @@ in
         Changing this option does not affect the current session.
         </para>
         </note>
-
-        <para>
       '';
     };
   };
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 70807ccf7cd..aa3d120c97f 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -234,6 +234,9 @@ with lib;
     (mkRenamedOptionModule [ "hardware" "ckb" "enable" ] [ "hardware" "ckb-next" "enable" ])
     (mkRenamedOptionModule [ "hardware" "ckb" "package" ] [ "hardware" "ckb-next" "package" ])
 
+    # binfmt
+    (mkRenamedOptionModule [ "boot" "binfmtMiscRegistrations" ] [ "boot" "binfmt" "registrations" ])
+
   ] ++ (flip map [ "blackboxExporter" "collectdExporter" "fritzboxExporter"
                    "jsonExporter" "minioExporter" "nginxExporter" "nodeExporter"
                    "snmpExporter" "unifiExporter" "varnishExporter" ]
diff --git a/nixos/modules/security/misc.nix b/nixos/modules/security/misc.nix
index ecf22bf81c5..bf474ac0a54 100644
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@@ -13,23 +13,17 @@ with lib;
       default = true;
       description = ''
         Whether to allow creation of user namespaces.
-        </para>
 
-        <para>
         The motivation for disabling user namespaces is the potential
         presence of code paths where the kernel's permission checking
         logic fails to account for namespacing, instead permitting a
         namespaced process to act outside the namespace with the same
         privileges as it would have inside it.  This is particularly
         damaging in the common case of running as root within the namespace.
-        </para>
 
-        <para>
         When user namespace creation is disallowed, attempting to create a
         user namespace fails with "no space left on device" (ENOSPC).
         root may re-enable user namespace creation at runtime.
-        </para>
-        <para>
       '';
     };
 
@@ -48,21 +42,15 @@ with lib;
         Whether to allow SMT/hyperthreading.  Disabling SMT means that only
         physical CPU cores will be usable at runtime, potentially at
         significant performance cost.
-        </para>
 
-        <para>
         The primary motivation for disabling SMT is to mitigate the risk of
         leaking data between threads running on the same CPU core (due to
         e.g., shared caches).  This attack vector is unproven.
-        </para>
 
-        <para>
         Disabling SMT is a supplement to the L1 data cache flushing mitigation
         (see <xref linkend="opt-security.virtualization.flushL1DataCache"/>)
         versus malicious VM guests (SMT could "bring back" previously flushed
         data).
-        </para>
-        <para>
       '';
     };
 
@@ -73,10 +61,8 @@ with lib;
         Whether the hypervisor should flush the L1 data cache before
         entering guests.
         See also <xref linkend="opt-security.allowSimultaneousMultithreading"/>.
-        </para>
 
-        <para>
-          <variablelist>
+        <variablelist>
           <varlistentry>
             <term><literal>null</literal></term>
             <listitem><para>uses the kernel default</para></listitem>
@@ -98,7 +84,7 @@ with lib;
             enters the guest.  May incur significant performance cost.
             </para></listitem>
           </varlistentry>
-          </variablelist>
+        </variablelist>
       '';
     };
   };
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index 11b6215794e..9c4c5545e35 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -7,28 +7,23 @@ let
 
   planDescription = ''
       The znapzend backup plan to use for the source.
-    </para>
-    <para>
+
       The plan specifies how often to backup and for how long to keep the
       backups. It consists of a series of retention periodes to interval
       associations:
-    </para>
-    <para>
+
       <literal>
         retA=>intA,retB=>intB,...
       </literal>
-    </para>
-    <para>
-    Both intervals and retention periods are expressed in standard units
-    of time or multiples of them. You can use both the full name or a
-    shortcut according to the following listing:
-    </para>
-    <para>
+
+      Both intervals and retention periods are expressed in standard units
+      of time or multiples of them. You can use both the full name or a
+      shortcut according to the following listing:
+
       <literal>
         second|sec|s, minute|min, hour|h, day|d, week|w, month|mon|m, year|y
       </literal>
-    </para>
-    <para>
+
       See <citerefentry><refentrytitle>znapzendzetup</refentrytitle><manvolnum>1</manvolnum></citerefentry> for more info.
   '';
   planExample = "1h=>10min,1d=>1h,1w=>1d,1m=>1w,1y=>1m";
@@ -139,12 +134,10 @@ let
           type = nullOr ints.u16;
           description = ''
               Port to use for <command>mbuffer</command>.
-            </para>
-            <para>
+
               If this is null, it will run <command>mbuffer</command> through
               ssh.
-            </para>
-            <para>
+
               If this is not null, it will run <command>mbuffer</command>
               directly through TCP, which is not encrypted but faster. In that
               case the given port needs to be open on the destination host.
diff --git a/nixos/modules/services/security/fprintd.nix b/nixos/modules/services/security/fprintd.nix
index a35b065ba81..9ed7f2a2efd 100644
--- a/nixos/modules/services/security/fprintd.nix
+++ b/nixos/modules/services/security/fprintd.nix
@@ -26,28 +26,20 @@ in
       };
 
     };
-    
+
   };
-  
-  
+
+
   ###### implementation
-  
+
   config = mkIf cfg.enable {
 
     services.dbus.packages = [ pkgs.fprintd ];
 
     environment.systemPackages = [ pkgs.fprintd ];
 
-    systemd.services.fprintd = {
-      description = "Fingerprint Authentication Daemon";
-
-      serviceConfig = {
-        Type = "dbus";
-        BusName = "net.reactivated.Fprint";
-        ExecStart = "${pkgs.fprintd}/libexec/fprintd";
-      };
-    };
+    systemd.packages = [ pkgs.fprintd ];
 
   };
-  
+
 }
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
index 15e84dc021e..d6c0f050486 100644
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   inherit (lib) mkOption types optionalString;
 
-  cfg = config.boot.binfmtMiscRegistrations;
+  cfg = config.boot.binfmt;
 
   makeBinfmtLine = name: { recognitionType, offset, magicOrExtension
                          , mask, preserveArgvZero, openBinary
@@ -13,125 +13,249 @@ let
     mask' = toString mask;
     interpreter = "/run/binfmt/${name}";
     flags = if !(matchCredentials -> openBinary)
-              then throw "boot.binfmtMiscRegistrations.${name}: you can't specify openBinary = false when matchCredentials = true."
+              then throw "boot.binfmt.registrations.${name}: you can't specify openBinary = false when matchCredentials = true."
             else optionalString preserveArgvZero "P" +
                  optionalString (openBinary && !matchCredentials) "O" +
                  optionalString matchCredentials "C" +
                  optionalString fixBinary "F";
   in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}";
 
-  binfmtFile = builtins.toFile "binfmt_nixos.conf"
-    (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine cfg));
-
   activationSnippet = name: { interpreter, ... }:
     "ln -sf ${interpreter} /run/binfmt/${name}";
-  activationScript = ''
-    mkdir -p -m 0755 /run/binfmt
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList activationSnippet cfg)}
-  '';
+
+  getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;
+
+  # Mapping of systems to “magicOrExtension” and “mask”. Mostly taken from:
+  # - https://github.com/cleverca22/nixos-configs/blob/master/qemu.nix
+  # and
+  # - https://github.com/qemu/qemu/blob/master/scripts/qemu-binfmt-conf.sh
+  # TODO: maybe put these in a JSON file?
+  magics = {
+    armv6l-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\x00\xff\xfe\xff\xff\xff'';
+    };
+    armv7l-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\x00\xff\xfe\xff\xff\xff'';
+    };
+    aarch64-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\x00\xff\xfe\xff\xff\xff'';
+    };
+    aarch64_be-linux = {
+      magicOrExtension = ''\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    i386-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    i486-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x06\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    i586-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x06\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    i686-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x06\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    x86_64-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    alpha-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x26\x90'';
+      mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    sparc64-linux = {
+      magicOrExtension = ''\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    sparc-linux = {
+      magicOrExtension = ''\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x12'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    powerpc-linux = {
+      magicOrExtension = ''\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x14'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    powerpc64-linux = {
+      magicOrExtension = ''\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x15'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    powerpc64le-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x15\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\x00'';
+    };
+    mips-linux = {
+      magicOrExtension = ''\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    mipsel-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    mips64-linux = {
+      magicOrExtension = ''\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'';
+    };
+    mips64el-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    riscv32-linux = {
+      magicOrExtension = ''\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    riscv64-linux = {
+      magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00'';
+      mask = ''\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+    };
+    x86_64-windows = {
+      magicOrExtension = ".exe";
+      recognitionType = "extension";
+    };
+    i686-windows = {
+      magicOrExtension = ".exe";
+      recognitionType = "extension";
+    };
+  };
+
 in {
   options = {
-    boot.binfmtMiscRegistrations = mkOption {
-      default = {};
-
-      description = ''
-        Extra binary formats to register with the kernel.
-        See https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html for more details.
-      '';
-
-      type = types.attrsOf (types.submodule ({ config, ... }: {
-        options = {
-          recognitionType = mkOption {
-            default = "magic";
-            description = "Whether to recognize executables by magic number or extension.";
-            type = types.enum [ "magic" "extension" ];
-          };
+    boot.binfmt = {
+      registrations = mkOption {
+        default = {};
 
-          offset = mkOption {
-            default = null;
-            description = "The byte offset of the magic number used for recognition.";
-            type = types.nullOr types.int;
-          };
+        description = ''
+          Extra binary formats to register with the kernel.
+          See https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html for more details.
+        '';
 
-          magicOrExtension = mkOption {
-            description = "The magic number or extension to match on.";
-            type = types.str;
-          };
+        type = types.attrsOf (types.submodule ({ config, ... }: {
+          options = {
+            recognitionType = mkOption {
+              default = "magic";
+              description = "Whether to recognize executables by magic number or extension.";
+              type = types.enum [ "magic" "extension" ];
+            };
 
-          mask = mkOption {
-            default = null;
-            description =
-              "A mask to be ANDed with the byte sequence of the file before matching";
-            type = types.nullOr types.str;
-          };
+            offset = mkOption {
+              default = null;
+              description = "The byte offset of the magic number used for recognition.";
+              type = types.nullOr types.int;
+            };
 
-          interpreter = mkOption {
-            description = ''
-              The interpreter to invoke to run the program.
+            magicOrExtension = mkOption {
+              description = "The magic number or extension to match on.";
+              type = types.str;
+            };
 
-              Note that the actual registration will point to
-              /run/binfmt/''${name}, so the kernel interpreter length
-              limit doesn't apply.
-            '';
-            type = types.path;
-          };
+            mask = mkOption {
+              default = null;
+              description =
+                "A mask to be ANDed with the byte sequence of the file before matching";
+              type = types.nullOr types.str;
+            };
 
-          preserveArgvZero = mkOption {
-            default = false;
-            description = ''
-              Whether to pass the original argv[0] to the interpreter.
+            interpreter = mkOption {
+              description = ''
+                The interpreter to invoke to run the program.
 
-              See the description of the 'P' flag in the kernel docs
-              for more details;
-            '';
-            type = types.bool;
-          };
+                Note that the actual registration will point to
+                /run/binfmt/''${name}, so the kernel interpreter length
+                limit doesn't apply.
+              '';
+              type = types.path;
+            };
 
-          openBinary = mkOption {
-            default = config.matchCredentials;
-            description = ''
-              Whether to pass the binary to the interpreter as an open
-              file descriptor, instead of a path.
-            '';
-            type = types.bool;
-          };
+            preserveArgvZero = mkOption {
+              default = false;
+              description = ''
+                Whether to pass the original argv[0] to the interpreter.
 
-          matchCredentials = mkOption {
-            default = false;
-            description = ''
-              Whether to launch with the credentials and security
-              token of the binary, not the interpreter (e.g. setuid
-              bit).
+                See the description of the 'P' flag in the kernel docs
+                for more details;
+              '';
+              type = types.bool;
+            };
 
-              See the description of the 'C' flag in the kernel docs
-              for more details.
+            openBinary = mkOption {
+              default = config.matchCredentials;
+              description = ''
+                Whether to pass the binary to the interpreter as an open
+                file descriptor, instead of a path.
+              '';
+              type = types.bool;
+            };
 
-              Implies/requires openBinary = true.
-            '';
-            type = types.bool;
-          };
+            matchCredentials = mkOption {
+              default = false;
+              description = ''
+                Whether to launch with the credentials and security
+                token of the binary, not the interpreter (e.g. setuid
+                bit).
 
-          fixBinary = mkOption {
-            default = false;
-            description = ''
-              Whether to open the interpreter file as soon as the
-              registration is loaded, rather than waiting for a
-              relevant file to be invoked.
-
-              See the description of the 'F' flag in the kernel docs
-              for more details.
-            '';
-            type = types.bool;
+                See the description of the 'C' flag in the kernel docs
+                for more details.
+
+                Implies/requires openBinary = true.
+              '';
+              type = types.bool;
+            };
+
+            fixBinary = mkOption {
+              default = false;
+              description = ''
+                Whether to open the interpreter file as soon as the
+                registration is loaded, rather than waiting for a
+                relevant file to be invoked.
+
+                See the description of the 'F' flag in the kernel docs
+                for more details.
+              '';
+              type = types.bool;
+            };
           };
-        };
-      }));
+        }));
+      };
+
+      emulatedSystems = mkOption {
+        default = [];
+        description = ''
+          List of systems to emulate. Will also configure Nix to
+          support your new systems.
+        '';
+        type = types.listOf types.string;
+      };
     };
   };
 
-  config = lib.mkIf (cfg != {}) {
-    environment.etc."binfmt.d/nixos.conf".source = binfmtFile;
-    system.activationScripts.binfmt = activationScript;
-    systemd.additionalUpstreamSystemUnits =
+  config = {
+    boot.binfmt.registrations = builtins.listToAttrs (map (system: {
+      name = system;
+      value = {
+        interpreter = getEmulator system;
+      } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}"));
+    }) cfg.emulatedSystems);
+    # TODO: add a nix.extraPlatforms option to NixOS!
+    nix.extraOptions = lib.mkIf (cfg.emulatedSystems != []) ''
+      extra-platforms = ${toString (cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux")}
+    '';
+    nix.sandboxPaths = lib.mkIf (cfg.emulatedSystems != [])
+      ([ "/run/binfmt" ] ++ (map (system: dirOf (dirOf (getEmulator system))) cfg.emulatedSystems));
+
+    environment.etc."binfmt.d/nixos.conf".source = builtins.toFile "binfmt_nixos.conf"
+      (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine config.boot.binfmt.registrations));
+    system.activationScripts.binfmt = ''
+      mkdir -p -m 0755 /run/binfmt
+      ${lib.concatStringsSep "\n" (lib.mapAttrsToList activationSnippet config.boot.binfmt.registrations)}
+    '';
+    systemd.additionalUpstreamSystemUnits = lib.mkIf (config.boot.binfmt.registrations != {})
       [ "proc-sys-fs-binfmt_misc.automount"
         "proc-sys-fs-binfmt_misc.mount"
       ];
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 9ad2a2779e1..03a5fece82e 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -62,8 +62,7 @@ in {
 
       description = ''
         The resolution of the console. The following values are valid:
-        </para>
-        <para>
+
         <itemizedlist>
           <listitem><para>
             <literal>"0"</literal>: Standard UEFI 80x25 mode
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 3841074f043..9dcb683eff4 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -76,6 +76,33 @@ let
         fi
         return 0
     }
+
+    wait_gpgcard() {
+        local secs="''${1:-10}"
+
+        gpg --card-status > /dev/null 2> /dev/null
+        if [ $? != 0 ]; then
+            echo -n "Waiting $secs seconds for GPG Card to appear"
+            local success=false
+            for try in $(seq $secs); do
+                echo -n .
+                sleep 1
+                gpg --card-status > /dev/null 2> /dev/null
+                if [ $? == 0 ]; then
+                    success=true
+                    break
+                fi
+            done
+            if [ $success == true ]; then
+                echo " - success";
+                return 0
+            else
+                echo " - failure";
+                return 1
+            fi
+        fi
+        return 0
+    }
   '';
 
   preCommands = ''
@@ -93,6 +120,13 @@ let
     # For Yubikey salt storage
     mkdir -p /crypt-storage
 
+    ${optionalString luks.gpgSupport ''
+    export GPG_TTY=$(tty)
+    export GNUPGHOME=/crypt-ramfs/.gnupg
+
+    gpg-agent --daemon --scdaemon-program $out/bin/scdaemon > /dev/null 2> /dev/null
+    ''}
+        
     # Disable all input echo for the whole stage. We could use read -s
     # instead but that would ocasionally leak characters between read
     # invocations.
@@ -105,7 +139,7 @@ let
     umount /crypt-ramfs 2>/dev/null
   '';
 
-  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, fallbackToPassword, ... }: assert name' == name;
+  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fallbackToPassword, ... }: assert name' == name;
   let
     csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
     cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
@@ -182,7 +216,7 @@ let
         ''}
     }
 
-    ${if luks.yubikeySupport && (yubikey != null) then ''
+    ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
     # Yubikey
     rbtohex() {
         ( od -An -vtx1 | tr -d ' \n' )
@@ -278,7 +312,7 @@ let
         umount /crypt-storage
     }
 
-    open_yubikey() {
+    open_with_hardware() {
         if wait_yubikey ${toString yubikey.gracePeriod}; then
             do_open_yubikey
         else
@@ -286,8 +320,75 @@ let
             open_normally
         fi
     }
+    ''}
 
-    open_yubikey
+    ${optionalString (luks.gpgSupport && (gpgCard != null)) ''
+
+    do_open_gpg_card() {
+        # Make all of these local to this function
+        # to prevent their values being leaked
+        local pin
+        local opened
+
+        gpg --import /gpg-keys/${device}/pubkey.asc > /dev/null 2> /dev/null
+
+        gpg --card-status > /dev/null 2> /dev/null
+
+        for try in $(seq 3); do
+            echo -n "PIN for GPG Card associated with device ${device}: "
+            pin=
+            while true; do
+                if [ -e /crypt-ramfs/passphrase ]; then
+                    echo "reused"
+                    pin=$(cat /crypt-ramfs/passphrase)
+                    break
+                else
+                    # and try reading it from /dev/console with a timeout
+                    IFS= read -t 1 -r pin
+                    if [ -n "$pin" ]; then
+                       ${if luks.reusePassphrases then ''
+                         # remember it for the next device
+                         echo -n "$pin" > /crypt-ramfs/passphrase
+                       '' else ''
+                         # Don't save it to ramfs. We are very paranoid
+                       ''}
+                       echo
+                       break
+                    fi
+                fi
+            done
+            echo -n "Verifying passphrase for ${device}..."
+            echo -n "$pin" | gpg -q --batch --passphrase-fd 0 --pinentry-mode loopback -d /gpg-keys/${device}/cryptkey.gpg 2> /dev/null | ${csopen} --key-file=- > /dev/null 2> /dev/null
+            if [ $? == 0 ]; then
+                echo " - success"
+                ${if luks.reusePassphrases then ''
+                  # we don't rm here because we might reuse it for the next device
+                '' else ''
+                  rm -f /crypt-ramfs/passphrase
+                ''}
+                break
+            else
+                echo " - failure"
+                # ask for a different one
+                rm -f /crypt-ramfs/passphrase
+            fi
+        done
+
+        [ "$opened" == false ] && die "Maximum authentication errors reached"
+    }
+
+    open_with_hardware() {
+        if wait_gpgcard ${toString gpgCard.gracePeriod}; then
+            do_open_gpg_card
+        else
+            echo "No GPG Card found, falling back to normal open procedure"
+            open_normally
+        fi
+    }
+    ''}
+
+    ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) then ''
+    open_with_hardware
     '' else ''
     open_normally
     ''}
@@ -473,6 +574,36 @@ in
             '';
           };
 
+          gpgCard = mkOption {
+            default = null;
+            description = ''
+              The option to use this LUKS device with a GPG encrypted luks password by the GPG Smartcard.
+              If null (the default), GPG-Smartcard will be disabled for this device.
+            '';
+
+            type = with types; nullOr (submodule {
+              options = {
+                gracePeriod = mkOption {
+                  default = 10;
+                  type = types.int;
+                  description = "Time in seconds to wait for the GPG Smartcard.";
+                };
+
+                encryptedPass = mkOption {
+                  default = "";
+                  type = types.path;
+                  description = "Path to the GPG encrypted passphrase.";
+                };
+
+                publicKey = mkOption {
+                  default = "";
+                  type = types.path;
+                  description = "Path to the Public Key.";
+                };
+              };
+            });
+          };
+
           yubikey = mkOption {
             default = null;
             description = ''
@@ -554,6 +685,14 @@ in
       }));
     };
 
+    boot.initrd.luks.gpgSupport = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Enables support for authenticating with a GPG encrypted password.
+      '';
+    };
+
     boot.initrd.luks.yubikeySupport = mkOption {
       default = false;
       type = types.bool;
@@ -567,6 +706,12 @@ in
 
   config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {
 
+    assertions =
+      [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
+          message = "Yubikey and GPG Card may not be used at the same time.";
+        }
+      ];
+
     # actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
     boot.blacklistedKernelModules = optionals luks.mitigateDMAAttacks
       ["firewire_ohci" "firewire_core" "firewire_sbp2"];
@@ -603,6 +748,23 @@ in
         EOF
         chmod +x $out/bin/openssl-wrap
       ''}
+
+      ${optionalString luks.gpgSupport ''
+        copy_bin_and_libs ${pkgs.gnupg}/bin/gpg
+        copy_bin_and_libs ${pkgs.gnupg}/bin/gpg-agent
+        copy_bin_and_libs ${pkgs.gnupg}/libexec/scdaemon
+
+        ${concatMapStringsSep "\n" (x:
+          if x.gpgCard != null then
+            ''
+              mkdir -p $out/secrets/gpg-keys/${x.device}
+              cp -a ${x.gpgCard.encryptedPass} $out/secrets/gpg-keys/${x.device}/cryptkey.gpg
+              cp -a ${x.gpgCard.publicKey} $out/secrets/gpg-keys/${x.device}/pubkey.asc
+            ''
+          else ""
+          ) (attrValues luks.devices)
+        }
+      ''}
     '';
 
     boot.initrd.extraUtilsCommandsTest = ''
@@ -612,6 +774,11 @@ in
         $out/bin/ykinfo -V
         $out/bin/openssl-wrap version
       ''}
+      ${optionalString luks.gpgSupport ''
+        $out/bin/gpg --version
+        $out/bin/gpg-agent --version
+        $out/bin/scdaemon --version
+      ''}
     '';
 
     boot.initrd.preFailCommands = postCommands;
diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index fc68904ae08..5c66cf4a6e6 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -35,7 +35,7 @@ in
         when resolving single-label host names (domain names which
         contain no dot), in order to qualify them into fully-qualified
         domain names (FQDNs).
-        </para><para>
+
         For compatibility reasons, if this setting is not specified,
         the search domains listed in
         <filename>/etc/resolv.conf</filename> are used instead, if
@@ -50,8 +50,9 @@ in
       description = ''
         Controls Link-Local Multicast Name Resolution support
         (RFC 4795) on the local host.
-        </para><para>
+
         If set to
+
         <variablelist>
         <varlistentry>
           <term><literal>"true"</literal></term>
diff --git a/nixos/modules/virtualisation/docker-containers.nix b/nixos/modules/virtualisation/docker-containers.nix
index c4e47bfa477..c1f0ba303e3 100644
--- a/nixos/modules/virtualisation/docker-containers.nix
+++ b/nixos/modules/virtualisation/docker-containers.nix
@@ -65,10 +65,9 @@ let
           default = [];
           description = ''
             Network ports to publish from the container to the outer host.
-            </para>
-            <para>
+
             Valid formats:
-            </para>
+
             <itemizedlist>
               <listitem>
                 <para>
@@ -91,21 +90,19 @@ let
                 </para>
               </listitem>
             </itemizedlist>
-            <para>
+
             Both <literal>hostPort</literal> and
             <literal>containerPort</literal> can be specified as a range of
             ports.  When specifying ranges for both, the number of container
             ports in the range must match the number of host ports in the
             range.  Example: <literal>1234-1236:1234-1236/tcp</literal>
-            </para>
-            <para>
+
             When specifying a range for <literal>hostPort</literal> only, the
             <literal>containerPort</literal> must <emphasis>not</emphasis> be a
             range.  In this case, the container port is published somewhere
             within the specified <literal>hostPort</literal> range.  Example:
             <literal>1234-1236:1234/tcp</literal>
-            </para>
-            <para>
+
             Refer to the
             <link xlink:href="https://docs.docker.com/engine/reference/run/#expose-incoming-ports">
             Docker engine documentation</link> for full details.
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index 502b537ed68..f91121077ea 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -67,5 +67,12 @@ import ./make-test.nix ({ pkgs, ... }: {
       # Ensure building an image on top of a layered Docker images work
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.layered-on-top}'");
       $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.layered-on-top.imageName}");
+
+      # Ensure order of layers is correct
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.layersOrder}'");
+      $docker->succeed("docker run --rm  ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer1 | grep -q layer1");
+      # This is to be sure the order of layers of the parent image is preserved
+      $docker->succeed("docker run --rm  ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer2 | grep -q layer2");
+      $docker->succeed("docker run --rm  ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer3 | grep -q layer3");
     '';
 })
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index eab498b9624..490f8639d38 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -29,17 +29,17 @@
 # handle that.
 
 stdenv.mkDerivation rec {
-  name = "qmmp-1.3.1";
+  name = "qmmp-1.3.2";
 
   src = fetchurl {
     url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "1dmybzibpr6hpr2iv1wvrjgww842mng2x0rh1mr8gs8j191xvlhw";
+    sha256 = "1rh063kcyg7gs9yj2r4v5irpnq4pjaxaxsgrw30mdr21xhhc15cz";
   };
 
+  nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
     [ # basic requirements
-      cmake pkgconfig xlibsWrapper
-      qtbase qttools qtmultimedia qtx11extras
+      qtbase qttools qtmultimedia qtx11extras xlibsWrapper
       # transports
       curl libmms
       # input plugins
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index 27533084804..15935751c32 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -72,8 +72,9 @@ with stdenv.lib; stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Open-source virtual modular synthesizer";
     homepage = http://vcvrack.com/;
-    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or unfree
-    license = [ licenses.bsd3 licenses.cc-by-nc-40 licenses.unfree ];
+    # The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or under a
+    # no-derivatives clause
+    license = with licenses; [ bsd3 cc-by-nc-40 unfreeRedistributable ];
     maintainers = with maintainers; [ moredread ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index bce2e882698..5922206a8b9 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, qt5, libsForQt5
 , bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
-, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext
+, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext, freetype, fontconfig
 }:
 
 stdenv.mkDerivation rec {
@@ -18,11 +18,13 @@ stdenv.mkDerivation rec {
     sha256 = "1y63yqyd0v255liik4ff5ak6mj86d8d76w436x76hs5dk6jgpmfb";
   };
 
+  nativeBuildInputs = [ bison flex pkgconfig ];
+
   buildInputs = [
-    bison flex eigen boost libGLU_combined glew opencsg cgal mpfr gmp glib
-    pkgconfig harfbuzz gettext
-  ]
-    ++ (with qt5; [qtbase qmake])
+    eigen boost glew opencsg cgal mpfr gmp glib
+    harfbuzz gettext freetype fontconfig
+  ] ++ stdenv.lib.optional stdenv.isLinux libGLU_combined
+    ++ (with qt5; [qtbase qmake] ++ stdenv.lib.optional stdenv.isDarwin qtmacextras)
     ++ (with libsForQt5; [qscintilla])
   ;
 
@@ -33,6 +35,17 @@ stdenv.mkDerivation rec {
 
   doCheck = false;
 
+  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/*.app $out/Applications
+    rmdir $out/bin || true
+
+    mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
+      $out/share/openscad/{examples,color-schemes,locale,libraries,fonts}
+
+    rmdir $out/share/openscad
+  '';
+
   meta = {
     description = "3D parametric model compiler";
     longDescription = ''
@@ -48,7 +61,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://openscad.org/;
     license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
     maintainers = with stdenv.lib.maintainers;
       [ bjornfor raskin the-kenny ];
   };
diff --git a/pkgs/applications/kde/kgpg.nix b/pkgs/applications/kde/kgpg.nix
index 33813f376a5..944cff47e0d 100644
--- a/pkgs/applications/kde/kgpg.nix
+++ b/pkgs/applications/kde/kgpg.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools, ki18n, makeWrapper,
-  akonadi-contacts, gnupg1, karchive, kcodecs, kcontacts, kcoreaddons,
+  akonadi-contacts, gnupg, karchive, kcodecs, kcontacts, kcoreaddons,
   kcrash, kdbusaddons, kiconthemes, kjobwidgets, kio, knotifications, kservice,
   ktextwidgets, kxmlgui, kwidgetsaddons, kwindowsystem, qgpgme,
 }:
@@ -10,12 +10,12 @@ mkDerivation {
   name = "kgpg";
   nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];
   buildInputs = [
-    akonadi-contacts gnupg1 karchive kcodecs kcontacts kcoreaddons kcrash
+    akonadi-contacts gnupg karchive kcodecs kcontacts kcoreaddons kcrash
     kdbusaddons ki18n kiconthemes kjobwidgets kio knotifications kservice
     ktextwidgets kxmlgui kwidgetsaddons kwindowsystem qgpgme
   ];
   postFixup = ''
-    wrapProgram "$out/bin/kgpg" --prefix PATH : "${lib.makeBinPath [ gnupg1 ]}"
+    wrapProgram "$out/bin/kgpg" --prefix PATH : "${lib.makeBinPath [ gnupg ]}"
   '';
   meta = {
     license = [ lib.licenses.gpl2 ];
diff --git a/pkgs/applications/misc/bemenu/default.nix b/pkgs/applications/misc/bemenu/default.nix
new file mode 100644
index 00000000000..89c32668be9
--- /dev/null
+++ b/pkgs/applications/misc/bemenu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, cairo, cmake, libxkbcommon
+, pango, fribidi, harfbuzz, pcre, pkgconfig
+, ncursesSupport ? true, ncurses ? null
+, waylandSupport ? true, wayland ? null
+, x11Support ? true, xlibs ? null, xorg ? null
+}:
+
+assert ncursesSupport -> ncurses != null;
+assert waylandSupport -> wayland != null;
+assert x11Support -> xlibs != null && xorg != null;
+
+stdenv.mkDerivation rec {
+  pname = "bemenu";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cloudef";
+    repo = "bemenu";
+    rev = "33e540a2b04ce78f5c7ab4a60b899c67f586cc32";
+    sha256 = "11h55m9dx6ai12pqij52ydjm36dvrcc856pa834njihrp626pl4w";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig pcre ];
+
+  buildInputs = with stdenv.lib; [
+    cairo
+    fribidi
+    harfbuzz
+    libxkbcommon
+    pango
+  ] ++ optionals ncursesSupport [ ncurses ]
+    ++ optionals waylandSupport [ wayland ]
+    ++ optionals x11Support [
+      xlibs.libX11 xlibs.libXinerama xlibs.libXft
+      xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
+    ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/Cloudef/bemenu";
+    description = "Dynamic menu library and client program inspired by dmenu";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 6185b7d228f..9cabd6dda7c 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -3,16 +3,6 @@
 let
   version = "3.3.5";
 
-  qdarkstyle = python3Packages.buildPythonPackage rec {
-    pname = "QDarkStyle";
-    version = "2.5.4";
-    src = python3Packages.fetchPypi {
-      inherit pname version;
-      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
-    };
-    doCheck = false; # no tests
-  };
-
   # Not provided in official source releases, which are what upstream signs.
   tests = fetchFromGitHub {
     owner = "spesmilo";
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index 0049e9aca75..bf29e05db1b 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -57,7 +57,28 @@ stdenv.mkDerivation rec {
       prePatch = ''
         cp ${src}/leptonica_mod/{allheaders.h,dewarp2.c,leptwin.c} src/
       '';
-      patches = [];
+      patches = [
+        # stripped down copy of upstream commit b88c821f8d347bce0aea86d606c710303919f3d2
+        ./leptonica-CVE-2018-3836.patch
+        (fetchpatch {
+          # CVE-2018-7186
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "ee301cb2029db8a6289c5295daa42bba7715e99a.patch";
+          sha256 = "0cgb7mvz2px1rg5i80wk1wxxjvzjga617d8q6j7qygkp7jm6495d";
+        })
+        (fetchpatch {
+          # CVE-2018-7247
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "c1079bb8e77cdd426759e466729917ca37a3ed9f.patch";
+          sha256 = "1z4iac5gwqggh7aa8cvyp6nl9fwd1v7wif26caxc9y5qr3jj34qf";
+        })
+        (fetchpatch {
+          # CVE-2018-7440
+          url = "https://github.com/DanBloomberg/leptonica/commit/"
+              + "49ecb6c2dfd6ed5078c62f4a8eeff03e3beced3b.patch";
+          sha256 = "1hjmva98iaw9xj7prg7aimykyayikcwnk4hk0380007hqb35lqmy";
+        })
+      ];
     });
     tesseract_modded = tesseract4.override {
       tesseractBase = tesseract4.tesseractBase.overrideAttrs (_: {
diff --git a/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
new file mode 100644
index 00000000000..f1b4170fbaa
--- /dev/null
+++ b/pkgs/applications/misc/k2pdfopt/leptonica-CVE-2018-3836.patch
@@ -0,0 +1,95 @@
+--- a/src/allheaders.h
++++ b/src/allheaders.h
+@@ -2600,6 +2600,7 @@
+ LEPT_DLL extern char * stringReverse ( const char *src );
+ LEPT_DLL extern char * strtokSafe ( char *cstr, const char *seps, char **psaveptr );
+ LEPT_DLL extern l_int32 stringSplitOnToken ( char *cstr, const char *seps, char **phead, char **ptail );
++LEPT_DLL extern l_int32 stringCheckForChars ( const char *src, const char *chars, l_int32 *pfound );
+ LEPT_DLL extern char * stringRemoveChars ( const char *src, const char *remchars );
+ LEPT_DLL extern l_int32 stringFindSubstr ( const char *src, const char *sub, l_int32 *ploc );
+ LEPT_DLL extern char * stringReplaceSubstr ( const char *src, const char *sub1, const char *sub2, l_int32 *pfound, l_int32 *ploc );
+--- a/src/gplot.c
++++ b/src/gplot.c
+@@ -141,9 +141,10 @@
+             const char  *xlabel,
+             const char  *ylabel)
+ {
+-char   *newroot;
+-char    buf[L_BUF_SIZE];
+-GPLOT  *gplot;
++char    *newroot;
++char     buf[L_BUF_SIZE];
++l_int32  badchar;
++GPLOT   *gplot;
+ 
+     PROCNAME("gplotCreate");
+ 
+@@ -152,6 +153,9 @@
+     if (outformat != GPLOT_PNG && outformat != GPLOT_PS &&
+         outformat != GPLOT_EPS && outformat != GPLOT_LATEX)
+         return (GPLOT *)ERROR_PTR("outformat invalid", procName, NULL);
++    stringCheckForChars(rootname, "`;&|><\"?*", &badchar);
++    if (badchar)  /* danger of command injection */
++        return (GPLOT *)ERROR_PTR("invalid rootname", procName, NULL);
+ 
+     if ((gplot = (GPLOT *)LEPT_CALLOC(1, sizeof(GPLOT))) == NULL)
+         return (GPLOT *)ERROR_PTR("gplot not made", procName, NULL);
+--- a/src/utils2.c
++++ b/src/utils2.c
+@@ -42,6 +42,7 @@
+  *           l_int32    stringSplitOnToken()
+  *
+  *       Find and replace string and array procs
++ *           l_int32    stringCheckForChars()
+  *           char      *stringRemoveChars()
+  *           l_int32    stringFindSubstr()
+  *           char      *stringReplaceSubstr()
+@@ -701,6 +702,48 @@
+ /*--------------------------------------------------------------------*
+  *                       Find and replace procs                       *
+  *--------------------------------------------------------------------*/
++/*!
++ * \brief   stringCheckForChars()
++ *
++ * \param[in]    src      input string; can be of zero length
++ * \param[in]    chars    string of chars to be searched for in %src
++ * \param[out]   pfound   1 if any characters are found; 0 otherwise
++ * \return  0 if OK, 1 on error
++ *
++ * <pre>
++ * Notes:
++ *      (1) This can be used to sanitize an operation by checking for
++ *          special characters that don't belong in a string.
++ * </pre>
++ */
++l_int32
++stringCheckForChars(const char  *src,
++                    const char  *chars,
++                    l_int32     *pfound)
++{
++char     ch;
++l_int32  i, n;
++
++    PROCNAME("stringCheckForChars");
++
++    if (!pfound)
++        return ERROR_INT("&found not defined", procName, 1);
++    *pfound = FALSE;
++    if (!src || !chars)
++        return ERROR_INT("src and chars not both defined", procName, 1);
++
++    n = strlen(src);
++    for (i = 0; i < n; i++) {
++        ch = src[i];
++        if (strchr(chars, ch)) {
++            *pfound = TRUE;
++            break;
++        }
++    }
++    return 0;
++}
++
++
+ /*!
+  * \brief   stringRemoveChars()
+  *
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
index 3edb48cc489..be70efba5ad 100644
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@@ -2,7 +2,7 @@
   harfbuzz, fontconfig, pkgconfig, ncurses, imagemagick, xsel,
   libstartup_notification, libX11, libXrandr, libXinerama, libXcursor,
   libxkbcommon, libXi, libXext, wayland-protocols, wayland,
-  which, dbus,
+  which, dbus, fetchpatch,
   Cocoa,
   CoreGraphics,
   Foundation,
@@ -67,6 +67,17 @@ buildPythonApplication rec {
       libstartup_notification = "${libstartup_notification}/lib/libstartup-notification-1.so";
     })
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      name = "macos-symlink-1";
+      url = https://github.com/kovidgoyal/kitty/commit/bdeec612667f6976109247fe1750b10dda9c24c0.patch;
+      sha256 = "1d18x260w059qag80kgb2cgi2h4rricvqhwpbrw79s8yxzs7jhxk";
+    })
+    (fetchpatch {
+      # fixup of previous patch
+      name = "macos-symlink-2";
+      url = https://github.com/kovidgoyal/kitty/commit/af2c9a49b1ad31e94242295d88598591623fbf11.patch;
+      sha256 = "0k3dmgbvmh66j8k3h8dw6la6ma6f20fng6jjypy982kxvracsnl5";
+    })
     ./macos-10.11.patch
     ./no-lto.patch
     ./no-werror.patch
@@ -84,7 +95,7 @@ buildPythonApplication rec {
     mkdir -p $out
     ${if stdenv.isDarwin then ''
     mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+    ln -s ../Applications/kitty.app/Contents/MacOS/kitty-deref-symlink "$out/bin/kitty"
     mkdir "$out/Applications"
     cp -r kitty.app "$out/Applications/kitty.app"
     '' else ''
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 76a0a574808..b8ed4c5ddbe 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -15,13 +15,26 @@ let
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
       (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
       (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
-      (mkOverride "jinja2"      "2.8.1"  "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m")
       (mkOverride "pylru"       "1.0.9"  "0b0pq0l7xv83dfsajsc49jcxzc99kb9jfx1a1dlx22hzcy962dvi")
       (mkOverride "sarge"       "0.1.4"  "08s8896973bz1gg0pkr592w6g4p6v47bkfvws5i91p9xf8b35yar")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
 
       # https://github.com/NixOS/nixpkgs/pull/58179#issuecomment-478605134
       (mkOverride "werkzeug"    "0.14.1" "c3fd7a7d41976d9f44db327260e263132466836cef6f91512889ed60ad26557c")
+
+      # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
+      # This old version does not have updated test config for pytest 4,
+      # and pypi tarball doesn't contain tests dir anyways.
+      (pself: psuper: {
+        jinja2 = psuper.jinja2.overridePythonAttrs (oldAttrs: rec {
+          version = "2.8.1";
+          src = oldAttrs.src.override {
+            inherit version;
+            sha256 = "14aqmhkc9rw5w0v311jhixdm6ym8vsm29dhyxyrjfqxljwx1yd1m";
+          };
+          doCheck = false;
+        });
+      })
     ]);
   };
 
@@ -69,7 +82,7 @@ in py.pkgs.buildPythonApplication rec {
     pylru pyyaml sarge feedparser netifaces click websocket_client
     scandir chainmap future dateutil futures wrapt monotonic emoji
     frozendict
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
   checkInputs = with py.pkgs; [ nose mock ddt ];
 
@@ -82,7 +95,7 @@ in py.pkgs.buildPythonApplication rec {
   '';
 
   checkPhase = ''
-    HOME=$(mktemp -d) nosetests
+    HOME=$(mktemp -d) nosetests ${lib.optionalString stdenv.isDarwin "--exclude=test_set_external_modification"}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index da09c123dcd..e5c096fd2ae 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -4,7 +4,7 @@
 , cabextract
 , gettext
 , glxinfo
-, gnupg1compat
+, gnupg
 , icoutils
 , imagemagick
 , netcat-gnu
@@ -32,7 +32,7 @@ let
       python2Packages.python
       gettext
       glxinfo
-      gnupg1compat
+      gnupg
       icoutils
       imagemagick
       netcat-gnu
diff --git a/pkgs/applications/misc/tilix/default.nix b/pkgs/applications/misc/tilix/default.nix
index ed9ae5ade9f..342eca0a6fd 100644
--- a/pkgs/applications/misc/tilix/default.nix
+++ b/pkgs/applications/misc/tilix/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tilix";
-  version = "1.9.0";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "gnunn1";
     repo = "tilix";
     rev = version;
-    sha256 = "1k8hqpq6bzmn06b4s8c257n37ghgp3fl7l9g6fy0giwk1x0ix735";
+    sha256 = "0mg9y4xd2pnv0smibg7dyy733jarvx6qpdqap3sj7fpyni0jvpph";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/tzupdate/default.nix b/pkgs/applications/misc/tzupdate/default.nix
index a5d2f206f3a..c887876634f 100644
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@@ -5,11 +5,11 @@ let
 in
 buildPythonApplication rec {
   pname = "tzupdate";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "085kp4v9ijhkfvr0r5rzn4z7nrkb2qig05j0bajb0gkgynwf8wnz";
+    sha256 = "1sc3z2bx2nhnxg82x0jy19pr8lw56chbr90c2lr11w495csqwhz7";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index f3258c0c711..6378cf1c068 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -32,15 +32,15 @@ stdenv.mkDerivation rec {
   ] ++ optional synctexSupport "-Dsynctex=enabled";
 
   nativeBuildInputs = [
-    meson ninja pkgconfig appstream-glib desktop-file-utils python3.pkgs.sphinx
+    meson ninja pkgconfig desktop-file-utils python3.pkgs.sphinx
     gettext makeWrapper libxml2
-  ];
+  ] ++ optional stdenv.isLinux appstream-glib;
 
   buildInputs = [
-    gtk girara libintl libseccomp
-    sqlite glib file librsvg
+    gtk girara libintl sqlite glib file librsvg
   ] ++ optional synctexSupport texlive.bin.core
-    ++ optional stdenv.isDarwin [ gtk-mac-integration ];
+    ++ optional stdenv.isLinux libseccomp
+    ++ optional stdenv.isDarwin gtk-mac-integration;
 
   meta = {
     homepage = https://pwmt.org/projects/zathura/;
diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix
index dfddfe7d91e..e3db15ca78d 100644
--- a/pkgs/applications/misc/zathura/default.nix
+++ b/pkgs/applications/misc/zathura/default.nix
@@ -1,5 +1,6 @@
 { config, pkgs
-, useMupdf ? config.zathura.useMupdf or true
+# zathura_pdf_mupdf fails to load _opj_create_decompress at runtime on Darwin (https://github.com/NixOS/nixpkgs/pull/61295#issue-277982980)
+, useMupdf ? config.zathura.useMupdf or (!pkgs.stdenv.isDarwin)
 , synctexSupport ? true }:
 
 let
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 709c1edb0b8..e2c08a00da2 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -21,9 +21,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     zathura_core girara mupdf cairo
-  ] ++ stdenv.lib.optional stdenv.isDarwin [
-    gtk-mac-integration
-  ];
+  ] ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 
   PKG_CONFIG_ZATHURA_PLUGINDIR= "lib/zathura";
 
