Merge remote-tracking branch 'upstream/master' into staging

Conflicts:
	pkgs/build-support/fetchbower/default.nix
	pkgs/build-support/fetchdarcs/default.nix
	pkgs/build-support/fetchgx/default.nix
	pkgs/development/python-modules/botocore/default.nix
	pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
	pkgs/tools/admin/awscli/default.nix

22 files changed, 73 insertions, 59 deletions

diff --git a/pkgs/build-support/docker/pull.nix b/pkgs/build-support/docker/pull.nix
index 5ccd0a41c5e49..5611c77858624 100644
--- a/pkgs/build-support/docker/pull.nix
+++ b/pkgs/build-support/docker/pull.nix
@@ -14,7 +14,7 @@ let
 
       builder = ./pull.sh;
 
-      buildInputs = [ curl utillinux docker kmod dhcp cacert e2fsprogs ];
+      nativeBuildInputs = [ curl utillinux docker kmod dhcp cacert e2fsprogs ];
 
       outputHashAlgo = "sha256";
       outputHash = sha256;
diff --git a/pkgs/build-support/fetchbower/default.nix b/pkgs/build-support/fetchbower/default.nix
index ba1c8420e91c6..fd971d431df88 100644
--- a/pkgs/build-support/fetchbower/default.nix
+++ b/pkgs/build-support/fetchbower/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, bower2nix, cacert }:
+{ stdenvNoCC, lib, bower2nix, cacert }:
 let
   bowerVersion = version:
     let
@@ -9,7 +9,7 @@ let
 
   cleanName = name: lib.replaceStrings ["/" ":"] ["-" "-"] name;
 
-  fetchbower = name: version: target: outputHash: stdenv.mkDerivation {
+  fetchbower = name: version: target: outputHash: stdenvNoCC.mkDerivation {
     name = "${cleanName name}-${bowerVersion version}";
     buildCommand = ''
       fetch-bower --quiet --out=$PWD/out "${name}" "${target}" "${version}"
@@ -22,7 +22,7 @@ let
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     inherit outputHash;
-    buildInputs = [ cacert bower2nix ];
+    nativeBuildInputs = [ bower2nix cacert ];
   };
 
 in fetchbower
diff --git a/pkgs/build-support/fetchbzr/default.nix b/pkgs/build-support/fetchbzr/default.nix
index dd2c0363187ac..f9250de4ee07e 100644
--- a/pkgs/build-support/fetchbzr/default.nix
+++ b/pkgs/build-support/fetchbzr/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, bazaar }: 
+{ stdenvNoCC, bazaar }:
 { url, rev, sha256 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "bzr-export";
 
   builder = ./builder.sh;
-  buildInputs = [ bazaar ];
+  nativeBuildInputs = [ bazaar ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchcvs/default.nix b/pkgs/build-support/fetchcvs/default.nix
index d4c88ca6d15ef..9d9deb3f629ec 100644
--- a/pkgs/build-support/fetchcvs/default.nix
+++ b/pkgs/build-support/fetchcvs/default.nix
@@ -3,14 +3,14 @@
 # tag="<tagname>" (get version by tag name)
 # If you don't specify neither one date="NOW" will be used (get latest)
 
-{stdenv, cvs}:
+{stdenvNoCC, cvs}:
 
 {cvsRoot, module, tag ? null, date ? null, sha256}:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "cvs-export";
   builder = ./builder.sh;
-  buildInputs = [cvs];
+  nativeBuildInputs = [cvs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchdarcs/default.nix b/pkgs/build-support/fetchdarcs/default.nix
index 48d87cc5d1083..3b965b06662c3 100644
--- a/pkgs/build-support/fetchdarcs/default.nix
+++ b/pkgs/build-support/fetchdarcs/default.nix
@@ -1,14 +1,14 @@
-{stdenv, darcs, nix, cacert}:
+{stdenvNoCC, darcs, nix, cacert}:
 
 {url, rev ? null, context ? null, md5 ? "", sha256 ? ""}:
 
 if md5 != "" then
   throw "fetchdarcs does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "fetchdarcs";
   builder = ./builder.sh;
-  buildInputs = [cacert darcs];
+  nativeBuildInputs = [cacert darcs];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchegg/default.nix b/pkgs/build-support/fetchegg/default.nix
index 41d2c936e01e4..746af9e27375d 100644
--- a/pkgs/build-support/fetchegg/default.nix
+++ b/pkgs/build-support/fetchegg/default.nix
@@ -1,16 +1,16 @@
 # Fetches a chicken egg from henrietta using `chicken-install -r'
 # See: http://wiki.call-cc.org/chicken-projects/egg-index-4.html
 