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 81c493fedcf..9696c55bd86 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "4.1.5";
+  version = "4.1.6";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "09zcygaxfv9g6av0vsvlyzv4v65wvj766xyfx31yz5ig3xan6ak1";
+    sha256 = "1y9kv84sy5fg64wbl4xpm8qh0hjba7ibk045cazp0m736rjmxk8c";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index d58c4214d0e..7a5f389af24 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tixati-${version}";
-  version = "2.59";
+  version = "2.61";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "0vf5y9kj2g7psgdzv2r46jdh5krdps838ca4wwwxi0dd1mwa65my";
+    sha256 = "05f8lcsac2mr90bhk999qkj8wwd6igdl07389bqrd1ydjasacl2k";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 46869ecb24f..b9d973287d2 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -14,7 +14,8 @@ let
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
-  name = "wireshark-${variant}-${version}";
+  pname = "wireshark-${variant}";
+  inherit version;
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
@@ -24,7 +25,6 @@ in stdenv.mkDerivation {
 
   cmakeFlags = [
     "-DBUILD_wireshark=${if withQt then "ON" else "OFF"}"
-    "-DENABLE_QT5=${if withQt then "ON" else "OFF"}"
     "-DENABLE_APPLICATION_BUNDLE=${if withQt && stdenv.isDarwin then "ON" else "OFF"}"
   ];
 
@@ -95,6 +95,8 @@ in stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  dontFixCmake = true;
+
   shellHook = ''
     # to be able to run the resulting binary
     export WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 7cdc7341953..ccb346868a1 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -3,14 +3,14 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoPackage rec {
-      version = "1.1.1";
+      version = "1.1.3";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1nkc4ivc8mg9c1njqlkhb9i5f4c1via1rdqfbhwgkj86s6cnxrg7";
+        sha256 = "00jshqa0nkwj06bfq16p359ss6nl6h49s31hag79wl9gwkca38va";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";
diff --git a/pkgs/applications/science/biology/eggnog-mapper/default.nix b/pkgs/applications/science/biology/eggnog-mapper/default.nix
index a15425ec213..c9a9b55c31e 100644
--- a/pkgs/applications/science/biology/eggnog-mapper/default.nix
+++ b/pkgs/applications/science/biology/eggnog-mapper/default.nix
@@ -12,8 +12,8 @@ python27Packages.buildPythonApplication rec {
   };
 
   patches = (fetchpatch {
-    url = https://github.com/eggnogdb/eggnog-mapper/pull/125/commits/b7828e4c8c1c453e391aef050f06ff3f84ff9faf.patch;
-    sha256 = "0nz1a7ybm4j5c7vdm3annnxz9036iam2044hia341a0am9wydmzk";
+    url = "https://github.com/eggnogdb/eggnog-mapper/commit/6972f601ade85b65090efca747d2302acb58507f.patch";
+    sha256 = "0abnmn0bh11jihf5d3cggiild1ykawzv5f5fhb4cyyi8fvy4hcxf";
   });
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/logic/symbiyosys/default.nix b/pkgs/applications/science/logic/symbiyosys/default.nix
index f58c820d22b..8ba77159693 100644
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, yosys, python3 }:
+{ stdenv, fetchFromGitHub, yosys, bash, python3 }:
 
 stdenv.mkDerivation rec {
   name = "symbiyosys-${version}";
@@ -26,6 +26,9 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/sby \
       --replace "##yosys-sys-path##" \
                 "sys.path += [p + \"/share/yosys/python3/\" for p in [\"$out\", \"${yosys}\"]]"
+    substituteInPlace $out/share/yosys/python3/sby_core.py \
+      --replace "/bin/bash" \
+                "${bash}/bin/bash"
   '';
   meta = {
     description = "Tooling for Yosys-based verification flows";
diff --git a/pkgs/applications/science/math/cbc/default.nix b/pkgs/applications/science/math/cbc/default.nix
index 93aefbca216..d0857e2a517 100644
--- a/pkgs/applications/science/math/cbc/default.nix
+++ b/pkgs/applications/science/math/cbc/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, zlib, bzip2 }:
 
-stdenv.mkDerivation {
-  name = "cbc-2.9.9";
+stdenv.mkDerivation rec {
+  pname = "cbc";
+  version = "2.10.2";
 
   src = fetchurl {
-    url = "https://www.coin-or.org/download/source/Cbc/Cbc-2.9.9.tgz";
-    sha256 = "1w8axdzm05xf5y13c31w7rc5z6ywxqxiwafnxcq3p195kgj0915a";
+    url = "https://www.coin-or.org/download/source/Cbc/Cbc-${version}.tgz";
+    sha256 = "0frbxkh6nbh46kaxsx5bmzridgip3v7aq75l8yak5npiiq4jlwv3";
   };
 
   configureFlags = [ "-C" ];
@@ -23,6 +24,7 @@ stdenv.mkDerivation {
     license = lib.licenses.epl10;
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    broken = stdenv.isAarch64; # Missing <immintrin.h> after 2.10.0
     description = "A mixed integer programming solver";
   };
 }
diff --git a/pkgs/applications/science/math/pynac/default.nix b/pkgs/applications/science/math/pynac/default.nix
index f05700b1bd8..75a46bb182a 100644
--- a/pkgs/applications/science/math/pynac/default.nix
+++ b/pkgs/applications/science/math/pynac/default.nix
@@ -9,14 +9,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.24";
+  version = "0.7.25";
   pname = "pynac";
 
   src = fetchFromGitHub {
     owner = "pynac";
     repo = "pynac";
     rev = "pynac-${version}";
-    sha256 = "0i3qxww28576jim0abgkqy9mi2k0lfllgyx8xpfqsqb75ai970ik";
+    sha256 = "0nnifvg6kzx0lq6gz7znind8g30v3d2pjfwgsdiks3vv9kv9nbj3";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index fd50febb469..c9fd33312d7 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -1,41 +1,42 @@
-{stdenv, fetchgit, mercurial, makeWrapper, subversion}:
+{stdenv, fetchgit, mercurial, makeWrapper}:
 
-with stdenv.lib;
-stdenv.mkDerivation {
-  name = "fast-export";
+stdenv.mkDerivation rec {
+  pname = "fast-export";
+  version = "190107";
 
   src = fetchgit {
     url = git://repo.or.cz/fast-export.git;
-    rev = "d202200fd9daa75cdb37d4cf067d4ca00e269535";
-    sha256 = "0m4llsg9rx4sza1kf39kxsdvhi6y87a18wm5k19c5r2h3vpylwcc";
+    rev = "v${version}";
+    sha256 = "14azfps9jd5anivcvfwflgsvqdyy6gm9jy284kzx2ng9f7871d14";
   };
 
-  buildInputs = [mercurial.python mercurial makeWrapper subversion];
+  buildInputs = [mercurial.python mercurial makeWrapper];
 
-  dontBuild = true; # skip svn for now
-
-  # TODO also support svn stuff
-  # moving .py files into lib directory so that you can't pick the wrong file from PATH.
-  # This requires redefining ROOT
   installPhase = ''
-    sed -i "s@/usr/bin/env.*@$(type -p python)@" *.py
-    l=$out/libexec/git-fast-export
-    mkdir -p $out/{bin,doc/git-fast-export} $l
-    sed -i "s@ROOT=.*@ROOT=$l@" *.sh
-    mv *.sh $out/bin
-    mv *.py $l
-    for p in $out/bin/*.sh; do
-      wrapProgram $p \
-        --prefix PYTHONPATH : "$(echo ${mercurial}/lib/python*/site-packages):$(echo ${mercurial.python}/lib/python*/site-packages)${stdenv.lib.concatMapStrings (x: ":$(echo ${x}/lib/python*/site-packages)") mercurial.pythonPackages or []}" \
-        --prefix PATH : "$(dirname $(type -p python))":$l
+    binPath=$out/bin
+    libexecPath=$out/libexec/${pname}
+    sitepackagesPath=$out/${mercurial.python.sitePackages}
+    mkdir -p $binPath $libexecPath $sitepackagesPath
+
+    # Patch shell scripts so they can execute the Python scripts
+    sed -i "s|ROOT=.*|ROOT=$libexecPath|" *.sh
+
+    mv hg-fast-export.sh hg-reset.sh $binPath
+    mv hg-fast-export.py hg-reset.py $libexecPath
+    mv hg2git.py pluginloader plugins $sitepackagesPath
+
+    for script in $out/bin/*.sh; do
+      wrapProgram $script \
+        --prefix PATH : "${mercurial.python}/bin":$libexec \
+        --prefix PYTHONPATH : "${mercurial}/${mercurial.python.sitePackages}":$sitepackagesPath
     done
   '';
 
-  meta = {
-    description = "Import svn, mercurial into git";
+  meta = with stdenv.lib; {
+    description = "Import mercurial into git";
     homepage = https://repo.or.cz/w/fast-export.git;
     license = licenses.gpl2;
     maintainers = [ maintainers.koral ];
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
index 2163855d00e..6a39f1fe3d1 100644
--- a/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-crypt/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, git, gnupg1compat, makeWrapper, openssl, stdenv }:
+{ fetchFromGitHub, git, gnupg, makeWrapper, openssl, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "git-crypt-${version}";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     make install PREFIX=$out
-    wrapProgram $out/bin/* --prefix PATH : $out/bin:${git}/bin:${gnupg1compat}/bin
+    wrapProgram $out/bin/* --prefix PATH : $out/bin:${git}/bin:${gnupg}/bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix b/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
index 5a5b666b7cd..d1dce046979 100644
--- a/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-remote-gcrypt/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, docutils, makeWrapper
-, gnupg1compat, curl, rsync, coreutils
+, gnupg, curl, rsync, coreutils
 , gawk, gnused, gnugrep
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     prefix="$out" ./install.sh
     wrapProgram "$out/bin/git-remote-gcrypt" \
-      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg1compat curl rsync coreutils
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg curl rsync coreutils
                                                     gawk gnused gnugrep ]}"
   '';
 
diff --git a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
index 0ee188cc19d..34c367b20a4 100644
--- a/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, qmake, qtbase, qttools, subversion, apr }:
 
 let
-  version = "1.0.13";
+  version = "1.0.16";
 in
 stdenv.mkDerivation {
   name = "svn-all-fast-export-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     owner = "svn-all-fast-export";
     repo = "svn2git";
     rev = version;
-    sha256 = "0f1qj0c4cdq46mz54wcy17g7rq1fy2q0bq3sswhr7r5a2s433x4f";
+    sha256 = "1xs3gngjkna458liaqjsc8ryld03mdmvycnkzwsgyzfxsgjx1i3l";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/version-management/src/default.nix b/pkgs/applications/version-management/src/default.nix
index 20d3922138b..e41d40beb59 100644
--- a/pkgs/applications/version-management/src/default.nix
+++ b/pkgs/applications/version-management/src/default.nix
@@ -2,20 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "0n9j2mywbm8c7mc5b3m7dvn6gff88wwwaygk4y1jivpg1f6s3k3l";
+    sha256 = "0qd10w8fwbrgaj8sx49q6cfhqq3ylhwn7nl9v6kxi1yjlw2p098p";
   };
 
-  buildInputs = [ python rcs git makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ python rcs git ];
 
   preConfigure = ''
     patchShebangs .
   '';
 
-  makeFlags = [ "prefix=$(out)" ];
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   postInstall = ''
     wrapProgram $out/bin/src \
@@ -32,8 +33,9 @@ stdenv.mkDerivation rec {
       will seem familiar to Subversion/Git/hg users, and no binary blobs
       anywhere.
     '';
-    homepage = http://www.catb.org/esr/src/;
-    license = licenses.bsd3;
+    homepage = "http://www.catb.org/esr/src/";
+    changelog = "https://gitlab.com/esr/src/raw/${version}/NEWS";
+    license = licenses.bsd2;
     platforms = platforms.all;
     maintainers = with maintainers; [ calvertvl AndersonTorres ];
   };
diff --git a/pkgs/applications/video/mkclean/default.nix b/pkgs/applications/video/mkclean/default.nix
new file mode 100644
index 00000000000..4a3cbc81b35
--- /dev/null
+++ b/pkgs/applications/video/mkclean/default.nix
@@ -0,0 +1,37 @@
+{ dos2unix, fetchurl, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "mkclean";
+  version = "0.8.10";
+
+  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ dos2unix ];
+
+  src = fetchurl {
+    url = "mirror://sourceforge/matroska/${pname}-${version}.tar.bz2";
+    sha256 = "0zbpi4sm68zb20d53kbss93fv4aafhcmz7dsd0zdf01vj1r3wxwn";
+  };
+
+  configurePhase = ''
+    dos2unix ./mkclean/configure.compiled
+    ./mkclean/configure.compiled
+  '';
+
+  buildPhase = ''
+    make -C mkclean
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,lib}
+    mv release/gcc_linux_*/*.* $out/lib
+    mv release/gcc_linux_*/* $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "mkclean is a command line tool to clean and optimize Matroska (.mkv / .mka / .mks / .mk3d) and WebM (.webm / .weba) files that have already been muxed.";
+    homepage = "https://www.matroska.org";
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ chrisaw ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/virtualization/rkt/default.nix b/pkgs/applications/virtualization/rkt/default.nix
index 42aad06d0c0..0f53ede188c 100644
--- a/pkgs/applications/virtualization/rkt/default.nix
+++ b/pkgs/applications/virtualization/rkt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, autoreconfHook, acl, go, file, git, wget, gnupg1, trousers, squashfsTools,
+{ stdenv, lib, autoreconfHook, acl, go, file, git, wget, gnupg, trousers, squashfsTools,
   cpio, fetchurl, fetchFromGitHub, iptables, systemd, makeWrapper, glibc }:
 
 let
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [
     glibc.out glibc.static
-    autoreconfHook go file git wget gnupg1 trousers squashfsTools cpio acl systemd
+    autoreconfHook go file git wget gnupg trousers squashfsTools cpio acl systemd
     makeWrapper
   ];
 
diff --git a/pkgs/applications/window-managers/i3/wk-switch.nix b/pkgs/applications/window-managers/i3/wk-switch.nix
index 39bd62cd5aa..5b1cdbe05f5 100644
--- a/pkgs/applications/window-managers/i3/wk-switch.nix
+++ b/pkgs/applications/window-managers/i3/wk-switch.nix
@@ -1,18 +1,17 @@
-{ stdenv, fetchFromGitHub, python2Packages }:
+{ stdenv, fetchFromGitHub, python3Packages }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "i3-wk-switch";
-  version = "2017-08-21";
+  version = "2019-05-10";
 
-  # https://github.com/tmfink/i3-wk-switch/commit/484f840bc4c28ddc60fa3be81e2098f7689e78fb
   src = fetchFromGitHub {
     owner = "tmfink";
     repo = pname;
-    rev = "484f840";
-    sha256 = "0nrc13ld5bx07wrgnpzgpbaixb4rpi93xiapvyb8srd49fj9pcmb";
+    rev = "05a2d5d35e9841d2a26630f1866fc0a0e8e708eb";
+    sha256 = "0ln192abdqrrs7rdazp9acbji2y6pf68z2d1by4nf2q529dh24dc";
   };
 
-  propagatedBuildInputs = with python2Packages; [ i3-py ];
+  propagatedBuildInputs = with python3Packages; [ i3ipc ];
 
   dontBuild = true;
   doCheck = false;
@@ -23,7 +22,7 @@ python2Packages.buildPythonApplication rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "XMonad-like workspace switching for i3";
+    description = "XMonad-like workspace switching for i3 and sway";
     maintainers = with maintainers; [ synthetica ];
     platforms = platforms.linux;
     license = licenses.mit;
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 11945e7b6f7..57e40069003 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -216,7 +216,7 @@ rec {
         find image/$extractionID/layer -name ".wh.*" -exec bash -c 'name="$(basename {}|sed "s/^.wh.//")"; mknod "$(dirname {})/$name" c 0 0; rm {}' \;
 
         # Get the next lower directory and continue the loop.
-        lowerdir=$lowerdir''${lowerdir:+:}image/$extractionID/layer
+        lowerdir=image/$extractionID/layer''${lowerdir:+:}$lowerdir
       done
 
       mkdir work
@@ -585,9 +585,9 @@ rec {
           layerID=$(sha256sum "$layer/json" | cut -d ' ' -f 1)
           ln -s "$layer" "./image/$layerID"
 
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerID/layer.tar\"] + .")
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${configJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerID/layer.tar\"]")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${configJson})\"}]")
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
         done
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
         echo "$imageJson" > "image/$imageJsonChecksum.json"
@@ -779,23 +779,24 @@ rec {
         # Use the temp folder we've been working on to create a new image.
         mv temp image/$layerID
 
-        # Add the new layer ID to the beginning of the layer list
+        # Add the new layer ID to the end of the layer list
         (
+          cat layer-list
           # originally this used `sed -i "1i$layerID" layer-list`, but
           # would fail if layer-list was completely empty.
           echo "$layerID/layer.tar"
-          cat layer-list
         ) | ${pkgs.moreutils}/bin/sponge layer-list
 
         # Create image json and image manifest
         imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")
         manifestJson=$(jq -n "[{\"RepoTags\":[\"$imageName:$imageTag\"]}]")
 
-        for layerTar in $(tac ./layer-list); do
+        for layerTar in $(cat ./layer-list); do
           layerChecksum=$(sha256sum image/$layerTar | cut -d ' ' -f1)
-          imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"$(jq -r .created ${baseJson})\"}] + .")
-          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
-          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$layerTar\"] + .")
+          imageJson=$(echo "$imageJson" | jq ".history |= . + [{\"created\": \"$(jq -r .created ${baseJson})\"}]")
+          # diff_ids order is from the bottom-most to top-most layer
+          imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= . + [\"sha256:$layerChecksum\"]")
+          manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= . + [\"$layerTar\"]")
         done
 
         imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 557a4dbf54b..ac21be907b8 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -187,4 +187,43 @@ rec {
     runAsRoot = "touch /example-file";
     fromImage = bash;
   };
+
+  # 13. example of 3 layers images This image is used to verify the
+  # order of layers is correct.
+  # It allows to validate
+  # - the layer of parent are below
+  # - the order of parent layer is preserved at image build time
+  #   (this is why there are 3 images)
+  layersOrder = let
+    l1 = pkgs.dockerTools.buildImage {
+      name = "l1";
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer1 > tmp/layer1
+        echo layer1 > tmp/layer2
+        echo layer1 > tmp/layer3
+      '';
+    };
+    l2 = pkgs.dockerTools.buildImage {
+      name = "l2";
+      fromImage = l1;
+      tag = "latest";
+      extraCommands = ''
+        mkdir -p tmp
+        echo layer2 > tmp/layer2
+        echo layer2 > tmp/layer3
+      '';
+    };
+  in pkgs.dockerTools.buildImage {
+    name = "l3";
+    fromImage = l2;
+    tag = "latest";
+    contents = [ pkgs.coreutils ];
+    extraCommands = ''
+      mkdir -p tmp
+      echo layer3 > tmp/layer3
+    '';
+  };
+
 }
diff --git a/pkgs/data/fonts/agave/default.nix b/pkgs/data/fonts/agave/default.nix
index eb18f620a2a..b9417256867 100644
--- a/pkgs/data/fonts/agave/default.nix
+++ b/pkgs/data/fonts/agave/default.nix
@@ -1,24 +1,21 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
-stdenv.mkDerivation rec {
+let
   pname = "agave";
   version = "009";
+in fetchurl {
+  name = "${pname}-${version}";
+  url = "https://github.com/agarick/agave/releases/download/v${version}/agave-r.ttf";
 
-  src = fetchurl {
-    url = "https://github.com/agarick/agave/releases/download/v${version}/agave-r.ttf";
-    sha256 = "05766gp2glm1p2vknk1nncxigq28hg8s58kjwsbn8zpwy8ivywpk";
-  };
-
-  sourceRoot = ".";
-
-  unpackPhase = ":";
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp $src $out/share/fonts/truetype/
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    install -D $downloadedFile $out/share/fonts/truetype/agave-r.ttf
   '';
 
-  meta = with stdenv.lib; {
+  sha256 = "16qvz3zpwiq2nw0gxygva5pssswcia5xp0q6ir5jfkackvqf3fql";
+
+  meta = with lib; {
     description = "truetype monospaced typeface designed for X environments";
     homepage = https://b.agaric.net/page/agave;
     license = licenses.mit;
diff --git a/pkgs/data/fonts/aileron/default.nix b/pkgs/data/fonts/aileron/default.nix
index 52a96f16db0..ee85ee59882 100644
--- a/pkgs/data/fonts/aileron/default.nix
+++ b/pkgs/data/fonts/aileron/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A helvetica font in nine weights";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/andagii/default.nix b/pkgs/data/fonts/andagii/default.nix
index ba0bab61eec..0f20b9c46cf 100644
--- a/pkgs/data/fonts/andagii/default.nix
+++ b/pkgs/data/fonts/andagii/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0.2";
@@ -17,7 +17,7 @@ in fetchzip {
   # There are multiple claims that the font is GPL, so I include the
   # package; but I cannot find the original source, so use it on your
   # own risk Debian claims it is GPL - good enough for me.
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.i18nguy.com/unicode/unicode-font.html;
     description = "Unicode Plane 1 Osmanya script font";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/andika/default.nix b/pkgs/data/fonts/andika/default.nix
index 4b6965563a3..e03a800b3ad 100644
--- a/pkgs/data/fonts/andika/default.nix
+++ b/pkgs/data/fonts/andika/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "1jy9vpcprpd1k48p20wh6jhyn909ibia8lr5i747p41l0s8a7lqy";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/andika;
       description = "A family designed especially for literacy use taking into account the needs of beginning readers";
       longDescription = ''
diff --git a/pkgs/data/fonts/ankacoder/condensed.nix b/pkgs/data/fonts/ankacoder/condensed.nix
index 08a46628e65..53f4d94b38f 100644
--- a/pkgs/data/fonts/ankacoder/condensed.nix
+++ b/pkgs/data/fonts/ankacoder/condensed.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "1.100"; in
 fetchzip rec {
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "0i80zpr2y9368rg2i6x8jv0g7d03kdyr5h7w9yz7pjd7i9xd8439";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Anka/Coder Condensed font";
     homepage = https://code.google.com/archive/p/anka-coder-fonts;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ankacoder/default.nix b/pkgs/data/fonts/ankacoder/default.nix
index 170c8cde514..52e2d4a4233 100644
--- a/pkgs/data/fonts/ankacoder/default.nix
+++ b/pkgs/data/fonts/ankacoder/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "1.100"; in
 fetchzip rec {
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "1jqx9micfmiarqh9xp330gl96v3vxbwzz9cmg2vi845n9md4im85";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Anka/Coder fonts";
     homepage = https://code.google.com/archive/p/anka-coder-fonts;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/anonymous-pro/default.nix b/pkgs/data/fonts/anonymous-pro/default.nix
index 3ac2c943299..4aeda64377e 100644
--- a/pkgs/data/fonts/anonymous-pro/default.nix
+++ b/pkgs/data/fonts/anonymous-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.002";
@@ -13,7 +13,7 @@ in fetchzip rec {
   '';
   sha256 = "05rgzag38qc77b31sm5i2vwwrxbrvwzfsqh3slv11skx36pz337f";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.marksimonson.com/fonts/view/anonymous-pro;
     description = "TrueType font set intended for source code";
     longDescription = ''
diff --git a/pkgs/data/fonts/arkpandora/default.nix b/pkgs/data/fonts/arkpandora/default.nix
index 909985d945b..26c4530ac0e 100644
--- a/pkgs/data/fonts/arkpandora/default.nix
+++ b/pkgs/data/fonts/arkpandora/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
 let
   version = "2.04";
@@ -21,6 +21,5 @@ in fetchurl {
 
   meta = {
     description = "Font, metrically identical to Arial and Times New Roman";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/arphic/default.nix b/pkgs/data/fonts/arphic/default.nix
index 37d9a199567..1e52ea301af 100644
--- a/pkgs/data/fonts/arphic/default.nix
+++ b/pkgs/data/fonts/arphic/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, mkfontscale, mkfontdir }:
+{ lib, fetchzip, mkfontscale, mkfontdir }:
 
 let
   version = "0.2.20080216.2";
@@ -18,7 +18,7 @@ in {
 
     sha256 = "0xi5ycm7ydzpn7cqxv1kcj9vd70nr9wn8v27hmibyjc25y2qdmzl";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "CJK Unicode font Kai style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;
 
@@ -43,7 +43,7 @@ in {
 
     sha256 = "16jybvj1cxamm682caj6nsm6l5c60x9mgchp1l2izrw2rvc8x38d";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "CJK Unicode font Ming style";
       homepage = https://www.freedesktop.org/wiki/Software/CJKUnifonts/;
 
diff --git a/pkgs/data/fonts/aurulent-sans/default.nix b/pkgs/data/fonts/aurulent-sans/default.nix
index 1a83ce17646..a87be94acd0 100644
--- a/pkgs/data/fonts/aurulent-sans/default.nix
+++ b/pkgs/data/fonts/aurulent-sans/default.nix
@@ -1,12 +1,13 @@
-{stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "aurulent-sans-0.1";
-
-  url = "https://github.com/deepfire/hartke-aurulent-sans/archive/${name}.zip";
+  owner = "deepfire";
+  repo = "hartke-aurulent-sans";
+  rev = name;
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    tar xf $downloadedFile -C $out/share/fonts --strip=1
   '';
   sha256 = "1l60psfv9x0x9qx9vp1qnhmck7a7kks385m5ycrd3d91irz1j5li";
 
@@ -14,8 +15,8 @@ fetchzip rec {
     description = "Aurulent Sans";
     longDescription = "Aurulent Sans is a humanist sans serif intended to be used as an interface font.";
     homepage = http://delubrum.org/;
-    maintainers = with stdenv.lib.maintainers; [ deepfire ];
-    license = stdenv.lib.licenses.ofl;
-    platforms = stdenv.lib.platforms.all;
+    maintainers = with lib.maintainers; [ deepfire ];
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/b612/default.nix b/pkgs/data/fonts/b612/default.nix
index 2f583e2fc4b..1c2d7f53bad 100644
--- a/pkgs/data/fonts/b612/default.nix
+++ b/pkgs/data/fonts/b612/default.nix
@@ -1,20 +1,21 @@
-{ stdenv, fetchzip, lib }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "1.008";
   pname = "b612";
-in
-
-fetchzip rec {
+in fetchFromGitHub {
   name = "${pname}-font-${version}";
-  url = "https://github.com/polarsys/b612/archive/${version}.zip";
-  sha256 = "0r3lana1q9w3siv8czb3p9rrb5d9svp628yfbvvmnj7qvjrmfsiq";
+  owner = "polarsys";
+  repo = "b612";
+  rev = version;
   postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype/${pname}
-    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/${pname}
+    cp fonts/ttf/*.ttf $out/share/fonts/truetype/${pname}
   '';
+  sha256 = "0r3lana1q9w3siv8czb3p9rrb5d9svp628yfbvvmnj7qvjrmfsiq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://b612-font.com/;
     description = "Highly legible font family for use on aircraft cockpit screens";
     longDescription = ''
diff --git a/pkgs/data/fonts/babelstone-han/default.nix b/pkgs/data/fonts/babelstone-han/default.nix
index 67080e73c46..5408e7b1b1d 100644
--- a/pkgs/data/fonts/babelstone-han/default.nix
+++ b/pkgs/data/fonts/babelstone-han/default.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
-  version = "11.0.3";
+  version = "12.1.4";
 in fetchzip {
   name = "babelstone-han-${version}";
 
@@ -10,9 +10,9 @@ in fetchzip {
     mkdir -p $out/share/fonts/truetype
     unzip $downloadedFile '*.ttf' -d $out/share/fonts/truetype
   '';
-  sha256 = "0c8s21kllyilwivrb8gywq818y67w3zpann34hz36vy0wyiswn1c";
+  sha256 = "1fypwk2i87jfrckvxg9wz4x84z7c6ifgzrjb8fylhac50lzi6kni";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Unicode CJK font with over 36000 Han characters";
     homepage = http://www.babelstone.co.uk/Fonts/Han.html;
 
diff --git a/pkgs/data/fonts/baekmuk-ttf/default.nix b/pkgs/data/fonts/baekmuk-ttf/default.nix
index 555bba63354..b11a0a4f0f0 100644
--- a/pkgs/data/fonts/baekmuk-ttf/default.nix
+++ b/pkgs/data/fonts/baekmuk-ttf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "baekmuk-ttf-2.2";
@@ -6,9 +6,8 @@ fetchzip rec {
   url = "http://kldp.net/baekmuk/release/865-${name}.tar.gz";
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
-    mkdir -p $out/share/fonts $out/share/doc/${name}
-    cp ttf/*.ttf  $out/share/fonts
-    cp COPYRIGHT* $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts        ttf/*.ttf
+    install -m444 -Dt $out/share/doc/${name}  COPYRIGHT*
   '';
   sha256 = "1jgsvack1l14q8lbcv4qhgbswi30mf045k37rl772hzcmx0r206g";
 
@@ -16,7 +15,6 @@ fetchzip rec {
     description = "Korean font";
     homepage = http://kldp.net/projects/baekmuk/;
     license = "BSD-like";
-    platforms = stdenv.lib.platforms.linux;
   };
 }
 
diff --git a/pkgs/data/fonts/bakoma-ttf/default.nix b/pkgs/data/fonts/bakoma-ttf/default.nix
index 8d87154c1df..53ebba41fd5 100644
--- a/pkgs/data/fonts/bakoma-ttf/default.nix
+++ b/pkgs/data/fonts/bakoma-ttf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "bakoma-ttf";
@@ -16,6 +16,5 @@ fetchzip {
   meta = {
     description = "TrueType versions of the Computer Modern and AMS TeX Fonts";
     homepage = http://www.ctan.org/tex-archive/fonts/cm/ps-type1/bakoma/ttf/;
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/behdad-fonts/default.nix b/pkgs/data/fonts/behdad-fonts/default.nix
index 54ddc95bf6c..8b4228ec423 100644
--- a/pkgs/data/fonts/behdad-fonts/default.nix
+++ b/pkgs/data/fonts/behdad-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "behdad-fonts";
   version = "0.0.3";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "font-store";
+  repo = "BehdadFont";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "font-store";
-    repo = "BehdadFont";
-    rev = "v${version}";
-    sha256 = "0rlmyv82qmyy90zvkjnlva44ia7dyhiyk7axbq526v7zip3g79w0";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/behdad-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/behdad-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/behrad-fonts {} \;
   '';
+  sha256 = "0c57232462cv1jrfn0m2bl7jzcfkacirrdd2qimrc8iqhkz0ajfz";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/font-store/BehdadFont;
     description = "A Persian/Arabic Open Source Font";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/cabin/default.nix b/pkgs/data/fonts/cabin/default.nix
index 5bf4d454b06..0a8168cdf9e 100644
--- a/pkgs/data/fonts/cabin/default.nix
+++ b/pkgs/data/fonts/cabin/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "cabin-1.005";
 
-  url = https://github.com/impallari/Cabin/archive/982839c790e9dc57c343972aa34c51ed3b3677fd.zip;
+  owner = "impallari";
+  repo = "Cabin";
+  rev = "982839c790e9dc57c343972aa34c51ed3b3677fd";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype fonts/OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "1ax5c2iab48qsk9zn3gjvqaib2lnlm25f1wr0aysf5ngw0y0jkrd";
+  sha256 = "1bl7h217m695jn4rbniialfk573aa44fslp2rjxnhkicakpcm44h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A humanist sans with 4 weights and true italics";
     longDescription = ''
       The Cabin font family is a humanist sans with 4 weights and true italics,
diff --git a/pkgs/data/fonts/caladea/default.nix b/pkgs/data/fonts/caladea/default.nix
index 56d8273f78a..29bd001f808 100644
--- a/pkgs/data/fonts/caladea/default.nix
+++ b/pkgs/data/fonts/caladea/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "20130214";
@@ -15,7 +15,7 @@ in fetchzip rec {
   '';
   sha256 = "0kwm42ggr8kvcn3554cpmv90xzam1sdncx7x3zs3bzp88mxrnv1z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
     homepage = http://openfontlibrary.org/en/font/caladea;
diff --git a/pkgs/data/fonts/camingo-code/default.nix b/pkgs/data/fonts/camingo-code/default.nix
index dfdf367337c..98175373ebd 100644
--- a/pkgs/data/fonts/camingo-code/default.nix
+++ b/pkgs/data/fonts/camingo-code/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -8,14 +8,12 @@ in fetchzip rec {
   url = https://github.com/chrissimpkins/codeface/releases/download/font-collection/codeface-fonts.zip;
   postFetch = ''
     unzip $downloadedFile
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/doc/${name}
-    cp -v fonts/camingo-code/*.ttf $out/share/fonts/truetype/
-    cp -v fonts/camingo-code/*.txt $out/share/doc/${name}/
+    install -m444 -Dt $out/share/fonts/truetype fonts/camingo-code/*.ttf
+    install -m444 -Dt $out/share/doc/${name}    fonts/camingo-code/*.txt
   '';
-  sha256 = "035z2k6lwwy2bysw27pirn3vjxnj2h23nyx8jr213rb2bl0m21x1";
+  sha256 = "16iqjwwa7pnswvcc4w8nglkd0m0fz50qsz96i1kcpqip3nwwvw7y";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.myfonts.com/fonts/jan-fromm/camingo-code/;
     description = "A monospaced typeface designed for source-code editors";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/carlito/default.nix b/pkgs/data/fonts/carlito/default.nix
index 2243435bc5d..3c0e314579d 100644
--- a/pkgs/data/fonts/carlito/default.nix
+++ b/pkgs/data/fonts/carlito/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "20130920";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "0d72zy6kdmxgpi63r3yvi3jh1hb7lvlgv8hgd4ag0x10dz18mbzv";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     # This font doesn't appear to have any official web site but this
     # one provides some good information and samples.
     homepage = http://openfontlibrary.org/en/font/carlito;
diff --git a/pkgs/data/fonts/charis-sil/default.nix b/pkgs/data/fonts/charis-sil/default.nix
index 995e03372fb..e28a718fad1 100644
--- a/pkgs/data/fonts/charis-sil/default.nix
+++ b/pkgs/data/fonts/charis-sil/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "1a220s8n0flvcdkazqf5g10v6r55s2an308slvvarynpj6l7x27n";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/charis;
       description = "A family of highly readable fonts for broad multilingual use";
       longDescription = ''
diff --git a/pkgs/data/fonts/clearlyU/default.nix b/pkgs/data/fonts/clearlyU/default.nix
index 5dc8e53282a..0df3ba4f659 100644
--- a/pkgs/data/fonts/clearlyU/default.nix
+++ b/pkgs/data/fonts/clearlyU/default.nix
@@ -7,18 +7,17 @@ stdenv.mkDerivation {
     url = https://www.math.nmsu.edu/~mleisher/Software/cu/cu12-1.9.tgz;
     sha256 = "1xn14jbv3m1khy7ydvad9ydkn7yygdbhjy9wm1v000jzjwr3lv21";
   };
-  
+
   nativeBuildInputs = [ mkfontdir mkfontscale ];
 
-  installPhase =
-    ''
-      mkdir -p $out/share/fonts
-      cp *.bdf $out/share/fonts
-      cd $out/share/fonts
-      mkfontdir 
-      mkfontscale
-    '';
-  
+  installPhase = ''
+    mkdir -p $out/share/fonts
+    cp *.bdf $out/share/fonts
+    cd $out/share/fonts
+    mkfontdir
+    mkfontscale
+  '';
+
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = "127zrg65s90ksj99kr9hxny40rbxvpai62mf5nqk853hcd1bzpr6";
@@ -26,6 +25,5 @@ stdenv.mkDerivation {
   meta = {
     description = "A Unicode font";
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/cm-unicode/default.nix b/pkgs/data/fonts/cm-unicode/default.nix
index d17021feb81..c058f07ed51 100644
--- a/pkgs/data/fonts/cm-unicode/default.nix
+++ b/pkgs/data/fonts/cm-unicode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.7.0";
@@ -9,15 +9,13 @@ in fetchzip rec {
 
   postFetch = ''
     tar -xJvf $downloadedFile --strip-components=1
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v *.otf $out/share/fonts/opentype/
-    cp -v README FontLog.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    README FontLog.txt
   '';
 
   sha256 = "1rzz7yhqq3lljyqxbg46jfzfd09qgpgx865lijr4sgc94riy1ypn";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://canopus.iacp.dvo.ru/~panov/cm-unicode/;
     description = "Computer Modern Unicode fonts";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/comfortaa/default.nix b/pkgs/data/fonts/comfortaa/default.nix
index f7ec6e8b8c8..6e4c0bb08e7 100644
--- a/pkgs/data/fonts/comfortaa/default.nix
+++ b/pkgs/data/fonts/comfortaa/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "3.001";
@@ -8,13 +8,12 @@ in fetchzip rec {
   url = "https://orig00.deviantart.net/40a3/f/2017/093/d/4/comfortaa___font_by_aajohan-d1qr019.zip";
   postFetch = ''
     mkdir -p $out/share/fonts $out/share/doc
-    unzip -l $downloadedFile
     unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
     unzip -j $downloadedFile \*/FONTLOG.txt \*/donate.html -d $out/share/doc/${name}
   '';
   sha256 = "0z7xr0cnn6ghwivrm5b5awq9bzhnay3y99qq6dkdgfkfdsaz0n9h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://aajohan.deviantart.com/art/Comfortaa-font-105395949;
     description = "A clean and modern font suitable for headings and logos";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/comic-neue/default.nix b/pkgs/data/fonts/comic-neue/default.nix
index 07fc172ca51..2615d0260f0 100644
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.2";
@@ -19,7 +19,7 @@ in fetchzip rec {
 
   sha256 = "1yypq5aqqzv3q1c6vx5130mi2iwihzzvrawhwqpwsfjl0p25sq9q";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://comicneue.com/;
     description = "A casual type face: Make your lemonade stand look like a fortune 500 company";
     longDescription = ''
diff --git a/pkgs/data/fonts/comic-relief/default.nix b/pkgs/data/fonts/comic-relief/default.nix
index 2a1273214bd..d51c915b844 100644
--- a/pkgs/data/fonts/comic-relief/default.nix
+++ b/pkgs/data/fonts/comic-relief/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
@@ -18,7 +18,7 @@ in fetchzip rec {
 
   sha256 = "0dz0y7w6mq4hcmmxv6fn4mp6jkln9mzr4s96vsg68wrl5b7k9yff";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://loudifier.com/comic-relief/;
     description = "A font metric-compatible with Microsoft Comic Sans";
     longDescription = ''
diff --git a/pkgs/data/fonts/cooper-hewitt/default.nix b/pkgs/data/fonts/cooper-hewitt/default.nix
index 1fa5cff7604..e1635c560d6 100644
--- a/pkgs/data/fonts/cooper-hewitt/default.nix
+++ b/pkgs/data/fonts/cooper-hewitt/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-fetchzip rec {
+fetchzip {
   name = "cooper-hewitt-2014-06-09";
 
   url = https://www.cooperhewitt.org/wp-content/uploads/fonts/CooperHewitt-OTF-public.zip;
@@ -12,7 +12,7 @@ fetchzip rec {
 
   sha256 = "01iwqmjvqkc6fmc2r0486vk06s6f51n9wxzl1pf9z48n0igj4gqd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.cooperhewitt.org/open-source-at-cooper-hewitt/cooper-hewitt-the-typeface-by-chester-jenkins/;
     description = "A contemporary sans serif, with characters composed of modified-geometric curves and arches";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/corefonts/default.nix b/pkgs/data/fonts/corefonts/default.nix
index 8c45c813953..5e06a34b6f0 100644
--- a/pkgs/data/fonts/corefonts/default.nix
+++ b/pkgs/data/fonts/corefonts/default.nix
@@ -41,12 +41,10 @@ stdenv.mkDerivation {
 
     cabextract --lowercase viewer1.cab
 
-    fontDir=$out/share/fonts/truetype
-    mkdir -p $fontDir
-    cp *.ttf $fontDir
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
 
     # Also put the EULA there to be on the safe side.
-    cp ${eula} $fontDir/eula.html
+    cp ${eula} $out/share/fonts/truetype/eula.html
 
     # Set up no-op font configs to override any aliases set up by
     # other packages.
diff --git a/pkgs/data/fonts/crimson/default.nix b/pkgs/data/fonts/crimson/default.nix
index e96c13b7822..a3f24985fd9 100644
--- a/pkgs/data/fonts/crimson/default.nix
+++ b/pkgs/data/fonts/crimson/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2014.10";
@@ -9,16 +9,13 @@ in fetchzip rec {
 
   postFetch = ''
     tar -xzvf $downloadedFile --strip-components=1
-
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v "Desktop Fonts/OTF/"*.otf $out/share/fonts/opentype
-    cp -v README.md $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/opentype "Desktop Fonts/OTF/"*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md
   '';
 
   sha256 = "0mg65f0ydyfmb43jqr1f34njpd10w8npw15cbb7z0nxmy4nkl842";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://aldusleaf.org/crimson.html;
     description = "A font family inspired by beautiful oldstyle typefaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/culmus/default.nix b/pkgs/data/fonts/culmus/default.nix
index 4ef5a444558..5aad7ff236f 100644
--- a/pkgs/data/fonts/culmus/default.nix
+++ b/pkgs/data/fonts/culmus/default.nix
@@ -1,16 +1,12 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.133";
-in stdenv.mkDerivation {
+in fetchzip {
   name = "culmus-${version}";
-
-  src = fetchzip {
-    url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
-    sha256 = "0q80j3vixn364sc23hcy6098rkgy0kb4p91lky6224am1dwn2qmr";
-  };
-
-  installPhase = ''
+  url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{truetype,type1}
     cp -v *.pfa $out/share/fonts/type1/
     cp -v *.afm $out/share/fonts/type1/
@@ -19,12 +15,13 @@ in stdenv.mkDerivation {
     cp -v *.otf $out/share/fonts/truetype/
     cp -v fonts.scale-ttf $out/share/fonts/truetype/fonts.scale
   '';
+  sha256 = "0zqqjcrqmbd4389hqz2dwymkkcxjrq9ylyriiv3gbmzl6l1ffk3g";
 
   meta = {
     description = "Culmus Hebrew fonts";
     longDescription = "The Culmus project aims at providing the Hebrew-speaking GNU/Linux and Unix community with a basic collection of Hebrew fonts for X Windows.";
-    platforms = stdenv.lib.platforms.all;
-    license = stdenv.lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    license = lib.licenses.gpl2;
     homepage = http://culmus.sourceforge.net/;
     downloadPage = http://culmus.sourceforge.net/download.html;
   };
diff --git a/pkgs/data/fonts/d2coding/default.nix b/pkgs/data/fonts/d2coding/default.nix
index abc0dba8165..00823fe05b2 100644
--- a/pkgs/data/fonts/d2coding/default.nix
+++ b/pkgs/data/fonts/d2coding/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchzip, unzip }:
+{ lib, fetchzip, unzip }:
 
 let
   version = "1.3.2";
   pname = "d2codingfont";
 
-in fetchzip rec {
+in fetchzip {
   name = "${pname}-${version}";
   url = "https://github.com/naver/${pname}/releases/download/VER${version}/D2Coding-Ver${version}-20180524.zip";
 