-{ stdenv, chicken }:
+{ stdenvNoCC, chicken }:
 { name, version, md5 ? "", sha256 ? "" }:
 
 if md5 != "" then
   throw "fetchegg does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "chicken-${name}-export";
   builder = ./builder.sh;
-  buildInputs = [ chicken ];
+  nativeBuildInputs = [ chicken ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -20,6 +20,6 @@ stdenv.mkDerivation {
 
   eggName = name;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 }
 
diff --git a/pkgs/build-support/fetchfossil/default.nix b/pkgs/build-support/fetchfossil/default.nix
index 439c96019a414..27933b47178a6 100644
--- a/pkgs/build-support/fetchfossil/default.nix
+++ b/pkgs/build-support/fetchfossil/default.nix
@@ -5,7 +5,7 @@
 stdenv.mkDerivation {
   name = "fossil-archive" + (if name != null then "-${name}" else "");
   builder = ./builder.sh;
-  buildInputs = [fossil];
+  nativeBuildInputs = [fossil];
 
   # Envvar docs are hard to find. A link for the future:
   # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
diff --git a/pkgs/build-support/fetchgit/default.nix b/pkgs/build-support/fetchgit/default.nix
index 8e060b87ebd30..9fccc27ef6322 100644
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -1,6 +1,6 @@
-{stdenv, git, cacert}: let
+{stdenvNoCC, git, cacert}: let
   urlToName = url: rev: let
-    inherit (stdenv.lib) removeSuffix splitString last;
+    inherit (stdenvNoCC.lib) removeSuffix splitString last;
     base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
 
     matched = builtins.match "(.*).git" base;
@@ -48,11 +48,11 @@ assert deepClone -> leaveDotGit;
 if md5 != "" then
   throw "fetchgit does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   inherit name;
   builder = ./builder.sh;
   fetcher = "${./nix-prefetch-git}";  # This must be a string to ensure it's called with bash.
-  buildInputs = [git];
+  nativeBuildInputs = [git];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -62,7 +62,7 @@ stdenv.mkDerivation {
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars ++ [
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars ++ [
     "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
 
diff --git a/pkgs/build-support/fetchgit/private.nix b/pkgs/build-support/fetchgit/private.nix
index a1dd9210e731c..4dcf6d06718af 100644
--- a/pkgs/build-support/fetchgit/private.nix
+++ b/pkgs/build-support/fetchgit/private.nix
@@ -17,7 +17,7 @@
       in builtins.toString sshConfigFile}'';
 
     ssh-wrapped = runCommand "fetchgit-ssh" {
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
     } ''
       mkdir -p $out/bin
       makeWrapper ${openssh}/bin/ssh $out/bin/ssh --prefix PATH : "$out/bin" --add-flags "-F ${config}" "$@"
diff --git a/pkgs/build-support/fetchgx/default.nix b/pkgs/build-support/fetchgx/default.nix
index 65061ce0f63e6..3ccf5d273fc5a 100644
--- a/pkgs/build-support/fetchgx/default.nix
+++ b/pkgs/build-support/fetchgx/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, gx, gx-go, go, cacert }:
+{ stdenvNoCC, gx, gx-go, go, cacert }:
 
 { name, src, sha256 }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "${name}-gxdeps";
   inherit src;
 
-  buildInputs = [ cacert go gx gx-go ];
+  nativeBuildInputs = [ cacert go gx gx-go ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index aba12317963ac..36a48ce9f1700 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -1,15 +1,15 @@
-{stdenv, mercurial, nix}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
+{stdenvNoCC, mercurial, nix}: {name ? null, url, rev ? null, md5 ? null, sha256 ? null, fetchSubrepos ? false}:
 
 if md5 != null then
   throw "fetchhg does not support md5 anymore, please use sha256"
 else
 # TODO: statically check if mercurial as the https support if the url starts woth https.
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "hg-archive" + (if name != null then "-${name}" else "");
   builder = ./builder.sh;
-  buildInputs = [mercurial];
+  nativeBuildInputs = [mercurial];
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 
   subrepoClause = if fetchSubrepos then "S" else "";
 
diff --git a/pkgs/build-support/fetchipfs/default.nix b/pkgs/build-support/fetchipfs/default.nix
index 196b3bebc9168..dc8949794221f 100644
--- a/pkgs/build-support/fetchipfs/default.nix
+++ b/pkgs/build-support/fetchipfs/default.nix
@@ -28,7 +28,7 @@ in
 if (!hasHash) then throw "Specify sha for fetchipfs fixed-output derivation" else stdenv.mkDerivation {
   name = ipfs;
   builder = ./builder.sh;
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   # New-style output content requirements.
   outputHashAlgo = if outputHashAlgo != "" then outputHashAlgo else
diff --git a/pkgs/build-support/fetchmtn/default.nix b/pkgs/build-support/fetchmtn/default.nix
index 1dc14e8cab13c..7ce67453d698b 100644
--- a/pkgs/build-support/fetchmtn/default.nix
+++ b/pkgs/build-support/fetchmtn/default.nix
@@ -1,5 +1,5 @@
 # You can specify some extra mirrors and a cache DB via options
-{stdenv, monotone, defaultDBMirrors ? [], cacheDB ? "./mtn-checkout.db"}:
+{stdenvNoCC, monotone, defaultDBMirrors ? [], cacheDB ? "./mtn-checkout.db"}:
 # dbs is a list of strings
 # each is an url for sync
 