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1812r82530wzfki7k9cm35fy6k2lvis7j6w0w8svc784949m1wwj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Monospace font with support for Korean and latin characters";
     longDescription = ''
       D2Coding is a monospace font developed by a Korean IT Company called Naver.
diff --git a/pkgs/data/fonts/dina-pcf/default.nix b/pkgs/data/fonts/dina-pcf/default.nix
index 975bbc1749a..27306a0ef05 100644
--- a/pkgs/data/fonts/dina-pcf/default.nix
+++ b/pkgs/data/fonts/dina-pcf/default.nix
@@ -60,6 +60,5 @@ stdenv.mkDerivation rec {
     downloadPage = https://www.donationcoder.com/Software/Jibz/Dina/;
     license = licenses.free;
     maintainers = [ maintainers.prikhi ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/dina/default.nix b/pkgs/data/fonts/dina/default.nix
index 66feaf0ff54..8638ec74f77 100644
--- a/pkgs/data/fonts/dina/default.nix
+++ b/pkgs/data/fonts/dina/default.nix
@@ -5,11 +5,13 @@ let
 in fetchzip rec {
   name = "dina-font-${version}";
 
-  url = "http://www.donationcoder.com/Software/Jibz/Dina/downloads/Dina.zip";
+  # `meta.homepage` has no direct download link
+  url = "https://github.com/ProgrammingFonts/ProgrammingFonts/archive/b15ef365146be7eef4a46979cfe157c5aeefb7c0.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.bdf -d $out/share/fonts
+    unzip -j $downloadedFile '*/Dina/*.bdf' -d $out/share/fonts
+    chmod u-x $out/share/fonts/*
   '';
 
   sha256 = "02a6hqbq18sw69npylfskriqhvj1nsk65hjjyd05nl913ycc6jl7";
@@ -25,6 +27,5 @@ in fetchzip rec {
     downloadPage = https://www.donationcoder.com/Software/Jibz/Dina/;
     license = licenses.free;
     maintainers = [ maintainers.prikhi ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/dosemu-fonts/default.nix b/pkgs/data/fonts/dosemu-fonts/default.nix
index f564507c777..4837425d19a 100644
--- a/pkgs/data/fonts/dosemu-fonts/default.nix
+++ b/pkgs/data/fonts/dosemu-fonts/default.nix
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Various fonts from the DOSEmu project";
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/dosis/default.nix b/pkgs/data/fonts/dosis/default.nix
index 01157e8b7e4..48b170e2e1b 100644
--- a/pkgs/data/fonts/dosis/default.nix
+++ b/pkgs/data/fonts/dosis/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "dosis-1.007";
 
-  url = https://github.com/impallari/Dosis/archive/12df1e13e58768f20e0d48ff15651b703f9dd9dc.zip;
+  owner = "impallari";
+  repo = "Dosis";
+  rev = "12df1e13e58768f20e0d48ff15651b703f9dd9dc";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    find . -name '*.otf' -exec install -m444 -Dt $out/share/fonts/opentype {} \;
+    install -m444 -Dt $out/share/doc/${name} README.md FONTLOG.txt
   '';
 
-  sha256 = "11a8jmgaly14l7rm3jxkwwv3ngr8fdlkp70nicjk2rg0nny2cvfq";
+  sha256 = "0vz25w45i8flfvppymr5h83pa2n1r37da20v7691p44018fdsdny";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A very simple, rounded, sans serif family";
     longDescription = ''
       Dosis is a very simple, rounded, sans serif family.
diff --git a/pkgs/data/fonts/doulos-sil/default.nix b/pkgs/data/fonts/doulos-sil/default.nix
index 324f6f63e55..59371593f79 100644
--- a/pkgs/data/fonts/doulos-sil/default.nix
+++ b/pkgs/data/fonts/doulos-sil/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -16,7 +16,7 @@ in
 
     sha256 = "04a9cr7jbw7d8llcj8xsqp9rp8w6gcgbd9sdwvi02kz7jhqa0vad";
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       homepage = https://software.sil.org/doulos;
       description = "A font that provides complete support for the International Phonetic Alphabet";
       longDescription = ''
diff --git a/pkgs/data/fonts/eb-garamond/default.nix b/pkgs/data/fonts/eb-garamond/default.nix
index 53a5d9f73cc..14233268991 100644
--- a/pkgs/data/fonts/eb-garamond/default.nix
+++ b/pkgs/data/fonts/eb-garamond/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.016";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "04jq4mpln85zzbla8ybsjw7vn9qr3r0snmk5zykrm24imq7ripv3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.georgduffner.at/ebgaramond/;
     description = "Digitization of the Garamond shown on the Egenolff-Berner specimen";
     maintainers = with maintainers; [ relrod rycee ];
diff --git a/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix b/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
index d2b376f5bba..e7981f63baf 100644
--- a/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
+++ b/pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.2.0";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "0ps8q9nkx67ivgn8na4s012360v36jwr0951rsg7j6dyyw9g41jq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Icon fonts for emacs all-the-icons";
     longDescription = ''
       The emacs package all-the-icons provides icons to improve
diff --git a/pkgs/data/fonts/emojione/default.nix b/pkgs/data/fonts/emojione/default.nix
index f466a5b230d..3e71352f802 100644
--- a/pkgs/data/fonts/emojione/default.nix
+++ b/pkgs/data/fonts/emojione/default.nix
@@ -29,7 +29,6 @@ stdenv.mkDerivation rec {
     description = "Open source emoji set";
     homepage = http://emojione.com/;
     license = licenses.cc-by-40;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/data/fonts/encode-sans/default.nix b/pkgs/data/fonts/encode-sans/default.nix
index 96d64e13893..787a83f9561 100644
--- a/pkgs/data/fonts/encode-sans/default.nix
+++ b/pkgs/data/fonts/encode-sans/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "encode-sans-1.002";
@@ -13,7 +13,7 @@ fetchzip rec {
 
   sha256 = "16mx894zqlwrhnp4rflgayxhxppmsj6k7haxdngajhb30rlwf08p";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A versatile sans serif font family";
     longDescription = ''
       The Encode Sans family is a versatile workhorse. Featuring a huge range of
diff --git a/pkgs/data/fonts/eunomia/default.nix b/pkgs/data/fonts/eunomia/default.nix
index 56fa718f867..55250156fcd 100644
--- a/pkgs/data/fonts/eunomia/default.nix
+++ b/pkgs/data/fonts/eunomia/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://dotcolon.net/font/eunomia/;
     description = "A futuristic decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/f5_6/default.nix b/pkgs/data/fonts/f5_6/default.nix
index 25cab717cee..28969f02364 100644
--- a/pkgs/data/fonts/f5_6/default.nix
+++ b/pkgs/data/fonts/f5_6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A weighted decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/fantasque-sans-mono/default.nix b/pkgs/data/fonts/fantasque-sans-mono/default.nix
index 7d05482ef5f..5b982dcaa3e 100644
--- a/pkgs/data/fonts/fantasque-sans-mono/default.nix
+++ b/pkgs/data/fonts/fantasque-sans-mono/default.nix
@@ -1,9 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
-
   version = "1.7.2";
-
 in
 
 fetchzip rec {
@@ -19,7 +17,7 @@ fetchzip rec {
 
   sha256 = "1fwvbqfrgb539xybwdawvwa8cg4f215kw905rgl9a6p0iwa1nxqk";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/belluzj/fantasque-sans;
     description = "A font family with a great monospaced variant for programmers";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ferrum/default.nix b/pkgs/data/fonts/ferrum/default.nix
index bbe185bd848..ec3f3218ea5 100644
--- a/pkgs/data/fonts/ferrum/default.nix
+++ b/pkgs/data/fonts/ferrum/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A decorative font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/data/fonts/fira/default.nix
index ce6e011d8a6..fe27ac2cd5d 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/data/fonts/fira/default.nix
@@ -1,18 +1,23 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
-  name = "fira-4.106";
+let
+  version = "4.106";
+in fetchFromGitHub {
+  name = "fira-${version}";
 
-  url = https://github.com/mozilla/Fira/archive/4.106.zip;
+  owner = "mozilla";
+  repo = "Fira";
+  rev = version;
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile Fira-4.106/otf/FiraSans\*.otf -d $out/share/fonts/opentype
+    tar xf $downloadedFile --strip=1
+    mkdir -p $out/share/fonts/opentype
+    cp otf/*.otf $out/share/fonts/opentype
   '';
 
   sha256 = "0c97nmihcq0ki7ywj8zn048a2bgrszc61lb9p0djfi65ar52jab4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://mozilla.github.io/Fira/;
     description = "Sans-serif font for Firefox OS";
     longDescription = ''
diff --git a/pkgs/data/fonts/fixedsys-excelsior/default.nix b/pkgs/data/fonts/fixedsys-excelsior/default.nix
index b0c481dfcb5..14232edee0c 100644
--- a/pkgs/data/fonts/fixedsys-excelsior/default.nix
+++ b/pkgs/data/fonts/fixedsys-excelsior/default.nix
@@ -1,33 +1,25 @@
 { stdenv, fetchurl } :
 
-let 
+let
   major = "3";
   minor = "00";
   version = "${major}.${minor}";
-
-in
-
-stdenv.mkDerivation rec {
+in fetchurl rec {
   name = "fixedsys-excelsior-${version}";
 
-  src = fetchurl {
-    url = http://www.fixedsysexcelsior.com/fonts/FSEX300.ttf;
-    sha256 = "6ee0f3573bc5e33e93b616ef6282f49bc0e227a31aa753ac76ed2e3f3d02056d";
-  };
-
-  phases = [ "installPhase" ];
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/truetype/
-    cp $src $out/share/fonts/truetype/${name}.ttf
+  urls = [
+    http://www.fixedsysexcelsior.com/fonts/FSEX300.ttf
+    https://raw.githubusercontent.com/chrissimpkins/codeface/master/fonts/fixed-sys-excelsior/FSEX300.ttf
+    http://tarballs.nixos.org/sha256/6ee0f3573bc5e33e93b616ef6282f49bc0e227a31aa753ac76ed2e3f3d02056d
+  ];
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    install -m444 -D $downloadedFile $out/share/fonts/truetype/${name}.ttf
   '';
 
-  outputHashMode = "recursive";
-
-  outputHashAlgo = "sha256";
+  sha256 = "32d6f07f1ff08c764357f8478892b2ba5ade23427af99759f34a0ba24bcd2e37";
 
-  outputHash = "32d6f07f1ff08c764357f8478892b2ba5ade23427af99759f34a0ba24bcd2e37";
-  
   meta = {
     description = "Pan-unicode version of Fixedsys, a classic DOS font.";
     homepage = http://www.fixedsysexcelsior.com/;
diff --git a/pkgs/data/fonts/font-awesome-5/default.nix b/pkgs/data/fonts/font-awesome-5/default.nix
index 312cef61ec7..8ed30632c0a 100644
--- a/pkgs/data/fonts/font-awesome-5/default.nix
+++ b/pkgs/data/fonts/font-awesome-5/default.nix
@@ -1,20 +1,22 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "5.8.2";
-in fetchzip rec {
+in fetchFromGitHub rec {
   name = "font-awesome-${version}";
 
-  url = "https://github.com/FortAwesome/Font-Awesome/archive/${version}.zip";
+  owner = "FortAwesome";
+  repo = "Font-Awesome";
+  rev = version;
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile "Font-Awesome-${version}/otfs/*.otf" -d $out/share/fonts/opentype
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype otfs/*.otf
   '';
 
   sha256 = "1h0qhvkfyfs4579jvrk3gwc7dp4i9s46bkj406b493dvmxxhv986";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Font Awesome - OTF font";
     longDescription = ''
       Font Awesome gives you scalable vector icons that can instantly be customized.
diff --git a/pkgs/data/fonts/fontconfig-penultimate/default.nix b/pkgs/data/fonts/fontconfig-penultimate/default.nix
index e1be0da428a..601146d99a9 100644
--- a/pkgs/data/fonts/fontconfig-penultimate/default.nix
+++ b/pkgs/data/fonts/fontconfig-penultimate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip
+{ lib, fetchzip
 , version ? "0.3.5"
 , sha256 ? "1gfgl7qimp76q4z0nv55vv57yfs4kscdr329np701k0xnhncwvrk"
 }:
@@ -14,7 +14,7 @@ fetchzip {
     unzip -j $downloadedFile \*.conf -d $out/etc/fonts/conf.d
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/ttuegel/fontconfig-penultimate;
     description = "Sensible defaults for Fontconfig";
     license = licenses.asl20;
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 39118716f6f..c5e19edea26 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "freefont-ttf-20120503";
@@ -20,8 +20,8 @@ fetchzip rec {
       10646/Unicode UCS (Universal Character Set).
     '';
     homepage = https://www.gnu.org/software/freefont/;
-    license = stdenv.lib.licenses.gpl3Plus;
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
     maintainers = [];
   };
 }
diff --git a/pkgs/data/fonts/gandom-fonts/default.nix b/pkgs/data/fonts/gandom-fonts/default.nix
index 938ff272cbd..4d925b269cd 100644
--- a/pkgs/data/fonts/gandom-fonts/default.nix
+++ b/pkgs/data/fonts/gandom-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "gandom-fonts";
   version = "0.6";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "rastikerdar";
+  repo = "gandom-font";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "gandom-font";
-    rev = "v${version}";
-    sha256 = "1pdbqhvcsz6aq3qgarhfd05ip0wmh7bxqkmxrwa0kgxsly6zxz9x";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/gandom-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/gandom-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/gandom-fonts {} \;
   '';
+  sha256 = "0zsq6s9ziyb5jz0v8aj00dlxd1aly0ibxgszd05dfvykmgz051lc";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/gandom-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی گندم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/gdouros/default.nix b/pkgs/data/fonts/gdouros/default.nix
index 359074099ba..71c92a72e59 100644
--- a/pkgs/data/fonts/gdouros/default.nix
+++ b/pkgs/data/fonts/gdouros/default.nix
@@ -1,29 +1,16 @@
-{stdenv, fetchzip, lib}:
+{ fetchzip, lib }:
 
 let
   fonts = {
-    symbola = { version = "9.17"; file = "Symbola.zip"; sha256 = "13z18lxx0py54nns61ihgxacpf1lg9s7g2sbpbnxpllqw7j73iq2";
-                description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
-    aegyptus = { version = "6.17"; file = "Aegyptus.zip"; sha256 = "19rkf89msqb076qjdfa75pqrx35c3slj64vxw08zqdvyavq7jc79";
-                 description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
-    akkadian = { version = "7.17"; file = "AkkadianAssyrian.zip"; sha256 = "1xw2flrwb5r89sk7jd195v3svsb21brf1li2i3pdjcfqxfp5m0g7";
-                 description = "Sumero-Akkadian Cuneiform"; };
-    anatolian = { version = "5.17"; file = "Anatolian.zip"; sha256 = "0dqcyjakc4fy076pjplm6psl8drpwxiwyq97xrf6a3qa098gc0qc";
-                  description = "Anatolian Hieroglyphs"; };
-    maya = { version = "4.17"; file = "Maya.zip"; sha256 = "17s5c23wpqrcq5h6pgssbmzxiv4jvhdh2ssr99j9q6j32a51h9gh";
-             description = "Maya Hieroglyphs"; };
-    unidings = { version = "9.17"; file = "Unidings.zip"; sha256 = "0nzw8mrhk0hbjnl2cgi31b00vmi785win86kiz9d2yzdfz1is6sk";
-                 description = "Glyphs and Icons for blocks of The Unicode Standard"; };
-    musica = { version = "3.17"; file = "Musica.zip"; sha256 = "0mnv61dxzs2npvxgs5l9q81q19xzzi1sn53x5qwpiirkmi6bg5y6";
-               description = "Musical Notation"; };
-    analecta = { version = "5.17"; file = "Analecta.zip"; sha256 = "13npnfscd9mz6vf89qxxbj383njf53a1smqjh0c1w2lvijgak3aj";
-                 description = "Coptic, Gothic, Deseret"; };
-    textfonts = { version = "7.17"; file = "TextfontsFonts.zip"; sha256 = "1ggflqnslp81v8pzmzx6iwi2sa38l9bpivjjci7nvx3y5xynm6wl";
-                 description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
-    aegan = { version = "9.17"; file = "AegeanFonts.zip"; sha256 = "0dm2ck3p11bc9izrh7xz3blqfqg1mgsvy4jsgmz9rcs4m74xrhsf";
-              description = "Aegean"; };
-    abydos = { version = "1.23"; file = "AbydosFont.zip"; sha256 = "04r7ysnjjq0nrr3m8lbz8ssyx6xaikqybjqxzl3ziywl9h6nxdj8";
-               description = "AbydosFont"; };
+    aegan     = { version = "10.00"; file = "Aegean.zip";       sha256 = "0k47nhzw4vx771ch3xx8mf6xx5vx0hg0cif5jdlmdaz4h2c3rawz"; description = "Aegean"; };
+    aegyptus  = { version =  "8.00"; file = "Aegyptus.zip";     sha256 = "13h2pi641k9vxgqi9l11mjya10ym9ln54wrkwxx6gxq63zy7y5mj"; description = "Egyptian Hieroglyphs, Coptic, Meroitic"; };
+    akkadian  = { version =  "7.18"; file = "Akkadian.zip";     sha256 = "1bplcvszbdrk85kqipn9lzhr62647wjibz1p8crzjvsw6f9ymxy3"; description = "Sumero-Akkadian Cuneiform"; };
+    assyrian  = { version =  "2.00"; file = "AssyrianFont.zip"; sha256 = "0vdvb24vsnmwzd6bw14akqg0hbvsk8avgnbwk9fkybn1f801475k"; description = "Neo-Assyrian in Unicode with OpenType"; };
+    eemusic   = { version =  "2.00"; file = "EEMusic.zip";      sha256 = "1y9jf105a2b689m7hdjmhhr7z5j0qd2w6dmb3iic9bwaczlrjy7j"; description = "Byzantine Musical Notation in Unicode with OpenType"; };
+    maya      = { version =  "4.18"; file = "Maya.zip";         sha256 = "08z2ch0z2c43fjfg5m4yp3l1dp0cbk7lv5i7wzsr3cr9kr59wpi9"; description = "Maya Hieroglyphs"; };
+    symbola   = { version = "12.00"; file = "Symbola.zip";      sha256 = "1i3xra33xkj32vxs55xs2afrqyc822nk25669x78px5g5qd8gypm"; description = "Basic Latin, Greek, Cyrillic and many Symbol blocks of Unicode"; };
+    textfonts = { version =  "9.00"; file = "Textfonts.zip";    sha256 = "0wzxz4j4fgk81b88d58715n1wvq2mqmpjpk4g5hi3vk77y2zxc4d"; description = "Aroania, Anaktoria, Alexander, Avdira and Asea"; };
+    unidings  = { version =  "9.19"; file = "Unidings.zip";     sha256 = "1bybzgdqhmq75hb12n3pjrsdcpw1a6sgryx464s68jlq4zi44g78"; description = "Glyphs and Icons for blocks of The Unicode Standard"; };
   };
 
   mkpkg = name_: {version, file, sha256, description}: fetchzip rec {
@@ -42,9 +29,8 @@ let
       # In lieu of a license:
       # Fonts in this site are offered free for any use;
       # they may be installed, embedded, opened, edited, modified, regenerated, posted, packaged and redistributed.
-      license = stdenv.lib.licenses.free;
+      license = lib.licenses.free;
       homepage = http://users.teilar.gr/~g1951d/;
-      platforms = stdenv.lib.platforms.unix;
     };
   };
 in
diff --git a/pkgs/data/fonts/gentium-book-basic/default.nix b/pkgs/data/fonts/gentium-book-basic/default.nix
index 9b626291c2c..505b273c2d2 100644
--- a/pkgs/data/fonts/gentium-book-basic/default.nix
+++ b/pkgs/data/fonts/gentium-book-basic/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   major = "1";
@@ -11,14 +11,13 @@ in fetchzip rec {
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
-    unzip -l $downloadedFile
     unzip -j $downloadedFile \*.ttf                            -d $out/share/fonts/truetype
     unzip -j $downloadedFile \*/FONTLOG.txt \*/GENTIUM-FAQ.txt -d $out/share/doc/${name}
   '';
 
   sha256 = "0598zr5f7d6ll48pbfbmmkrybhhdks9b2g3m2g67wm40070ffzmd";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/gentium/;
     description = "A high-quality typeface family for Latin, Cyrillic, and Greek";
     maintainers = with maintainers; [ ];
diff --git a/pkgs/data/fonts/gentium/default.nix b/pkgs/data/fonts/gentium/default.nix
index 829eca8c06f..a60a39f4f01 100644
--- a/pkgs/data/fonts/gentium/default.nix
+++ b/pkgs/data/fonts/gentium/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "5.000";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "1qr2wjdmm93167b0w9cidlf3wwsyjx4838ja9jmm4jkyian5whhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/gentium/;
     description = "A high-quality typeface family for Latin, Cyrillic, and Greek";
     longDescription = ''
diff --git a/pkgs/data/fonts/go-font/default.nix b/pkgs/data/fonts/go-font/default.nix
index a0af38cfd24..bb28d3be67f 100644
--- a/pkgs/data/fonts/go-font/default.nix
+++ b/pkgs/data/fonts/go-font/default.nix
@@ -1,26 +1,22 @@
 { stdenv, fetchgit }:
 
-stdenv.mkDerivation rec {
-  name = "go-font-${version}";
+let
   version = "2017-03-30";
+in (fetchgit {
+  name = "go-font-${version}";
+  url = "https://go.googlesource.com/image";
+  rev = "f03a046406d4d7fbfd4ed29f554da8f6114049fc";
 
-  src = fetchgit {
-    url = "https://go.googlesource.com/image";
-    rev = "f03a046406d4d7fbfd4ed29f554da8f6114049fc";
-    sha256 = "1aq6mnjayks55gd9ahavk6jfydlq5lm4xm0xk4pd5sqa74p5p74d";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    mv $out/* .
     mkdir -p $out/share/fonts/truetype
     mkdir -p $out/share/doc/go-font
     cp font/gofont/ttfs/* $out/share/fonts/truetype
     mv $out/share/fonts/truetype/README $out/share/doc/go-font/LICENSE
   '';
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "10hfm2cpxlx1ng7r2mbvykjhmy131qlgzpdzj7ibg9kr293bcjc0";
-
+  sha256 = "1488426ya2nzmwjas947fx9h5wzxrp9wasn8nkjqf0y0mpd4f1xz";
+}) // {
   meta = with stdenv.lib; {
     homepage = https://blog.golang.org/go-fonts;
     description = "The Go font family";
diff --git a/pkgs/data/fonts/gohufont/default.nix b/pkgs/data/fonts/gohufont/default.nix
index b394cb47157..59ac4ec850b 100644
--- a/pkgs/data/fonts/gohufont/default.nix
+++ b/pkgs/data/fonts/gohufont/default.nix
@@ -67,6 +67,5 @@ stdenv.mkDerivation rec {
     homepage    = http://font.gohu.org/;
     license     = licenses.wtfpl;
     maintainers = with maintainers; [ epitrochoid rnhmjoj ];
-    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/gyre/default.nix b/pkgs/data/fonts/gyre/default.nix
index 492d89a674c..91a8aaf3c30 100644
--- a/pkgs/data/fonts/gyre/default.nix
+++ b/pkgs/data/fonts/gyre/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   baseName = "gyre-fonts";
@@ -25,8 +25,8 @@ in fetchzip {
       covering all modern European languages and then some
     '';
     homepage = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/index_html#Readings";
-    license = stdenv.lib.licenses.lppl13c;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = with stdenv.lib.maintainers; [ bergey ];
+    license = lib.licenses.lppl13c;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ bergey ];
   };
 }
diff --git a/pkgs/data/fonts/hack/default.nix b/pkgs/data/fonts/hack/default.nix
index e77fcc3c3a3..ef0df1ba67f 100644
--- a/pkgs/data/fonts/hack/default.nix
+++ b/pkgs/data/fonts/hack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.003";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "1l6ih6v7dqali5c7zh6z2xnbf9h2wz0ag6fdgszmqd5lnhw39v6s";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A typeface designed for source code";
     longDescription = ''
       Hack is hand groomed and optically balanced to be a workhorse face for
diff --git a/pkgs/data/fonts/hanazono/default.nix b/pkgs/data/fonts/hanazono/default.nix
index 27459b2d1f3..4def0b44b14 100644
--- a/pkgs/data/fonts/hanazono/default.nix
+++ b/pkgs/data/fonts/hanazono/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "20141012";
@@ -15,7 +15,7 @@ in fetchzip {
 
   sha256 = "0z0fgrjzp0hqqnhfisivciqpxd2br2w2q9mvxkglj44np2q889w2";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Free kanji font containing 96,327 characters";
     homepage = http://fonts.jp/hanazono/;
 
diff --git a/pkgs/data/fonts/hasklig/default.nix b/pkgs/data/fonts/hasklig/default.nix
index de7dd5834e4..6286cf8a1df 100644
--- a/pkgs/data/fonts/hasklig/default.nix
+++ b/pkgs/data/fonts/hasklig/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
@@ -9,13 +9,12 @@ in fetchzip {
 
   postFetch = ''
     unzip $downloadedFile
-    mkdir -p $out/share/fonts/opentype
-    cp *.otf $out/share/fonts/opentype
+    install -m444 -Dt $out/share/fonts/opentype *.otf
   '';
 
   sha256 = "0xxyx0nkapviqaqmf3b610nq17k20afirvc72l32pfspsbxz8ybq";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/i-tu/Hasklig;
     description = "A font with ligatures for Haskell code based off Source Code Pro";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
index a614017b809..759d2c2db1d 100644
--- a/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
+++ b/pkgs/data/fonts/helvetica-neue-lt-std/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2013.06.07"; # date of most recent file in distribution
@@ -28,8 +28,8 @@ in fetchzip rec {
       font. The numbers are well spaced and defined with high accuracy. The
       punctuation marks are heavily detailed as well.
     '';
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.romildo ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/hermit/default.nix b/pkgs/data/fonts/hermit/default.nix
index c247ad15543..f641b36a1b0 100644
--- a/pkgs/data/fonts/hermit/default.nix
+++ b/pkgs/data/fonts/hermit/default.nix
@@ -1,23 +1,20 @@
-{ stdenv, fetchurl }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
   pname = "hermit";
   version = "2.0";
+in fetchzip rec {
+  name = "${pname}-${version}";
 
-  src = fetchurl {
-    url = "https://pcaro.es/d/otf-${pname}-${version}.tar.gz";
-    sha256 = "09rmy3sbf1j1hr8zidighjgqc8kp0wsra115y27vrnlf10ml6jy0";
-  };
-
-  sourceRoot = ".";
+  url = "https://pcaro.es/d/otf-${name}.tar.gz";
 
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    cp *.otf $out/share/fonts/opentype/
+  postFetch = ''
+    tar xf $downloadedFile
+    install -m444 -Dt $out/share/fonts/opentype *.otf
   '';
+  sha256 = "127hnpxicqya7v1wmzxxqafq3aj1n33i4j5ncflbw6gj5g3bizwl";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "monospace font designed to be clear, pragmatic and very readable";
     homepage = https://pcaro.es/p/hermit;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/hyperscrypt/default.nix b/pkgs/data/fonts/hyperscrypt/default.nix
index 80516eb0293..362781c05bb 100644
--- a/pkgs/data/fonts/hyperscrypt/default.nix
+++ b/pkgs/data/fonts/hyperscrypt/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, lib }:
+{ fetchzip, lib }:
 
 let
   version = "1.1";
@@ -15,7 +15,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*${pname}.otf -d $out/share/fonts/opentype/${pname}.otf
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://velvetyne.fr/fonts/hyper-scrypt/;
     description = "A modern stencil typeface inspired by stained glass technique";
     longDescription = ''
diff --git a/pkgs/data/fonts/inriafonts/default.nix b/pkgs/data/fonts/inriafonts/default.nix
index a2192385abc..52c28db639e 100644
--- a/pkgs/data/fonts/inriafonts/default.nix
+++ b/pkgs/data/fonts/inriafonts/default.nix
@@ -1,26 +1,22 @@
-{ stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
+{ lib, fetchFromGitHub }:
 
+let
   pname = "inriafonts";
   version = "1.200";
+in fetchFromGitHub rec {
   name = "${pname}-${version}";
-
-src = fetchFromGitHub {
   owner = "BlackFoundry";
   repo = "InriaFonts";
   rev = "v${version}";
-  sha256 = "06775y99lyh6hj5hzvrx56iybdck8a8xfqkipqd5c4cldg0a9hh8";
-};
 
-installPhase = ''
-  mkdir -p $out/share/fonts/truetype
-  cp fonts/*/TTF/*.ttf $out/share/fonts/truetype
-  mkdir -p $out/share/fonts/opentype
-  cp fonts/*/OTF/*.otf $out/share/fonts/opentype
-'';
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/truetype fonts/*/TTF/*.ttf
+    install -m444 -Dt $out/share/fonts/opentype fonts/*/OTF/*.otf
+  '';
+  sha256 = "0wrwcyycyzvgvgnlmwi1ncdvwb8f6bbclynd1105rsyxgrz5dd70";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://black-foundry.com/work/inria;
     description = "Inria Sans and Inria Serif";
     longDescription = ''
@@ -32,7 +28,7 @@ installPhase = ''
       typeface with a unapologetically contemporary design as the
       Sans-serif part and a more rational axis and drawing for the
       serif. Both members comes in 3 weights with matching italics.
-      '';
+    '';
     license = licenses.ofl;
     maintainers = with maintainers; [ leenaars ];
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/inter-ui/default.nix b/pkgs/data/fonts/inter-ui/default.nix
index 15032ebb3e3..d9ef6684faa 100644
--- a/pkgs/data/fonts/inter-ui/default.nix
+++ b/pkgs/data/fonts/inter-ui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 # XXX: IMPORTANT:
 # For compat, keep this at the last version that used the name "Inter UI"
@@ -18,7 +18,7 @@ in fetchzip {
 
   sha256 = "01d2ql803jrhss6g60djvs08x9xl7z6b3snkn03vqnrajdgifcl4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://rsms.me/inter/;
     description = "A typeface specially designed for user interfaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/inter/default.nix b/pkgs/data/fonts/inter/default.nix
index 8973eae1464..f11f13283d5 100644
--- a/pkgs/data/fonts/inter/default.nix
+++ b/pkgs/data/fonts/inter/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.5";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "0zqixzzbb3n1j4jvpjm0hlxc32j53hgq4j078gihjkhgvjhsklf2";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://rsms.me/inter/;
     description = "A typeface specially designed for user interfaces";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/ipaexfont/default.nix b/pkgs/data/fonts/ipaexfont/default.nix
index dfeab5124c8..4d7e2fa380e 100644
--- a/pkgs/data/fonts/ipaexfont/default.nix
+++ b/pkgs/data/fonts/ipaexfont/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-fetchzip rec {
+fetchzip {
   name = "ipaexfont-003.01";
 
-  url = "http://dl.ipafont.ipa.go.jp/IPAexfont/IPAexfont00301.zip";
+  url = "http://web.archive.org/web/20160616003021/http://dl.ipafont.ipa.go.jp/IPAexfont/IPAexfont00301.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -12,7 +12,7 @@ fetchzip rec {
 
   sha256 = "02a6sj990cnig5lq0m54nmbmfkr3s57jpxl9fiyzrjmigvd1qmhj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Japanese font package with Mincho and Gothic fonts";
     longDescription = ''
       IPAex font is a Japanese font developed by the Information-technology
@@ -24,6 +24,5 @@ fetchzip rec {
     homepage = http://ipafont.ipa.go.jp/;
     license = licenses.ipa;
     maintainers = with maintainers; [ gebner ];
-    platforms = with platforms; unix;
   };
 }
diff --git a/pkgs/data/fonts/ipafont/default.nix b/pkgs/data/fonts/ipafont/default.nix
index c056f14f46f..d1cb0070883 100644
--- a/pkgs/data/fonts/ipafont/default.nix
+++ b/pkgs/data/fonts/ipafont/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "ipafont-003.03";
@@ -20,8 +20,7 @@ fetchzip {
       suitable for both display and printing.
     '';
     homepage = http://ipafont.ipa.go.jp/ipafont/;
-    license = stdenv.lib.licenses.ipa;
-    maintainers = [ stdenv.lib.maintainers.auntie ];
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.ipa;
+    maintainers = [ lib.maintainers.auntie ];
   };
 }
diff --git a/pkgs/data/fonts/ir-standard-fonts/default.nix b/pkgs/data/fonts/ir-standard-fonts/default.nix
index af1392e9d5e..1501e0fb7fa 100644
--- a/pkgs/data/fonts/ir-standard-fonts/default.nix
+++ b/pkgs/data/fonts/ir-standard-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "ir-standard-fonts";
-  version= "unstable-2017-01-21";
+  version = "unstable-2017-01-21";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "morealaz";
+  repo = pname;
+  rev = "d36727d6c38c23c01b3074565667a2fe231fe18f";
 
-  src = fetchFromGitHub {
-    owner = "morealaz";
-    repo = pname;
-    rev = "d36727d6c38c23c01b3074565667a2fe231fe18f";
-    sha256 = "1ks9q1r1gk2517yfr1fbgrdbgw0w97i4am6jqn5ywpgm2xd03yg1";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/ir-standard-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/ir-standard-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/ir-standard-fonts {} \;
   '';
+  sha256 = "0i2vzhwk77pm6fx5z5gxl026z9f35rhh3cvl003mry2lcg1x5rhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/morealaz/ir-standard-fonts;
     description = "Iran Supreme Council of Information and Communication Technology (SCICT) standard Persian fonts series";
     # License information is unavailable.
diff --git a/pkgs/data/fonts/iwona/default.nix b/pkgs/data/fonts/iwona/default.nix
index 3649aad99f4..afa59b737a5 100644
--- a/pkgs/data/fonts/iwona/default.nix
+++ b/pkgs/data/fonts/iwona/default.nix
@@ -1,23 +1,18 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "iwona-${version}";
+let
   version = "0_995";
+in fetchzip {
+  name = "iwona-${version}";
+  url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
 
-  src = fetchzip {
-    url = "http://jmn.pl/pliki/Iwona-otf-${version}.zip";
-    sha256 = "1wj5bxbxpz5a8p3rhw708cyjc0lgqji8g0iv6brmmbrrkpb3jq2s";
-  };
-
-  installPhase = ''
-    install -m 444 -D -t $out/share/fonts/opentype/ *.otf
+  postFetch = ''
+    mkdir -p $out/share/fonts/opentype
+    unzip -j $downloadedFile *.otf -d $out/share/fonts/opentype
   '';
+  sha256 = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1dcpn13bd31dw7ir0s722bv3nk136dy6qsab0kznjbzfqd7agswa";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A two-element sans-serif typeface, created by Małgorzata Budyta";
     homepage = http://jmn.pl/en/kurier-i-iwona/;
     # "[...] GUST Font License (GFL), which is a free license, legally
diff --git a/pkgs/data/fonts/junicode/default.nix b/pkgs/data/fonts/junicode/default.nix
index 824d9044d76..1cfe1d5d4b0 100644
--- a/pkgs/data/fonts/junicode/default.nix
+++ b/pkgs/data/fonts/junicode/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "junicode-0.7.8";
@@ -15,7 +15,6 @@ fetchzip {
   meta = {
     homepage = http://junicode.sourceforge.net/;
     description = "A Unicode font for medievalists";
-    platforms = stdenv.lib.platforms.unix;
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/data/fonts/kawkab-mono/default.nix b/pkgs/data/fonts/kawkab-mono/default.nix
index 852fdec82f8..c1de2806ef1 100644
--- a/pkgs/data/fonts/kawkab-mono/default.nix
+++ b/pkgs/data/fonts/kawkab-mono/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "kawkab-mono-20151015";
@@ -15,8 +15,7 @@ fetchzip rec {
   meta = {
     description = "An arab fixed-width font";
     homepage = https://makkuk.com/kawkab-mono/;
-    license = stdenv.lib.licenses.ofl;
-    platforms = stdenv.lib.platforms.unix;
+    license = lib.licenses.ofl;
   };
 }
 
diff --git a/pkgs/data/fonts/kochi-substitute-naga10/default.nix b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
index c24e6898129..cc2ec0d641f 100644
--- a/pkgs/data/fonts/kochi-substitute-naga10/default.nix
+++ b/pkgs/data/fonts/kochi-substitute-naga10/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let version = "20030809";
 in
@@ -26,7 +26,7 @@ fetchzip {
       Debian version.
     '';
     homepage = http://sourceforge.jp/projects/efont/;
-    license = stdenv.lib.licenses.unfreeRedistributable;
-    maintainers = [ stdenv.lib.maintainers.auntie ];
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ lib.maintainers.auntie ];
   };
 }
diff --git a/pkgs/data/fonts/kochi-substitute/default.nix b/pkgs/data/fonts/kochi-substitute/default.nix
index 5815b84f21a..11cd73e5237 100644
--- a/pkgs/data/fonts/kochi-substitute/default.nix
+++ b/pkgs/data/fonts/kochi-substitute/default.nix
@@ -43,6 +43,5 @@ stdenv.mkDerivation {
     homepage = http://sourceforge.jp/projects/efont/;
     license = stdenv.lib.licenses.wadalab;
     maintainers = [ stdenv.lib.maintainers.auntie ];
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/lalezar-fonts/default.nix b/pkgs/data/fonts/lalezar-fonts/default.nix
index c9915d7a3e6..2cd33e9fe1b 100644
--- a/pkgs/data/fonts/lalezar-fonts/default.nix
+++ b/pkgs/data/fonts/lalezar-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "lalezar-fonts";
   version = "unstable-2017-02-28";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "BornaIz";
+  repo = "Lalezar";
+  rev = "238701c4241f207e92515f845a199be9131c1109";
 
-  src = fetchFromGitHub {
-    owner = "BornaIz";
-    repo = "Lalezar";
-    rev = "238701c4241f207e92515f845a199be9131c1109";
-    sha256 = "1j3zg9qw4ahw52i0i2c69gv5gjc1f4zsdla58kd9visk03qgk77p";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/lalezar-fonts
     cp -v $( find . -name '*.ttf') $out/share/fonts/lalezar-fonts
   '';
+  sha256 = "0jmwhr2dqgj3vn0v26jh6c0id6n3wd6as3bq39xa870zlk7v307b";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/BornaIz/Lalezar;
     description = "A multi-script display typeface for popular culture";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/lato/default.nix b/pkgs/data/fonts/lato/default.nix
index 91d85ce9a0d..ea9d1837ef5 100644
--- a/pkgs/data/fonts/lato/default.nix
+++ b/pkgs/data/fonts/lato/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lato-2.0";
@@ -12,7 +12,7 @@ fetchzip {
 
   sha256 = "1amwn6vcaggxrd2s4zw21s2pr47zmzdf2xfy4x9lxa2cd9bkhvg5";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.latofonts.com/;
 
     description = ''
diff --git a/pkgs/data/fonts/liberastika/default.nix b/pkgs/data/fonts/liberastika/default.nix
index 2e1f89ed1e7..1bc3b9b2092 100644
--- a/pkgs/data/fonts/liberastika/default.nix
+++ b/pkgs/data/fonts/liberastika/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1.5";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1a9dvl1pzch2vh8sqyyn1d1wz4n624ffazl6hzlc3s5k5lzrb6jp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Liberation Sans fork with improved cyrillic support";
     homepage = https://sourceforge.net/projects/lib-ka/;
 
diff --git a/pkgs/data/fonts/liberation-sans-narrow/default.nix b/pkgs/data/fonts/liberation-sans-narrow/default.nix
index 97a1ff70f49..4a14e095cf0 100644
--- a/pkgs/data/fonts/liberation-sans-narrow/default.nix
+++ b/pkgs/data/fonts/liberation-sans-narrow/default.nix
@@ -14,11 +14,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ fontforge pythonPackages.fonttools python ];
 
   installPhase = ''
-    mkdir -p $out/share/fonts/truetype
-    cp -v $(find . -name '*Narrow*.ttf') $out/share/fonts/truetype
-
-    mkdir -p "$out/doc/${pname}-${version}"
-    cp -v AUTHORS ChangeLog COPYING License.txt README "$out/doc/${pname}-${version}" || true
+    find . -name '*Narrow*.ttf' -exec install -m444 -Dt $out/share/fonts/truetype {} \;
+    install -m444 -Dt $out/doc/${pname}-${version} AUTHORS ChangeLog COPYING License.txt README.rst
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/data/fonts/libertinus/default.nix b/pkgs/data/fonts/libertinus/default.nix
index 2ee1e83691c..246d4a91a96 100644
--- a/pkgs/data/fonts/libertinus/default.nix
+++ b/pkgs/data/fonts/libertinus/default.nix
@@ -1,28 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "libertinus-${version}";
+let
   version = "6.6";
+in fetchFromGitHub rec {
+  name = "libertinus-${version}";
 
-  src = fetchFromGitHub {
-    rev    = "v${version}";
-    owner  = "khaledhosny";
-    repo   = "libertinus";
-    sha256 = "0syagjmwy6q1ysncchl9bgyfrm7f6fghj1aipbr6md7l6gafz7ji";
-  };
+  owner  = "khaledhosny";
+  repo   = "libertinus";
+  rev    = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype/
-    mkdir -p $out/share/doc/${name}/
-    cp *.otf $out/share/fonts/opentype/
-    cp *.txt $out/share/doc/${name}/
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    *.txt
   '';
+  sha256 = "11pxb2zwvjlk06zbqrfv2pgwsl4awf68fak1ks4881i8xbl1910m";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "11pxb2zwvjlk06zbqrfv2pgwsl4awf68fak1ks4881i8xbl1910m";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A fork of the Linux Libertine and Linux Biolinum fonts";
     longDescription = ''
       Libertinus fonts is a fork of the Linux Libertine and Linux Biolinum fonts
diff --git a/pkgs/data/fonts/libre-baskerville/default.nix b/pkgs/data/fonts/libre-baskerville/default.nix
index 18f236068a2..f5e6083f944 100644
--- a/pkgs/data/fonts/libre-baskerville/default.nix
+++ b/pkgs/data/fonts/libre-baskerville/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-baskerville-1.000";
 
-  url = https://github.com/impallari/Libre-Baskerville/archive/2fba7c8e0a8f53f86efd3d81bc4c63674b0c613f.zip;
+  owner = "impallari";
+  repo = "Libre-Baskerville";
+  rev = "2fba7c8e0a8f53f86efd3d81bc4c63674b0c613f";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip    -j $downloadedFile \*.ttf                    -d $out/share/fonts/truetype
-    unzip -n -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "0arlq89b3vmpw3n4wbllsdvqblhz6p09dm19z1cndicmcgk26w2a";
+  sha256 = "1kpji85d1mgwq8b4fh1isznrhsrv32la3wf058rwjmhx5a3l7yaj";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A webfont family optimized for body text";
     longDescription = ''
       Libre Baskerville is a webfont family optimized for body text. It's Based
diff --git a/pkgs/data/fonts/libre-bodoni/default.nix b/pkgs/data/fonts/libre-bodoni/default.nix
index 96f366973f0..e55d5030741 100644
--- a/pkgs/data/fonts/libre-bodoni/default.nix
+++ b/pkgs/data/fonts/libre-bodoni/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-bodoni-2.000";
 
-  url = https://github.com/impallari/Libre-Bodoni/archive/995a40e8d6b95411d660cbc5bb3f726ffd080c7d.zip;
+  owner = "impallari";
+  repo = "Libre-Bodoni";
+  rev = "995a40e8d6b95411d660cbc5bb3f726ffd080c7d";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*/v2000\ -\ initial\ glyphs\ migration/OTF/\*.otf  -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt                           -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype */v2000\ -\ initial\ glyphs\ migration/OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "0pnb1xydpvcl9mkz095f566kz7yj061wbf40rwrbwmk706f6bsiw";
+  sha256 = "0my0i5a7f0d27m6dcdirjmlcnswqqfp8gl3ccxa5f2wkn3qlzkvz";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Bodoni fonts adapted for today's web requirements";
     longDescription = ''
       The Libre Bodoni fonts are based on the 19th century Morris Fuller
diff --git a/pkgs/data/fonts/libre-franklin/default.nix b/pkgs/data/fonts/libre-franklin/default.nix
index 9ca37e35640..97832ab5651 100644
--- a/pkgs/data/fonts/libre-franklin/default.nix
+++ b/pkgs/data/fonts/libre-franklin/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub rec {
   name = "libre-franklin-1.014";
 
-  url = https://github.com/impallari/Libre-Franklin/archive/006293f34c47bd752fdcf91807510bc3f91a0bd3.zip;
+  owner = "impallari";
+  repo = "Libre-Franklin";
+  rev = "006293f34c47bd752fdcf91807510bc3f91a0bd3";
 
   postFetch = ''
-    mkdir -p $out/share/{doc,fonts}
-    unzip -j $downloadedFile \*.otf                    -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*README.md \*FONTLOG.txt -d "$out/share/doc/${name}"
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype */OTF/*.otf
+    install -m444 -Dt $out/share/doc/${name}    README.md FONTLOG.txt
   '';
 
-  sha256 = "1rkjp8x62cn4alw3lp7m45q34bih81j2hg15kg5c1nciyqq1qz0z";
+  sha256 = "0aq280m01pbirkzga432340aknf2m5ggalw0yddf40sqz7falykf";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A reinterpretation and expansion based on the 1912 Morris Fuller Benton’s classic.";
     homepage = https://github.com/impallari/Libre-Franklin;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/lm-math/default.nix b/pkgs/data/fonts/lm-math/default.nix
index 348373b8927..8df851cb9df 100644
--- a/pkgs/data/fonts/lm-math/default.nix
+++ b/pkgs/data/fonts/lm-math/default.nix
@@ -1,26 +1,20 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "latinmodern-math-${version}";
+let
   version = "1.959";
+in fetchzip rec {
+  name = "latinmodern-math-${version}";
 
-  src = fetchzip {
-    url = "www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
-    sha256 = "15l3lxjciyjmbh0q6jjvzz16ibk4ij79in9fs47qhrfr2wrddpvs";
-  };
-
-  installPhase = ''
+  url = "http://www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip";
+  postFetch = ''
     mkdir -p $out/share/fonts/opentype/
     mkdir -p $out/share/doc/${name}/
-    cp otf/*.otf $out/share/fonts/opentype/
-    cp doc/*.txt $out/share/doc/${name}/
+    unzip -f $downloadedFile otf/*.otf -d $out/share/fonts/opentype/
+    unzip -f $downloadedFile doc/*.txt -d $out/share/doc/${name}/
   '';
+  sha256 = "05k145bxgxjh7i9gx1ahigxfpc2v2vwzsy2mc41jvvg51kjr8fnn";
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "05k145bxgxjh7i9gx1ahigxfpc2v2vwzsy2mc41jvvg51kjr8fnn";
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The Latin Modern Math (LM Math) font completes the modernization of the Computer Modern family of typefaces designed and programmed by Donald E. Knuth.";
     homepage = http://www.gust.org.pl/projects/e-foundry/lm-math;
     # "The Latin Modern Math font is licensed under the GUST Font License (GFL),
diff --git a/pkgs/data/fonts/lmodern/default.nix b/pkgs/data/fonts/lmodern/default.nix
index c408aae9c0e..644efd8b858 100644
--- a/pkgs/data/fonts/lmodern/default.nix
+++ b/pkgs/data/fonts/lmodern/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lmodern-2.004.5";
@@ -21,7 +21,6 @@ fetchzip {
 
   meta = {
     description = "Latin Modern font";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/lmodern/lmmath.nix b/pkgs/data/fonts/lmodern/lmmath.nix
index c6e0788eed3..98bde90ff94 100644
--- a/pkgs/data/fonts/lmodern/lmmath.nix
+++ b/pkgs/data/fonts/lmodern/lmmath.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "lmmath-0.903";
@@ -21,7 +21,6 @@ fetchzip {
 
   meta = {
     description = "Latin Modern font";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/lobster-two/default.nix b/pkgs/data/fonts/lobster-two/default.nix
index 850fd1a1f94..d9e7ec66ee6 100644
--- a/pkgs/data/fonts/lobster-two/default.nix
+++ b/pkgs/data/fonts/lobster-two/default.nix
@@ -70,10 +70,11 @@ in
     outputHash = "0if9l8pzwgfnbdjg5yblcy08dwn9yj3wzz29l0fycia46xlzd4ym";
 
     meta = with stdenv.lib; {
-      homepage = http://www.impallari.com/lobstertwo;
+      homepage = https://github.com/librefonts/lobstertwo;
       description = "Script font with many ligatures";
       license = licenses.ofl;
       platforms = platforms.all;
       maintainers = [maintainers.rycee];
+      broken = true; # googlecode.com RIP; can be built from sources
     };
   }
diff --git a/pkgs/data/fonts/lohit-fonts/default.nix b/pkgs/data/fonts/lohit-fonts/default.nix
index c847b4cdd27..0e8b1f8fe4d 100644
--- a/pkgs/data/fonts/lohit-fonts/default.nix
+++ b/pkgs/data/fonts/lohit-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, lib }:
+{ fetchzip, lib }:
 let
   fonts = {
     assamese        = { label = "Assamese";          version = "2.91.5"; sha256 = "06cw416kgw0m6883n5ixmpniinsd747rdmacf06z83w1hqwj2js6"; };
@@ -51,7 +51,6 @@ let
       # Set a non-zero priority to allow easy overriding of the
       # fontconfig configuration files.
       priority = 5;
-      platforms = stdenv.lib.platforms.unix;
     };
   };
 
diff --git a/pkgs/data/fonts/manrope/default.nix b/pkgs/data/fonts/manrope/default.nix
index 1fdf88b79ab..9dce73a28aa 100644
--- a/pkgs/data/fonts/manrope/default.nix
+++ b/pkgs/data/fonts/manrope/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "manrope";
   version = "3";
-  src = fetchFromGitHub {
-    owner = "sharanda";
-    repo = pname;
-    rev = "3bd68c0c325861e32704470a90dfc1868a5c37e9";
-    sha256 = "1k6nmczbl97b9j2a8vx6a1r3q4gd1c2qydv0y9gn8xyl7x8fcvhs";
-  };
-  dontBuild = true;
-  installPhase = ''
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "sharanda";
+  repo = pname;
+  rev = "3bd68c0c325861e32704470a90dfc1868a5c37e9";
+  sha256 = "1h4chkfbp75hrrqqarf28ld4yb7hfrr7q4w5yz96ivg94lbwlnld";
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     install -Dm644 -t $out/share/fonts/opentype "desktop font"/*
   '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Open-source modern sans-serif font family";
     homepage = https://github.com/sharanda/manrope;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/marathi-cursive/default.nix b/pkgs/data/fonts/marathi-cursive/default.nix
index 48b2f4c516b..60c77dddc8d 100644
--- a/pkgs/data/fonts/marathi-cursive/default.nix
+++ b/pkgs/data/fonts/marathi-cursive/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   version = "1.2";
@@ -11,15 +11,13 @@ in fetchzip rec {
     ${p7zip}/bin/7z x $downloadedFile
     cd MarathiCursive
 
-    mkdir -p $out/share/fonts/marathi-cursive
-    cp -v *.otf *.ttf $out/share/fonts/marathi-cursive
-    mkdir -p $out/share/doc/${name}
-    cp -v README *.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/marathi-cursive *.otf *.ttf
+    install -m444 -Dt $out/share/doc/${name}           README *.txt
   '';
 
-  sha256 = "0fhz2ixrkm523qlx5pnwyzxgb1cfiiwrhls98xg8a5l3sypn1g8v";
+  sha256 = "0wq4w79x8r5w6ikm9amcmapf0jcdgifs9zf1pbnw3fk4ncz5s551";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/MihailJP/MarathiCursive;
     description = "Modi script font with Graphite and OpenType support";
     maintainers = with maintainers; [ mathnerd314 ];
diff --git a/pkgs/data/fonts/material-design-icons/default.nix b/pkgs/data/fonts/material-design-icons/default.nix
index 432bbaa78db..1c36d0f57fe 100644
--- a/pkgs/data/fonts/material-design-icons/default.nix
+++ b/pkgs/data/fonts/material-design-icons/default.nix
@@ -1,17 +1,15 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "material-design-icons-${version}";
+let
   version = "3.3.92";
+in fetchFromGitHub {
+  name = "material-design-icons-${version}";
+  owner  = "Templarian";
+  repo   = "MaterialDesign-Webfont";
+  rev    = "v${version}";
 
-  src = fetchFromGitHub {
-    owner  = "Templarian";
-    repo   = "MaterialDesign-Webfont";
-    rev    = "v${version}";
-    sha256 = "0k8pv2nsp3al4i4awx5mv7cscpm8akjn567jl9dwzangcsai0l53";
-  };
-
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/{eot,svg,truetype,woff,woff2}
     cp fonts/*.eot $out/share/fonts/eot/
     cp fonts/*.svg $out/share/fonts/svg/
@@ -19,8 +17,9 @@ stdenv.mkDerivation rec {
     cp fonts/*.woff $out/share/fonts/woff/
     cp fonts/*.woff2 $out/share/fonts/woff2/
   '';
+  sha256 = "0dbm4qfd0b91yrw3cv4i377pnm98fgj936nk1m5wlx8mx8jahz48";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "3200+ Material Design Icons from the Community";
     longDescription = ''
       Material Design Icons' growing icon collection allows designers and
diff --git a/pkgs/data/fonts/material-icons/default.nix b/pkgs/data/fonts/material-icons/default.nix
index ea44c9c79b1..0126fbac225 100644
--- a/pkgs/data/fonts/material-icons/default.nix
+++ b/pkgs/data/fonts/material-icons/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "material-icons-${version}";
+let
   version = "3.0.1";
+in fetchFromGitHub {
+  name = "material-icons-${version}";
 
-  src = fetchFromGitHub {
-    owner  = "google";
-    repo   = "material-design-icons";
-    rev    = "${version}";
-    sha256 = "17q5brcqyyc8gbjdgpv38p89s60cwxjlwy2ljnrvas5cj0s62np0";
-  };
+  owner  = "google";
+  repo   = "material-design-icons";
+  rev    = version;
 
-  buildCommand = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype
-    cp $src/iconfont/*.ttf $out/share/fonts/truetype
+    cp iconfont/*.ttf $out/share/fonts/truetype
   '';
+  sha256 = "1syy6v941lb8nqxhdf7mfx28v05lwrfnq53r3c1ym13x05l9kchp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "System status icons by Google, featuring material design";
     homepage = https://material.io/icons;
     license = licenses.asl20;
diff --git a/pkgs/data/fonts/medio/default.nix b/pkgs/data/fonts/medio/default.nix
index aa805b6f082..024e6049a38 100644
--- a/pkgs/data/fonts/medio/default.nix
+++ b/pkgs/data/fonts/medio/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Serif font designed by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/migmix/default.nix b/pkgs/data/fonts/migmix/default.nix
index 14b08e140ea..986751645e3 100644
--- a/pkgs/data/fonts/migmix/default.nix
+++ b/pkgs/data/fonts/migmix/default.nix
@@ -26,8 +26,7 @@ stdenv.mkDerivation rec {
   unpackPhase = ":";
 
   installPhase = ''
-    mkdir -p $out/share/fonts/truetype/migmix
-    find $srcs -name '*.ttf' | xargs install -m644 --target $out/share/fonts/truetype/migmix
+    find $srcs -name '*.ttf' -exec install -m644 -Dt $out/share/fonts/truetype/migmix {} \;
   '';
 
   outputHashAlgo = "sha256";
@@ -38,7 +37,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on M+ fonts and IPA fonts";
     homepage = http://mix-mplus-ipa.osdn.jp/migmix;
     license = licenses.ipa;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/migu/default.nix b/pkgs/data/fonts/migu/default.nix
index aefaefb337f..3b03460125f 100644
--- a/pkgs/data/fonts/migu/default.nix
+++ b/pkgs/data/fonts/migu/default.nix
@@ -37,7 +37,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on modified M+ fonts and IPA fonts";
     homepage = http://mix-mplus-ipa.osdn.jp/migu/;
     license = licenses.ipa;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/mononoki/default.nix b/pkgs/data/fonts/mononoki/default.nix
index cc481a136ba..658c3bdf20a 100644
--- a/pkgs/data/fonts/mononoki/default.nix
+++ b/pkgs/data/fonts/mononoki/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.2";
@@ -14,7 +14,7 @@ in fetchzip {
 
   sha256 = "19y4xg7ilm21h9yynyrwcafdqn05zknpmmjrb37qim6p0cy2glff";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/madmalik/mononoki;
     description = "A font for programming and code review";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/montserrat/default.nix b/pkgs/data/fonts/montserrat/default.nix
index 37afa063c3e..de8ea80b017 100644
--- a/pkgs/data/fonts/montserrat/default.nix
+++ b/pkgs/data/fonts/montserrat/default.nix
@@ -2,7 +2,7 @@
 #
 # https://aur.archlinux.org/packages/ttf-montserrat/
 
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -19,7 +19,7 @@ in fetchzip {
 
   sha256 = "11sdgvhaqg59mq71aqwqp2mb428984hjxy7hd1vasia9kgk8259w";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A geometric sans serif font with extended latin support (Regular, Alternates, Subrayada)";
     homepage    = "https://www.fontspace.com/julieta-ulanovsky/montserrat";
     license     = licenses.ofl;
diff --git a/pkgs/data/fonts/mph-2b-damase/default.nix b/pkgs/data/fonts/mph-2b-damase/default.nix
index 692ad63574f..4102386af90 100644
--- a/pkgs/data/fonts/mph-2b-damase/default.nix
+++ b/pkgs/data/fonts/mph-2b-damase/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "MPH-2B-Damase-2";
@@ -13,6 +13,5 @@ fetchzip {
   sha256 = "0yzf12z6fpbgycqwiz88f39iawdhjabadfa14wxar3nhl9n434ql";
 
   meta = {
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/mplus-outline-fonts/default.nix b/pkgs/data/fonts/mplus-outline-fonts/default.nix
index 0fd724149d8..812f96352f0 100644
--- a/pkgs/data/fonts/mplus-outline-fonts/default.nix
+++ b/pkgs/data/fonts/mplus-outline-fonts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "063";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0d485l2ihxfk039rrrnfviamlbj13cwky0c752m4ikwvgiqiq94y";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "M+ Outline Fonts";
     homepage = http://mplus-fonts.sourceforge.jp/mplus-outline-fonts/index-en.html;
     license = licenses.mit;
diff --git a/pkgs/data/fonts/mro-unicode/default.nix b/pkgs/data/fonts/mro-unicode/default.nix
index 8986a9adb7a..bb5a1ed8a9f 100644
--- a/pkgs/data/fonts/mro-unicode/default.nix
+++ b/pkgs/data/fonts/mro-unicode/default.nix
@@ -3,7 +3,7 @@
 fetchzip {
   name = "mro-unicode-2013-05-25";
 
-  url = "https://github.com/phjamr/MroUnicode/raw/master/MroUnicode-Regular.ttf";
+  url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/MroUnicode-Regular.ttf";
 
diff --git a/pkgs/data/fonts/nahid-fonts/default.nix b/pkgs/data/fonts/nahid-fonts/default.nix
index 31c0f5590bd..b9d9025b2c0 100644
--- a/pkgs/data/fonts/nahid-fonts/default.nix
+++ b/pkgs/data/fonts/nahid-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "nahid-fonts";
   version = "0.3.0";
+in fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "rastikerdar";
+  repo = "nahid-font";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "nahid-font";
-    rev = "v${version}";
-    sha256 = "0n42sywi41zin9dilr8vabmcqvmx2f1a8b4yyybs6ms9zb9xdkxg";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/nahid-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/nahid-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/nahid-fonts {} \;
   '';
+  sha256 = "0df169sibq14j2mj727sq86c00jm1nz8565v85hkvh4zgz2plb7c";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/nahid-font;
     description = "A Persian (Farsi) Font - قلم (فونت) فارسی ناهید";
     license = licenses.free;
diff --git a/pkgs/data/fonts/nanum-gothic-coding/default.nix b/pkgs/data/fonts/nanum-gothic-coding/default.nix
index c0b4670a659..f6b8210290e 100644
--- a/pkgs/data/fonts/nanum-gothic-coding/default.nix
+++ b/pkgs/data/fonts/nanum-gothic-coding/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, unzip}:
+{ lib, fetchzip }:
 
 let
   version = "VER2.5";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0b3pkhd6xn6393zi0dhj3ah08w1y1ji9fl6584bi0c8lanamf2pc";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A contemporary monospaced sans-serif typeface with a warm touch";
     homepage = https://github.com/naver/nanumfont;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/nerdfonts/default.nix b/pkgs/data/fonts/nerdfonts/default.nix
index 528055a5e80..985f264f40e 100644
--- a/pkgs/data/fonts/nerdfonts/default.nix
+++ b/pkgs/data/fonts/nerdfonts/default.nix
@@ -30,7 +30,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/ryanoasis/nerd-fonts;
     license = licenses.mit;
     maintainers = with maintainers; [ garbas ];
-    platforms = with platforms; unix;
     hydraPlatforms = []; # 'Output limit exceeded' on Hydra
   };
 }
diff --git a/pkgs/data/fonts/nika-fonts/default.nix b/pkgs/data/fonts/nika-fonts/default.nix
index f40ee8da750..c6bdbd40248 100644
--- a/pkgs/data/fonts/nika-fonts/default.nix
+++ b/pkgs/data/fonts/nika-fonts/default.nix
@@ -1,22 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "nika-fonts";
   version = "1.0.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
+  owner = "font-store";
+  repo = "NikaFont";
+  rev = "v${version}";
 
-  src = fetchFromGitHub {
-    owner = "font-store";
-    repo = "NikaFont";
-    rev = "v${version}";
-    sha256 = "16dhk87vmjnywl5wqsl9dzp12ddpfk57w08f7811m3ijqadscdwc";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/nika-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/nika-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/nika-fonts {} \;
   '';
+  sha256 = "1x34b2dqn1dymi1vmj5vrjcy2z8s0f3rr6cniyrz85plvid6x40i";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/font-store/NikaFont/;
     description = "Persian/Arabic Open Source Font";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/norwester/default.nix b/pkgs/data/fonts/norwester/default.nix
index 35d69aa7f07..0de5aa8fdf3 100644
--- a/pkgs/data/fonts/norwester/default.nix
+++ b/pkgs/data/fonts/norwester/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.2";
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "1npsaiiz9g5z6315lnmynwcnrfl37fyxc7w1mhkw1xbzcnv74z4r";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://jamiewilson.io/norwester;
     description = "A condensed geometric sans serif by Jamie Wilson";
     maintainers = with maintainers; [ leenaars ];
diff --git a/pkgs/data/fonts/noto-fonts/tools.nix b/pkgs/data/fonts/noto-fonts/tools.nix
index b5fc13daefa..a9d45128c5b 100644
--- a/pkgs/data/fonts/noto-fonts/tools.nix
+++ b/pkgs/data/fonts/noto-fonts/tools.nix
@@ -27,6 +27,5 @@ pythonPackages.buildPythonPackage rec {
     description = "Noto fonts support tools and scripts plus web site generation";
     license = lib.licenses.asl20;
     homepage = https://github.com/googlei18n/nototools;
-    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/office-code-pro/default.nix b/pkgs/data/fonts/office-code-pro/default.nix
index 564b950784b..4354725c90c 100644
--- a/pkgs/data/fonts/office-code-pro/default.nix
+++ b/pkgs/data/fonts/office-code-pro/default.nix
@@ -1,26 +1,23 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "office-code-pro";
   version = "1.004";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "nathco";
-    repo = "Office-Code-Pro";
-    rev = version;
-    sha256 = "0znmjjyn5q83chiafy252bhsmw49r2nx2ls2cmhjp4ihidfr6cmb";
-  };
+  owner = "nathco";
+  repo = "Office-Code-Pro";
+  rev = version;
 
-  installPhase = ''
-    fontDir=$out/share/fonts/opentype
-    docDir=$out/share/doc/${pname}-${version}
-    mkdir -p $fontDir $docDir
-    install -Dm644 README.md $docDir
-    install -t $fontDir -m644 'Fonts/Office Code Pro/OTF/'*.otf
-    install -t $fontDir -m644 'Fonts/Office Code Pro D/OTF/'*.otf
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -m644 -Dt $out/share/doc/${name} README.md
+    install -m444 -Dt $out/share/fonts/opentype 'Fonts/Office Code Pro/OTF/'*.otf 'Fonts/Office Code Pro D/OTF/'*.otf
   '';
+  sha256 = "1bagwcaicn6q8qkqazz6wb3x30y4apmkga0mkv8fh6890hfhywr9";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A customized version of Source Code Pro";
     longDescription = ''
       Office Code Pro is a customized version of Source Code Pro, the monospaced
@@ -31,6 +28,5 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/nathco/Office-Code-Pro;
     license = licenses.ofl;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/oldsindhi/default.nix b/pkgs/data/fonts/oldsindhi/default.nix
index 4e55b5098c8..c2ea6a7180b 100644
--- a/pkgs/data/fonts/oldsindhi/default.nix
+++ b/pkgs/data/fonts/oldsindhi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   version = "0.1";
@@ -10,15 +10,13 @@ in fetchzip rec {
   postFetch = ''
     ${p7zip}/bin/7z x $downloadedFile
 
-    mkdir -p $out/share/fonts/truetype
-    mkdir -p $out/share/doc/${name}
-    cp -v OldSindhi/*.ttf $out/share/fonts/truetype/
-    cp -v OldSindhi/README OldSindhi/*.txt $out/share/doc/${name}
+    install -m444 -Dt $out/share/fonts/truetype OldSindhi/*.ttf
+    install -m444 -Dt $out/share/doc/${name}    OldSindhi/README OldSindhi/*.txt
   '';
 
-  sha256 = "1na3lxyz008fji5ln3fqzyr562k6kch1y824byhfs4y0rwwz3f3q";
+  sha256 = "0d4l9cg2vmh2pvnqsla8mgcwvc7wjxzcabhlli6633h3ifj2yp7b";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/MihailJP/oldsindhi;
     description = "Free Sindhi Khudabadi font";
     maintainers = with maintainers; [ mathnerd314 ];
diff --git a/pkgs/data/fonts/oldstandard/default.nix b/pkgs/data/fonts/oldstandard/default.nix
index 95f8f3be7d6..cd0d0063efb 100644
--- a/pkgs/data/fonts/oldstandard/default.nix
+++ b/pkgs/data/fonts/oldstandard/default.nix
@@ -1,29 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
-stdenv.mkDerivation rec {
-  name = "oldstandard-${version}";
+let
   version = "2.2";
+in fetchzip rec {
+  name = "oldstandard-${version}";
 
-  src = fetchzip {
-    stripRoot = false;
-    url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${name}.otf.zip";
-    sha256 = "1hl78jw5szdjq9dhbcv2ln75wpp2lzcxrnfc36z35v5wk4l7jc3h";
-  };
-
-  phases = [ "unpackPhase" "installPhase" ];
+  url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${name}.otf.zip";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    mkdir -p $out/share/doc/${name}
-    cp -v *.otf $out/share/fonts/opentype/
-    cp -v FONTLOG.txt $out/share/doc/${name}
+  postFetch = ''
+    unzip $downloadedFile
+    install -m444 -Dt $out/share/fonts/opentype *.otf
+    install -m444 -Dt $out/share/doc/${name}    FONTLOG.txt
   '';
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1qwfsyp51grr56jcnkkmnrnl3r20pmhp9zh9g88kp64m026cah6n";
+  sha256 = "1qwfsyp51grr56jcnkkmnrnl3r20pmhp9zh9g88kp64m026cah6n";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/akryukov/oldstand;
     description = "An attempt to revive a specific type of Modern style of serif typefaces";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/open-dyslexic/default.nix b/pkgs/data/fonts/open-dyslexic/default.nix
index 7fa57463ece..8519c346891 100644
--- a/pkgs/data/fonts/open-dyslexic/default.nix
+++ b/pkgs/data/fonts/open-dyslexic/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2016-06-23";
@@ -15,7 +15,7 @@ in fetchzip {
 
   sha256 = "1vl8z5rknh2hpr2f0v4b2qgs5kclx5pzyk8al7243k5db82a2cyi";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://opendyslexic.org/;
     description = "Font created to increase readability for readers with dyslexia";
     license = "Bitstream Vera License (https://www.gnome.org/fonts/#Final_Bitstream_Vera_Fonts)";
diff --git a/pkgs/data/fonts/open-sans/default.nix b/pkgs/data/fonts/open-sans/default.nix
index d8918a6567b..dfe1426d697 100644
--- a/pkgs/data/fonts/open-sans/default.nix
+++ b/pkgs/data/fonts/open-sans/default.nix
@@ -1,25 +1,23 @@
-{ stdenv, fetchFromGitLab }:
+{ lib, fetchFromGitLab }:
 
-stdenv.mkDerivation rec {
+let
   pname = "open-sans";
   version = "1.11";
+in fetchFromGitLab rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitLab {
-    domain = "salsa.debian.org";
-    owner = "fonts-team";
-    repo = "fonts-open-sans";
-    rev = "debian%2F1.11-1"; # URL-encoded form of "debian/1.11-1" tag
-    sha256 = "077hkvpmk3ghbqyb901w43b2m2a27lh8ddasyx1x7pdwyr2bjjl2";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
+  domain = "salsa.debian.org";
+  owner = "fonts-team";
+  repo = "fonts-open-sans";
+  rev = "debian%2F1.11-1"; # URL-encoded form of "debian/1.11-1" tag
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
   '';
+  sha256 = "146ginwx18z624z582lrnhil8jvi9bjg6843265bgxxrfmf75vhp";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Open Sans fonts";
     longDescription = ''
       Open Sans is a humanist sans serif typeface designed by Steve Matteson,
diff --git a/pkgs/data/fonts/orbitron/default.nix b/pkgs/data/fonts/orbitron/default.nix
index e0ef1ecda81..699345f753e 100644
--- a/pkgs/data/fonts/orbitron/default.nix
+++ b/pkgs/data/fonts/orbitron/default.nix
@@ -1,23 +1,23 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "20110526";
-in fetchzip {
+in fetchFromGitHub {
   name = "orbitron-${version}";
 
-  url = https://github.com/theleagueof/orbitron/archive/13e6a52.zip;
+  owner = "theleagueof";
+  repo = "orbitron";
+  rev = "13e6a52";
 
   postFetch = ''
-    otfdir=$out/share/fonts/opentype/orbitron
-    ttfdir=$out/share/fonts/ttf/orbitron
-    mkdir -p $otfdir $ttfdir
-    unzip -j $downloadedFile \*/Orbitron\*.otf -d $otfdir
-    unzip -j $downloadedFile \*/Orbitron\*.ttf -d $ttfdir
+    tar xf $downloadedFile --strip=1
+    install -m444 -Dt $out/share/fonts/opentype/orbitron *.otf
+    install -m444 -Dt $out/share/fonts/ttf/orbitron      *.ttf
   '';
 
   sha256 = "1y9yzvpqs2v3ssnqk2iiglrh8amgsscnk8vmfgnqgqi9f4dhdvnv";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.theleagueofmoveabletype.com/orbitron;
     downloadPage = "https://www.theleagueofmoveabletype.com/orbitron/download";
     description = ''
diff --git a/pkgs/data/fonts/overpass/default.nix b/pkgs/data/fonts/overpass/default.nix
index c39bb945f48..4730a67e290 100644
--- a/pkgs/data/fonts/overpass/default.nix
+++ b/pkgs/data/fonts/overpass/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "3.0.3";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "1m6p7rrlyqikjvypp4698sn0lp3a4z0z5al4swblfhg8qaxzv5pg";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://overpassfont.org/;
     description = "Font heavily inspired by Highway Gothic";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/oxygenfonts/default.nix b/pkgs/data/fonts/oxygenfonts/default.nix
index 109b3c3a0b3..e34e49d9814 100644
--- a/pkgs/data/fonts/oxygenfonts/default.nix
+++ b/pkgs/data/fonts/oxygenfonts/default.nix
@@ -1,18 +1,21 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
-fetchzip rec {
+fetchFromGitHub {
   name = "oxygenfonts-20160824";
 
-  url = https://github.com/vernnobile/oxygenFont/archive/62db0ebe3488c936406685485071a54e3d18473b.zip;
+  owner = "vernnobile";
+  repo = "oxygenFont";
+  rev = "62db0ebe3488c936406685485071a54e3d18473b";
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile '*/Oxygen-Sans.ttf' '*/Oxygen-Sans-Bold.ttf' '*/OxygenMono-Regular.ttf' -d $out/share/fonts/truetype
+    tar xf $downloadedFile --strip=1
+    mkdir -p $out/share/fonts/truetype
+    cp */Oxygen-Sans.ttf */Oxygen-Sans-Bold.ttf */OxygenMono-Regular.ttf $out/share/fonts/truetype
   '';
 
   sha256 = "17m86p1s7a7d90zqjsr46h5bpmas4vxsgj7kd0j5c8cb7lw92jyf";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Desktop/gui font for integrated use with the KDE desktop";
     longDescription = ''
       Oxygen Font is a font family originally aimed as a desktop/gui
diff --git a/pkgs/data/fonts/parastoo-fonts/default.nix b/pkgs/data/fonts/parastoo-fonts/default.nix
index 00f03b53078..d02925e3a37 100644
--- a/pkgs/data/fonts/parastoo-fonts/default.nix
+++ b/pkgs/data/fonts/parastoo-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "parastoo-fonts";
   version = "1.0.0-alpha5";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "parastoo-font";
-    rev = "v${version}";
-    sha256 = "1nya9cbbs6sgv2w3zyah3lb1kqylf922q3fazh4l7bi6zgm8q680";
-  };
+  owner = "rastikerdar";
+  repo = "parastoo-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/parastoo-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/parastoo-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/parastoo-fonts {} \;
   '';
+  sha256 = "10jbii6rskcy4akjl5yfcqv4mfwk3nqnx36l6sbxks43va9l04f4";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/parastoo-font;
     description = "A Persian (Farsi) Font - فونت ( قلم ) فارسی پرستو";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/paratype-pt/mono.nix b/pkgs/data/fonts/paratype-pt/mono.nix
index 6124d0c79b6..e6f0776daea 100644
--- a/pkgs/data/fonts/paratype-pt/mono.nix
+++ b/pkgs/data/fonts/paratype-pt/mono.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-mono";
 
-  url = "http://www.paratype.ru/uni/public/PTMono.zip";
+  url = [
+    https://company.paratype.com/system/attachments/631/original/ptmono.zip
+    http://rus.paratype.ru/system/attachments/631/original/ptmono.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "07kl82ngby55khvzsvn831ddpc0q8djgz2y6gsjixkyjfdk2xjjm";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/paratype-pt/sans.nix b/pkgs/data/fonts/paratype-pt/sans.nix
index 499871a4228..1e6610e8e44 100644
--- a/pkgs/data/fonts/paratype-pt/sans.nix
+++ b/pkgs/data/fonts/paratype-pt/sans.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-sans";
 
-  url = "http://www.paratype.ru/uni/public/PTSans.zip";
+  url = [
+    https://company.paratype.com/system/attachments/629/original/ptsans.zip
+    http://rus.paratype.ru/system/attachments/629/original/ptsans.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "01fkd417gv98jf3a6zyfi9w2dkqsbddy1vacga2672yf0kh1z1r0";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/paratype-pt/serif.nix b/pkgs/data/fonts/paratype-pt/serif.nix
index 409aaf526f8..f4da6508f08 100644
--- a/pkgs/data/fonts/paratype-pt/serif.nix
+++ b/pkgs/data/fonts/paratype-pt/serif.nix
@@ -3,7 +3,10 @@
 fetchzip rec {
   name = "paratype-pt-serif";
 
-  url = "http://www.paratype.ru/uni/public/PTSerif.zip";
+  url = [
+    https://company.paratype.com/system/attachments/634/original/ptserif.zip
+    http://rus.paratype.ru/system/attachments/634/original/ptserif.zip
+  ];
 
   postFetch = ''
     mkdir -p $out/share/{doc,fonts}
@@ -14,7 +17,7 @@ fetchzip rec {
   sha256 = "1iw5qi4ag3yp1lwmi91lb18gr768bqwl46xskaqnkhr9i9qp0v6d";
 
   meta = with stdenv.lib; {
-    homepage = http://www.paratype.ru/public/; 
+    homepage = http://www.paratype.ru/public/;
     description = "An open Paratype font";
 
     license = "Open Paratype license";
diff --git a/pkgs/data/fonts/pecita/default.nix b/pkgs/data/fonts/pecita/default.nix
index a90ff42a8e2..144ec3bab85 100644
--- a/pkgs/data/fonts/pecita/default.nix
+++ b/pkgs/data/fonts/pecita/default.nix
@@ -1,9 +1,7 @@
-{ stdenv, fetchurl }:
+{ lib, fetchurl }:
 
 let
-
   version = "5.4";
-
 in
 
 fetchurl rec {
@@ -21,7 +19,7 @@ fetchurl rec {
   recursiveHash = true;
   sha256 = "0pwm20f38lcbfkdqkpa2ydpc9kvmdg0ifc4h2dmipsnwbcb5rfwm";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://pecita.eu/police-en.php;
     description = "Handwritten font with connected glyphs";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/penna/default.nix b/pkgs/data/fonts/penna/default.nix
index b1244c47bf1..57395c507fe 100644
--- a/pkgs/data/fonts/penna/default.nix
+++ b/pkgs/data/fonts/penna/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Geometric sans serif designed by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/poly/default.nix b/pkgs/data/fonts/poly/default.nix
index 81fc7b79925..d291d50e836 100644
--- a/pkgs/data/fonts/poly/default.nix
+++ b/pkgs/data/fonts/poly/default.nix
@@ -46,6 +46,5 @@ stdenv.mkDerivation rec {
     homepage = http://www.fontsquirrel.com/fonts/poly;
     license = stdenv.lib.licenses.ofl;
     maintainers = with stdenv.lib.maintainers; [ relrod ];
-    platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/data/fonts/powerline-fonts/default.nix b/pkgs/data/fonts/powerline-fonts/default.nix
index c932c7f06c0..c8044905a08 100644
--- a/pkgs/data/fonts/powerline-fonts/default.nix
+++ b/pkgs/data/fonts/powerline-fonts/default.nix
@@ -1,30 +1,24 @@
-{ stdenv, fetchzip}:
+{ lib, fetchFromGitHub }:
 
-fetchzip {
+fetchFromGitHub {
   name = "powerline-fonts-2018-11-11";
 
-  url = https://github.com/powerline/fonts/archive/e80e3eba9091dac0655a0a77472e10f53e754bb0.zip;
+  owner = "powerline";
+  repo = "fonts";
+  rev = "e80e3eba9091dac0655a0a77472e10f53e754bb0";
 
   postFetch = ''
-    mkdir -p $out/share/fonts/opentype
-    unzip -j $downloadedFile '*.otf' -d $out/share/fonts/opentype
-
-    mkdir -p $out/share/fonts/truetype
-    unzip -j $downloadedFile '*.ttf' -d $out/share/fonts/truetype
-
-    mkdir -p $out/share/fonts/bdf
-    unzip -j $downloadedFile '*/BDF/*.bdf' -d $out/share/fonts/bdf
-
-    mkdir -p $out/share/fonts/pcf
-    unzip -j $downloadedFile '*/PCF/*.pcf.gz' -d $out/share/fonts/pcf
-
-    mkdir -p $out/share/fonts/psf
-    unzip -j $downloadedFile '*/PSF/*.psf.gz' -d $out/share/fonts/psf
+    tar xf $downloadedFile --strip=1
+    find . -name '*.otf'    -exec install -Dt $out/share/fonts/opentype {} \;
+    find . -name '*.ttf'    -exec install -Dt $out/share/fonts/truetype {} \;
+    find . -name '*.bdf'    -exec install -Dt $out/share/fonts/bdf      {} \;
+    find . -name '*.pcf.gz' -exec install -Dt $out/share/fonts/pcf      {} \;
+    find . -name '*.psf.gz' -exec install -Dt $out/share/fonts/psf      {} \;
   '';
 
   sha256 = "0irifak86gn7hawzgxcy53s22y215mxc2kjncv37h7q44jsqdqww";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/powerline/fonts;
     description = "Patched fonts for Powerline users";
     longDescription = ''
diff --git a/pkgs/data/fonts/profont/default.nix b/pkgs/data/fonts/profont/default.nix
index 0c6eede969f..c28c9283a9b 100644
--- a/pkgs/data/fonts/profont/default.nix
+++ b/pkgs/data/fonts/profont/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "profont";
 
-  url = "http://tobiasjung.name/downloadfile.php?file=profont-x11.zip";
+  url = "http://web.archive.org/web/20160707013914/http://tobiasjung.name/downloadfile.php?file=profont-x11.zip";
 
   postFetch = ''
     unzip -j $downloadedFile
@@ -19,10 +19,10 @@ fetchzip rec {
 
   sha256 = "1calqmvrfv068w61f614la8mg8szas6m5i9s0lsmwjhb4qwjyxbw";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://tobiasjung.name;
     description = "A monospaced font created to be a most readable font for programming";
-    maintainers = with stdenv.lib.maintainers; [ myrl ];
+    maintainers = with lib.maintainers; [ myrl ];
     license = licenses.mit;
     platforms = platforms.all;
   };
diff --git a/pkgs/data/fonts/public-sans/default.nix b/pkgs/data/fonts/public-sans/default.nix
index 12adfcb9136..cfcf2563340 100644
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.003";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "02ranwr1bw4n9n1ljw234nzhj2a0hgradniib37nh10maark5wg3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";
     homepage = https://public-sans.digital.gov/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/quattrocento-sans/default.nix b/pkgs/data/fonts/quattrocento-sans/default.nix
index 34c8a74a762..429cd80c2fc 100644
--- a/pkgs/data/fonts/quattrocento-sans/default.nix
+++ b/pkgs/data/fonts/quattrocento-sans/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "2.0";
 in fetchzip rec {
   name = "quattrocento-sans-${version}";
 
-  url = "http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
+  url = "http://web.archive.org/web/20170709124317/http://www.impallari.com/media/releases/quattrocento-sans-v${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/{fonts,doc}
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0g8hnn92ks4y0jbizwj7yfa097lk887wqkqpqjdmc09sd2n44343";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.impallari.com/quattrocentosans/;
     description = "A classic, elegant and sober sans-serif typeface";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/quattrocento/default.nix b/pkgs/data/fonts/quattrocento/default.nix
index a78001bb4ae..7e268182eef 100644
--- a/pkgs/data/fonts/quattrocento/default.nix
+++ b/pkgs/data/fonts/quattrocento/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1";
 in fetchzip rec {
   name = "quattrocento-${version}";
 
-  url = "http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
+  url = "http://web.archive.org/web/20170707001804/http://www.impallari.com/media/releases/quattrocento-v${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/{fonts,doc}
@@ -15,7 +15,7 @@ in fetchzip rec {
 
   sha256 = "0f8l19y61y20sszn8ni8h9kgl0zy1gyzychg22z5k93ip4h7kfd0";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.impallari.com/quattrocento/;
     description = "A classic, elegant, sober and strong serif typeface";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/raleway/default.nix b/pkgs/data/fonts/raleway/default.nix
index 009295c5869..7fd6b80b714 100644
--- a/pkgs/data/fonts/raleway/default.nix
+++ b/pkgs/data/fonts/raleway/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchzip }:
+{ lib, fetchFromGitHub }:
 
 let
   version = "2016-08-30";
-in fetchzip {
+in fetchFromGitHub {
   name = "raleway-${version}";
 
-  url = https://github.com/impallari/Raleway/archive/fa27f47b087fc093c6ae11cfdeb3999ac602929a.zip;
+  owner = "impallari";
+  repo = "Raleway";
+  rev = "fa27f47b087fc093c6ae11cfdeb3999ac602929a";
 
   postFetch = ''
-    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*-Original.otf  -d $out/share/fonts/opentype
-    unzip -j $downloadedFile \*.txt \*.md     -d $out
+    tar xf $downloadedFile --strip=1
+    find . -name "*-Original.otf" -exec install -Dt $out/share/fonts/opentype {} \;
+    cp *.txt *.md -d $out
   '';
 
   sha256 = "16jr7drqg2wib2q48ajlsa7rh1jxjibl1wd4rjndi49vfl463j60";
@@ -33,8 +35,8 @@ in fetchzip {
     '';
 
     homepage = https://github.com/impallari/Raleway;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
 
-    maintainers = with stdenv.lib.maintainers; [ Profpatsch ];
+    maintainers = with lib.maintainers; [ Profpatsch ];
   };
 }
diff --git a/pkgs/data/fonts/ricty/default.nix b/pkgs/data/fonts/ricty/default.nix
index d26adfc0f9f..2667562b1b0 100644
--- a/pkgs/data/fonts/ricty/default.nix
+++ b/pkgs/data/fonts/ricty/default.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation rec {
     description = "A high-quality Japanese font based on Inconsolata and Migu 1M";
     homepage = https://www.rs.tus.ac.jp/yyusa/ricty.html;
     license = licenses.unfree;
-    platforms = platforms.unix;
     maintainers = [ maintainers.mikoim ];
   };
 }
diff --git a/pkgs/data/fonts/roboto/default.nix b/pkgs/data/fonts/roboto/default.nix
index 26697c52327..707d31ac531 100644
--- a/pkgs/data/fonts/roboto/default.nix
+++ b/pkgs/data/fonts/roboto/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.138";
@@ -22,8 +22,8 @@ in fetchzip rec {
       Chrome OS, and the recommended font for Google’s visual language,
       Material Design.
     '';
-    license = stdenv.lib.licenses.asl20;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.romildo ];
   };
 }
diff --git a/pkgs/data/fonts/rounded-mgenplus/default.nix b/pkgs/data/fonts/rounded-mgenplus/default.nix
index c6cb61b7bd1..43198702492 100644
--- a/pkgs/data/fonts/rounded-mgenplus/default.nix
+++ b/pkgs/data/fonts/rounded-mgenplus/default.nix
@@ -1,33 +1,19 @@
-{ stdenv, fetchurl, p7zip }:
+{ lib, fetchzip, p7zip }:
 
 let
   pname = "rounded-mgenplus";
   version = "20150602";
-
-in
-
-stdenv.mkDerivation rec {
+in fetchzip rec {
   name = "${pname}-${version}";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
-    sha256 = "1k15xvzd3s5ppp151wv31wrfq2ri8v96xh7i71i974rxjxj6gspc";
-  };
-
-  nativeBuildInputs = [ p7zip ];
-
-  phases = [ "unpackPhase" "installPhase" ];
-
-  unpackPhase = ''
-    7z x $src
-  '';
 