@@ -8,7 +8,7 @@
 {name ? "mtn-checkout", dbs ? [], sha256
 , selector ? "h:" + branch, branch}:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   builder = ./builder.sh;
   nativeBuildInputs = [monotone];
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   dbs = defaultDBMirrors ++ dbs;
   inherit branch cacheDB name selector;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
 
 }
 
diff --git a/pkgs/build-support/fetchnuget/default.nix b/pkgs/build-support/fetchnuget/default.nix
index 62b700dd81b5d..40ba79ec4353f 100644
--- a/pkgs/build-support/fetchnuget/default.nix
+++ b/pkgs/build-support/fetchnuget/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, buildDotnetPackage, unzip }:
+{ stdenvNoCC, fetchurl, buildDotnetPackage, unzip }:
 
 attrs @
 { baseName
diff --git a/pkgs/build-support/fetchrepoproject/default.nix b/pkgs/build-support/fetchrepoproject/default.nix
index 199c029d3b649..f8793dbac9502 100644
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, gitRepo, cacert, copyPathsToStore }:
+{ stdenvNoCC, gitRepo, cacert, copyPathsToStore }:
 
 { name, manifest, rev ? "HEAD", sha256
 # Optional parameters:
@@ -9,7 +9,7 @@
 assert repoRepoRev != "" -> repoRepoURL != "";
 assert createMirror -> !useArchive;
 
-with stdenv.lib;
+with stdenvNoCC.lib;
 
 let
   extraRepoInitFlags = [
@@ -28,7 +28,7 @@ let
 
   local_manifests = copyPathsToStore localManifests;
 
-in stdenv.mkDerivation {
+in stdenvNoCC.mkDerivation {
   inherit name;
 
   inherit cacert manifest rev repoRepoURL repoRepoRev referenceDir; # TODO
@@ -44,7 +44,7 @@ in stdenv.mkDerivation {
     "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
 
-  buildInputs = [ gitRepo cacert ];
+  nativeBuildInputs = [ gitRepo cacert ];
 
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
diff --git a/pkgs/build-support/fetchs3/default.nix b/pkgs/build-support/fetchs3/default.nix
index a5cdbd150b8bc..e6b7a3418c0cf 100644
--- a/pkgs/build-support/fetchs3/default.nix
+++ b/pkgs/build-support/fetchs3/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, runCommand, awscli }:
+{ stdenvNoCC, runCommand, awscli }:
 
 { s3url
 , sha256
@@ -10,13 +10,13 @@
 }:
 
 let
-  credentialAttrs = stdenv.lib.optionalAttrs (credentials != null) {
+  credentialAttrs = stdenvNoCC.lib.optionalAttrs (credentials != null) {
     AWS_ACCESS_KEY_ID = credentials.access_key_id;
     AWS_SECRET_ACCESS_KEY = credentials.secret_access_key;
     AWS_SESSION_TOKEN = credentials.session_token ? null;
   };
 in runCommand "foo" ({
-  buildInputs = [ awscli ];
+  nativeBuildInputs = [ awscli ];
   outputHashAlgo = "sha256";
   outputHash = sha256;
   outputHashMode = if recursiveHash then "recursive" else "flat";
diff --git a/pkgs/build-support/fetchsvn/default.nix b/pkgs/build-support/fetchsvn/default.nix
index 8a1085affd3cb..da57d581daddc 100644
--- a/pkgs/build-support/fetchsvn/default.nix
+++ b/pkgs/build-support/fetchsvn/default.nix
@@ -1,9 +1,9 @@
-{stdenv, subversion, glibcLocales, sshSupport ? false, openssh ? null}:
+{stdenvNoCC, subversion, glibcLocales, sshSupport ? false, openssh ? null}:
 {url, rev ? "HEAD", md5 ? "", sha256 ? "",
  ignoreExternals ? false, ignoreKeywords ? false, name ? null}:
 
 let
-  repoName = with stdenv.lib;
+  repoName = with stdenvNoCC.lib;
     let
       fst = head;
       snd = l: head (tail l);
@@ -28,10 +28,10 @@ in
 if md5 != "" then
   throw "fetchsvn does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = name_;
   builder = ./builder.sh;
-  buildInputs = [ subversion glibcLocales ];
+  nativeBuildInputs = [ subversion glibcLocales ];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
@@ -39,6 +39,6 @@ stdenv.mkDerivation {
 