-  installPhase = ''
+  url = "https://osdn.jp/downloads/users/8/8598/${name}.7z";
+  postFetch = ''
+    ${p7zip}/bin/7z x $downloadedFile
     install -m 444 -D -t $out/share/fonts/${pname} ${pname}-*.ttf
   '';
+  sha256 = "0vwdknagdrl5dqwpb1x5lxkbfgvbx8dpg7cb6yamgz71831l05v1";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A Japanese font based on Rounded M+ and Noto Sans Japanese";
     homepage = http://jikasei.me/font/rounded-mgenplus/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/route159/default.nix b/pkgs/data/fonts/route159/default.nix
index 892078a1151..1b8d4e60653 100644
--- a/pkgs/data/fonts/route159/default.nix
+++ b/pkgs/data/fonts/route159/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "1";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "A weighted sans serif font";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/sahel-fonts/default.nix b/pkgs/data/fonts/sahel-fonts/default.nix
index 20545be3dca..0b90a43ca3e 100644
--- a/pkgs/data/fonts/sahel-fonts/default.nix
+++ b/pkgs/data/fonts/sahel-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "sahel-fonts";
   version = "1.0.0-alpha22";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "sahel-font";
-    rev = "v${version}";
-    sha256 = "1kx7byzb5zxspq0i4cvgf4q7sm6xnhdnfyw9zrb1wfmdv3jzaz7p";
-  };
+  owner = "rastikerdar";
+  repo = "sahel-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/sahel-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/sahel-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/sahel-fonts {} \;
   '';
+  sha256 = "0vj8ydv50rjanb0favd7rh4r9rv5fl39vqwvzkpgfdcdawn0xjm7";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/sahel-font;
     description = "A Persian (farsi) Font - فونت (قلم) فارسی ساحل";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/samim-fonts/default.nix b/pkgs/data/fonts/samim-fonts/default.nix
index 620e2fdcfb9..dd4a01c782e 100644
--- a/pkgs/data/fonts/samim-fonts/default.nix
+++ b/pkgs/data/fonts/samim-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "samim-fonts";
   version = "3.1.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "samim-font";
-    rev = "v${version}";
-    sha256 = "1mp0pgbn9r098ilajwzag7c21shwb13mq61ly9av0mfbpnhkkjqk";
-  };
+  owner = "rastikerdar";
+  repo = "samim-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/samim-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/samim-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/samim-fonts {} \;
   '';
+  sha256 = "0mmhncqg48dp0d7l725dv909zswbkk22dlqzcdfh6k6cgk2gn08q";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/samim-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی صمیم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index 17ee7cc2a9e..f46fda0dd31 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -1,25 +1,21 @@
-{ stdenv, fetchurl, p7zip }:
+{ lib, fetchurl, p7zip }:
 
 let
   version = "0.8.0";
-  sha256 = "0zafvzrh4180hmz351f1rvs29n8mfxf0qv6mdl7psf1f066dizs6";
 in fetchurl rec {
-  inherit sha256;
-
   name = "sarasa-gothic-${version}";
 
   url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
+  sha256 = "0zafvzrh4180hmz351f1rvs29n8mfxf0qv6mdl7psf1f066dizs6";
 
   recursiveHash = true;
   downloadToTemp = true;
 
   postFetch = ''
-    ${p7zip}/bin/7z x $downloadedFile
-    mkdir -p $out/share/fonts
-    install -m644 *.ttc $out/share/fonts/
+    ${p7zip}/bin/7z x $downloadedFile -o$out/share/fonts
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "SARASA GOTHIC is a Chinese & Japanese programming font based on Iosevka and Source Han Sans";
     homepage = https://github.com/be5invis/Sarasa-Gothic;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/scheherazade/default.nix b/pkgs/data/fonts/scheherazade/default.nix
index b35f537c06b..062b29c9039 100644
--- a/pkgs/data/fonts/scheherazade/default.nix
+++ b/pkgs/data/fonts/scheherazade/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.100";
@@ -17,7 +17,7 @@ in fetchzip rec {
 
   sha256 = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://software.sil.org/scheherazade/;
     description = "A font designed in a similar style to traditional Naskh typefaces";
     longDescription = ''
diff --git a/pkgs/data/fonts/seshat/default.nix b/pkgs/data/fonts/seshat/default.nix
index 6b22716f1eb..af3c5dd25ee 100644
--- a/pkgs/data/fonts/seshat/default.nix
+++ b/pkgs/data/fonts/seshat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib,  fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Roman body font designed for main text by Sora Sagano";
     longDescription = ''
diff --git a/pkgs/data/fonts/shabnam-fonts/default.nix b/pkgs/data/fonts/shabnam-fonts/default.nix
index cf4bd372229..89bca56a53e 100644
--- a/pkgs/data/fonts/shabnam-fonts/default.nix
+++ b/pkgs/data/fonts/shabnam-fonts/default.nix
@@ -1,22 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "shabnam-fonts";
+let
+  pname = "shabnam-fonts";
   version = "4.0.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "shabnam-font";
-    rev = "v${version}";
-    sha256 = "1y4w16if2y12028b9vyc5l5c5bvcglhxacv380ixb8fcc4hfakmb";
-  };
+  owner = "rastikerdar";
+  repo = "shabnam-font";
+  rev = "v${version}";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/shabnam-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/shabnam-fonts
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/shabnam-fonts {} \;
   '';
+  sha256 = "0wfyaaj2pq2knz12l7rsc4wc703cbz0r8gkcya5x69p0aixch8ba";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/shabnam-font;
     description = "A Persian (Farsi) Font - فونت (قلم) فارسی شبنم";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/shrikhand/default.nix b/pkgs/data/fonts/shrikhand/default.nix
index 034c36a63ce..a00036510f5 100644
--- a/pkgs/data/fonts/shrikhand/default.nix
+++ b/pkgs/data/fonts/shrikhand/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2016-03-03";
@@ -11,7 +11,7 @@ in fetchzip {
 
   sha256 = "0s54k9cs1g2yz6lwg5gakqb12vg5qkfdz3pc8mh7mib2s6q926hs";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://jonpinhorn.github.io/shrikhand/;
     description = "A vibrant and playful typeface for both Latin and Gujarati writing systems";
     maintainers = with maintainers; [ sternenseemann ];
diff --git a/pkgs/data/fonts/siji/default.nix b/pkgs/data/fonts/siji/default.nix
index a5a4be73c27..a0acf78d855 100644
--- a/pkgs/data/fonts/siji/default.nix
+++ b/pkgs/data/fonts/siji/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   date = "2016-05-13";
@@ -19,8 +19,8 @@ in fetchzip {
   meta = {
     homepage = https://github.com/stark/siji;
     description = "An iconic bitmap font based on Stlarch with additional glyphs";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.asymmetric ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.asymmetric ];
   };
 }
diff --git a/pkgs/data/fonts/source-code-pro/default.nix b/pkgs/data/fonts/source-code-pro/default.nix
index 6c3b9035306..be4d045815c 100644
--- a/pkgs/data/fonts/source-code-pro/default.nix
+++ b/pkgs/data/fonts/source-code-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.030";
@@ -16,9 +16,9 @@ in fetchzip {
 
   meta = {
     description = "A set of monospaced OpenType fonts designed for coding environments";
-    maintainers = with stdenv.lib.maintainers; [ relrod ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ relrod ];
+    platforms = with lib.platforms; all;
     homepage = https://adobe-fonts.github.io/source-code-pro/;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/source-han-code-jp/default.nix b/pkgs/data/fonts/source-han-code-jp/default.nix
index fc016a457c2..85f5cddd2ea 100644
--- a/pkgs/data/fonts/source-han-code-jp/default.nix
+++ b/pkgs/data/fonts/source-han-code-jp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   pname = "source-han-code-jp";
@@ -17,9 +17,9 @@ in fetchzip {
 
   meta = {
     description = "A monospaced Latin font suitable for coding";
-    maintainers = with stdenv.lib.maintainers; [ mt-caret ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ mt-caret ];
+    platforms = with lib.platforms; all;
     homepage = https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/source-han-sans/default.nix b/pkgs/data/fonts/source-han-sans/default.nix
index dc0d3175851..87e24c0e23c 100644
--- a/pkgs/data/fonts/source-han-sans/default.nix
+++ b/pkgs/data/fonts/source-han-sans/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   makePackage = {variant, language, region, sha256}: let
@@ -19,9 +19,8 @@ let
     meta = {
       description = "${language} subset of an open source Pan-CJK sans-serif typeface";
       homepage = https://github.com/adobe-fonts/source-han-sans;
-      license = stdenv.lib.licenses.ofl;
-      platforms = stdenv.lib.platforms.unix;
-      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      license = lib.licenses.ofl;
+      maintainers = with lib.maintainers; [ taku0 ];
     };
   };
 in
diff --git a/pkgs/data/fonts/source-han-serif/default.nix b/pkgs/data/fonts/source-han-serif/default.nix
index ac85d31d331..bb5a67c8306 100644
--- a/pkgs/data/fonts/source-han-serif/default.nix
+++ b/pkgs/data/fonts/source-han-serif/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   makePackage = {variant, language, region, sha256}: let
@@ -19,9 +19,8 @@ let
     meta = {
       description = "${language} subset of an open source Pan-CJK serif typeface";
       homepage = https://github.com/adobe-fonts/source-han-sans;
-      license = stdenv.lib.licenses.ofl;
-      platforms = stdenv.lib.platforms.unix;
-      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      license = lib.licenses.ofl;
+      maintainers = with lib.maintainers; [ taku0 ];
     };
   };
 in
diff --git a/pkgs/data/fonts/source-sans-pro/default.nix b/pkgs/data/fonts/source-sans-pro/default.nix
index 84360dec5d4..bea5fea0f9d 100644
--- a/pkgs/data/fonts/source-sans-pro/default.nix
+++ b/pkgs/data/fonts/source-sans-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "source-sans-pro-2.045";
@@ -14,7 +14,7 @@ fetchzip {
 
   sha256 = "0xjdp226ybdcfylbpfsdgnz2bf4pj4qv1wfs6fv22hjxlzqfixf3";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://adobe-fonts.github.io/source-sans-pro/;
     description = "A set of OpenType fonts designed by Adobe for UIs";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/source-serif-pro/default.nix b/pkgs/data/fonts/source-serif-pro/default.nix
index cdfe1e3f187..87484a99b11 100644
--- a/pkgs/data/fonts/source-serif-pro/default.nix
+++ b/pkgs/data/fonts/source-serif-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.010";
@@ -16,7 +16,7 @@ in fetchzip {
 
   sha256 = "1a3lmqk7hyxpfkb30s9z73lhs823dmq6xr5llp9w23g6bh332x2h";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://adobe-fonts.github.io/source-serif-pro/;
     description = "A set of OpenType fonts to complement Source Sans Pro";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/spleen/default.nix b/pkgs/data/fonts/spleen/default.nix
index a474c3db779..ed1e1e52e98 100644
--- a/pkgs/data/fonts/spleen/default.nix
+++ b/pkgs/data/fonts/spleen/default.nix
@@ -1,23 +1,25 @@
-{ stdenv, fetchurl, mkfontdir, mkfontscale }:
+{ lib, fetchurl }:
 
-stdenv.mkDerivation rec {
+let
   pname = "spleen";
   version = "1.0.4";
+in fetchurl rec {
+  name = "${pname}-${version}";
+  url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
 
-  src = fetchurl {
-    url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
-    sha256 = "1x62a5ygn3rpgzbaacz64rp8mn7saymdnxci4l3xasvsjjp60s3g";
-  };
-
-  buildPhase = "gzip -n9 *.pcf";
-  installPhase = ''
+  downloadToTemp = true;
+  recursiveHash = true;
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     d="$out/share/fonts/X11/misc/spleen"
+    gzip -n9 *.pcf
     install -Dm644 *.pcf.gz  -t $d
     install -Dm644 *.bdf -t $d
     install -m644 fonts.alias-spleen $d/fonts.alias
   '';
+  sha256 = "0jab55h08gy7gpyxqfrfj30iinmknpllh3dp5g7ck5q3qfgdzh7m";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Monospaced bitmap fonts";
     homepage = https://www.cambus.net/spleen-monospaced-bitmap-fonts;
     license = licenses.bsd2;
diff --git a/pkgs/data/fonts/stix-otf/default.nix b/pkgs/data/fonts/stix-otf/default.nix
index 1ae85da3f7f..f5d15439079 100644
--- a/pkgs/data/fonts/stix-otf/default.nix
+++ b/pkgs/data/fonts/stix-otf/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 let
   version = "1.1.1";
 in fetchzip rec {
   name = "stix-otf-${version}";
 
-  url = "mirror://sourceforge/stixfonts/STIXv${version}-word.zip";
+  url = "http://ftp.fi.muni.cz/pub/linux/gentoo/distfiles/STIXv${version}-word.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "04d4qxq3i9fyapsmxk6d9v1xirjam8c74fyxs6n24d3gf2945zmw";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://www.stixfonts.org/;
     description = "Fonts for Scientific and Technical Information eXchange";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/stix-two/default.nix b/pkgs/data/fonts/stix-two/default.nix
index f535c0d7e7b..1d5ed37767c 100644
--- a/pkgs/data/fonts/stix-two/default.nix
+++ b/pkgs/data/fonts/stix-two/default.nix
@@ -5,11 +5,11 @@ let
 in fetchzip {
   name = "stix-two-${version}";
 
-  url = "mirror://sourceforge/stixfonts/Current%20Release/STIXv${version}.zip";
+  url = "https://github.com/stipub/stixfonts/archive/${version}.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
-    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile '*/OTF/*.otf' -d $out/share/fonts/opentype
   '';
 
   sha256 = "19i30d2xjk52bjj7xva1hnlyh58yd5phas1njcc8ldcz87a1lhql";
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index 7652f593db4..bfc66a77207 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.37";
@@ -11,7 +11,7 @@ in fetchzip rec {
     mkdir -p $out/share/fonts/truetype/
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype/
   '';
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Font for programmers and command line users";
     homepage = https://www.kutilek.de/sudo-font/;
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/tamsyn/default.nix b/pkgs/data/fonts/tamsyn/default.nix
index 91198408d8d..380024e7e1a 100644
--- a/pkgs/data/fonts/tamsyn/default.nix
+++ b/pkgs/data/fonts/tamsyn/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, mkfontdir, mkfontscale }:
 
 let
-  version = "1.11"; 
+  version = "1.11";
 in stdenv.mkDerivation {
   pname = "tamsyn-font";
   inherit version;
@@ -22,7 +22,7 @@ in stdenv.mkDerivation {
     fontDir="$out/share/fonts/tamsyn"
     mkdir -p "$fontDir"
     mv *.pcf "$fontDir"
-    mv *.psf.gz "$fontDir" 
+    mv *.psf.gz "$fontDir"
 
     cd "$fontDir"
     mkfontdir
@@ -38,13 +38,12 @@ in stdenv.mkDerivation {
     longDescription = ''Tamsyn is a monospace bitmap font, primarily aimed at
     programmers. It was derived from Gilles Boccon-Gibod's MonteCarlo. Tamsyn
     font was further inspired by Gohufont, Terminus, Dina, Proggy, Fixedsys, and
-    Consolas. 
+    Consolas.
     '';
     homepage = http://www.fial.com/~scott/tamsyn-font/;
     downloadPage = http://www.fial.com/~scott/tamsyn-font/download;
     license = licenses.free;
     maintainers = [ maintainers.rps ];
-    platforms = platforms.linux;
   };
 }
 
diff --git a/pkgs/data/fonts/tempora-lgc/default.nix b/pkgs/data/fonts/tempora-lgc/default.nix
index 1cab3da200e..f06a5bfee27 100644
--- a/pkgs/data/fonts/tempora-lgc/default.nix
+++ b/pkgs/data/fonts/tempora-lgc/default.nix
@@ -38,6 +38,5 @@ stdenv.mkDerivation {
     description = ''Tempora font'';
     license = stdenv.lib.licenses.gpl2 ;
     maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/tenderness/default.nix b/pkgs/data/fonts/tenderness/default.nix
index 29682cc1299..958af414ff0 100644
--- a/pkgs/data/fonts/tenderness/default.nix
+++ b/pkgs/data/fonts/tenderness/default.nix
@@ -1,4 +1,4 @@
-{ stdenv,  fetchzip }:
+{ lib, fetchzip }:
 
 let
   majorVersion = "0";
@@ -17,7 +17,7 @@ fetchzip rec {
     unzip -j $downloadedFile \*.otf  -d $out/share/fonts/opentype/${pname}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "http://dotcolon.net/font/${pname}/";
     description = "Serif font designed by Sora Sagano with old-style figures";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/terminus-font-ttf/default.nix b/pkgs/data/fonts/terminus-font-ttf/default.nix
index 27abb72e124..211cc73cc9d 100644
--- a/pkgs/data/fonts/terminus-font-ttf/default.nix
+++ b/pkgs/data/fonts/terminus-font-ttf/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "4.47.0";
@@ -20,7 +20,7 @@ in fetchzip rec {
 
   sha256 = "1mnx3vlnl0r15yzsa4zb9qqab4hpi603gdwhlbw960wg03i3xn8z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A clean fixed width TTF font";
     longDescription = ''
       Monospaced bitmap font designed for long work with computers
@@ -29,6 +29,5 @@ in fetchzip rec {
     homepage = http://files.ax86.net/terminus-ttf;
     license = licenses.ofl;
     maintainers = with maintainers; [ okasu ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/terminus-font/default.nix b/pkgs/data/fonts/terminus-font/default.nix
index 2221f6bc6f5..4198fe2cbe6 100644
--- a/pkgs/data/fonts/terminus-font/default.nix
+++ b/pkgs/data/fonts/terminus-font/default.nix
@@ -37,6 +37,5 @@ stdenv.mkDerivation rec {
     homepage = http://terminus-font.sourceforge.net/;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ astsmtl ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/tewi/default.nix b/pkgs/data/fonts/tewi/default.nix
index 32d859bf53b..fbc29cdf5fb 100644
--- a/pkgs/data/fonts/tewi/default.nix
+++ b/pkgs/data/fonts/tewi/default.nix
@@ -46,6 +46,5 @@ stdenv.mkDerivation rec {
       url = "https://www.gnu.org/licenses/gpl-faq.html#FontException";
     };
     maintainers = [ maintainers.fro_ozen ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/tex-gyre-math/default.nix b/pkgs/data/fonts/tex-gyre-math/default.nix
index 3f9726ee094..8e1d2743174 100644
--- a/pkgs/data/fonts/tex-gyre-math/default.nix
+++ b/pkgs/data/fonts/tex-gyre-math/default.nix
@@ -28,32 +28,30 @@ let
     };
   };
 
-  mkVariant = variant: current:
-    let dotless_version = builtins.replaceStrings ["."] [""] current.version; in
+  mkVariant = variant: {displayName, version, sha256, outputHash}:
+    let dotless_version = builtins.replaceStrings ["."] [""] version; in
     stdenv.mkDerivation rec {
-      name = "tex-gyre-${variant}-math-${current.version}";
-      version = "${current.version}";
+      name = "tex-gyre-${variant}-math-${version}";
+      inherit version;
 
       src = fetchzip {
-        url = "www.gust.org.pl/projects/e-foundry/tg-math/download/texgyre${variant}-math-${dotless_version}.zip";
-        sha256 = current.sha256;
+        url = "http://www.gust.org.pl/projects/e-foundry/tg-math/download/texgyre${variant}-math-${dotless_version}.zip";
+        inherit sha256;
       };
 
       installPhase = ''
-        mkdir -p $out/share/fonts/opentype/
-        mkdir -p $out/share/doc/${name}/
-        cp -v opentype/*.otf $out/share/fonts/opentype/
-        cp -v doc/*.txt $out/share/doc/${name}/
+        install -m444 -Dt $out/share/fonts/opentype opentype/*.otf
+        install -m444 -Dt $out/share/doc/${name}    doc/*.txt
       '';
 
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
-      outputHash = current.outputHash;
+      inherit outputHash;
 
       meta = with stdenv.lib; {
         longDescription = ''
-          TeX Gyre ${current.displayName} Math is a math companion for the TeX Gyre
-          ${current.displayName} family of fonts (see
+          TeX Gyre ${displayName} Math is a math companion for the TeX Gyre
+          ${displayName} family of fonts (see
           http://www.gust.org.pl/projects/e-foundry/tex-gyre/) in the OpenType format.
         '';
         homepage = http://www.gust.org.pl/projects/e-foundry/tg-math;
diff --git a/pkgs/data/fonts/tex-gyre/default.nix b/pkgs/data/fonts/tex-gyre/default.nix
index 3229e58506d..7e55a70c71a 100644
--- a/pkgs/data/fonts/tex-gyre/default.nix
+++ b/pkgs/data/fonts/tex-gyre/default.nix
@@ -20,7 +20,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = outputHash;
+    inherit outputHash;
 
     meta = with stdenv.lib; {
       homepage = http://www.gust.org.pl/projects/e-foundry/tex-gyre;
diff --git a/pkgs/data/fonts/theano/default.nix b/pkgs/data/fonts/theano/default.nix
index 2dbe7e720d2..82563205454 100644
--- a/pkgs/data/fonts/theano/default.nix
+++ b/pkgs/data/fonts/theano/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.0";
@@ -16,7 +16,7 @@ in fetchzip rec {
 
   sha256 = "1my1symb7k80ys33iphsxvmf6432wx6vjdnxhzhkgrang1rhx1h8";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/akryukov/theano;
     description = "An old-style font designed from historic samples";
     maintainers = with maintainers; [ raskin rycee ];
diff --git a/pkgs/data/fonts/tipa/default.nix b/pkgs/data/fonts/tipa/default.nix
index 1a4954e6ce4..6cebe2120fe 100644
--- a/pkgs/data/fonts/tipa/default.nix
+++ b/pkgs/data/fonts/tipa/default.nix
@@ -22,7 +22,6 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Phonetic font for TeX";
-    platforms = stdenv.lib.platforms.unix;
   };
 }
 
diff --git a/pkgs/data/fonts/tlwg/default.nix b/pkgs/data/fonts/tlwg/default.nix
index 90f1b1da908..494f48fd36e 100644
--- a/pkgs/data/fonts/tlwg/default.nix
+++ b/pkgs/data/fonts/tlwg/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
     description = "A collection of Thai scalable fonts available under free licenses";
     homepage = https://linux.thai.net/projects/fonts-tlwg;
     license = with licenses; [ gpl2 publicDomain lppl13c free ];
-    platforms = platforms.unix;
     maintainers = [ maintainers.yrashk ];
   };
 }
diff --git a/pkgs/data/fonts/ttf-bitstream-vera/default.nix b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
index a4d479ea33c..a732b576ffd 100644
--- a/pkgs/data/fonts/ttf-bitstream-vera/default.nix
+++ b/pkgs/data/fonts/ttf-bitstream-vera/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "ttf-bitstream-vera-1.10";
@@ -7,14 +7,11 @@ fetchzip {
 
   postFetch = ''
     tar -xjf $downloadedFile --strip-components=1
-    fontDir=$out/share/fonts/truetype
-    mkdir -p $fontDir
-    cp *.ttf $fontDir
+    install -m444 -Dt $out/share/fonts/truetype *.ttf
   '';
 
   sha256 = "179hal4yi3367jg8rsvqx6h2w4s0kn9zzrv8c47sslyg28g39s4m";
 
   meta = {
-    platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/data/fonts/ttf-envy-code-r/default.nix b/pkgs/data/fonts/ttf-envy-code-r/default.nix
index 2c58f197f18..024e1acd434 100644
--- a/pkgs/data/fonts/ttf-envy-code-r/default.nix
+++ b/pkgs/data/fonts/ttf-envy-code-r/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   pname = "ttf-envy-code-r";
@@ -16,11 +16,10 @@ in fetchzip {
 
   sha256 = "0x0r07nax68cmz7490x2crzzgdg4j8fg63wppcmjqm0230bggq2z";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://damieng.com/blog/tag/envy-code-r;
     description = "Free scalable coding font by DamienG";
     license = licenses.unfree;
-    platforms = platforms.unix;
     maintainers = [ maintainers.lyt ];
   };
 }
diff --git a/pkgs/data/fonts/twemoji-color-font/default.nix b/pkgs/data/fonts/twemoji-color-font/default.nix
index 52d11bfd622..a9bf3720c07 100644
--- a/pkgs/data/fonts/twemoji-color-font/default.nix
+++ b/pkgs/data/fonts/twemoji-color-font/default.nix
@@ -38,6 +38,5 @@ stdenv.mkDerivation rec {
     downloadPage = "https://github.com/eosrei/twemoji-color-font/releases";
     license = with licenses; [ cc-by-40 mit ];
     maintainers = [ maintainers.fgaz ];
-    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/ubuntu-font-family/default.nix b/pkgs/data/fonts/ubuntu-font-family/default.nix
index e78f86fede4..5f072f90f05 100644
--- a/pkgs/data/fonts/ubuntu-font-family/default.nix
+++ b/pkgs/data/fonts/ubuntu-font-family/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "ubuntu-font-family-0.83";
 
-  url = "http://font.ubuntu.com/download/${name}.zip";
+  url = "https://assets.ubuntu.com/v1/fad7939b-ubuntu-font-family-0.83.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
@@ -19,8 +19,8 @@ fetchzip rec {
     contemporary style and contains characteristics unique to
     the Ubuntu brand that convey a precise, reliable and free attitude.";
     homepage = http://font.ubuntu.com/;
-    license = stdenv.lib.licenses.free;
-    platforms = stdenv.lib.platforms.all;
-    maintainers = [ stdenv.lib.maintainers.antono ];
+    license = lib.licenses.free;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.antono ];
   };
 }
diff --git a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
index f8df39c9565..35551e929e6 100644
--- a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
+++ b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.0";
@@ -13,10 +13,9 @@ fetchzip rec {
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The Ultimate Oldschool PC Font Pack (TTF Fonts)";
     homepage = "http://int10h.org/oldschool-pc-fonts/";
-    platforms = platforms.unix;
     license = licenses.cc-by-sa-40;
     maintainers = [ maintainers.endgame ];
   };
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index e61e582d742..c98936b8096 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "undefined-medium-1.0";
@@ -10,9 +10,9 @@ fetchzip rec {
     unzip -j $downloadedFile ${name}/fonts/otf/\*.otf -d $out/share/fonts/opentype
   '';
 
-  sha256 = "0v3p1g9f1c0d6b9lhrvm1grzivm7ddk7dvn96zl5hdzr2y60y1rw";
+  sha256 = "1wa04jzbffshwcxm705yb5wja8wakn8j7fvim1mlih2z1sqw0njk";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://undefined-medium.com/;
     description = "A pixel grid-based monospace typeface";
     longDescription = ''
diff --git a/pkgs/data/fonts/uni-vga/default.nix b/pkgs/data/fonts/uni-vga/default.nix
index 2a13824b36f..cd719a62d99 100644
--- a/pkgs/data/fonts/uni-vga/default.nix
+++ b/pkgs/data/fonts/uni-vga/default.nix
@@ -20,13 +20,12 @@ stdenv.mkDerivation {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  sha256 = "0rfly7r6blr2ykxlv0f6my2w41vvxcw85chspljd2p1fxlr28jd7";
+  outputHash = "0rfly7r6blr2ykxlv0f6my2w41vvxcw85chspljd2p1fxlr28jd7";
 
   meta = {
     description = "Unicode VGA font";
     maintainers = [stdenv.lib.maintainers.ftrvxmtrx];
     homepage = http://www.inp.nsk.su/~bolkhov/files/fonts/univga/;
     license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index b167a7802d1..d495efc79ec 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   name = "unifont-${version}";
-  version = "12.0.01";
+  version = "12.1.01";
 
   ttf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.ttf";
-    sha256 = "191vgddv5fksg7g01q692nfcb02ks2y28fi9fv8aghvs36q4iana";
+    sha256 = "05knv3vlnk8ahaybwz6r95d3a1h7h7q9ll6ij2jl7zgjhcx4zy5d";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/${name}/${name}.pcf.gz";
-    sha256 = "14xbrsdrnllly8h2afan3b4v486vd4y8iff8zqmcfliw0cipm8v4";
+    sha256 = "0q7dlnfzk49m4pgf2s7jv05jysa6sfxx3w0y17yis9j7g18lyw1b";
   };
 
   nativeBuildInputs = [ mkfontscale mkfontdir ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "1jccbz7wyyk7rpyapgsppcgakgpm1l9fqqxs7fg9naav7i0nzzpg";
+  outputHash = "0sgdr9dma4hkda3siydfvjrnzrpri8r7iqs2zqf77z9n4zn90qp5";
 
   meta = with stdenv.lib; {
     description = "Unicode font for Base Multilingual Plane";
diff --git a/pkgs/data/fonts/unifont_upper/default.nix b/pkgs/data/fonts/unifont_upper/default.nix
index d94a2cc0242..5cccc1eddc6 100644
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
-  version = "12.0.01";
+  version = "12.1.01";
 in fetchzip rec {
   name = "unifont_upper-${version}";
 
@@ -9,9 +9,9 @@ in fetchzip rec {
 
   postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";
 
-  sha256 = "1mmbndyi91fcdj7ykk5y7rypmm5jf2zf5pp5ab8hq3aa9y7invw3";
+  sha256 = "11b14ka2w16vssxdhgq7k9bx7xx0sr36hfi2vzyimmaibasi1r74";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
     homepage = http://unifoundry.com/unifont.html;
 
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index 408bd9a9264..d004e75571b 100755
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
@@ -1,23 +1,22 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
-  name = "vazir-fonts";
+let
+  pname = "vazir-fonts";
   version = "19.2.0";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "rastikerdar";
-    repo = "vazir-font";
-    rev = "v${version}";
-    sha256 = "0p96y4q20nhpv7hxca6rncfcb14iqy2vacv0xl55wkwqkm4wvzgr";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/vazir-fonts
-    cp -v $( find . -name '*.ttf') $out/share/fonts/vazir-fonts
+  owner = "rastikerdar";
+  repo = "vazir-font";
+  rev = "v${version}";
 
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/vazir-fonts {} \;
   '';
+  sha256 = "008h095rjrcjhz9h02v6cf3gv64khj21lii4zffgpdlmvfs29f8l";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/rastikerdar/vazir-font;
     description = "A Persian (Farsi) Font - قلم (فونت) فارسی وزیر";
     license = licenses.ofl;
diff --git a/pkgs/data/fonts/vdrsymbols/default.nix b/pkgs/data/fonts/vdrsymbols/default.nix
index d3373a64c49..01a4072099a 100644
--- a/pkgs/data/fonts/vdrsymbols/default.nix
+++ b/pkgs/data/fonts/vdrsymbols/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "vdrsymbols-20100612";
@@ -12,7 +12,7 @@ fetchzip rec {
     install -Dm444 -t "$out/share/fonts/truetype" */*.ttf
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "DejaVu fonts with additional symbols used by VDR";
     homepage = http://andreas.vdr-developer.org/fonts/;
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/vegur/default.nix b/pkgs/data/fonts/vegur/default.nix
index 4bf28782a8a..a269f17bf0e 100644
--- a/pkgs/data/fonts/vegur/default.nix
+++ b/pkgs/data/fonts/vegur/default.nix
@@ -1,29 +1,22 @@
-{ stdenv, rpmextract, fetchurl, unzip }:
+{ lib, buildPackages, fetchzip }:
 
-stdenv.mkDerivation rec {
+let
   version = "0.701";
+in fetchzip {
   name = "vegur-font-${version}";
 
   # Upstream doesn't version their URLs.
   # http://dotcolon.net/font/vegur/ → http://dotcolon.net/DL/font/vegur.zip
-  src = fetchurl {
-    url = "http://download.opensuse.org/repositories/M17N:/fonts/SLE_12_SP3/src/dotcolon-vegur-fonts-0.701-1.4.src.rpm";
-    sha256 = "0ra3fds3b352rpzn0015km539c3l2ik2lqd5x6fr65ss9fg2xn34";
-  };
-
-  nativeBuildInputs = [ rpmextract unzip ];
+  url = "http://download.opensuse.org/repositories/M17N:/fonts/SLE_12_SP3/src/dotcolon-vegur-fonts-0.701-1.4.src.rpm";
 
-  unpackPhase = ''
-    rpmextract $src
+  postFetch = ''
+    ${buildPackages.rpmextract}/bin/rpmextract $downloadedFile
     unzip vegur.zip
+    install -m444 -Dt $out/share/fonts/Vegur *.otf
   '';
+  sha256 = "0iisi2scq72lyj7pc1f36fhfjnm676n5byl4zaavhbxpdrbc6d1v";
 
-  installPhase = ''
-    mkdir -p $out/share/fonts/Vegur
-    cp *.otf $out/share/fonts/Vegur
-  '';
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = http://dotcolon.net/font/vegur/;
     description = "A humanist sans serif font.";
     platforms = platforms.all;
diff --git a/pkgs/data/fonts/vista-fonts-chs/default.nix b/pkgs/data/fonts/vista-fonts-chs/default.nix
index e9a3282e715..6a7cc71133a 100644
--- a/pkgs/data/fonts/vista-fonts-chs/default.nix
+++ b/pkgs/data/fonts/vista-fonts-chs/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip, cabextract}:
+{ lib, fetchzip, buildPackages }:
 
 # Modified from vista-fonts
 
@@ -8,7 +8,7 @@ fetchzip {
   url = http://download.microsoft.com/download/d/6/e/d6e2ff26-5821-4f35-a18b-78c963b1535d/VistaFont_CHS.EXE;
 
   postFetch = ''
-    ${cabextract}/bin/cabextract --lowercase --filter '*.TTF' $downloadedFile
+    ${buildPackages.cabextract}/bin/cabextract --lowercase --filter '*.TTF' $downloadedFile
 
     mkdir -p $out/share/fonts/truetype
     cp *.ttf $out/share/fonts/truetype
@@ -25,12 +25,12 @@ fetchzip {
   meta = {
     description = "TrueType fonts from Microsoft Windows Vista For Simplified Chinese (Microsoft YaHei)";
     homepage = https://www.microsoft.com/typography/fonts/family.aspx?FID=350;
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.ChengCat ];
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.ChengCat ];
 
     # Set a non-zero priority to allow easy overriding of the
     # fontconfig configuration files.
     priority = 5;
-    platforms = stdenv.lib.platforms.all;
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/vista-fonts/default.nix b/pkgs/data/fonts/vista-fonts/default.nix
index 65fa3fb81ab..e8784d90e7f 100644
--- a/pkgs/data/fonts/vista-fonts/default.nix
+++ b/pkgs/data/fonts/vista-fonts/default.nix
@@ -31,6 +31,6 @@ fetchzip {
     # Set a non-zero priority to allow easy overriding of the
     # fontconfig configuration files.
     priority = 5;
-    platforms = stdenv.lib.platforms.unix;
+    broken = true; # source url is 404
   };
 }
diff --git a/pkgs/data/fonts/weather-icons/default.nix b/pkgs/data/fonts/weather-icons/default.nix
index 8d818d21923..17227367120 100644
--- a/pkgs/data/fonts/weather-icons/default.nix
+++ b/pkgs/data/fonts/weather-icons/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "2.0.10";
-in fetchzip rec {
+in fetchzip {
   name = "weather-icons-${version}";
 
   url = "https://github.com/erikflowers/weather-icons/archive/${version}.zip";
@@ -14,7 +14,7 @@ in fetchzip rec {
 
   sha256 = "10zny9987wybq55sm803hrjkp33dq1lgmnxc15kssr8yb81g6qrl";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Weather Icons";
     longDescription = ''
       Weather Icons is the only icon font and CSS with 222 weather themed icons,
diff --git a/pkgs/data/fonts/wqy-microhei/default.nix b/pkgs/data/fonts/wqy-microhei/default.nix
index 038f0316940..dc87e6b634f 100644
--- a/pkgs/data/fonts/wqy-microhei/default.nix
+++ b/pkgs/data/fonts/wqy-microhei/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 fetchzip rec {
   name = "wqy-microhei-0.2.0-beta";
@@ -15,9 +15,9 @@ fetchzip rec {
   meta = {
     description = "A (mainly) Chinese Unicode font";
     homepage = http://wenq.org;
-    license = stdenv.lib.licenses.asl20;
-    maintainers = [ stdenv.lib.maintainers.pkmx ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.pkmx ];
+    platforms = lib.platforms.all;
   };
 }
 
diff --git a/pkgs/data/fonts/wqy-zenhei/default.nix b/pkgs/data/fonts/wqy-zenhei/default.nix
index 9718763d004..7df1e5aeb2a 100644
--- a/pkgs/data/fonts/wqy-zenhei/default.nix
+++ b/pkgs/data/fonts/wqy-zenhei/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "0.9.45";
@@ -18,8 +18,8 @@ in fetchzip rec {
   meta = {
     description = "A (mainly) Chinese Unicode font";
     homepage = http://wenq.org;
-    license = stdenv.lib.licenses.gpl2; # with font embedding exceptions
-    maintainers = [ stdenv.lib.maintainers.pkmx ];
-    platforms = stdenv.lib.platforms.all;
+    license = lib.licenses.gpl2; # with font embedding exceptions
+    maintainers = [ lib.maintainers.pkmx ];
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/data/fonts/xkcd-font/default.nix b/pkgs/data/fonts/xkcd-font/default.nix
index 9aa664fd289..0e996da2fc7 100644
--- a/pkgs/data/fonts/xkcd-font/default.nix
+++ b/pkgs/data/fonts/xkcd-font/default.nix
@@ -1,24 +1,23 @@
-{ stdenv, fetchFromGitHub }:
+{ lib, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
   pname = "xkcd-font";
   version = "unstable-2017-08-24";
+in fetchFromGitHub rec {
+  name = "${pname}-${version}";
 
-  src = fetchFromGitHub {
-    owner = "ipython";
-    repo = pname;
-    rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
-    sha256 = "01wpfc1yp93b37r472mx2b459il5gywnv5sl7pp9afpycb3i4f6l";
-  };
-
-  phases = [ "unpackPhase" "installPhase" ];
+  owner = "ipython";
+  repo = pname;
+  rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
 
-  installPhase = ''
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
     install -Dm444 -t $out/share/fonts/opentype/ xkcd/build/xkcd.otf
     install -Dm444 -t $out/share/fonts/truetype/ xkcd-script/font/xkcd-script.ttf
   '';
+  sha256 = "0xhwa53aiz20763jb9nvbr2zq9k6jl69p07dc4b0apwrrwz0jfr1";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "The xkcd font";
     homepage = https://github.com/ipython/xkcd-font;
     license = licenses.cc-by-nc-30;
diff --git a/pkgs/data/fonts/yanone-kaffeesatz/default.nix b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
index 026bb2d2244..e713f4d64a3 100644
--- a/pkgs/data/fonts/yanone-kaffeesatz/default.nix
+++ b/pkgs/data/fonts/yanone-kaffeesatz/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchzip}:
+{ lib, fetchzip }:
 
 fetchzip {
   name = "yanone-kaffeesatz-2004";
@@ -14,9 +14,9 @@ fetchzip {
 
   meta = {
     description = "The free font classic";
-    maintainers = with stdenv.lib.maintainers; [ mt-caret ];
-    platforms = with stdenv.lib.platforms; all;
+    maintainers = with lib.maintainers; [ mt-caret ];
+    platforms = with lib.platforms; all;
     homepage = https://yanone.de/fonts/kaffeesatz/;
-    license = stdenv.lib.licenses.ofl;
+    license = lib.licenses.ofl;
   };
 }
diff --git a/pkgs/data/fonts/zilla-slab/default.nix b/pkgs/data/fonts/zilla-slab/default.nix
index d77d6d8b301..369fb53e6ab 100644
--- a/pkgs/data/fonts/zilla-slab/default.nix
+++ b/pkgs/data/fonts/zilla-slab/default.nix
@@ -1,8 +1,7 @@
-{ stdenv, fetchzip }:
+{ lib, fetchzip }:
 
 let
   version = "1.002";
-  hash = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
 in fetchzip {
   name = "zilla-slab-${version}";
 
@@ -12,9 +11,9 @@ in fetchzip {
     mkdir -p $out/share/fonts/truetype
     cp -v zilla-slab/ttf/*.ttf $out/share/fonts/truetype/
   '';
-  sha256 = hash;
+  sha256 = "1b1ys28hyjcl4qwbnsyi6527nj01g3d6id9jl23fv6f8fjm4ph0f";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://github.com/mozilla/zilla-slab;
     description = "Zilla Slab fonts";
     longDescription = ''
diff --git a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
index da99fb68b85..8920c401882 100644
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.32.1";
+  version = "3.32.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0jb8d2a4kzz7an7d3db8mfpvhb6r1wrp8dk11vpa3jby60cxbbyd";
+    sha256 = "1jdk3az797kznkg40nbxb3ddyx8s6favzxlc4vr840zxcl84k9vy";
   };
 
   patches = [
diff --git a/pkgs/development/compilers/ghc/8.6.4.nix b/pkgs/development/compilers/ghc/8.6.4.nix
index 640709aba1b..54c53691574 100644
--- a/pkgs/development/compilers/ghc/8.6.4.nix
+++ b/pkgs/development/compilers/ghc/8.6.4.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.6.5.nix b/pkgs/development/compilers/ghc/8.6.5.nix
index e891ff42ff6..bc45540036d 100644
--- a/pkgs/development/compilers/ghc/8.6.5.nix
+++ b/pkgs/development/compilers/ghc/8.6.5.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/8.8.1.nix b/pkgs/development/compilers/ghc/8.8.1.nix
index 9772d045b76..ad2d64866f8 100644
--- a/pkgs/development/compilers/ghc/8.8.1.nix
+++ b/pkgs/development/compilers/ghc/8.8.1.nix
@@ -9,7 +9,7 @@
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -31,7 +31,8 @@
 
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/ghc/head.nix b/pkgs/development/compilers/ghc/head.nix
index 88b273500dc..46d8dfafd0f 100644
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@@ -6,7 +6,7 @@
 
 , libiconv ? null, ncurses
 
-, useLLVM ? !stdenv.targetPlatform.isx86 || (stdenv.targetPlatform.isMusl && stdenv.hostPlatform != stdenv.targetPlatform)
+, useLLVM ? !stdenv.targetPlatform.isx86
 , # LLVM is conceptually a run-time-only depedendency, but for
   # non-x86, we need LLVM to bootstrap later stages, so it becomes a
   # build-time dependency too.
@@ -29,7 +29,8 @@
 , version ? "8.7.20190115"
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
-  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) "perf-cross"
+  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+    (if useLLVM then "perf-cross" else "perf-cross-ncg")
 
 , # Whether to disable the large address space allocator
   # necessary fix for iOS: https://www.reddit.com/r/haskell/comments/4ttdz1/building_an_osxi386_to_iosarm64_cross_compiler/d5qvd67/
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index a697aac5b8f..f58871f1d7c 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
     sed -i 's,"$.LLVM_LIBRARY_DIR.",${llvm}/lib ${clang-unwrapped}/lib,' \
       cmake/modules/LLDBStandalone.cmake
+    sed -i -e 's,message(SEND_ERROR "Cannot find debugserver on system."),,' \
+           -e 's,string(STRIP ''${XCODE_DEV_DIR} XCODE_DEV_DIR),,' \
+           tools/debugserver/source/CMakeLists.txt
   '';
 
   nativeBuildInputs = [ cmake python which swig ];
@@ -36,8 +39,11 @@ stdenv.mkDerivation {
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
+
   cmakeFlags = [
     "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+    "-DSKIP_DEBUGSERVER=ON"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch b/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
deleted file mode 100644
index 779391fc62a..00000000000
--- a/pkgs/development/compilers/mruby/0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From f3db284516105fd30b5513a5528104574a7b8545 Mon Sep 17 00:00:00 2001
-From: Samuel Dionne-Riel <samuel@dionne-riel.com>
-Date: Thu, 9 Aug 2018 19:07:45 -0400
-Subject: [PATCH] Disables `IO#isatty` test for sandboxed builds.
-
----
- mrbgems/mruby-io/test/io.rb | 13 -------------
- 1 file changed, 13 deletions(-)
-
-diff --git a/mrbgems/mruby-io/test/io.rb b/mrbgems/mruby-io/test/io.rb
-index e06b1499..e8a54736 100644
---- a/mrbgems/mruby-io/test/io.rb
-+++ b/mrbgems/mruby-io/test/io.rb
-@@ -342,19 +342,6 @@ assert('IO#_read_buf') do
-   io.closed?
- end
- 
--assert('IO#isatty') do
--  skip "isatty is not supported on this platform" if MRubyIOTestUtil.win?
--  f1 = File.open("/dev/tty")
--  f2 = File.open($mrbtest_io_rfname)
--
--  assert_true  f1.isatty
--  assert_false f2.isatty
--
--  f1.close
--  f2.close
--  true
--end
--
- assert('IO#pos=, IO#seek') do
-   fd = IO.sysopen $mrbtest_io_rfname
-   io = IO.new fd
--- 
-2.16.4
-
diff --git a/pkgs/development/compilers/mruby/default.nix b/pkgs/development/compilers/mruby/default.nix
index cfc1f00a803..03f3d56fd93 100644
--- a/pkgs/development/compilers/mruby/default.nix
+++ b/pkgs/development/compilers/mruby/default.nix
@@ -1,20 +1,16 @@
 { stdenv, ruby, bison, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  name = "mruby-${version}";
-  version = "2.0.0";
+  pname = "mruby";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner   = "mruby";
     repo    = "mruby";
     rev     = version;
-    sha256  = "1r6w1asjshff43ymdwa6xmrkggza99mi2kw88k7ic6ag2j81hcj5";
+    sha256  = "1zm2d5kj9fnfx8ifj8ysrrr838ipwmvz35byzjhprakrg64911p9";
   };
 
-  patches = [
-    ./0001-Disables-IO-isatty-test-for-sandboxed-builds.patch
-  ];
-
   nativeBuildInputs = [ ruby bison ];
 
   # Necessary so it uses `gcc` instead of `ld` for linking.
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
index abf2760075b..dc3071e5fab 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -41,8 +41,30 @@ self: super: {
   unix = null;
   xhtml = null;
 
-  # Use our native version of the Cabal library.
-  cabal-install = (doJailbreak super.cabal-install).overrideScope (self: super: { Cabal = null; });
+  # Use the current git version of cabal-install.
+  cabal-install = overrideCabal (super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal-git; })) (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/cabal-install";
+    jailbreak = true;
+  });
+  Cabal-git = overrideCabal super.Cabal_2_4_1_0 (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "haskell";
+      repo = "cabal";
+      rev = "e98f6c26fa301b49921c2df67934bf9b0a4f3386";
+      sha256 = "15nrkvckq2rw31z7grgbsg5f0gxfc09afsrqdfi4n471k630xd2i";
+    };
+    version = "20190510-git";
+    editedCabalFile = null;
+    postUnpack = "sourceRoot+=/Cabal";
+  });
 
   # Ignore overly restrictive upper version bounds.
   async = doJailbreak super.async;
@@ -56,10 +78,12 @@ self: super: {
   lucid = doJailbreak super.lucid;
   parallel = doJailbreak super.parallel;
   quickcheck-instances = doJailbreak super.quickcheck-instances;
+  setlocale = doJailbreak super.setlocale;
   split = doJailbreak super.split;
   tasty-expected-failure = doJailbreak super.tasty-expected-failure;
   test-framework = doJailbreak super.test-framework;
   th-lift = self.th-lift_0_8_0_1;
+  hledger-lib = doJailbreak super.hledger-lib;  # base >=4.8 && <4.13, easytest >=0.2.1 && <0.3
 
   # These packages don't work and need patching and/or an update.
   primitive = overrideSrc (doJailbreak super.primitive) {
@@ -160,9 +184,21 @@ self: super: {
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/attoparsec-0.13.2.2.patch";
     sha256 = "13i1p5g0xzxnv966nlyb77mfmxvg9jzbym1d36h1ajn045yf4igl";
   });
-  aeson = appendPatch super.aeson (pkgs.fetchpatch {
+  aeson = appendPatch (dontCheck super.aeson) (pkgs.fetchpatch {   # the test suite breaks the compiler
     url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/aeson-1.4.3.0.patch";
     sha256 = "1z6wmsmc682qs3y768r0zx493dxardwbsp0wdc4dsx83c0m5x66f";
   });
+  cassava = appendPatch super.cassava (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/cassava-0.5.1.0.patch";
+    sha256 = "11scwwjp94si90vb8v5yr291g9qwv5l223z8y0g0lc63932bp63g";
+  });
+  shakespeare = appendPatch super.shakespeare (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/shakespeare-2.0.20.patch";
+    sha256 = "1dgx41ylahj4wk8r422aik0d7qdpawdga4gqz905nvlnhqjla58y";
+  });
+  lens = appendPatch (doJailbreak super.lens) (pkgs.fetchpatch {
+    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/lens-4.17.1.patch";
+    sha256 = "0w89ipi6dfkx5vlw4a64hh6fd0bm9hg33mwpghliyyxik5jmilv1";
+  });
 
 }
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
index 99967aa6724..fe76c581eda 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -3750,6 +3750,7 @@ broken-packages:
   - cparsing
   - CPBrainfuck
   - cpio-conduit
+  - cpkg
   - cplusplus-th
   - cprng-aes-effect
   - cpuperf
@@ -3956,6 +3957,7 @@ broken-packages:
   - dead-simple-json
   - Deadpan-DDP
   - debian
+  - debug
   - debug-me
   - debug-trace-var
   - decepticons
@@ -5083,6 +5085,7 @@ broken-packages:
   - hakismet
   - hakka
   - hako
+  - hakyll
   - hakyll-agda
   - hakyll-blaze-templates
   - hakyll-contrib
@@ -5091,9 +5094,16 @@ broken-packages:
   - hakyll-contrib-hyphenation
   - hakyll-contrib-links
   - hakyll-convert
+  - hakyll-dhall
+  - hakyll-dir-list
+  - hakyll-favicon
   - hakyll-filestore
+  - hakyll-images
   - hakyll-ogmarkup
   - hakyll-R
+  - hakyll-sass
+  - hakyll-series
+  - hakyll-shakespeare
   - hakyll-shortcode
   - hakyll-shortcut-links
   - halberd
@@ -5627,6 +5637,7 @@ broken-packages:
   - hocker
   - hodatime
   - HODE
+  - Hoed
   - hog
   - hogg
   - hoggl
@@ -6335,6 +6346,7 @@ broken-packages:
   - katip-syslog
   - katt
   - kawaii
+  - kazura-queue
   - kd-tree
   - kdesrc-build-extra
   - kdt
@@ -6442,6 +6454,7 @@ broken-packages:
   - language-c-comments
   - language-c-inline
   - language-conf
+  - language-csharp
   - language-css
   - language-dart
   - language-dockerfile
@@ -7470,6 +7483,7 @@ broken-packages:
   - parsec-pratt
   - parseerror-eq
   - parsely
+  - parser-combinators-tests
   - parser-helper
   - parser241
   - parsergen
@@ -8203,6 +8217,7 @@ broken-packages:
   - RNAlien
   - RNAwolf
   - rncryptor
+  - rob
   - robin
   - robots-txt
   - roc-cluster
@@ -8453,6 +8468,7 @@ broken-packages:
   - servant-streaming-docs
   - servant-streaming-server
   - servant-waargonaut
+  - servant-xml
   - servant-zeppelin
   - servant-zeppelin-client
   - servant-zeppelin-server
@@ -9741,6 +9757,7 @@ broken-packages:
   - wiring
   - withdependencies
   - wkt
+  - wkt-geom
   - wl-pprint-ansiterm
   - wl-pprint-terminfo
   - WL500gPControl
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 1be90f902e6..f4dd805568e 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -128,6 +128,26 @@ self: super: builtins.intersectAttrs super {
   # the system-fileio tests use canonicalizePath, which fails in the sandbox
   system-fileio = if pkgs.stdenv.isDarwin then dontCheck super.system-fileio else super.system-fileio;
 
+  # Prevents needing to add `security_tool` as a run-time dependency for
+  # everything using x509-system to give access to the `security` executable.
+  x509-system =
+    if pkgs.stdenv.hostPlatform.isDarwin && !pkgs.stdenv.cc.nativeLibc
+    then
+      # darwin.security_tool is broken in Mojave (#45042)
+
+      # We will use the system provided security for now.
+      # Beware this WILL break in sandboxes!
+
+      # TODO(matthewbauer): If someone really needs this to work in sandboxes,
+      # I think we can add a propagatedImpureHost dep here, but I’m hoping to
+      # get a proper fix available soonish.
+      overrideCabal super.x509-system (drv: {
+        postPatch = (drv.postPatch or "") + ''
+          substituteInPlace System/X509/MacOS.hs --replace security /usr/bin/security
+        '';
+      })
+    else super.x509-system;
+
   # https://github.com/NixOS/cabal2nix/issues/136 and https://github.com/NixOS/cabal2nix/issues/216
   gio = disableHardening (addPkgconfigDepend (addBuildTool super.gio self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
   glib = disableHardening (addPkgconfigDepend (addBuildTool super.glib self.buildHaskellPackages.gtk2hs-buildtools) pkgs.glib) ["fortify"];
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 41d94bd5309..ddcfa0ff447 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -10169,6 +10169,8 @@ self: {
        testHaskellDepends = [ base process QuickCheck ];
        description = "Lightweight algorithmic debugging";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "HoleyMonoid" = callPackage
@@ -44208,8 +44210,8 @@ self: {
      }:
      mkDerivation {
        pname = "cabal-cache";
-       version = "1.0.0.7";
-       sha256 = "1r1qz3nrh2k4gx6j6iiw3gvcflkl9l5yk81nj0c2snrz8wgsq28b";
+       version = "1.0.0.9";
+       sha256 = "1h7wp30gmggsrjgspsahn6b045njy6c23mhgkmhz6nn5s4wa1hak";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -58088,6 +58090,8 @@ self: {
        testHaskellDepends = [ base hspec hspec-megaparsec megaparsec ];
        description = "Build tool for C";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "cplex-hs" = callPackage
@@ -64785,6 +64789,8 @@ self: {
        ];
        description = "Simple trace-based debugger";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "debug-diff" = callPackage
@@ -66627,6 +66633,8 @@ self: {
        pname = "dhall-bash";
        version = "1.0.20";
        sha256 = "1nqiyvyj0dw1a6shy9bb1qxzjrnh8544hsa2c6rwg2j36f0lk73d";
+       revision = "1";
+       editedCabalFile = "0rld0k17lprd8ibwbk0aan94lbd5ffsx5a5apjgk4d4cs3jchycp";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66696,6 +66704,8 @@ self: {
        pname = "dhall-json";
        version = "1.2.8";
        sha256 = "0s5iygh9rfmhx3v62dnfr55xz60rjvnicrq9ydspy129mhf0zzgd";
+       revision = "1";
+       editedCabalFile = "04gbbjns1vgafvc10zx4vrk130kww0a6c4lcqcmapa8yi7vz9670";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -66763,6 +66773,8 @@ self: {
        pname = "dhall-text";
        version = "1.0.17";
        sha256 = "0bs246857r801qnqvh8cb5wm1rplr7grynl4h989i61qz7vcqf53";
+       revision = "1";
+       editedCabalFile = "1avvybk495zngswlnjiqj8nk7iycwzzhxx3cml4w2yhqlic3xx2g";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
@@ -92221,12 +92233,13 @@ self: {
          bup curl git gnupg lsof openssh perl rsync wget which
        ];
        preConfigure = "export HOME=$TEMPDIR; patchShebangs .";
-       postBuild = ''
+       installPhase = "make PREFIX=$out BUILDER=: install";
+       checkPhase = ''
          ln -sf dist/build/git-annex/git-annex git-annex
          ln -sf git-annex git-annex-shell
+         export PATH+=":$PWD"
+         git-annex test
        '';
-       installPhase = "make PREFIX=$out BUILDER=: install install-completions";
-       checkPhase = ''PATH+=":$PWD" git-annex test'';
        enableSharedExecutables = false;
        description = "manage files with git, without checking their contents into git";
        license = stdenv.lib.licenses.agpl3;
@@ -99881,6 +99894,19 @@ self: {
        license = stdenv.lib.licenses.gpl3;
      }) {};
 
+  "gw" = callPackage
+    ({ mkDerivation, base, unix }:
+     mkDerivation {
+       pname = "gw";
+       version = "0.1";
+       sha256 = "055pkk3gg74r4yzh3fxq1zvp1fv3i8cd53jscy1b2n3mmzhbzahv";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [ base unix ];
+       description = "ghcWithPackages cmdline util";
+       license = stdenv.lib.licenses.bsd3;
+     }) {};
+
   "gyah-bin" = callPackage
     ({ mkDerivation, base, extra, GiveYouAHead }:
      mkDerivation {
@@ -102234,6 +102260,8 @@ self: {
        testToolDepends = [ utillinux ];
        description = "A static website compiler library";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {inherit (pkgs) utillinux;};
 
   "hakyll-R" = callPackage
@@ -102413,6 +102441,8 @@ self: {
        executableHaskellDepends = [ base dhall hakyll ];
        description = "Dhall compiler for Hakyll";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-dir-list" = callPackage
@@ -102427,6 +102457,8 @@ self: {
        ];
        description = "Allow Hakyll to create hierarchical menues from directories";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-elm" = callPackage
@@ -102455,6 +102487,8 @@ self: {
        executableHaskellDepends = [ base hakyll ];
        testHaskellDepends = [ base ];
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-filestore" = callPackage
@@ -102494,6 +102528,8 @@ self: {
        ];
        description = "Hakyll utilities to work with images";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-ogmarkup" = callPackage
@@ -102522,6 +102558,8 @@ self: {
        ];
        description = "Hakyll SASS compiler over hsass";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-series" = callPackage
@@ -102533,6 +102571,8 @@ self: {
        libraryHaskellDepends = [ base containers hakyll ];
        description = "Adds series functionality to hakyll";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shakespeare" = callPackage
@@ -102550,6 +102590,8 @@ self: {
        ];
        description = "Hakyll Hamlet compiler";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "hakyll-shortcode" = callPackage
@@ -119173,6 +119215,29 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {inherit (pkgs) ruby;};
 
+  "hruby_0_3_7" = callPackage
+    ({ mkDerivation, aeson, attoparsec, base, bytestring, Cabal
+     , process, QuickCheck, ruby, scientific, stm, text
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "hruby";
+       version = "0.3.7";
+       sha256 = "1i77gmkggm6l17zr1jrn65rjgh3m47f7wz5j9c715mi2ilr01qfx";
+       setupHaskellDepends = [ base Cabal process ];
+       libraryHaskellDepends = [
+         aeson attoparsec base bytestring scientific stm text
+         unordered-containers vector
+       ];
+       librarySystemDepends = [ ruby ];
+       testHaskellDepends = [
+         aeson attoparsec base QuickCheck text vector
+       ];
+       description = "Embed a Ruby intepreter in your Haskell program !";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {inherit (pkgs) ruby;};
+
   "hs-GeoIP" = callPackage
     ({ mkDerivation, base, bytestring, deepseq, GeoIP }:
      mkDerivation {
@@ -137709,6 +137774,8 @@ self: {
        ];
        description = "Fast concurrent queues much inspired by unagi-chan";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "kbq-gu" = callPackage
@@ -140522,6 +140589,8 @@ self: {
        libraryToolDepends = [ alex ];
        description = "C# source code manipulation";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "language-css" = callPackage
@@ -172143,6 +172212,8 @@ self: {
        testToolDepends = [ hspec-discover ];
        description = "Test suite of parser-combinators";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "parser-helper" = callPackage
@@ -192469,12 +192540,16 @@ self: {
      }) {};
 
   "relation" = callPackage
-    ({ mkDerivation, array, base, containers, groom }:
+    ({ mkDerivation, base, containers, hedgehog, hspec, hspec-discover
+     , hw-hspec-hedgehog
+     }:
      mkDerivation {
        pname = "relation";
-       version = "0.2.1";
-       sha256 = "03h6l8v3ppxbwg9ddgg121yx3i2v4vbcpwrv1vg3mgbw5pwq7x4c";
-       libraryHaskellDepends = [ array base containers groom ];
+       version = "0.4";
+       sha256 = "1jy5m0jih6ik05zagngrskk1ibiiblxsydxgdq6kjx1aa2pqnmqi";
+       libraryHaskellDepends = [ base containers ];
+       testHaskellDepends = [ base hedgehog hspec hw-hspec-hedgehog ];
+       testToolDepends = [ hspec-discover ];
        description = "A data structure representing Relations on Sets";
        license = stdenv.lib.licenses.bsd3;
        hydraPlatforms = stdenv.lib.platforms.none;
@@ -195640,6 +195715,8 @@ self: {
        testHaskellDepends = [ base directory ];
        description = "Simple projects generator";
        license = stdenv.lib.licenses.mit;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "robin" = callPackage
@@ -204334,6 +204411,8 @@ self: {
        ];
        description = "Servant support for the XML Content-Type";
        license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "servant-yaml" = callPackage
@@ -223107,6 +223186,22 @@ self: {
        broken = true;
      }) {};
 
+  "tasty-lua" = callPackage
+    ({ mkDerivation, base, bytestring, directory, file-embed, hslua
+     , tasty, tasty-hunit, text
+     }:
+     mkDerivation {
+       pname = "tasty-lua";
+       version = "0.1.0";
+       sha256 = "199zhrd48ixyi32spnm85v0dj6i09sl3rwi42kaxdlxkkmc54i1z";
+       libraryHaskellDepends = [
+         base bytestring file-embed hslua tasty text
+       ];
+       testHaskellDepends = [ base directory hslua tasty tasty-hunit ];
+       description = "Write tests in Lua, integrate into tasty";
+       license = stdenv.lib.licenses.mit;
+     }) {};
+
   "tasty-program" = callPackage
     ({ mkDerivation, base, deepseq, directory, filepath, process, tasty
      }:
@@ -245543,6 +245638,8 @@ self: {
        ];
        description = "A parser of WKT, WKB and eWKB";
        license = stdenv.lib.licenses.asl20;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       broken = true;
      }) {};
 
   "wl-pprint" = callPackage
diff --git a/pkgs/development/libraries/alkimia/default.nix b/pkgs/development/libraries/alkimia/default.nix
index 6f4fd09015e..f98c8fa480e 100644
--- a/pkgs/development/libraries/alkimia/default.nix
+++ b/pkgs/development/libraries/alkimia/default.nix
@@ -1,19 +1,20 @@
 { mkDerivation, fetchurl, lib
-, extra-cmake-modules, doxygen, graphviz, qtbase, mpir
+, extra-cmake-modules, doxygen, graphviz, qtbase, qtwebkit, mpir
+, kdelibs4support, plasma-framework, knewstuff, kpackage
 }:
 
 mkDerivation rec {
   name = "alkimia-${version}";
-  version = "7.0.1";
+  version = "8.0.1";
 
   src = fetchurl {
-    url = "mirror://kde/stable/alkimia/${version}/src/${name}.tar.xz";
-    sha256 = "1fri76465058fgsyrmdrc3hj1javz4g10mfzqp5rsj7qncjr1i22";
+    url = "mirror://kde/stable/alkimia/${version}/${name}.tar.xz";
+    sha256 = "059i6vn36sdq5zn2vqzh4asvvgdgs7n478nk9phvb5gdys01fq7m";
   };
 
   nativeBuildInputs = [ extra-cmake-modules doxygen graphviz ];
 
-  buildInputs = [ qtbase ];
+  buildInputs = [ qtbase qtwebkit kdelibs4support plasma-framework knewstuff kpackage ];
   propagatedBuildInputs = [ mpir ];
 
   meta = {
diff --git a/pkgs/development/libraries/ctl/default.nix b/pkgs/development/libraries/ctl/default.nix
index ac6c9657dde..71e30104476 100644
--- a/pkgs/development/libraries/ctl/default.nix
+++ b/pkgs/development/libraries/ctl/default.nix
@@ -1,22 +1,31 @@
-{ stdenv, callPackage, cmake, pkgconfig, ilmbase, libtiff, openexr }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, pkgconfig, ilmbase, libtiff, openexr }:
 
-let
-  source = callPackage ./source.nix { };
-in
-stdenv.mkDerivation {
-  name = "ctl-${source.version}";
+stdenv.mkDerivation rec {
+  pname = "ctl";
+  version = "1.5.2";
 
-  src = source.src;
+  src = fetchFromGitHub {
+    owner = "ampas";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "ctl-1.5.2-ilm_230.patch";
+      url = "https://src.fedoraproject.org/rpms/CTL/raw/9d7c15a91bccdc0a9485d463bf2789be72e6b17d/f/ctl-1.5.2-ilm_230.patch";
+      sha256 = "0mdx7llwrm0q8ai53zhyxi40i9h5s339dbkqpqv30yzi2xpnfj3d";
+    })
+  ];
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libtiff ilmbase openexr ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libtiff ilmbase openexr ];
 
   meta = with stdenv.lib; {
     description = "Color Transformation Language";
-    homepage = http://ampasctl.sourceforge.net;
-    license = "A.M.P.A.S";
+    homepage = "https://github.com/ampas/CTL";
+    license = "A.M.P.A.S"; # BSD-derivative, free but GPL incompatible
     platforms = platforms.all;
   };
-
-  passthru.source = source;
 }
diff --git a/pkgs/development/libraries/ctl/source.nix b/pkgs/development/libraries/ctl/source.nix
deleted file mode 100644
index d0cb83c0369..00000000000
--- a/pkgs/development/libraries/ctl/source.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ fetchFromGitHub }:
-rec {
-  version = "1.5.2";
-
-  src = fetchFromGitHub {
-    owner = "ampas";
-    repo = "CTL";
-    rev = "ctl-${version}";
-    sha256 = "0a698rd1cmixh3mk4r1xa6rjli8b8b7dbx89pb43xkgqxy67glwx";
-  };
-}
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 0f72afe4cc1..9d1751afaf9 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtksourceview-${version}";
-  version = "3.24.10";
+  version = "3.24.11";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtksourceview/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "16ym7jwiki4s1pilwr4incx0yg7ll94f1cajrnpndkxxs36hcm5b";
+    sha256 = "1zbpj283b5ycz767hqz5kdq02wzsga65pp4fykvhg8xj6x50f6v9";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/java/lombok/default.nix b/pkgs/development/libraries/java/lombok/default.nix
index 7f932d52dc4..be3ddfff4c8 100644
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "lombok-1.18.4";
+  name = "lombok-1.18.8";
 
   src = fetchurl {
     url = "https://projectlombok.org/downloads/${name}.jar";
-    sha256 = "0hlpycnmzd71ihn59hzf445dvwky2lkv57jimx91i6v7xcnr5wrr";
+    sha256 = "1z14rc3fh03qvn2xkjrb7ha0hddv3f3vsp781xm336sp4cl9b5h3";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/libraries/libdazzle/default.nix b/pkgs/development/libraries/libdazzle/default.nix
index 59f07202fde..28d9152dcee 100644
--- a/pkgs/development/libraries/libdazzle/default.nix
+++ b/pkgs/development/libraries/libdazzle/default.nix
@@ -2,7 +2,7 @@
 , gtk-doc, docbook_xsl, docbook_xml_dtd_43, glibcLocales, dbus, xvfb_run, glib, gtk3, gnome3 }:
 
 let
-  version = "3.32.1";
+  version = "3.32.2";
   pname = "libdazzle";
 in
 stdenv.mkDerivation {
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdazzle/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0wprqgn480r31pcgmpyk9l6cfvlczfcx10fpqaq9pbn3vjgs3393";
+    sha256 = "0hgi7gnkna9n42nh7p81crrw0jjj22yr8acych60wxh6hzxqsgs1";
   };
 
   nativeBuildInputs = [ ninja meson pkgconfig vala gobject-introspection libxml2 gtk-doc docbook_xsl docbook_xml_dtd_43 glibcLocales dbus xvfb_run ];
diff --git a/pkgs/development/libraries/libgda/default.nix b/pkgs/development/libraries/libgda/default.nix
index 95860ac9420..bb6402dc428 100644
--- a/pkgs/development/libraries/libgda/default.nix
+++ b/pkgs/development/libraries/libgda/default.nix
@@ -9,11 +9,11 @@ assert postgresSupport -> postgresql != null;
 
 (if stdenv.isAarch64 then overrideCC stdenv gcc6 else stdenv).mkDerivation rec {
   pname = "libgda";
-  version = "5.2.8";
+  version = "5.2.9";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0id4my5wh2m6rd7ijqp2azsjdb4l4yjrv3imq71kly00gjc6v1z2";
+    sha256 = "16vxv2qvysh22s8h9h6irx96sacagxkz0i4qgi1wc6ibly6fvjjr";
   };
   configureFlags = with stdenv.lib; [ "--enable-gi-system-install=no" ]
     ++ (optional (mysqlSupport) "--with-mysql=yes")
diff --git a/pkgs/development/libraries/linbox/default.nix b/pkgs/development/libraries/linbox/default.nix
index 8389ba7e3e0..cde422906da 100644
--- a/pkgs/development/libraries/linbox/default.nix
+++ b/pkgs/development/libraries/linbox/default.nix
@@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "linbox";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "${pname}";
     rev = "v${version}";
-    sha256 = "0rmk474hvgkggmhxwa5i52wdnbvipx9n8mpsc41j1c96q4v8fl22";
+    sha256 = "11mgj7pkppvzmhx5g6wfnzisk36z00gqzzq9p14hzh5dbdhk3693";
   };
 
   nativeBuildInputs = [
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.lgpl21Plus;
     maintainers = [stdenv.lib.maintainers.timokau];
     platforms = stdenv.lib.platforms.unix;
+    broken = stdenv.isDarwin || stdenv.isAarch64; # https://trac.sagemath.org/ticket/26932#comment:21
     homepage = http://linalg.org/;
   };
 }
diff --git a/pkgs/development/libraries/oniguruma/default.nix b/pkgs/development/libraries/oniguruma/default.nix
index 4c994d596ba..b54f34fbb2c 100644
--- a/pkgs/development/libraries/oniguruma/default.nix
+++ b/pkgs/development/libraries/oniguruma/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "onig-${version}";
-  version = "6.9.1";
+  version = "6.9.2";
 
   src = fetchFromGitHub {
     owner = "kkos";
     repo = "oniguruma";
     rev = "v${version}";
-    sha256 = "0dbdd9r15fsqn0rimkjwlv8v68v4i1830h0m7dw56b335wwl6bbg";
+    sha256 = "15asc9v6ylal8fwzlnrh673mp62wngxvv9jx7h86vhljjdap6yfc";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 6a882ecd900..89248597f5d 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-mac-universal --enable-cxx" ];
 
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=nullability-inferred-on-nested-type -Wno-error=nullability-completeness-on-arrays";
+
   propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ AudioUnit AudioToolbox CoreAudio CoreServices Carbon ];
 
   patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/range-v3/default.nix b/pkgs/development/libraries/range-v3/default.nix
index 7fe4b504a99..256b756ed45 100644
--- a/pkgs/development/libraries/range-v3/default.nix
+++ b/pkgs/development/libraries/range-v3/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "range-v3-${version}";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "ericniebler";
     repo = "range-v3";
     rev = version;
-    sha256 = "1s5gj799aa94nfg3r24whq7ck69g0zypf70w14wx64pgwg0424vf";
+    sha256 = "0fzbpaa4vwlivi417zxm1d6v4lkp5c9f5bd706nn2fmw3zxjj815";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 615ac4fa690..f95ae385ab6 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -2,13 +2,13 @@
 
 with stdenv.lib; stdenv.mkDerivation rec {
   name = "tbb-${version}";
-  version = "2019_U5";
+  version = "2019_U6";
 
   src = fetchFromGitHub {
     owner = "01org";
     repo = "tbb";
     rev = version;
-    sha256 = "0390da1iya2mvn3ribjb1f8yvzsqsf5b16wn6dqbjxcz0crmwlzk";
+    sha256 = "1zbf06l659vq6s5wp3ln96ycwcd42caffan5vilqvqyxqvjljyic";
   };
 
   makeFlags = concatStringsSep " " (
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index 5326300a146..56850dcf86e 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-runner";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a2b83e63b830de3ff01c2992342cfe09f96e410953c85904ee7e301b21fa513";
+    sha256 = "087jk00kv0qsqqspyn015nicvbl627wck3fgx2qhqawvrgqk3xb0";
   };
 
   checkInputs = [ pytest mock ];
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 84c9b21f933..c32719140ea 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
 , numpy
 , ffmpeg_4
 , libav
@@ -10,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "av";
-  version = "6.1.2";
+  version = "6.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eebbb56eeae650b1fc551f94d51aee39b487bf4df73c39daea186c5d2950650f";
+    sha256 = "1wm33qajxcpl9rn7zfb2pwwqn87idb7ic7h5zwy2hgbpjnh3vc2g";
   };
 
-  checkInputs = [ nose numpy ];
+  checkInputs = [ numpy ];
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ ffmpeg_4 ];
diff --git a/pkgs/development/python-modules/holoviews/default.nix b/pkgs/development/python-modules/holoviews/default.nix
index 1de465cfec0..405b66ce724 100644
--- a/pkgs/development/python-modules/holoviews/default.nix
+++ b/pkgs/development/python-modules/holoviews/default.nix
@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.11.3";
+  version = "1.12.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "cb03053bfcb96ccef181405b6d3482a5b868f0c7fbaa68b52d25e0071dafd1bc";
+    sha256 = "0i4lfnajz685hlp9m0bjn7s279bv6mm5118b1qmldzqdnvw4s032";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/latexcodec/default.nix b/pkgs/development/python-modules/latexcodec/default.nix
index 785d9f1aa3a..2873c8f9622 100644
--- a/pkgs/development/python-modules/latexcodec/default.nix
+++ b/pkgs/development/python-modules/latexcodec/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "latexcodec";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0s4wdbg0w2l8pj3i0y4510i0s04p8nhxcsa2z41bjsv0k66npb81";
+    sha256 = "0wnp3yqcgx0rpy8dz51vh75lbp2qif67da19zi7m3ca98n887hgb";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index e22c52bb248..222f5137475 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.10.10";
+  version = "8.10.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "dabc8cfcff96446b0787ea337739ea286ec3949ec27a4790a9b4587817da5c5f";
+    sha256 = "1rd46dryxkwlha9lfqqwywazlh908ngh6076zz3myhzf8h3dmxnz";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/py-radix/default.nix b/pkgs/development/python-modules/py-radix/default.nix
new file mode 100644
index 00000000000..b06de3a27a7
--- /dev/null
+++ b/pkgs/development/python-modules/py-radix/default.nix
@@ -0,0 +1,28 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, coverage
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "py-radix";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "mjschultz";
+    repo = "py-radix";
+    rev = "v${version}";
+    sha256 = "01xyn9lg6laavnzczf5bck1l1c2718ihxx0hvdkclnnxjqhbrqis";
+  };
+
+  doCheck = true;
+  checkInputs = [ coverage nose ];
+
+  meta = with stdenv.lib; {
+    description = "Python radix tree for IPv4 and IPv6 prefix matching";
+    homepage = https://github.com/mjschultz/py-radix;
+    license = with licenses; [ isc bsdOriginal ];
+    maintainers = with maintainers; [ mkg ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index 7bc54cb0ffb..713861deae3 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -32,12 +32,25 @@ let
     "test_set_notBefore"
   ];
 
+  # these tests are extremely tightly wed to the exact output of the openssl cli tool,
+  # including exact punctuation.
+  failingOpenSSL_1_1Tests = [
+    "test_dump_certificate"
+    "test_dump_privatekey_text"
+    "test_dump_certificate_request"
+    "test_export_text"
+  ];
+
   disabledTests = [
     # https://github.com/pyca/pyopenssl/issues/692
     # These tests, we disable always.
     "test_set_default_verify_paths"
     "test_fallback_default_verify_paths"
-  ] ++ (optionals (hasPrefix "libressl" openssl.meta.name) failingLibresslTests);
+  ] ++ (
+    optionals (hasPrefix "libressl" openssl.meta.name) failingLibresslTests
+  ) ++ (
+    optionals (versionAtLeast (getVersion openssl.name) "1.1") failingOpenSSL_1_1Tests
+  );
 
   # Compose the final string expression, including the "-k" and the single quotes.
   testExpression = optionalString (disabledTests != [])
diff --git a/pkgs/development/python-modules/python-gnupg/default.nix b/pkgs/development/python-modules/python-gnupg/default.nix
index 1ecf5fe1061..728a353cec7 100644
--- a/pkgs/development/python-modules/python-gnupg/default.nix
+++ b/pkgs/development/python-modules/python-gnupg/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, gnupg1 }:
+{ stdenv, buildPythonPackage, fetchPypi, gnupg }:
 
 buildPythonPackage rec {
   pname   = "python-gnupg";
@@ -12,9 +12,9 @@ buildPythonPackage rec {
   # Let's make the library default to our gpg binary
   patchPhase = ''
     substituteInPlace gnupg.py \
-    --replace "gpgbinary='gpg'" "gpgbinary='${gnupg1}/bin/gpg'"
+    --replace "gpgbinary='gpg'" "gpgbinary='${gnupg}/bin/gpg'"
     substituteInPlace test_gnupg.py \
-    --replace "gpgbinary=GPGBINARY" "gpgbinary='${gnupg1}/bin/gpg'" \
+    --replace "gpgbinary=GPGBINARY" "gpgbinary='${gnupg}/bin/gpg'" \
     --replace "test_search_keys" "disabled__test_search_keys"
   '';
 
diff --git a/pkgs/development/python-modules/qdarkstyle/default.nix b/pkgs/development/python-modules/qdarkstyle/default.nix
index 5f8c59584dc..425bb21a687 100644
--- a/pkgs/development/python-modules/qdarkstyle/default.nix
+++ b/pkgs/development/python-modules/qdarkstyle/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "qdarkstyle";
-  version = "2.6.6";
+  version = "2.6.8";
 
   src = fetchPypi {
     inherit version;
     pname = "QDarkStyle";
-    sha256 = "1jbvvg36fnbvpzvg4ns7zx5jj8h1xsqdr05v5m98a0a9r8awdx3m";
+    sha256 = "18l2ynq2x8jd380nr47xy947c3qdmhv8nnxnan03y5d51azm8yh3";
   };
 
   # No tests available
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 941c24033e5..2912ef213c2 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -14,11 +14,11 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1b03n1ixzscm0jw97l4dq5iy4fslnqxq5bb8287xb7n2a1gs26xw";
+    sha256 = "1qqyk5wlaps1m2hb5n2q1gynw2ayqn31dvxwwni4450ygf65arx6";
   };
 
   checkInputs = [ nose ] ++ lib.optionals isPy27 [mock];
diff --git a/pkgs/development/python-modules/qtpy/default.nix b/pkgs/development/python-modules/qtpy/default.nix
index d0bea83ad26..24e607f2849 100644
--- a/pkgs/development/python-modules/qtpy/default.nix
+++ b/pkgs/development/python-modules/qtpy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "QtPy";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gjg7farw6mkmrwqcg6ms7j74g8py2msvawddji4wy8yfvql1ifl";
+    sha256 = "17pdn4d77gjjrsq7m1i6dz9px0dfi6wgaqz2v3sa3crl15spawp9";
   };
 
   # no concrete propagatedBuildInputs as multiple backends are supposed
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index 586edd766cd..cefe7dac221 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0fd68yaqhpay7jxhyc6xkdrak88wdblxs0phgdkngbakx2yaw2y3";
+    sha256 = "06z9h5vxrvqns3yr4jfrxifw0iqdn6ijlnznpmyi8nc18h8yma2a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/smart_open/default.nix b/pkgs/development/python-modules/smart_open/default.nix
index f3f7acabfd6..9d2c7162719 100644
--- a/pkgs/development/python-modules/smart_open/default.nix
+++ b/pkgs/development/python-modules/smart_open/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "smart_open";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d3c16477ad7e8f94ab033630ea31993670ad21153172367db1acb143077d501c";
+    sha256 = "029b0ns6q9vl4pyk1w7jp4dvif1mfgr53a58z1p8zipwnhkfwnih";
   };
 
   # nixpkgs version of moto is >=1.2.0, remove version pin to fix build
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index 507f7ec49bd..f540cf72877 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,10 +1,10 @@
 { buildPythonPackage, fetchPypi, lib, pythonOlder }:
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.3.4";
+  version = "1.3.5";
   src = fetchPypi{
     inherit pname version;
-    sha256 = "68c362848d9fb71d3c3e5f43c09974a0ae319144634e7a47db62f0f2a54a7fa7";
+    sha256 = "1m7pr6qpana3cvqwiw7mlvrgvmw27ch5mx1592572xhlki8g85ak";
   };
   # Only works with Python 3.3 and newer;
   disabled = pythonOlder "3.3";
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index c80a14063a5..5a3ee3d8cbd 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -110,12 +110,12 @@ in {
   #<generated>
   # DO NOT EDIT! Automatically generated by ./update.py
   radare2 = generic {
-    version_commit = "21276";
-    gittap = "3.4.1";
-    gittip = "da30e593718d5149f2a3d520c7f79fe1c7ca46ef";
-    rev = "3.4.1";
-    version = "3.4.1";
-    sha256 = "02qfj11j8f37hl46m8h4x9pv161glgdr7q3rfhwmq46px9y7f17p";
+    version_commit = "21707";
+    gittap = "3.5.0";
+    gittip = "75cfab37c6cfd0caffb9a90a949f5e60282bbd6c";
+    rev = "3.5.0";
+    version = "3.5.0";
+    sha256 = "03zm74a4vpip4pzj1s3gm2bdihw0iz47w8sxbhjf74074x1ylpzv";
     cs_ver = "4.0.1";
     cs_sha256 = "0ijwxxk71nr9z91yxw20zfj4bbsbrgvixps5c7cpj163xlzlwba6";
   };
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 1e29e4b34f0..e106c6962dc 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -153,7 +153,7 @@ stdenv.mkDerivation rec {
       sed -i -e 's/<.*\*>//g' tools/osx/xcode_locator.m
 
       # don't use system installed Xcode to run clang, use Nix clang instead
-      sed -i -e "s;/usr/bin/xcrun clang;${clang}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
+      sed -i -e "s;/usr/bin/xcrun clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
         scripts/bootstrap/compile.sh \
         src/tools/xcode/realpath/BUILD \
         src/tools/xcode/stdredirect/BUILD \
@@ -256,7 +256,7 @@ stdenv.mkDerivation rec {
     makeWrapper
     which
     customBash
-  ] ++ lib.optionals (stdenv.isDarwin) [ cctools clang libcxx CoreFoundation CoreServices Foundation ];
+  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
diff --git a/pkgs/development/tools/build-managers/buck/default.nix b/pkgs/development/tools/build-managers/buck/default.nix
index 832e8e35164..2cbf3a33a09 100644
--- a/pkgs/development/tools/build-managers/buck/default.nix
+++ b/pkgs/development/tools/build-managers/buck/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "buck";
-  version = "2019.01.10.01";
+  version = "2019.05.06.01";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0987s399v4ba2a3crca12vsg9001xcb5drhqi564ninpa5vxamr2";
+    sha256 = "0bcj1g8hmcpdgz3c2sxglxxq1jn1x0p9dk6hml8ajkn4h82kw12y";
   };
 
   patches = [ ./pex-mtime.patch ];
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 5e03474bf10..99692d1ef50 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, makeWrapper
-, coreutils, jdk, rlwrap, gnupg1compat }:
+, coreutils, jdk, rlwrap, gnupg }:
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       --replace 'LEIN_JAR=/usr/share/java/leiningen-$LEIN_VERSION-standalone.jar' "LEIN_JAR=$out/share/$JARNAME"
     wrapProgram $out/bin/lein \
       --prefix PATH ":" "${stdenv.lib.makeBinPath [ rlwrap coreutils ]}" \
-      --set LEIN_GPG ${gnupg1compat}/bin/gpg \
+      --set LEIN_GPG ${gnupg}/bin/gpg \
       --set JAVA_CMD ${jdk}/bin/java
   '';
 
diff --git a/pkgs/development/tools/chit/default.nix b/pkgs/development/tools/chit/default.nix
new file mode 100644
index 00000000000..a23a3d45cce
--- /dev/null
+++ b/pkgs/development/tools/chit/default.nix
@@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl
+, darwin
+}:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  pname = "chit";
+  version = "0.1.12";
+
+  src = fetchFromGitHub {
+    owner = "peterheesterman";
+    repo = pname;
+    rev = version;
+    sha256 = "17g2p07zhf4n4pjmws0ssfy2mrn0v933ih0vnlr1z2cv9mx8srsl";
+  };
+
+  cargoSha256 = "1jqnnf4jgjpm1i310hda15423nxfw9frgpmc2kbrs66qcsj7avaw";
+
+  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ pkgconfig ];
+  buildInputs = []
+  ++ stdenv.lib.optionals stdenv.isLinux [ openssl ]
+  ++ stdenv.lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ CoreFoundation CoreServices Security ])
+  ;
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Crate help in terminal: A tool for looking up details about rust crates without going to crates.io";
+    longDescription = ''
+      Chit helps answer these questions:
+
+      * Who wrote this crate? What else did they write?
+      * What alternatives are there?
+      * How old is this crate?
+      * What versions are there? When did they come out?
+      * What are the downloads over time?
+      * Should i use this crate?
+      * How mature is it?
+    '';
+    homepage = https://github.com/peterheesterman/chit;
+    license = licenses.mit;
+    maintainers = [ maintainers.lilyball ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/react-native-debugger/default.nix b/pkgs/development/tools/react-native-debugger/default.nix
index 9a421129955..3b6c7940384 100644
--- a/pkgs/development/tools/react-native-debugger/default.nix
+++ b/pkgs/development/tools/react-native-debugger/default.nix
@@ -38,11 +38,11 @@ let
   ];
 in stdenv.mkDerivation rec {
   name = "react-native-debugger-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchurl {
     url = "https://github.com/jhen0409/react-native-debugger/releases/download/v${version}/rn-debugger-linux-x64.zip";
-    sha256 = "0f1wvk1550z4imcs60sv229zllcxpykx4b60bw658idr1xc3c0ix";
+    sha256 = "07mcliy5f3kcqr76izqirqzwb2rwbnl3k1al9dln1izim0lhx06r";
   };
 
   buildInputs = [ unzip ];
diff --git a/pkgs/development/tools/scalafmt/default.nix b/pkgs/development/tools/scalafmt/default.nix
index db3a2af8f5b..a9f8a4cd4b3 100644
--- a/pkgs/development/tools/scalafmt/default.nix
+++ b/pkgs/development/tools/scalafmt/default.nix
@@ -2,7 +2,7 @@
 
 let
   baseName = "scalafmt";
-  version = "2.0.0-RC5";
+  version = "2.0.0-RC7";
   deps = stdenv.mkDerivation {
     name = "${baseName}-deps-${version}";
     buildCommand = ''
@@ -13,13 +13,14 @@ let
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash     = "0y2nja4dj3l7f7m9dxr8xwda8vv27dwj090gfsa78a20vq1d3xxw";
+    outputHash     = "0scz3pp63z6xfj69kvsfr8l3ll9rq95j4xlhlyrzg1vfl1gf41ig";
   };
 in
 stdenv.mkDerivation rec {
   name = "${baseName}-${version}";
 