   inherit url rev sshSupport openssh ignoreExternals ignoreKeywords;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars;
   preferLocalBuild = true;
 }
diff --git a/pkgs/build-support/fetchsvnssh/default.nix b/pkgs/build-support/fetchsvnssh/default.nix
index a6f3d3469f09f..f76bd10247ba8 100644
--- a/pkgs/build-support/fetchsvnssh/default.nix
+++ b/pkgs/build-support/fetchsvnssh/default.nix
@@ -1,14 +1,14 @@
-{stdenv, subversion, sshSupport ? false, openssh ? null, expect}: 
+{stdenvNoCC, subversion, sshSupport ? false, openssh ? null, expect}: 
 {username, password, url, rev ? "HEAD", md5 ? "", sha256 ? ""}:
 
 
 if md5 != "" then
   throw "fetchsvnssh does not support md5 anymore, please use sha256"
 else
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "svn-export-ssh";
   builder = ./builder.sh;
-  buildInputs = [subversion expect];
+  nativeBuildInputs = [subversion expect];
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index 8dac273eb1ca9..3e47d4a4b6837 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, curl }: # Note that `curl' may be `null', in case of the native stdenv.
+{ stdenvNoCC, curl }: # Note that `curl' may be `null', in case of the native stdenvNoCC.
 
 let
 
@@ -10,7 +10,7 @@ let
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
   mirrorsFile =
-    stdenv.mkDerivation ({
+    stdenvNoCC.mkDerivation ({
       name = "mirrors-list";
       builder = ./write-mirror-list.sh;
       preferLocalBuild = true;
@@ -20,7 +20,7 @@ let
   # "gnu", etc.).
   sites = builtins.attrNames mirrors;
 
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars ++ [
+  impureEnvVars = stdenvNoCC.lib.fetchers.proxyImpureEnvVars ++ [
     # This variable allows the user to pass additional options to curl
     "NIX_CURL_FLAGS"
 
@@ -103,8 +103,8 @@ let
 in
 
 if md5 != "" then throw "fetchurl does not support md5 anymore, please use sha256 or sha512"
-else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenv.lib.concatStringsSep ", " urls_}"
-else stdenv.mkDerivation {
+else if (!hasHash) then throw "Specify hash for fetchurl fixed-output derivation: ${stdenvNoCC.lib.concatStringsSep ", " urls_}"
+else stdenvNoCC.mkDerivation {
   name =
     if showURLs then "urls"
     else if name != "" then name
@@ -112,7 +112,7 @@ else stdenv.mkDerivation {
 
   builder = ./builder.sh;
 
-  buildInputs = [ curl ];
+  nativeBuildInputs = [ curl ];
 
   urls = urls_;
 
diff --git a/pkgs/build-support/release/source-tarball.nix b/pkgs/build-support/release/source-tarball.nix
index 5e1785446441c..c7129ae83f928 100644
--- a/pkgs/build-support/release/source-tarball.nix
+++ b/pkgs/build-support/release/source-tarball.nix
@@ -123,7 +123,7 @@ stdenv.mkDerivation (
 
       # Tarball builds are generally important, so give them a high
       # default priority.
-      schedulingPriority = "200";
+      schedulingPriority = 200;
     };
   }
 
diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index 8c136d8648830..19cffcd9c14e6 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -2,7 +2,7 @@
 { name ? "cargo-deps", src, srcs, sourceRoot, sha256, cargoUpdateHook ? "" }:
 stdenv.mkDerivation {
   name = "${name}-vendor";
-  buildInputs = [ cacert cargoVendor git rust.cargo ];
+  nativeBuildInputs = [ cacert cargoVendor git rust.cargo ];
   inherit src srcs sourceRoot;
 
   phases = "unpackPhase installPhase";
diff --git a/pkgs/build-support/safe-discard-string-context.nix b/pkgs/build-support/safe-discard-string-context.nix
new file mode 100644
index 0000000000000..293a15295d554
--- /dev/null
+++ b/pkgs/build-support/safe-discard-string-context.nix
@@ -0,0 +1,14 @@
+# | Discard the context of a string while ensuring that expected path
+# validity invariants hold.
+#
+# This relies on import-from-derivation, but it is only useful in
+# contexts where the string is going to be used in an
+# import-from-derivation anyway.
+#
+# safeDiscardStringContext : String → String
+{ writeText }: s:
+  builtins.seq
+    (import (writeText
+               "discard.nix"
+               "${builtins.substring 0 0 s}null\n"))
+    (builtins.unsafeDiscardStringContext s)