-  buildInputs = [ jdk makeWrapper deps ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jdk deps ];
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index e607fe2ff14..e9ced0e753a 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "wabt-${version}";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner  = "WebAssembly";
     repo   = "wabt";
     rev    = version;
-    sha256 = "0vki02317mbk5f2w9fxyslcrn5rl2sk845rrs318i37wsz6ismp3";
+    sha256 = "0hn88vlqyclpk79v3wg3lrssd9vwhjdgvb41g03jqakygxxgnmp5";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/games/azimuth/default.nix b/pkgs/games/azimuth/default.nix
new file mode 100644
index 00000000000..3370f339fa2
--- /dev/null
+++ b/pkgs/games/azimuth/default.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchFromGitHub, SDL }:
+
+stdenv.mkDerivation rec {
+  pname = "azimuth";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner  = "mdsteele";
+    repo   = "azimuth";
+    rev    = "v${version}";
+    sha256 = "0yh52i3vfmj5zd7fs1r2xpjy2mknycr5xz6kyixj2qncb25xsm7z";
+  };
+
+  preConfigure = ''
+    substituteInPlace data/azimuth.desktop \
+      --replace Exec=azimuth "Exec=$out/bin/azimuth" \
+      --replace "Version=%AZ_VERSION_NUMBER" "Version=${version}"
+  '';
+
+  makeFlags = [
+    "BUILDTYPE=release"
+  ];
+
+  buildInputs = [ SDL ];
+
+  enableParallelBuilding = true;
+
+  # the game doesn't have an installation procedure
+  installPhase = ''
+    mkdir -p $out/bin
+    cp out/release/host/bin/azimuth $out/bin/azimuth
+    cp out/release/host/bin/editor $out/bin/azimuth-editor
+    cp out/release/host/bin/muse $out/bin/azimuth-muse
+    cp out/release/host/bin/zfxr $out/bin/azimuth-zfxr
+    mkdir -p $out/share/doc/azimuth
+    cp doc/* README.md LICENSE $out/share/doc/azimuth
+    mkdir -p $out/share/icons/hicolor/128x128/apps $out/share/icons/hicolor/64x64/apps $out/share/icons/hicolor/48x48/apps $out/share/icons/hicolor/32x32/apps
+    cp data/icons/icon_128x128.png $out/share/icons/hicolor/128x128/apps/azimuth.png
+    cp data/icons/icon_64x64.png $out/share/icons/hicolor/64x64/apps/azimuth.png
+    cp data/icons/icon_48x48.png $out/share/icons/hicolor/48x48/apps/azimuth.png
+    cp data/icons/icon_32x32.png $out/share/icons/hicolor/32x32/apps/azimuth.png
+    mkdir -p $out/share/applications
+    cp data/azimuth.desktop $out/share/applications
+  '';
+
+  meta = {
+    description = "A metroidvania game using only vectorial graphic";
+    longDescription = ''
+      Azimuth is a metroidvania game, and something of an homage to the previous
+      greats of the genre (Super Metroid in particular). You will need to pilot
+      your ship, explore the inside of the planet, fight enemies, overcome
+      obstacles, and uncover the storyline piece by piece. Azimuth features a
+      huge game world to explore, lots of little puzzles to solve, dozens of
+      weapons and upgrades to find and use, and a wide variety of enemies and
+      bosses to tangle with.
+    '';
+
+    license = stdenv.lib.licenses.gpl3Plus;
+    homepage = https://mdsteele.games/azimuth/index.html;
+    maintainers = with stdenv.lib.maintainers; [ marius851000 ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index ef22bd9a3ac..f441ac36add 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -39,16 +39,16 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "4.7";
+    version = "4.8";
     url = "https://dl.winehq.org/wine/source/4.x/wine-${version}.tar.xz";
-    sha256 = "1c5swx6jj0hz9w2jgyl30pdjcq9n62qp1rmqyq1d4q2a6n291jiv";
+    sha256 = "0dd1vw3bq47ypdpflgmmbi68pjw5z3wz26kfwvnkxqbp28fapfa8";
     inherit (stable) mono gecko32 gecko64;
   };
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "1sgyq57dyzchwnvkgx96bcx5rv821s0vidzdyz7x5711j7xmiv70";
+    sha256 = "0npm44zdys78qbqqyvjczqqjdgacpsfds3jxyy1y4yj2xjqzagsq";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/misc/screensavers/xautolock/default.nix b/pkgs/misc/screensavers/xautolock/default.nix
index 8edb618b389..0da198aab78 100644
--- a/pkgs/misc/screensavers/xautolock/default.nix
+++ b/pkgs/misc/screensavers/xautolock/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   name = "xautolock-${version}";
-  version = "2.2-6-ge68d0ed";
+  version = "2.2-7-ga23dd5c";
 
   # This repository contains xautolock-2.2 plus various useful patches that
   # were collected from Debian, etc.
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     owner = "peti";
     repo = "xautolock";
     rev = "v${version}";
-    sha256 = "1131ki6zwk94s8j6zqywf8r5kanx3nrjm692rxh8pcz4hv9qp1mz";
+    sha256 = "10j61rl0sx9sh84rjyfyddl73xb5i2cpb17fyrli8kwj39nw0v2g";
   };
 
   nativeBuildInputs = [ imake gccmakedep ];
diff --git a/pkgs/misc/vscode-extensions/cpptools/default.nix b/pkgs/misc/vscode-extensions/cpptools/default.nix
index ca44ccb8cd2..89ed98cd0a7 100644
--- a/pkgs/misc/vscode-extensions/cpptools/default.nix
+++ b/pkgs/misc/vscode-extensions/cpptools/default.nix
@@ -68,8 +68,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cpptools";
     publisher = "ms-vscode";
-    version = "0.22.1";
-    sha256 = "1f79vbp19k1zm2y5djr4vim0h5y5rnm96rg8fx2h9zb8i559230k";
+    version = "0.23.0";
+    sha256 = "1c7qia60fgak5pisl1qzp2kvm1cs30b29rxpydk7j3lqcpqr5ixj";
   };
 
   buildInputs = [
diff --git a/pkgs/misc/vscode-extensions/wakatime/default.nix b/pkgs/misc/vscode-extensions/wakatime/default.nix
index f4c8ca8647d..034866d5b2f 100644
--- a/pkgs/misc/vscode-extensions/wakatime/default.nix
+++ b/pkgs/misc/vscode-extensions/wakatime/default.nix
@@ -8,8 +8,8 @@ in
     mktplcRef = {
       name = "vscode-wakatime";
       publisher = "WakaTime";
-      version = "2.0.9";
-      sha256 = "0fbliim80ydq90c606jhl79fdcmmpb9fs402mvy3g9zmjixspnpb";
+      version = "2.1.0";
+      sha256 = "0a23l8vaj0yghfh9lbi453vjghaxgjmphfjy2s4lgrvq38j4bv9n";
     };
 
     postPatch = ''
diff --git a/pkgs/os-specific/linux/bpftool/default.nix b/pkgs/os-specific/linux/bpftool/default.nix
new file mode 100644
index 00000000000..cc4786ab384
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftool/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchurl
+, libopcodes, libbfd, libelf
+, linuxPackages_latest
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpftool";
+  inherit (linuxPackages_latest.kernel) version src;
+
+  buildInputs = [ libopcodes libbfd libelf ];
+
+  preConfigure = ''
+    cd tools/bpf/bpftool
+    substituteInPlace ./Makefile \
+      --replace '/usr/local' "$out" \
+      --replace '/usr'       "$out" \
+      --replace '/sbin'      '/bin'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Debugging/program analysis tool for the eBPF subsystem";
+    license     = [ licenses.gpl2 licenses.bsd2 ];
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2f091b95cfc..a735d165299 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -427,6 +427,12 @@ let
 
       VFIO_PCI_VGA = mkIf stdenv.is64bit yes;
 
+      # VirtualBox guest drivers in the kernel conflict with the ones in the
+      # official additions package and prevent the vboxsf module from loading,
+      # so disable them for now.
+      VBOXGUEST = option no;
+      DRM_VBOXVIDEO = option no;
+
     } // optionalAttrs (stdenv.isx86_64 || stdenv.isi686) ({
       XEN = option yes;
 
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 85ef8a1a6cc..2627286ccff 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, substituteAll, autoreconfHook, pkgconfig, libusb1, hwdata , python3 }:
 
 stdenv.mkDerivation rec {
-  name = "usbutils-010";
+  name = "usbutils-012";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/usb/usbutils/${name}.tar.xz";
-    sha256 = "06aag4jfgsfjxk563xsp9ik9nadihmasrr37a1gb0vwqni5kdiv1";
+    sha256 = "0iiy0q7fzikavmdsjsb0sl9kp3gfh701qwyjjccvqh0qz4jlcqw8";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 81143032c91..c6140bd12be 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,9 +182,9 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "0.8.0-rc4";
+    version = "0.8.0-rc5";
 
-    sha256 = "02cdxf62758smbqy723yqv8lkch1043alvcwhdnvya21ygcgycnw";
+    sha256 = "1944w36rk33mn44zfvc1qbn2sv9h90r25zxnanwvyhss0vgqw73v";
     isUnstable = true;
 
     extraPatches = [
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 6a0114a6ba5..347ac290378 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -6,8 +6,8 @@ let
     src = fetchFromGitHub {
       owner = "chobits";
       repo = "ngx_http_proxy_connect_module";
-      rev = "8201639082cba702211585b03d4cc7bc51c65167";
-      sha256 = "0z71x3xnlczrr2kq43w3drxj9g14fkk4jz66x921v0yb8r9mnn5a";
+      rev = "18e2520b361ffebde6c08c8119ecfba113a3b53c";
+      sha256 = "1nyil5n2a97nqsqarvnp4bazw4vnxifqizzw5aank4vi9xlq90b2";
     };
 
     patches = [
@@ -32,12 +32,21 @@ in
     inputs = [ pkgs.brotli ];
   };
 
+  coolkit = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_coolkit";
+      rev    = "0.2";
+      sha256 = "1idj0cqmfsdqawjcqpr1fsq670fdki51ksqk2lslfpcs3yrfjpqh";
+    };
+  };
+
   dav = {
     src = fetchFromGitHub {
       owner = "arut";
       repo = "nginx-dav-ext-module";
-      rev = "v0.1.0";
-      sha256 = "1ifahd69vz715g3zim618jbmxb7kcmzykc696grskxm0svpy294k";
+      rev = "v3.0.0";
+      sha256 = "000dm5zk0m1hm1iq60aff5r6y8xmqd7djrwhgnz9ig01xyhnjv9w";
     };
     inputs = [ pkgs.expat ];
   };
@@ -87,6 +96,14 @@ in
     };
   };
 
+  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "15";
+  };
+
+  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "14";
+  };
+
   ipscrub = {
     src = fetchFromGitHub {
       owner = "masonicboom";
@@ -97,12 +114,30 @@ in
     inputs = [ pkgs.libbsd ];
   };
 
+  limit-speed = {
+    src = fetchFromGitHub {
+      owner = "yaoweibin";
+      repo = "nginx_limit_speed_module";
+      rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
+      sha256 = "0kkrd08zpcwx938i2is07vq6pgjkvn97xzjab0g4zaz8bivgmjp8";
+    };
+  };
+
+  live ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-live-module";
+      rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
+      sha256 = "1kpnhl4b50zim84z22ahqxyxfq4jv8ab85kzsy2n5ciqbyg491lz";
+    };
+  };
+
   lua = {
     src = fetchFromGitHub {
       owner = "openresty";
       repo = "lua-nginx-module";
-      rev = "v0.10.13";
-      sha256 = "19mpc76lfhyyvkfs2n08b4rc9cf2v7rm8fskkf60hsdcf6qna822";
+      rev = "v0.10.14";
+      sha256 = "1vg6pp9n8z42p6f3jqk15gvdyy7mfvs5ssfbiy83bydjx42fq7g0";
     };
     inputs = [ pkgs.luajit ];
     preConfigure = ''
@@ -148,6 +183,24 @@ in
     };
   };
 
+  mpeg-ts ={
+    src = fetchFromGitHub {
+      owner = "arut";
+      repo = "nginx-ts-module";
+      rev = "v0.1.1";
+      sha256 = "12dxcyy6wna1fccl3a9lnsbymd6p4apnwz6c24w74v97qvpfdxqd";
+    };
+  };
+
+  naxsi ={
+    src = fetchFromGitHub {
+      owner = "nbs-system";
+      repo = "naxsi";
+      rev = "0.56";
+      sha256 = "12kn6wbl8xqc19fi05ffprqps4pplg4a6i1cf01xc0d6brx1fg8v";
+    } + "/naxsi_src";
+  };
+
   ngx_aws_auth = {
     src = fetchFromGitHub {
       owner = "anomalizer";
@@ -254,6 +307,24 @@ in
     };
   };
 
+  slowfs-cache = {
+    src = fetchFromGitHub {
+      owner  = "FRiCKLE";
+      repo   = "ngx_slowfs_cache";
+      rev    = "1.10";
+      sha256 = "1gyza02pcws3zqm1phv3ag50db5gnapxyjwy8skjmvawz7p5bmxr";
+    };
+  };
+
+  sorted-querystring = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-sorted-querystring-module";
+      rev = "0.3";
+      sha256 = "0p6b0hcws39n27fx4xp9k4hb3pcv7b6kah4qqaj0pzjy3nbp4gj7";
+    };
+  };
+
   statsd = {
     src = fetchFromGitHub {
       owner = "apcera";
@@ -285,8 +356,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "ngx_http_substitutions_filter_module";
-      rev = "v0.6.4";
-      sha256 = "0q86cv0mfffh43id5xanywyhpd7b0jijrmk8y311c13l9ajrd2rx";
+      rev = "bc58cb11844bc42735bbaef7085ea86ace46d05b";
+      sha256 = "1q5hr3sqys4f365gzjci549rn9ylhgj4xb29ril04zr5vkhzlnar";
     };
   };
 
@@ -303,8 +374,8 @@ in
     src = fetchFromGitHub {
       owner = "yaoweibin";
       repo = "nginx_upstream_check_module";
-      rev = "9aecf15ec379fe98f62355c57b60c0bc83296f04";
-      sha256 = "1cjisxw1wykll683nw09k0i1nvzslp4dr59x58cvarpk43paim2y";
+      rev = "007f76f7adbcbd6abd9352502af1a4ae463def85";
+      sha256 = "1qcg7c9rcl70wr1qf188shnn9s2f7cxnlw05s6scbvlgnf6ik6in";
     };
   };
 
@@ -312,8 +383,8 @@ in
     src = fetchFromGitHub {
       owner = "tarantool";
       repo = "nginx_upstream_module";
-      rev = "v2.7";
-      sha256 = "05dwj0caj910p7kan2qjvm6x2x601igryhny2xzr47hhsk5q1cnx";
+      rev = "v2.7.1";
+      sha256 = "0ya4330in7zjzqw57djv4icpk0n1j98nvf0f8v296yi9rjy054br";
     };
     inputs = [ pkgs.msgpuck.dev pkgs.yajl ];
   };
@@ -327,6 +398,16 @@ in
     };
   };
 
+  video-thumbextractor = {
+    src = fetchFromGitHub {
+      owner = "wandenberg";
+      repo = "nginx-video-thumbextractor-module";
+      rev = "0.9.0";
+      sha256 = "1b0v471mzbcys73pzr7gpvzzhff0cva0l5ff32cv7z1v9c0ypji7";
+    };
+    inputs = [ pkgs.ffmpeg ];
+  };
+
   vts = {
     src = fetchFromGitHub {
       owner = "vozlt";
@@ -335,12 +416,4 @@ in
       sha256 = "1jq2s9k7hah3b317hfn9y3g1q4g4x58k209psrfsqs718a9sw8c7";
     };
   };
-
-  http_proxy_connect_module_v15 = http_proxy_connect_module_generic "proxy_connect_rewrite_1015" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "15";
-  };
-
-  http_proxy_connect_module_v14 = http_proxy_connect_module_generic "proxy_connect_rewrite_1014" // {
-    supports = with lib.versions; version: major version == "1" && minor version == "14";
-  };
 }
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index 094b782abf9..e95fcaa03ef 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg1 }:
+{ stdenv, fetchurl, perlPackages, makeWrapper, gnupg }:
 
 perlPackages.buildPerlPackage rec {
   name = "SpamAssassin-3.4.2";
@@ -27,7 +27,7 @@ perlPackages.buildPerlPackage rec {
     mv "rules/"* $out/share/spamassassin/
 
     for n in "$out/bin/"*; do
-      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : "${gnupg1}/bin"
+      wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : "${gnupg}/bin"
     done
   '';
 
diff --git a/pkgs/servers/search/elasticsearch/5.x.nix b/pkgs/servers/search/elasticsearch/5.x.nix
index 0d67988e820..6142d751dab 100644
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless, utillinux }:
+{ stdenv, fetchurl, elk5Version, makeWrapper, jre_headless
+, utillinux, gnugrep, coreutils }:
 
 with stdenv.lib;
 
@@ -23,7 +24,7 @@ stdenv.mkDerivation rec {
 
     wrapProgram $out/bin/elasticsearch \
       --prefix ES_CLASSPATH : "$out/lib/*" \
-      --prefix PATH : "${utillinux}/bin" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}" \
       --set ES_JVM_OPTIONS "$out/config/jvm.options"
 
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index 73bee6c47f3..fffc84b2d28 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -45,7 +45,7 @@ stdenv.mkDerivation (rec {
     chmod -x $out/bin/*.*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux gnugrep coreutils ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/servers/search/elasticsearch/7.x.nix b/pkgs/servers/search/elasticsearch/7.x.nix
index a55a43baa0b..ddb1d2299cb 100644
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , makeWrapper
 , jre_headless
-, utillinux
+, utillinux, gnugrep, coreutils
 , autoPatchelfHook
 , zlib
 }:
@@ -56,7 +56,7 @@ stdenv.mkDerivation (rec {
     chmod +x $out/bin/*
 
     wrapProgram $out/bin/elasticsearch \
-      --prefix PATH : "${utillinux}/bin/" \
+      --prefix PATH : "${makeBinPath [ utillinux coreutils gnugrep ]}" \
       --set JAVA_HOME "${jre_headless}"
 
     wrapProgram $out/bin/elasticsearch-plugin --set JAVA_HOME "${jre_headless}"
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index 0f393c11988..43dd8a40480 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   name = "tcsh-${version}";
-  version = "6.20.00";
+  version = "6.21.00";
 
   src = fetchurl {
     urls = [
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
       "ftp://ftp.astron.com/pub/tcsh/${name}.tar.gz"
       "ftp://ftp.funet.fi/pub/unix/shells/tcsh/${name}.tar.gz"
     ];
-    sha256 = "17ggxkkn5skl0v1x0j6hbv5l0sgnidfzwv16992sqkdm983fg7dq";
+    sha256 = "0wp9cqkzdj5ahfyg9bn5z1wnyblqyv9vz4sc5aqmj7rp91a34f64";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index 0ccc964c3e6..d476b797f38 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, coreutils, python2, duplicity, gawk, gnupg1, bash
+{ stdenv, fetchurl, coreutils, python2, duplicity, gawk, gnupg, bash
 , gnugrep, txt2man, makeWrapper, which
 }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share/man/man1"
     install -vD duply "$out/bin"
     wrapProgram "$out/bin/duply" --set PATH \
-        ${stdenv.lib.makeBinPath [ coreutils python2 duplicity gawk gnupg1 bash gnugrep txt2man which ]}
+        ${stdenv.lib.makeBinPath [ coreutils python2 duplicity gawk gnupg bash gnugrep txt2man which ]}
     "$out/bin/duply" txt2man > "$out/share/man/man1/duply.1"
   '';
 
diff --git a/pkgs/tools/misc/aptly/default.nix b/pkgs/tools/misc/aptly/default.nix
index 4571ee24fba..2dac9bd60c9 100644
--- a/pkgs/tools/misc/aptly/default.nix
+++ b/pkgs/tools/misc/aptly/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, gnupg1compat, bzip2, xz, graphviz }:
+{ stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, gnupg, bzip2, xz, graphviz }:
 
 let
 
@@ -34,7 +34,7 @@ buildGoPackage {
     mkdir -p $bin/share/bash-completion/completions
     ln -s ${aptlyCompletionSrc}/aptly $bin/share/bash-completion/completions
     wrapProgram "$bin/bin/aptly" \
-      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg1compat bzip2 xz graphviz ]}"
+      --prefix PATH ":" "${stdenv.lib.makeBinPath [ gnupg bzip2 xz graphviz ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
new file mode 100644
index 00000000000..02b0b85db31
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/coreutils-8.31-musl-cross.patch
@@ -0,0 +1,1153 @@
+From 453ff940449bbbde9ec00f0bbf82a359c5598fc7 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sat, 23 Mar 2019 23:00:52 +0100
+Subject: [PATCH 1/1] Support cross-compilation to musl libc.
+
+Reported by Necktwi Ozfguah <necktwi@ferryfair.com>.
+
+* m4/calloc.m4 (_AC_FUNC_CALLOC_IF): Add cross-compilation guesses for
+musl libc.
+* m4/canonicalize.m4 (gl_FUNC_REALPATH_WORKS): Likewise.
+* m4/chown.m4 (gl_FUNC_CHOWN): Likewise.
+* m4/d-ino.m4 (gl_CHECK_TYPE_STRUCT_DIRENT_D_INO): Likewise.
+* m4/fdopendir.m4 (gl_FUNC_FDOPENDIR): Likewise.
+* m4/fnmatch.m4 (gl_FUNC_FNMATCH_POSIX): Likewise.
+* m4/fpurge.m4 (gl_FUNC_FPURGE): Likewise.
+* m4/getcwd.m4 (gl_FUNC_GETCWD_NULL): Likewise.
+* m4/getcwd-abort-bug.m4 (gl_FUNC_GETCWD_ABORT_BUG): Likewise.
+* m4/getdelim.m4 (gl_FUNC_GETDELIM): Likewise.
+* m4/getgroups.m4 (AC_FUNC_GETGROUPS, gl_FUNC_GETGROUPS): Likewise.
+* m4/getline.m4 (gl_FUNC_GETLINE): Likewise.
+* m4/gettimeofday.m4 (gl_FUNC_GETTIMEOFDAY_CLOBBER): Likewise.
+* m4/hypot.m4 (gl_FUNC_HYPOT): Likewise.  // removed
+* m4/hypotf.m4 (gl_FUNC_HYPOTF): Likewise.  // removed
+* m4/hypotl.m4 (gl_FUNC_HYPOTL): Likewise.  // removed
+* m4/iconv_open-utf.m4 (gl_FUNC_ICONV_OPEN_UTF_SUPPORT): Likewise.  // removed
+* m4/link-follow.m4 (gl_FUNC_LINK_FOLLOWS_SYMLINK): Likewise.
+* m4/log.m4 (gl_FUNC_LOG): Likewise.  // removed
+* m4/logf.m4 (gl_FUNC_LOGF): Likewise.  // removed
+* m4/logl.m4 (gl_FUNC_LOGL_WORKS): Likewise.  // removed
+* m4/log10.m4 (gl_FUNC_LOG10): Likewise.  // removed
+* m4/log10f.m4 (gl_FUNC_LOG10F): Likewise.  // removed
+* m4/log10l.m4 (gl_FUNC_LOG10L): Likewise.  // removed
+* m4/log1p.m4 (gl_FUNC_LOG1P): Likewise.  // removed
+* m4/log1pf.m4 (gl_FUNC_LOG1PF): Likewise.  // removed
+* m4/log1pl.m4 (gl_FUNC_LOG1PL): Likewise.  // removed
+* m4/log2.m4 (gl_FUNC_LOG2): Likewise.  // removed
+* m4/log2f.m4 (gl_FUNC_LOG2F): Likewise.  // removed
+* m4/malloc.m4 (_AC_FUNC_MALLOC_IF): Likewise.
+* m4/mkdir.m4 (gl_FUNC_MKDIR): Likewise.
+* m4/mkstemp.m4 (gl_FUNC_MKSTEMP): Likewise.
+* m4/modf.m4 (gl_FUNC_MODF): Likewise.  // removed
+* m4/modff.m4 (gl_FUNC_MODFF): Likewise.  // removed
+* m4/modfl.m4 (gl_FUNC_MODFL): Likewise.  // removed
+* m4/perror.m4 (gl_FUNC_PERROR): Likewise.
+* m4/printf.m4 (gl_PRINTF_SIZES_C99, gl_PRINTF_INFINITE,
+gl_PRINTF_INFINITE_LONG_DOUBLE, gl_PRINTF_DIRECTIVE_A,
+gl_PRINTF_DIRECTIVE_F, gl_PRINTF_FLAG_ZERO, gl_SNPRINTF_TRUNCATION_C99,
+gl_SNPRINTF_RETVAL_C99, gl_SNPRINTF_DIRECTIVE_N,
+gl_VSNPRINTF_ZEROSIZE_C99): Likewise.
+* m4/ptsname.m4 (gl_FUNC_PTSNAME): Likewise.  // removed
+* m4/putenv.m4 (gl_FUNC_PUTENV): Likewise.
+* m4/realloc.m4 (_AC_FUNC_REALLOC_IF): Likewise.
+* m4/remainder.m4 (gl_FUNC_REMAINDER): Likewise.  // removed
+* m4/remainderf.m4 (gl_FUNC_REMAINDERF): Likewise.  // removed
+* m4/remainderl.m4 (gl_FUNC_REMAINDERL): Likewise.  // removed
+* m4/rintl.m4 (gl_FUNC_RINTL): Likewise.  // removed
+* m4/round.m4 (gl_FUNC_ROUND): Likewise.  // removed
+* m4/roundf.m4 (gl_FUNC_ROUNDF): Likewise.  // removed
+* m4/roundl.m4 (gl_FUNC_ROUNDL): Likewise.  // removed
+* m4/setenv.m4 (gl_FUNC_SETENV): Likewise.
+* m4/signbit.m4 (gl_SIGNBIT): Likewise.
+* m4/sleep.m4 (gl_FUNC_SLEEP): Likewise.
+* m4/stpncpy.m4 (gl_FUNC_STPNCPY): Likewise.
+* m4/strerror.m4 (gl_FUNC_STRERROR, gl_FUNC_STRERROR_0): Likewise.
+* m4/strtod.m4 (gl_FUNC_STRTOD): Likewise.
+* m4/strtold.m4 (gl_FUNC_STRTOLD): Likewise.
+* m4/trunc.m4 (gl_FUNC_TRUNC): Likewise.    // removed
+* m4/truncf.m4 (gl_FUNC_TRUNCF): Likewise.  // removed
+* m4/truncl.m4 (gl_FUNC_TRUNCL): Likewise.  // removed
+* m4/tzset.m4 (gl_FUNC_TZSET_CLOBBER): Likewise.
+* m4/ungetc.m4 (gl_FUNC_UNGETC_WORKS): Likewise.
+* m4/usleep.m4 (gl_FUNC_USLEEP): Likewise.
+* m4/utimes.m4 (gl_FUNC_UTIMES): Likewise.
+* m4/wcwidth.m4 (gl_FUNC_WCWIDTH): Likewise.
+---
+ m4/calloc.m4           |  4 ++-
+ m4/canonicalize.m4     |  4 ++-
+ m4/chown.m4            | 22 +++++++------
+ m4/d-ino.m4            | 16 +++++-----
+ m4/fdopendir.m4        | 12 ++++---
+ m4/fnmatch.m4          | 18 ++++++++---
+ m4/fpurge.m4           | 24 +++++++++-----
+ m4/getcwd-abort-bug.m4 | 11 +++++--
+ m4/getcwd.m4           |  4 ++-
+ m4/getdelim.m4         | 40 ++++++++++++++----------
+ m4/getgroups.m4        |  6 +++-
+ m4/getline.m4          | 38 +++++++++++++---------
+ m4/gettimeofday.m4     |  4 ++-
+ m4/link-follow.m4      |  4 ++-
+ m4/malloc.m4           |  4 +--
+ m4/mkdir.m4            |  4 ++-
+ m4/mkstemp.m4          |  4 ++-
+ m4/perror.m4           | 12 ++++---
+ m4/printf.m4           | 22 ++++++++++++-
+ m4/putenv.m4           |  4 ++-
+ m4/realloc.m4          |  4 +--
+ m4/setenv.m4           |  4 ++-
+ m4/signbit.m4          |  6 +++-
+ m4/sleep.m4            |  4 ++-
+ m4/stpncpy.m4          | 14 +++++++--
+ m4/strerror.m4         |  6 +++-
+ m4/strtod.m4           | 10 +++---
+ m4/strtold.m4          |  9 ++++--
+ m4/tzset.m4            |  4 ++-
+ m4/ungetc.m4           | 18 ++++++-----
+ m4/usleep.m4           |  4 ++-
+ m4/utimes.m4           | 10 +++---
+ m4/wcwidth.m4          | 12 ++++---
+ 76 files changed, 461 insertions(+), 157 deletions(-)
+
+diff --git a/m4/calloc.m4 b/m4/calloc.m4
+index 012a5bf..d76535d 100644
+--- a/m4/calloc.m4
++++ b/m4/calloc.m4
+@@ -1,4 +1,4 @@
+-# calloc.m4 serial 18
++# calloc.m4 serial 19
+
+ # Copyright (C) 2004-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -40,6 +40,8 @@ AC_DEFUN([_AC_FUNC_CALLOC_IF],
+        [case "$host_os" in
+                          # Guess yes on glibc systems.
+           *-gnu* | gnu*) ac_cv_func_calloc_0_nonnull="guessing yes" ;;
++                         # Guess yes on musl systems.
++          *-musl*)       ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # Guess yes on native Windows.
+           mingw*)        ac_cv_func_calloc_0_nonnull="guessing yes" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/canonicalize.m4 b/m4/canonicalize.m4
+index 5b6e25d..b61747b 100644
+--- a/m4/canonicalize.m4
++++ b/m4/canonicalize.m4
+@@ -1,4 +1,4 @@
+-# canonicalize.m4 serial 29
++# canonicalize.m4 serial 30
+
+ dnl Copyright (C) 2003-2007, 2009-2019 Free Software Foundation, Inc.
+
+@@ -113,6 +113,8 @@ AC_DEFUN([gl_FUNC_REALPATH_WORKS],
+      [case "$host_os" in
+                        # Guess yes on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_realpath_works="guessing yes" ;;
++                       # Guess yes on musl systems.
++        *-musl*)       gl_cv_func_realpath_works="guessing yes" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_realpath_works="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/chown.m4 b/m4/chown.m4
+index ecfc0c0..b798325 100644
+--- a/m4/chown.m4
++++ b/m4/chown.m4
+@@ -1,4 +1,4 @@
+-# serial 30
++# serial 32
+ # Determine whether we need the chown wrapper.
+
+ dnl Copyright (C) 1997-2001, 2003-2005, 2007, 2009-2019 Free Software
+@@ -109,10 +109,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_slash_works=yes],
+         [gl_cv_func_chown_slash_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_slash_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_slash_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_slash_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_slash_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.link conftest.file])
+@@ -145,10 +147,12 @@ AC_DEFUN_ONCE([gl_FUNC_CHOWN],
+         [gl_cv_func_chown_ctime_works=yes],
+         [gl_cv_func_chown_ctime_works=no],
+         [case "$host_os" in
+-                   # Guess yes on glibc systems.
+-           *-gnu*) gl_cv_func_chown_ctime_works="guessing yes" ;;
+-                   # If we don't know, assume the worst.
+-           *)      gl_cv_func_chown_ctime_works="guessing no" ;;
++                    # Guess yes on glibc systems.
++           *-gnu*)  gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # Guess yes on musl systems.
++           *-musl*) gl_cv_func_chown_ctime_works="guessing yes" ;;
++                    # If we don't know, assume the worst.
++           *)       gl_cv_func_chown_ctime_works="guessing no" ;;
+          esac
+         ])
+       rm -f conftest.file])
+diff --git a/m4/d-ino.m4 b/m4/d-ino.m4
+index f1420cc..87dcacc 100644
+--- a/m4/d-ino.m4
++++ b/m4/d-ino.m4
+@@ -1,4 +1,4 @@
+-# serial 18
++# serial 19
+
+ dnl From Jim Meyering.
+ dnl
+@@ -40,12 +40,14 @@ AC_DEFUN([gl_CHECK_TYPE_STRUCT_DIRENT_D_INO],
+            [gl_cv_struct_dirent_d_ino=yes],
+            [gl_cv_struct_dirent_d_ino=no],
+            [case "$host_os" in
+-                           # Guess yes on glibc systems with Linux kernel.
+-              linux*-gnu*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
+-                           # Guess no on native Windows.
+-              mingw*)      gl_cv_struct_dirent_d_ino="guessing no" ;;
+-                           # If we don't know, assume the worst.
+-              *)           gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # Guess yes on glibc systems with Linux kernel.
++              linux*-gnu*)  gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess yes on musl systems with Linux kernel.
++              linux*-musl*) gl_cv_struct_dirent_d_ino="guessing yes" ;;
++                            # Guess no on native Windows.
++              mingw*)       gl_cv_struct_dirent_d_ino="guessing no" ;;
++                            # If we don't know, assume the worst.
++              *)            gl_cv_struct_dirent_d_ino="guessing no" ;;
+             esac
+            ])])
+    case "$gl_cv_struct_dirent_d_ino" in
+diff --git a/m4/fdopendir.m4 b/m4/fdopendir.m4
+index 0490551..b2b3b03 100644
+--- a/m4/fdopendir.m4
++++ b/m4/fdopendir.m4
+@@ -1,4 +1,4 @@
+-# serial 10
++# serial 11
+ # See if we need to provide fdopendir.
+
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+@@ -45,10 +45,12 @@ DIR *fdopendir (int);
+          [gl_cv_func_fdopendir_works=yes],
+          [gl_cv_func_fdopendir_works=no],
+          [case "$host_os" in
+-                    # Guess yes on glibc systems.
+-            *-gnu*) gl_cv_func_fdopendir_works="guessing yes" ;;
+-                    # If we don't know, assume the worst.
+-            *)      gl_cv_func_fdopendir_works="guessing no" ;;
++                     # Guess yes on glibc systems.
++            *-gnu*)  gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fdopendir_works="guessing yes" ;;
++                     # If we don't know, assume the worst.
++            *)       gl_cv_func_fdopendir_works="guessing no" ;;
+           esac
+          ])])
+     case "$gl_cv_func_fdopendir_works" in
+diff --git a/m4/fnmatch.m4 b/m4/fnmatch.m4
+index c264ca7..75ba55b 100644
+--- a/m4/fnmatch.m4
++++ b/m4/fnmatch.m4
+@@ -1,4 +1,4 @@
+-# Check for fnmatch - serial 13.  -*- coding: utf-8 -*-
++# Check for fnmatch - serial 14.  -*- coding: utf-8 -*-
+
+ # Copyright (C) 2000-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -14,6 +14,7 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+   m4_divert_text([DEFAULTS], [gl_fnmatch_required=POSIX])
+
+   AC_REQUIRE([gl_FNMATCH_H])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   gl_fnmatch_required_lowercase=`
+     echo $gl_fnmatch_required | LC_ALL=C tr '[[A-Z]]' '[[a-z]]'
+   `
+@@ -117,12 +118,19 @@ AC_DEFUN([gl_FUNC_FNMATCH_POSIX],
+             ]])],
+          [eval "$gl_fnmatch_cache_var=yes"],
+          [eval "$gl_fnmatch_cache_var=no"],
+-         [eval "$gl_fnmatch_cache_var=\"guessing no\""])
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) eval "$gl_fnmatch_cache_var=\"guessing yes\"" ;;
++                     # Guess no otherwise, even on glibc systems.
++            *)       eval "$gl_fnmatch_cache_var=\"guessing no\"" ;;
++          esac
++         ])
+       ])
+     eval "gl_fnmatch_result=\"\$$gl_fnmatch_cache_var\""
+-    if test "$gl_fnmatch_result" != yes; then
+-      REPLACE_FNMATCH=1
+-    fi
++    case "$gl_fnmatch_result" in
++      *yes) ;;
++      *) REPLACE_FNMATCH=1 ;;
++    esac
+   fi
+   if test $HAVE_FNMATCH = 0 || test $REPLACE_FNMATCH = 1; then
+     gl_REPLACE_FNMATCH_H
+diff --git a/m4/fpurge.m4 b/m4/fpurge.m4
+index cb21f56..6c5b3e9 100644
+--- a/m4/fpurge.m4
++++ b/m4/fpurge.m4
+@@ -1,4 +1,4 @@
+-# fpurge.m4 serial 8
++# fpurge.m4 serial 9
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -7,12 +7,13 @@ dnl with or without modifications, as long as this notice is preserved.
+ AC_DEFUN([gl_FUNC_FPURGE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_FUNCS_ONCE([fpurge])
+   AC_CHECK_FUNCS_ONCE([__fpurge])
+   AC_CHECK_DECLS([fpurge], , , [[#include <stdio.h>]])
+   if test "x$ac_cv_func_fpurge" = xyes; then
+     HAVE_FPURGE=1
+-    # Detect BSD bug.  Only cygwin 1.7 is known to be immune.
++    # Detect BSD bug.  Only cygwin 1.7 and musl are known to be immune.
+     AC_CACHE_CHECK([whether fpurge works], [gl_cv_func_fpurge_works],
+       [AC_RUN_IFELSE(
+          [AC_LANG_PROGRAM(
+@@ -48,11 +49,20 @@ AC_DEFUN([gl_FUNC_FPURGE],
+                return 13;
+              return 0;
+             ])],
+-      [gl_cv_func_fpurge_works=yes], [gl_cv_func_fpurge_works=no],
+-      [gl_cv_func_fpurge_works='guessing no'])])
+-    if test "x$gl_cv_func_fpurge_works" != xyes; then
+-      REPLACE_FPURGE=1
+-    fi
++         [gl_cv_func_fpurge_works=yes],
++         [gl_cv_func_fpurge_works=no],
++         [case "$host_os" in
++                     # Guess yes on musl systems.
++            *-musl*) gl_cv_func_fpurge_works="guessing yes" ;;
++                     # Guess no otherwise.
++            *)       gl_cv_func_fpurge_works="guessing no" ;;
++          esac
++         ])
++      ])
++    case "$gl_cv_func_fpurge_works" in
++      *yes) ;;
++      *) REPLACE_FPURGE=1 ;;
++    esac
+   else
+     HAVE_FPURGE=0
+   fi
+diff --git a/m4/getcwd-abort-bug.m4 b/m4/getcwd-abort-bug.m4
+index f0f24a5..7227f08 100644
+--- a/m4/getcwd-abort-bug.m4
++++ b/m4/getcwd-abort-bug.m4
+@@ -1,4 +1,4 @@
+-# serial 9
++# serial 11
+ # Determine whether getcwd aborts when the length of the working directory
+ # name is unusually large.  Any length between 4k and 16k trigger the bug
+ # when using glibc-2.4.90-9 or older.
+@@ -13,6 +13,7 @@
+ # gl_FUNC_GETCWD_ABORT_BUG([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
+ AC_DEFUN([gl_FUNC_GETCWD_ABORT_BUG],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+   AC_CHECK_DECLS_ONCE([getcwd])
+   AC_CHECK_HEADERS_ONCE([unistd.h])
+   AC_REQUIRE([gl_PATHMAX_SNIPPET_PREREQ])
+@@ -142,7 +143,13 @@ main ()
+         else
+           gl_cv_func_getcwd_abort_bug=no
+         fi],
+-       [gl_cv_func_getcwd_abort_bug=yes])
++       [case "$host_os" in
++                   # Guess no on musl systems.
++          *-musl*) gl_cv_func_getcwd_abort_bug="guessing no" ;;
++                   # Guess yes otherwise, even on glibc systems.
++          *)       gl_cv_func_getcwd_abort_bug="guessing yes"
++        esac
++       ])
+     ])
+   AS_IF([test $gl_cv_func_getcwd_abort_bug = yes], [$1], [$2])
+ ])
+diff --git a/m4/getcwd.m4 b/m4/getcwd.m4
+index 4929b51..625171a 100644
+--- a/m4/getcwd.m4
++++ b/m4/getcwd.m4
+@@ -6,7 +6,7 @@
+ # with or without modifications, as long as this notice is preserved.
+
+ # Written by Paul Eggert.
+-# serial 16
++# serial 17
+
+ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+   [
+@@ -50,6 +50,8 @@ AC_DEFUN([gl_FUNC_GETCWD_NULL],
+         [[case "$host_os" in
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) gl_cv_func_getcwd_null="guessing yes";;
++                           # Guess yes on musl systems.
++            *-musl*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # Guess yes on Cygwin.
+             cygwin*)       gl_cv_func_getcwd_null="guessing yes";;
+                            # If we don't know, assume the worst.
+diff --git a/m4/getdelim.m4 b/m4/getdelim.m4
+index bf17c57..e77c379 100644
+--- a/m4/getdelim.m4
++++ b/m4/getdelim.m4
+@@ -1,4 +1,4 @@
+-# getdelim.m4 serial 12
++# getdelim.m4 serial 13
+
+ dnl Copyright (C) 2005-2007, 2009-2019 Free Software Foundation, Inc.
+ dnl
+@@ -11,6 +11,7 @@ AC_PREREQ([2.59])
+ AC_DEFUN([gl_FUNC_GETDELIM],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getdelim().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -21,9 +22,10 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+   if test $ac_cv_func_getdelim = yes; then
+     HAVE_GETDELIM=1
+     dnl Found it in some library.  Verify that it works.
+-    AC_CACHE_CHECK([for working getdelim function], [gl_cv_func_working_getdelim],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getdelim function],
++      [gl_cv_func_working_getdelim],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -53,25 +55,31 @@ AC_DEFUN([gl_FUNC_GETDELIM],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [gl_cv_func_working_getdelim=yes] dnl The library version works.
+-    , [gl_cv_func_working_getdelim=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [gl_cv_func_working_getdelim=yes],
++         [gl_cv_func_working_getdelim=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [gl_cv_func_working_getdelim="guessing yes"],
+-         [gl_cv_func_working_getdelim="guessing no"])]
+-    )])
++            ],
++            [gl_cv_func_working_getdelim="guessing yes"],
++            [case "$host_os" in
++               *-musl*) gl_cv_func_working_getdelim="guessing yes" ;;
++               *)       gl_cv_func_working_getdelim="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+     case "$gl_cv_func_working_getdelim" in
+-      *no)
+-        REPLACE_GETDELIM=1
+-        ;;
++      *yes) ;;
++      *) REPLACE_GETDELIM=1 ;;
+     esac
+   else
+     HAVE_GETDELIM=0
+diff --git a/m4/getgroups.m4 b/m4/getgroups.m4
+index 2ce986e..c93447b 100644
+--- a/m4/getgroups.m4
++++ b/m4/getgroups.m4
+@@ -1,4 +1,4 @@
+-# serial 21
++# serial 22
+
+ dnl From Jim Meyering.
+ dnl A wrapper around AC_FUNC_GETGROUPS.
+@@ -42,6 +42,8 @@ AC_DEFUN([AC_FUNC_GETGROUPS],
+          [case "$host_os" in # ((
+                            # Guess yes on glibc systems.
+             *-gnu* | gnu*) ac_cv_func_getgroups_works="guessing yes" ;;
++                           # Guess yes on musl systems.
++            *-musl*)       ac_cv_func_getgroups_works="guessing yes" ;;
+                            # If we don't know, assume the worst.
+             *)             ac_cv_func_getgroups_works="guessing no" ;;
+           esac
+@@ -95,6 +97,8 @@ AC_DEFUN([gl_FUNC_GETGROUPS],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_getgroups_works="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_getgroups_works="guessing yes" ;;
+                             # If we don't know, assume the worst.
+              *)             gl_cv_func_getgroups_works="guessing no" ;;
+            esac
+diff --git a/m4/getline.m4 b/m4/getline.m4
+index 5b2ead2..32f771c 100644
+--- a/m4/getline.m4
++++ b/m4/getline.m4
+@@ -1,4 +1,4 @@
+-# getline.m4 serial 28
++# getline.m4 serial 29
+
+ dnl Copyright (C) 1998-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+@@ -16,6 +16,7 @@ dnl to do with the function we need.
+ AC_DEFUN([gl_FUNC_GETLINE],
+ [
+   AC_REQUIRE([gl_STDIO_H_DEFAULTS])
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
+
+   dnl Persuade glibc <stdio.h> to declare getline().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+@@ -28,9 +29,10 @@ AC_DEFUN([gl_FUNC_GETLINE],
+                  gl_getline_needs_run_time_check=yes],
+                 [am_cv_func_working_getline=no])
+   if test $gl_getline_needs_run_time_check = yes; then
+-    AC_CACHE_CHECK([for working getline function], [am_cv_func_working_getline],
+-    [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
+-    AC_RUN_IFELSE([AC_LANG_SOURCE([[
++    AC_CACHE_CHECK([for working getline function],
++      [am_cv_func_working_getline],
++      [echo fooNbarN | tr -d '\012' | tr N '\012' > conftest.data
++       AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #    include <stdio.h>
+ #    include <stdlib.h>
+ #    include <string.h>
+@@ -61,21 +63,28 @@ AC_DEFUN([gl_FUNC_GETLINE],
+       fclose (in);
+       return 0;
+     }
+-    ]])], [am_cv_func_working_getline=yes] dnl The library version works.
+-    , [am_cv_func_working_getline=no] dnl The library version does NOT work.
+-    , dnl We're cross compiling. Assume it works on glibc2 systems.
+-      [AC_EGREP_CPP([Lucky GNU user],
+-         [
++    ]])],
++         [am_cv_func_working_getline=yes],
++         [am_cv_func_working_getline=no],
++         [dnl We're cross compiling.
++          dnl Guess it works on glibc2 systems and musl systems.
++          AC_EGREP_CPP([Lucky GNU user],
++            [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+  #if (__GLIBC__ >= 2) && !defined __UCLIBC__
+   Lucky GNU user
+  #endif
+ #endif
+-         ],
+-         [am_cv_func_working_getline="guessing yes"],
+-         [am_cv_func_working_getline="guessing no"])]
+-    )])
++            ],
++            [am_cv_func_working_getline="guessing yes"],
++            [case "$host_os" in
++               *-musl*) am_cv_func_working_getline="guessing yes" ;;
++               *)       am_cv_func_working_getline="guessing no" ;;
++             esac
++            ])
++         ])
++      ])
+   fi
+
+   if test $ac_cv_have_decl_getline = no; then
+@@ -83,7 +92,8 @@ AC_DEFUN([gl_FUNC_GETLINE],
+   fi
+
+   case "$am_cv_func_working_getline" in
+-    *no)
++    *yes) ;;
++    *)
+       dnl Set REPLACE_GETLINE always: Even if we have not found the broken
+       dnl getline function among $LIBS, it may exist in libinet and the
+       dnl executable may be linked with -linet.
+diff --git a/m4/gettimeofday.m4 b/m4/gettimeofday.m4
+index d29b4bf..5e2ef6f 100644
+--- a/m4/gettimeofday.m4
++++ b/m4/gettimeofday.m4
+@@ -1,4 +1,4 @@
+-# serial 25
++# serial 26
+
+ # Copyright (C) 2001-2003, 2005, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -105,6 +105,8 @@ AC_DEFUN([gl_FUNC_GETTIMEOFDAY_CLOBBER],
+       case "$host_os" in
+                        # Guess all is fine on glibc systems.
+         *-gnu* | gnu*) gl_cv_func_gettimeofday_clobber="guessing no" ;;
++                       # Guess all is fine on musl systems.
++        *-musl*)       gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # Guess no on native Windows.
+         mingw*)        gl_cv_func_gettimeofday_clobber="guessing no" ;;
+                        # If we don't know, assume the worst.
+diff --git a/m4/link-follow.m4 b/m4/link-follow.m4
+index cbd2dca..8ac7301 100644
+--- a/m4/link-follow.m4
++++ b/m4/link-follow.m4
+@@ -1,4 +1,4 @@
+-# serial 20
++# serial 21
+ dnl Run a program to determine whether link(2) follows symlinks.
+ dnl Set LINK_FOLLOWS_SYMLINKS accordingly.
+
+@@ -88,6 +88,8 @@ AC_DEFUN([gl_FUNC_LINK_FOLLOWS_SYMLINK],
+             case "$host_os" in
+                                   # On glibc/Linux we know the result.
+               linux*-gnu* | gnu*) gl_cv_func_link_follows_symlink="guessing no" ;;
++                                  # On musl/Linux we know the result.
++              linux*-musl*)       gl_cv_func_link_follows_symlink="guessing no" ;;
+                                   # Otherwise, we don't know.
+               *)                  gl_cv_func_link_follows_symlink=unknown ;;
+             esac
+diff --git a/m4/malloc.m4 b/m4/malloc.m4
+index b9b8d4b..c469c45 100644
+--- a/m4/malloc.m4
++++ b/m4/malloc.m4
+@@ -1,4 +1,4 @@
+-# malloc.m4 serial 17
++# malloc.m4 serial 19
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_MALLOC_IF],
+        [ac_cv_func_malloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_malloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/mkdir.m4 b/m4/mkdir.m4
+index 4cd9590..366a3cd 100644
+--- a/m4/mkdir.m4
++++ b/m4/mkdir.m4
+@@ -1,4 +1,4 @@
+-# serial 14
++# serial 15
+
+ # Copyright (C) 2001, 2003-2004, 2006, 2008-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -62,6 +62,8 @@ AC_DEFUN([gl_FUNC_MKDIR],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_mkdir_trailing_dot_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_mkdir_trailing_dot_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/mkstemp.m4 b/m4/mkstemp.m4
+index ae24c3b..1b15c2e 100644
+--- a/m4/mkstemp.m4
++++ b/m4/mkstemp.m4
+@@ -1,4 +1,4 @@
+-#serial 25
++#serial 26
+
+ # Copyright (C) 2001, 2003-2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -59,6 +59,8 @@ AC_DEFUN([gl_FUNC_MKSTEMP],
+           [case "$host_os" in
+                             # Guess yes on glibc systems.
+              *-gnu* | gnu*) gl_cv_func_working_mkstemp="guessing yes" ;;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_working_mkstemp="guessing yes" ;;
+                             # Guess no on native Windows.
+              mingw*)        gl_cv_func_working_mkstemp="guessing no" ;;
+                             # If we don't know, assume the worst.
+diff --git a/m4/perror.m4 b/m4/perror.m4
+index 335be72..08e2db1 100644
+--- a/m4/perror.m4
++++ b/m4/perror.m4
+@@ -1,4 +1,4 @@
+-# perror.m4 serial 7
++# perror.m4 serial 8
+ dnl Copyright (C) 2008-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,10 +48,12 @@ AC_DEFUN([gl_FUNC_PERROR],
+             rm -rf conftest.txt1 conftest.txt2],
+            [gl_cv_func_perror_works=no],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_perror_works="guessing yes" ;;
+-                      # Otherwise guess no.
+-              *)      gl_cv_func_perror_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_perror_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_perror_works="guessing yes" ;;
++                       # Otherwise guess no.
++              *)       gl_cv_func_perror_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/printf.m4 b/m4/printf.m4
+index cbf6ae4..6d2280e 100644
+--- a/m4/printf.m4
++++ b/m4/printf.m4
+@@ -1,4 +1,4 @@
+-# printf.m4 serial 60
++# printf.m4 serial 61
+ dnl Copyright (C) 2003, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -62,6 +62,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_sizes_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_sizes_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_printf_sizes_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_sizes_c99="guessing yes";;
+@@ -240,6 +242,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_infinite="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_infinite="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_infinite="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_infinite="guessing yes";;
+@@ -457,6 +461,8 @@ int main ()
+ changequote(,)dnl
+                                          # Guess yes on glibc systems.
+                    *-gnu* | gnu*)        gl_cv_func_printf_infinite_long_double="guessing yes";;
++                                         # Guess yes on musl systems.
++                   *-musl*)              gl_cv_func_printf_infinite_long_double="guessing yes";;
+                                          # Guess yes on FreeBSD >= 6.
+                    freebsd[1-5].*)       gl_cv_func_printf_infinite_long_double="guessing no";;
+                    freebsd* | kfreebsd*) gl_cv_func_printf_infinite_long_double="guessing yes";;
+@@ -575,6 +581,8 @@ int main ()
+                [gl_cv_func_printf_directive_a="guessing yes"],
+                [gl_cv_func_printf_directive_a="guessing no"])
+              ;;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_a="guessing yes";;
+                                  # Guess no on Android.
+            linux*-android*)      gl_cv_func_printf_directive_a="guessing no";;
+                                  # Guess no on native Windows.
+@@ -625,6 +633,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_printf_directive_f="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_printf_directive_f="guessing yes";;
+                                  # Guess yes on FreeBSD >= 6.
+            freebsd[1-5].*)       gl_cv_func_printf_directive_f="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_printf_directive_f="guessing yes";;
+@@ -960,6 +970,8 @@ changequote(,)dnl
+          case "$host_os" in
+                             # Guess yes on glibc systems.
+            *-gnu* | gnu*)   gl_cv_func_printf_flag_zero="guessing yes";;
++                            # Guess yes on musl systems.
++           *-musl*)         gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess yes on BeOS.
+            beos*)           gl_cv_func_printf_flag_zero="guessing yes";;
+                             # Guess no on Android.
+@@ -1206,6 +1218,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_truncation_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_truncation_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_truncation_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_truncation_c99="guessing yes";;
+@@ -1308,6 +1322,8 @@ int main ()
+ changequote(,)dnl
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_retval_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_retval_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_retval_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_retval_c99="guessing yes";;
+@@ -1400,6 +1416,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_snprintf_directive_n="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_snprintf_directive_n="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_snprintf_directive_n="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_snprintf_directive_n="guessing yes";;
+@@ -1554,6 +1572,8 @@ changequote(,)dnl
+          case "$host_os" in
+                                  # Guess yes on glibc systems.
+            *-gnu* | gnu*)        gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
++                                 # Guess yes on musl systems.
++           *-musl*)              gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+                                  # Guess yes on FreeBSD >= 5.
+            freebsd[1-4].*)       gl_cv_func_vsnprintf_zerosize_c99="guessing no";;
+            freebsd* | kfreebsd*) gl_cv_func_vsnprintf_zerosize_c99="guessing yes";;
+diff --git a/m4/putenv.m4 b/m4/putenv.m4
+index f8960f6..342ba26 100644
+--- a/m4/putenv.m4
++++ b/m4/putenv.m4
+@@ -1,4 +1,4 @@
+-# putenv.m4 serial 22
++# putenv.m4 serial 23
+ dnl Copyright (C) 2002-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -36,6 +36,8 @@ AC_DEFUN([gl_FUNC_PUTENV],
+              [case "$host_os" in
+                                # Guess yes on glibc systems.
+                 *-gnu* | gnu*) gl_cv_func_svid_putenv="guessing yes" ;;
++                               # Guess yes on musl systems.
++                *-musl*)       gl_cv_func_svid_putenv="guessing yes" ;;
+                                # Guess no on native Windows.
+                 mingw*)        gl_cv_func_svid_putenv="guessing no" ;;
+                                # If we don't know, assume the worst.
+diff --git a/m4/realloc.m4 b/m4/realloc.m4
+index f9f15ad..93066e8 100644
+--- a/m4/realloc.m4
++++ b/m4/realloc.m4
+@@ -1,4 +1,4 @@
+-# realloc.m4 serial 15
++# realloc.m4 serial 17
+ dnl Copyright (C) 2007, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -32,7 +32,7 @@ AC_DEFUN([_AC_FUNC_REALLOC_IF],
+        [ac_cv_func_realloc_0_nonnull=no],
+        [case "$host_os" in
+           # Guess yes on platforms where we know the result.
+-          *-gnu* | gnu* | freebsd* | netbsd* | openbsd* \
++          *-gnu* | gnu* | *-musl* | freebsd* | netbsd* | openbsd* \
+           | hpux* | solaris* | cygwin* | mingw*)
+             ac_cv_func_realloc_0_nonnull="guessing yes" ;;
+           # If we don't know, assume the worst.
+diff --git a/m4/setenv.m4 b/m4/setenv.m4
+index 6101274..a8f83d6 100644
+--- a/m4/setenv.m4
++++ b/m4/setenv.m4
+@@ -1,4 +1,4 @@
+-# setenv.m4 serial 27
++# setenv.m4 serial 28
+ dnl Copyright (C) 2001-2004, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -37,6 +37,8 @@ AC_DEFUN([gl_FUNC_SETENV],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_setenv_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_setenv_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+          *)             gl_cv_func_setenv_works="guessing no" ;;
+        esac
+diff --git a/m4/signbit.m4 b/m4/signbit.m4
+index bf5bce5..f7f2f3d 100644
+--- a/m4/signbit.m4
++++ b/m4/signbit.m4
+@@ -1,4 +1,4 @@
+-# signbit.m4 serial 16
++# signbit.m4 serial 17
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit="guessing yes" ;;
+                           # Guess yes on native Windows.
+            mingw*)        gl_cv_func_signbit="guessing yes" ;;
+                           # If we don't know, assume the worst.
+@@ -62,6 +64,8 @@ AC_DEFUN([gl_SIGNBIT],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_signbit_gcc="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_signbit_gcc="guessing yes" ;;
+                           # Guess yes on mingw, no on MSVC.
+            mingw*)        if test -n "$GCC"; then
+                             gl_cv_func_signbit_gcc="guessing yes"
+diff --git a/m4/sleep.m4 b/m4/sleep.m4
+index 5f71cc7..7bab467 100644
+--- a/m4/sleep.m4
++++ b/m4/sleep.m4
+@@ -1,4 +1,4 @@
+-# sleep.m4 serial 9
++# sleep.m4 serial 10
+ dnl Copyright (C) 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -48,6 +48,8 @@ handle_alarm (int sig)
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_sleep_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_sleep_works="guessing yes" ;;
+                         # Guess no on native Windows.
+          mingw*)        gl_cv_func_sleep_works="guessing no" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/stpncpy.m4 b/m4/stpncpy.m4
+index 83425dd..f8e1a7c 100644
+--- a/m4/stpncpy.m4
++++ b/m4/stpncpy.m4
+@@ -1,4 +1,4 @@
+-# stpncpy.m4 serial 16
++# stpncpy.m4 serial 17
+ dnl Copyright (C) 2002-2003, 2005-2007, 2009-2019 Free Software Foundation,
+ dnl Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -7,6 +7,8 @@ dnl with or without modifications, as long as this notice is preserved.
+
+ AC_DEFUN([gl_FUNC_STPNCPY],
+ [
++  AC_REQUIRE([AC_CANONICAL_HOST]) dnl for cross-compiles
++
+   dnl Persuade glibc <string.h> to declare stpncpy().
+   AC_REQUIRE([AC_USE_SYSTEM_EXTENSIONS])
+
+@@ -69,12 +71,18 @@ int main ()
+ ]])],
+         [gl_cv_func_stpncpy=yes],
+         [gl_cv_func_stpncpy=no],
+-        [AC_EGREP_CPP([Thanks for using GNU], [
++        [dnl Guess yes on glibc systems and musl systems.
++         AC_EGREP_CPP([Thanks for using GNU], [
+ #include <features.h>
+ #ifdef __GNU_LIBRARY__
+   Thanks for using GNU
+ #endif
+-], [gl_cv_func_stpncpy="guessing yes"], [gl_cv_func_stpncpy="guessing no"])
++],         [gl_cv_func_stpncpy="guessing yes"],
++           [case "$host_os" in
++              *-musl*) gl_cv_func_stpncpy="guessing yes" ;;
++              *)       gl_cv_func_stpncpy="guessing no" ;;
++            esac
++           ])
+         ])
+     ])
+     case "$gl_cv_func_stpncpy" in
+diff --git a/m4/strerror.m4 b/m4/strerror.m4
+index b452f7f..2c90f31 100644
+--- a/m4/strerror.m4
++++ b/m4/strerror.m4
+@@ -1,4 +1,4 @@
+-# strerror.m4 serial 19
++# strerror.m4 serial 20
+ dnl Copyright (C) 2002, 2007-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -26,6 +26,8 @@ AC_DEFUN([gl_FUNC_STRERROR],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_working_strerror="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_working_strerror="guessing yes" ;;
+                           # If we don't know, assume the worst.
+            *)             gl_cv_func_working_strerror="guessing no" ;;
+          esac
+@@ -80,6 +82,8 @@ AC_DEFUN([gl_FUNC_STRERROR_0],
+       [case "$host_os" in
+                         # Guess yes on glibc systems.
+          *-gnu* | gnu*) gl_cv_func_strerror_0_works="guessing yes" ;;
++                        # Guess yes on musl systems.
++         *-musl*)       gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # Guess yes on native Windows.
+          mingw*)        gl_cv_func_strerror_0_works="guessing yes" ;;
+                         # If we don't know, assume the worst.
+diff --git a/m4/strtod.m4 b/m4/strtod.m4
+index 9912217..d68ab75 100644
+--- a/m4/strtod.m4
++++ b/m4/strtod.m4
+@@ -1,4 +1,4 @@
+-# strtod.m4 serial 24
++# strtod.m4 serial 25
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -115,9 +115,11 @@ numeric_equal (double x, double y)
+            ],
+            [gl_cv_func_strtod_works="guessing yes"],
+            [case "$host_os" in
+-                      # Guess yes on native Windows.
+-              mingw*) gl_cv_func_strtod_works="guessing yes" ;;
+-              *)      gl_cv_func_strtod_works="guessing no" ;;
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtod_works="guessing yes" ;;
++                       # Guess yes on native Windows.
++              mingw*)  gl_cv_func_strtod_works="guessing yes" ;;
++              *)       gl_cv_func_strtod_works="guessing no" ;;
+             esac
+            ])
+         ])
+diff --git a/m4/strtold.m4 b/m4/strtold.m4
+index 16b4eda..17125fe 100644
+--- a/m4/strtold.m4
++++ b/m4/strtold.m4
+@@ -1,4 +1,4 @@
+-# strtold.m4 serial 2
++# strtold.m4 serial 4
+ dnl Copyright (C) 2002-2003, 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,7 +98,12 @@ numeric_equal (long double x, long double y)
+ #endif
+            ],
+            [gl_cv_func_strtold_works="guessing yes"],
+-           [gl_cv_func_strtod_works="guessing no"])
++           [case "$host_os" in
++                       # Guess yes on musl systems.
++              *-musl*) gl_cv_func_strtold_works="guessing yes" ;;
++              *)       gl_cv_func_strtold_works="guessing no" ;;
++            esac
++           ])
+         ])
+       ])
+     case "$gl_cv_func_strtold_works" in
+diff --git a/m4/tzset.m4 b/m4/tzset.m4
+index 1278801..afdfa8e 100644
+--- a/m4/tzset.m4
++++ b/m4/tzset.m4
+@@ -1,4 +1,4 @@
+-# serial 11
++# serial 12
+
+ # Copyright (C) 2003, 2007, 2009-2019 Free Software Foundation, Inc.
+ # This file is free software; the Free Software Foundation
+@@ -70,6 +70,8 @@ main ()
+        [case "$host_os" in
+                          # Guess all is fine on glibc systems.
+           *-gnu* | gnu*) gl_cv_func_tzset_clobber="guessing no" ;;
++                         # Guess all is fine on musl systems.
++          *-musl*)       gl_cv_func_tzset_clobber="guessing no" ;;
+                          # Guess no on native Windows.
+           mingw*)        gl_cv_func_tzset_clobber="guessing no" ;;
+                          # If we don't know, assume the worst.
+diff --git a/m4/ungetc.m4 b/m4/ungetc.m4
+index ab8757b..08baf33 100644
+--- a/m4/ungetc.m4
++++ b/m4/ungetc.m4
+@@ -1,4 +1,4 @@
+-# ungetc.m4 serial 6
++# ungetc.m4 serial 7
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -41,12 +41,16 @@ AC_DEFUN_ONCE([gl_FUNC_UNGETC_WORKS],
+            remove ("conftest.tmp");])],
+         [gl_cv_func_ungetc_works=yes], [gl_cv_func_ungetc_works=no],
+         [case "$host_os" in
+-                                       # Guess yes on glibc and bionic systems.
+-           *-gnu* | gnu* | *-android*) gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # Guess yes on native Windows.
+-           mingw*)                     gl_cv_func_ungetc_works="guessing yes" ;;
+-                                       # If we don't know, assume the worst.
+-           *)                          gl_cv_func_ungetc_works="guessing no" ;;
++                          # Guess yes on glibc systems.
++           *-gnu* | gnu*) gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on bionic systems.
++           *-android*)    gl_cv_func_ungetc_works="guessing yes" ;;
++                          # Guess yes on native Windows.
++           mingw*)        gl_cv_func_ungetc_works="guessing yes" ;;
++                          # If we don't know, assume the worst.
++           *)             gl_cv_func_ungetc_works="guessing no" ;;
+          esac
+         ])
+     ])
+diff --git a/m4/usleep.m4 b/m4/usleep.m4
+index 59605a8..4a6bff0 100644
+--- a/m4/usleep.m4
++++ b/m4/usleep.m4
+@@ -1,4 +1,4 @@
+-# usleep.m4 serial 5
++# usleep.m4 serial 6
+ dnl Copyright (C) 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -31,6 +31,8 @@ AC_DEFUN([gl_FUNC_USLEEP],
+         [case "$host_os" in
+                           # Guess yes on glibc systems.
+            *-gnu* | gnu*) gl_cv_func_usleep_works="guessing yes" ;;
++                          # Guess yes on musl systems.
++           *-musl*)       gl_cv_func_usleep_works="guessing yes" ;;
+                           # Guess no on native Windows.
+            mingw*)        gl_cv_func_usleep_works="guessing no" ;;
+                           # If we don't know, assume the worst.
+diff --git a/m4/utimes.m4 b/m4/utimes.m4
+index 7209b6d..5806d8f 100644
+--- a/m4/utimes.m4
++++ b/m4/utimes.m4
+@@ -1,5 +1,5 @@
+ # Detect some bugs in glibc's implementation of utimes.
+-# serial 5
++# serial 6
+
+ dnl Copyright (C) 2003-2005, 2009-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+@@ -143,9 +143,11 @@ main ()
+        [gl_cv_func_working_utimes=yes],
+        [gl_cv_func_working_utimes=no],
+        [case "$host_os" in
+-                  # Guess no on native Windows.
+-          mingw*) gl_cv_func_working_utimes="guessing no" ;;
+-          *)      gl_cv_func_working_utimes="guessing no" ;;
++                   # Guess yes on musl systems.
++          *-musl*) gl_cv_func_working_utimes="guessing yes" ;;
++                   # Guess no on native Windows.
++          mingw*)  gl_cv_func_working_utimes="guessing no" ;;
++          *)       gl_cv_func_working_utimes="guessing no" ;;
+         esac
+        ])
+     ])
+diff --git a/m4/wcwidth.m4 b/m4/wcwidth.m4
+index baa2002..3952fd2 100644
+--- a/m4/wcwidth.m4
++++ b/m4/wcwidth.m4
+@@ -1,4 +1,4 @@
+-# wcwidth.m4 serial 27
++# wcwidth.m4 serial 28
+ dnl Copyright (C) 2006-2019 Free Software Foundation, Inc.
+ dnl This file is free software; the Free Software Foundation
+ dnl gives unlimited permission to copy and/or distribute it,
+@@ -98,9 +98,13 @@ int main ()
+           [
+ changequote(,)dnl
+            case "$host_os" in
+-                                        # Guess yes on glibc and AIX 7 systems.
+-             *-gnu* | gnu* | aix[7-9]*) gl_cv_func_wcwidth_works="guessing yes";;
+-             *)                         gl_cv_func_wcwidth_works="guessing no";;
++                            # Guess yes on glibc systems.
++             *-gnu* | gnu*) gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on musl systems.
++             *-musl*)       gl_cv_func_wcwidth_works="guessing yes";;
++                            # Guess yes on AIX 7 systems.
++             aix[7-9]*)     gl_cv_func_wcwidth_works="guessing yes";;
++             *)             gl_cv_func_wcwidth_works="guessing no";;
+            esac
+ changequote([,])dnl
+           ])
+--
+1.9.1
+
+
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 9cc48f44646..f83a2b94071 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, buildPackages
-, autoreconfHook, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
+, autoreconfHook, bison, texinfo, fetchurl, perl, xz, libiconv, gmp ? null
 , aclSupport ? stdenv.isLinux, acl ? null
 , attrSupport ? stdenv.isLinux, attr ? null
 , selinuxSupport? false, libselinux ? null, libsepol ? null
@@ -24,7 +24,9 @@ stdenv.mkDerivation rec {
     sha256 = "1zg9m79x1i2nifj4kb0waf9x3i5h6ydkypkjnbsb9rnwis8rqypz";
   };
 
-  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch;
+  patches = optional stdenv.hostPlatform.isCygwin ./coreutils-8.23-4.cygwin.patch
+         # Fix compilation in musl-cross environments. To be removed in coreutils-8.32.
+         ++ optional stdenv.hostPlatform.isMusl ./coreutils-8.31-musl-cross.patch;
 
   postPatch = ''
     # The test tends to fail on btrfs,f2fs and maybe other unusual filesystems.
@@ -55,7 +57,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "info" ];
 
-  nativeBuildInputs = [ perl xz.bin ];
+  nativeBuildInputs = [ perl xz.bin ]
+    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
+    ++ optionals stdenv.hostPlatform.isMusl [ autoreconfHook bison ];   # due to patch
   configureFlags = [ "--with-packager=https://NixOS.org" ]
     ++ optional (singleBinary != false)
       ("--enable-single-binary" + optionalString (isString singleBinary) "=${singleBinary}")
@@ -73,7 +77,6 @@ stdenv.mkDerivation rec {
     ++ optional aclSupport acl
     ++ optional attrSupport attr
     ++ optional withOpenssl openssl
-    ++ optionals stdenv.hostPlatform.isCygwin [ autoreconfHook texinfo ]   # due to patch
     ++ optionals selinuxSupport [ libselinux libsepol ]
        # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.libc != "glibc") libiconv;
@@ -132,4 +135,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 
+} // optionalAttrs stdenv.hostPlatform.isMusl {
+  # Work around a bogus warning in conjunction with musl.
+  NIX_CFLAGS_COMPILE = "-Wno-error";
 }
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index b4272dac531..22da00da9fc 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit, python3Packages, docutils, help2man
 , acl, apktool, binutils-unwrapped, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
-, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg1, gnutar
+, e2fsprogs, file, findutils, fontforge-fonttools, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, pdftk, pgpdump, poppler_utils, sng, sqlite
 , squashfsTools, tcpdump, unoconv, unzip, xxd, xz
 , enableBloat ? false
@@ -41,7 +41,7 @@ python3Packages.buildPythonApplication rec {
       dtc e2fsprogs file findutils fontforge-fonttools gettext gnutar gzip
       libarchive libcaca lz4 pgpdump progressbar33 sng sqlite squashfsTools unzip xxd xz
     ] ++ lib.optionals enableBloat [
-      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg1 gnumeric imagemagick
+      apktool cbfstool colord fpc ghc ghostscriptX giflib gnupg gnumeric imagemagick
       llvm jdk mono openssh pdftk poppler_utils tcpdump unoconv
       python3Packages.guestfs
     ];
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index 77331a7f025..ddd4ae5ce05 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -4,11 +4,11 @@ let inherit (stdenv.lib) getDev; in
 
 stdenv.mkDerivation rec {
   pname = "qt5ct";
-  version = "0.38";
+  version = "0.39";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0p0317z79h906qwaf0p8ga6lmr1dlabkx12gn31bv9lnp9f55jwg";
+    sha256 = "069y6c17gfics8rz3rdsn2x2hb39m4qka08ygwpxa8gqppffqs9p";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/tools/misc/shell-hist/default.nix b/pkgs/tools/misc/shell-hist/default.nix
new file mode 100644
index 00000000000..b44cbf100e8
--- /dev/null
+++ b/pkgs/tools/misc/shell-hist/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage {
+  pname = "shell-hist";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "jamesmunns";
+    repo = "shell-hist";
+    rev = "158de8c3908b49530ecd76bf6e65c210f351ef82";
+    sha256 = "0kc128xnnp1d56if70vfv0w3qnwhljhbnvzwwb7hfm3x2m0vqrqf";
+  };
+
+  cargoSha256 = "1nqnkzwqk879qy1261g1gds668xz6islhzq7chzhilaqpmvf6039";
+
+  meta = with lib; {
+    description = "Inspect your shell history";
+    homepage = "https://github.com/jamesmunns/shell-hist";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = [ maintainers.spacekookie ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 2cdb8aff472..6e431fdc98e 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -15,13 +15,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "tlp-${version}";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "linrunner";
     repo = "TLP";
     rev = version;
-    sha256 = "1msldl6y8fpvxa9p87lv3hvgxwk2vpiahqmapq485ihdjkshc558";
+    sha256 = "0vm31ca6kdak9xzwskz7a8hvdp67drfh2zcdwlz3260r8r2ypgg1";
   };
 
   outRef = placeholder "out";
diff --git a/pkgs/tools/misc/ttyplot/default.nix b/pkgs/tools/misc/ttyplot/default.nix
index 53a0e0a2992..78aeab00a50 100644
--- a/pkgs/tools/misc/ttyplot/default.nix
+++ b/pkgs/tools/misc/ttyplot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttyplot-${version}";
-  version = "1.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "tenox7";
     repo = "ttyplot";
     rev = version;
-    sha256 = "1xaqzm71w2n0q532wpa3w818mvjvch3h34m2aq7pldkyk09frjxh";
+    sha256 = "19qm0hx9ljdw9qg78lydn3c627xy7xnx3knq5f7caw9lf0cdp7kf";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 70f304134d9..a32ce090ecd 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, rustPlatform, cargo, cmake, sphinx, lib, prefix ? "uutils-" }:
 
 rustPlatform.buildRustPackage {
-  name = "uutils-coreutils-2018-09-30";
+  name = "uutils-coreutils-2019-05-03";
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
-    rev = "a161b7e803aef08455ae0547dccd9210e38a4574";
-    sha256 = "19j40cma7rz6yf5j6nyid8qslbcmrnxdk6by53hflal2qx3g555z";
+    rev = "036dd812958ace22d973acf7b370f58072049dac";
+    sha256 = "0d9w3iiphhsk7l5l34682wayp90rgq5a3d94l3qdvhcqkfmpg727";
   };
 
   # too many impure/platform-dependent tests
   doCheck = false;
 
-  cargoSha256 = "1a9k7i4829plkxgsflmpji3mrw2i1vln6jsnhxmkl14h554yi5j4";
+  cargoSha256 = "0qnpx2xhckb45q8cgn0xh31dg5k73hqp5mz5zg3micmg7as4b621";
 
   makeFlags =
     [ "CARGO=${cargo}/bin/cargo" "PREFIX=$(out)" "PROFILE=release" "INSTALLDIR_MAN=$(out)/share/man/man1" ]
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index 724979439d4..98dc79fbe11 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   # The websites youtube-dl deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2019.04.30";
+  version = "2019.05.11";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1s43adnky8ayhjwmgmiqy6rmmygd4c23v36jhy2lzr2jpn8l53z1";
+    sha256 = "1y272jgdqwhf2njzqfln80zb2pmw83rvp6lxza6wghb7cld249j1";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/axel/default.nix b/pkgs/tools/networking/axel/default.nix
index 8a0efbb1943..68dfb089865 100644
--- a/pkgs/tools/networking/axel/default.nix
+++ b/pkgs/tools/networking/axel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "axel-${version}";
-  version = "2.16.1";
+  version = "2.17.1";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/a/axel/axel_${version}.orig.tar.gz";
-    sha256 = "0v3hgqrpqqqkj8ghaky88a0wpnpwqd72vd04ywlbhgfzfkfrllk4";
+  url = "https://github.com/axel-download-accelerator/axel/releases/download/v${version}/${name}.tar.xz";
+    sha256 = "1mwyps6yvrjxp7mpzc0a2hwr2pw050c63fc9aqjzdzjjw123dfrn";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 8c71018ba86..dfe8f6d1d60 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -11,13 +11,13 @@ stdenv.mkDerivation rec {
 
   name = pname + "-" + version;
   pname = "i2pd";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "1gn8i3jxy6zwrqxmkzc1n55sw29jxdjr4ihv33q2kcp7b90b4wsq";
+    sha256 = "1jqfgpwg83prikjg67farl854mhyjiy4lz6i8kahp765m6kp8gaq";
   };
 
   buildInputs = with stdenv.lib; [ boost zlib openssl ]
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 9f3075b374e..4491d183aad 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -2,7 +2,7 @@
 , docbook_xsl }:
 
 let
-  version = "1.0.76";
+  version = "1.0.77";
 in stdenv.mkDerivation rec {
   name = "tgt-${version}";
 
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
     owner = "fujita";
     repo = "tgt";
     rev = "v${version}";
-    sha256 = "1q01ay0zn5gmy6df1iw1ic11p8zygxlp0r3nd887vvvjvlp3xrvc";
+    sha256 = "1qhck8v5057wn9nb1nsq6dzhvqzz51x8i3n0p1x36zbsmdjy2ajw";
   };
 
   buildInputs = [ libxslt systemd libaio docbook_xsl ];
diff --git a/pkgs/tools/security/signing-party/default.nix b/pkgs/tools/security/signing-party/default.nix
index 29af5a5cc0a..8148692327e 100644
--- a/pkgs/tools/security/signing-party/default.nix
+++ b/pkgs/tools/security/signing-party/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitLab, autoconf, automake, makeWrapper
 , python3, perl, perlPackages
-, libmd, gnupg1, which, getopt, libpaper, nettools, qprint
+, libmd, gnupg, which, getopt, libpaper, nettools, qprint
 , sendmailPath ? "/run/wrappers/bin/sendmail" }:
 
 let
@@ -45,7 +45,7 @@ in stdenv.mkDerivation rec {
   # Perl is required for it's pod2man.
   # Python and Perl are required for patching the script interpreter paths.
   nativeBuildInputs = [ autoconf automake makeWrapper ];
-  buildInputs = [ python3 perl perlPackages.GnuPGInterface libmd gnupg1 ];
+  buildInputs = [ python3 perl perlPackages.GnuPGInterface libmd gnupg ];
 
   postInstall = ''
     # Install all tools which aren't handled by 'make install'.
@@ -126,59 +126,59 @@ in stdenv.mkDerivation rec {
         TextTemplate MIMETools MailTools TimeDate NetIDNEncode ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ nettools gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ nettools gnupg ]}"
 
     wrapProgram $out/bin/gpg-key2latex --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 libpaper ]}"
+      "${stdenv.lib.makeBinPath [ gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-key2ps --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ which gnupg1 libpaper ]}"
+      "${stdenv.lib.makeBinPath [ which gnupg libpaper ]}"
 
     wrapProgram $out/bin/gpg-mailkeys --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 qprint ]}"
+      "${stdenv.lib.makeBinPath [ gnupg qprint ]}"
 
     wrapProgram $out/bin/gpgdir --set PERL5LIB \
       ${with perlPackages; makePerlPath ([
         TermReadKey ]
         ++ GnuPGInterfaceRuntimeDependencies)} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpglist --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgparticipants --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ getopt gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ getopt gnupg ]}"
 
 #    wrapProgram $out/bin/gpgparticipants-prefill
 
     wrapProgram $out/bin/gpgsigs --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/gpgwrap --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/keyanalyze --set PERL5LIB \
 
     wrapProgram $out/bin/keyart --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/keylookup --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-clean --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
     wrapProgram $out/bin/pgp-fixkey --set PERL5LIB \
       ${perlPackages.makePerlPath GnuPGInterfaceRuntimeDependencies} \
       --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ gnupg1 ]}"
+      "${stdenv.lib.makeBinPath [ gnupg ]}"
 
 #    wrapProgram $out/bin/pgpring
 
diff --git a/pkgs/tools/security/tboot/default.nix b/pkgs/tools/security/tboot/default.nix
index a07a374c5d8..f159dd27c42 100644
--- a/pkgs/tools/security/tboot/default.nix
+++ b/pkgs/tools/security/tboot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "tboot-${version}";
-  version = "1.9.6";
+  version = "1.9.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/tboot/${name}.tar.gz";
-    sha256 = "0f9afz260xhycpd0x5zz6jn8ha14i8j98rck0fhb55l1rbbfwm8v";
+    sha256 = "06f0ggl6vrb5ghklblvh2ixgmmjv31rkp1vfj9qm497iqwq9ac00";
   };
 
   patches = [ ./tboot-add-well-known-secret-option-to-lcp_writepol.patch ];
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 86cc6221a5c..1aa42dc75f3 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "vault-${version}";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "11hyqqpfz839ipqv534vvljyarnr9wn98rzvyfwnx2lq76h2adqn";
+    sha256 = "1916zqmh4cam9nw3k95wiqizlpkbbm5qhfz4lblqba8pzc2y9v32";
   };
 
   nativeBuildInputs = [ go gox removeReferencesTo ];
diff --git a/pkgs/tools/security/yara/default.nix b/pkgs/tools/security/yara/default.nix
index 08457efe740..7fcb9fc10bd 100644
--- a/pkgs/tools/security/yara/default.nix
+++ b/pkgs/tools/security/yara/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.9.0";
+  version = "3.10.0";
   name = "yara-${version}";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     rev = "v${version}";
-    sha256 = "1a707nx1py1q1z9fc18c93gjd4k5k6k53a93qw09jlcc67xk2sz7";
+    sha256 = "1qxqk324cyvi4n09s79786ciig1gdyhs9dnsm07hf95a3kh6w5z2";
   };
 
   buildInputs = [ autoconf automake libtool pcre]
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index a31ce8f65e4..eec36e8f090 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "stress-ng-${version}";
-  version = "0.09.57";
+  pname = "stress-ng";
+  version = "0.09.58";
 
   src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/${name}.tar.xz";
-    sha256 = "0xp55m1kif8hcjdcdhgaarghqf1gz5fa24qwl6zpmxkzl6bn002x";
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "1rlll6wl0i0m21idfr3xr99pfgnb9wf9i35hsb0frmrpcvls06za";
   };
 
   # All platforms inputs then Linux-only ones
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       attr keyutils libaio libapparmor libcap lksctp-tools
     ];
 
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace Makefile --replace "/usr" ""
   '';
 
@@ -27,25 +27,39 @@ stdenv.mkDerivation rec {
   # mystery, though. :-(
   enableParallelBuilding = (!stdenv.isi686);
 
-  installFlags = [ "DESTDIR=$(out)" ];
+  installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   meta = with stdenv.lib; {
     description = "Stress test a computer system";
     longDescription = ''
-      Stress test a system in various selectable ways, exercising both various
-      physical subsystems and various operating system kernel interfaces:
-      - over 130 different stress tests
-      - over 70 CPU specific stress tests that exercise floating point,
-        integer, bit manipulation and control flow
-      - over 20 virtual memory stress tests
-      stress-ng was originally intended to make a machine work hard and trip
-      hardware issues such as thermal overruns as well as operating system
-      bugs that only occur when a system is being thrashed hard.
+      stress-ng will stress test a computer system in various selectable ways. It
+      was designed to exercise various physical subsystems of a computer as well as
+      the various operating system kernel interfaces. Stress-ng features:
+
+        * over 210 stress tests
+        * over 50 CPU specific stress tests that exercise floating point, integer,
+          bit manipulation and control flow
+        * over 20 virtual memory stress tests
+        * portable: builds on Linux, Solaris, *BSD, Minix, Android, MacOS X,
+          Debian Hurd, Haiku, Windows Subsystem for Linux and SunOs/Dilos with
+          gcc, clang, tcc and pcc.
+
+      stress-ng was originally intended to make a machine work hard and trip hardware
+      issues such as thermal overruns as well as operating system bugs that only
+      occur when a system is being thrashed hard. Use stress-ng with caution as some
+      of the tests can make a system run hot on poorly designed hardware and also can
+      cause excessive system thrashing which may be difficult to stop.
+
+      stress-ng can also measure test throughput rates; this can be useful to observe
+      performance changes across different operating system releases or types of
+      hardware. However, it has never been intended to be used as a precise benchmark
+      test suite, so do NOT use it in this manner.
     '';
-    homepage = https://kernel.ubuntu.com/~cking/stress-ng/;
-    downloadPage = https://kernel.ubuntu.com/~cking/tarballs/stress-ng/;
+    homepage = "https://kernel.ubuntu.com/~cking/stress-ng/";
+    downloadPage = "https://kernel.ubuntu.com/~cking/tarballs/stress-ng/";
+    changelog = "https://kernel.ubuntu.com/git/cking/stress-ng.git/plain/debian/changelog?h=V${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ c0bw3b ];
-    platforms = platforms.linux; # TODO: fix https://github.com/NixOS/nixpkgs/pull/50506#issuecomment-439635963
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index adca2983fe5..a395066ee58 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1762,6 +1762,8 @@ in
 
   shab = callPackage ../tools/text/shab { };
 
+  shell-hist = callPackage ../tools/misc/shell-hist { };
+
   simg2img = callPackage ../tools/filesystems/simg2img { };
 
   snipes = callPackage ../games/snipes { };
@@ -2032,6 +2034,8 @@ in
 
   checkinstall = callPackage ../tools/package-management/checkinstall { };
 
+  chit = callPackage ../development/tools/chit { };
+
   chkrootkit = callPackage ../tools/security/chkrootkit { };
 
   chrony = callPackage ../tools/networking/chrony { };
@@ -2658,14 +2662,22 @@ in
   elk6Version = "6.7.2";
   elk7Version = "7.0.1";
 
-  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix { };
-  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix { };
+  elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix {
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix {
+    utillinux = utillinuxMinimal;
+  };
   elasticsearch6-oss = callPackage ../servers/search/elasticsearch/6.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
+  };
+  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix {
+    utillinux = utillinuxMinimal;
   };
-  elasticsearch7 = callPackage ../servers/search/elasticsearch/7.x.nix { };
   elasticsearch7-oss = callPackage ../servers/search/elasticsearch/7.x.nix {
     enableUnfree = false;
+    utillinux = utillinuxMinimal;
   };
   elasticsearch = elasticsearch6;
   elasticsearch-oss = elasticsearch6-oss;
@@ -4517,6 +4529,8 @@ in
     withMinimal = false;
   };
 
+  mkclean = callPackage ../applications/video/mkclean {};
+
   mkcue = callPackage ../tools/cd-dvd/mkcue { };
 
   mkp224o = callPackage ../tools/security/mkp224o { };
@@ -8748,13 +8762,16 @@ in
 
   bam = callPackage ../development/tools/build-managers/bam {};
 
-  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix { };
+  bazel_0_4 = callPackage ../development/tools/build-managers/bazel/0.4.nix {
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
+  };
   bazel = callPackage ../development/tools/build-managers/bazel {
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk8;
     buildJdkName = "jdk8";
     runJdk = jdk11;
+    stdenv = if stdenv.cc.isClang then llvmPackages_6.stdenv else stdenv;
   };
 
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
@@ -8816,6 +8833,8 @@ in
   buildkite-agent2 = callPackage ../development/tools/continuous-integration/buildkite-agent/2.x.nix { };
   buildkite-agent3 = callPackage ../development/tools/continuous-integration/buildkite-agent/3.x.nix { };
 
+  bpftool = callPackage ../os-specific/linux/bpftool { };
+
   byacc = callPackage ../development/tools/parsing/byacc { };
 
   cadre = callPackage ../development/tools/cadre { };
@@ -16422,7 +16441,7 @@ in
   stix-two = callPackage ../data/fonts/stix-two { };
 
   inherit (callPackages ../data/fonts/gdouros { })
-    symbola aegyptus akkadian anatolian maya unidings musica analecta textfonts aegan abydos;
+    aegan aegyptus akkadian assyrian eemusic maya symbola textfonts unidings;
 
   iana-etc = callPackage ../data/misc/iana-etc { };
 
@@ -21110,6 +21129,8 @@ in
 
   atanks = callPackage ../games/atanks {};
 
+  azimuth = callPackage ../games/azimuth {};
+
   ballAndPaddle = callPackage ../games/ball-and-paddle {
     guile = guile_1_8;
   };
@@ -21457,7 +21478,10 @@ in
 
   nethack = callPackage ../games/nethack { };
 
-  nethack-qt = callPackage ../games/nethack { qtMode = true; };
+  nethack-qt = callPackage ../games/nethack {
+    qtMode = true;
+    stdenv = gccStdenv;
+  };
 
   nethack-x11 = callPackage ../games/nethack { x11Mode = true; };
 
@@ -24006,8 +24030,10 @@ in
     stdenv = crossLibcStdenv;
     };
 
-	omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
+  omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
 
   wasmtime = callPackage ../development/interpreters/wasmtime {};
 
+  bemenu = callPackage ../applications/misc/bemenu { };
+
 }
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 2cbdd0aee5c..63886bac857 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -347,12 +347,12 @@ let
   };
 
   phpstan = mkDerivation rec {
-    version = "0.11.5";
+    version = "0.11.6";
     pname = "phpstan";
 
     src = pkgs.fetchurl {
       url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-      sha256 = "13akllfr5dav0y61i4ym5ww8z32ynwj5lpvsfiwx6z52avmcrc29";
+      sha256 = "016zm9ynh0zi40kclvzql7zxs3pl69cacln2c7n3gsicpswr0qa4";
     };
 
     phases = [ "installPhase" ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c8026ced43..d9ebd75b5c1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -665,6 +665,8 @@ in {
 
   py-lru-cache = callPackage ../development/python-modules/py-lru-cache { };
 
+  py-radix = callPackage ../development/python-modules/py-radix { };
+
   pydbus = callPackage ../development/python-modules/pydbus { };
 
   pydocstyle = callPackage ../development/python-modules/pydocstyle { };
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index acccd155e08..339973f0574 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -31,7 +31,7 @@ let
     buildPackages.gcc = nativePlatforms;
     coreutils = nativePlatforms;
     haskell.packages.ghcHEAD.hello = nativePlatforms;
-    haskell.packages.ghc844.hello = nativePlatforms;
+    haskellPackages.hello = nativePlatforms;
   };
 
   linuxCommon = lib.recursiveUpdate gnuCommon {